Loss of control

Investigation summary

What happened

On the morning of 4 November 2023, a Gulfstream 695A, registered VH‑HPY, was being operated by AGAIR on an instrument flight rules flight from Toowoomba to Mount Isa, Queensland. On board the aircraft were the pilot and 2 camera operators. The purpose of the flight was to conduct line scanning of fire zones located north of Mount Isa. 

About 1 hour and 50 minutes into the flight, while the aircraft was in cruise at flight level 280, air traffic control (ATC) lost radio contact with the pilot. Over the following 30 minutes, ATC made multiple attempts to re‑establish contact, including using alternate frequencies and relaying messages via other aircraft in the vicinity. VH-HPY was observed diverging from track and ATC declared an uncertainty phase for the aircraft.

About 20 minutes later, ATC called the pilot’s mobile telephone, and a brief conversation took place. During the conversation, the pilot’s speech was observed as slow and flat. In response, ATC upgraded the aircraft’s status to an alert phase and initiated their hypoxic pilot emergency procedures. About 10 minutes later, the crew of a nearby aircraft was able to establish contact with the pilot, having been requested to do so by ATC. The alert phase was downgraded to an uncertainty phase and, a short time later, ATC re-established direct contact with the pilot. The uncertainty phase was cancelled 1 minute later.

The pilot confirmed that their oxygen system was operating normally, and they were issued a clearance to undertake line scanning north of Mount Isa. Over the following 4 minutes, the pilot repeated the clearance from ATC 4 times, seeming uncertain about the status of the clearance. The radio recordings during this period indicate that the pilot’s rate and volume of speech had substantially lowered from earlier communications and was worsening. The pilot’s final radio transmission displayed the slowest speaking rate of all their communications during the flight and contained stuttering and operational mistakes. Air traffic control did not attempt to re‑establish contact with the pilot until about 18 minutes later, however no further responses from the pilot were received. 

A short time later, the aircraft departed controlled flight, initially entering a descending anticlockwise turn with an increasing rate of descent. At about 10,500 ft, the aircraft likely transitioned into an aerodynamic spin, with a subsequent average rate of descent of about 13,500 ft/min. The aircraft collided with terrain 55 km south-east of Cloncurry. The 3 occupants were fatally injured, and the aircraft was destroyed by impact forces and a fuel-fed post-impact fire.

What the ATSB found

The ATSB found that the aircraft had a long-term intermittent defect with the pressurisation system that would manifest as a reduced maximum attainable cabin differential pressure. The defect was known about by senior AGAIR management who attempted to have the defect rectified. However, they did not formally record the defect, communicate it to the safety manager, undertake a formal risk assessment of the issue, or provide explicit procedures to pilots for managing it. 

Instead, AGAIR management personnel participated in and encouraged the practice of continuing operations in the aircraft at a cabin altitude that required the use of oxygen, without access to a suitable oxygen supply. This included the pilot of the accident flight, with emails and historical flight data indicating they had a pattern of normalised deviation from safe operating practices by continuing to operate the aircraft when the pressurisation system was defective. In these situations, the pilot was found to have managed the effects of hypoxia by undertaking short descents to lower altitudes and use of the aircraft’s oxygen system, which was designed for emergency use only.

It was identified that during the accident flight the pressurisation system probably did not maintain the required cabin altitude, and the pilot probably continued the flight using the aircraft’s oxygen system, which was unsuitable for this purpose. The pilot’s speech, as captured by air traffic control recordings, demonstrated significant and progressive impairment while the aircraft was operating at about flight level 280. This impairment was consistent with altitude hypoxia, which almost certainly significantly degraded the pilot’s ability to safely operate the aircraft.

While the aircraft was in cruise, both power levers were probably reduced without a descent being initiated, resulting in a progressive reduction of airspeed. The aircraft then entered a descending anticlockwise turn with an increasing rate of descent. At around 10,500 ft control input(s) were almost certainly made, probably an attempt to recover, that transitioned the aircraft from a high‑speed descent to an unrecoverable spin condition that continued until the impact with terrain. 

It was found that the AGAIR head of flying operations (HOFO) did not communicate critical safety information about the known intermittent pressurisation defect when they were phoned by air traffic control about concerns that the pilot was impacted by hypoxia around 37 minutes before the collision. This took place at a time when air traffic control could have taken action to instruct the pilot to descend to a safe altitude. 

Air traffic control personnel involved therefore had no knowledge of the aircraft pressurisation defect from that phone call, and without establishing with the pilot why they had not responded to ATC broadcasts for 1 hour and 13 minutes, they likely reduced their vigilance about hypoxia after being told by the pilot that operations were normal. Consequently, ATC did not re-identify the possibility of hypoxia during the subsequent progressive deterioration of the pilot’s speech. Additionally, the air traffic control ‘hypoxic pilot emergency checklist’ contained no guidance on ceasing the emergency response, which increased the risk of inappropriately downgrading the response during a developing hypoxic scenario. 

It was also identified that AGAIR Gulfstream 690 and 695 aircraft were operated with known defects without being recorded on the aircraft’s maintenance releases, likely as a routine practice. This issue had been reported to CASA in 2019 and a surveillance event was conducted in response. The scope of the surveillance event did not include a crosscheck of maintenance releases against the aircraft logbooks, limiting the ability to determine whether any non-reporting and improper deferral of defects had been taking place at that time.

What has been done as a result

AGAIR amended the organisation’s procedural documentation to provide greater detail on the delegation of management responsibilities, maximum cabin altitude requirements, defect reporting, and the capture of cabin pressure information as part of daily aircraft flight and fuel logs. 

AGAIR also incorporated pressurisation, oxygen and line scanning hazards within the organisation’s hazard register. AGAIR has also contracted a continuing airworthiness management organisation and appointed a new head of aircraft airworthiness maintenance control to monitor defect reporting. 

While the ATSB recognises the changes implemented by AGAIR to date, the actions taken do not address the matters raised relating to effective operational control. The HOFO was responsible for ensuring the operation was compliant with aviation legislation and conformed to company standards. However, the ATSB found multiple instances where these requirements were not met. AGAIR has not addressed how the organisation intends to assure future legislative and procedural compliance by line pilots and management personnel. As such, the ATSB has issued a formal safety recommendation to AGAIR to initiate an independent review of their organisational structure and oversight of operational activities to assure ongoing effective operational control by management.

Airservices Australia advised that it is in the process of conducting a review of the hypoxia in-flight emergency response checklist.

Safety message

This accident highlights the dangers of operational practices that intentionally circumvent critical safety defences. The acceptance of these actions at an individual and organisational level normalises that behaviour and exposes the operation to an unnecessarily increased level of risk. 

This accident also underscores the insidious and deadly potential of altitude hypoxia, and pilots need to be alert to this significant hazard when operating at high altitude. Life support and emergency alerting systems are often the final line of defence against hypoxic incapacitation, and they should only be used in accordance with the manufacturer’s procedures. 

Summary video

The occurrence

Overview

On the morning of 4 November 2023, a Gulfstream 695A, registered VH‑HPY, was being operated by AGAIR on an instrument flight rules[1] flight from Toowoomba to Mount Isa, Queensland, with the callsign ‘birddog 370’. On board the aircraft were the pilot and 2 camera operators. The purpose of the flight was to conduct line scanning[2] of fire zones located north of Mount Isa. The flight had been contracted by Queensland Fire and Emergency Services and was conducted as an aerial work operation.

While the aircraft was in cruise at flight level[3] (FL) 280, air traffic control (ATC) radio contact with the pilot was unable to be maintained. ATC made multiple attempts to re-establish radio communications, but these were initially unsuccessful. ATC also declared an uncertainty phase for the aircraft, later upgrading it to an alert phase. After about 1 hour, the crew of a Royal Australian Air Force (RAAF) aircraft was able to make radio contact with the pilot, and ATC re-established communications a short time later. The alert and uncertainty phases were subsequently cancelled.

A series of radio communications were exchanged between the pilot and ATC, during which the pilot was issued a clearance to undertake line scanning north of Mount Isa. The pilot did not respond to any further calls from ATC. The aircraft departed controlled flight and at 1427 (local time) collided with terrain 55 km south-east of Cloncurry (Figure 1). The 3 occupants were fatally injured, and the aircraft was destroyed.

Figure 1: Flight path overview 

Source: Google Earth, annotated by the ATSB

Departure, climb and cruise

At 1055 on the morning of the accident flight, the aircraft departed Toowoomba Airport with the pilot being provided an ATC clearance for the flight to track to Mount Isa. The pilot was initially cleared by ATC to climb to FL160 and was then issued further instruction to continue the climb to the planned cruise of FL280. The pilot made a brief personal phone call at about 1103 (see Telecommunications), and the aircraft reached FL280 at 1120:30 (Figure 2).

Figure 2: Plot of changes in aircraft altitude and the sequence of radio communication events throughout the accident flight from 1045–1300  

Position information including altitude and time was obtained from ADS-B data that was broadcast from VH-HPY. Source: ATSB

At 1126:55 the flight was transferred to, and the pilot established radio communication with, the controller responsible for the Simpson region on the frequency 126.0 MHz (see Airspace). 

At 1141:12, the pilot contacted the controller and requested clearance to descend to FL150. The requested clearance was provided and, a short time later, the aircraft started to descend. The initial rate of descent reached about 3,900 feet per minute (ft/min), but this slowed as the aircraft continued to descend. At 1151:49, the aircraft levelled off at FL150. At 1157:43, the pilot contacted the controller again and requested clearance to climb back to FL280, which was approved. Shortly after, the aircraft began to climb.

At 1210:19, the Simpson region controller requested the pilot change their radio communication frequency to 122.3 MHz, to maintain radio contact with ground equipment as the aircraft flew further west. The pilot established radio communication on the new frequency and reported to the controller that the aircraft was on climb to FL280. At 1221:49, the aircraft levelled off at FL280. 

At 1245:51, the Simpson region controller requested the pilot change their radio communication frequency to 122.1 MHz as the aircraft continued its journey to the northwest. This change was acknowledged by the pilot, but the controller did not receive radio communications from the flight on the newly-assigned frequency. 

Initial loss of radio communications

Between 1247:51 and 1317:48, the Simpson region controller made 12 separate radio broadcasts attempting to re-establish radio communication with the pilot. The controller also attempted to contact the pilot on high frequency radio, and by relaying messages via the flight crew of a passenger transport aircraft that was operating in the vicinity of VH-HPY. 

During this time the controller identified that VH-HPY was diverging from track, by about 2 km laterally, and the shift manager (SM) was informed (see Air traffic services). At 1318:20, ATC declared an uncertainty phase (INCERFA)[4] (see Emergency phases) and the air traffic management director (ATMD) was made aware of the developing situation (Figure 3). 

Figure 3: Sequence of ATC actions and communication events between 1300–1430

Position information including altitude and time was obtained from ADS-B data that was broadcast from VH-HPY. Source: ATSB

At 1337:46, the ATMD attempted to contact the pilot using the mobile telephone number listed on the flight plan, but the pilot did not answer the call. At 1338:36, the pilot returned the ATMD’s phone call, and they had a brief conversation during which the pilot advised that they had ‘no joy’ on radio frequency 122.4 MHz, rather than the instructed frequency of 122.1 MHz (see Telecommunications). The ATMD determined that the pilot’s speech was ‘slower’ than normal and ‘flat’, and these concerns were shared with the SM at the conclusion of the call. At 1340:00, the INCEFRA was upgraded to an alert phase (ALERFA)[5] (see Emergency phases) and the hypoxic pilot in-flight emergency response (IFER) checklist was initiated (see Hypoxic pilot procedures). 

At 1340:15, the controller commenced radio broadcasts to the pilot as part of the IFER hypoxia checklist. These transmissions included the instructions:

- Oxygen, oxygen, oxygen, descend to one zero thousand feet. 

At the same time, the ATMD called the pilot’s mobile phone, but the pilot did not answer. The ATMD left a voicemail message requesting the pilot check their oxygen and call back ATC. 

At 1341:11, the crew of a RAAF aircraft that was in the vicinity of VH-HPY offered to assist the controller to contact the pilot. The controller agreed and a short time later the RAAF crew reported hearing a broken transmission, possibly from VH-HPY, but they were unable to establish contact with the pilot.

At 1341:31, the pilot of VH-HPY transmitted a radio broadcast on frequency 122.1 MHz, providing callsign, flight level, and radio frequency, but the controller was unable to re-establish 2-way communications. Between 1341:31 and 1350:51, the controller continued to broadcast instruction for the pilot to descend the aircraft to 10,000 ft. The controller also attempted further relays via other aircraft in the vicinity of VH‑HPY on various frequencies, including the international air distress frequency 121.5 MHz. 

At about 1348:00, ATC sent 2 text messages to the pilot’s mobile phone and an email requesting they check their oxygen and pressurisation and contact them on frequency 122.1 MHz. No response was received. 

Re-establishment of radio communications

At 1349:13, the crew of the RAAF aircraft advised the controller that they had heard a ‘weak’ transmission from the pilot of VH-HPY on frequency 118.6 MHz. In response, the controller requested the crew of the RAAF aircraft make another broadcast to include the statement ‘oxygen, oxygen, oxygen descend to one zero thousand feet’. The crew of the RAAF aircraft made 2 such broadcasts and, at about 1350, they established contact with the pilot of VH-HPY. 

During this time, the ATMD and SM telephoned the AGAIR head of flying operations (HOFO), advising that contact had been lost with the pilot of VH-HPY and that they suspected the pilot was potentially affected by hypoxia (see Telecommunications).

At 1350:50 the crew of the RAAF aircraft relayed to the controller that VH‑HPY was ‘ops normal’ and maintaining FL280. ATC subsequently downgraded the ALERFA to an INCERFA. At 1351:08, the controller requested that the RAAF crew instruct the pilot to call ATC on frequency 123.95 MHz. At 1351:59, the controller re-established radio communications with the pilot of VH‑HPY on this frequency and the pilot reported ‘ops normal’. About 1 minute later, ATC cancelled the INCERFA phase.

Between 1352:08 and 1357:34, several communications took place between the controller and the pilot. During this time, and 2 minutes after ATC had cancelled the INCERFA phase, the controller asked the pilot ‘just confirm your oxygen system is ops normal’, to which the pilot responded ‘affirm’. The controller later recalled that they had asked about the oxygen system because they had concerns there was a potential hypoxia event and wanted the pilot to look at the oxygen system in case there was a problem. The ATMD recalled that they requested the controller query the status of the oxygen system as a ‘surety check’. The controller recalled that the pilot’s speech at that time was ‘clear and concise’, and they were satisfied with the pilot’s delivery of speech.

At 1357:34, the pilot was provided with an ATC clearance to undertake operations near Mount Gordon. ATC communication recordings showed that the pilot confirmed the clearance at 1357:43, and then twice requested confirmation that the controller had copied their clearance readback (1359:26 and 1400:15). The controller then responded at 1400:19, advising the pilot that the communications were at low strength and could the pilot adjust their microphone. The pilot replied at 1400:57 and the controller then confirmed they had received the pilot’s confirmation of the clearance. At 1401:23 the pilot then confirmed the clearance again. The controller recalled that, during this time, a lot of activity took place near their console related to the status of the aircraft (see Simpson region controller divided attention). 

The radio recordings indicate that the pilot’s rate and volume of speech had substantially decreased from earlier communications and were worsening. During the radio transmission that commenced at 1401:23 the pilot had difficulty pronouncing the location ‘Cloncurry’ and they incorrectly stated the airwork would take place near ‘Mount Ball’, which was then corrected to ‘Gordon’. 

At 1419:19, the controller requested the pilot change frequency to 122.4 MHz, but no response was received. Between 1419:19 and 1427:15 the controller attempted to contact the pilot 8 times without receiving a response.

Departure from controlled flight

Recorded data indicated that, at 1423:20, the aircraft’s airspeed began to reduce from a cruise airspeed of about 236 KTAS.[6] At 1425:25, the airspeed had decreased to about 138 KTAS and the aircraft departed controlled flight (see Flight performance analysis). The aircraft initially entered a descending anticlockwise[7] turn with an increasing rate of descent. At an altitude of about 10,500 ft, the aircraft transitioned into a tight clockwise helical descent, likely an aerodynamic spin,[8] with a subsequent average rate of descent of about 13,500 ft/min (Figure 4). 

Figure 4: Flight path of VH-HPY during the descent from FL280

Source: Google Earth, annotated by the ATSB

Two witnesses at a nearby mining facility observed the aircraft descending in a nose-down, clockwise, corkscrew motion and described hearing a ‘whirring’ noise. The witnesses recalled that motion momentarily stopped part way down, before re-entering the nose-down corkscrew descent.

At about 1427:15, the aircraft collided with terrain 55 km south-east of Cloncurry. The 3 occupants were fatally injured, and the aircraft was destroyed by impact forces and a fuel-fed post-impact fire.

Context

Personnel information

Pilot

Aeronautical experience 

The pilot held an air transport pilot licence (aeroplane) and a commercial pilot licence (helicopter), issued in February 2005 and August 2009, respectively. At the time of the accident, the pilot had accumulated about 4,900 hours total aeronautical experience, which included about 3,200 hours operating turboprop, jet, and high-performance Royal Australian Air Force (RAAF) military aircraft. This included unpressurised aircraft with supplemental oxygen systems (Pilatus PC-9) and pressurised aircraft (Beechcraft B200 and Learjet L35/36). Training records provided by the RAAF indicated the pilot had completed 2 altitude chamber training exercises,[9] one in 1995 and the second in 2019.

Gulfstream 695A training and experience

In August 2023, the pilot commenced work with AGAIR. They had not previously flown a Gulfstream 695A. 

On 15 August 2023, the pilot undertook Gulfstream 695A training and completed a flight review the following day. This training was arranged by AGAIR, and undertaken in VH-HPY, but the training and review were conducted by an independent training provider. 

During the training, the pilot demonstrated competent use of the aircraft systems including management of the pressurisation system. The pilot also conducted a simulated depressurisation scenario from FL150, which involved the use of oxygen and an emergency descent. The training notes made by the instructor about the pilot’s performance during this activity stated:

Emergency descent - best initiated with roll, using the secondary effect (yaw) to pitch the nose down to the required attitude without causing negative load factor. 

The training and flight review were completed within 2.9 hours of flight time and the pilot was assessed by the instructor as competent to operate the aircraft type as pilot in command (PIC). The pilot commenced flying as PIC for AGAIR on 28 September 2023 and they were initially supervised by the AGAIR chief operating officer (COO) over ‘3 or 4 flights’ (see AGAIR chief operating officer actions). There was no training file kept on the pilot’s performance during the supervised flights. 

In the 3 months after starting with the operator until the accident, they had accumulated a total of about 102 hours flight time, all flying VH-HPY mostly undertaking line scanning flights from Toowoomba.

After review of the draft ATSB investigation report the operator provided a record indicating the pilot of the accident flight completed a ‘line check’ flight in VH-HPY on 9 August 2023 with the AGAIR head of flying operations (HOFO). 

Medical information

The pilot held a class 1 aviation medical certificate that was issued on 27 February 2023 and was valid at the time of the accident. Their certificate had a restriction requiring reading correction to be available while exercising the privileges of their licence. The pilot’s aviation medical records were provided for the period 2022–2023 and their general practitioner records were provided for the period 2021–2023. Overall, these records indicated no significant medical conditions or abnormal physical findings. 

At the time of the accident, the pilot was taking medication for high cholesterol. In 2019 they underwent a coronary angiography, which showed no calcium and no soft plaque formation. The pilot had also visited a cardiologist in December 2021 due to family history, and undertook a stress electrocardiogram in November 2022, which identified no issues. In April 2023, the pilot injured their Achilles tendon and underwent surgical repair. The injury was reported to the Civil Aviation Safety Authority (CASA) on 18 April 2023, and the pilot was cleared to resume flying duties on 22 May 2023. The pilot was reported to have recovered well from their Achilles injury. Overall, the pilot was reported to have been fit, active and healthy, with no known stressors. 

Recent history

The pilot had 8 duty free days prior to the commencement of their most recent period of duty. This period started on 1 November 2023. They conducted a 1.3 hour flight from Essendon, Victoria, to Hay, New South Wales, on 1 November, and a 3.7 hour flight from Hay to Toowoomba on 2 November.

The pilot was reported to have gone to bed at around 2030–2100 the night prior to the accident and was known to wake early and undertake morning exercise. The collision with terrain occurred mid-afternoon after they had been flying about 3.5 hours that day. The ATSB reviewed their recent work-rest history and based on the available evidence, it was considered very unlikely that the pilot was experiencing a level of fatigue known to adversely affect performance.

Camera operator 1

Aeronautical experience

Camera operator 1 joined AGAIR in July 2021. They were not employed as a pilot by the organisation, but they held a commercial pilot licence (aeroplane), issued in February 2020. At the time of the accident, they had about 434 hours total aeronautical experience, including 72 hours on multi-engine piston aircraft.

