Loss of control

Investigation summary

What happened

On the evening of 14 July 2023 an aerial light display was scheduled to be conducted over the waters of Victoria Harbour, Docklands, Victoria using a swarm of 500 Damoda Newton V2.2 remotely piloted aircraft (RPA). 

At 1830 the Remote Pilot in Command (RPIC) launched the swarm. Shortly after, the RPIC identified both visually and from multiple errors on the ground control station (GCS) computer, that multiple aircraft were out of position. 

Despite this, the aircraft automatically commenced the transition from the launch location towards the show area. As the aircraft transitioned, further errors with increasing severity appeared on the GCS computer. Aircraft were observed to be out of position and colliding in the air, with multiple aircraft breaching the geofence.

As the errors cascaded, the RPIC commanded the aircraft in the swarm to loiter (hold position) and attempted to return those with the most significant errors to the launch site individually. Whilst multiple aircraft were in the loiter, the GCS computer lost connection to almost 400, with the majority descending into the harbour below.

427 of the 500 aircraft in the swarm were lost into the water, with divers subsequently recovering 236.

What the ATSB found

The ATSB determined that shortly after launch, the swarm encountered wind conditions that exceeded the aircraft’s published capability. That was not identified by the RPIC as they were unaware that the wind speed affecting the aircraft was displayed on the GCS computer. Additionally, while the GCS computer displayed the wind speed, it did not have the functionality to actively alert the pilot to exceedances.

Consequently, the RPIC allowed the flight to continue toward the show area, where wind speeds more than twice the published limit were encountered. In these conditions the aircraft were unable to maintain position, resulting in aircraft collisions, breaches of the operating area, and activation of failsafe modes that led to most of them descending to the water.

The RPIC did not make use of all processes available to them to collect relevant wind information prior to launching the swarm. There were also a number of factors on the day that caused the RPIC to have a higher than normal workload that affected their decision‑making capacity, and was likely to be under pressure to conduct the show. It was also found that the operator had no procedure in place to verify that pilots were familiar with all relevant functions of the GCS software. 

Finally, while not contributory to the accident, the investigation also identified that the flight crew did not comply with operational limitations set by the regulator and contained within their own documentation.

What has been done as a result

Operator

The operator advised that in response to this accident it undertook a detailed review of its operating procedures and made several changes, including:

• changes to the crewing requirements to have 2 Civil Aviation Safety Authority‑approved pilots operating every show
• introduction of wind speed test flights using individual aircraft prior to show launch to establish actual conditions in the show area
• establishment of multiple go/no-go points during the launch sequence allowing for more clearly defined stop points
• introduction of sterile cockpit procedures to limit outside interactions with the flight crew in critical phases in the lead‑up to show launch.

Additionally, the ATSB issued a safety recommendation that the operator develops a process to ensure that future software changes are communicated and understood by all pilots before commencing operations.

Manufacturer

The manufacturer advised that updating the ground control station software to include an active alert for wind speed exceedances was technically possible and that this feature was being considered for future software releases. The ATSB issued a safety recommendation to the manufacturer that such alerting be implemented.

Safety message

In Remotely Piloted Aircraft System (RPAS) swarm operations the flight crew are highly dependent on the ground control station software, its functionality and the data it provides for safe operation. It is therefore critical that the flight crew be familiar with all functionalities and understand the information being presented to them. Functionality that actively alerts crew to exceedances in flight‑critical parameters can assist crew awareness.

Operators should have systems in place to ensure that pilots are familiar with new functionality when introduced. To assist flight crews, operators should ensure that operational documentation, including checklists, carry the relevant prompts for flight crews to gather all necessary information to assist their decision‑making processes.

Additionally, the impact of human factors on RPAS operations should be actively considered and managed. While the risk profile may differ from that of crewed operations, factors such as workload and operational pressure can equally impact RPAS operations. 

As RPAS operations continue to rapidly develop and diversify, compliance with operational guidelines and limitations set or approved by the regulator are critically important to minimise risk to both the operation and the public. This is particularly important where RPAS are being operated in higher risk environments, such as public displays in built‑up areas.

Summary video

The occurrence

Test flight

Late in the evening of 13 July 2023, the Remote Pilot in Command (RPIC) and copilot of a Damoda Newton V2.2 Remotely Piloted Aircraft (RPA) swarm operated by the Australian Traffic Network Pty Limited (ATN) arrived at a pre-arranged launch site on North Wharf at Docklands, Melbourne, Victoria (Figure 1). They were to conduct a limited test of a swarm RPA display (drone show) which was to take place the following evening in support of a sporting event at the Docklands Stadium. 

Figure 1: Operational area and launch site

Source: Google Earth, annotated by the ATSB

The RPIC and copilot set out 10 aircraft [1] on the launch site and prepared the ground control station (GCS) to test the show program. The primary function of the flight was to test for potential interference from the launch site and the surrounding area. Shortly before the launch time, the RPIC identified that the wind conditions were well above the 15.6 kt limit that the aircraft could safely operate in and the test was downscaled to a hover test. The hover test involved 10 aircraft launching to a height of 10 m and hovering for a short time before landing. 

The hover test was successfully completed with the GCS system recording minimal interference from the launch site. However, the RPIC reported that as part of this process the launch location programmed for the show was identified to be incorrect and that this location needed to be updated before the show the following evening.

Flight preparation

At approximately 1400 local time on 14 July 2023 the RPIC and copilot returned to the launch site to prepare for the show that was scheduled for 1830. On surveying the intended operating area, the RPIC identified that the mast of a boat moored on the wharf directly adjacent to the launch area was an obstacle for the swarm as it transitioned from the launch area to the show area. The mast was measured at approximately 15 metres tall, requiring the height of the swarm’s transition between the launch and the show to be increased.

Shortly after arriving, the copilot and RPIC were met onsite by 4 members of the show support crew. A fifth member, who was to assist in setting up and conducting safety checks on the 500 aircraft, was late. Following launch, the support crew were to monitor the exclusion zone [2] surrounding the show area for intruders.

The RPIC briefed the crew on several topics, including the operational plan for the display, the requirements for the launch grid and setting up the aircraft. The support crew then commenced setting out the launch grid and aircraft as per the show plan. The RPIC recalled that setting out the aircraft took slightly longer than anticipated due to the wind interfering with the process of measuring out the grid. During the set‑up the RPIC took multiple ground level wind readings with a handheld anemometer. The pilot recalled that these readings were returning 8‍–‍10 kt of sustained wind, with frequent gusts up to 12 kt. 

Throughout the set‑up the RPIC was interrupted on multiple occasions by tasks normally assigned to the copilot. This included:

• additional briefings to support personnel
• multiple interactions with the client who wanted to confirm whether the show would be able to go ahead in the prevailing conditions
• interactions with other stakeholders and senior management of the operator’s company who were in attendance to view the show.

Setting up the grid took approximately 2 hours, after which the RPIC gave the support crew a 30‑minute break while they completed a walkthrough of the grid to ensure that the location and identification of each aircraft aligned with the set‑up plan. 

At 1740, the RPIC started screen recording on the ground control station (GCS) computer. This recorded all activity on the screen of the GCS computer and audio within range of the computer’s microphone (see the section titled Ground Control Station). 

Throughout the 50 minutes leading up to the show the recording captured interactions between the RPIC and copilot, and with support crew and stakeholders. It also recorded a range of operationally critical information. A detailed summary of events captured in the recording can be found in Appendix A, with key events summarised below.

At 1750 the first recorded wind speed reading was taken, giving 14 kt. At 1754 and 1817 further readings are taken at 12 kt and 14 kt respectively. At 1805 and following the 1816 reading the pilot and copilot discussed the prevailing wind conditions. The copilot stated that they believed that conditions were suitable to launch the swarm. In response, the RPIC identified that the readings they had were only at ground level and they had not tested for gusts at the intended height of the show. No further wind speed readings were taken and there was no further discussion of the wind speed recorded before the show.

At 1756 the RPIC was recorded dictating a voice to text message to the client’s representative with an update regarding the status of the show. They advised that the conditions were on trend with the forecast and they expected the show to go ahead at that point. At 1816 the RPIC identified that the representative had asked them for an update by 1815 as to whether the show would go ahead. At 1817 the RPIC was recorded dictating a further text message to the client that they were good to launch.

At 1759 the RPIC identified that to reprogram the show position to avoid the boat mast in front of the launch area required the assistance of another company pilot as they had not used that software functionality before. However, they were unable to contact the other company pilot for a further 8 minutes, despite prearranging for them to be available at 1800 to assist.

Between 1807 and 1817 the RPIC and the other company pilot went through the process of moving the show, performing the show virtual preview and interpreting the results of the preview. The RPIC applied the relevant correction to the show position, increasing the show height and moving the show to the left. The RPIC identified that the increased show height now exceeded the 120 m limit of the approval, but the other company pilot identified that the surrounding buildings provided some shielding. The RPIC elected to continue the show.

At 1817, following the completion of the show repositioning, the RPIC identified that they needed to work through the pre‑flight checklist prior to launch. The pilot and copilot worked through the items on the pre‑flight checklist. On multiple occasions they are interrupted by external communications from stakeholders and support crew.

At 1827 the RPIC instructed the copilot to make an airband broadcast in accordance with the pre‑flight checklist. The copilot questioned the need for the broadcast but was overruled by the RPIC and made the relevant transmission. The RPIC then completed the verification that the show program had been successfully uploaded to all 500 aircraft. At 1829 the copilot read out the last pre‑launch items on the checklist and the RPIC confirmed that they had been completed.

Flight

Launch

The aircraft were programmed to take off and ascend into a hover in a series of 10 layers of 50 aircraft (Figure 2). The aircraft would then move out over the water transitioning into the show area flying through a series of waypoints to make the relevant patterns of the show before returning and landing back on the grid. The whole show was planned to take about 10 minutes from take-off to return.

At 1830:15 the RPIC commanded the show to launch on the GCS. Following a 10 second countdown the aircraft powered up and the take‑off sequence commenced. The aircraft took off as programmed, with the 10 layers of aircraft stacked over the take‑off grid (Figure 2). However, 15 seconds after the first aircraft launched the GCS recorded 45 aircraft with errors, indicating that aircraft were out of position. Over the following 30 seconds the GCS recorded a further 78 aircraft showing as out of position. 

Transition to the show area 

At 1831:11 the swarm commenced its transition into the show area, but within 30 seconds more than half of the aircraft in the show were indicating errors, most for being out of position. At 1831:43 and 1831:48 the RPIC attempted to command the swarm to loiter, the first attempt was unsuccessful as they had not selected the aircraft to send the command to. The second attempt was successful with the loiter command reaching all the aircraft that were connected to the GCS computer. 

At approximately the same time as the second loiter command was issued, multiple aircraft presented with critical errors indicating an autopilot failure. This was shortly followed at 1831:55 by the RPIC identifying that there was a ‘fly‑away’. Further errors of varying severity levels continued to present on the GCS. After confirming that the copilot had the fly‑away aircraft under their control, the RPIC directed the copilot to disarm[3] that aircraft. 

By this time over 400 aircraft were presenting errors on the GCS. Between 1832:30 and 1832:50 the GCS rapidly lost connection to almost 400 of the aircraft in the swarm. When the connection was lost aircraft were in multiple different modes, with many showing loiter as per the RPIC’s command, some attempting to return to the launch area and others, predominantly those with critical errors, showing land in place.

Of the remaining aircraft connected to the GCS, 7 aircraft were attempting to continue with the show, which the RPIC then commanded to return home, while the remainder were indicating varying levels of errors. 

Nine minutes and 56 seconds after the show was commanded to launch, the last operational aircraft returned to the launch point.

Divers contracted by the operator attempted to recover the aircraft from the harbour over the following days. The divers recovered 236 of the 427 aircraft that entered the water, with 191 unrecovered.

Figure 2: CCTV footage of show

Source: City of Melbourne, cropped and annotated by the ATSB

Context

Aircraft information

Overview

The swarm consisted of 500 Newton V2.2 remotely piloted aircraft manufactured by Shenzhen Damoda Intelligent Control Technology Co., Ltd. (Damoda).

The Newton V2.2 is a quadcopter designed specifically for light show operations (Figure 3). It measured 360 mm square, sat 109 mm high, and weighed 725 grams. Mounted centrally on the bottom of the aircraft was a single colour‑changing LED light outputting a maximum of 16 watts. With a single battery the aircraft was designed for a show time of between 16 and 18 minutes and with a maximum hover endurance of approximately 26 minutes. The number of aircraft within the swarm could be varied depending on the individual show requirements, up to a maximum of 1,024.

Figure 3: Damoda Newton V2.2

Source: Operator, annotated by the ATSB

To conduct a show each aircraft was programmed with a series of timed waypoints and light colour changes. The aircraft operated independently through these waypoints with minimum separation distances of approximately 1.5 m during the show. Aircraft were not fitted with sensors to allow independent collision avoidance, relying on positional and time‑based accuracy to prevent collisions.

The aircraft were installed with a firmware package to enable operations. Due to the flight critical nature of the firmware, the operations manual required a flight test be conducted following a firmware update and that a record of this flight be made in the aircraft maintenance log.

Batteries

For the show each aircraft was fitted with a removeable Lithium Polymer (LiPo) battery that weighed 300 g and had a maximum energy capacity of 42.56Wh. Upon installation the aircraft had a red button that would protrude from the body of the aircraft to indicate that the battery was mounted correctly. For a swarm of 500 RPA these batteries equated to a total energy capacity of 21.28kWh. 

Aircraft limitations

The manufacturer’s wind speed limit for the Newton V2.2 was 8 m/s (equivalent to 15.6 kt or 29 km/h), this wind limit was common to all Damoda aircraft. In addition to the wind speed limit the aircraft also had an ingress protection or IP[4] rating of 63. This rating indicated that the aircraft were dust tight and could resist water spray but were not designed to operate in rain or be immersed in water and they would not float.

Aircraft positioning

Due to the close proximity of the swarm aircraft, uncorrected GNSS position information was not sufficiently accurate. To obtain high accuracy GNSS positions the aircraft were connected to a network containing a Real Time Kinematic (RTK) receiver. By using an independent stationary receiver in proximity to the aircraft the positional accuracy can be improved from several metres to centimetres as required for show operations. At 1822, 8 minutes before the show was due to launch, all aircraft were showing between 23 and 28 satellites connected and a high accuracy RTK position fix.

Prior to the show, the operator set up a spectrum analyser to identify potential interference in the GNSS signal that may cause the aircraft to malfunction or be out of position. The RPIC advised that prior to the show no abnormalities were identified in the signal that could have affected the aircrafts’ ability to accurately position themselves. 

GNSS spoofing

GNSS spoofing is the process of tricking a receiver into reporting an incorrect position. Spoofing a signal requires 2 steps, first the incoming signal to the receiver needs to be jammed and then the receiver must lock onto an independently generated false signal providing incorrect information. In the lead‑up to the display the GCS computer shows the position of each aircraft on the ground and in flight. These positions were shown over a base map and corresponded with locations recorded by CCTV footage (Figure 4). If the signal to the aircraft had been spoofed these locations would not have aligned.

Figure 4: Comparison of GCS and recorded aircraft positions

Note: The satellite basemap image as shown on the GCS is not an accurate representation of the actual structures around the launch site. This image was taken earlier in 2023 but the ATSB was unable to confirm the exact date. Source: City of Melbourne and operator annotated by the ATSB.

Aircraft modes

The Newton V2.2 could be operated in 6 different flight modes, G (guided), S (stabilised), L (loiter), R (return to launch), LD (land) and AH (altitude hold). A mode could be selected for an individual aircraft, it could be commanded for all aircraft in the swarm or it could be automatically changed by logic within the aircraft in the event that certain conditions were met. Manual mode changes could be commanded via the ground control station computer or a backup manual controller (see the section titled Ground control station).

In guided mode the aircraft was positioned based on the corrected GNSS position and transited through a series of pre‑programmed waypoints, before returning to the launch location.

In stabilised mode the GNSS positioning was disabled and the aircraft was manually flown using the hand controller. This mode was used if the aircraft had an error that rendered it unable to return to home automatically.

In loiter mode the aircraft held both lateral and vertical position until a further command was provided by the pilot, either via the GCS or using the hand controller.

In return to launch (RTL) mode the aircraft automatically tracked back to a position over the launch location. As the aircraft did not have obstacle avoidance sensors, this option was preferred only for individual or small groups of aircraft as commanding RTL for the whole swarm was likely to result in multiple aircraft collisions and loss of aircraft.

In land mode the aircraft landed directly below its current location.

Aircraft errors

The Newton V2.2 had 6 error modes that could be presented on the ground control station. These were: 

• EKF (autopilot failure)
• W (waypoint issue)
• B (battery voltage was low)
• F (aircraft had breached the geofence)
• T and S (Too far and Static) both indicated that the aircraft was not at the planned position. Too far indicated that the aircraft was more than 0.8 m from its target position. The distance from the target position required to activate a static error was not identified in the aircraft documentation.

These errors were broken into 3 categories depending on the required pilot response when they are presented.

• EKF or W errors required the pilot to return the aircraft to launch.
• B error - the aircraft should activate RTL automatically.
• F error - the aircraft would automatically activate RTL and re-enter the geofence. If it did not return within the geofence the motors would be automatically shut down.
• T and S errors were for information and monitoring. The pilot was only to intervene and manually activate RTL if the distance between the planned and actual locations continued to increase. 

The display of these errors on the GCS is discussed further in the section Flight control software - Warnings. The RPIC identified that there were up to 10 aircraft presenting with EKF errors, and that they had never experienced more than one EKF error simultaneously. 

Fleet

At the time of the occurrence the operator had a total Damoda V2.2 fleet of 1,136 aircraft registered with the Civil Aviation Safety Authority (CASA). The first 515 of these were registered with CASA at the end of October 2022. The remaining aircraft were registered in April of 2023, shortly after their purchase.

Along with these additional aircraft, the operator also purchased additional support equipment for a second complete GCS layout. This enabled the operator to either operate 2 independent fleets of 500 aircraft or to combine the 2 fleets for a single show of up to 1,024 aircraft. When the operator purchased the additional aircraft, it was supplied with the latest version of the aircraft firmware and the manufacturer’s latest GCS software (see the section titled Flight control software). 

Ground control station

The ground control station (GCS) consisted of 4 elements: 

• a laptop computer running Damoda’s flight control software
• a Wi-Fi network to which all the aircraft were connected, enabling communications and data transfer between the aircraft and flight control software before and during the show
• a differential ground station for real time correction of the GNSS signal
• a spectrum analyser used to identify abnormalities or issues in the frequency bands that the aircraft and the GNSS signal were operating. 

These elements were brought to the show location by the operator and were set up by the flight crew.

Flight control software

Operating on a laptop computer, the flight control software provided all command and control actions for the swarm through the local network. Common to all Damoda aircraft types, the software allowed flight crew to monitor the status of all aircraft before and throughout the show. It was used to upload, manipulate and test the proposed show, control the aircraft either through the software itself or by tethering them to the hand controller.

The flight control software also displayed errors and warnings affecting the aircraft or the software. The flight control software was not used for the development of the show flight paths or ‘drama’. This was completed in a different software package and a drama file containing the show flight paths for each aircraft was imported into the flight control software for uploading to the individual aircraft.

When the operator received the first 500 aircraft in October 2022 these were provided with version 2 of the manufacturer’s flight control software. Prior to the acquisition of the operator’s second 500 aircraft in April 2023, the manufacturer introduced an updated version of the flight control software (version 3), and this was provided to the operator, along with an updated version of the aircraft firmware.

Wind speed monitoring

A wind monitoring function was introduced with version 3 of the flight control software. This function displayed the maximum wind speed and direction encountered by aircraft in the swarm, in the upper right corner of the screen (Figure 5). To provide a reading, at least one aircraft had to be active and connected to the GCS software.

The wind monitoring function remained visible and its position constant on the screen throughout the operation of the GCS. Other functionality could be selected or deselected depending on the pilot’s information preference. Wind speed and direction were calculated and displayed in real time through the interpretation of aircraft bank angle and motor speed, combined with the planned and actual positions of the aircraft. 

When the wind speed limit was exceeded, there was no audible, visual or tactile alert presented to the pilot. As such, the flight crew needed to actively monitor the parameter to be aware of an exceedance of the wind speed limit. Figure 6 shows the wind speed indicator at 3 moments during the show with the wind speed below, just above and significantly exceeding the 8 m/s published wind speed limit of the aircraft. 

Figure 5: GCS software display with wind speed readout highlighted

Source: Operator, annotated by the ATSB

Figure 6: Wind speed display below, just above and significantly exceeding the wind speed limit

Source: Operator, cropped and annotated by the ATSB

The flight crew advised that at the time of the show they were not aware that this functionality was available to them. The RPIC reported that they only became aware of it when they were reviewing the incident with another one of the operator’s pilots who identified the indicator to them. The RPIC stated that if they had identified this information at the time of the show then they would have likely terminated the show when the wind speed limit was reached.

Warnings

The GCS software could present 2 different types of warnings depending on whether an individual or multiple aircraft were affected. 

Errors related to individual aircraft presented on the GCS computer in an individual box as shown in Figure 7. These boxes showed the aircraft identifier, the error or errors and the mode the aircraft was operating in. They were then grouped by colour coded category depending on the required pilot response. Errors requiring immediate action were coded red, those that resulted in an automatic RTL were coded orange and those that only required monitoring were coded blue.

Where an aircraft showed errors from multiple different categories the aircraft was placed in the highest category of urgency encountered. Figure 8 shows all 3 of the categories appearing on the GCS for this occurrence, shortly after the aircraft transitioned towards the show area.

Figure 7: GCS screenshot showing individual aircraft errors

Source: Operator, annotated by the ATSB

Figure 8: GCS recording showing the 3 error categories as they appeared on the night of the show

Source: Operator annotated by the ATSB

Errors that affected multiple aircraft were presented as a pop‑up over other windows on the GCS screen (Figure 9) and required acknowledgement before any other action could be taken. These warnings were presented in instances such as a failure of data to successfully upload to aircraft or failure of a command to reach the aircraft. 

Figure 9: GCS screenshot showing a multi-aircraft warning pop‑up

Source: Operator, annotated by the ATSB

Both types of warnings relied on data processed by the GCS to display the relevant information to the pilot. The errors were then presented in such a way that the pilot could rapidly interpret the meaning and respond appropriately. 

Adjusting the show 

The GCS software had the capability to adjust the position, height and orientation of the drama file to ensure that the flight paths could be executed safely. The flight crew had multiple options for making the adjustment, which could be used independently or simultaneously. They could change the height or position of the whole drama file or they could adjust the launch and landing profiles, which changed the position and altitude that the aircraft moved to before they transitioned into the show area.

Due to the boat mast hazard the RPIC, in consultation with one of company’s other pilots, elected to adjust the position of the transition into the show area by increasing the height by 11 m and moving all aircraft 2 m to the left (Figure 10). To accommodate for these changes the total height of the show was also adjusted up by 8 m taking the maximum show height to 126 m. 

Figure 10: Drama adjustment functionality as set by the RPIC

Source: Operator, annotated by the ATSB

Setting the geofence and exclusion zone

The geofence is a polygon made of a series of GNSS locations surrounding the show area (Figure 11). It was manually created in the flight control software and then uploaded to the aircraft. Once in flight, if an aircraft passed through the geofence it automatically activated the RTL mode to bring it back inside the geofenced area and return to land. If the aircraft remained outside the geofence then the motors were shut down and the aircraft fell to the ground or water uncontrolled. 

Figure 11: Development and placement of Geofence

Source: Operator, annotated by the ATSB

The flight control software had a measurement feature that allowed the operator to identify and measure approximate distances over the base map. This allowed the determination of the size of both the geofence and the subsequent size of the exclusion zone (see the section titled Exclusion zone).

Hand controller

Swarm operations are conducted autonomously with the aircraft moving through a series of pre‑programmed waypoints or in the relevant failsafe modes. In the event of a system issue or error that prevented the automated system from effectively controlling the swarm, manual control could be taken using a hand controller. The controller allowed the operator to fly the swarm, command mode changes and activate relevant failsafe modes on the aircraft. For the hand controller to be used it must be tethered to the relevant aircraft in the swarm. It could be tethered to all aircraft in the swarm or to certain aircraft independently.

The manual controller employed by the operator was a VANTAC Taranis hand‑held controller, manufactured by FrSky. The VANTAC (Figure 12) was a programmable, 24 channel, 2.4 GHz transmitter that could be used to control a range of remote devices, including RPA. The controller had 8 programable control switches, (6 3‑position and 2 2‑position) that the user could assign to modes or operational settings. In support of the Damoda swarm operations the switches were assigned as per Figure 12. The mode switch allowed the operator to change the mode between land, loiter and stabilised modes. As part of the operator’s pre-flight checklist the throttle (vertical movement on the left control stick) on the controller was to be set to 50% so that if the controller was required the aircraft would have sufficient power to hover.

The emergency kill switch was a 2‑position switch. When activated it immediately shut down the motors, causing the aircraft to fall to the ground. This was the command that the copilot implemented once the RPIC instructed them to disarm the fly‑away aircraft.

Figure 12: FrSky VANTAC Taranis controller

Source: Operator

Crew information

The operator’s manuals listed the crew for a light show operation in 3 distinct groups, all under the oversight of the RPIC, as follows: 

• flight crew, responsible for the safe setup and operation of the fleet of drones
• ground/support crew, assisted in the set-up of the fleet and operational area and monitoring the ground and airspace around the show for potential intruders
• additional security or other personnel involved in securing the operational area, such as water police for a show over water. 

Flight crew

For light show operations involving up to 500 aircraft the company operations manual required a flight crew of 2 – a mission commander (RPIC) and a copilot. The CASA permission for the operation (see the section titled Operational approval) listed specific pilots who were approved to operate more than one RPA at a time. The CASA permission did not specifically require a second pilot, however the operator’s manuals contained a requirement for a 2 or 3 pilot operation depending upon the swarm size. 

Remote pilot in command 

The RPIC was authorised and qualified to act as the mission commander for the operation that was being undertaken. They held a Remote Pilot License (RePL) for multi‑copter operations up to 25 kg. Upon joining the operator in October 2022, they had completed the Damoda training program and subsequently been endorsed by CASA to operate more than one RPA at a time.

At the time of the operation the RPIC had approximately 6 hours on type consisting of 32 training or operational shows varying in size from 10 to 1,050 aircraft conducted at a range of locations, including over water, and in both day and night conditions. The RPIC’s most recent show flight was the rehearsal for the Docklands operation, which was carried out 4 days prior to the show.

The RPIC held ultimate responsibility for the safe operation of the show in accordance with the relevant permissions and operator’s manuals. The operations manual outlined the specific responsibilities of the RPIC to include but were not limited to:

• Conducting an operational safety briefing on items relevant to the RPA operation.

• RPA crew co-ordination.

• Ensuring the RPA is in CASA approved airspace.

• Ensuring operations are conducted in accordance with company operating procedures including the JSA [job safety assessment] and Flight Authorisation.

• Maintaining communication with the RPA crew throughout the entire operation using Local Comms Handheld Radios.

• Confirming responsibilities of all flight crew members

• Reviewing the show design and verify operational area, exclusion area, and minimum drone separation distance (1.0 m) prior to flight.

• Confirming proper set-up of base station.

• Operation of the RPA.

• Post-flight data recording.

• Confirm all crew fitness for duty.

• Reporting incidents to the Chief Pilot.

Copilot

The copilot for this operation was authorised and qualified to operate in the role of copilot. They held a RePL for multi‑copter operations up to 25 kg and had completed the operator’s Damoda training program following the introduction of the aircraft type in October 2022.

The copilot had previously completed 17 lightshow training flights operating in either the RPIC or copilot role, the most recent of which was as a copilot 3 days prior to the occurrence flight at Sydney Olympic Park. The operator’s flight logs identified that prior to that operation they had not completed a show in more than 6 months. The copilot had not been endorsed by CASA as qualified to operate as mission commander (RPIC) in one‑to‑many operations, however under the operator’s manuals this was not required to operate in the role of copilot. 

The copilot’s role as outlined in the operator’s manuals was to assist the RPIC in the conduct of the show. The manual delegated specific responsibilities to the copilot. While not specifically stated in the manual, one of the aims of this was to reduce the RPIC’s workload. The responsibilities of the copilot included: 

• conducting an operational safety briefing on airspace items

• management of stakeholders

• management of show support crew

• monitoring operating area Airband VHF frequencies throughout the entire operation

• broadcasting on VHF frequency when needed

• immediately advising Mission Commander of any relevant airspace traffic

• show timing

• co-ordinating incident response

• assist the Remote Pilot in Command and be co-located during the show unless attending to an emergency

• activate emergency procedures in event of RPIC incapacitation

• Hold direct communication with the all crew throughout the entire operation using Local Comms Handheld Radios (or co-location).

• Visual observation of swarm

• Alert of drone flyaway

• Control of drone flyaway Drones IDs 1-500

The copilot was also the operator’s chief remote pilot (CRP). As such, they had overall responsibility for the RPAS operation, including the approval of operations planned by the other pilots. The copilot had completed training on the V2.2 aircraft and GCS software when it was introduced, however they stated that they normally left the planning and operation of the shows to the other pilots who were more proficient in swarm operations. This allowed them to focus on other areas of their role in the organisation. 

Due to staffing changes at the operator (see the section titled Staffing changes) the chief remote pilot had been brought into this operation as a copilot. As they were not endorsed by CASA, they could not assume the role of RPIC. 

Ground crew

In support of the flight crew the operator’s manual required that one ground crew member be present for every 100 aircraft within the display. Under the operations manual these crew members were responsible for a range of tasks. These included: 

• ground handling of the RPAs
• pre- and post-flight checks of the RPAs
• battery management
• monitoring of the ground and airspace around the show area for potential breaches
• maintaining direct communications with the flight crew throughout the entire operation.

The operator sourced ground crew members from a labour hire company. Ground crew members were briefed by the RPIC and required to complete a consent and compliance declaration acknowledging that they understood their role. Once briefed by the RPIC the management of the show support crew was the responsibility of the copilot.

Additional personnel

As this show was to be conducted over water, the operator was required to ensure that water traffic was maintained clear of the show area exclusion zone. To enforce this zone the operator had engaged vessels from Parks Victoria, Victorian water police and a private contractor to monitor the show area perimeter. Communications between these vessels and the flight crew was maintained by UHF radio.

Multi-crew operations

Cockpit gradient

A cockpit or authority gradient refers to how balanced power and decision‑making authority is within a team. Authority is not necessarily defined by experience or competence in a role but may be through the role that a person holds (SKYbrary, 2025). Where a cockpit gradient is too steep, team members may not be willing to challenge or express concerns over a leader’s decisions, and where too shallow it can slow decision‑making processes.

A negative gradient is where a team member in a subordinate role has more power or authority than the team leader. This can undermine the team leader’s authority and lead to the leader deferring to, or placing additional weight on, that team member’s opinions or ideas.

In crewed operations, to be endorsed to fly multi‑crew, pilots must undertake multi‑crew coordination (MCC) training. Part of this training required the candidate to demonstrate effective management of flight deck gradient for tasks that were being performed. Neither the CASA approval nor the operator’s documentation required this or equivalent training for swarm operations.   

Operator information

Operations manual

The operator maintained an operations manual and operations library in accordance with the requirements of Part 101 of the Civil Aviation Safety Regulations 1998 (CASR); both had been approved by CASA. The operations manual contained the operator’s overarching processes and procedures and outlined various regulatory compliance requirements. The operational library contained more specific aircraft information and operational processes.

For example, the operator’s manual contained information about the conduct of RPAS display operations, however the specific process for carrying out the pre‑show checklist was contained in the operational library. Similarly, the basic and overarching emergency procedures were contained within the operations manual but specific responses and processes for different emergencies were in the operational library. 

The operations manual outlined that the chief remote pilot was responsible for all operational matters and remote pilot training affecting safety. This included:

• ensuring that operations were conducted in compliance with relevant regulations
• responsibility for applications, permissions and approvals to facilitate operations
• maintaining a reference library of operational documents
• developing checklist and procedures relating to flight operations. 

Checklists

To support show operations using Damoda aircraft the operator maintained and utilised several checklists contained within the operations library. The show day and flight checklists were the primary documents used by the crew in preparations for a show. There were different versions of these checklists depending on whether more or less than 500 drones were being used in the show. 

For a show of up to 500 drones, the show day checklist consisted of 10 items, taking the crew through the set‑up of the GCS and the laying out of all drones in preparation for the show. It also included guidance on the set‑up of the network and RTK equipment and environmental monitoring including electromagnetic and wind conditions.

The final item on this checklist (Figure 13) was for a weather inspection. This item required the pilot to check the current weather forecast and measure the wind speed at 5‑minute intervals for the 30 minutes before the show start ‘if the pilot has capacity’. The checklist did not identify a specific location where these wind readings are to be taken. The checklist was dated 7 March 2023, which was before the introduction of the wind management plan and weather drone (see the section titled Wind management plan). 

Figure 13: Item 10 on the operator’s show day checklist

Source: Operator

At interview both the RPIC and copilot identified that this checklist was available to assist them in the lead‑up to the show. The RPIC stated that they and other pilots were familiar with the content and they did not always refer to the checklist during preparations for the show.

For a show of up to 500 drones the flight checklist consisted of 20 items taking the flight crew through the set‑up of the aircraft and GCS equipment, a review of the emergency procedures and final checks. Item 17 was the final item before launch and it required the RPIC to consider their confidence in the fleet and assess the overall risk factors before deciding whether to launch the show. The RPIC stated that the flight checklist was mandatory and was always used in the lead‑up to the show.

Emergency procedures

The operator’s manuals outlined the procedures in the event of an emergency during the swarm display. It defined procedures for a range of non‑swarm related emergencies including fire on the ground, crew medical event and non‑cooperative traffic (aircraft or bird) interacting with the swarm.

The general response to any of these emergencies was to respond to the immediate threat (if required) and then place the swarm on the ground as quickly and safely as possible either using an RTL or land command sent to all aircraft or manually controlling aircraft to the ground. 

The operator maintained specific emergency procedures for aircraft producing EKF (autopilot failure) and W (waypoint issue) errors. These errors required an immediate response from the pilot to select RTL and if the RTL command failed the aircraft were to be flown back manually using the hand controller.

Item 2 of the operator’s flight checklist required that the RPIC and copilot reviewed the emergency procedures prior to flight. The GCS recorded that the RPIC stated that the response to these errors would be to RTL, take control of the aircraft manually and if neither of these were successful, land the aircraft in the water.

In response to this occurrence, the RPIC activated the emergency procedure for EKF errors and fly away aircraft. While initially the RPIC activated a loiter command, at that time neither the fly away nor the first EKF error had occurred. When these occurred the RPIC instructed the copilot to control and then deactivate the aircraft and attempted to RTL each aircraft showing an EKF error on the GCS.

Training and checking

With the introduction of the Damoda aircraft all the operator’s pilots, including the copilot (CRP) undertook initial training with the manufacturer’s Australian agent. The CRP identified that there were some gaps in the training so the operator’s pilots undertook further in‑house familiarisation and testing with the show software to understand the relevant capabilities and features.

When version 3 of the GCS software was introduced, no formalised training was undertaken with the manufacturer or its Australia agent. The operator and RPIC reported that the manufacturer had provided a document with installation guidance and some differences between the old and new versions of the software. They further identified that prior to starting operations with the new software the pilots undertook familiarisation with it, identifying updates to existing features and some of the new features.   

There was no documented process for ensuring that all pilots had the same level of competence or were aware of all the relevant features of the software.

Prior to commencing show operations, the RPIC was required to complete the operator’s internal training program and be checked by CASA for approval to operate multiple aircraft simultaneously. The training syllabus for operations using the Damoda aircraft involved 8 sessions. The first required the pilot to demonstrate correct set‑up and operation of all the show hardware, including the GCS and aircraft.

The following sessions involved incremental increases in the number of aircraft from a single aircraft through to a 1,050 aircraft flight. Each session required the pilot to identify the relevant configuration, set‑up and crewing changes for the number of aircraft being operated. The CASA check for approval to the operational instrument was built into this training syllabus and was completed as part of session 7. Session 8 was a final demonstration flight with 1,050 RPA.

The operator’s manual required show‑qualified RPICs, copilots and ground crew members to undertake proficiency checks to ensure that they were operationally capable. Proficiency checks covered a range of items applicable to each of these roles. They were required every 12 months unless the candidate had carried out a minimum of 4 relevant light show operations in the last 12 months, whereby the time between the proficiency checks could be extended to 24 months.

The RPIC had joined the operator less than 12 months previously and had completed more than the required 4 light show operations as RPIC meaning that a proficiency check was not required until October 2024.

Proficiency checks were required for each aircraft type and additional proficiency checks were not required in the event of significant changes to the software.

Wind management plan

In response to a specific request from an earlier client the operator had developed a wind management plan. Introduced on 21 May 2023, the plan was ‘…to ensure the safe and successful execution of a drone light show event in windy conditions’. While initially developed for that specific client the plan made no specific reference to that client or event, generally identifying the set‑up and operational wind limits and specifying how weather could be monitored. The set‑up limit was 18 kt (9.2 m/s) measured 3 hours before the flight and the operational limit was 14 kt (7.2 m/s) measured 5 minutes before the flight. The wind management plan also contained higher level statements about how the use of certain aircraft, training of pilots, engagement with stakeholders, an emergency response plan and post‑event evaluation was used to achieve the purpose of the plan. 

Despite containing operationally relevant information related to wind management and responses to adverse conditions the plan was only included in the event plan for the show and was not integrated into the organisation’s operational processes and procedures.

Version 1.1 of the wind management plan was dated 6 June 2023, approximately 5 weeks before the accident flight. The updated version increased the operational wind limit from 14 to 15.3 kt (7.2 to 7.9 m/sec) and introduced, at the RPIC’s discretion, the use of a weather drone to test the conditions in the show area before the show was launched. The plan did not detail how the weather drone could be used, but the CRP identified that it could be conducted with a separate aircraft or an aircraft from the swarm could be tethered to the controller and flown manually for the weather check. As with the earlier version, the updated version of the plan was only included in the event operational plan and not integrated into show processes and procedures. 

The wind management plan did not refer to the wind speed readout on the GCS display.

The RPIC advised that they were aware of the wind management plan and that, to their knowledge at the time of the occurrence, it did not contain the option for the launch of a weather drone. They further stated that this was only introduced post this accident. 

Staffing changes

In the weeks leading up to the show there were several staffing changes that impacted how the show was planned and carried out. Firstly, the operator’s chief executive officer (CEO) had left and this show was the first opportunity for the new CEO to see the company’s drone swarm operation in practise. Secondly, the operations manager, who had been the main point of interaction between the client and flight crew during show preparations had left the company and had not been replaced. 

As a result of the departure of the operations manager, the RPIC had taken on this role and subsequently was involved in preparation of multiple shows, including the Docklands show. This included liaising directly with the client and other stakeholders. The RPIC stated that having the pilot operating the show involved in client interaction during operational planning was normally avoided. This was to ensure that the RPIC on the night could focus on operating the show and not have to worry about engaging with the client.

Normally, once a show had been planned, contact with the client would be handed over to the copilot for them to manage on the night of the show. For this show that did not occur due to the already established relationship between the RPIC and client. 

The reduction in team size brought about by the operations manager’s departure reduced the personnel available for this show. Subsequently the CRP who was copilot‑qualified, but stated that they weren’t ‘recent’ in the operation, stepped into the role of copilot. The RPIC commented that this resulted in a different dynamic between the RPIC and copilot than if the copilot had been more experienced.