Medical

Camera operator 1 held a class 1 aviation medical certificate that was issued on 14 November 2022 with no restriction. The medical certificate was valid at the time of the accident. Their aviation medical records were provided for the period 2021–2022. These examinations indicated no significant medical conditions or abnormal physical findings. Camera operator 1 was reported to be in ‘very good health’ with no known medical conditions.

Camera operator 2 

Aeronautical experience

Camera operator 2 was a United States citizen who had experience in the construction and operation of the imaging system fitted to VH-HPY (see Aerial survey camera system). They joined AGAIR in October 2023, and had conducted 5 line scanning flights in VH-HPY prior to the accident flight. They did not hold a flight crew licence, but they had received about 4 hours instructional flight training in the year prior to the accident. 

Medical

Camera operator 2 did not hold an aviation medical certificate, nor were they required to. They were reported to be ‘very healthy’ with no known medical conditions.

Post-mortem and toxicology 

Autopsy results

The post-mortem examinations determined that the occupants of the aircraft had sustained multiple injuries during impact that proved fatal. The results of the examinations did not indicate any significant natural disease that could have contributed to the accident. However, the examinations were limited due to the nature of the impact and resulting fire. There were no indications that the occupants of the aircraft had inhaled products of combustion.

Toxicology results

Toxicology testing was conducted and no drugs were detected, however the validity of the testing was degraded due to changes that occur post-mortem. Alcohol and carbon monoxide testing could not be completed using the samples obtained. 

Aircraft information

General information

The Gulfstream 695A is a high-wing, pressurised, twin-engine aircraft powered by 2 Garrett TPE331-10-511K turboprop engines. The aircraft was designed as a business and personal aircraft with seating capacity of up to 11 people.

The accident aircraft, serial number 96051, was manufactured in 1982 and in January 1983 commenced operations in South Africa. During this time the aircraft’s air conditioning system was replaced with an approved alternative system.[10] In 2014, prior to the aircraft being exported to Australia, the aircraft underwent refurbishment, which included a new avionics suite and interior, and the aircraft was repainted. Additionally, the original Dowty Rotol propellers were replaced with Hartzell propellers under a supplemental type certificate.[11]

The aircraft was first registered in Australia as VH-HPY on 11 November 2014. Its registration was held by AGAIR since 14 September 2016 and was initially used for birddog flights[12] (Figure 5). 

The aircraft was configured with 2 crew seats, 4 passenger seats, and a bench seat in the rear. The last periodic inspection was completed on 1 November 2023. At this time, the aircraft had accumulated 7,566.1 hours total time in service.

Figure 5: VH-HPY August 2023

Source: Cameron Marchant

Aircraft systems

Aerial survey camera system

To expand its operational capabilities, AGAIR elected to modify VH-HPY to undertake aerial surveys of natural disasters such as bushfire and flood by fitting an Overwatch Imaging TK‑7 camera system. 

To modify the aircraft, AGAIR engaged an approved aircraft design organisation to prepare the engineering order,[13] and the installation was carried out by General Aviation Maintenance (GAM). Work on the modification began in June 2021 and had been partially completed when the aircraft recommenced operations in August 2021. In November 2021, VH‑HPY returned to GAM and the modification was completed and certified on the maintenance release.[14] The engineering order, associated drawings, and a flight manual supplement specific to VH-HPY, were approved by the aircraft design organisation in February 2022.

Pressurisation system

Generally, aircraft that are intended to be operated at altitudes over 10,000 ft are equipped with a pressurisation system. As the aircraft climbs, the air pressure outside the cabin decreases, and at the same time the aircraft’s pressurisation system maintains the pressure inside the cabin to a level that allows normal breathing (without the use of supplemental oxygen). The environment maintained by the pressurisation system is known as the cabin altitude. The difference between the pressure inside the cabin and the pressure outside the cabin is known as cabin differential pressure. Pressurised aircraft have a stipulated maximum differential pressure because of the loads that pressurisation places on an aircraft’s fuselage.

The Gulfstream 695A is pressurised by ducting air from both engines (known as bleed air) into the cabin and controlling its flow overboard via outflow safety valves to maintain the desired cabin pressure. The source of bleed air can be selected within the cockpit. A cabin pressure controller, also located within the cockpit, is used to manage the cabin pressure from take-off, through climb, cruise, and descent. The controller also prevents exceedance of the maximum differential pressure of 6.8 psi (see Appendix A – Gulfstream 695A systems information). The Gulfstream 695A is certified to operate up to 35,000 ft above mean sea level. At this altitude, and at the maximum differential pressure, the cabin altitude would be 9,600 ft. The pilot’s operating handbook (POH) requires the pilot to ‘limit flight altitude to maintain 10,000 ft cabin altitude’ should the cabin altitude exceed the selected value.

Figure 6: VH-HPY cockpit layout 

Note: Image captured prior to the accident. Source: Cameron Marchant, annotated by the ATSB

The Gulfstream 695A is fitted[15] with a cabin altitude visual and aural warning system that activates when the cabin altitude is at or above 11,000 ft (±500 ft) (Figure 6). When activated, ‘CABIN ALT’ illuminates in red on the glareshield annunciator panel and flashes for 10–20 seconds before remaining steady. This is accompanied by an aural tone that pulses 6 times per second. The aural warning can be silenced by pressing a button on the left engine power lever (see Appendix A – Gulfstream 695A systems information).

In the event of illumination of the ‘CABIN ALT’ annunciator, accompanied by the aural warning tone, the POH requires the pilot to don their oxygen mask, verify passengers were receiving oxygen, and initiate a descent to 12,000 ft or below (Figure 7).

Figure 7: Cabin altitude annunciator emergency procedure

Source: Ontic

Oxygen system

The Gulfstream 695A is equipped with an oxygen system that provides life support in the event of an emergency. The POH states that:

The airplane is equipped with a high pressure, gaseous oxygen system which provides supplemental breathing oxygen to the crew and passengers in the event of cabin depressurization during high altitude operation, or in the event cabin air becomes contaminated. The system will provide oxygen for sufficient time to permit a planned descent to an altitude where supplemental oxygen is no longer required.

Oxygen is stored in a cylinder located in the rear fuselage and, when full, can supply oxygen to 3 people for about 29 minutes. The cylinder is full when filled to 1,800 psi. The passenger oxygen system switch is recessed into the sidewall on the right side of the cockpit, alongside a cylinder pressure gauge for the aircraft oxygen system (see Appendix A – Gulfstream 695A systems information).

The pilot and copilot oxygen masks are designed for rapid donning and are positioned on hooks immediately behind the pilot and copilot seats for ease of access. The masks incorporate a microphone for radio communications. Passenger oxygen masks are stowed in containers at various locations in the cabin lining above the passenger seats (see Appendix A – Gulfstream 695A systems information). 

Autopilot

The autopilot fitted to VH-HPY was a Collins AP-106 and it was integrated with the aircraft’s instruments. The Collins AP-106 is a 3-axis system that stabilises the aircraft about its roll, pitch, and yaw axes. The system can operate in various modes including pitch hold, heading, navigation, approach, back-course, altitude, and indicated airspeed. Both pilot and copilot control wheels have an autopilot release switch (see Appendix A – Gulfstream 695A systems information). 

A subcomponent of the autopilot system, the trim servo monitor, has fault detection and diagnostic capabilities that automatically disengage the autopilot if a discrepancy or malfunction is detected. One such potential fault condition is the exceedance of threshold voltages within a servo as it works against an aerodynamic or mechanical force. 

The ATSB interviewed 3 pilots who had previously flown VH-HPY for AGAIR. Two pilots described the autopilot as being unreliable at times. One recalled that the autopilot would not hold altitude well and would ‘chase’ the target by +/- 100 ft. Another recalled that the system would be fine in smooth air, but if the aircraft experienced turbulence that required multiple control inputs, the autopilot would disconnect without any prior indication after about 10 minutes. Another pilot regarded the autopilot favourably. Maintenance records for VH‑HPY show multiple instances of autopilot defects and subsequent rectifications.

Engine controls

The Gulfstream 695A engines are controlled from the cockpit using a power lever and a condition lever for each engine. The autopilot does not interface with the engine controls.

Radios

The aircraft was fitted with very high frequency (VHF) and high frequency (HF) radios, along with an additional communication unit for birddog flights and a satellite phone. Pilots wore headsets with boom microphones and were able to transmit by pressing a thumb-operated button on the outboard grip of each control wheel. Handheld microphones were also stowed on each control column.

On the day of the accident, routine communications between air traffic control and VH-HPY were via VHF. VHF radio is limited to ‘line of sight transmissions’, with communication range increasing with aircraft altitude.

Maintenance history

Recent maintenance

The ATSB reviewed the maintenance records for VH-HPY. This included records from when the aircraft was operating in South Africa (from 1983 to 2014) and the Australian records (from 2014 to 2023).

The last maintenance activity prior to the accident was carried out by General Aviation Maintenance (GAM) at Essendon Airport, Victoria, in late October 2023. The work carried out was predominately scheduled maintenance along with some minor defect rectifications. The maintenance provider also carried out checks on the left and right engine bleed air valves after being informed by the AGAIR chief operating officer (COO) that the pressurisation system was malfunctioning (see Aircraft pressurisation defects). The aircraft was released for service on Wednesday 1 November 2023, 3 days prior to the accident flight. The maintenance provider advised that after the first flight, the pilot who accepted the aircraft called and reported to them that the aircraft systems including pressurisation were working normally.

Aircraft pressurisation defects

In 2011, while the aircraft was operating in South Africa, the cabin door seal was replaced to address a pressurisation issue. In 2013 a defect was recorded where the maximum cabin differential pressure of 6.8 psi could not be reached. It was determined that cabin air was leaking from the cabin doorstep area, and this was rectified. Correspondence showed that, when preparing the aircraft to be exported to Australia, the aircraft was not capable of attaining the maximum cabin differential pressure. Significant work was carried out to rectify the issue, including major component replacements, and the cabin interior was removed for access to seal the fuselage.

When VH-HPY was purchased by AGAIR in 2016, maintenance was then provided by GAM at Essendon Airport. The aircraft was reportedly difficult to pressurise when it arrived, which was identified to be because of a leak from a sub-component of the pressurisation system known as a volume tank. Additionally, to address the pressurisation issue a few minor cabin leaks were repaired. A pilot who had flown VH-HPY when it initially entered service with AGAIR recalled that its pressurisation system did function, however if the aircraft rate of climb was high, the pressurisation system would malfunction.

Two of the pilots who had previously flown VH-HPY for AGAIR recalled intermittent pressurisation issues, where the aircraft would not pressurise higher than 2 psi differential pressure. The third pilot reported the pressurisation was okay but had noticed the high rate of climb issue. The unreliability of the pressurisation system reportedly could be managed by selecting the maximum flow of bleed air to the cabin (which can be used at any time except take-off and landing), and by turning the cabin heating up. Additionally, it was also reported that pressurisation seals in the cockpit for the rudder controls were known to leak, and during a flight in late August 2020, the seal dislodged and depressurised the aircraft. On 4 August 2023, the AGAIR HOFO said to GAM that the pressurisation system was working ‘perfectly’.

On 16 October 2023, the pilot of the accident flight emailed the AGAIR COO stating that the pressurisation of VH-HPY was ‘stuck on 2.0 differential for [a] prolonged period’ and because they needed to operate at FL280, they had ‘used a bit of oxygen’ (see Pilot of the accident flight actions). According to the Gulfstream 695A POH, operating at FL280 with a differential pressure of 2.0 psi will result in a cabin altitude of 19,800 ft. The email also requested the aircraft oxygen cylinder be refilled by a maintenance provider at Toowoomba, Queensland where the aircraft was based at the time. Records from the maintenance provider showed that the oxygen cylinder was serviced (refilled) from 1,000 psi to 1,700 psi on 18 October 2023 (see Appendix A – Gulfstream 695A systems information).

On 22 October 2023, the pilot of the accident flight emailed the AGAIR COO and chief executive officer (CEO), who also held the positions of HOFO and head of aircraft airworthiness maintenance control (HAAMC), advising them of issues relating to the pressurisation system of VH-HPY. The email stated there was ‘no change…same cycles and fixes’. The defect was described in the email as the cabin differential being stuck at 2.2 psi (see Pilot of the accident flight actions). 

On 27 October 2023, the AGAIR COO operated the aircraft as PIC and captured a video that showed the aircraft at FL280 with a cabin altitude of 19,000 ft (see AGAIR chief operating officer actions). The COO attempted to ascertain why the pressurisation system was malfunctioning by using the bleed air selector (see Appendix A – Gulfstream 695A systems information) to shut off engine bleed air from each engine in turn. When the pilot selected ‘RIGHT CLOSE’, there was no change in cabin altitude, or when ‘BOTH OPEN’ was re-selected. When ‘LEFT CLOSE’ was selected, the cabin vertical speed indicator showed the cabin altitude climbing at 2,000 ft/min. 

The video was sent to the maintenance provider and the aircraft was flown to their facility on 29 October 2023 for scheduled maintenance. The left and right engine bleed air valves were removed and functionally checked in-house before being refitted to the aircraft. The maintenance provider reported that no faults were found during the valve functional checks or when the pressurisation system was later checked on the ground. The maintenance provider stated that, prior to the completion of maintenance, the aircraft oxygen system was refilled. A maintenance release was issued on 1 November 2023 and the aircraft re-entered service.

Service letters to address cabin leaks

In September 2008, the then type certificate holder for the Gulfstream 695A, and other aircraft in the series, issued 2 service letters with guidance for addressing cabin pressurisation leaks. Service letter 382 was for aircraft in the series that were pressurised ‘to the floor’, while service letter 383 was for aircraft that were pressurised ‘to the skin’. Service letter 383 was applicable to the Gulfstream 695A and it stated:

A recurring problem in pressurized Twin Commanders is maintaining cabin pressure when flying at high altitude. This publication is presented in an effort to standardize the procedure for sealing the known and most significant leakage areas.

The service letter advised that to establish a leakage rate, the aircraft was to be pressurised on the ground using either the engines or with a pressurisation unit. Aircraft that exceeded the maximum allowable leakage rate required rectification. The service letter identified the locations where the most significant leaks occur and provided detailed instructions to address them.

Operations with unserviceable pressurisation system components

The Gulfstream 695A POH contains a minimum required equipment list (MREL) detailing components and systems that must be operable for the aircraft to be considered airworthy. It also lists components and systems that can be inoperable provided that certain operating limits were followed. For inoperative pressurisation system components, the MREL operating limitation requires the aircraft to be only operated unpressurised (see Supplemental oxygen legislative requirements).

Recording of aircraft defects

Requirements

The maintenance release document used for VH-HPY was a standard Civil Aviation Safety Authority (CASA) form 918. The document was used to identify the maintenance release period of validity, list scheduled maintenance due in that period, and to record the hours flown along with landings and pressurisation cycles.[16]

Another principal function of the maintenance release was to record defects and major damage that occurred during the maintenance release period of validity and show the actions taken to rectify them. Part 4B of the Civil Aviation Regulations 1988 did not make a distinction between minor and major defects. However, major defects were defined as:

… those that have caused, or that could cause either: a primary structural failure, a control system failure, an engine structural failure, or a fire. 

Parties required to make entries (known as endorsements) on the maintenance release for defects or damage included the holder of the certificate of registration, the operator, and the flight crew. When a defect was endorsed on the maintenance release, the aircraft was not able to be flown until a formal assessment and deferral of the defect was carried out, or an entry was made to ‘clear’ the original endorsement (known as a clearing endorsement). Clearing endorsements were generally made by approved maintenance personnel, and in accordance with approved data such as the aircraft maintenance manual.

The AGAIR operations manual (OM) required the PIC to record defects and their symptoms on the aircraft’s maintenance release. The PIC was then required to liaise with the HAAMC, who would in turn liaise with the maintenance provider to determine what action was required.

Provision was given in the OM to defer defects that ‘do not impinge on the airworthiness of the aircraft’. Examples of this were given in the manual:

...the Pilot-in-command must consider whether or not the defect will render the aircraft unserviceable for a particular category or type of operation. For instance an unserviceable landing light would not render the aircraft unserviceable for day VFR operations but would render it unserviceable for night operations.

…

…some minor defects such as paint scratches or dents in the structure would not normally impinge on airworthiness whereas cracks in a wing spar certainly would.

The OM contained provision for the use of minimum equipment lists (MEL) supplied by the aircraft manufacturer. Prior to their use by AGAIR, an MEL was required to be approved by CASA, specific to a particular aircraft and operator. The MEL[17] provisions stated in the Gulfstream 695A POH were not approved for use with VH‑HPY at the time of the accident.[18]

Unapproved recording of defects

Some defects that were identified on VH‑HPY and another AGAIR aircraft, VH‑LVG, were recorded using unofficial means to the operator or maintenance provider. On 21 April 2021, the AGAIR HOFO emailed GAM requesting various tasks to be carried out on VH‑HPY, VH‑LVG, and VH‑LMC when the aircraft arrived for maintenance. The email also listed defects on each of the aircraft. None of the 4 defects listed for VH‑HPY in the email had been entered on the relevant maintenance release. Other examples included emails from the pilot of the accident flight to AGAIR managers describing a pressurisation defect with VH‑HPY (see Recording of pressurisation defects), and an internal GAM email listing defects on VH‑LVG.

The ATSB interviewed pilots who had flown VH‑HPY for AGAIR. One pilot recalled that defects would be communicated by phone to GAM. Other pilots recalled that defect lists were compiled to be rectified during the aircraft’s next scheduled maintenance. 

The ATSB reviewed a total of 15 expired maintenance releases¹⁴ that had been retained with the maintenance logbooks from VH-HPY. These maintenance releases dated from November 2014 when VH‑HPY was first registered in Australia. Of these maintenance releases, 13 were from when the aircraft commenced operations with AGAIR in September 2016, and defect entries had been made on 6 of these. The defect entries had been predominately made by the maintenance provider, and the remaining 7 maintenance releases were either blank or had entries for scheduled maintenance activities.

Recording of pressurisation defects

After VH-HPY sustained an in-flight depressurisation in August 2020, an entry for the defect and a clearing endorsement was made by a licensed aircraft maintenance engineer (LAME) on the maintenance release. 

Of the remaining known instances of pressurisation defects, there were no relevant entries on the aircraft’s maintenance releases (Table 1).

Table 1: Recording of known pressurisation defects affecting VH‑HPY since 2016

Meteorological information

Meteorological records[19] from the Bureau of Meteorology (BoM) at the time of the accident were reviewed by the ATSB. This predicted westerly winds at 40 kt, temperature −30°C, with no significant nearby weather events at FL280.

Meteorological conditions were also recorded by the BoM automatic weather station at Cloncurry Airport (55 km north-west of the collision location). At 1430 the surface wind was 6 kt from 190° true, visibility greater than 10 km, no detected cloud, temperature 40°C, dew point 2°C, and no rainfall since 0900.

Recorded data 

The aircraft was not fitted with a flight data recorder or a cockpit voice recorder, nor was it required to be. During the accident flight, data was being transmitted by the automatic dependent surveillance broadcast (ADS-B) and Mode S transponder[20] equipment fitted to the aircraft. Flight data was also being broadcast from a TracPlus[21] unit fitted to the aircraft, which could be used by the fire services and AGAIR to track the location of the aircraft during flight. A navigational application (OzRunways) was installed on a tablet computer on board the aircraft and that device also broadcast flight data. The OzRunways data was recorded at 5 second intervals. The parameters captured from all systems were: time, aircraft position, GPS and pressure (barometric) altitude, altitude rate of change, groundspeed, and heading.

Navigation system

A Garmin GTN-750 navigation system was recovered from the accident site and transported to the ATSB Canberra technical facility. Examination of the unit identified that it was not recording flight data. 

ADS-B data

The ADS-B data provided the highest reporting frequency (~0.5 seconds), and altitude was reported to the nearest 25 ft. This data was captured from shortly after departure until the aircraft descended to about FL240 during its final descent (Figure 8). 

Figure 8: Altitude profile of the accident flight throughout its duration with key moments (phases) displayed

The blue trace represents pressure altitude and the green trace represents GPS altitude. Source: ATSB

Pressure and global positioning system altitude discrepancy

The ADS-B data that was broadcast from the aircraft during the accident flight contained a discrepancy between the pressure altitude and the GPS altitude (Figure 8).[22] At the start of the second cruise phase, the broadcast pressure altitude was 28,000 ft while the GPS altitude was 29,400 ft. At the end of the second cruise phase (approximately 2 hours later), the broadcast pressure altitude was 28,050 ft while the GPS altitude was 29,750 ft. The difference in pressure and GPS altitudes over the entire flight varied with altitude and flight time and is shown on a scatter plot below (Figure 9).