Operator’s review

Following the accident the operator conducted a review into the occurrence and identified the following:

• The flight crew did not consider the conditions in the show area at altitude.
• RPIC was under unrealistic pressure to complete the show in the allotted time.
• The copilot’s limited experience increased pressure on the RPIC.
• Requirement to move the show reduced time available for show preparations.
• The RPIC had significant confidence in the reliability and functionality of the operational fleet.

Operational information

Operational approval

In Australia RPAS operations are governed by Part 101 of the CASR. Under regulation 101.300 a person may not operate more than one RPA without a specific approval from CASA. On 12 May 2023 CASA issued a 12‑month approval for the operator and specified pilots to operate more than one RPA at a time and at night, subject to a series of conditions. Some of the conditions listed on this approval were that the:

• operator must have an active notice to airmen (NOTAM) advising when and where the operation was taking place

• operator must operate in accordance with their operations manual

• operator may only operate Damoda multirotor aircraft up to 750 g

• RPA must have appropriate failsafe functionality in the event the data link to it was lost.

• operator must maintain an appropriate exclusion distance to non-essential personnel as outlined in the specific revision of their operations library.

Provided that these conditions could be met, the operator was permitted to plan shows at any location in Australia. 

Show planning

Once a potential show location had been identified, an operational self‑assessment was to be carried out on the site using the process outlined in the operations library. The assessment was to include hazards within the operational area, including the show airspace, the launch and recovery area and the traversal airspace between these 2 areas. The assessment also determined the exclusion zone requirements. 

The self-assessment required consideration of the access to both the ground and airspace in these areas, clearance and obstacles, the potential for RF interference, ground topography and other potential users. The manual specifically identified that waterways were a preferred operational area as the water provided a natural barrier to public access. Waterways without vessel access were preferred, however where vessel access was possible then an exclusion zone needed to be set up and enforced by the relevant authorities.

Docklands

The show planning for the Docklands operation was carried out by the RPIC and one of the operator’s other pilots. Part of the planning process was engagement with the harbour authority to organise a harbour closure and enforcement of the exclusion zone around the show. In the days leading up to the show, the operator requested that the 15‑minute closure window for the show be moved later due to forecast wind conditions. The operator advised that the harbour authority had stated that this was not possible.

Event operational plan

The event operational plan contained all the relevant information that the crew required to conduct the show, such as timings, location, relevant stakeholder contact details and plans for traffic and crowd control. Listed as attachments to the operational plan were 5 appendices (labelled A through E). Appendix A was the wind management plan. The event operational plan did not specify which version was attached, however at the time v1.1 was current. Appendix D contained the operator’s risk assessment. This document identified the loss of aircraft into the water as a hazard that required treatment. Most of the treatments were related to management of batteries and inspection of aircraft, the final treatment was the availability of divers onsite to recover any RPAS that were lost into the water.

The event operational plan and its appendices were available to the flight crew on the day of the accident. However, the RPIC reported that in the lead‑up to the show the crew would normally refer to the checklists rather than the event operational plan for relevant processes. In the 50 minutes leading up to the show the only reference that was recorded to the event operational plan was associated with obtaining the frequency for the nearby Essendon air traffic control tower.

Operational area

Victoria Harbour is located approximately 1 km south‑west of the Melbourne CBD. The area surrounding the harbour is a mixed residential and commercial precinct with the Docklands Stadium on the northern end and several high‑rise buildings adjacent to the harbour, with the tallest being approximately 140 m.

South of the harbour the Bolte Bridge crosses the Yarra River with two 140 m tall support towers. The selected launch site had previously been used by another operator to launch a swarm display. That display had encountered issues with magnetic interference close to the ground, which was believed to be due to the large volume of steel reinforcing of the concrete at the launch site associated with its previous use as an operational dock.

The operator had identified this as a potential hazard and expected that there may be some magnetic interference with the aircraft, however there were minimal impacts identified in the GCS recording or reported by the flight crew prior to or during the initial launch of the swarm.

As shown in Figure 1 there were multiple jetties where pleasure craft were moored extending up to 90 m into the harbour. As the operator did not have access controls in place for these jetties, to ensure safety for anyone on them at the time of the show, they needed to be outside of the exclusion zone around the show area. 

Exclusion zone

An exclusion zone ensures that, in the event of an aircraft operational issue, it will be contained and not pose a risk to non‑essential personnel. The zone is calculated from the geofence, based on the aircraft’s maximum operational speed and its wind speed limit. Therefore, an aircraft operating at maximum operational speed with a tail wind at the aircraft’s wind speed limit will still be contained. The exclusion zone was calculated at 50 ft operating height increments between 100 ft and 400 ft (maximum allowable show height).

Table 1, reproduced from the operations library, shows the calculated minimum exclusion zones for Damoda V2 aircraft between 100 ft and 400 ft.

Table 1: Damoda V2 minimum exclusion zones by aircraft height

Prior to setting the geofence, the pilot measured the distance between the edge of the show area and a publicly-accessible jetty on the opposite side of the harbour to be 62 m. The RPIC then set the geofence around the show area manually using a buffer of 8‍–‍15 m, resulting in an effective exclusion zone between 47‍–‍54 m (Figure 14). 

Figure 14: Exclusion zone positioning

Source: Operator, modified and annotated by the ATSB

Based on the operator’s exclusion zone calculation process, the ATSB assessed the size of zone required to contain aircraft operating at maximum show speed and subject to a tailwind of twice the approved limit of the aircraft (16 m/s) at a height of 126 m (the maximum planned height of the show). In that scenario, an exclusion zone of more than 100 m would have been required. 

Meteorological information

Operator accessed information

The flight crew advised that, throughout the afternoon and in the lead‑up to the show, they had accessed meteorological information from several sources. This included the Bureau of Meteorology (BoM), Windy and Willy Weather applications and aviation meteorological forecasts, including the relevant graphical area forecast and terminal area forecast for Essendon Airport (6 nautical miles to the north-west of Docklands). In discussing the wind conditions the flight crew noted that they were above the limit of the aircraft, but expected them to ease leading up to the show time.

Ground‑based monitoring

The flight crew were monitoring the wind speed on the ground using a handheld anemometer[6]. The flight crew reported that during the set‑up for the show the wind had been recorded in excess of the aircrafts’ limit. 

Table 2 shows the recorded wind readings that were taken in the 40 minutes leading up to the show, ending at 1817.

Table 2: Wind speed measurements taken at launch site recorded by GCS

Bureau of Meteorology aviation forecasts and observations

The graphical area forecast issued by the BoM, valid at the time of the show for the Docklands area, identified surface visibility exceeding 10 km and severe turbulence below 6,000 ft for most of south‑eastern Victoria.

At 0927 on the day of the show the BoM issued a terminal area forecast (TAF) for Essendon Airport (YMEN)[7]. The TAF was valid between 1000 and 2200 local time on the day of the show. It forecast winds from the north at 18 kt gusting to 28 kt, strengthening to 20 kt gusting 32 kt from 1100, with severe turbulence below 5,000 ft from 1000.

At 1507 the BoM issued an amended TAF valid from 1600 till 0400 the day after the show. From 1600 it forecast winds from the north at 18 kt gusting 28 kt and severe turbulence below 5000 ft. From 2200 winds were forecast from the north at 14 kt with the turbulence reducing to moderate. 

Corresponding observations

METAR and SPECI information for YMEN for the period from the start of the amended TAF at 1600 until 1830 (the show launch time) was consistent with the forecast conditions. The wind direction was consistently from the north and wind speeds varied around the aircrafts’ limit, with gusts between 25–30 kt (Figure 15).

Figure 15: YMEN wind speed observations

Source: ATSB using BOM data

Aircraft

While airborne and connected to the GCS the aircraft reported wind speed and direction information, which was displayed on the wind monitor. The wind speed was manually extracted from the GCS recording and plotted at 5 second intervals showing the changes in wind speed throughout the occurrence (Figure 16).

Within 10 seconds of the first data being recorded, the aircraft were operating in excess of the wind speed limit. As the aircraft climbed during the transition to the show area the wind speed increased rapidly progressing to more than double the 8 m/s limit of the aircraft.

Over the following 35 seconds the wind speed decreased and remained at or close to the limit until 1833:30, approximately 2 minutes after the show was launched. At the time the wind speed decreased most of the aircraft had activated their failsafe mode and were attempting to land in the water. Notwithstanding the potential effect of wind gusts, at these lower heights the wind speeds were likely closer to the speeds recorded on the ground before launch.

Figure 16: Wind speeds displayed on the GCS

Source: ATSB based on operator data

Recorded data

Aircraft

Following the occurrence the operator downloaded the flight logs from the aircraft that were not submerged and provided these, along with the screen recording and logs from the GCS software to the manufacturer for further analysis.

The manufacturer identified that up to 397 aircraft simultaneously reported ‘T’ errors. Further analysis of the available logs indicated that aircraft throttled to 100% and that the recorded pitch angle of the aircraft (max 53°) exceeded the normal flight angle (Figure 17).

The manufacturer concluded that the aircraft had encountered wind conditions exceeding their capability.

Figure 17: Aircraft pitch, roll and throttle parameters

Source: Manufacturer, annotated by the ATSB

Specifically, while most of the aircraft were showing the commanded loiter mode, the manufacturer identified that:

Due to the influence of the wind speed, the power of the motors was no longer able to provide the required lift for the drones, so they moved up and down and slowly landed.

Without the capacity to provide the required lift the aircraft could not maintain position in the loiter as the RPIC had commanded and subsequently descended. This resulted in most of the aircraft ditching into the harbour. The GCS recording did not show evidence of a mode change, with most aircraft still showing the ‘L’ indicating they were in loiter mode on the GCS when connection was lost.

The manufacturer’s report also stated that the pilot was responsible for testing the wind speed and should be aware that the winds at height may be greater than that on the ground.

Ground control station

In accordance with the operator’s show day checklist the RPIC started screen recording on the GCS laptop computer at 1740, 50 minutes before the show was launched. The recording captured all activity that was displayed on the screen, including command inputs and selections, errors and function displays through until 1920, 50 minutes after launch.

The recording only captures what was displayed on the screen and not the information that the software used to generate the visual display. For example, during the show an aircraft status window was open over the location map so the location of the aircraft during and after transition into the show area was not visible. 

The software used to record the screen also recorded the input from the computer’s microphone, capturing the interactions and communications between various crew members that were within range. Appendix A summarises the recording leading up to the show.

Closed circuit television

A series of 6 closed circuit television (CCTV) cameras around Victoria Harbour (Figure 18) captured the show’s launch, transition to the show area and some of the show. The footage captured the uncommanded movement of multiple aircraft, aircraft collisions, the aircraft landing in the water and the fly away aircraft (Figure 2).

Camera 1 captured the location of the boat mast that the RPIC had identified as presenting an obstacle to the swarm (Figure 2). Camera 4 captured multiple flags showing full extension at the time that the show was launching in the background. Noting that wind conditions varied with height, this camera was used to gain a general understanding of the conditions around the show site in the lead‑up to, and at the time of, the show.

Figure 18: CCTV cameras around Docklands

Source: Google Earth, annotated by the ATSB

Safety analysis

Introduction

At 1830 on 14 July 2023, the remote pilot in command (RPIC) of a swarm of 500 Damoda Newton V2.2 aircraft commanded the aircraft to launch to conduct a light show. Shortly after launch, and before the aircraft transitioned to the show area, the RPIC was presented with an increasing number of errors. The swarm continued towards the show area where further errors presented with multiple aircraft entering failsafe modes and landing or falling into the water. A total of 427 aircraft were submerged, with only 236 recovered.

The following analysis will consider the conduct of the show from the launch to the aircraft ditching into the water, including the factors that impacted the decision to launch. It will also review several safety issues that increased the risk to the operation. 

Launch decision

Available information

Prior to the show the flight crew monitored wind conditions by referencing various weather sources and taking wind speed measurements at ground level. The conditions on the ground were below the limit of the aircraft with gusts exceeding the limit. The flight crew expected that, based on their interpretation of the available forecasts, wind conditions would ease in the lead‑up to the show time.

However, at 1817, 13 minutes before the show launch, a wind speed of 7 m/s was recorded on the ground, only 1 m/s below the allowable wind limit. At this time there was a conversation between the RPIC and the copilot about the wind conditions. The RPIC identified that the conditions on the ground were near the limit of the aircraft and that the wind speed in the show area was likely to be higher than that at ground level. The copilot responds that it’s only gusting and that they just have to get off the ground. In the following 13 minutes prior to the launch the RPIC was occupied with other tasks and no further wind speed assessment was undertaken. 

Wind management plan

The version of the operator’s wind management plan current at the time of the accident provided guidance for the collection of wind information within the show area using a weather drone. The RPIC was aware of the wind management plan but not that it contained the option to use a weather drone. That understanding was consistent with the content of the previous version of the plan that did not contain that option. 

As the wind management plan was attached to the event operational plan, which was prepared by the RPIC and approved by the copilot in their role as CRP, both flight crew should have been aware of the plan’s availability to them on the night of the show and its contents. However, in response to the draft report, both advised that they were unaware of its attachment to the event operational plan. Further, as the wind management plan had not been included in any operational process or procedure there was no prompt for the flight crew to review or access the plan prior to the show for guidance in the windy conditions. Subsequently, neither the plan nor the weather drone option it contained were used.

If a weather drone had been launched it is highly likely that it would have encountered conditions like those experienced by the swarm. That would then have provided the flight crew with confirmation that conditions were unsuitable for the light show to proceed.

Control issues and ditching

Show launch

Ten seconds after the RPIC commanded the swarm to launch, the wind speed displayed on the ground control station (GCS) was equal to the aircrafts’ limit of 8 m/s. A further 10 seconds later the readout was showing a wind speed of 9.9 m/s. At this time 85 aircraft were displaying errors on the GCS. Of these, the 20 where the error type was visible were all showing ‘T’ errors indicating that they were out of position. The manufacturer’s analysis of the flight data identified that these ‘T’ errors were presented due to the aircraft motors being unable to hold position against the prevailing wind.

Having ruled out interference with or spoofing of the GNSS signal the ATSB also considered the possibility of a malicious actor attempting to take control of the swarm. However, the GCS computer showed no unexpected changes to aircraft mode or any commands received by the aircraft that were not commanded either by the RPIC or automatically through aircraft logic. Additionally, if the aircraft had been interfered with and tasked to alternate positions then they would likely not have recorded out of position errors.

Ground control station wind speed display

There was no indication from the discussion, comments or actions recorded on the GCS computer that the flight crew identified a wind limit exceedance. They did not equate the 85 aircraft indicating ‘T’ errors to a limit exceedance or identify the wind speed readout. The RPIC and copilot were both unaware of the GCS wind speed display functionality so were not monitoring it for limit exceedances. They stated that if they had identified that the wind was in exceedance of limit that they would have taken actions to terminate the show.

Once the show had launched the copilot’s responsibilities as outlined in the operations manual were to monitor the airspace for relevant traffic, visually observe the swarm and to monitor it for fly aways. These 3 tasks required the copilot’s attention to be on the swarm and the surrounding airspace rather than detail displayed on the GCS computer. While the copilot visually identified aircraft out of position, they did not associate it with a wind speed limit exceedance.

Movement into the show area

As the aircraft moved into the show area along the pre‑programmed flight paths, the wind speed increases noticeably from 8.3 m/s to 18.5 m/s 40 seconds later. CCTV footage showed multiple aircraft in the upper layers of the show drop into the lower layers and collide with one another. The GCS displayed an increasing number of errors across all 3 categories. Not all errors were shown on the screen simultaneously so it was not possible to determine the exact number of aircraft presenting each error. However, the manufacturer’s analysis showed a maximum of 397 aircraft simultaneously recorded T errors indicating that they were out of position and the GCS recorded at least 11 aircraft presented with F errors indicating that they had breached the geofence. 

The RPIC’s last command to the swarm was to loiter, the manufacturer’s analysis confirmed that this command was received by aircraft in the swarm. The manufacturer’s analysis further identified that, due to the wind conditions the motors were unable to provide the required lift to remain airborne while attempting to maintain their position. The manufacturer reported that they subsequently descended into the water below their location. 

Human Factors

Pilot workload

All tasks require a level of cognitive load to process the information and undertake the activity. Workload is a measure of the amount of mental effort that is needed or expended to process this information. Humans have a limited capacity to process information, where the information processing required is close to, or exceeds, the human capability this is referred to as overload and can have multiple negative effects on performance. These effects can include, task shedding, attentional focusing, reduction in situational awareness, increased fatigue and the increased chance of errors. (United Kingdom Civil Aviation Authority, 2016)

The level of workload that an individual task requires varies depending on a range of factors. These include the difficulty of the task, familiarity and recency with the task, the number of other tasks that are being conducted concurrently and the time available to complete the task. (United Kingdom Civil Aviation Authority, 2016)

The completion of an RPAS light show requires flight crew to be familiar and interact with multiple systems including:

• the aircraft
• the various hardware and software elements of the GCS
• condition monitoring equipment
• operational processes and procedures.

The flight crew also need to interact with and manage support crew and stakeholders. The operator had procedures to mitigate this through the implementation of the multi‑crew operation requiring at least 2 flight crew members for shows of more than 10 aircraft. 

Workload review

A review of the operational environment in the lead‑up to and at the time the show was launched identified 2 factors that increased the RPIC’s workload above the normal level for show operations. These were the

• copilot’s limited experience in show operations
• RPIC’s lack of familiarity with adjusting the show position. 

Copilot experience

For this operation the operator’s chief remote pilot (CRP) was performing the role of copilot. At the time of the show the RPIC had completed almost twice as many shows as the copilot, and the copilot had only conducted a single show in the previous 6 months, which was on the Wednesday night before this show. While not required to be, the copilot was also not approved by CASA to operate in the RPIC role.

At interview both flight crew identified that the copilot had less experience in show operations compared to the RPIC and the copilot themselves identified that, while current, they were ‘rusty’ when it came to show processes and procedures. As a result, some tasks that were normally assigned to the copilot were carried out by the RPIC. The GCS recording captured the RPIC:

• actively managing various stakeholders and the show support crew
• ensuring that the show timings were met
• alerting the copilot of an aircraft fly away.

All these tasks were the responsibility of the copilot in the operator’s procedures. The RPIC reported that if they had been operating with a more current pilot the division of tasks would have been more equal, which would have reduced their mental load. 

The increased tasks that the RPIC carried out meant that they had to move from task to task rapidly, and work on multiple tasks concurrently. Both of which are known to increase workload. (United Kingdom Civil Aviation Authority, 2016)

RPIC lack of familiarity

On the night of the show the presence of the boat mast hazard meant that the RPIC had to reposition the show. Being unfamiliar with the required process, the RPIC elected to consult, by phone, with another pilot who was familiar with the system. 

The conversation between the RPIC and the other pilot had been prearranged for 1800, 30 minutes before the show launch time. However, the other pilot did not call back until 8 minutes later, leaving only 22 minutes before launch to effect the change. 

Subsequently the RPIC was preoccupied with tasks of moving the show for 18 of the 30 minutes leading up to the show. Based on the required actions it was assessed that, for someone familiar with the process and site, the move of the show could have been completed in about 5 minutes.

In summary, the combination of task unfamiliarity, time pressure and extra tasks due to the copilot’s limited show experience significantly increased the RPIC’s workload in the lead‑up to launch. That reduced the effectiveness of the wind speed assessment vital for the safety of the launch decision. 