Figure 9: Scatter plot of pressure and GPS altitude discrepancy with altitude (left) and over time (right)

Source: ATSB

When the above data was corrected for local barometric pressure and GPS ellipsoid modelling, the difference in altitudes at the end of the second cruise phase of flight was about 1,400 ft. The GPS altitudes from ADS-B, OzRunways and TrackPlus, which had independent GPS sources and data processing, were broadly aligned over the entire flight, and it is therefore likely that the pressure altitude was reading low and the aircraft was likely flying at FL294 (i.e. the actual position of the aircraft was likely higher than indicated). The reason for the discrepancy could not be determined, although a static source leak inside the cabin could not be discounted. 

Initial descent to FL150

At 1141:12, while at FL280, the aircraft commenced a descent to FL150. The aircraft’s flight profile during this period was erratic with a fluctuating rate of descent that peaked to about 4,200 ft/min. The aircraft’s heading remained steady during the descent. The aircraft then maintained FL150 for a period of about 6 minutes before climbing back to FL280. No reason for the descent was provided to air traffic control and it was not part of the submitted flight plan. The AGAIR COO stated there was no operational reason for the descent to occur.

Flight performance analysis

General

The ADS-B, OzRunways and TrackPlus position and groundspeed data, combined with aircraft performance data, forecast conditions, and actual environmental conditions, were used to formulate likely aircraft performance during the flight. The engine power (maximum continuous power (MCP)), knots true airspeed (KTAS), knots calibrated airspeed (KCAS),[23] and vertical speed was calculated at points in time during the initial cruise, initial descent and the secondary cruise (Table 2). 

Table 2: VH-HPY performance assessment

Source: ATSB

Trajectory analysis was used to estimate the likely pitch angle, angle of attack, roll angle, speed, and rate of descent for the deceleration and loss of control phases of the flight.

Deceleration phase

Commencing at 1423:20, the deceleration phase of the flight was assessed from 10 seconds after the transition from cruise until the start of the left descending turn (Figure 10). Over this 2‑minute period, the altitude reduced from 28,040 ft to 27,840 ft, with an initial vertical descent rate of 78 ft/min, increasing to 120 ft/min. However, over this same loss of altitude, a more substantial loss of airspeed occurred with a linear airspeed reduction from 236 KTAS (148 KCAS) to 138 KTAS (86 KCAS). This descent performance was estimated to require a power setting of about 25% MCP.

Figure 10: Deceleration phase

Source: ATSB

The aircraft stall speed at maximum weight was 78.6 KCAS. The corrected stall speed at the calculated operating weight of the aircraft was about 74 KCAS, 12 kt lower than the calibrated airspeed at the end of the assessed period. It was calculated that the aircraft had approximately 25% MCP applied at the end of the descent, which would slightly decrease the stall speed, giving further margin from the stall. 

The minimum control speed in the air (V_MCA)[24] for the aircraft was documented to be 95 KCAS. However, this speed assumes one engine inoperative with the other at MCP. Assuming in this instance one engine failed inoperative, and the other engine remained at half power (that is, total aircraft power at 25%), the minimum control speed was calculated to have been approximately 67 KCAS. This was below the power off stall speed for the aircraft weight and below the recorded minimum speed. Thus, a minimum control speed departure was excluded as a potential reason for the flight profile of the aircraft.

Loss of control

The reliability of the ADS-B data diminished as the aircraft entered the descending left turn. However, trends in the data were able to be identified. At 1425:26 and an airspeed of about 78 KCAS, the aircraft entered a left roll. The roll rate was initially about 10 degrees per second (°/s), slowing to 0°/s 14 seconds later whereby the aircraft had rolled to approximately 75° left angle of bank. The angle of attack (AoA)[25] was estimated to stay reasonably constant over this period at around 8°, indicating a fixed elevator position. However, it was calculated from the data that the aircraft pitched to about 20° nose down due to the fixed AoA and excessive roll angle allowing the nose to drop. 

At 1425:40, the aircraft’s heading had turned through 85° and it had accelerated to about 106 KCAS. From this point, over the following 10 seconds, the angle of bank was estimated to reduce to around 45° and the nose-down pitch change slowed until it stabilised about 30° nose down all while the calculated AoA remained constant at around 8°. During this period, the aircraft’s heading turned through a further 100° and the speed increased to about 189 KCAS. The diameter of the turn was approximately 700 m (Figure 11). 

Figure 11: Deceleration and loss of control

Source: ATSB

Because of the extreme attitude of the aircraft from this time on, the ADS‑B data and TrackPlus data became unreliable, likely due to the angle of the onboard antenna and reflected signals. The last reliable ADS‑B position information occurred at 1425:50 and at 25,500 ft standard barometric altitude and 189 KCAS. Only horizontal ADS-B position information remained valid for another 5 seconds, by which point the aircraft had turned through a ~270° track angle and crossed back through its original track. 

From this point, to about 10,500 ft, all data sources became unreliable and sporadic and no conclusions about flight path or attitude could be made. However, the data indicated an average vertical speed of about −19,500 ft/min, or 192 kt vertical speed, during the period from about 25,000 ft to 10,500 ft. 

At about 10,500 ft, the OzRunways altitude data stabilised and provided an average vertical descent rate of 13,500 ft/min. The final data point was at 1427:15 at an altitude of 1,800 ft. 

Wreckage and impact information 

Accident site

The aircraft was destroyed by the impact with terrain and a subsequent fuel-fed post-impact fire (Figure 12). The ATSB conducted an onsite examination of the aircraft wreckage. The ground impact marks and wreckage position indicated that the aircraft impacted terrain upright with a shallow, nose-down attitude with little forward momentum. Immediately surrounding the wreckage, numerous landscape features (a tree and termite mounds) remained upright and had not been disturbed by the aircraft impact or its liberated debris (Figure 13). The compression and displacement of the aft fuselage relative to the engines, the displacement of the inboard wing section and the aircraft nose, showed that the aircraft was rotating clockwise on impact with the terrain, which was highly indicative of a spin. 

Figure 12: Overview of the accident site

Source: Queensland Police, annotated by the ATSB

Figure 13: Heavily disrupted and burnt remnants of the wreckage at the accident site 

The surrounding landscape features (termite mounds and a tree) remained upright and were not disturbed from the impact. Source: ATSB

All major aircraft components were accounted for at the accident site. The disruption to the airframe from the impact and the subsequent fire damage limited the extent to which the aircraft could be examined. The oxygen cylinder fitted to the aircraft was located in the wreckage and its associated components had been significantly fire damaged, precluding any assessment of the oxygen system’s serviceability prior to the accident. Additionally, the components comprising the pressurisation system were unable to be assessed due to the extent of damage sustained.

Engines

Both engines had been significantly damaged by the post-impact fire, limiting the extent to which they could be examined. However, the low-pressure compressor of each engine was observed to have rotational damage, indicating that the engines were operating at impact.

Propeller assemblies

Both propellers were examined and photographed by the ATSB at the accident site. Assistance was sought from Hartzell Propeller personnel to interpret the photographic evidence. They advised that there were multiple indications to identify that the engines were operating and estimated them to be at a low to moderate power setting. These indications included blade bending (in multiple planes), twisting, fractures (including multiple blade tip fractures), chordwise scoring and rotational gouges. Additionally, blades from both propellers had separated from their hubs at the shanks, and internal components were fractured.

Crew locations

The pilot was found toward the front of the cabin, camera operator 1 was behind and to the left of the pilot, and camera operator 2 was behind and to the right of the pilot. However, the impact with terrain caused significant compressional damage to the cabin area of the fuselage and the location of the crew as found within the wreckage may not be indicative of their seated location during the flight. 

Fire 

Witnesses from a nearby mine site who observed the aircraft during its descent did not report any indications of fire until the aircraft collided with the ground, after which a fireball and rising smoke plume were visible. A fuel-fed fire persisted after the impact, which consumed most of the aircraft wreckage. The fire was extinguished by responders from the mine site.

Survivability

The impact with terrain was not survivable. 

Hypoxia

General

Hypoxia is a state where there is a deficient supply of oxygen in the blood, tissues and cells sufficient to cause an impairment of body functions. The human central nervous system demands about 20% of all inhaled oxygen to supply the brain. Any reduction in oxygen supply to the body will impact brain function, with higher reasoning portions affected first (US Federal Aviation Administration 2015). Severe exposure to hypoxia can result in the rapid deterioration of most bodily functions and, eventually, death (Gradwell 2016).

Hypoxia can result from a variety of factors including respiratory and cardiovascular deficiencies, blood disorders, pharmaceuticals and toxic substances, and a reduction in the oxygen tension in the arterial and capillary blood. The latter factor is known as altitude hypoxia, hypobaric hypoxia, or hypoxic hypoxia, and it is the most common form of oxygen deficiency in aviation (Gradwell 2016).

Altitude hypoxia

Within aviation, the typical cause of altitude hypoxia is the low oxygen tension of inhaled gas (air) associated with exposure to altitude. On ascent, as barometric pressure reduces, breathing ambient air will result in a reduction of the partial pressure and the molecular content of oxygen within the lungs. The result is an inadequate oxygen supply to the arterial blood and decreased oxygen available to the tissues (Gradwell 2016). 

Clinical features of altitude hypoxia

The clinical features of altitude hypoxia are described in Table 3. In general, the greater the altitude, the more overt and serious the features of hypoxia will be. Except for a possible headache, nausea or dizziness, a pilot is unlikely to experience other uncomfortable symptoms (US Federal Aviation Administration 2015). A loss of self-criticism usually results in a person remaining unaware of their deterioration in performance and, consequently, the presence of hypoxia. It is this insidious nature that makes the condition a significant hazard in aviation (Gradwell 2016). 

As noted in the table, although there is minimal impact below 10,000 ft, research has shown impaired task performance (with individuals unaware of their impairment) at cabin altitudes below 15,000 ft. With reference to the effect of altitude hypoxia on the performance of pilots, studies have shown an increase in procedural errors (Nesthus and others 1997), reduced flight profile accuracy (Steinman and others 2017), and reduced awareness of the environment (Steinman and others 2021). 

Table 3: Clinical features of altitude hypoxia 

Source: Gradwell (2016)

Time of useful consciousness

The time of useful consciousness (TUC) is the interval between a person being exposed to a reduction in oxygen tension of the inhaled air to the time when they experience a specified degree of performance impairment (Gradwell 2016). It can also be considered the time after which an individual is no longer capable of taking appropriate corrective action to resolve the situation (for example, the use of oxygen and/or a descent to a lower altitude). The TUC does not denote the time to the onset of unconsciousness (US Federal Aviation Administration 2015).

The TUC at various altitudes is presented in Table 4. However, TUC is subject to considerable variation based on an individual’s general physical fitness, age, degree of training and previous experiences of hypoxia (Gradwell 2016). It is also affected by the rate of ascent, with a faster ascent resulting in a shorter TUC. For example, during a rapid depressurisation to altitudes between 25,000 ft and 43,000 ft, the TUC is reduced by about 50% (US Federal Aviation Administration 2015). 

Table 4: Time of useful consciousness at various altitudes

Source: US Federal Aviation Administration (2015)

Principal aviation causes

Within the aviation context, the principal causes of altitude hypoxia are: 

• climbing to high altitudes without the use of supplemental oxygen
• failure of the supplemental oxygen system, or oxygen set to an inadequate concentration and/or pressure
• depressurisation of the cabin at a high altitude (Gradwell 2016).

Post-mortem indicators of altitude hypoxia

Altitude hypoxia rarely leaves any indications that would be detectable at a post-mortem examination.

Supplemental oxygen legislative requirements 

The Civil Aviation Safety Regulation (CASR) part 91 (general operating and flight rules) manual of standards 2020 required flight crew[26] to use supplemental oxygen:

• for any period exceeding 30 minutes when the cabin pressure altitude was continuously at least FL125 but less than FL140
• for any period when the cabin pressure altitude was at least FL140.

For passengers, an oxygen supply was required to be available for the entire period for any time when the cabin pressure altitude was at least FL150. Additionally, an aircraft was required to carry sufficient oxygen to meet the above requirements, and the oxygen was required to be made available through an oxygen dispensing unit in accordance with the supply requirements for that level.

Without affecting the above requirements, the same legislation also required a pressurised aircraft that was flown at an altitude of FL250 or more to have:

• at least 10 minutes oxygen supply for flight crew, even if the entire period of relevant flight was less than 10 minutes
• at least 10 minutes oxygen supply for passengers after descending below FL250 even if the entire period of relevant flight was less than 10 minutes.

The oxygen system fitted to VH-HPY complied with the legislative requirements to have a 10‑minute supply when operating the aircraft at FL250 or higher when pressurised. However, as described in Aircraft systems, the oxygen system for Gulfstream 695A aircraft was for emergency purposes (depressurisation, smoke and fumes etc) and not for the purpose of conducting normal operations (also see Appendix A – Gulfstream 695A systems information).

Operational information

Tasking

The flight had been contracted by Queensland Fire and Emergency Services (QFES) and the crew had been tasked to conduct line scanning of 10 areas of interest in Northern Queensland. The line scanning activity was to take place over 2 days, 4–5 November 2023, with the crew overnighting in Townsville, Queensland on 4 November.

Flight plan

The submitted flight plan stated the aircraft would depart Toowoomba Airport and climb to FL280. It would then fly at FL280 overhead Winton, Cloncurry, and Mount Gordon respectively, and conduct aerial work operation (line scanning) near Mount Gordon for a period of 40 minutes. The aircraft was then planned to land at Mount Isa, before travelling on to Townsville later that day (Figure 14).

Figure 14: Planned route

Source: Google Earth, annotated by the ATSB

Fuel 

The aircraft had been refuelled on 3 occasions in the 3 days prior to the accident and had flown about 5 hours. However, the quantity of fuel on board the aircraft when the accident flight departed could not be determined from the records available. 

AGAIR line scanning 

History of line scanning operations

AGAIR commenced line scanning operations around early 2022, following the fitment of the TK-7 Overwatch camera to VH-HPY. VH-HPY was the only aircraft within the AGAIR fleet equipped to undertake the activity. The service was initially provided on an ‘ad-hoc’ basis and in 2023 AGAIR secured a ‘call when needed’ contract with QFES. The AGAIR COO operated as pilot in command of all AGAIR line scanning flights until the pilot of the accident flight commenced operations in September 2023.

Line scanning procedures

The AGAIR OM contained a generic section on aerial photography, but it did not contain specific procedures for the conduct of line scanning operations. 

The pilot of the accident flight had developed draft line scanning procedures for inclusion in the AGAIR OM. These procedures contained a section on tasking, which included information on the altitude line scanning operations were to be conducted. It stated:

The altitude missions are flown will depend on mission specifics. As a general guide for missions where a high coverage area is priority, the preference is to conduct scans as high as possible. This will ensure maximum coverage from the system while minimising the requirements for a high number of passes.

The tasking process will require refining with the clients’ requirements for considerations of weather and terrain. The imagery is affected by cloud and therefore this will dictate what height is feasible for the best product. 

Generally, F200 to F280 is the most effective for large area coverage imaging. The lowest feasible altitude is 5000 ft AGL though this will be dependent on the size of the area. Large areas at this level will require a high number of passes and produce a very large volume of data.

The pilot of the accident flight had emailed the draft procedures to the AGAIR COO on 10 October 2023, but they were not incorporated into the AGAIR OM at the time of the accident.

Line scanning practices

The normal flight profile, as explained by senior AGAIR management personnel, was for line scanning operations to be conducted at FL200‍–‍FL280 as the resolution of the thermal images was not impacted by increased altitude. Consequently, the higher the aircraft flew the greater the swath[27] of the images and the more ground area could be captured in one pass, resulting in increased efficiency of data acquisition.

However, thermal imagery could be affected by cloud and, depending on the cloud coverage, may require the aircraft to descend below cloud level to conduct imaging. In those scenarios, the lower limit for the operation of the camera was about 5,000 ft. 

The ATSB was advised by the AGAIR COO that transit flights to and from the fire area could be flown at any level, but transiting at FL280 would result in improved fuel efficiency in comparison to lower levels. The aircraft was also used for low level ‘birddog’ activities, where it was flown less frequently at higher altitudes.

A review of VH-HPY flights into or out of Toowoomba Airport over the period 4 September 2023–4 November 2023 indicated that 70% of flights involved a cruise at FL280. Since commencing operations with AGAIR, the pilot of the accident flight had flown 24 flights in VH-HPY as PIC, 19 of which were flown at FL280.

Operations at high cabin pressure altitudes

AGAIR chief operating officer actions

During interview, the AGAIR COO stated that they occasionally experienced the intermittent defect with VH-HPY’s pressurisation system while conducting line scanning operations. They recalled 2 occasions where they had continued the climb while the pressurisation system was defective and used oxygen.

The earlier event occurred about 12 months prior to the accident, where the COO recalled continuing the climb while the pressurisation system was defective. They recalled using the aircraft oxygen system, attaining the cruise level, and rectifying the defect by increasing the cabin heat.

The most recent example occurred on 27 October 2023, 8 days prior to the accident, during a line scanning flight from Toowoomba with the COO, as pilot in command, and camera operator 2 on board. The COO used their phone to video the cockpit indications of the defect. The video captured the aircraft in cruise at FL280, with a cabin differential of 2.2 psi and a cabin altitude of about 19,000 ft (Figure 15). There was no audible cabin alarm on the video’s audio.

Figure 15: Inflight cockpit indications captured on video footage 27 October 2023

Source: ATSB

The COO stated that, on that occasion, the pressurisation system defect had manifested during climb, but they elected to continue to their cruise altitude of FL280 as they hoped the system would rectify itself after a short time. They stated that they maintained FL280, while using the aircraft’s emergency oxygen system as a supplemental oxygen supply, for a period of about 20 minutes before the pressurisation system ‘probably’ started working again. They also stated that they silenced the cabin altitude alerting system using the inhibit button located near the power levers. The defect was not entered in the aircraft’s maintenance release, but the occurrence was communicated directly to the maintenance provider via text message with the accompanying video (see also Recent maintenance).

The text message sent from the COO to the maintenance provider included the statement:

this was at F280 with a cabin of F200 and diff 2.2, O2 will need a top off please sir [emoji], got the job done

The COO provided line scanning training to the pilot of the accident flight in late September 2023. The COO recalled that they experienced the pressurisation defect during one of these training flights, and in that instance, they stopped at FL160 until the system functioned correctly. They recalled the advice they gave the pilot of the accident flight on the management of the pressurisation system defect was to ‘do what’s sensible and safe’. 

Pilot of the accident flight actions

Documents sourced during the investigation indicated that the pilot of the accident flight had operated VH‑HPY at a cabin altitude that exceeded FL140 on several occasions. The documentation included:

• An email sent by the pilot of the accident flight on 16 October 2023 to the AGAIR COO stated:

HPY pressurisation stuck on 2.0 differential again for prolonged period.  We needed F280 to complete the trip and thus used a bit of Oxygen.   Pretty normal for HPY as we discussed and the pressurisation has generally been good. Oxy is still good, but we may need to do this profile again on and off.   We have checked with [provider] and he has Oxygen if and when we need it. Is there anything specific re filling Oxygen on HPY that I need to be aware of? Aiming to run it down to below 500 psi and then taxi to [provider] and take it back up to around 1300-1500psi.

On the same day, the AGAIR COO replied to the pilot of the accident flight’s email, stating that they would send the pilot the relevant process from the maintenance manual so that it could be given to the maintenance provider in Toowoomba. The aircraft’s oxygen cylinder was refilled on 18 October 2023 (see Recent maintenance)

• An operational risk assessment (ORAT) was completed by the pilot of the accident flight on 2 November 2023 for a flight that took place on 16 October 2023. This ORAT likely related to the flight referred to in the email sent by the pilot on 16 October 2023 (see the above dot point). The ORAT stated:

Pressurisation stuck on 2.0 differential for extended period. F280 required for mission completion. Oxygen used. Not abnormal and pressurization returned to regular differential after 3.0 hour. 

The ORAT was a tool used by AGAIR flight and operations crew to assess the risk associated with any assigned flight duty or task. The procedures for the use of the tool stated that ‘flight crew shall use the ORAT for all day-to-day operations’. The ORAT for the flight on 16 October had been assigned a total hazard score of ‘4 – normal operations’ and there was no accompanying safety report submitted (see Safety management system). It had been allocated to the AGAIR head of flying operations (HOFO) for approval. Records indicate the HOFO accessed and approved the ORAT on the evening of 6 November 2023. 

• An email sent by the pilot of the accident flight on 22 October 2023 to the AGAIR COO, copying in the AGAIR HOFO, included the following statement:

Pressurisation - No change. Same cycles and fixes. The issue is that we are spending most of our time at F280. This means in a 80 hour month (last month), the accumulative effect of high cabin altitudes is a factor. Both myself and [camera operator 1] have had some symptoms during this rotation. This is mitigated by use of Oxygen, lower altitudes when able and the usual fixes of climbing and descending etc. However given the rate of effort and the altitude, the risk of decompression sickness and hypoxia should not be normalised. As we all know if the diff gets stuck at 2.2 then you generally spend around 90 mins at Cabin Alt of 19000 if F280 is mission essential. This can be mitigated operationally if we can’t fix the pressurisation.

• On the same day, the AGAIR HOFO responded to the pilot of the accident flight’s email stating:

Thanks [name of pilot of the accident flight] for the update. Yes, QFES have definitely embraced the program and are utilising the service well. Many thanks to you and [name of camera operator 1] for keeping it going over the last few weeks. We are getting great feedback and preparing for sustained operations over the summer.

The AGAIR COO did not respond to the pilot of the accident flight’s email.

AGAIR head of flying operations actions

The AGAIR HOFO, who was also the CEO and HAAMC, occasionally flew VH-HPY and had experienced the pressurisation defect for themselves.[28] The HOFO recalled that, in these circumstances, they ceased the climb and flew the aircraft at a lower level. The HOFO had not recorded the defect with the pressurisation system in the aircraft maintenance release following these flights, and they could not recall why they had not done so.

During interview with the ATSB, the HOFO stated that, in the event that the pressurisation system became defective, they had instructed pilots to cease the climb and operate at a safe level. They stated that they were not aware of any pilots that had continued to operate VH-HPY at FL280 with the pressurisation system defective. 

When queried about the email sent by the pilot of the accident flight on 22 October 2023, which detailed the continued operation at FL280 with a cabin altitude of 19,000 ft, the HOFO stated that they had read the pilot of the accident flight’s email as being what ‘would’ happen, rather than what ‘was’ happening. Other than the short email response from the HOFO, where they thanked the pilot and camera operator for ‘keeping it going over the last few weeks’, the HOFO did not contact the pilot to discuss the content of the email. The HOFO explained this was because they were not involving themselves into the operational aspects as they had passed the day-to-day management of the line scanning operation to the AGAIR COO, and that the pilot of the accident flight reported to the COO (see Organisational information). 

Documents sourced during the investigation indicated that the HOFO had attempted to acquire a supplemental oxygen system from a supplier on 22 October 2023. The initial enquiry to the supplier stated:

We are doing high altitude (28,000 ft AGL) operations in our Turbine Commander aircraft where we are spending 4 to 5 hours at this altitude. The aircraft is pressurised but the cabin altitude can be 10,000 feet or more so we are looking for a simple portable system to supplement oxygen for a crew of two. We would like to utilise the existing built in oxygen system in the aircraft and optimise the flow to get maximum time between needing to refill the aircraft bottle. Are you able to help us with this?

On 31 October 2023, the HOFO requested the supplier provide:

one Aerox portable oxygen complete setup – 2 users – E cylinder please. Could you include 6 canulas and one pulse oximeter

The accident occurred before the equipment was supplied. The HOFO subsequently ‘postponed’ the request on 9 November 2023.

Camera operator 1 information

Camera operator 1 had communicated to their family, during casual conversation, that there was an issue with VH-HPY’s pressurisation system that would occasionally manifest. They informed their family that the aircraft had oxygen on board, and they had ‘workarounds’ to deal with the issue.

Historical flight track data

The TrackPlus data for VH-HPY over the period 26 March 2022–2 November 2023 was analysed to identify similar flight profiles to the accident flight. A total of 132 flights took place within this period. Flights with a possible operational requirement were excluded and 8 flights were identified as involving a similar unexplainable descent to a lower flight level for a short period of time before returning to a cruise altitude. The first of these flights took place on 30 September 2023. The pilot of the accident flight was the PIC of 7 of the flights, the COO was the PIC of the eighth flight on 24 October 2023 (Table 5).

Table 5: Previous flight profiles similar to the accident flight were identified from 30 September 2023 to 24 October 2023

Date	Pilot in command	Flight time	Profile
30 Sep 2023	Pilot of the accident flight	2 hr 50 min
15 Oct 2023	Pilot of the accident flight	4 hr 14 min
16 Oct 2023	Pilot of the accident flight	5 hr 27 min
19 Oct 2023	Pilot of the accident flight	4 hr 54 min
20 Oct 2023	Pilot of the accident flight	4 hr 57 min
21 Oct 2023	Pilot of the accident flight	5 hr 30 min
22 Oct 2023	Pilot of the accident flight	3 hr 12 min
24 Oct 2023	AGAIR COO	4 hr 50 min

Aerodynamic stalls and spins 

Aerodynamic stalls

Overview

An aerodynamic stall is a rapid decrease in lift and increase in drag caused by the separation of airflow from the wing’s upper surface. A stall occurs when the angle of attack[29] exceeds the wing’s critical angle of attack,[30] resulting in the disruption to the smooth airflow over the wing. 

Accelerated stalls

At the same gross weight, configuration, centre of gravity location, power setting, and environmental conditions, an aircraft will consistently stall at the same airspeed provided the aircraft is at +1 g.  However, the same aircraft will stall at a higher airspeed when subject to an acceleration greater than +1 g. This type of stall is called an ‘accelerated stall’, and they may occur inadvertently during an improperly executed turn or a pullout from a steep dive (US Federal Aviation Administration 2021).

Accelerated stalls tend to be more aggressive than unaccelerated +1 g stalls and may put the aircraft in an unexpected attitude. Failure to execute an immediate recovery may result in a spin or other departure from controlled flight(US Federal Aviation Administration 2021).

Aerodynamic spins

Overview

An aerodynamic spin is a sustained descent in which one or both of an aircraft’s wings are in a stalled condition. During a spin, an aircraft rotates around its vertical axis affected by different lift and drag forces on each wing, descending due to gravity, rolling, yawing, and pitching in a corkscrew path (US Federal Aviation Administration 2021). A spinning aircraft will descend more slowly than one in a vertical or spiral dive and it will have a lower airspeed, which may oscillate. The pitch angle can also vary considerably from significant pitch down to a relatively flat attitude. 

Entry, development and recovery

A spin may be entered intentionally or unintentionally, from any flight attitude if the aircraft has sufficient yaw while at the stall point. An aircraft may yaw for a variety of reasons including incorrect rudder application, adverse yaw created by aileron deflection, engine or propeller effects, and windshear (US Federal Aviation Administration 2021).

Initially the aircraft will enter an incipient spin phase where the aircraft starts rotating, but aerodynamic and inertial forces have not achieved a balance. This phase may take 2–4 turns to develop as the airspeed slows and stabilises (Figure 16). A fully developed spin occurs when the aircraft’s angular rotation rate, airspeed and vertical speed are stabilised in a flight path that is nearly vertical and the spin is in equilibrium (US Federal Aviation Administration 2021).

Recovery from a spin occurs when rotation ceases and the angle of attack of the wings is decreased below the critical angle of attack. To do so, a pilot is required to apply control inputs to disrupt the spin equilibrium (US Federal Aviation Administration 2021). 

Figure 16: Spin development and recovery

Source: US Federal Aviation Administration (2021)

Gulfstream Commander 695A spin recovery 

The Gulfstream Commander 695A POH prohibited intentional spinning and stated that no spin tests had been conducted. Certification standards for this class of aircraft do not require spin testing to be conducted. However, the POH did contain instructions for recovery should the aircraft inadvertently enter an incipient spin. It stated:

If a spin is entered inadvertently, immediately move control column full forward, apply full rudder opposite to the direction of the spin and reduce power to FLT IDLE. These three actions should be done as near simultaneously as possible. Hold this control position until rotation stops, then neutralize all controls and execute a smooth pullout. Ailerons should be neutral during recovery. Airspeed may reach VMO before full recovery.

Despite this guidance, the relatively large lateral/polar moment of inertia created by the wing‑mounted engines during a fully developed spin would make recovery of the aircraft inherently difficult and possibly improbable.

Telecommunications 

General

All telecommunications made and received by Airservices Australia were recorded. Information related to telecommunications made by other parties was sourced from mobile devices, carrier data and interviews.

Telephone call – pilot and a family member

At 1102, while the aircraft was on climb to FL280, the pilot returned a missed telephone call that they had received from a family member 13 minutes earlier. The AGAIR OM stated that mobile phones could only be used by the pilot during the cruise phase of flight. The return call lasted 3 minutes and 30 seconds. The family member recalled that during the call the pilot sounded focused, happy and logical. Before ending the call, the pilot advised they would call the family member again once they landed. 

Telephone calls – pilot and Airservices Australia personnel

At 1337:46, the Airservices Australia air traffic management director (ATMD) attempted to contact the pilot via mobile phone, however the call went unanswered. At 1338:36, the pilot returned the ATMD’s call, and they had a short conversation that lasted 34 seconds (Table 6). 

Table 6: Transcript from the recording of telephone conversation between the pilot and the ATMD 

Source: Airservices Australia

At 1340:15, the ATMD attempted to call the pilot’s mobile phone again, but the pilot did not answer. The ATMD left a voicemail message stating:

Hi [pilot of the accident flight’s name]. Could you ring air traffic control back again please. [Name of pilot of the accident flight] please ring air traffic control back again on this number. Check your oxygen, oxygen, oxygen, oxygen.

The pilot did not return the ATMD’s call.

Telephone call – Airservices Australia personnel and the AGAIR head of flying operations

At 1350, the ATMD contacted the AGAIR HOFO by phone to advise that ATC had lost contact with VH-HPY, and they suspected the pilot may be suffering from hypoxia (see Appendix B – Transcript – Telephone call between Airservices Australia personnel and the AGAIR head of flying operations).

The conversation lasted nearly 6 minutes during which the ATMD passed the telephone handset to the shift manager (SM), who discussed ATC’s concerns regarding the loss of communications, the pilot’s ‘slow response’ via telephone, the aircraft diverging from track, the ATC ‘oxygen’ calls, and ATC’s instructions for the aircraft to descend. The HOFO was placed on hold for a total duration of 66 seconds. During the conversation ATC regained communication with the pilot and the HOFO was advised that contact had been re-established. The HOFO was also advised that the pilot had confirmed operations were normal and that ATC believed the aircraft was safe.

During the phone conversation, the HOFO advised ATC that the aircraft was on flight tracking, confirmed the level of the aircraft as expected, advised ATC that they believed the flight looked normal, and asked if there were any communication issues in the area. The HOFO did not advise the ATMD or SM that the aircraft had a known intermittent pressurisation defect. The HOFO advised the ATSB that it did not occur to them to pass this information on during the telephone call.  

During interview with the ATSB, the SM stated that their perception of what was going on may have changed had information such as a history of problems with the aircraft pressurisation or about the pilot had been communicated during the telephone conversation.

Speech analysis from the accident flight 

General

As part of the investigation into a Beechcraft King Air 200 accident in 2000, the ATSB obtained expert analysis to determine whether that pilot’s speech and related behaviour was affected by hypoxia (see Related occurrences). A review of research conducted as part of that investigation found that pilots experiencing hypoxia will have a slower speech rate (syllables per second), a slower response time to ATC transmissions, a slowing of the pilot’s coordination of microphone pressing/speaking (in which the pilot allows more ’dead’ time on the radio channel before and after speaking), and slurring of speech. 

There is also a tendency to activate the microphone without speaking, particularly when more adversely affected, and eventually stop responding. Although the fundamental frequency of speech (or pitch) can be an indicator of workload or stress, there is evidence that it tends to remain unchanged in situations involving hypoxia.

During the investigation into the accident involving VH-HPY, the ATSB requested a speech analysis expert, who had previous experience conducting analysis of hypoxia events, conduct an examination of the pilot’s speech and related behaviour during the accident flight to determine if the pilot was affected by hypoxia. The analysis involved comparing the pilot’s communications at lower altitudes against their communications at higher altitudes. 

The analysis used both subjective and computational evaluations of the speech samples. Subjective evaluation provided observations of operational errors, quality and clarity of speech, and the number of syllables spoken. Computational evaluation was used to measure response time to ATC transmissions, the time from the commencement of transmission to the commencement of speech, speaking rate (syllables per second), and fundamental frequency (or pitch).

The speech samples used to perform the analysis consisted of:

• 5 radio statements made by the pilot at lower altitudes 
  (3 below 10,000 ft on the initial climb and 2 at FL150 after the first descent)[31]
• 20 radio statements made by the pilot at higher altitudes[32] 
  (4 at FL280 in first cruise, 2 on climb to second cruise and 1 just after establishing the second cruise at FL280, and then 13 from 55 minutes later at FL280 during the second cruise).

Analysis

The analysis found that, compared to when at lower altitudes, at higher altitudes, the pilot:

• took significantly longer to respond to ATC communication (2.9 seconds compared to 1.1 seconds)[33]
• spoke at a significantly slower rate (5.9 syllables per second compared to 7.4 syllables per second)[34]
• took slightly longer to begin speaking after they commenced a transmission (0.59 seconds compared to 0.26 seconds)[35]^,[36]
• displayed no change in their average speech fundamental frequency (99.6 Hz compared to 99.8 Hz)
• made operational errors, especially in their later communications, such as providing a callsign twice, failing to provide a callsign, and referring to an incorrect location
• spoke unclearly, especially in their later communications, including stuttering toward the end of their communications (which became pronounced in their final communication). 

During the later series of communications (1341:31 to 1401:23), the pilot’s speaking rate became significantly slower (5.1 syllables per second) than their earlier speech at higher altitudes (7.3 syllables per second).[37] The pilot’s final communication displayed the slowest speech of all their communications during the flight (2.81 syllables per second). There was also one occasion when the pilot appeared to unkey and then rekey the microphone when speaking (1359:26) and one occasion when the microphone was keyed but the pilot did not speak (1400:27). 

There appeared to be some improvement in the pilot’s speech while the aircraft spent a short time at FL150 compared to their speech during the initial cruise at FL280, with a more rapid response to the controller, a more rapid response after commencing transmission, a faster speaking rate, and clear and accurate communication. However, only limited samples were available to compare these 2 periods. 

The analysis concluded that the speech samples provide evidence of significant and progressive impairment once the pilot reached FL280, including errors, slowed responses, misarticulations and, eventually, a failure to respond. Overall, the analysis determined that, although the pattern of symptoms could be consistent with a variety of environmental and medical issues, their correlation with altitude strongly indicated impairment by hypoxia.

Air traffic services 

Overview

Airservices Australia was the responsible authority for the provision and administration of civil air traffic services in Australia. The stated objectives of the organisation’s air traffic services, as contained in the Manual of Air Traffic Services,[38] were to: 

a) prevent collisions between aircraft;

b) prevent collisions between aircraft on the manoeuvring area and obstructions on that area;

c) expedite and maintain an orderly flow of air traffic;

d) provide advice and information useful for the safe and efficient conduct of flights; and

e) notify appropriate organisations regarding aircraft in need of search and rescue aid, and assist such organisations as required.

Service types

Airspace in Australia was separated into different classes that were either controlled (class A, class C, class D, and class E) or non-controlled (class G). Different services were offered to aircraft that operated in these airspace classes, based on the flight rules the aircraft was operating under. These services included ATC (en route, approach, and aerodrome), flight information, and alerting. These services were provided by air traffic controllers located at specific aerodromes or 1 of the 2 air traffic control centres located in Melbourne, Victoria and Brisbane, Queensland.

At the time of the accident, the aircraft was operating in class A airspace and received an en route control service from a controller located in the Brisbane ATC centre. 

Airspace

Brisbane Centre was responsible for providing air traffic services to aircraft operating within the Brisbane flight information region (Figure 17). The Brisbane airspace was further divided into smaller volumes of airspace, called regions, with assigned air traffic controllers. 

Figure 17: Flight information regions

Source: Airservices Australia, annotated by the ATSB

While the aircraft was on climb to its cruise level of FL280, the aircraft transitioned into an area of airspace defined as the ‘Simpson’ region, where it spent the remainder of the flight. The Simpson region covered an area of about 2 million km² from the ground level to FL285. Its border started about 160 km inland from the east coast of Queensland and included central and north Queensland, parts of the Northern Territory, and sections of the Torres Strait (Figure 18). 

Figure 18: Brisbane flight information region (Simpson region airspace highlighted)

Source: Airservices Australia, annotated by the ATSB

The airspace was ‘dynamic’ and could be divided into smaller sectors, depending on the volume or complexity of aircraft traffic, with a controller assigned to each sector. Within the region, the lower level of class A and class E (controlled) airspace was FL245 and FL125 respectively. 

At the time of the accident, the air traffic activity within the Simpson region was low, and the airspace was ‘fully combined’ meaning the whole of the Simpson region was being controlled by one controller. 

Also present within the Brisbane Centre at the time was a shift manager (SM), who was responsible for the oversight of the Simpson region’s controllers, and the air traffic management director (ATMD), who had overall responsibility for both the Brisbane and Melbourne airspace.

Air traffic control personnel

Simpson region air traffic controller

There were 2 air traffic controllers who managed VH-HPY while it was within the Simpson region airspace:

• controller 1 had responsibility for the region for 90 minutes and managed most of the loss of communications and hypoxia response
• controller 2 had responsibility for the region for 15 minutes during the period while controller 1 was in break.

All references to the ‘Simpson region controller’ contained herein refer to controller 1. They joined Airservices in 2012 and had about 9 years experience as an en route controller, all within the Brisbane Centre. 

Shift manager

The SM joined Airservices Australia in 2004. Their experience included about 7 years as an area radar controller, 2 years as an operations manager, and 9 years as a SM.

Air traffic management director

The ATMD’s experience included about 27 years as an en route controller, 3 years as a SM, 2 years as an operations manager, and 1 year as an ATMD. 

Emergency phases

Emergency phases were declared by ATC in instances where there was concern for the safety of an aircraft and its occupants. The procedures for the declaration of emergency phases for aircraft were contained in the Manual of Air Traffic Services and included:

• An uncertainty phase (INCERFA) which was declared by ATC when uncertainty existed as to the safety of an aircraft and its occupants. The scenarios under which an INCERFA could be declared included a failure of a pilot to report to ATC 30 minutes after being assigned a frequency change.
• An alert phase (ALERFA) which was declared when apprehension existed as to the safety of an aircraft and its occupants. 

Emergency phases could be upgraded when air traffic control became ‘aware of additional factors that warrant greater apprehension’. This included:

• following an uncertainty phase declared because of failure to report, subsequent communications checks or inquiries to other relevant sources fail to reveal any news of the aircraft; [or]

• information has been received which indicates that the operating efficiency of an aircraft has been impaired to the extent that the safety of the aircraft may be affected.

If an aircraft was subject to an ALERFA declaration and the situation was relieved, but not to the extent that normal operations had been resumed, ATC could downgrade the ALERFA to an INCERFA.

If an aircraft was subject to an emergency phase and had resumed normal operations, or had landed safely, then ATC would cancel the phase and advise relevant units and agencies.

Hypoxic pilot procedures

The procedures to be applied by ATC in the case of specific in-flight emergencies were contained in the Airservices In-Flight Emergency Response (IFER) checklist. This included the actions to take if ATC suspected a pilot was potentially impacted by hypoxia.

The IFER checklist for a suspected hypoxic pilot scenario included the information to be passed to the pilot, the actions to take should escalation be required, and the instructions to issue the pilot to initiate a descent (Figure 19).

Figure 19: Airservices Australia IFER hypoxia checklist

Source: Airservices Australia

Supplemental procedures associated with all types of in-flight emergencies were also contained within the ‘normal operations resumed’ section of the Airservices Australia IFER Management Abnormal Operations manual. This section stated:

Extensive experience, both in Australia and overseas, shows that crews often try to down-play problems when communicating with [air traffic control]. Furthermore, what may be normal as far as the crew is concerned may still preclude the operational system from operating normally.

This section also stated:

If there is the slightest doubt about the continuing safety of the aircraft, it is prudent to continue with the IFER even if at a low key.

Airservices noted this manual was considered training material and reported that controllers do not use it when they are plugged into the console, rather, they only use the IFER Checklist.

Simpson region controller divided attention

Between 1357:43 and 1401:36, the pilot repeated the clearance from the controller 4 times, and twice requested confirmation that the Simpson controller had copied their clearance readback. During this time the Simpson region controller recalled that a lot of activity took place in the vicinity of their console to do with the previously-held concerns for the aircraft’s safety. This included questions from those located near the console. Additionally, during that 3 minute 53 second period there were 3 transmissions made by 2 other aircraft within the Simpson region. The controller responded to both aircraft without delay.

Organisational information

General

At the time of the accident, AGAIR held an air operator’s certificate issued by CASA on 19 May 2020, valid until 30 November 2023, which authorised ‘charter operations’ (CASR part 135) and ‘aerial work operations’ (CASR part 137 and 138). It also held a CASR part 141 flight training certificate that was valid until 28 February 2025. 