Operational pressure

Pressure refers to a feeling of internal or external stress, which may not necessarily be based on actual urgency or necessity. This pressure can stem from various sources, such as tight schedules, stakeholder expectations or personal standards of performance. It can lead to rushed decisions, cutting corners or taking of unnecessary risks that can impact the safety of operations. (Ramdeen, 2024)

Multiple ATSB investigations and other publications have discussed the impact that personal, social or organisational pressures (perceived or actual) can have on pilot weather‑related decision‑making. In their safety leaflet about visual flight rules into instrument meteorological conditions (VFR into IMC) occurrences, (UK CAA, 2024) the United Kingdom Civil Aviation Authority (CAA) identified that as a pilot:

‘You may feel pressure to commence or continue a flight due to factors such as time constraints, passenger expectations, disruption to your personal life or the continuation bias of wanting to execute the intended plan. The effect of these pressures is sometimes referred to as ‘get-there-itis’ and can lead to a disregard for weather conditions or an overly optimistic interpretation of the situation, increasing the likelihood of a VFR into IMC scenario’

As a large public event an RPAS light show will likely place a level of pressure on the flight crew, and particularly the RPIC, for the show to go ahead. The operator’s procedures went some way to mitigating this hazard by assigning the copilot the task of stakeholder engagement to isolate the RPIC from the potential pressures. On this occasion however, the RPIC conducted this task. 

Factors known to increase pressure

A review of the operational environment on the night of the show identified a number of the factors that the CAA identified as likely to increase pressure. These, together with 2 other factors, are discussed in the following sections. 

Time constraints

To conduct the show, the harbour needed to be closed to keep vessel traffic out of the exclusion area. To minimise disruption the port authority provided a 15‑minute time window, starting at 1830, for the 10‑minute show. In the days leading up to the show the operator identified that the forecast conditions at the show time were going to be marginal and had requested that the show time be moved later. The operator advised that the port authority would not allow them to move the show later due to the impact on the harbour’s operations. This meant that the RPIC had to launch at 1830, or the show could not go ahead. 

Stakeholder expectation

RPAS light show operations do not involve passengers however there are other stakeholders who will have the same desire for a flight to go ahead and limited understanding of the operational requirements. In this case the client had expended significant capital and expected that the show would proceed. 

The RPIC advised that they had been in contact with the client’s representative on multiple occasions in the lead‑up to the show giving updates on conditions and what that meant for the likelihood of the show going ahead. The RPIC stated that they were aware that the client had other people waiting on the decision as to whether the show would proceed. 

Secondly, the recently appointed CEO and COO had limited experience with the light show operation and had travelled specifically to see this show and observe the operation in person. The RPIC advised that the CEO and COO had spoken with them in the lead‑up to the show and expressed a desire to see the show operate effectively.

Continuation bias

Continuation bias is ‘an unconscious cognitive bias to continue with the original plan in spite of changing conditions.’ (Transportation Safety Board of Canada, 2019) In a crewed operation continuation bias might appear as a pilot departing into questionable conditions on a route they have completed successfully a number of times before. It could also appear as a flight crew conducting multiple attempts to land at the destination airport rather than divert to a location where the conditions are more suitable. (Federal Aviation Administration, 2022)

The RPIC reported that the operator had never had to cancel a show due to wind conditions. Further, the RPIC’s records indicated that they had conducted more than 30 shows without incident. Therefore, continuing with the show launch was a familiar process and based on previous experience a negative outcome from this decision was not expected.

Additional factors 

The light show was being conducted in a populated area, had been advertised by the client and was supporting a national sporting team’s fixture, which was expected to draw a large crowd. The show therefore had a higher than normal profile that provided significant publicity and an opportunity to demonstrate the operator’s capability. 

On the night of the accident the copilot, as the operator’s CRP, held greater organisational authority than the RPIC. Despite the RPIC holding overall responsibility for the safe conduct of the flight, that pairing created a negative cockpit gradient. On multiple occasions during the lead‑up to the launch the copilot stated to the RPIC that they believed that the conditions are suitable for launch. While the RPIC identified that they were the ultimate authority onsite, the statements from the copilot potentially influenced their decision‑making.

Summary

The review of the operational environment identified that the RPIC was likely experiencing time pressure, expectations from the client and senior staff that the show would go ahead, an expectation bias as they had conducted many shows without a similar issue with these aircraft. As identified by the CAA these pressures can lead to a disregard or overly optimistic interpretation of the situation. Further increasing pressure the show had a higher than normal profile and there was a negative cockpit gradient between the RPIC and copilot. 

The operator’s report into the accident identified that the RPIC had been placed under additional pressure by external factors including: 

• the client engagement
• the time pressure from the time window available for the show to be carried out
• confidence in the fleet due to the number of successful shows that had been completed. 

Further, the RPIC identified directly that they had felt that there was pressure to have the show happen and for it to be successful.

Leading up to the show the RPIC had information that the weather conditions on the ground were near, but below, the limit of the aircraft but the conditions within the show area were unknown. An optimistic interpretation of conditions in the show area would be that the conditions were better or at least equivalent to those at ground level. Under this interpretation of the conditions they would have been acceptable for the show to go ahead. 

In crewed operations a poor weather‑related decision can put the aircraft, crew and passengers at risk of a fatal outcome. In uncrewed operations the primary risks relate to financial and reputational damage in the event of an incident or accident. While present, the risk to personal safety of the crew was low, which may have altered the flight crew’s risk perception or tolerance.

Operational requirements

To mitigate against the boat mast obstacle the RPIC elected to lift the entire show by 8 m above the originally planned maximum height of 118 m to a height of 126 m. The operator’s CASA permission required the RPIC to comply with their approved operations manual and subsequently operations library. The operations library stated that shows were not to be conducted at night above 120 m (400 ft) unless a specific approval had been approved by CASA, no such permission had been issued for this operation. 

At the time that they changed the show height the RPIC identified that they were in exceedance of the 400 ft limit. The phone discussion with the other pilot who was assisting in the show move identified that this was a minor breach of the limit, and it was mitigated by the presence of buildings that exceeded the maximum show height.

The CASA permission also required that the operations be conducted within an exclusion zone, which was detailed in the operations library. The role of the exclusion zone was to ensure that in the event of an aircraft loss of control, bystanders were maintained at a safe distance. For a maximum show height of 400 ft a minimum exclusion zone of 70 m was required. The exclusion zone set by the RPIC was not able to be precisely determined but was estimated to be between 47 and 54 m, from a publicly accessible jetty. 

The exclusion zone is calculated based on aircraft height and wind conditions. The RPIC’s decision to lift the show to avoid the boat mast meant that the planned exclusion zone of 70 m was no longer applicable. The zone should have been recalculated based on the new show height. For an 8 m (26 ft) increase in show height the exclusion zone should have been increased by about 4 m. Further, the wind speeds that the aircraft encountered, being more than twice the wind limit, increased the required exclusion zone to more than 100 m.

The available data did not identify the maximum height that aircraft reached or whether any aircraft exceeded the exclusion zone. However, as the flight was automated, if it had continued as planned it would have been in breach of both the maximum height and exclusion zone restrictions approved by the regulator. By not complying with these limitations safety defences built into the documentation and approval process were removed. While this did not contribute to the accident, it increased the risk of an adverse outcome.

Ground control station capability

Version 3 of the Damoda flight control software introduced a wind speed read out, showing wind speed and direction, in the top right corner of the display. Following launch, if the wind speed limit was exceeded, no active alert was shown on the GCS computer display. In its report, the manufacturer expressed a view that the flight crew should be actively monitoring the wind speed readout. 

An alert, visual, audible or tactile, improves the chance that the operator will be made aware of this information, especially when under high workload. In crewed aviation there are multiple alerts that are provided to pilots despite information already being presented independently to them. For example, aircraft are required to have an airspeed indicator but active stall warnings are commonly used.

The software displayed multiple types of alerts, which varied from individual aircraft showing single or multiple errors, through to pop‑up boxes advising that a command had failed to reach one or more aircraft. All were clearly identifiable on the screen and were easily interpreted by someone who was familiar with the system. 

For light show operations wind speed and direction are critical to the safety of flight. The small tolerances between aircraft and their relatively light weight means that changes in wind speed can significantly impact the aircraft position and lead to an increased risk of collisions.  

The implementation of an active alert to the wind speed monitoring function would improve the pilot’s ability to both identify and respond to wind speed exceedances. 

The RPIC stated that they were not aware of the wind speed readout at the time of the occurrence. Therefore, for an alert to have been effective in this instance it would have had to both identify the wind speed readout and the exceedance to the flight crew. As the alerting function did not exist, it was not possible to determine if it could have effectively done both these things. As such, the lack of an alert was not considered contributory to the accident. 

Pilot training

Following the introduction of version 3 of the GCS software, the operator’s pilots undertook familiarisation flights with the new software, and the manufacturer was consulted about issues when they were encountered. However, there was no formalised training, as there had been for an earlier version of the software, and there was no system of assessment in place to ensure that all pilots had an equivalent understanding of the software before they started using it operationally.

The operator had both initial training and proficiency requirements for pilots to ensure that they were competent in the systems that they would be expected to use. The ongoing proficiency checks were only required on the introduction of new aircraft types or annually or biennially, depending on how recently a pilot had completed operational flights. As such, if a pilot had recently been checked and a new software version was then introduced it could be up to 2 years of operational flying before their proficiency on the new software and understanding of all its features would be assessed.

The flight crew for this show were not aware of the wind speed indication function or confident in the process of moving the show. However, at least one other pilot was aware of these systems and how to effectively use them.

Without a timely verification process in place there was no way for the operator to know whether their familiarisation process had been effective and if the pilots understood how to use the relevant features in an operational environment. Had such a system been in place, it is more likely that the flight crew would have identified the wind speed limit exceedance and that moving the show would have been done more efficiently.

Operational document changes

The option of using weather drones to assess airborne conditions was introduced with version 1.1 of the wind management plan, dated 6 June 2023. This represented a significant change in the information gathering process for the wind speed information in the lead‑up to the show. The wind management plan, along with the event risk assessment, the emergency management plan and the maritime safety management plan, were available to the flight crew as attachments to the event operational plan. While the event plan was available, it was not a primary reference during preparations for the show. The show day and pre‑flight checklists were the primary references. 

As neither of these documents contained reference to either the weather drone or the wind management plan, subsequently the flight crew were less likely to use a weather drone to collect relevant information from the show area. That increased the risk of launching into unsafe flight conditions. 

It could not be determined whether inclusion of the information in the operator’s procedures would have altered the outcome of the accident as it was not known how or where this information would have been included in the operational procedures/documents. Additionally, as not all the procedures such as the show day checklist were routinely used, the inclusion of the weather drone option may not have been identified by the members of the flight crew, particularly given the high workload and time‑restricted environment in the lead‑up to show launch. 

Findings

From the evidence available, the following findings are made with respect to control issues and ditching involving RPA swarm of 500 Damoda Newton 2.2 RPA, Victoria Harbour, Docklands, Victoria on 14 July 2023. 

Contributing factors

• The remote pilot in command launched the show with the wind speed close to the limit of the aircraft and aware that conditions in the show area were likely to be worse than those on the ground.
• In the lead‑up to the show, the flight crew did not use a weather drone to conduct a wind check at show altitude as outlined in the operator's wind management plan. As a result, the remote pilot in command did not have accurate information about the conditions within the show area at the time they launched the swarm.
• Shortly after launch, before transitioning to the show area, the swarm encountered wind conditions that exceeded the aircrafts’ operational manoeuvring capability. This resulted in multiple aircraft being out of position and errors presenting on the ground control station computer.
• The flight crew were both unaware that the ground control station had a wind speed monitoring function. The remote pilot in command did not use it to monitor the wind conditions after take-off. As a result, they did not identify that the wind exceeded the aircrafts’ limits and continued with the transition to the show area.
• Shortly after starting the transition into the show area, the swarm encountered wind conditions that were more than double the published capability of the aircraft. This led to multiple aircraft being unable to hold position, with at least 11 aircraft breaching the geofence, multiple aircraft collisions and most aircraft descending into the water.
• The remote pilot in command's workload was significantly increased due to their unfamiliarity with the process to make the necessary show position adjustment and the copilot’s limited knowledge and experience in show operations. This reduced the effectiveness of the wind speed assessment vital for the safety of the launch decision.
• It is likely that the remote pilot in command perceived a higher than normal level of pressure for the show to go ahead. This combined with a higher than normal workload, contributed to their decision to launch the show into unknown wind conditions.

Other factors that increased risk

• The remote pilot in command programmed and launched the show with a maximum height which exceeded the 120 m limit and with an insufficient exclusion zone, both of which were limitations in accordance with the operator's CASA‑issued permission to conduct the shows. This increased the risk of injury to bystanders in the event of an aircraft malfunction.
• Version 3 of the Damoda ground control station software included a wind speed readout, but did not actively alert the pilot if the wind speed limit was exceeded. This increased the risk that a pilot would fail to identify a limit exceedance and continue a show into unsafe conditions. (Safety issue)
• The operator did not provide formal training on version 3 of the ground control station software to its pilots. Instead, relying on familiarisation flights and ad hoc advice from the manufacturer. This increased the risk that show-qualified pilots would fail to identify exceedances in flight critical parameters and experience increased workload. (Safety issue)
• Following the introduction of a weather drone option to the wind management plan in June of 2023, the operator had not updated its operational procedures to include this option. As a result, flight crew were not prompted to use this method for gathering information on wind conditions in the show area prior to launch. (Safety issue)

Safety issues and actions

No trigger in key operational documents to use weather drone

Safety issue number: AO-2023-033-SI-01

Safety issue description: Following the introduction of a weather drone option to the wind management plan in June of 2023, the operator had not updated its operational procedures to include this option. As a result, flight crew were not prompted to use this method for gathering information on wind conditions in the show area prior to launch. 

Ground Control Station pilot assurance

Safety issue number: AO-2023-033-SI-02

Safety issue description: The operator did not provide formal training on version 3 of the ground control station software to its pilots. Instead, relying on familiarisation flights and ad hoc advice from the manufacturer. This increased the risk that show-qualified pilots would fail to identify exceedances in flight critical parameters and experience increased workload. 

Safety recommendation to The Australian Traffic Network Pty Limited

Safety recommendation number: AO-2023-033-SR-02

Safety recommendation description: The Australian Transport Safety Bureau recommends that The Australian Traffic Network Pty Limited develops a process to ensure that future software changes are communicated and understood by all pilots before commencing operations.

Aircraft control software

Safety issue number: AO-2023-033-SI-03

Safety issue description: Version 3 of the Damoda ground control station software included a wind speed readout, but did not actively alert the pilot if the wind speed limit was exceeded. This increased the risk that a pilot would fail to identify a limit exceedance and continue a show into unsafe conditions.

Safety recommendation to Damoda Intelligent Control Technology Co., Ltd

Safety recommendation number: AO-2023-033-SR-01

Safety recommendation description: The Australian Transport Safety Bureau recommends that Damoda Intelligent Control Technology Co., Ltd implements active wind speed exceedance alerting in the ground control station software.

Safety action not associated with an identified safety issue

Additional safety action by The Australian Traffic Network Pty Limited

The Australian Traffic Network Pty Limited advised the ATSB that following this incident it implemented several changes to its show planning and conduct processes. These included:

• changes to the crewing requirements to have 2 CASA-approved pilots operating every show
• establishment of multiple go/no-go points during the launch sequence allowing for more clearly defined stop points
• introduction of sterile cockpit procedures to limit outside interactions with the flight crew in critical phases in the lead‑up to show launch.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the remote pilot in command and copilot
• The Australian Traffic Network Pty Limited
• the aircraft and ground control station software manufacturer
• Civil Aviation Safety Authority
• another Australian operator of the type
• ground control station software screen recording
• Bureau of Meteorology
• video footage of the accident flight and other photographs and videos taken on the day of the accident

References

Federal Aviation Administration. (2022). CFIT and Plan Continuation Bias. Washington DC: United States Department of Transportation.

Ramdeen, A. (2024, 04). Performing Under Percieved Pressure in Aviation Maintenance. Naval Safety Command Aviation Safety Blog.

SKYbrary. (2025, May). Authority Gradients. Retrieved from SKYbrary: https://skybrary.aero/articles/authority-gradients

Transportation Safety Board of Canada. (2019). AIR TRANSPORTATION SAFETY INVESTIGATION REPORT A18P0031 Loss of control and collision with terrain Island Express Air Inc. Beechcraft King Air B100, C-GIAE Abbottsford Airport, British Columbia 23 February 2018. Quebec: Transportation Safety Board of Canada.

UK CAA. (2024). VFR Flight Into IMC - CAP 2562. London: UK CAA.

United Kingdom Civil Aviation Authority. (2016). Flight crew human factors handbook. West Sussex: United Kingdom Civil Aviation Authority.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• remote pilot in command
• Australian Traffic Network Pty Ltd chief remote pilot
• Aircraft and GCS software manufacturer
• Civil Aviation Safety Authority

Submissions were received from:

• remote pilot in command
• Australian Traffic Network Pty Ltd chief remote pilot

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Ground control station recording summary

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On 4 December 2021, the pilot of an Air Tractor AT-400 aircraft, registered VH-ACQ and operated by Aircair Aviation Operations Pty Ltd (Aircair), was conducting aerial spraying operations on a property 75 km west-south-west of Moree, New South Wales.

At 0632 Eastern Daylight-saving Time, the aircraft took off from the property’s airstrip with the first spray load. The pilot then completed 10 spray loads, each time returning to the airstrip where the loader mixed about 1,250 L of chemical into the aircraft’s hopper. During that period, the loader also refuelled the aircraft twice.

Prior to departing with the eleventh load, the loader again refuelled the aircraft to full and mixed chemical into the hopper. The aircraft then returned to the western side of the target block, where the pilot had been spraying in a racetrack pattern on the previous load. After descending to recommence spraying towards the south, the aircraft climbed and turned away to track north and overfly a flood-affected area. The pilot radioed the company operations manager expressing concern about the weather conditions and the potential for chemical to drift onto a neighbouring property. About 5 minutes later, the aircraft returned to the target block, this time on the eastern boundary.  

The pilot then conducted 2 ‘smoker’ runs to assess the drift, followed by 5 back-to-back (parallel) spray runs. At the end of the fifth spray run, the aircraft was observed to climb then enter a right procedure turn. During the turn, the aircraft descended rapidly, collided with terrain, and was subsequently destroyed by fire. The pilot sustained fatal injuries.  

What the ATSB found

The ATSB found that the aircraft was too close to the start of the spray run during the turn, which probably resulted in the pilot tightening the turn. This almost certainly resulted in an aerodynamic stall at a height too low to recover before colliding with the ground.

Mishandling the turn was probably a result of the combined effects of the pilot experiencing high workload and fatigue due to long flight and duty times, inexperience, the complexity of the task and the weather conditions. The combination of these factors would likely have identified an elevated flight risk, had an aerial application-specific flight risk assessment been conducted. However, it was not a requirement to conduct a flight risk assessment or to have a flight risk assessment tool.

The pilot was almost certainly wearing a helmet and 4-point restraint increasing their chances of survival in an accident. However, the aircraft’s fuel tanks ruptured during the accident sequence resulting in a fire and fatal thermal injuries to the pilot.

The aircraft was not fitted with a crash-resistant fuel system, nor was it required to be under the standards in place at the time of manufacture. The current standards also do not require it. The ATSB found that on average, post-impact fire in VH-registered certified aeroplanes results in one fatality every 2 years in Australia. As such, post-impact fire presents a significant risk of fire-related injuries and fatalities to occupants of general aviation aeroplanes.

What has been done as a result

As a result of this accident, Aircair has implemented additional fatigue management measures, which include an assessment of other factors that may contribute to fatigue and flight risk, within the regulatory fatigue requirements.

In August 2022, the operator’s pilot group completed training with an expert instructor in advanced stall and spin prevention, recognition and recovery. The operator is investigating ways to incorporate such training into its pilot induction program.