AGAIR operated a mixed fleet of aircraft that comprised 3 Gulfstream 690 and 695, 2 Cessna C525, 9 Air Tractor AT802, a Cessna C337 and a Beech Baron. Its main base of operations was located at Stawell Airport, Victoria. AGAIR also had an aerial application (crop spraying) base located at Hay Airport, New South Wales (NSW).

AGAIR provided aerial application services to south-western NSW. It also had contracts to provide aerial services to fire agencies in Queensland, NSW and Western Australia. AGAIR engaged a mixture of permanently‑employed and seasonal pilots to complete aerial application and aerial fire operations.

Organisational structure

The chief executive officer (CEO) was the sole owner of the organisation. In addition to the CEO role, they also held the CASA‑approved positions of head of flying operations (HOFO) and head of aircraft airworthiness and maintenance control (HAAMC). The CEO worked from the AGAIR base at Stawell Airport. The approved organisational structure was documented in the AGAIR operations manual (OM) (Figure 20). 

Figure 20: AGAIR organisational structure

Source: AGAIR

The AGAIR organisational structure depicted all flight crew reporting to the head of training and checking. However, this role was vacant at the time of the accident, as was the head of operations (flight training) position. The CEO stated that the organisation did not have an approved training and checking system, and that they (as HOFO) were undertaking aspects of the role until the organisation received its approval. However, neither the unapproved nature of the training and checking system or the additional training and checking activities undertaken by the HOFO were captured in the AGAIR OM.

The defined responsibilities of the HOFO included:

• The implementation of company policy and ensuring that all company air operations are conducted in full compliance with the Civil Aviation Act 1988, CASRs and CAOs

• Monitoring operational standards, maintaining training and checking records and supervising the training and checking of flight crew

• The allocation of aircraft appropriate to the planned task

The AGAIR OM also stated that the HOFO ‘in exercising any responsibility may delegate to other members of the company certain duties’. The CEO/HOFO stated that they had passed operational control of the line scanning activities to the chief operating officer (COO). This included flight crew reporting, and that the pilot of the accident flight reported to the COO at the time of the accident. This was not reflected in the approved organisational structure, and the AGAIR OM did not contain defined responsibilities for the COO role. 

During interview, the COO confirmed their role included the oversight of the line scanning operations in VH-HPY, which involved overseeing the installation and testing of the camera equipment, mission planning, and client management. 

Safety management system

Introduction

CASA defined a safety management system (SMS) as:

…a systematic approach based on managing risk through setting goals, capturing data, measuring performance and system refinement for managing safety risks. An SMS is woven into the fabric of an organisation that enables effective risk based decision-making processes across the business where risks are identified and continuously managed to an acceptable level.

At the time of the accident, AGAIR was required to have submitted an SMS implementation plan to CASA, but it was not required by aviation legislation to have an approved SMS or safety manager (see SMS implementation). 

Outsourced safety management function

At the time of the accident, AGAIR outsourced its safety management functions to an entity named AVIARC. It provided AGAIR with a nominated safety manager and oversaw the development, implementation and ongoing management of the SMS. This contractual arrangement commenced in mid-2021. 

The nominated safety manager was located at the AVIARC office in Red Hill, Queensland. They attended the AGAIR Stawell and Hay bases about 2 times a year, with most of the safety management work undertaken remotely. An online database, which was accessible by AGAIR and AVIARC personnel, was used for occurrence reporting and the ongoing management of safety functions.

SMS implementation

On 25 November 2022, AVIARC, on behalf of AGAIR, submitted a nomination for a safety manager, safety management manual (SMM) (issue 1 revision 1 dated November 2022), and SMS implementation plan to CASA. At the time of the accident, neither the SMM nor the nomination for safety manager had been assessed by CASA. CASA stated that no assessment had taken place as neither were required to have been submitted. Additionally, AGAIR had not specifically applied to be an early SMS adopter or completed the appropriate application submission for the approval of the safety manager.

The implementation plan submitted to CASA outlined the phased implementation of the SMS. In the supporting letter to CASA, the nominated safety manager stated that:

the Agair Safety Management System is ‘Present’ and ‘Suitable’ in every aspect, and also ‘Operational’ and ‘Effective’ in many others. 

The AGAIR SMS implementation plan did not contain specific timeframes for the implementation of each phase other than to state:

the entire plan may take several years to reach full implementation.

The most recent revision to the AGAIR safety management system took place in June 2023 (SMM issue 4 revision 1), and this version was implemented at the time of the accident. 

System effectiveness

Overview

The ATSB reviewed the AGAIR SMS as implemented at the time of the accident. This involved the review of safety data recorded over the period 2019–2023. Although it was found that AGAIR did have the basic elements necessary to capture and manage operational hazards at the time of the accident, many of these elements were partially implemented, did not meet current defined safety objectives, or contained deficiencies that may have impacted system efficacy. 

The nominated safety manager stated that they were unaware of the intermittent pressurisation defect with VH-HPY, or the practice of operating the aircraft at a hazardous cabin altitude. The AGAIR CEO/HOFO confirmed that they had not raised the pressurisation issue with the safety manager either directly or during the various safety management meetings.

Safety management meetings

The AGAIR SMS had 4 levels of safety meetings:

• executive safety review meetings
• safety action group meetings
• base safety meetings in both Stawell Airport and Hay Airport locations
• CEO touchpoint meetings.

In the 3 years prior to the accident, AGAIR had conducted 14 safety action group meetings, 14 base safety meetings and 8 CEO touchpoint meetings. The minutes from these meetings did not contain any reference to the pressurisation issue involving VH-HPY or the continued risk of operating the aircraft at a hazardous cabin altitude. No executive safety review meetings had taken place. The AGAIR safety manager advised the ATSB that the content of the executive safety review was captured by the CEO touchpoint meetings.

Hazard and occurrence reporting

Interviews with AGAIR personnel and emails sourced during the investigation indicate that at least 8 current or previous AGAIR personnel had awareness of a pressurisation issue with VH-HPY over a period ranging from 1 month to greater than 2 years prior to the accident. Additionally, at least 4 current AGAIR personnel had awareness of the practice of operating the aircraft with an excessive cabin altitude over a period ranging from 1 month to greater than 12 months prior to the accident.

In the 5 years prior to the accident, a total of 62 reports had been submitted into the AGAIR reporting system. Thirty-four of these were work health safety (WHS) or non-operational reports including injuries and infrastructure issues. A total of 28 of the submitted reports related to aviation safety matters including wildlife and airspace issues (Figure 21). There were no instances of either the pressurisation issue or the continued operation of the aircraft with that defect raised within the system. 

Figure 21: AGAIR hazard and occurrence reporting data from years 2019 to 2023

Source: ATSB

The reporting target defined within the AGAIR SMM at the time of the accident was 24 reports per year. However, it was unclear if this target was to also include non-operational reports. Regardless of the composition, this reporting target had not been achieved. A review of CEO touchpoint meeting minutes found that the 2 meetings conducted prior to the accident in September 2023 and October 2023 both referenced a low reporting rate. Other than stating the ‘CEO will encourage pilots to report on issues via usage of the ORAT’ it was unclear what, if any, action had been taken to improve reporting following these meetings. The safety manager had promulgated 4 messages to AGAIR personnel regarding reporting during the period October 2022 to September 2023, but these predated the 2 CEO touchpoint meetings.

During interview with the ATSB, the CEO/HOFO recalled that they always encouraged personnel to submit issues into the safety management system. They also stated that they had not entered the intermittent pressurisation defect into the SMS themselves, nor had they given thought about doing so. During interview with the ATSB, the safety manager stated that both the intermittent defect and the continued operation of the aircraft should have been reported into the SMS.

Hazard register

AGAIR had a hazard register that contained 268 identified hazards across the various activities conducted by the organisation. There were no instances of either the pressurisation issue or the continued operation of the aircraft with such a defect raised within the register. There was also no reference to the operation of pressurised aircraft or line scanning operations within the register.

Internal audits

AGAIR had conducted 19 internal audits in the 5 years prior to the accident. This was composed of 9 WHS or non-operational audits and 10 operational audits. Ninety per cent of the completed audits resulted in no findings and there were no instances of either the pressurisation issue or the continued operation of the aircraft having been identified. No audit of the line scanning operation had been conducted. 

A review of the internal audits by the ATSB found that most of the operational audits were completed by the department owner, for example aircraft fleet audits conducted by the HOFO and HAAMC, in contradiction to the documented procedures contained within the AGAIR SMM current at the time that stated:

the AGAIR SMS audit processes are conducted by persons and departments independent of the functions being audited. … For Internal audits, where an independent auditor is not available, AGAIR can retain the services of a third-party auditor. 

The SMM also stated:

AGAIR uses ‘normal operations’ monitoring methods, to gather hazard information from the normal daily routine workflow. This may include Line Operations Safety Auditing (LOSA), and/or Normal Operations Safety Surveys (NOSS) conducted by the ASM [safety manager] or delegate, on a randomly continuous basis as opportunity arises during the normal course of business.

No LOSA or NOSS had been conducted in the 5 years prior to the accident. 

Management of change

The AGAIR safety management manual current at the time contained procedures for the management of change and stated ‘AGAIR adheres to a policy of systematic change management’. The triggers for the initiation of the change management process included:

• addition of new aircraft type, or more of the same aircraft type

• introduction of new equipment and/or operational procedures

• organisational restructure

• new types of operation

• changes to key personnel

• restructure of operational departments

• acquisition of equipment

• change in customer base.

In the 5 years prior to the accident, no change management activities had been documented. 

Training and education

SMS training was recorded as current for all involved AGAIR personnel at the time of the accident.

Regulatory oversight

Civil Aviation Safety Authority 

Overview

CASA was responsible, under the provisions of Section 9 of the Civil Aviation Act 1988, for the safety regulation of civil air operations in Australia and of Australian aircraft outside of Australia. This included issuing certificates, licences, registrations and permits, and conducting comprehensive aviation industry surveillance. 

The primary means CASA used to oversight authorisation holders[39] were:

• regulatory service activities (for example, assessing applications for the issue or variation to an authorisation holder’s approvals)
• surveillance events.

Surveillance events

CASA undertook surveillance of an authorisation holder to assess the safety performance and compliance with regulatory requirements. This surveillance could be initiated:

• based on a planned schedule
• in response to outside events such as accidents or complaints
• by a regulatory service task
• as part of a national campaign focused on a particular industry sector. 

There were 2 levels of surveillance undertaken by CASA. A level 1 event was usually structured to assess an authorisation holder’s system capabilities. These were large surveillance activities that often took place over several days and involved a multi-disciplinary team. A level 2 event was a less formal activity that was usually shorter in duration and was often focused on the verification of a process in practice. Both levels of surveillance could be conducted onsite or by desktop assessment.

Surveillance events were scoped to assess defined areas of an authorisation holder’s approved activities. Determining the scope of surveillance events incorporated elements of judgment by CASA staff in assessing risk and was informed by a range of information including previous surveillance events, and other safety data related to an authorisation holder. The effectiveness of the associated process(es) would then be assessed using a variety of techniques including process sampling. The limitations of process sampling included that a deficiency could exist within an area outside the defined scope of a surveillance event, that a process might not be sampled to the breadth or depth needed to uncover an issue, or that a process containing an issue might not be sampled at all.

At the conclusion of a surveillance event, CASA would issue a report and any identified findings to the authorisation holder. These findings were classified as:

• safety alerts – used to raise an immediate safety concern regarding a serious breach
• safety findings – used for the purposes of identifying a breach of a legislative provision or a provision of the authorisation holder’s written procedures
• aircraft survey reports – used to provide the registered operator of an aircraft with notice of a potential or actual aircraft defect
• safety observations – used to identify latent conditions resulting in system deficiencies that, while not constituting a legislative or procedural breach, have the potential to result in such a breach if not addressed, or potential areas for improvement in safety performance.

An authorisation holder was required to respond to all findings except for safety observations. If issues identified in a finding were not addressed, the authorisation holder could be subject to regulatory enforcement action, which involved CASA exercising specific legislative powers to alter the legal rights or obligations of the authorisation holder. 

Authorisation holder performance indicator 

The authorisation holder performance indicator (AHPI) tool was an assessment of an authorisation holder completed periodically by CASA. The tool was used until June 2022. The questionnaire covered factors associated with an authorisation holder’s management, organisation, operations, and regulatory history. An overall value was then given, which resulted in the authorisation holder being assigned to either category 1 (higher level surveillance focus required) or category 2 (normal surveillance level appropriate).

AGAIR pre-accident regulatory services

Regulatory service activities of note provided to AGAIR between November 2018–November 2023 included:

• variation to the system of maintenance for VH-HPY (2019)
• renewal of the air operator’s certificate (2020)
• initial issue of a CASR part 141 flight training certificate (2020)
• renewal of the CASR part 141 flight training certificate (2022)
• voluntary suspension of the CASR part 141 flight training certificate (2023).

AGAIR pre-accident surveillance 2018–2023  

Overview

There were 6 AHPI assessments undertaken on AGAIR during 2018‍–‍2022. All assessments resulted in AGAIR being assigned with category 2 (normal level of surveillance appropriate). 

During November 2018–November 2023, AGAIR was also subject to 6 authorisation holder surveillance events (Table 7). This was composed of one level 1 event and 5 level 2 events that included surveillance associated with the variation to the manufacturer’s maintenance schedule for VH‑HPY (January 2019), renewal of the air operator’s certificate (April 2020), and regulatory service tasks. AGAIR had not been subject to any regulatory enforcement action in the 5 years prior to the accident. Further details on 2 surveillance events of note during that period, events 18876 and 18981, are provided in the following sections. 

Table 7: AGAIR surveillance events

Surveillance event 18876 (January 2019)

In January 2019, AGAIR applied to CASA for a one-off approval to vary the validity period for the maintenance release inspection for VH-HPY from 165 hours to 180 hours. At the time of the application, the aircraft had accumulated 6,521.2 hours, with the maintenance release valid for 150 flight hours (up to 6,512.9 hours). However, the maintenance schedule also permitted a non‑cumulative planning tolerance of an additional 15 hours (up to 6,527.9 hours). CASA subsequently granted AGAIR’s request. 

Subsequent CASA review of the maintenance release identified that VH‑HPY had operated 8.3 hours beyond the 150-hour validity period of the maintenance release at the time of the application to CASA and a safety finding was raised. However, CASA acknowledged that the aircraft was still within the 15-hour planning tolerance published in the manufacturer’s maintenance schedule.

AGAIR responded to the safety finding, stating that the organisation had misinterpreted the allowable 15 hour ‘grace’ period within the system of maintenance which required a logbook statement and the maintenance release show the actual expiry time of 165 hours rather than 150 hours. An amended logbook statement for VH‑HPY was provided to CASA in May 2019 and the finding was acquitted by CASA in October 2019.

Surveillance event 18981 (May 2019)

In February 2019, CASA received correspondence from the New South Wales (NSW) Rural Fire Service (RFS)[40] that contained concerns raised by an AGAIR pilot. The concerns raised by the pilot included: 

• ‘numerous ongoing maintenance issues’ with 2 aircraft used by AGAIR,[41] VH‑LVG (an Rockwell Commander 690A) and VH‑CLT (a Rockwell Commander 690B)[42]
• senior AGAIR personnel providing conflicting advice to pilots on the continuation of operations with aircraft defects that (according to the reporting pilot) impacted the safety of operations ‘on a daily basis’
• deferring the rectification of aircraft defects that impacted the safety of operations
• non-compliant flight and duty rostering practices affecting pilot fatigue. 

The concerns raised by the pilot did not contain any information on specific defects, other than reference to an issue with the air conditioning system of VH-LVG, which the pilot indicated had resulted in a very hot and fatiguing cockpit environment and resulting in tablets used as electronic flight bags (EFBs) entering thermal shutdown. 

In response to the raised concerns, CASA initiated an onsite level 2 surveillance event that took place in May 2019. The surveillance was scoped to assess airworthiness control, crew scheduling and authorised activities. The surveillance team was composed of a flying operations inspector (FOI) and an airworthiness inspector (AWI). The surveillance event was conducted over a single day at AGAIR’s Stawell Airport facility and, according to the surveillance report and subsequent interviews with the involved AWI, the event involved:

• interviews with the CEO (chief pilot and HAAMC) and a senior pilot
• a review of flight and duty time records, AGAIR operations manual, and the current maintenance release for VH-LVG[43]
• a non-intrusive, visual inspection of VH-LVG, and an Air Tractor.

The surveillance report, issued to AGAIR, stated:

The aircraft maintenance release for VH-LVG, Rockwell Turbo Commander 690B was reviewed and found to have no defects noted from operating pilots regarding any safety of flight issues. The release appeared to be managed correctly.

As a result of the surveillance, CASA issued AGAIR one safety finding and 3 observations (Table 8). The finding related to flight and duty rest requirements, which was one of the issues the pilot had raised with the NSW RFS.

Table 8: Surveillance event 18981 findings

The ATSB reviewed the surveillance file and interviewed the AWI who undertook the May 2019 surveillance activity. The surveillance file contained limited information about the planning and actual conduct of the surveillance, and the FOI involved was no longer working for CASA and was not interviewed. 

The AWI recalled that they had not themselves been in contact with the reporting pilot, and was unsure whether others at CASA had done so. There were no records on the surveillance file to indicate whether CASA contacted the pilot who wrote to the NSW RFS to assist in the planning for the event. However, usual practice was for CASA to make contact before any surveillance event was approved, so such a record may not have been stored in the surveillance file. The ATSB was unable to contact this pilot.

The AWI recalled that it was generally the approach that when conducting surveillance activities of authorisation holders that were involved in firefighting activities, the events were scheduled outside of the peak fire season to minimise the operational impacts to the holder from these activities. 

At the time of the surveillance event, the AWI recalled that they had no previous interactions with AGAIR or GAM. Further, the AWI recalled that CASA’s approach to the surveillance was to determine if there was validity to the pilot’s complaint. The AWI advised that both aircraft inspected were in good condition. The historical (expired) maintenance releases and the aircraft logbooks were located at the aircraft’s maintenance provider (GAM) facility at Essendon Airport, Victoria, and were not reviewed. The AWI recalled that there was no evidence from their visit to suggest that there was activity going on that was not being documented, and nothing to indicate additional surveillance was necessary. 

The ATSB was unable to determine if the safety finding related to pilot flight and duty times had been acquitted based on the available records.

ATSB review of VH-LVG maintenance records

The ATSB undertook a review of the maintenance records for VH-LVG from December 2014–April 2023. This included a crosscheck of the information contained within historical maintenance releases and the information contained within the aircraft airframe, engine, and propeller logbooks.

The maintenance release current at the time the AGAIR pilot raised their concerns, very likely the same maintenance release reviewed by the AWI during the surveillance event, contained 2 annotated items within the defects section. Both had been entered by a licenced aircraft maintenance engineer (LAME) on 11 February 2019:

• ‘TRAFFIC PROCESSOR REQ SERVICE’
• ‘RUDDER TRIM IND FLICKERING’. 

These defects had been rectified during unscheduled maintenance endorsed on 15 and 27 February 2019. 

Of the 7 maintenance releases that were valid from December 2014 to May 2019, 5 had no defect entries. Further ATSB examination identified about 10 entries of unscheduled work recorded in the airframe logbook with the characteristics of defects that could have appeared during operations and been identifiable by pilots. It was not determined whether these defects had been knowingly deferred.

This work was carried out during scheduled 150-hourly checks. Most of these defects were minor with the exception of one entry that related to the right engine oil pressure indicating system. 

AGAIR post-accident surveillance 

In response to the accident involving VH-HPY, CASA conducted a level 2 surveillance event (number 28544) of AGAIR in January 2024 at Avalon Airport, Stawell Airport, and Essendon Airport, Victoria. The surveillance was scoped to assess airworthiness assurance and airworthiness control, crew scheduling and authorised activities, and it was completed over 3 days. Personnel from one of AGAIR’s maintenance providers, GAM, were also interviewed as part of the surveillance event. The surveillance team was composed of 2 AWIs. One safety alert, 5 safety findings and 2 safety observations were issued to AGAIR (Table 9).  

The primary issue identified by CASA was AGAIR operating its Gulfstream 690 and 695 aircraft (VH-HPY, VH-LVG and VH-LMC) with known defects not recorded on the maintenance release and operating these aircraft with scheduled maintenance overdue. 

CASA reported that the related findings were primarily supported by evidence from crosschecking the maintenance releases and aircraft logbook certifications. Additional supporting information also included personnel interviews and an internal GAM email record from March 2023 listing numerous defects provided to them by an AGAIR pilot. CASA did not conduct a review of the entire history of each aircraft, but issues were identified for VH-LVG and VH-LMC between the years 2022 and 2023. A more in-depth review was conducted on VH-HPY since it was involved in the accident, and this review identified issues that existed between the years 2018 and 2023. 