Safety message

An aerodynamic stall occurs when the aircraft’s wing exceeds the critical angle of attack. The angle of attack of the wing is caused by the angle of deflection of the elevator, independent of the airspeed, pitch attitude, angle of bank, weight and power. Therefore, pilots should remain aware that if they pull the control stick (or column) back too far and deflect the elevator too far, it will increase the angle of attack of the wing beyond the critical angle and stall it. The control stick position at which an aircraft will stall is therefore also independent of airspeed, pitch attitude, angle of bank, weight and power, but specific to the aircraft and may change with flap configuration. To un-stall the wing, the pilot has to move the control stick forward to a position corresponding to an angle of attack below the critical angle of attack.

Aircair pilots who completed the advanced stall/spin training (after the accident), found that discovering the stall stick position and its independence of other factors was very beneficial, particularly because they frequently operated at low level in a loaded aircraft, often towards the margins of the aircraft’s flight envelope. They also identified that the stall stick position in Air Tractor aircraft was forward of other aircraft types they had flown.

The US Federal Aviation Administration’s Airplane Flying Handbook (2021) stated that reducing the angle of attack is crucial for all stall recoveries. As aerial application pilots are usually operating at a height too low to recover from a stall, stall prevention by maintaining an awareness of elevator control input is key to preventing similar accidents.

The 2014 US National Transportation Safety Board Special investigation report on the safety of agricultural aircraft operations identified that risk management guidelines and best practices specific to aerial application operations were necessary to help operators and pilots mitigate their unique risks. These practices should include checklists for performing flight risk assessments to identify hazards specific to the task. Mitigation strategies should then be implemented to support pilot decision-making, particularly during high-risk activities.

Post-impact fire has been found to present a significant risk to aircraft occupants, including those conducting aerial application operations. Crash-resistant fuel systems have been proven effective in helicopters and in automotive applications. Implementing requirements for similar engineering countermeasures in existing, newly manufactured and newly certified FAR 23 aeroplanes, would reduce the incidence of fire-related serious injuries and fatalities in otherwise survivable accidents (TSB, 2006).

The occurrence

On 4 December 2021, the pilot of an Air Tractor AT-400 aircraft, registered VH-ACQ and operated by Aircair Aviation Operations (Aircair), was conducting aerial application (spraying) operations on a property 75 km west-south-west of Moree, New South Wales.

At 0604 Eastern Daylight-saving Time,[1] the aircraft departed Moree Airport and tracked to the property’s airstrip, 43 km south-west of Moree Airport. A loader was stationed at the property’s airstrip, whose role was to mix and load chemical into the aircraft’s hopper, and to refuel the aircraft.

A GPS tracker onboard the aircraft recorded data at 15-second intervals. The data showed that commencing at 0632, the aircraft took off from the property airstrip and sprayed 11 loads over the course of the morning.

For the first 8 loads, the aircraft remained within sight of the loader. Those loads were sprayed using a racetrack pattern (Figure 1). Each of the 8 loads took about 20 minutes, except the third load, which took 32 minutes as it included clean-up spray runs (across the direction of the pattern) and tracking to the next target area. Each time the aircraft landed at the airstrip, the loader mixed chemical and water totalling 1,250 L into the hopper. On 2 of those occasions, the loader refilled the aircraft fuel tanks.

Figure 1: Racetrack spray pattern

Source: ATSB

At 0914, while the pilot conducted the seventh load, the operations manager sent the pilot a text message advising that 4 of the target fields marked on the map were no longer to be sprayed (marked in orange in Figure 2). On the next (eighth) load, the pilot overflew an area marked on their map to be sprayed that day, which was adjacent to a river and under water due to flooding. As a result, the pilot radioed the operations manager to ask whether to spray the flood-affected area. The operations manager reported that they contacted the property owner but were subsequently unable to communicate with the pilot via radio to provide a response. 

Figure 2: Operating area including target spray blocks, location of airstrip, property boundary and neighbouring house 

Source: Aircraft operator information overlaid on Google Earth, annotated by the ATSB

At 1053, the aircraft took off with the tenth load and continued to fly north-south racetrack patterns from the western side of blocks 127 and 128, followed by an inspection of the northern end of the target area, before returning to land at the airstrip again at 1120. The loader then filled the aircraft with fuel and loaded 1,250 L of chemical into the hopper. While the loader did those tasks, the pilot had a snack and a drink, and conducted a walk-around of the aircraft, which they had done consistently during refuelling breaks throughout the day.

At 1126:15, the aircraft departed on the eleventh load and tracked again towards blocks 127 and 128 to recommence spraying the next run from where they had left off (as can be seen in Figure 3), in the racetrack pattern. The pilot commenced a run to the south, but before reaching the target crop, the aircraft climbed and turned left. The aircraft then overflew the northern boundary of block 127, which was also the property boundary. The operations manager heard the pilot on the radio expressing concern about the potential for chemical spray to drift towards a house on the neighbouring property due to the wind. The aircraft then tracked north and again overflew the flood-affected area (top of Figure 2 and Figure 3), before returning to the north‑eastern end of block 127 (Figure 3).

Figure 3: GPS data showing the aircraft’s track on the accident load

Source: Aircraft operator TracPlus data overlaid on Google Earth, annotated by the ATSB

A witness reported that on the first and second runs along the eastern boundary, which were towards the south and north respectively, the pilot used smoke to assess the drift from the wind, before commencing spraying on the next (third) run. Instead of a racetrack pattern, the pilot conducted back-to-back spray runs with a procedure turn at each end. In a procedure turn, the aircraft is initially turned away from the direction of the turn, usually about 45°, before reversing the direction and completing the turn to position the aircraft on the reciprocal heading for the next spray run (Figure 4).

Figure 4: Back-to-back patterns with procedure turns

Source: Aerial Application Pilots Manual (Aerial Application Association of Australia, 2011), annotated by the ATSB

After the two ‘smoker’ runs, the aircraft sprayed 4 runs. At 1145, the aircraft commenced a spray run towards the south, at the end of which the aircraft climbed. The aircraft’s last recorded position was at 1145:30 about 170 m beyond the southern end of the field and 180 ft above the ground.

A witness (‘Witness 1’, Figure 5) located in the neighbouring paddock to the east, observed the aircraft turn slightly left then enter a right turn, consistent with a procedure turn. During the turn, the witness observed the aircraft’s nose pitch down and it descended rapidly, right‑wing low, then disappeared behind trees. The witness reported seeing a black plume of smoke rise almost immediately afterwards.

Figure 5: Aerial photo of target spray area taken 10 December 2021, showing accident site and witness location  

Note: The yellow lines represent the block boundaries.

Source: Aircraft operator, annotated by the ATSB

Another witness positioned about 1 km south of the accident site, observed the aircraft’s distinct yellow colouring as it descended among trees and impacted the ground. The witness estimated this was followed within about 2 seconds by flames and smoke. The pilot was fatally injured, and the aircraft was destroyed.

Context

Pilot information

Medical, licence and qualifications

The pilot held a valid Class 1 Aviation Medical Certificate issued on 15 October 2021 with no recorded medical issues and was reported to have been fit and healthy. The pilot’s Commercial Pilot Licence (Aeroplane) was issued on 30 March 2021.

The pilot also held ratings for:

• single-engine aeroplane
• low-level
• aerial application[2]

and endorsements for:

• tailwheel
• manual propeller pitch control
• gas turbine engine.

The pilot attained Spraysafe accreditation[3] through the Aerial Application Association of Australia (AAAA) on 2 July 2021 and had been issued a Pesticide Licence by the New South Wales Environment Protection Authority on 24 August 2021.

At the start of the accident day, the pilot had accumulated 372.5 flying hours, 203.3 of which were conducting aerial application operations (including training), 31.7 of which were in VH-ACQ. 

Recent history

The pilot’s recent sleep-wake and work history was determined from a combination of interviews, text messages, logged flight times and recorded flight data.

The pilot lived about 30 km from their assigned base and about 70 km from the operator’s Moree base. In late November, the pilot’s commute was increased by about 1 hour as a road was inaccessible due to flooding.

On 2 December 2021 (2 days prior to the accident), the pilot left home at about 0600, returned at 2000 for dinner and was in bed by 2100. That day, the pilot recorded 13 hours of duty time and 8 hours of flight time. The pilot had described this as a huge day – the most spraying so far in one day – and was very tired at the end of the day.

The day prior to the accident, the pilot was awake by 0412 and left for work at 0530. That day, the pilot recorded 13 hours of duty time and 7.9 hours of flight time. At 1816, the pilot sent a text message to a friend stating that they were about to fall asleep in the aeroplane (but did not advise the operator), before ferrying the aircraft to Moree Airport for maintenance, arriving at about 1900. Rather than drive home, the night before the accident, the pilot stayed with another company pilot in Moree. The company pilot reported that the accident pilot was happy and was proud of having sprayed 1,100 hectares that day and 1,000 hectares the previous day. They went out for dinner at about 2100 and went to bed between 2200 and 2215. Others described the pilot that evening as a bit tired but nothing out of the ordinary.

The accident day was the pilot’s ninth consecutive day of duty. That morning, the pilot was awake by 0510 and picked up another company pilot at 0530. They purchased breakfast, snacks and lunch from a petrol station before heading to Moree Airport. The company pilot recalled that the pilot reported having had a good sleep, appeared fresh and not tired, and was very happy that morning. Other company pilots who had seen the pilot in the 24 hours prior to the accident reported that the pilot did not seem overwhelmed or stressed.

For the 3 days prior to the accident, the recorded flight times were the longest consecutive logged by the pilot (7.7, 8.0 and 7.9 hours) and the longest duty times (12, 13 and 13 hours).

Flight training

The pilot completed their commercial pilot licence flight test on 24 March 2021 with 166 hours total flying time. The pilot had completed an integrated training course, combining ground theory training with practical flight training for their private and commercial pilot licences. During this training, the pilot was described as a good student who was well-prepared, focused and dedicated. The pilot’s non-technical skills were assessed as being very good, and their aircraft handling skills were described as exceptional – including maintaining the aircraft well within the required tolerances in steep turns, practice forced landings and circuits. 

Aerial application training

The pilot commenced training for aerial application and low-level ratings on 15 June 2021, and achieved those, along with a tailwheel endorsement, on 30 June 2021. At that time, the pilot had accrued 204.3 hours total flying time. This included the aerial application rating training, which consisted of 31.1 hours dual (including test) and 5.5 hours solo aerial application flight time, conducted in a Piper PA-25 two-seat dual-control aircraft.

The instructor who conducted the pilot’s aerial application rating and endorsement, noted in the second lesson (16 June) that the pilot had carried out stalls in all configurations at 1,000 ft above ground level. The pilot was reported to have handled these well for their total flying experience and achieved a good standard in recovery from stalls during climbing turns with left- and right-wing drops.

The lesson conducted on 20 June was conducted on a field similar to the accident field – with a diagonal boundary and trees – and included conducting back-to-back runs with procedure turns (Figure 6). On the training day, the wind was about 5 kt in the downwind direction at the diagonal boundary. The lesson notes indicated the pilot initially had difficulty lining the aircraft up on the spray run after the turn. The notes from the following day’s lesson (21 June) included ‘needs to back off on turns, pulling too tight…at times near stall’. A similar comment was made on 28 June. The instructor reported providing feedback to the operator of VH-ACQ (Aircair), to keep an eye on this aspect, but overall assessed that the pilot flew very well when taking into account the limited hours of experience at that time. 

Figure 6: Diagonal boundary paddock example  

Source: ATSB

Employment at Aircair

The pilot was inducted into Aircair Aviation Operations (Aircair) in July 2021, and initially commenced working as ground crew – mixing and loading chemical. On 9 September, the pilot satisfactorily conducted an operational proficiency check flight with the chief pilot in a Cessna 185 aircraft. The pilot’s first aerial application job at Aircair was on 15 September 2021 in a Cessna 188B (C188B) aircraft – a conventional single-seat, piston-engine, strut-braced low-wing agricultural aircraft – having completed 2.4 hours of familiarisation in the aircraft in the previous 2 days. The pilot’s emergency dump training[4] in the C188B aircraft was assessed satisfactory on 21 October 2021, although recorded in the pilot’s logbook as 13 October.

The pilot then conducted aerial application in the C188B aircraft and on 22 November 2021, the chief pilot signed off that the pilot had completed the required 110 hours of aerial application under supervision. At that time, the pilot had accrued 321 hours of flying time.

The pilot was described as having a natural ability to pick things up quickly, flew very nicely and did everything they were asked to. The chief pilot and general manager of Aircair assessed that the pilot was then ready to progress to turbine-engine aircraft.

Gas turbine design feature endorsement

On 26 November 2021, the pilot commenced gas turbine engine endorsement training. The Civil Aviation Safety Regulations Part 61 Manual of Standards Schedule 2 detailed the skills and knowledge required to operate a gas turbine powered aircraft on the ground and in the air during normal and abnormal operations. The elements specified in the Schedule were starting, stopping and managing a gas turbine engine, and managing abnormal and emergency actions applicable to a gas turbine engine.

The endorsement required the pilot to complete ground (theory) components including studying the applicable flight manual, and then submit a written exam on the engine and aircraft to the examiner, which the pilot completed on 26 November 2021.

The pilot also received ground familiarisation of the engine and aircraft, followed by 7.5 hours of flight time in a two-seat dual-control turbine Air Tractor AT-504 aircraft. This included normal and abnormal situations, stalls and steep turns, and aerial application operations. The pilot’s stall training in the AT-504 aircraft consisted of climbing to a safe height, at which the supervising pilot demonstrated a straight and level stall, with the accident pilot following on the controls. The supervising pilot pointed out the stall buffet and the stall stick position, then demonstrated recovery from the impending stall, by reducing back pressure on the control stick. The supervising pilot commented that the AT-504 always tended to drop the right wing about 5° in the stall. The accident pilot then conducted two stalls. On the second of those, during the recovery, the aircraft nose lowered, and, assuming the aircraft had recovered from the stall, the pilot reapplied back pressure. However, as the wing was still stalled at the time, this action resulted in a secondary stall, from which the pilot performed a successful recovery.

Having demonstrated the ability to identify and recover from stalls, the pilot then conducted their first aerial spraying activity under supervision in the AT-504. The supervising pilot reported that the pilot had initially applied too much back pressure on the control stick (‘pulled too hard’) during the turn. This was due to trying to keep the aircraft too close to the paddock and led to a stall buffet during the turn. The supervising pilot reported that they reiterated the importance of the stall stick position, and the need to reduce back pressure on the control stick. The amount of force required on the control stick depended on the trim setting. If the aircraft was trimmed such that forward pressure was required during a spray run, the back pressure required to stall the aircraft was small.

The supervising pilot also reported advising the pilot to increase the amount of initial turn (‘fade’) away from the direction of the turn in the procedure turn, so the resulting turn was not as tight. They commented that the pilot subsequently flew the spray pattern ‘beautifully’.

The pilot received their gas turbine endorsement on 27 November 2021. The pilot had completed the requirements of the endorsement; however, it was noted that the theory examiner had signed off the endorsement although the flying component was conducted by a different pilot. At the time the theory component was conducted, a dual-seat aircraft was not available to conduct the in-flight competencies, and as a result, the examiner would have had to observe the pilot solo in a single seat aircraft from the ground. The operator assessed it would be more effective and safer to wait until the dual-seat aircraft was available. The theory examiner was not available when the dual-seat aircraft became available and the flying component was supervised by a pilot whose instructor rating was not current as it had not been renewed, primarily due to COVID restraints. They had however, previously conducted 5 gas turbine endorsements before their rating lapsed, and subsequently renewed their instructor rating in 2022.

Transition to the AT-400

On the morning of 28 November, the pilot conducted circuits in the AT-504 in preparation for transitioning to the single-seat AT-400 aircraft.

The operator reported that they had put many less-experienced pilots in VH‑ACQ over the last 40 years, primarily because it never lacked take-off performance, even when fully loaded. They assessed that the biggest differences the pilot would have found in transitioning from the C188B to the AT-400, were that the operating speed of VH-ACQ was about 20 kt faster, it was heavier and had more inertia. Due to its inertia, it would take longer to recover from an impending stall than the C188B. The operator noted that the cockpit layout of VH-ACQ was very similar to the C188B but more ergonomic. The main difference was the Satloc GPS display, which had a touchscreen in the C188B, but a keypad in the AT-400. The pilot had reportedly noted during their endorsement that this was something they would have to get used to.

Before the accident pilot’s first flight in the AT-400 (VH-ACQ), the Aircair general manager reported briefing the pilot about the aircraft. This included cautioning the pilot to keep the airspeed up in the turns because of the shorter wings, without Hoerner wing tips (Appendix A – Hoerner wingtips), and higher wing loading[5] than the AT-504. As a result, VH-ACQ tended to give less pre-stall buffet indication before stalling. However, the general manager advised the pilot that the stall characteristics were similar to the AT-504, in that the AT‑400 would likely drop a wing in a stall and stall recovery required the pilot to reduce back pressure on the control stick. This was consistent with descriptions by other pilots who had flown VH-ACQ. They described it as providing a stall buffet later in an impending stall than an AT-502. Additionally, that it tended to drop a wing when close to the stall, and that all Air Tractors can produce a significant wing drop when close to the stall in an unbalanced turn.

On 29 November, the pilot conducted familiarisation and circuits in VH-ACQ, before commencing revenue operations with a reduced hopper load (1,000 L), mentored from the ground by the chief pilot. The next day, the chief pilot approved an increase to 1,200 L hopper loads for 3 days, before assigning a maximum hopper load of 1,300 L on 3 December. That was still the pilot’s assigned limit on 4 December.  

The chief pilot reported that the pilot appeared to be coping well with the transition to VH-ACQ. The pilot had described the transition to the AT-400 as ‘like learning to fly again’ and had remarked that they loved flying VH-ACQ. The pilot had reportedly commented that because of the air conditioner in VH-ACQ, they did not get as tired as when flying the C188B. The pilot and chief pilot had spoken each day that the pilot flew VH-ACQ, up to the accident day. The chief pilot reported that this included discussion of general management of the turbine engine, and that the pilot had not indicated any deficiency in operating the aircraft.

Ongoing supervision and mentoring

During the pilot's flights at Aircair, they were typically supervised either by the chief pilot or the general manager flying in the same area or observing from the ground. Regardless of having completed the mandatory supervised hours, the chief pilot advised that inexperienced pilots were typically ‘spoon fed’ up until 800–900 hours of agricultural flying.

The pilot had been conducting aerial spraying on the same property on the 2 days before the accident. The chief pilot had briefed the pilot at the end of the day prior to the accident, and discussed what blocks had been done, which to do next and the expected weather noting the wind direction and forecast high temperature. The chief pilot was absent on the accident morning and did not speak to the pilot.

The chief pilot reported that they would have been on the radio with the pilot if they had not been called away on leave that day. As a result of that leave, on the day of the accident, the pilot was unsupervised for the first time. However, the Aircair general manager radioed the pilot at 0645 to check how they were going, and the pilot responded that they were good and had a plan for the day’s operation.

Aircraft information

VH-ACQ

VH-ACQ was an Air Tractor Incorporated AT-400 single-seat low-wing tailwheel agricultural aircraft manufactured in the United States (US) in 1980. It was first registered in Australia – to Aircair – in November 1980 to operate in the Agricultural category, and was later operated in the Restricted category.[6] The Certification basis was US Federal Aviation Regulation (FAR) 21.25(a)(1) and the aircraft met the structural requirements of FAR 23, basis February 1, 1965, through Amendment 23-9. The flight criteria, propulsion, system and equipment items met the requirements of Appendix B, Civil Aeronautics Manual (CAM) 8, November 15, 1951, as amended through January 10, 1956.

The aircraft was powered by a Pratt & Whitney PT6A-15AG turboprop engine, which drove a Hartzell HC-B3TN-3D three-blade constant speed reversible pitch propeller.

The aircraft was fitted with two fuel tanks, located in the inboard section of each wing and an integral part of the wing structure. Both tanks gravity fed into a small header tank, located behind the hopper. Their combined total fuel capacity was 476 L, of which 454 L was usable. This equated to a maximum usable fuel weight of 363 kg (using a specific gravity of 0.8 for Jet A1 fuel). The aircraft was also fitted with dispersal equipment for spraying and spreading, and a system that allowed the hopper contents to be dumped if required. The hopper had a capacity of 1,514 L.

Maintenance history

The aircraft was maintained by a Civil Aviation Safety Authority (CASA)-authorised maintenance organisation in accordance with a CASA-authorised system-of-maintenance. A periodic inspection, including annual, 150 and 300-hourly, was completed on 28 September 2021, with the current maintenance release issued at that time. Scheduled and preventative maintenance conducted during this time included:

•  engine overhaul and fitment of an overhauled propeller assembly
•  replacement of lower spar caps (due life limit), with wing disassembly allowing for wing repairs and hopper refurbishment
•  testing of the airspeed indicator, altimeter, compass and pitot/static system
•  corrosion treatment and repainting.

At the time of the accident, the aircraft had accrued 18,869.2 hours total time in service. The aircraft had flown 4 hours 42 minutes since maintenance, having undergone a scheduled 75-hour inspection the evening prior, which included checking air and fuel filters, tyres, brakes and governor. The maintenance release had likely been destroyed in the post-impact fire and was not recovered from the accident site. However, there was no report of any aircraft defects prior to the accident. Furthermore, a general review of the maintenance records did not identify any anomalies.

Aircraft operating weight

The AT-400 type certificate data sheet[7] specified a maximum weight of 2,722 kg (6,000 lb). For VH-ACQ to operate above that weight, Air Tractor Service Letter 304 – Establishing and operating with a special purpose operating weight for Air Tractor aircraft, applied. The Service Letter referenced methods described in CAM 8 to enable operations up to a maximum recommended weight of 3,565 kg (31% overload). A placard affixed to the aircraft stated the maximum take-off weight as 3,565 kg. The Service Letter stated:

When operating at weights above the certificated maximum weight, please note that the stall speeds will increase from the published stall speed numbers in the Airplane Flight Manual. For example, when operating at a 31% overload weight, the stall speed will be approximately 15% higher than at the certificated maximum weight. During the required flight check, the new stall speeds should be determined.

On 23 October 2018 at 18,098.2 hours total time in service, the airframe logbook included an entry stating that the aircraft was flight checked on that day in accordance with CAM 8.10-3(e). It was found to be safely controllable and to operate satisfactorily with the hopper load of 1,356 kg and aircraft total weight of 3,565 kg.

Accident load weight and balance

The Airplane Flight Manual (AFM)[8] for VH-ACQ included a load data sheet to calculate the aircraft’s weight and balance. The sheet contained a table with entries for the weight, arm and moment of the aircraft with sprayer and spreader configurations, pilot, baggage, hopper and fuel. The table also provided forward and aft centre of gravity (CG) limits for weights up to 2,269 kg and for 2,722 kg, with a straight-line variation between those points.

For the accident load, VH-ACQ had been refuelled to full and the hopper loaded to about 1,250 L. Using a fuel consumption rate of 225 L/hr for spraying based on the company’s operations manual, the probable fuel remaining was approximately 387 L (310 kg). The pilot had completed 4 spray runs about 1,700 m long at an 18 m wide swath, using a chemical application rate of 18 L/ha, which left about 1,030 L in the hopper. The accident weight was therefore approximately 3,066 kg, below the demonstrated maximum gross weight of 3,565 kg, and the CG was about 534 mm aft of the datum. This was within extrapolated CG limits.

The hopper load calculation table for VH-ACQ stated that with full fuel, the maximum permissible hopper load was 1,348 kg.

Fuel tank certification and testing

For the aircraft’s certification, CAM 8.3052 Tank Tests required that all fuel tanks should be pressured tested to 3.5 PSI to provide an indication of the ability of the tank to resist distortion and leakage under vibratory, accelerating, and surging loads, which may be encountered in flight and landing conditions.

FAR 23.967 (e)(1) stated that the fuel tank must withstand 9 G ultimate fore and aft load from emergency landing conditions. Air Tractor simulated this in testing by converting the acceleration to an internal pressure. Air Tractor provided an extract of the engineering report covering the fuel tank testing. Their testing found that using 20 PSI, the fuel tanks were capable of withstanding 27 G before leaking.

These two requirements were for flight, landing and emergency landing conditions, but did not assess the tank for tolerance to direct impingement. There was no requirement in the design standards for normal category aeroplanes to be tested for fuel tank crashworthiness.

Installed GPS systems

Systems

The aircraft was fitted with a TracPlus surveillance system, which provided real-time tracking through a satellite or mobile phone network. It reported position, altitude, and speed at set time periods, in this case every 15 seconds. The ATSB obtained TracPlus data for the accident day and several previous flights.

A Satloc aerial guidance system provided the pilot with guidance commands to fly accurate spray patterns. It was set to record at 2-second intervals. The Satloc data from the accident flight was unrecoverable due to extensive fire damage to the Satloc unit. However, the ATSB obtained Satloc data for several of the pilot’s previous flights. 

Satloc increase/decrease

The Aircair Air Tractor fleet all had the same control stick switch configuration. The Satloc stick switch (button) provided a ‘remote’ function to increase or decrease the run number, which could also be done on the Satloc keypad (Figure 7).

Figure 7: Satloc stick switch and keypad

 

Source: ATSB

The Satloc keypad could be set to either increase or decrease the run numbers. When set to increase, pressing the stick switch (button) once, increased the run number by one, and when set to decrease, pressing the stick switch once decreased the run number by one. When a pilot had set up the Satloc GPS to spray a racetrack pattern, then changed to fly a back-to-back pattern, they would then be spraying every second run number (with the alternate numbers on the other side of the programmed racetrack pattern). Therefore, the next parallel spray run required the switch to be double-clicked at the end of each run to spray the adjacent, parallel run.

The stick switch could only make the run numbers go one way: up if increase was set or down if decrease was set. Therefore, if a pilot inadvertently clicked the button too many times and needed to go back, that would have to be done using the keypad.

When the Satloc was set to decrease, this swapped the direction function of the keypad buttons: the up arrow on the keypad (labelled ABC) would then decrease the run number and the down arrow on the keypad (labelled DECR) would increase the run number. Reportedly, this frequently resulted in pilots pressing the incorrect (for example, up arrow) button first, then having to press the correct one (for example, down arrow) multiple times. This would require ‘head in cockpit’ time and the potential for distraction from controlling the aircraft. The US Federal Aviation Administration (FAA) Advisory Circular 137-1A stated that pilots should ‘use extreme caution when using GPS swath-marking equipment to prevent diverting attention away from the task of flying the aircraft safely’. 

Meteorological information

Bureau of Meteorology

Between 0600 and 1145 on the accident day, the pilot was operating within the NSW - West subdivision of the Bureau of Meteorology Graphical Area Forecast.[9]. The forecast for NSW - West issued at 0323 on 4 December and valid 0400–1000 was for visibility greater than 10 km and no cloud. The graphical area forecast issued at 0325 and valid 1000–1600 included scattered high cloud above 10,000 ft and, from 1100, isolated cumulonimbus clouds with visibility reducing to 2,000 m in isolated thunderstorms and rain. Moderate turbulence below 10,000 ft was forecast in thermals and dust devils[10] from 1200.

The nearest Bureau of Meteorology weather station was at Moree Airport, 80 km east-north-east of the property airstrip. The aerodrome forecast[11] for Moree Airport issued at 0424 and valid from 0600–1900 included wind from 360° at 8 kt, changing from 1100 to 240° at 14 kt and CAVOK.[12] Between 1100 and 1500, there was a 30% probability of variable winds at 20 kt gusting to 40 kt with visibility reducing to 2,000 m in thunderstorms with rain and associated scattered cloud at 800 ft above aerodrome elevation. The maximum temperature was forecast to reach 34 °C.

Oz Forecast

For more accurate local weather information (temperature and wind speed/direction), company pilots usually referenced the closest Oz Forecast weather station. The wind was measured 2 m above ground level and recorded in km/h and degrees true (°T). The nearest Oz Forecast weather station was located 11 km west of the property airstrip. Data from that weather station recorded at 15-minute intervals and converted to kt, is shown in Table 1.

Table 1: Weather recorded at 15-minute intervals from 0600–1200 EDT

Time	Temperature	Wind direction (°T)	Wind speed (kt)	Wind gust (kt)
0600	21.6	250	0.5	1.6
0615	21.5	227	2.4	5.4
0630	22	230	4.0	5.9
0645	22.8	227	4.1	5.9
0700	23.9	225	4.2	5.9
0715	24.8	219	4.6	7.0
0730	25.6	217	4.3	7.0
0745	26.3	196	4.5	5.9
0800	27.1	194	4.4	7.0
0815	27.5	195	5.1	7.6
0830	28.1	191	5.8	10.3
0845	28.4	192	6.6	11.3
0900	29.2	198	7.1	12.4
0915	29.6	190	7.6	11.3
0930	30	209	6.0	10.3
0945	30.3	192	5.3	9.7
1000	30.9	221	5.4	11.3
1015	31.3	221	5.4	10.3
1030	31.8	220	5.7	11.3
1045	32.2	228	8.2	14.0
1100	32.5	215	9.6	17.3
1115	32.3	230	10.6	17.3
1130	32.5	213	9.4	16.7
1145	32.6	225	10.2	18.4
1200	32.5	221	10.3	18.9

Source: Oz Forecast

At the time of the accident (1145), the wind was from the south-west at 10 kt gusting to 18 kt and the temperature was 32.6 °C. On the last spray run, as the aircraft had been tracking south, the wind was primarily a headwind. As the aircraft started to turn, it initially encountered more of a crosswind. The accident occurred as the wind became a quartering tailwind, but before completion of the turn to the north.

Other observations

A witness described the wind at about the time of the accident as ‘chopping and changing directions, was more stop and start again…gusts on and off’. The loader also described the weather as ‘windy’ and reported that the wind had become stronger throughout the morning.

At the time of the accident, the Aircair general manager was flying near Moree Airport, where the temperature was about 32 °C. They described the flying conditions as starting to get ‘bumpy and uncomfortable’ and about 30 minutes after the accident, as ‘quite windy and rough’. They reported that on the accident day, the wind had started from the north-east and went around to the north-west during the morning, in the usual summer pattern, but that it was stronger than normal, and increased around the time of the accident.

Another company pilot operating in the area that day recalled that it was the first hot, rough day of the season.

The chief pilot reported that on the evening before the accident flight, during their briefing with the pilot, they discussed the forecast 35 °C temperature. This included discussion of the associated increased thermal activity, which may lead the pilots to cease spraying operations.

At the time of the accident, the sun was not in a position to affect the pilot’s visibility.

Operational information

Work orders

The pilot had operated at the same property on 2–4 December. The blocks allocated to the pilot to be sprayed were depicted on multiple work orders for the property, one of which is depicted in Figure 8. Of the blocks depicted in Figure 8, on 4 December the pilot sprayed blocks M10, M11, M24, M25, M118, before commencing blocks 127 and 128. Block 117 was the wet area along the river and 123, 124 and 125 were not to be sprayed (although as they had powerlines in them, the pilot had been told not to spray them anyway).

Figure 8: Work order map depicting areas to be sprayed and location of the accident site

Source: Aircraft operator, annotated by the ATSB

Field selection

The operator reported that they selected blocks for spraying appropriate to a pilot’s experience and ability – including the block shape and whether there were powerlines in or near the target area. The accident pilot had not yet sprayed a block with a powerline in it, but had sprayed blocks with a powerline along one edge in the previous two weeks. Although not documented, it was reported that when any new aspects of the spraying task were introduced, the chief pilot or general manager would be there to mentor the pilots – either on the ground or flying next to them. The gradual progression to more complex blocks continued with the pilot’s transition to a more powerful, faster, heavier aircraft.

The field the pilot was spraying at the time of the accident (127 and 128 – Figure 8) was selected by the chief pilot because it was considered suitable for the pilot’s level of experience, with no powerlines or difficult obstacles. The blocks sprayed by the pilot the previous day were irrigated blocks – squarer and more defined. The accident field was a dry-land block with a few small trees. The field was near rectangular, but it had a diagonal border at the southern end, and the eastern and western fence lines were not quite parallel. The diagonal border angled down toward the western side, which would have made the back-to-back spray runs with a procedure turn at each end slightly more difficult for the pilot when incrementing runs from east to west. This is because with a diagonal end, each subsequent time the pilot pulled the aircraft up to make the procedure turn, the aircraft had to be further beyond the boundary to allow enough distance to line up for the next run (Figure 6).

Back-to-back pattern

According to the AAAA Aerial Application Pilot’s Manual (2011), the back-to-back pattern was the most common pattern flown prior to the availability of on-board GPS systems. It was usually the first pattern pilots learnt in their initial aerial application rating training. Flying back-to-back patterns was the preferred pattern when working around a hazard, such as a powerline, tree, susceptible crop, or house. This was because in a back-to-back pattern, the aircraft would be gradually moving towards a hazard. In contrast, when flying a racetrack pattern, the aircraft moves away from the hazard, which could be more easily forgotten on the next run. In a back-to-back pattern, during the procedure turn at the end of each run, the aircraft is turned through 180°. During the turn, ‘most of the speed is squandered and you arrive back on the same [reverse] heading at which you started the turn, with time and speed both going in the wrong direction’ (AAAA, 2011).

The operator reported that during a procedure turn, pilots judge how far to turn away (fade) by using the GPS light bar for guidance, counting (for example, for 3 seconds) in their head, or by feel, before banking the opposite way around the turn. If they do not get it right, it can be difficult to line up on the next run. In that case a pilot would normally skip that run and write the missed run number on their hand. They would then either return to spray it later or leave it and advise the operations manager at the end of the day, so that it would get done another day. The chief pilot reported having previously seen the pilot with missed run numbers written on their hand.

In a procedure turn, after the fade, as a pilot banked to turn the aircraft in the opposite direction, they would extend some flap during the turn, usually up to about 15° in the Air Tractor aircraft. They would then retract the flap as the aircraft lined up for the next spray run. The chief pilot reported that the key instrument referenced by a pilot during the turn was the airspeed indicator, while also cross-referencing the GPS light bar, and using the turn and balance indicator (ball) to ensure a balanced turn. The target airspeed they were referencing on the airspeed indicator depended on the aircraft weight.

Flight and duty review

Aircair flight and duty time limitations were in accordance with Civil Aviation Safety Regulations Part 137.Q. The key limitations were:

• maximum flight time of 170 hours in 28 days and 1,200 hours in 365 days
• daily tour of duty limit of 14 hours including a rest period of at least 8 hours after a duty of 10 hours or less, or 10 hours after a duty of more than 10 hours
• following a tour of duty of more than 10 hours, a pilot was permitted to recommence after 9 hours off duty, if they believed they were mentally and physically fit to do so and would not breach any other regulation in the subpart
• at least 36 hours continuous off duty in any 14 days
• 44 hours cumulative duty time limit in 3 days (72 hours) and 98 hours in 7 days (168 hours). 

The Aircair Administration and Policy Manual stated that for aerial application operations, duty time was calculated from 30 minutes prior to the flight to 15 minutes after the flight. The regulations defined flight time as commencing when ‘the aircraft first moves under its own power for the purpose of taking off’.

On the accident morning, the aircraft engine started at 0553, take-off roll commenced at 0559 and it took off at 0600. According to Aircair’s procedures, recorded duty time would commence no later than 0529, although the pilot arrived at the airport at about 0550. According to the operator’s flight and duty records, the pilot had been on duty for 13 hours the previous day, having commenced duty at 0700 and ended at 2000. Recorded data showed the aircraft was shut down at 1919 that evening and duty time should therefore finish no earlier than 1934.

As the previous day’s duty time exceeded 10 hours, the pilot was required to have a rest period of 10 hours, but could recommence duty after 9 provided the pilot assessed themselves ‘mentally and physically fit to do so’. The pilot’s start time was close to the 10-hour rest period, accounting for imprecision of the recorded duty times. It could not be determined whether the pilot made this assessment, however, regulations required pilots to ensure they were fit for duty prior every flight. Civil Aviation Safety Regulation 137.300 described that a pilot was not fit for duty if they had not had adequate rest, food or drink; or was adversely affected by a medical condition or a psychoactive substance.

The pilot commenced flying for Aircair on 9 September 2021 and flew 15.5 hours total for the month. In October, the pilot flew 54.8 hours in the C188B aircraft, over 18 days, with the longest flight time 7.3 hours on 6 October followed by 6.3 hours on 7 October. From 1 to 24 November, the pilot conducted 50.4 hours in the C188B. In that period, the longest flight time was 6.6 hours on 16 November which was also the longest duty day of 10.5 hours. The previous longest flight time recorded was on 6 October (7.3 hours). Both those days had been preceded by significantly shorter flight times.

The pilot’s most recent day off work prior to the accident was 25 November. After their day off, on 26 November the pilot commenced the transition to turbine-engine aircraft. Figure 9 and Table 2 show the pilot’s flight and duty records from 26 November to 3 December. The first time (ever) that the pilot flew VH-ACQ, was 5 days before the accident on 29 November. On that day, the pilot was awake at 0454 and home at 2126, having logged 5.6 hours of flight time in VH-ACQ.

Figure 9: Recorded flight and duty times from 26 November to 3 December 2021

Source: Aircraft operator data analysed by the ATSB

Table 2: Flight and duty records from 26 November to 3 December 2021

Date	Aircraft	Flying hours	Activity	Duty hours (and times)
26 Nov	AT-504	0.9	Dual training	10 (0800–1800)
27 Nov	AT-504 CA188B	6.1 (dual) 1.7	2.6 training plus 3.5 spraying Spraying	10 (0700–1700)
28 Nov	AT-504 CA188B	0.5 3.0	6 circuits ICUS Spraying	6 (0800–1400)
29 Nov	VH-ACQ (AT-400)	5.6	5 circuits (Tracplus shows 4 circuits at Moree) plus spraying 1,000 L load limit	8.5 (0800–1630)
30 Nov	VH-ACQ	2.5	Spraying 1,200 L load limit	6 (0930–1530)
1 Dec	VH-ACQ	7.7	Spraying 1,200 L load limit	12 (0730–1930)
2 Dec	VH-ACQ	8.0	Spraying 1,200 L load limit	13 (0700–2000)
3 Dec	VH-ACQ	7.9	Spraying 1,300 L load limit	13 (0700–2000)

In the 8-day period since the pilot’s last rest day, there were some discrepancies between the logged flight and duty times and the recorded GPS data for the aircraft. On 3 December, the aircraft was rolling at 0647, 13 minutes prior to the recorded duty commencement. On 29 November, the aircraft landed at 1841 and on 26 November, the aircraft landed at 1932, both times after the recorded end of duty period. It was the pilot’s responsibility to enter the flight and duty times and it could not be determined how the inconsistencies occurred. The chief pilot reported that they checked the entered data occasionally.

Operational tempo

A review of text messages the pilot sent to a friend (but not to the operator) showed that since October and throughout November, the pilot had often mentioned that they felt tired, and had frequently been awake at or before 0500, and getting to bed after 2100. 

The accident pilot had flown more than 30 hours in VH-ACQ in the 4 days prior to the accident. The chief pilot commented that the company pilots had been doing a lot of flying and were approaching the flight and duty limits every day. Other company pilots reported that they had been working long, but not excessive, days. Further, that although they had early starts, they were not finishing very late.  

On the day before the accident, the chief pilot had reported being worried about the company pilots with the workload ahead. The chief pilot sent a text message to check they were all managing the workload and reminding them to work together with each other and the ground crew, stick to the routine and keep it simple. Later that day, a company aircraft struck a powerline, which resulted in minor damage and no injuries to the pilot.