AGAIR provided CASA with responses to the safety alert and safety findings. These responses were under assessment at the time of publication.

Table 9: Surveillance event 28544 findings

GAM pre-accident surveillance 2018–2023

There were 3 AHPI assessments undertaken on GAM between 2018 and 2022. All assessments resulted in GAM being assigned with category 2 (normal level of surveillance appropriate). 

Between November 2018–November 2023, GAM was subject to one surveillance event that was conducted in May 2023. The CASA surveillance team was composed of 2 AWIs and one safety systems inspector. The event was conducted onsite at GAM’s Essendon Airport facility over 2 days. Three safety observations were issued to GAM related to non-destructive testing and safety assurance improvements. 

GAM post-accident surveillance 

Following the post-accident surveillance of AGAIR, CASA conducted a level 2 surveillance event (number 28605) of GAM onsite at its Essendon Airport facility over 2 days in April 2024. The surveillance team was composed of 2 AWIs, and the scope included approved maintenance organisation operations, data and documents, and maintenance activity. Six safety findings and 2 observations were raised as a result (Table 10). 

The primary issue that CASA identified was that GAM had not appropriately managed the conduct of aircraft modifications on 2 Gulfstream 695A aircraft. This included the installation of the TK-7 camera system on VH-HPY.

GAM provided CASA with responses to the safety findings. These responses were under assessment at the time of publication. 

Table 10: Surveillance event 28605 findings

Related occurrences

The ATSB occurrence database contained 6 other serious incidents and accidents that were investigated involving pilot incapacitation due to altitude hypoxia.

Pilot incapacitation involving Raytheon Aircraft Super King Air 200, VH‑OYA, 72 km east of Edinburgh Airport, South Australia, on 21 June 1999 (ATSB investigation 199902928)

On 21 June 1999, a Raytheon Aircraft Super King Air 200, VH-OYA, departed Edinburgh, South Australia for Oakey, Queensland with 1 pilot and 2 passengers. One of the 2 passengers, who was also a pilot but not qualified to operate the aircraft type, occupied the co-pilot seat. The other passenger was seated in the cabin. All 3 occupants were serving RAAF personnel.

As the aircraft reached the cruise level of FL250, the controller contacted the pilot, indicating that the aircraft was not maintaining the assigned track. The pilot acknowledged this transmission. A short time later the passenger in the co-pilot seat noticed that the pilot was repeatedly performing the same task to do with GPS programming. The controller advised the pilot again that the aircraft was still off track, however the pilot did not reply to this transmission. Shortly after this, the pilot lost consciousness. The passenger in the co-pilot seat took control of the aircraft and commenced an emergency descent. The other passenger then unstowed the pilot's oxygen mask and took several breaths of oxygen from it before fitting it to the unconscious pilot. Neither passenger donned an oxygen mask during the incident. The pilot recovered consciousness during the descent, and once they had regained situation awareness, resumed control of the aircraft and carried out an uneventful landing.

The investigation concluded that both bleed air switches were inadvertently selected to ENVIR OFF during the climb. It was also found that the cockpit warning system did not adequately alert the pilot to the cabin depressurisation, and the oxygen mask deployment doors were incorrectly orientated during installation so that the masks would not automatically deploy when required. The ATSB also identified that hypobaric training did not provide an effective defence to ensure that the pilot or passengers would identify the onset of hypoxia.

Pilot and passenger incapacitation involving Beech Super King Air 200, VH‑SKC, Wernadinga Station, Queensland, on 4 September 2000 (ATSB investigation 200003771)

On 4 September 2000, a Beech Super King Air 200 aircraft, VH-SKC, departed Perth, Western Australia on a charter flight to Leonora with 1 pilot and 7 passengers on board. Shortly after the aircraft had climbed through its assigned altitude, the pilot’s speech became significantly impaired and they appeared unable to respond to ATC instructions. Open microphone transmissions over the next 8 minutes revealed the progressive deterioration of the pilot towards unconsciousness and the absence of any sounds of passenger activity in the aircraft. No human response of any kind was detected for the remainder of the flight. Five hours after taking off from Perth, the aircraft impacted terrain and was destroyed. There were no survivors.

The investigation concluded that the incapacitation was probably a result of altitude hypoxia due to the aircraft being fully or partially unpressurised and the occupants not receiving supplemental oxygen. Due to the extensive nature of the damage to the aircraft caused by the impact with the ground, and because no recording systems were installed in the aircraft (nor were they required to be), the investigation could not determine the reason for the aircraft being unpressurised, or why the pilot and passengers did not receive supplemental oxygen.

Uncontrolled flight into water involving Cessna 208B, VH-FAY 260 km north-east of Narita International Airport, Japan, on 27 September 2018 (ATSB investigation AO-2018-065)

The pilot of a Cessna 208B aircraft, registered VH-FAY, was contracted by the aircraft operator to ferry VH-FAY from Jandakot Airport, Western Australia to Mississippi, United States. On the morning of 27 September 2018 local time, the aircraft departed Saipan International Airport, Northern Mariana Islands, for a planned flight to New Chitose Airport, Hokkaido, Japan. After climbing for about an hour, the aircraft levelled off at FL220. 

After 2 hours 20 minutes flight time, the pilot contacted Tokyo radio flight information service at the first mandatory reporting position. The aircraft passed the next reporting point at the same altitude, 1 hour 20 minutes later, but the pilot did not contact Tokyo radio as expected. Tokyo radio made repeated attempts to communicate with the pilot, without success. Having received no communications from the pilot for 4.5 hours, 2 Japan Air Self-Defense Force aircraft intercepted VH-FAY. The pilot did not manoeuvre the aircraft in response, in accordance with international intercept protocols. 

After about 30 minutes, the Japan Air Self-Defense Force pilots observed VH-FAY descend into cloud. The aircraft descended rapidly and disappeared from radar less than 2 minutes later. Within 2 hours, search and rescue personnel located the aircraft’s rear passenger door. No other aircraft wreckage was located and the pilot was not found.

The ATSB found that while the aircraft was in the cruise on autopilot, the pilot almost certainly became incapacitated and did not recover. About 5 hours after the last position report, without pilot intervention to select fuel tanks, the aircraft’s engine stopped, likely due to fuel starvation. This resulted in the aircraft entering an uncontrolled descent into the ocean. The cause of incapacitation could not be determined. While a medical event could not be ruled out, the pilot was operating alone in an unpressurised aircraft at 22,000 ft and probably using an unsuitable oxygen system, which increased the risk of hypoxia.

Depressurisation event involving a Metro 3, VH-SEF, 93 km south-south-east of Narrabri Airport, New South Wales, on 23 September 2012 (ATSB investigation AO-2012-127)

On the evening of 23 September 2012, a Metro 3 aircraft, VH-SEF, departed Narrabri, New South Wales on a scheduled passenger flight to Sydney with 2 pilots and 7 passengers. During the climb, the captain began to feel unwell and their symptoms worsened as the climb progressed. The captain used the aircraft’s oxygen supply and noted that their symptoms started to improve. The captain requested the first officer check the cabin altitude, but before they could respond, the cabin altitude warning light illuminated at a cabin altitude of 17,000 ft. An emergency descent to 10,000 ft was subsequently performed.

The flight crew later found that the aircraft’s pressurisation system would not pressurise the cabin in automatic mode, and manual mode resulted in an erratic cabin altitude. Once the aircraft had landed, the pressurisation system was tested with no fault found. The cabin altitude warning switch was found to be out of tolerance and replaced. At the time of the incident, there was no routine maintenance regime for the cabin altitude warning system.

Flight crew incapacitation involving a Reims F406, VH-EYQ, near Emerald Airport, Queensland, on 1 August 2014 (ATSB investigation AO-2014-134)

On the morning of 1 August 2014, a Reims Aviation F406 aircraft, VH-EYQ, departed Emerald, Queensland, on an aerial survey task with a pilot and navigator on board. The aircraft was fitted with an oxygen system to allow unpressurised operations above 10,000 ft. 

During the climb, the pilot turned on the aircraft oxygen supply, and then connected and donned their oxygen mask. The pilot then monitored their blood oxygen saturation level on an oxygen pulse meter as the aircraft continued to climb. During the climb to FL245, at a level of about FL180, the pilot noticed that their blood oxygen saturation level had fallen significantly.

The pilot attempted to increase the amount of oxygen they were receiving, while continuing to climb, by adjusting their oxygen system controller. During this period, the pilot’s accuracy when controlling the aircraft deteriorated and their speech became slurred. The navigator encouraged the pilot to maintain control and descend, and ATC prompted the pilot to ensure they were receiving an adequate supply of oxygen. The pilot eventually identified that their oxygen fitting had disconnected. The fitting was reconnected by the pilot, after which the pilot made a controlled descent before landing at Emerald.

Pilot incapacitation involving Cessna 208B, VH-DQP, near Brisbane Airport, Queensland, on 2 July 2020 (ATSB investigation AO-2020-032)

On the afternoon of 2 July 2020, the pilot of a Cessna 208B aircraft, VH-DQP, was conducting a ferry flight from Cairns, Queensland to Redcliffe. After encountering unforecast icing conditions and poor visibility due to cloud, the pilot climbed from 10,000 ft to 11,000 ft. Later, ATC attempted to contact the pilot regarding the descent into Redcliffe but no response was received from the pilot at that time, or for the next 40 minutes. During this time, ATC, with the assistance of pilots from nearby aircraft, made further attempts to contact the pilot. When the aircraft was about 111 km south-south-east of the intended destination, communications were re-established. The pilot was instructed by ATC to land at Gold Coast Airport. The pilot tracked to the Gold Coast and landed.

The ATSB found that the pilot was likely experiencing a level of fatigue due to inadequate sleep the night before, and leading up to the incident, and consequently fell asleep during the flight. Further, operating at 11,000 ft with intermittent use of supplemental oxygen likely resulted in the pilot experiencing mild hypoxia. This likely exacerbated the pilot’s existing fatigue and contributed to the pilot falling asleep.

Safety analysis

Introduction 

On the morning of 4 November 2023, a Gulfstream 695A, registered VH‑HPY, was tasked to conduct line scanning of fire zones north of Mount Isa, Queensland. On board the aircraft were the pilot and 2 camera operators. 

About 1 hour and 50 minutes into the flight, while the aircraft was in cruise at flight level (FL) 280, air traffic control (ATC) radio contact with the pilot was lost. ATC made multiple attempts to contact the pilot, leading ATC to declare an uncertainty phase for the aircraft. Following a brief telephone conversation with the pilot, where the pilot’s speech was detected to be ‘slow’ and ‘delayed’, ATC upgraded the status to an alert phase and initiated their hypoxia emergency procedures.

About 10 minutes later, radio contact with the pilot was re-established via the crew of a Royal Australian Air Force aircraft, then directly with ATC. The alert phase was downgraded to an uncertainty phase and, a short time later, ATC cancelled the uncertainty phase.

The pilot confirmed with ATC that their oxygen system was operating normally, and they were subsequently issued a clearance to undertake line scanning north of Mount Isa. The pilot made a final radio transmission at 1401:23. Commencing at 1419:19, ATC attempted to repeatedly contact the pilot, but they did not respond to any further radio calls.

At 1426 the aircraft entered a descending anticlockwise turn with an increasing rate of descent. At an altitude of about 10,500 ft, the aircraft likely transitioned into an aerodynamic spin, with a subsequent average rate of descent of about 13,500 ft/min. The aircraft collided with terrain at about 1427, with the wreckage located 55 km south-east of Cloncurry Airport. The 3 occupants were fatally injured, and the aircraft was destroyed by impact forces and a fuel-fed post-impact fire.

This analysis first examines pilot impairment and the accident sequence, and then discusses the maintenance, organisational, air traffic control and regulatory oversight aspects involved.

Altitude hypoxia

The pilot’s speech, as captured by ATC recordings, demonstrated significant and progressive impairment while the aircraft was operating at about FL280. This included errors, slowed responses, misarticulations, and eventually a failure to respond to radio calls.

The pilot’s medical history and the post-mortem examination contained no indications of a pre‑existing medical condition that could have resulted in their impairment. Additionally, camera operator 1 held a commercial pilot licence, with experience flying twin-engine aircraft, and they would likely have been able to operate the aircraft had the pilot experienced a medical event. 

The content of the pilot’s radio transmissions at FL280 were consistent with altitude hypoxia. The vocal symptoms exhibited by the pilot varied significantly with altitude, noticeably improving when the aircraft descended to FL150, then worsening again when the aircraft returned to FL280. These symptoms progressively worsened when the flight was continued at FL280. The pilot’s final radio transmission included an incorrect location reference, stuttering, and the slowest speaking rate of all transmissions.

The effects of altitude hypoxia worsen as pressure altitude increases and over the duration of exposure, and include impairment of cognitive skills, impaired psychomotor coordination, reduced reaction times and loss of consciousness. From the evidence available, further elaborated on below, it is almost certain that during the flight the pilot experienced hypoxia symptoms that degraded their ability to operate the aircraft, and it is possible that the pilot also experienced some loss of consciousness.

The ATSB also identified that the aircraft was likely higher than indicated by the barometric data transmitted by the automatic dependent surveillance broadcast (ADS-B) transponder. During cruise at FL280 it is likely that the actual altitude of the aircraft was at about 29,400 ft, which would have further exacerbated the effects of altitude hypoxia.

Accident sequence

Power reduction

About 4 minutes prior to the accident, when VH-HPY was about 67 km south-east of Cloncurry Airport, the aircraft entered a very shallow descent from FL280, and its airspeed began to decay at a linear rate. Over a period of 2 minutes the airspeed reduced from about 148 to 86 knots calibrated airspeed. 

The flight plan route, and ATC clearance current at the time, was for the aircraft to track to a location near Mount Gordon to undertake line scanning. Both the flight to this location and line scanning were to be conducted at FL280. Consequently, there was no planned operational reason for the aircraft to initiate a descent at the location where the deceleration commenced. 

The linear deceleration, combined with the shallow descent, was estimated to require a reduction in engine power settings to about 25% maximum continuous power (MCP). This value was consistent with the power setting calculated to be used by the pilot earlier in the flight when the aircraft undertook a descent from FL280 to FL150, and significantly less than the 46–48% MCP setting that was calculated to have been used by the pilot during cruise. 

It is possible that, as the aircraft neared Cloncurry, the pilot reduced the power with the intention of undertaking a similar manoeuvre. Overall, there was insufficient evidence to determine why the power levers were reduced during the flight. However, the pilot’s ability to manage the aircraft systems (such as not disengaging the autopilot), or communicate their intentions to ATC, would probably have been impacted by the effects of altitude hypoxia, resulting in the pilot not initiating the descent correctly.   

Departure from controlled flight

The flight data, in conjunction with the wreckage composition and witness observations, indicate the aircraft had entered a stable spin by about 10,500 ft that continued until impact with terrain. 

There was no hazardous weather forecast for the area and the wreckage composition was not consistent with an in-flight breakup with all major components accounted amongst the wreckage at the accident site. While the quantity of fuel onboard the aircraft could not be established, the engine and propeller indications, flight performance data, witness reports, and large post-impact fuel-fed fire were consistent with the engines operating and producing power at impact. 

The aircraft wreckage was surrounded by an undamaged tree and termite mounds, indicating a near vertical trajectory, and the aircraft’s angle of entry was shallow and upright. The aft fuselage was compressed and displaced on the windward side, and the aircraft nose was displaced to the left, indicating clockwise rotation at impact. 

Several possibilities for the aircraft’s departure from controlled flight were examined.

Stall

An aerodynamic stall was examined as a possible mechanism for the aircraft’s departure from controlled flight. However, this scenario was considered unlikely as the calculated stall speed of the aircraft at the time was about 74 kt calibrated airspeed (KCAS), 12 kt less than the calculated airspeed of the aircraft. Additionally, it was calculated that the aircraft engines were producing about 25% MCP, which would effectively decrease the stall speed and result in a further increased margin above the stall. 

Inoperative engine

An inoperative engine resulting in an inability to maintain directional control was also considered and excluded as a mechanism for the departure from controlled flight. While the minimum control speed air (V_MCA) for the aircraft was 95 KCAS, the minimum control speed decreased to approximately 67 KCAS when the 25% MCP engine power was applied to the scenario (assuming half the lateral thrust and thus half the yaw moment). This speed was 19 kt less than the speed of the aircraft. 

Both engines had internal damage indicating they were operating at the time of impact. The damage present on both propellers showed multiple indications that the engines were probably operating at a low to moderate power at the time of impact, further reducing the likelihood of such a scenario. 

Autopilot disengagement

The autopilot trim servo monitor had fault detection and diagnostic capabilities that would automatically disengage the autopilot if it detected an exceedance of threshold voltages within a servo as it worked against an aerodynamic or mechanical force. It is possible that the threshold voltage of the elevator/elevator trim servo was exceeded as the angle of attack increased and, as a result, the autopilot disengaged, and the aircraft began a slow roll to the left. However, no data existed that captured the resistance values within these servos and, consequently, an accurate calculation of the conditions present within the autopilot system could not be achieved. 

Emergency descent

The flight data was consistent with the pilot’s training notes for the execution of an emergency descent which stated, ‘best initiated with roll, using the secondary effect (yaw) to pitch the nose down to the required attitude without causing negative load factor.’ It is therefore possible that the pilot manually disconnected the autopilot and initiated the descent manoeuvre, while managing the effects of altitude hypoxia. It is also possible, albeit less likely, that one of the camera operators may have manually disconnected the autopilot in response to the hypoxic scenario. 

Regardless of the mechanism for the initial departure from controlled flight, the manoeuvre progressed to a high-speed descent with an average vertical speed of about 19,500 ft/min (192 kt vertical). Prior to the aircraft passing 10,500 ft the aircraft transitioned from a high-speed regime to a slow, below stall speed spin. There were 2 scenarios that would likely result in such a transition. They were a pull out of a near vertical dive or spiral dive, without overstressing the airframe to: 

• a climbing attitude allowing the speed to decay to around stall before an uncoordinated entry into the spin; or
• an entry to an accelerated stall due to high ‘g’ acceleration, possibly while attempting to roll wings level. 

The first scenario is unlikely due to there being no evidence of climbing flight in the flight data. 

From an almost certain hypoxic state, with rapid descent into increasing air density and pressure, and with increasing wind noise and possibly airframe buffet, the pilot likely became more aware of their situation and attempted to manoeuvre the aircraft by pulling out of the dive. In a vertical dive pull out, stall speed will increase with normal acceleration. If yaw or roll was present at the time of the stall, it would likely have resulted in the aircraft entering an unintentional spin condition that continued until the aircraft impacted terrain.

Furthermore, being a twin-engine aircraft, spin recovery is not probable due to the relatively large lateral/polar moment of inertia created by the wing-mounted engines. The flight manual contained a section on spin recovery, but it also stated that no spin testing had been conducted.

VH-HPY pressurisation defect and continued operations at high altitude

Pressurisation defect

The aircraft had a pressurised cabin that was designed to permit the aircraft to operate up to a service ceiling of 35,000 ft without the occupants requiring supplemental oxygen. The aircraft was also fitted with an oxygen system, to be used in the event of an emergency such as a cabin depressurisation, that allowed the pilot to make a planned descent to a safe altitude.

However, the aircraft had a known, long-term, unresolved intermittent pressurisation system defect that would occasionally limit the maximum attainable cabin differential to about 2.2 psi. The normal operating cabin differential was about 6.6 psi. The pressurisation defect was known by AGAIR management personnel and pilots, as well as engineering staff at the operator’s maintenance facility (General Aviation Maintenance). This included the AGAIR head of flying operations (HOFO), chief operating officer (COO) and the pilot of the accident flight. While the defect had not been recorded on the maintenance release, nor entered into the AGAIR hazard and occurrence reporting system (SMS), raised at safety meetings or reported to the external safety manager, attempts had been made by GAM engineers to resolve the defect, but these attempts were unsuccessful. 

The defect would manifest during climb, indicated by a low value on the cabin differential gauge, which would give the pilot operating the aircraft the opportunity to cease the climb at a level that would maintain a safe cabin altitude (typically less than 10,000 ft). If the climb was continued, and the cabin altitude exceeded 11,000 ft (± 500 ft), the pilot would be alerted to the unsafe cabin altitude by an aural warning, which could be silenced by the pilot, and a flashing annunciator that would continue for 10–20 seconds and then remain illuminated until the cabin altitude was below the 11,000 ft threshold. In this instance, the pilot’s operating handbook (POH) required the pilot to don an oxygen mask and initiate a descent to 12,000 ft or below.

The POH required the aircraft to be operated unpressurised if a pressurisation system component was inoperative. The aircraft was fitted with an oxygen system, but it was for emergency use only to allow the pilot to make a controlled descent to a safe altitude in the event of a depressurisation or cabin air contamination event. Consequently, with the pressurisation system defective, the aircraft was required by aviation legislation to be operated no longer than 30 minutes continuously between FL125 and less than FL140, or it could be operated indefinitely at a level below FL125.