In response, on the morning of the accident flight, the chief pilot sent a message to all company pilots, reminding them, among other things, to be aware of the effects of successive early starts and late finishes. The message advised pilots to manage their time and rest when they could, consider load sizes particularly following refuelling, maintain wire awareness, and to be safe, have fun and keep it simple.

Communications

The UHF radio in VH-ACQ had malfunctioned on the day prior to the accident and been fixed that evening. The UHF radio was used to communicate with the operations manager, other company pilots in the area and normally, with the loader. However, the loader did not have a radio that day as they were not driving a (company) vehicle fitted with one. Normal procedure involved the pilot communicating with the loader via radio so the loader could prepare the next chemical load prior to landing. The operator also had a procedure for loaders to operate with an unserviceable UHF, which required the loader to either mix load by load only, or to continue mixing until further notice, and to have a mobile phone. The loader had a mobile phone.

During refuelling prior to the accident load, the pilot sent a text message to the operations manager and received an immediate response. After departing with the accident load at about 1130, a company pilot operating in the area heard the accident pilot on the radio to the operations manager advising of their concern about drift onto neighbouring property and that the wind was picking up. That company pilot later reported that they thought the pilot sounded nervous. The operations manager reportedly responded suggesting they could spray a different area or cease operating.

Analysis of recorded data

The TracPlus data for 4 December 2021 indicated that the pilot had not flown a hazard check of any block before commencing spraying or conducting clean-up runs. This meant the pilot had not overflown the south-eastern area of the block (127 and 128) where the accident occurred.

For the accident load, several data points were recorded at the northern and southern ends during the turns. Analysis of these points indicated the maximum height reached during the turn at each end of the field was about 250 ft above the ground.

Analysis of Satloc data from the pilot’s flight the day prior to the accident, showed that in more than 75% of procedure turns, the peak angle of bank was 50–70° and peak acceleration was between 1.5 and 1.9 G. The angle of bank exceeded 80° three times and the peak G on average occurred at about the same time as the peak angle of bank. In the turn technique described in the AAAA’s Aerial Application Pilot’s Manual (AAAA, 2011), the peak G would be reached before the peak angle of bank:

A key pilot technique in aerial application is to unload the aircraft from excessive G before applying aileron to initiate a turn. This is most likely to be relevant during a pull out of a paddock at the end of a run. Pull back to get out of the paddock and establish the aircraft in a climb, unload the G, and then initiate the turn. 

The Satloc data from the day prior to the accident also showed that during back-to-back spray runs with procedure turns, the aircraft was usually lined up (within half a swath width) on the next spray run about 200 m prior to the crop boundary.

Aerodynamic stall

A wing generates lift when the airflow around the upper and lower surfaces results in a pressure difference between those surfaces. At a certain angle of attack (the relative angle between the chord line of the wing and the approaching airflow), which is a characteristic of the wing design, the flow over the upper surface of the wing separates from the surface. This condition is known as an aerodynamic stall (or simply a stall) and results in a rapid reduction in the lift generated and an increase in drag. Due to the sudden reduction in lift from the wing and rearward movement of the centre of lift, an uncommanded nose-down pitch ensues.

A wing drop occurs when one wing stalls before the other, which can be exacerbated by uncoordinated (or ‘unbalanced’) flight. A cross-control stall occurs when the critical angle of attack is exceeded while aileron is applied in one direction and rudder in the opposite direction.

As a loss of altitude also occurs during recovery from a stall, it is possible to stall with insufficient height above the ground to recover. The AFM for VH-ACQ stated the altitude loss from a wings-level stall was 220 ft at 2,722 kg gross weight. The main indications of an impending stall in the AT-400 are airframe buffeting (vibration) and an aural stall warning (horn).  

Aerofoils of the type used on aircraft such as the AT-400, typically stall at angles of attack of around 16°. This critical angle of attack can be exceeded at any airspeed, any (pitch) attitude and any power setting. As most small aircraft do not have an instrument that indicates the aircraft’s angle of attack, the angle of attack at which the stall occurs may be referenced to an airspeed. The AFM for VH-ACQ provided stall speeds at 2,722 kg gross weight, power off, wings level (0° angle of bank), in a balanced level turn at selected angles of bank, and with the flaps up (retracted) and flaps down (fully extended) (Table 3).

Table 3: Angle of bank and stall speed at 2,722 kg, power off (adapted from AFM)

Angle of bank	0°	15°	30°	45°	60°
Stall speed (kt) – flaps up	66	67	71	78	93
Stall speed (kt) – flaps down	59	60	63	70	83

However, the airspeed at which a stall will occur is not fixed to a single value, and varies with weight, centre of gravity, load factor,[13] and power setting. Tight turns and rapid pull-ups increase the load factor and therefore increase the stall speed. A stall that occurs at a stall speed greater than the +1 G stall speed, such as when turning or pulling up, is termed an accelerated stall. Increasing an aircraft’s weight by 25% will result in the stall speed being about 12% faster.

At the probable aircraft weight at the time of the accident (3,066 kg), the stall reference speeds in the AFM (Table 3) would increase by a factor of 1.06. For the referenced angle of bank stall speeds, if the pilot did not move the control stick aft to maintain level flight, and the aircraft descended while turning, (at the same radius), the G would be less, therefore the stall speed would be lower than when maintaining a level turn.

The primary control for angle of attack is the aircraft’s elevator. Pulling back on the control stick will increase the angle of attack and pushing forward will decrease the angle of attack. If a pilot pulls the stick too far back and deflects the elevator too far, it will increase the angle of attack of the wing to the critical angle and stall it. The elevator control stick (or column) position at which the critical angle of attack is reached is independent of factors including airspeed, angle of bank, power, and pitch attitude. Recovery from a stall requires reducing the angle of attack by moving the control stick forward, which normally means lowering the aircraft nose (pitching down). A secondary stall can result following a stall if, during the recovery, the pilot again pulls the stick past the position at which the critical angle of attack is reached in an effort to regain horizontal or climbing flight too quickly.

As VH-ACQ was the ‘first of type’ AT-400 registered in Australia, flight tests were conducted at Ballarat airfield, Victoria, on 31 October and 2 November 1980. At the flight-tested weight of 3,042 kg, the report concluded that the handling characteristics were acceptable. It found the airframe (pre-stall) buffet was felt at 76 kt indicated airspeed (IAS) with the flaps up (fully retracted) and was ‘not violent’. There was a ‘clear and distinctive’ stall warning onset at 80 kt IAS with flaps up (fully retracted) and at 68 kt with flaps down (fully extended). The stall characteristics were described as ‘satisfactory’.

Human performance considerations

Workload

Workload is defined as the sum of task demands placed on an individual’s cognitive resources that are used for attention, perception, decision making and action (Skybrary, 2010). Humans are limited in the amount of new information the brain can process at once. Once the limit of cognitive resources has been reached, performance starts to decline with increased error rates and/or delayed responses. Factors that can increase workload include excessive task demands, time pressures, a lack of operator skills and knowledge, or environmental conditions (NASA, 2010).

Task complexity and an individual’s level of experience and knowledge can have a significant impact on their workload (Li and others, 2021). Less experienced pilots typically have a higher cognitive workload compared to those that are more experienced due to their continual learning and development of skills. A more experienced and knowledgeable individual can rapidly interpret a situation based on past experiences and knowledge, and subconsciously pattern-match. This frees up cognitive capacity for a pilot to maintain vigilance and monitor performance, and, if they choose, reflect on their actions, whereas a less experienced individual may not (Byrne and others, 2013).

Green and others (1996) described the effect of practice on motor skills such as flying an aeroplane. With experience, skill acquisition progresses from the cognitive phase, in which the learner has to think consciously about the action, through the associative phase and on to become automatic, and the skill can then be executed without conscious control. Until this occurs, central processing capacity is needed to perform the task. Thus, a pilot with fewer hours in an aeroplane type would be expected to experience a higher workload than a more experienced one for the same task.

The instructor who conducted the pilot’s aerial application rating described the increase in workload for a pilot progressing from the C188B to the AT-400 as: ‘The workload is just so high for [the AT-400 aircraft] – they’re fast, nippy in the turn. If you are going to fly it on the edge, things are going to happen. It has more than double the weight and inertia’ of the C188B. They further reported that aerial application work is ‘not mundane’, that the pilot would be concentrating all the time, and has to consider other factors such as drift and temperature, in addition to flying. To conduct effective aerial application, while manoeuvring the aircraft at low altitude, a pilot must visually scan external cues and monitor internal resources (NTSB, 2014).

High workload is associated with increased error rates and reduced safety margins (Harris, 2011). It also leads to a degradation in performance and at extremely high levels of workload, important information may be missed due to the narrowing or focussing of attention onto only one aspect of the task (Green and others, 1996).

Fatigue

Overview

The Civil Aviation Safety Regulations define fatigue for a flight crew member (FCM) as:

a physiological state of reduced alertness or capability to perform mental or physical tasks, which:

• may impair the ability of the FCM to safely operate an aircraft
• is caused by 1 or more of the following: 
  • the FCM’s lack of sleep;
  • the FCM’s extended wakefulness;
  • the FCM’s circadian phase at any relevant time;
  • the FCM’s workload of mental activities, or physical activities, or mental and physical activities at any relevant time.’

The International Civil Aviation Organization (ICAO) (2020) defines fatigue as:

… a physiological state of reduced mental or physical performance capability resulting from sleep loss or extended wakefulness, circadian phase, or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety-related operational duties.

Factors that can cause fatigue include (CASA, 2012):

• emotional strain
• mental workload
• strenuous or sustained physical exertion
• inadequate food and fluid intake
• adverse environmental conditions, such as extremes of temperature, low light levels, vibration and confined spaces
• disrupted and lost sleep.

Mental fatigue results from long periods of cognitive activity. Its effects can include reduced concentration and manual dexterity, increased reaction time, performance monitoring, error management and decision making (Boksem and others, 2005; Bafna & Hansen, 2021, CASA, 2012; Heywood 1999).  

Self-assessment of fatigue

Although there are some known limitations of self-rated fatigue, research on airline flight crew has shown correlation between self-rated fatigue and performance in vigilance tasks, for example using the Samn-Perelli 7-point fatigue scale[14] (Garwon, 2016, Petrilli, 2007 and Roach, 2012). There was no regulatory or operator requirement for pilots to determine (or provide) a standardised fatigue estimation prior to, or during, operations.

Sleep and time of day

Inadequate quantity and quality of sleep is a contributor to fatigue. Most people generally require 7–8 hours of sleep to achieve a maximum amount of alertness and performance. Sleep debt can be cumulative and can result in degraded performance and uncontrolled sleep episodes (Orlady & Orlady, 1999; Hawkins, 1993). The pilot’s 72-hour history indicated they had adequate sleep opportunities in the preceding nights and the pilot was reported to have no sleeping issues.

Circadian rhythms are the body’s internal clock that regulates the sleep-wake cycle and repeats roughly every 24 hours. According to the International Civil Aviation Organization (2016) there are two times of peak sleepiness within a 24-hour cycle. The main peak is in the early morning between 0300–0500 known as the window of circadian low, another smaller peak around 1500–1700 is known as the afternoon nap window. For each individual these times can vary. The period between when the pilot arrived at Moree Airport and the accident was outside these peak sleepiness times.

Effect of multiple long days

The instructor who conducted the pilot’s aerial application rating, when asked what the effect of the previous long days would be, reported that it was not just the last couple of days; the season had effectively continued since July without a break. Research has found self-ratings of fatigue (Rithemeister and others 2021) and risks of successive incidents both increase for each consecutive day worked (Folkard and Akerstedt 2004).

As documented by ICAO (2020) biomathematical modelling is ‘a computer programme designed to predict aspects of a schedule that might generate an increased fatigue risk for the average person, based on scientific understanding of the factors contributing to fatigue…All bio-mathematical models have limitations that need to be understood for their appropriate use.’ Biomathematical models can only forecast the effects of sleep and circadian rhythms[15] on performance and cannot account for other factors known to impact performance such as training, experience, stress and illness. Additionally, the models were not designed for aerial agricultural operations and did not consider the pilot’s cognitive workload.

The ATSB used two software programs, Sleep Activity Fatigue Task Effectiveness-Fatigue Avoidance Scheduling Tool (SAFTE-FAST) and Fatigue Assessment Tool by InterDynamics (FAID) Quantum, which are biomathematical models to assess fatigue based on the pilot’s duty hours and sleep opportunity in the days leading up to the accident. Each model has specific applications and limitations.

SAFTE-FAST predicts future performance based on the recent sleep history of the projected population or individuals. The output is a performance score indicating a percentage of cognitive effectiveness at a point in time. The lower the performance score, the higher the effect of fatigue. The model is based on biological determinants of fatigue such as: hours of sleep, hours of wakefulness, current sleep debt, the circadian process and sleep fragmentation (awakenings during a period of sleep) that reduce quality (Hursh and others 2004). SAFTE-FAST indicated that the pilot’s performance was not affected by sleep history and circadian processes.

FAID uses work hours as its input to predict the effect on fatigue and performance of different duty periods or work schedules. The FAID output is a score indicating different levels of fatigue exposure for different work hours. The higher the FAID score, the higher the fatigue exposure. The FAID score is based on the following biological determinants of fatigue: time of day of work and breaks, duration of work and breaks, work history in the preceding 7 days, and biological limits on recovery sleep (InterDynamics n.d). FAID indicated a high fatigue exposure risk for the pilot on the accident day, but lower (although still high) at the time of the accident than the start of the day.

The outputs of the two models were inconsistent. The differences in results can be explained by the underlying parameters in each model.

Time on task

Agricultural operations are known to place high demands on the pilot’s attention for sustained work periods, which can result in a degradation of performance, even if the pilot has obtained adequate sleep. This is due to the continuous, repetitive, low altitude flying associated with this type of operation, while also managing the spray application (NTSB, 2014).

Rosa and others (2020) found that during a simulated 11-hour flight mission, participants' self-ratings of fatigue increased over time and their response time was slower after 7 hours. This demonstrates that sustained attention and vigilance were adversely affected by time on task.

Having started the aircraft’s engine at 0553, the pilot had been operating for nearly 6 hours when the accident occurred at 1145. Consistent with previous days and normal operations, the pilot took short breaks while the loader was refuelling, to get out of the aircraft, eat and drink. These breaks occurred approximately every hour and would last about 10 minutes. One fatigue countermeasure is activity breaks. These can reduce the impact of accumulating workload and alertness and performance will improve briefly due to providing a mental break from a continuous task (Caldwell 2008; Mallis and others 2022). Therefore, breaks can be temporarily beneficial in reducing the effects of fatigue.

Combined effects of workload and fatigue

Fatigue and workload can have similar effects on vigilance, perception and reaction/response times. A study of workload and fatigue in rail workers (Fan & Smith, 2017) found that both high workload and fatigue were associated with performance impairments. High workload was also found to increase fatigue, which then leads to a reduction in performance. The United Kingdom Civil Aviation Authority Flight-crew human factors handbook – CAP 737 (2016) described symptoms of increasing workload, including attentional and task focusing, task shedding, increased fatigue, and chance of error. It stated that:

Sustained workload contributes to fatigue. Very high workload (particularly fast onset) and feelings of not coping with the workload can cause high arousal or stress. All these things make error more likely.

The handbook lists effects of fatigue, similar to those associated with mental fatigue described earlier, including reduced awareness, easy distraction and increased slips and mistakes.

Accident site and aircraft damage  

Accident site and impact

The wreckage was located at the southern end of a stand of trees and had been subject to a significant post-impact fuel-fed fire. There were no powerlines in the area and there was no evidence the aircraft struck a tree or bird prior to the collision with terrain.

On-site examination of the wreckage and surrounding ground marks indicated that the aircraft impacted terrain upright, in a nose-down attitude of about 40°, with the right wing down about 10°. The propeller, main wheels and wing leading edge impacted the ground first (Figure 10), during which the fuselage right bottom longeron[16] fractured and punctured the right wing main spar (Figure 11). Two propeller blades were located at the engine point of impact.

Figure 10: Initial impact points – right wing, main landing gear and propeller

Source: ATSB

Figure 11: Fuselage frame longeron fracture and associated impact damage with main spar damage to right wing

Source: ATSB

Forward momentum then collapsed the forward section of the fuselage and resulted in the main spar rotating about 120° and separating from the fuselage. The aircraft then continued a short distance rotating to the right, consistent with a right turn/spin, and came to rest facing approximately east.

The engine fractured in half around the flange ‘C’ area (ring of bolts joining the exhaust casing to the gas generator casing), with the gas generator module remaining near the fuselage. The propeller hub, with propeller blade, the engine power section module, including power turbine wheel, was recovered about 27 m from the impact point, in the direction of the target crop (north). The liberated compressor turbine disc was found a further 30 m beyond the hub in a similar direction (north-east), and at the edge of the fire zone (Figure 12).

The flame front and debris trail were in the direction of the wind (towards the north-east) and towards the target crop (north). The propeller hub displacement and fire zone were consistent with the aircraft’s trajectory prior to the loss of control, and with ignition at the final resting place. There was no evidence of fire at the initial impact point.

Figure 12: Overview of accident site and fire zone

Source: ATSB

Wreckage examination

Although the throttle position could not be determined from the wreckage, examination of the damage to the engine and propeller blades was consistent with the engine producing power at impact. Seat frame distortion was consistent with a nose-down attitude at impact. Although impact and fire/heat damage precluded inspection of some control tubes and cables, flight control continuity was established via examination of connections, for example steel rod ends securely attached to bellcranks.

Aircraft configuration

Flap actuator measurement and corresponding flap setting indicated the flaps were extended about 18°. Due to impact damage, the position of the dump lever and of the hopper door could not be determined.

Fuel testing

A fuel sample was collected from the operator’s fuel tank at the property. The fuel was tested for the presence of water with none identified. A visual inspection did not identify any particulate matter in the fuel. There were also no reports of fuel quality concerns with the operator’s other aircraft using the same fuel source.

Survivability

Post-mortem and toxicology results

An autopsy report was prepared for the NSW Coroner. The report provided to the ATSB included the results of a post-mortem examination conducted by a forensic pathologist and toxicology testing.

The post-mortem examination found one minor fracture and multiple heat-related injuries, with no (life-threatening) traumatic injuries identified. No natural disease pathology was identified and no substances likely to have contributed to the accident were found in the toxicology results. The cause of death was found to be the effects of fire.

Restraint and helmet

The pilot’s seat was fitted with a 4-point harness, the webbing of which was destroyed by the fire. Despite this level of damage, the left and right lap belt attach points were found secured and the lap belt and shoulder harness steel buckle was secured. Additionally, the lap belt and shoulder harness webbing had been replaced in January 2020, and therefore would be very unlikely to have failed due to deterioration.

The pilot was always known to wear a helmet and was almost certainly wearing it at the time of the accident.

Impact force analysis

The ATSB analysed deformation of the pilot’s seat frame to determine peak impact deceleration. The pilot’s seat frame was bent at the two seat attachment locations, but the seat pan was undeformed. This indicated that the angle of deceleration was mostly forward rather than vertical. It was assessed that the seat rail was at the lowest height adjustment. The 4-point restraint was being worn at impact.

In conducting a dynamic loads analysis, a conservative evaluation of the peak deceleration for the pilot seat was 75 G. Based on a stall speed with flaps retracted of 60 kt, this equates to a square wave deceleration pulse[17] duration of 42 milliseconds.

The Aircraft crash survival design guide Volume 2 – Impact conditions and human tolerance (Coltman and others, 1989) placed this forward deceleration in the ‘area of severe injury’. Severe injury included life-threatening injuries such as major haemorrhages, spinal, abdominal and thoracic injuries, multiple fractures, concussion and long-time unconsciousness (Eiband, 1959). This was based on experiments of whole-body impact tolerance conducted on human volunteers to (mostly) subcritical levels, and test animals. Whole-body tolerance criteria were assessed with subjects seated in the upright posture and wearing full-torso restraints (and in some cases head restraint). The tolerable magnitude of accelerative force is a function of the duration; higher G were tolerated for a shorter pulse duration.