Pilot actions during previous flights

AGAIR normally conducted line scanning as a single pilot operation along with one camera operator on board. The flights were typically flown at FL280 as it provided for a wide camera swathe and increased fuel economy. Recorded data shows that about 70% of all VH-HPY flights into and out of Toowoomba during 4 September 2023–4 November 2023 involved a cruise at FL280. However, the associated operational procedures (in draft at the time of the accident) permitted line scanning to take place at any altitude at or above 5,000 ft. While management and draft procedures noted FL280 provided the best efficiency for both transiting and scanning, there was no specific requirement for the flights to be conducted only at FL280. 

The pilot of the accident flight undertook their first line scanning flight as pilot in command on 28 September 2023 and flew 24 flights as PIC of VH‑HPY, 19 of which involved a cruise at FL280. Over this period, the pilot sent a series of emails to AGAIR management personnel that described a practice of continuing to operate VH-HPY at FL280 while the pressurisation system was defective. In one such email, the pilot stated that they were regularly spending 90 minutes at a cabin altitude of 19,000 ft while operating at FL280. 

The time of useful consciousness (TUC) at 19,000 ft without a supplemental supply of oxygen could be as low as 18 minutes. To mitigate the risk of hypoxia, the pilot described using the aircraft’s oxygen system for non-emergency use. The oxygen system was designed for emergency use only, and for continuous flight at a cabin altitude of 19,000 ft, the pilot and crew were legally required to use an appropriate oxygen system, that is, a system designed for continued use over the duration of the flight.

The pilot of the accident flight also communicated a practice of conducting brief descents to a lower level as an additional means of managing the effects of hypoxia. A review of flight data revealed that the pilot had conducted similar short descents during 7 flights in the lead-up to the accident. No normal or approved operational requirement for these descents could be established. 

The emails sent by the pilot, and the VH-HPY historical flight data, indicate the pilot had a pattern of normalised deviation from safe operating practices by continuing to operate the aircraft at FL280 when the pressurisation system was defective. However, the pilot was not alone in the practice of continuing to operate the aircraft at FL280 while the pressurisation system was defective (see Organisational influences). These flights were conducted without access to a suitable oxygen supply, significantly increasing the risk of altitude hypoxia induced incapacitation.

The concept of ‘normalisation of deviance’ describes the desensitisation to risk experienced by individuals or groups who repeatedly deviate from safe operating practices, within a high-risk environment, without encountering negative consequences. A prominent feature of the normalisation of deviance is the desensitisation process, where frequent deviant actions result in the practice’s normalisation and perceived standardisation within everyday operations. This sets a new precedent for what is considered tolerable and establishes a new normal from which further deviations may occur. In the absence of intervention (for example, an independent audit), this cycle of deviance is disrupted only when the behaviour results in an undesirable outcome such as an accident (Sedlar and others 2022).

Pilot actions during accident flight

As previously noted, the pilot’s speech and related behaviour while the aircraft was at FL280 demonstrated significant and progressive impairment that was consistent with altitude hypoxia. Within the aviation context, the principal causes of altitude hypoxia are: 

• ascent to high cabin altitude without the use of supplemental oxygen
• failure of the supplemental oxygen system, or oxygen set to an inadequate concentration and or pressure, while at high cabin altitude
• depressurisation of the pressure cabin at high altitude (Gradwell 2016).

In addition, and as previously stated, the pilot of the accident flight had a normalised practice of operating VH-HPY at FL280 with the pressurisation system defective, resulting in a cabin altitude of 19,000 ft. The pilot’s strategies for mitigating the effects of hypoxia during these flights was to undertake descents to lower flight levels for a short period of time and use of the aircraft oxygen system for non-emergency use.

During the accident flight, at about 1141, the pilot undertook a descent to FL150 for a period of about 6 minutes, before climbing back to FL280. The descent was not part of the submitted flight plan and there was no operational reason for the descent to occur. The descent, which was consistent with the pilot’s practice for hypoxia management, almost certainly indicates that the aircraft's pressurisation system did not attain the required cabin altitude.

Although the aircraft cabin altitude at FL280 was not recorded and had not been reported by the pilot during the accident flight, if the aircraft pressurisation system defect manifested as it had done on previous flights, the cabin altitude at FL280 would have been about 19,000 ft. The TUC at 19,000 ft could be as low as 18 minutes, however the aircraft had been in cruise for about 90 minutes when the pilot made their final radio transmission. Although TUC is dependent on individual factors, the extended period beyond the calculated TUC may indicate that the pilot used the oxygen system for non-emergency use during cruise, as they had also done during previous flights.

The oxygen system included 2 rapid-donning masks in the cockpit and drop‑down masks within the cabin. It is unclear how these masks may have been used with 3 occupants on board the aircraft. There was one cylinder that provided oxygen to the cockpit and cabin masks which was refilled during the maintenance activity that took place 4 days prior to the accident. The aircraft had flown 2 flights since the refill so the amount of oxygen contained within the cylinder when the aircraft departed could not be determined. However, assuming the cylinder was at 1,800 psi at the time of departure from Toowoomba Airport, it was calculated that the cylinder contents would be depleted after about 29 minutes if used by 3 occupants, depending on flow rates. 

This time period is significantly less than the time the aircraft spent in cruise at FL280 up to the pilot’s final radio transmission. It is possible that the aircraft cabin altitude was less than 19,000 ft but still within the hypoxic range, or the crew may have been using the oxygen system intermittently, or highly diluted, to manage the acute symptoms of hypoxia. Such a scenario would be highly unsafe as the symptoms and signs of hypoxia, on acute exposure to altitudes greater than 15,000 ft when breathing air, include a loss of critical judgment and willpower, with the subject usually unaware of any deterioration in performance or the presence of hypoxia. In this scenario, the pilot may have eventually lost the self-awareness required to identify the symptoms of hypoxia and take appropriate corrective action to resolve the situation. 

The oxygen system panel, which included the cylinder pressure gauge for the aircraft oxygen system, was recessed into the sidewall on the right side of the cockpit out of the pilot’s direct field of view. Consequently, it is also possible that the oxygen within the cylinder was eventually exhausted by the 3 occupants, without their awareness, resulting in a similar outcome. 

Organisational influences

Normalisation of deviance

Chief operating officer

The AGAIR chief operating officer (COO), who oversighted the line scanning operations, occasionally experienced VH-HPY’s intermittent pressurisation system defect while flying as pilot in command. On at least 2 occasions the COO continued to operate VH-HPY with a cabin altitude that required the use of oxygen, without access to a suitable oxygen supply.

On 16 October 2023, the pilot of the accident flight sent the COO an email stating that they were operating the aircraft with a high cabin altitude while using the aircraft’s oxygen system and, consequently, the oxygen cylinder needed to be refilled. The COO responded to the email by providing procedures to facilitate the refilling of the oxygen cylinder, but the hazardous practice of continuing to operate the aircraft with an excessive cabin altitude was not addressed. 

The COO was a senior AGAIR manager, and their actions (and inactions) had the potential to influence the operational standards of other pilots and crew, and set the risk appetite for the operation. Their practice of continuing to operate the aircraft and allowing it to be operated at FL280 with the pressurisation system defective exposed the aircraft’s occupants to significant risk of hypoxic induced incapacitation. In doing so, the COO likely normalised the deviation from the POH and civil aviation legislation and communicated the acceptance of such non-compliant practices by senior AGAIR management.

Head of flying operations 

The AGAIR head of flying operations (HOFO), who was also the owner, chief executive officer (CEO), and head of airworthiness and aircraft maintenance control (HAAMC), stated to the ATSB that they were aware of the intermittent pressurisation defect, but they were not aware of any pilots who had continued to operate the aircraft at FL280 with the pressurisation system defective. This was despite the HOFO having received and responded to an email from the pilot of the accident flight on 22 October 2023 that outlined the practice of operating the aircraft with a cabin altitude of 19,000 ft while using the aircraft oxygen system. The response from the HOFO to the email included the statement ‘thanks for keeping it going’. Such a response would have been reasonably perceived by the pilot of the accident flight as encouraging their practice of continuing to operate the aircraft at an excessive cabin altitude, and inappropriate use of the oxygen system.

The HOFO stated that they interpreted the email as being what ‘would’ happen rather than what ‘was’ happening. However, if the HOFO’s premise that they interpreted the email content as hypothetical is to be accepted, then it would be reasonable to expect that the HOFO would have immediately advised the pilot of the accident flight not to apply such a hazardous operational practice. However, the HOFO’s email response contained no such advice, and they did not contact the pilot by any other means to discuss the content of the email. 

The HOFO stated that they had not provided any operational advice to the pilot following the email as they had passed operational control of the line scanning activity to the COO. This included reporting lines for the pilot of the accident flight. The COO also received the same email from the pilot of the accident flight on 22 October 2023, but they did not reply or contact the pilot to discuss its content.

Operational control

The COO had oversight of the line scanning operation. However, the approved organisational structure, as contained within the AGAIR operations manual (OM), did not reflect this arrangement. Instead, the COO role was depicted as having responsibility for ground support equipment and personnel, customers and suppliers only. There were no defined responsibilities for the COO contained within the AGAIR OM, nor any procedures specific to line scanning operations, making it unclear exactly what the COO’s role entailed. 

The AGAIR OM permitted the HOFO to delegate ‘certain duties’ to company personnel, but the responsibility remained the HOFO’s. Consequently, the undocumented delegation of duties associated with the line scanning activities to the COO did not absolve the responsibility of the HOFO to ensure these activities were:

• compliant with aviation legislation
• conducted by pilots who conformed to company standards
• undertaken in an aircraft that was appropriate for the planned task.

The HOFO had long-term awareness of the pressurisation defect and had experienced the issue themselves while flying the aircraft. However, at no time had the HOFO (or the COO):

• recorded the pressurisation defect on the aircraft maintenance release or required other pilots to do so
• provided explicit procedures to pilots for managing the defect
• communicated the ongoing issue to the AGAIR safety manager
• submitted a hazard or occurrence report
• conducted or requested a formal risk assessment of the issue.

In the days leading up to the accident, both the HOFO and the COO were advised that the pilot of the accident flight was operating VH-HPY at a hazardous cabin altitude without access to a suitable oxygen supply. However, neither the HOFO nor the COO exercised effective operational control to address the significant safety implications of the activity. Instead, the HOFO and the COO’s combination of inaction, direct involvement and, in some instances facilitation and encouragement of the activities, resulted in a hazardous, ongoing practice.

Aircraft defects not recorded

The AGAIR operations manual contained policy and procedures to formally manage defects that were identified while an aircraft was in service. These procedures required the defect to be recorded on the aircraft’s maintenance release, and then communicated to the HAAMC, who would in turn liaise with the maintenance provider. Collectively, defects could then be appropriately managed, drawing upon approved data such as the POH, the aircraft maintenance manual and the relevant legislative requirements.

Records of defects and the actions taken to rectify them can provide a means to measure their effectiveness, and to help focus any further action if required. Similarly, the recording of defects on the maintenance release can provide a means for flight crews to readily assess any defects the aircraft may have had, and what rectifications were made. Flight crews could then anticipate further issues, brief other crew members, flight plan accordingly if needed, and proactively prepare for the defect should it re-occur.

Likely as a routine practice, evidenced from the records for VH‑LVG (a Gulfstream 690), and VH‑HPY (a Gulfstream 695A) and from interviews conducted during the investigation, AGAIR was managing defects in a simplified, but unapproved manner. This practice was similar to the approved method in that defects were sometimes communicated to the HAAMC or the maintenance provider by means such as email or text messages. However, defects were not always recorded on the maintenance release, and communication of defects sometimes occurred just prior to the aircraft arriving at the maintenance facility. This practice was likely to have been occurring for some time. As discussed below in CASA surveillance events, an AGAIR pilot reported concerns in 2019 that included the management of aircraft defects. 

Although similar, this routine practice removed risk controls that were in place to ensure that defects were managed for the safe operation of the aircraft. The issues affecting the pressurisation system of VH‑HPY did not mean that the aircraft could not be flown. The controls in place for safe operation in this case would require the aircraft be flown unpressurised, and at a suitable altitude. To operate the aircraft with an unserviceable or underperforming pressurisation system would have required an appropriate level of scrutiny by the pilot in command, the HOFO/HAAMC, the maintenance provider and, if needed, CASA.

The logbooks for the aircraft prior to 2014 when it was operating in South Africa showed that the pressurisation system was underperforming on multiple occasions, and detailed the actions taken to rectify the issue. Since 2014, and with the exception of an entry for a depressurisation event in August 2020, no instances of pressurisation defects occurring with VH-HPY had been recorded on the aircraft’s maintenance release. These defects were known to those operating and maintaining the aircraft, and any transfer of information relating to those defects was by informal means, such as orally, or electronically (email, text messages). Should an independent review of the aircraft’s history be required, it would be limited by the absence of defect endorsements relating to the aircraft’s pressurisation system from 2014 onwards.

When the pressurisation system in VH‑HPY was underperforming, the aircraft was sometimes operated with cabin altitudes above 10,000 ft by using the oxygen system for general operations rather than its intended function (that is, for use in an emergency situation). As previously discussed, this was known to the pilot of the accident flight, the HOFO/HAAMC, the COO, and on one occasion, the maintenance provider. While the Gulfstream 695A POH refers to the oxygen system as ‘supplemental’, it is unambiguous in that the oxygen system is for use in an emergency, providing sufficient oxygen to descend to an altitude where oxygen is no longer required.

Aircraft defects are sometimes minor, with limited or no operational impact. However, the operational impact of defects relating to VH-HPY’s pressurisation system was unnecessarily more significant because the defects were accepted by the pilot of the accident flight, the HOFO/HAAMC, and the COO, and then managed using the aircraft’s oxygen system, rather than rectified or, in the interim, conducting flights safely at lower altitudes. A full understanding of the operational impact of the defects was in part limited by their absence from the aircraft’s maintenance release. In turn, such records would have assisted in analysing the nature and frequency of the defects, and for corrective actions to be carried out by the appropriate persons, and in accordance with published data.

Air traffic control

Pressurisation information not communicated to air traffic control

While VH-HPY was still in flight, the Airservices Australia air traffic management director (ATMD) and shift manager (SM) spoke with the AGAIR HOFO by telephone to advise that ATC had lost radio communications with VH-HPY for an extended period. 

During the telephone conversation, which lasted nearly 6 minutes, the HOFO was advised that the pilot had exhibited symptoms of hypoxia, and that ATC had initiated ‘oxygen’ radio calls. The HOFO was also informed that ATC had subsequently regained direct communication with the pilot, who had confirmed operations were normal, and that ATC no longer had concerns for the aircraft and that the emergency phases had been cancelled. 

At no point during the telephone conversation did the HOFO advise the ATMD or SM that the aircraft had a known intermittent pressurisation defect as it did not occur to them to do so. It is possible the HOFO did not perceive a need to provide this information once they were advised that communications had been re-established with the pilot.

The telephone conversation to AGAIR was a missed opportunity to communicate critical safety information about the aircraft, that was directly relevant to the conversation, at a time when ATC could have taken further action to instruct the pilot to descend to a safe altitude. 

Air traffic controller actions

During the initial loss of communication while the aircraft was at FL280, the ATMD was able to speak briefly with the pilot via mobile telephone. The ATMD identified that the pilot’s speech during the conversation was slow and flat. This information was passed to the SM and Simpson region controller (controller), who also noted that the aircraft was slightly off track. As a result, the SM determined that the pilot may have been suffering from hypoxia and they initiated the hypoxic pilot emergency procedures and escalated the aircraft’s status to an alert phase.

That hypoxia assessment was likely correct given the analysis of the pilot’s speech indicated a progressive deterioration that was consistent with altitude hypoxia. Consequently, the initiation of the hypoxic pilot emergency procedures was the appropriate response.

Over the following 10 minutes, the controller attempted to get the pilot to descend the aircraft, as instructed by the hypoxic pilot emergency procedure, using the phrase ‘oxygen, oxygen, oxygen descend to one zero thousand feet’. They also made multiple attempts to contact the pilot on different frequencies and relayed messages via other aircraft within the vicinity of VH-HPY. At the same time, the ATMD attempted to call the pilot’s mobile phone again, and sent 2 text messages, but the pilot did not respond. Eventually, a crewmember on board a Royal Australian Air Force (RAAF) aircraft established contact with the pilot, followed by ATC a short time later. 

While ATC held significant concern for the aircraft and its occupants during the loss of communication period, their concerns were de-escalated over a period of 2 minutes after the pilot contacted the RAAF crew resulting in ATC downgrading and cancelling the emergency phases. This de-escalation occurred without querying why the pilot had not responded to ATC broadcasts for 1 hour and 13 minutes. 

The hypoxic pilot emergency procedures contained an instruction for the controller to advise the pilot to ‘check oxygen system and connections’ and ‘check pressurisation’. About 2 minutes after the cancellation of the uncertainty phase, the controller asked the pilot to ‘just confirm your oxygen system is ops normal’, to which the pilot responded ‘affirm’. No further actions from the hypoxic pilot emergency procedures were undertaken while the pilot was in communication with ATC. The controller recalled the pilot’s speech was ‘clear and concise’, but this was not consistent with the speech analysis that indicated a deterioration in the pilot’s speech at that time.

The pilot was subsequently provided with an ATC clearance to undertake the line scanning operations near Mount Gordon, but over the following 4 minutes the pilot repeated the clearance from the controller 4 times, seeming uncertain about the status of the clearance. They twice requested confirmation that the controller had copied their clearance readback. The radio recordings during this period indicate that the pilot’s speech rate had substantially lowered from earlier communications and was becoming worse. The controller recalled a lot of activity taking place in the vicinity of their console at that time, which included questions regarding the status of the aircraft. 

The pilot’s final radio transmission displayed the slowest speaking rate of all their communications during the flight and contained stuttering and operational mistakes. However, the controller did not re-identify the possibility of hypoxia. At the time of the accident, the Simpson region was ‘fully combined’ with one controller responsible for the entire region of about 2 million square kilometres. While the traffic density was described as low, the controller and the SM had been heavily tasked with attempts to regain communications with VH-HPY for an extensive period while also communicating with other aircraft within the region. 

Although no reason for the loss of communication had been established, the pilot had confirmed that the aircraft’s oxygen system was operating normally, and routine radio communications had been re-established. These factors, combined with ATC having no knowledge of the aircraft’s pressurisation system defect as the AGAIR HOFO had not communicated this information during their telephone conversation, likely resulted in the ATC personnel involved reducing their vigilance about hypoxia. Consequently, the controller did not identify the deterioration in the pilot’s speech and, in a return to normal operations, did not attempt to contact the pilot until about 18 minutes later. The pilot did not respond to any further calls from ATC and the aircraft impacted terrain a further 6 minutes later.   

Air traffic control hypoxia emergency procedures

At the time of the accident, the procedures to be used if a controller suspected a pilot may be suffering from hypoxia were contained in the Airservices Australia in-flight emergency response checklist (IFER) procedure (ATS-PROC-0062). The IFER hypoxia checklist contained a list of symptoms that could indicate a pilot was impacted by hypoxia, and the actions to take when managing the aircraft. This included advising the pilot:

• Check oxygen system and connections

• Check pressurisation

When confirmed and checked - if no change or condition worsens, act immediately to descend the aircraft.

The likely symptoms and signs of hypoxia, on acute exposure to altitudes greater than 15,000 ft when breathing air, include a loss of critical judgment and willpower. Because of the loss of self‑criticism, the subject is usually unaware of any deterioration in performance or the presence of hypoxia (Nicholson and Rainford 2000). Consequently, a reliance on a pilot’s response to queries regarding the status of the aircraft oxygen and pressurisation systems would probably yield an unreliable response if the pilot were impacted by hypoxia.

Additionally, the IFER hypoxia checklist contained no instructions for a controller to follow when standing down the emergency response and resuming normal operations. In contrast the Airservices Australia IFER management abnormal operations manual, which was used for training and information, did contain material, albeit limited, regarding the transition to normal operations after any type of inflight emergency. This included the statements:

• Extensive experience, both in Australia and overseas, shows that crews often try to down‑play problems when communicating with [air traffic control]. Furthermore, what may be normal as far as the crew is concerned may still preclude the operational system from operating normally

• If there is the slightest doubt about the continuing safety of the aircraft, it is prudent to continue with the IFER even if at a low key

The information contained within the IFER management abnormal operations manual was directly relevant to the hypoxic scenario involved during the accident flight, but the information was not integrated within the IFER hypoxia checklist, which is the document used by controllers during operations.

When designing emergency and abnormal checklists, human performance capabilities and limitations under high stress and workload should influence the design and content. Attention should be given to the structure of these checklists to ensure that directions and information are complete, clear, and concise (Burian et al 2005). As the advice regarding the transition to normal operations was contained in a different document which likely relied on a controller recalling it from memory, the IFER hypoxia checklist was not complete and did not provide adequate guidance to controllers for the process to follow when ceasing the emergency response. This omission increased the risk that the emergency response could be inappropriately downgraded during a developing hypoxic scenario.

CASA surveillance events

The available evidence indicated that CASA's oversight of AGAIR and GAM was broadly appropriate for the type and size of operations. There were 7 surveillance events from 2019 to 2023, including 4 site visits, and CASA issued various findings as a result.

In May 2019, CASA undertook a level 2 surveillance event of AGAIR to examine concerns reported by an AGAIR pilot, about non-compliant flight and duty rostering practices, and the management of aircraft defects involving 2 aircraft of a similar type to VH-HPY – VH-LVG and VH‑CLT. The latter concerns were about the deferral of defects that (according to the reported concerns) impacted the safety of operations ‘on a daily basis,’ and conflicting advice being given to pilots on the continuation of operations with such known defects. 

Had non-compliant maintenance practices been taking place at the time, and been discovered by CASA in its response to the reported concerns, this would potentially have been an opportunity to influence the way the operator managed aircraft defects, such as the pressurisation issue in VH‑HPY, in the intervening 4 years before the accident. Accordingly, the ATSB sought to determine the extent to which the concerns were valid, and the appropriateness and effectiveness of the CASA response at the time.

The approach used by CASA to conduct the surveillance was, according to the surveillance team’s airworthiness inspector (AWI), intended to determine whether there was any validity to the pilot’s concerns. The ATSB did not determine whether CASA contacted the complainant pilot prior to the surveillance commencing; this would be an important step to clarify the context and specifics of the raised concerns and help direct the surveillance activities. 

The on-site surveillance included:

• a physical inspection of 2 aircraft, including VH-LVG, which was one of the 2 aircraft that the correspondent had mentioned in their report as having maintenance problems
• review of the current VH-LVG maintenance release
• interviews with management personnel.

As a result of the surveillance activity, the pilot’s concern about flight and duty times was partially substantiated (the senior pilot was found to have exceeded flight and duty time requirements) and a safety finding to AGAIR was issued on this. 

On the maintenance aspects of the surveillance event, CASA made no findings, and the 2 maintenance-related observations did not directly indicate any problems with inappropriately deferred maintenance. In effect, based on the information sampled, CASA (at the time) found no evidence that defects with a significant effect on aircraft safety were not being managed appropriately or that pilots were being given conflicting advice on the continuation of operations. 

The ATSB assessment of maintenance records for VH‑LVG from December 2014–May 2019 showed 10 entries indicating unscheduled defect rectification that had been carried out during scheduled maintenance, and which had the characteristics of defects that could have appeared during operations and been identifiable by pilots (in which case they should have been recorded on the maintenance release). The absence of entries on recent historical (expired) maintenance releases up to May 2019 indicates that, during this period, some defects were likely not being recorded on the maintenance release when in service, and were only being rectified when the aircraft arrived for scheduled maintenance. However, only one of the defects was of a type that could have had an effect on the safety of flight (an engine oil pressure indicating system defect). In addition, defects may have been reported through a means other than through the maintenance release or detected during scheduled maintenance. 

The ATSB identified these entries by crosschecking the content of each maintenance release against the aircraft logbooks. The historical maintenance releases and aircraft logbooks were at a different facility to that visited by CASA for the May 2019 surveillance event, and this type of crosschecking activity was not scoped or undertaken as part of that event. 

Crosschecking maintenance releases, logbooks and maintenance worksheets can identify discrepancies or deficiencies in defect reporting, maintenance action tracking, or certification of work performed. This process also helps identify potential issues such as undocumented rectifications, improper deferral of defects, or systemic lapses in maintenance record-keeping, all of which can have implications for continued airworthiness and regulatory compliance. Any problems found can then lead to further evidence gathering regarding an organisation’s defect management practices (for example, directly from employed pilots).

The post-accident activities undertaken by CASA and the ATSB were influenced by facts and circumstances that were learnt after the accident involving VH-HPY. Consequently, the focus and depth of these activities could be directed towards areas of particular relevance to the accident, notably potential non-compliant defect management practices. The May 2019 surveillance did not have the same advantage. At the time this surveillance was conducted, AGAIR had no recent history of regulatory enforcement action or identified need for a higher level of surveillance, and there was limited detail within the pilot’s concern about specific defects or safety of flight issues. CASA also issued a safety finding and 3 observations as a result of the activity; although this enhanced the credibility of the AGAIR pilot’s reported concerns, it also indicates that the surveillance did improve safety within the chosen area of focus.

In summary, given the areas of concern raised by the complainant pilot, the scope of the surveillance event limited the extent of the evidence relating to defect management that was collected. This consequently limited the surveillance team’s ability to determine whether any non‑reporting and improper deferral of defects had been taking place at that time. While there was likely some degree of non-compliant defect management practices at AGAIR in 2019, all but one of the likely non-reported defects were minor in nature (the other was an oil pressure indicating system, which does not present an immediate risk to flight). Accordingly, even if CASA had identified these likely non-reported defects, it is unclear whether there would have been sufficient evidence available for CASA to identify maintenance practices as a broad organisational concern. 

Findings

From the evidence available, the following findings are made with respect to the pilot incapacitation, loss of control and collision with terrain involving Gulfstream 695A, VH-HPY, 55 km south-east of Cloncurry Airport, Queensland on 4 November 2023.

Contributing factors

• The pilot's ability to safely operate the aircraft was almost certainly significantly degraded by the onset of altitude hypoxia.
• While in cruise at flight level 280, both power levers were probably reduced without an appropriate descent rate being initiated, resulting in a progressive reduction of airspeed.
• The aircraft entered a descending anticlockwise turn with an increasing rate of descent. At about 10,500 ft, control input(s) were almost certainly made, probably an attempt to recover, that transitioned the aircraft from a high-speed descent to a spin condition that was likely unrecoverable and which continued until the impact with terrain.
• The pilot had a normalised practice of operating VH-HPY with a cabin altitude that required the use of supplemental oxygen. These flights were conducted without access to a suitable oxygen supply, significantly increasing the risk of altitude hypoxia induced incapacitation.
• The aircraft's pressurisation system probably did not attain the required cabin altitude when operating at flight level 280 during the accident flight. The pilot probably knowingly continued the flight with a cabin altitude that required the use of supplemental oxygen, without access to a suitable oxygen supply.
• The AGAIR aircraft VH-HPY pressurisation system could not reliably attain the required cabin altitude during flight due to a known, long-term, unresolved intermittent defect. AGAIR management personnel were aware of the defect and, through a combination of inaction, encouragement and, in some instances direct involvement, permitted the aircraft to continue operations at an excessive cabin altitude. (Safety issue)
• AGAIR management exercised ineffective operational control over the line scanning activities. As a result, the ongoing intermittent pressurisation defect was not formally recorded, the issues with the aircraft were not communicated to the AGAIR safety manager, and the hazardous practice of operating the aircraft at a cabin altitude that required the use of supplemental oxygen, without access to a suitable oxygen supply, was allowed to continue. (Safety issue)
• The AGAIR head of flying operations did not communicate critical safety information about the known intermittent pressurisation defect on VH-HPY when they were phoned by air traffic control about concerns that the pilot may be impacted by hypoxia.
• After being told by the pilot that operations were normal, controllers likely reduced their vigilance about hypoxia and did not re-identify the possibility of hypoxia during the subsequent progressive deterioration of the pilot’s speech.

Other factors that increased risk

• AGAIR Gulfstream 690 and 695 aircraft were operated with known defects without being recorded on the aircraft’s maintenance releases, likely as a routine practice. For VH‑HPY, the absence of documented historical information limited the ability to assess the operational impact of the pressurisation defect and the effectiveness of maintenance rectification activities. (Safety issue)
• The Airservices Australia hypoxic pilot emergency checklist did not contain guidance on ceasing the emergency response. This increased the risk that a controller may inappropriately downgrade the emergency response during a developing hypoxic scenario. (Safety issue)

Other finding

• A 2019 Civil Aviation Safety Authority surveillance event of AGAIR triggered by concerns reported by an AGAIR pilot, including delayed rectification of airworthiness issues, did not include a crosscheck of maintenance releases against the aircraft logbooks, which limited the surveillance team’s ability to determine whether any non-reporting and improper deferral of defects had been taking place at that time.

Safety issues and actions

Normalisation of deviance

Safety issue number: AO-2023-053-SI-03

Safety issue description: The AGAIR aircraft VH-HPY pressurisation system could not reliably attain the required cabin altitude during flight due to a known, long-term, unresolved intermittent defect. AGAIR management personnel were aware of the defect and, through a combination of inaction, encouragement and, in some instances direct involvement, permitted the aircraft to continue operations at an excessive cabin altitude.

Operational control

Safety issue number: AO-2023-053-SI-04

Safety issue description: AGAIR management exercised ineffective operational control over the line scanning activities. As a result, the ongoing intermittent pressurisation defect was not formally recorded, the issues with the aircraft were not communicated to the AGAIR safety manager, and the hazardous practice of operating the aircraft at a cabin altitude that required the use of supplemental oxygen, without access to a suitable oxygen supply, was allowed to continue.

Safety recommendation description: The ATSB recommends AGAIR initiates an independent review of their organisational structure and oversight of operational activities to assure ongoing effective operational control by management.

Aircraft defects not recorded

Safety issue number: AO-2023-053-SI-02

Safety issue description: AGAIR Gulfstream 690 and 695 aircraft were operated with known defects without being recorded on the aircrafts’ maintenance release, likely as a routine practice. For VH-HPY, the absence of documented historical information limited the ability to assess the operational impact of the pressurisation defect and the effectiveness of maintenance rectification activities. 

Air traffic control hypoxia emergency procedures 

Safety issue number: AO-2023-053-SI-01

Safety issue description: The Airservices Australia hypoxic pilot emergency checklist did not contain guidance on ceasing the emergency response. This increased the risk that a controller may inappropriately downgrade the emergency response during a developing hypoxic scenario. 

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the next-of-kin of the pilot and both camera operators
• the pilot’s general practitioner
• AGAIR
• Airservices Australia
• Bureau of Meteorology
• Civil Aviation Safety Authority
• witnesses
• pilots who had previously operated VH-HPY
• General Aviation Maintenance
• a Gulfstream 695A training provider
• Jetfix aircraft maintenance personnel
• oxygen system provider
• Ontic
• OzRunways
• TrackPlus
• the previous owner of the aircraft
• Hartzell Propellers Inc
• Queensland Fire and Emergency Services
• Queensland Police Service
• a speech analysis specialist
• National Transportation Safety Board
• Defence Flight Safety Bureau 

References

Gradwell, D. & Rainford, D. (2016). Ernsting’s aviation and space medicine (5^th ed). Boca Raton, FL, US: Taylor & Francis Group

Sedlar, N. Irwin, A. Martin, D. & Roberts, R. (2022). A qualitative systematic review on the application of the normalization of deviance phenomenon within high-risk industries. School of Psychology, William Guild Building, University of Aberdeen, Aberdeen, UK. & Aberdeen Business School, Robert Gordon University (RGU), Aberdeen, UK.

US Federal Aviation Administration. (2015). Aircraft operations at altitudes above 25,000 feet mean sea level or mach numbers greater than .75. Advisory Circular 61-107B

US Federal Aviation Administration. (2021). Airplane Flying Handbook FAA-H-8083-3C. Chapter 5: Maintaining Aircraft Control: Upset Prevention and Recovery Training. Retrieved 14, January 2025 

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the next-of-kin of the pilot and both camera operators
• AGAIR
• General Aviation Maintenance
• Civil Aviation Safety Authority
• Queensland Fire and Emergency Services
• oxygen system provider
• previous pilots who had flown VH-HPY
• National Transportation Safety Board
• a speech specialist
• Airservices Australia
• Airservices Australia air traffic management director
• Airservices Australia shift manager
• Airservices Australia controller
• Hartzell Propellers Pty Ltd
• Ontic
• a 695A training provider
• Defence Flight Safety Bureau. 

Submissions were received from:

• the next-of-kin of the pilot
• Airservices Australia
• Airservices Australia air traffic management director
• Airservices Australia shift manager
• AGAIR
• Civil Aviation Safety Authority
• oxygen system provider
• a 695A training provider

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Gulfstream 695A systems information

Pressurisation system

Gulfstream 695A pressurisation system

The Gulfstream 695A is pressurised by ducting air from both engines (known as bleed air) into the cabin and controlling its flow overboard via outflow safety valves to maintain the desired cabin pressure. The source of bleed air can be selected within the cockpit to be via both engines, via the left or right engine, or selected off. The selector directs power to close the relevant engine bleed air valve or valves, which are opened pneumatically when the engines are operating (Figure A1 and Figure A2).

Figure A1: VH-HPY cockpit layout 

Note: Image captured prior to the accident. Source: Cameron Marchant, annotated by the ATSB

Figure A2: Bleed air selector in VH-HPY

Note: Image captured prior to accident. Source: Cameron Marchant, annotated by the ATSB

A cabin pressure controller is set by flight crew to maintain cabin pressure from take-off, through climb, cruise, and descent. A rate of change knob in its ‘nominal’ position controls the cabin altitude rate of change (or vertical speed) to 500 ft/min and can be set from a minimum of 50 ft/min to a maximum of 3,000 ft/min. The cabin altitude knob is used to set the desired cabin altitude (up to 10,000 ft) and has an inner scale that shows the corresponding aircraft altitude that can be flown without exceeding the aircraft’s maximum differential pressure. The adjacent indicators for the cabin show the cabin altitude, differential pressure, and the cabin’s vertical speed (Figure A3).

Figure A3: Pressurisation controls and indicators fitted to VH-HPY

Note: Image captured prior to the accident. Source: Cameron Marchant, annotated by the ATSB

The cabin pressure controller also prevents the cabin differential pressure from exceeding the maximum differential pressure of 6.8 psi. The Gulfstream 695A is certified to operate up to 35,000 ft above mean sea level. At this altitude, and at the maximum differential pressure, the cabin altitude would be 9,600 ft.

The maximum differential pressure is prevented from being exceeded by the outflow safety valves, though if the aircraft continued to climb there would be a corresponding climb in the cabin altitude.

Visual warning system

The cabin altitude visual warning system is limited[45] to a single caption on the glareshield annunciator panel. The caption, ‘CABIN ALT’ is coloured red when illuminated, meaning that immediate corrective action is required (Figure A4).  When the cabin altitude of the aircraft is at or above 11,000 ft (± 500 ft), ‘CABIN ALT’ flashes for 10–20 seconds and is accompanied by an aural warning. After 10–20 seconds the annunciator remains on until the cabin altitude is below 11,000 ft.

Figure A4: Cockpit of VH-HPY showing annunciator panel cabin altitude warning light

Note: Image captured prior to the accident. Source: Cameron Marchant and Ontic (inset), annotated by the ATSB

Aural warning system

The cabin altitude aural warning system produces a tone that pulses 6 times per second. The aural warning is triggered when the cabin altitude exceeds 11,000 ft. The aural warning can be silenced by pressing a button on the left engine power lever (Figure A5).

Figure A5: Cabin altitude aural warning silencing button

Source: Ontic, annotated by the ATSB

Oxygen system

Overview

The Gulfstream 695A is equipped with an oxygen system that provides life support in the event of an emergency. The POH states that:

The airplane is equipped with a high pressure, gaseous oxygen system which provides supplemental breathing oxygen to the crew and passengers in the event of cabin depressurization during high altitude operation, or in the event cabin air becomes contaminated. The system will provide oxygen for sufficient time to permit a planned descent to an altitude where supplemental oxygen is no longer required.

Aviator’s dry breathing oxygen[46] is stored in a cylinder located in the rear fuselage and, when full, can supply oxygen to 3 people for about 29 minutes. The passenger oxygen system switch (Figure A6) is recessed into the sidewall on the right side of the cockpit, alongside a cylinder pressure gauge for the aircraft oxygen system.

Figure A6: VH-HPY cockpit oxygen gauge and passenger oxygen switch

Note: Image captured prior to accident. Source: Cameron Marchant annotated by the ATSB

Crew oxygen masks

The pilot and copilot oxygen masks are designed for rapid donning and are positioned on hooks immediately behind the pilot and co-pilot seats for ease of access. The masks incorporate a diluter control, a purge control, a flow indicator, and a microphone for radio communications (Figure A7).

Figure A7: Crew and passenger oxygen masks

Source: Ontic, annotated by the ATSB

When required in an emergency, and if the aircraft is operating below 20,000 ft, the oxygen mask diluter control is selected by the pilot to the normal position. Oxygen flows to the mask on demand (when the wearer inhales) and is mixed with cabin air. The flow of oxygen stops when the wearer exhales. The dilution of oxygen with cabin air helps to conserve stored oxygen.

When required in an emergency, and if the aircraft is operating above 20,000 ft, the oxygen mask diluter control is selected by the pilot to the 100% position. Oxygen flows to the mask on demand (when the wearer inhales) at a 100% concentration. The flow of oxygen stops when the wearer exhales.

The oxygen inlet line to the mask has a flow indicator, which is green when oxygen is flowing and red when there is no flow. The oxygen inlet lines are attached to the aircraft oxygen system via a coupling. When the aircraft is not flying, the mask oxygen inlet line couplings are disconnected to prevent possible leakage, and the passenger oxygen system switched off at the passenger oxygen system control panel.

Passenger oxygen masks

Passenger oxygen masks are stowed in containers at various locations in the cabin lining above the passenger seats. The mask assemblies consist of a mask cup, a bag that incorporates a flow indicator, and a lanyard which is attached to a pin.

The passenger oxygen switch has 3 positions – OFF, AUTO, and ON. When the switch is selected to AUTO, and when the cabin altitude reaches 11,000 (±500) ft, the passenger oxygen masks will drop from their containers and the oxygen lines to them will become pressurised. When selected ON, and regardless of cabin altitude, the passenger oxygen masks will drop from their containers and the oxygen lines to them will be pressurised. 

After dropping from their containers, the passenger masks are suspended by their lanyard. When a passenger dons their mask, this action pulls on the lanyard, and thereby the pin, which initiates a constant flow of oxygen to the mask. The flow of oxygen shuts off automatically when the cabin altitude decreases to 8,000–10,000 ft. Selecting the passenger oxygen switch to OFF also shuts off the flow of oxygen.

Oxygen system servicing and duration

When required, aircraft oxygen cylinders are serviced (refilled) with aviator’s dry breathing oxygen by trained personnel using specialist equipment. The aircraft cylinder is full when filled to 1,800 psi. 

The Gulfstream 695A POH provides a table to calculate the duration of on-board oxygen, should it be required in an emergency (Figure A8). Duration is calculated by determining the oxygen cylinder pressure and the number of people on board the aircraft. The duration of on-board oxygen with 3 people on board and with a full oxygen cylinder should be just over 29 minutes.

Figure A8: Oxygen system duration table

Source: Ontic, annotated by the ATSB

Autopilot

The autopilot fitted to VH-HPY was a Collins AP-106 and it was integrated with the aircraft’s instruments. The Collins AP-106 is a 3-axis system that stabilises the aircraft about its roll, pitch, and yaw axes. The autopilot roll servo acts on the aircraft’s ailerons, a pitch servo acts on the aircraft’s elevators, and an additional pitch servo provides a trim function. A servo acts on the rudder for yaw dampening[47] which can be operated independently of the autopilot.

The autopilot operates in its ‘attitude’ function when engaged and no mode is selected. This function incorporates a pitch hold mode. The autopilot operates in its ‘guidance’ function when engaged and a mode is selected on the mode control panel, which is located on the centre pedestal below the pressurisation controls. Heading (HDG), navigation (NAV), approach (APP), and back-course (B/C) are lateral modes that receive commands from the aircraft’s instruments. Altitude (ALT) and indicated airspeed (IAS) are vertical modes and are used to hold a selected altitude or airspeed. A pitch hold mode is operational when no vertical modes are selected. The autopilot can be biased manually via a control adjacent to the mode control panel. 

Both pilot and co-pilot control wheels have thumb-operated buttons that interrupt the autopilot when pressed to allow the aircraft to be hand flown. Both control wheels have autopilot release switches, and the pilot control wheel has a thumb-operated pitch trim switch.

A subcomponent of the autopilot system, the trim servo monitor, has fault detection and diagnostic capabilities that automatically disengage the autopilot if a discrepancy or malfunction is detected. One such potential fault condition is the exceedance of threshold voltages within a servo as it works against an aerodynamic or mechanical force. 

Appendix B – Transcript – Telephone call between Airservices Australia personnel and the AGAIR head of flying operations

Source: Airservices Australia

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.