Post-impact fire safety

Post-impact fire and survivability

A potentially survivable accident is one in which the impact forces are within the limits of occupant tolerance, the aircraft structure preserves the required survival space, and the occupant restraint is adequate. As detailed below, for aircraft (including fixed and rotary wing) with a maximum certified take-off weight of 5,700 kg or less, post-impact fire (PIF) has been shown to contribute significantly to injuries and fatalities in accidents that are otherwise potentially survivable (TSB, 2006).

Aircraft certification requirements

Aircraft certification is found primarily in three regulatory structures: the US Federal Aviation Regulations (FARs), the Canadian Aviation Regulations, and the European Aviation Safety Agency requirements. These requirements are harmonised such that light aircraft manufactured in the US, Canada and Europe all meet basically the same standards.

Part 23 of the FARs prescribes the airworthiness standards for aeroplanes in the normal, utility, aerobatic, and commuter categories. There are only three FAR 23 fuel system certification requirements designed to reduce the risk of PIF. These specifically apply to aircraft with retractable landing gear in the event of a wheels-up landing.

The AT-400 aircraft was certificated under FAR 21 in the restricted category. It met the structural requirements of FAR 23, and the flight criteria, propulsion, systems and equipment items of CAM 8, Appendix B (FAA TCDS A9SW).

Fuel tanks in accident impacts

In an accident impact, metal fuel tanks are prone to rupturing, allowing fuel to spill. The rupture of the tank causes the fuel to escape at high pressure and velocity which in turn causes the fuel to form a fine mist, which can be ignited by a source such as a hot engine or electrical arcing, and produces a very intense fire.[18]  

The rupturing of the tanks results from high fluid pressures caused by inertial accelerations during the impact. The pressure distorts the tank walls and rupture will occur when the strain[19] of the distortion reaches the rupture strain (also known as the ‘ultimate’ or ‘fracture’ strain) of the tank wall material.

To improve crashworthiness, fuel bladders and cells have been constructed of materials that are less prone to rupturing, that is, they have a higher rupture strain. These are able to withstand more deformation and a puncture is less likely to expand or tear and form a larger opening from which fuel can escape.   

The rupture strain for airframe aluminium (2024-T3 alclad sheet) is about 18%. Elastomers[20] tolerate severe deformation without rupturing – for a typical elastomer, the rupture strain is about 300% – significantly higher than metals. Additionally, even if elastomeric walls are punctured, the probability of fuel misting is very low because the flow rate for the puncture is much less than through a split tank wall. As an example, Robinson R44 helicopter bladder tanks are elastomer.

The resistance of elastomers to rupture and puncture can be substantially increased by incorporating high-strength fibres, such as Kevlar, into the material. For ultimate post-crash fire resistance (as in motor racing), fuel tanks (or cells) use double elastomeric walls with material such as Kevlar in the outer layer. This substantially reduces the probability of tank wall rupture, puncture and of fuel misting.

Prevention of post-impact fires

The US National Transportation Safety Board (NTSB) special study report General Aviation Accidents: Postcrash Fires and How to Prevent or Control Them (NTSB, 1980), found that PIF occurred in about 8% of the 22,002 general aviation accidents in the US during 1974–1978. Fatalities resulted from about 59% of the accidents involving PIF and 13.3% of the accidents without fire. The study tested the hypothesis that PIF occur more often in severe accidents. Severe accidents included collisions with the ground or objects such as trees/poles, stall/spin accidents, and some following engine failure/malfunction. These made up almost 80% of fatal accidents. In severe accidents, fatalities occurred in 18% of the accidents without PIF, but in more than 60% with PIF. For non-severe accidents, less than 1% involved fatalities without PIF and 19% involved fatalities with PIF. The report summarised that fire, rather than impact, was the major contributor to fatalities in general aviation accidents involving PIF.

The study found that PIF was occurring in survivable accidents. It noted that in contrast to civil aviation, the US Army had used fuel containment technology to dramatically reduce fire injuries and deaths. A crash resistant fuel system is designed to absorb energy in controlled failures of sacrificial structures to minimise impact loads on the fuel tank and eliminate the escape of flammable fluid in a crash. The intent was that the aircraft occupants would then have sufficient time to escape or be rescued without the threat of fire.

The report identified that technology for crash-resistant fuel systems existed (in 1980) suitable for general aviation aircraft. The 1980 NTSB special study report stated that ‘the concept of fuel containment is both feasible and achievable now’. The report Tests of Crash-Resistant Fuel System for General Aviation Aircraft (Perrella, 1978) concluded that lightweight, flexible, crash-resistant fuel cells used in combination with self-sealing break-away fuel-line couplings can effectively reduce PIF in general aviation aircraft equipped with wing tanks. Safety fuel cells were developed in the 1960s to prevent post-crash fuel-fed fires in race cars to improve survivability.

However, aircraft design and certification regulations did not reflect the technologies available. In response, the US NTSB issued 6 recommendations to the US Federal Aviation Administration (FAA) to implement regulations aimed at addressing the issue of post-crash fires – A-80-90 to A-80-95.

On 17 September 1985, the FAA issued an advance notice of proposed rulemaking that informed the public of the FAA’s intent to formulate rules to improve the crash-resistance of small airplanes' fuel systems and requested economic and technical information to assist in economic analysis and technical decisions for future rulemaking.

After several years of studies and discussions, on 20 May 1988, the FAA advised the NTSB that they had drafted a notice of proposed rulemaking (NPRM). On 14 February 1990, the FAA issued an NPRM proposing changes to the airworthiness standards to improve the crash resistance of fuel system on normal, utility acrobatic, and commuter category airplanes. These proposed design changes were to limit fuel spillage near ignition sources and would provide additional time for survivors of an accident to evacuate the aeroplane.

After some changes and review of the NPRM, in 1995, the FAA concluded that the recommendations could not be justified on a benefit-to-cost basis and therefore planned to take no action on these recommendations.

In 1996, the NTSB assessed that no tangible action had occurred in the 16 years since the issuance of these recommendations, and classified recommendations A-80-90 to -92 as closed with unacceptable safety action.

Since that time, crash-resistant fuel bladders/tanks have been introduced in rotorcraft. Crash-resistant fuel system technologies have also advanced significantly, particularly in motor sports.

Regulation of helicopter fuel systems

In 1994, US helicopter standards FAR 27.952 and FAR 29.952 introduced fuel system crash resistance tests and features for new design certification. These were introduced because it was estimated at the time that 5% of occupants in survivable rotorcraft accidents were killed or injured by PIF. There were no equivalent test requirements for fixed wing aircraft.

Research for ATSB investigation AO-2013-055, found that in Australia from 1993 to 2013, PIF occurred in 7 of 47 impact-related accidents (with usable fuel remaining) involving Robinson R44 helicopters not fitted with bladder tanks. Six of those accidents resulted in fatalities. The investigation found that PIF occurred in a significantly higher proportion of accidents involving R44 helicopters without bladder-type tanks than in other similar helicopter types. In response to ATSB safety recommendation AO-2013-055-SI-01, in April 2013, CASA issued an airworthiness directive requiring Australian operators of R44 helicopters to comply with the manufacturer’s service bulletin to replace all-aluminium fuel tanks with bladder-type tanks on R44 helicopters. Since then, there have been 68 R44 and R44 II accidents in Australia, 4 of which had PIF. There were no recorded fatalities as a result of PIF in R44 helicopters in that period.

Transportation Safety Board of Canada safety issues investigation

The Transportation Safety Board of Canada (TSB) conducted a safety issues investigation – Post‑impact fires resulting from small-aircraft accidents. The investigation examined TSB data for the 13,806 accidents involving aircraft weighing 5,700 kg or less, that occurred between 1976 and 2002. The TSB determined that PIF had occurred in 521 (3.8%) of those accidents, resulting in 728 (22%) of the 3,311 total fatalities. Of the 728 fatalities, 205 were assessed as due to fire as were 80 of the 231 total serious injuries. The aircraft included 382 production aeroplanes, 94 production helicopters, 27 amateur-built aeroplanes, 2 amateur-built helicopters, 1 gyroplane and 17 ultralights. Two of the accidents were mid-air collisions between 2 aeroplanes.

The investigation found that PIF presented a significant risk of fire-related injuries and fatalities to the aircraft occupants following a collision because of:

• the proximity of fuel to the occupants
• limited escape time
• limited energy-absorption characteristics of the airframes in crash conditions
• high propensity for immobilising injuries
• inability of firefighters to suppress PIFs in time to prevent fire-related injuries and fatalities.

The investigation concluded that there should be improvements to prevent PIF and reduce fire-related injuries in otherwise survivable accidents. It found that ‘the most effective defence against post-impact fire is to prevent the fire from occurring at impact, either by containing fuel or preventing ignition, or both’.

The investigation also reviewed the history of post-impact fire safety action and identified that previous attempts to amend certification requirements for small aircraft had been unsuccessful. The report stated that post-impact fire-resistant fuel system technology had been demonstrated to be effective in race car and automotive applications, and in certified civilian helicopters. However, there was no requirement to incorporate these engineering countermeasures into new or existing small aeroplanes (or helicopters certified before November 1994).

While acknowledging the difficulty of implementing design improvements in new and existing (FAR 23 and equivalent) aircraft, the investigation found that doing so would reduce the incidence of fire-related injuries and significantly increase the rate of occupant survival.

ATSB post-impact fire occurrences

Post-impact fire data

As not all accidents were likely to have a post-impact fire risk, ATSB identified a subset of accidents, which were impact-related and therefore expected to be more likely to result in fire. The ATSB occurrence database held records of 316 collision with terrain or controlled flight into terrain (CFIT) accidents involving VH-registered (fixed-wing) aeroplanes between 2012 and 2021.

PIFs occurred in 34 (11%) of these accidents. Of the 316 accidents, 81 resulted in fatal injuries, 24 of which had PIF, in 36 the highest injury level was serious, 5 of which had PIF, and 199 resulted in only minor or nil injuries, 5 of which had PIF. As a proportion of PIF accidents, 71% were fatal, 15% were serious injury accidents and 15% resulted in minor or nil injuries. By comparison, 20% on non-PIF accidents were fatal, 11% resulted in serious injuries and 69% in minor or nil injuries.

Figure 13: Proportion of accidents with and without PIF

The 316 accidents resulted in a total of 137 fatalities and 61 serious injuries. The 34 PIF accidents accounted for 35 of the fatalities (26%) (similar to the TSB issues investigation which found 22%), and 10 (16%) of the serious injuries (Table 4).

Table 4: Number of fatal and serious injuries in PIF vs all aeroplane accidents 2012-2021

All collision accidents (316 total)
Injury category	Number	Rates per accident
Fatalities	137	0.43
Serious injuries	61	0.19

All accidents resulting in PIF (34 total)
Injury category	Number	Rates per accident
Total fatalities	35	1.03
Total serious injuries	10	0.29
Fatalities due to fire	5	0.15
Serious injuries due to fire	4	0.12

Survivability analysis

The ATSB analysed available information from the 34 PIF accidents to determine which fatalities and serious injuries were due to fire or impact. Information sources included post-mortem reports, coroners’ reports and published ATSB investigation reports. Post-mortem reports were not available for all the fatal accidents and were generally only of flight crew (not passengers). Further, for non-fatal injuries, recorded details of the injuries were limited. For this analysis, the severity was assessed as having been increased due to fire only where burns or smoke inhalation were specifically mentioned. Where information was unavailable, these were not counted as fire-related injuries/fatalities. As the NTSB found, fire rather than impact was the major contributor to fatalities in general aviation accidents involving PIF.

There were 2 accidents in which the cause of death was a combination of multiple injuries and fire, and where the injuries included head/skull injuries. These were assessed as probably not survivable because head injuries and skull fractures were significantly associated with mortality in studies of falls from heights and motor vehicle accidents (Liu and others, 2009, Papadimitriou-Olivgeris and others, 2020).

In 5 of the 34 PIF accidents (15%), a total of 5 fatalities were assessed as a result of fire following survivable injuries received in the impact. This was about 4% of all the VH-registered aeroplane impact-related accident fatalities. Two additional accidents resulted in a total of 4 serious injuries due to fire. Detail of the analysis is in Appendix B. In summary, analysis of the 34 PIF accidents found:

• 5 were considered survivable without the post-impact fire, where occupants were fatally injured
• 18 in which the accident impact was not considered survivable or were probably not survivable
• 2 resulted in serious fire-related injuries
• 9 in which occupants egressed and survived without further injury.

Five of those 34 accidents with a post-impact fire occurred during aerial application operations:

• 2 were probably not survivable as the occupants sustained multiple injuries including skull fractures
• 1 in which the occupant survived and exited the aircraft before it was destroyed by post-impact fire
• 1 in which the pilot died from the effects of fire
• 1 in which the pilot died from the effects of fire and sustained injuries that would probably have prevented the pilot extricating themselves from the wreckage.

Fuel tank type

Three types of fuel tanks were used in the accident aircraft – integral, rigid and bladder tanks:

• Integral fuel tanks are part of the aircraft structure. They are manufactured by assembling parts of the aircraft structure with sealant to form a fuel-tight compartment, most commonly in the wings.
• A rigid tank can be made of various materials including aluminium alloy, steel or composites. They are usually removable and mounted into the airframe structure.
• A bladder type fuel tank is a rubber/elastomer cell dependent on the structure of the cavity it sits in to support the weight of the fuel within it. Bladder (or ‘bag’) tanks have historically been installed in the wing in lieu of sealing the structural components but not made of crash-resistant materials. Crash-resistant materials are capable of providing impact and puncture resistant fuel bladders and cells such as those used in helicopters and racing cars.

For the aircraft involved in the 34 PIF accidents:

• Non-crash-resistant bladder tanks were fitted in 2 aircraft involving 6 fatalities. No serious injuries were recorded for those aircraft and neither accident was survivable.
• Rigid tanks were fitted in 9 of the aircraft involving 7 fatalities, none of which were survivable. Two resulted in serious injuries that were not fire related.
• Integral tanks were fitted in 23 of the aircraft involving 22 fatalities, 5 occupants of which would have survived without for the fire. In those aircraft, 8 serious injuries occurred, 4 of which were attributable to fire.

Organisational information

Aircair overview

Aircair was founded in 1980 and was one of the largest aerial application operators in Australia. The CASA-issued Air Operator’s Certificate current at the time of the accident was re-issued to Aircair on 11 June 2021, valid until 30 June 2024. Under the certificate, Aircair was authorised to conduct aerial application and aerial work operations. At the time of the accident, Aircair had a fleet of 13 aircraft conducting application operations and engaged 12 pilots. As well as VH-ACQ, the aircraft fleet included a radial-engine Air Tractor AT-301, turbine-engine AT-502, AT-504 and AT-802 type aircraft, and a piston-engine Cessna 188B, which the company had purchased specifically for the accident pilot to operate during their initial supervised hours of aerial application operations.

Safety management

At the time of the accident, although Aircair was not required to have a safety management system, they had implemented the AAAA’s Aerial Improvement Management System (AIMS). AIMS was designed to meet the safety management and quality assurance requirements of the multiple regulators that an aerial application employer is bound by, including CASA. AIMS incorporated safety management of all facets of the business, including aviation, and was designed to integrate with the company’s Operations Manual.

The AIMS section associated with planning and conducting an application detailed that the operations manager or general manager could select a particular pilot for a given application based on their experience. The section also included a detailed drift risk assessment, which was to be followed by a plan to manage the application risks, including identifying if a forecast temperature would result in a decision to cease spraying. There was no requirement for the risk assessment to be documented or retained. The chief pilot reported having discussed the application plan and forecast with the pilot the evening prior to the accident, and the pilot had confirmed the temperature spray limit with the operations manager while the aircraft was being refuelled shortly before the accident. 

The AIMS section also required the pilot to complete a hazard check on arrival to the treatment area.

Similar occurrences

Loss of control in flight

The CASA Advisory Circular 61-16 – Spin avoidance and stall recovery training (CASA, 2020), stated that stall-spin accidents accounted for about a quarter of all general aviation accidents worldwide. Further, that other than those which occurred during dual flight instruction, most of those losses of control occurred at a height too low for recovery.  

The ATSB occurrence database recorded 269 accidents that occurred due to a loss of control between 2010 and 2020 involving (fixed-wing) aeroplanes. Of those accidents, 32 occurred while manoeuvring or conducting airwork, 17 of which resulted in fatal injuries. Of the 32 accidents that occurred during manoeuvring/airwork, 14 were conducting aerial application or mustering operations.

The following is a sample of ATSB investigations into fatal accidents that resulted from an aerodynamic stall at a height too low to recover before the aircraft impacted terrain.

AO-2008-069

The pilot of a Piper Aircraft PA36-375 Pawnee Brave was conducting aerial baiting operations in the Pilton Valley, Queensland when the aircraft collided with terrain. The aircraft was seriously damaged by impact forces and a post–impact, fuel- and magnesium-fed fire. The pilot was fatally injured.

The investigation found that the topography of the area and the strong gusty wind conditions at the time, probably resulted in turbulence that increased the hazardous nature of the low-level application task. It is likely that the pilot lost control of the aircraft as a result of that turbulence, at a height from which recovery was not possible before the aircraft struck the ground.

AO-2009-070

The pilot of a Cessna A188B aircraft was fatally injured when the aircraft impacted terrain during spraying operations. The investigation determined that the aircraft stalled at an altitude from which the pilot was unable to recover before the aircraft impacted terrain.

AO-2011-082

A PZL-Mielec M18A Turbine Dromader aircraft impacted terrain on a cotton station near Dirranbandi, Queensland while conducting aerial spraying. The pilot was fatally injured, and the aircraft was destroyed by impact forces.

The ATSB found that, for reasons that could not be determined with certainty, the aircraft departed from controlled flight during a turn at low height and the pilot was unable to recover before impacting the ground.

AO-2012-059

The owner-pilot of a Cessna 150 aircraft was aerial stock mustering on a cattle station about 55 km north-east of Bourke, New South Wales. The aircraft was observed circling over an area (where cattle were not moving,) then entered a steep descent followed by the sound of an impact. The aircraft was seriously damaged, and the pilot sustained fatal injuries.

The ATSB found that, while manoeuvring at low level, the pilot inadvertently allowed the aircraft to aerodynamically stall, resulting in a high rate of descent and collision with terrain. There was insufficient information about pilot control inputs to establish the factors that precipitated the stall.

AO-2014-192

On 29 December 2014, a Cessna 172S aircraft departed Cambridge Airport, Tasmania to photograph yachts participating in the 2014 Sydney Hobart race. On board the aircraft were the pilot and a photographer.

At about 1815, the aircraft commenced low-level photographic runs on yachts. Shortly after completing a run on one yacht at a height of about 50 ft, the aircraft entered a steep climbing turn. The aircraft had almost completed a 180° turn when the upper (right) wing dropped sharply while the aircraft’s nose pitched down to almost vertical. The aircraft impacted the water’s surface in an almost vertical nose down attitude with wings about level. Both aircraft occupants were fatally injured, and the aircraft was substantially damaged.

As a result of the steep climbing turn, the aircraft’s upper wing aerodynamically stalled, resulting in a rapid rotation out of the turn. The steep pitch attitude indicated that, because of the stalled upper wing, the aircraft entered a spin. There was insufficient height for the pilot to recover the aircraft.

Addressing loss of control in flight occurrences

The US FAA Airplane Flying Handbook (2021) chapter 5 Maintaining aircraft control: upset prevention and recovery training, stated that a loss of control in flight (LOC-I) is the leading cause of fatal general aviation accidents in the US and commercial aviation worldwide. The text listed situations that increase the risk of loss of control, including uncoordinated flight, distraction, turbulence and poor risk management. It further stated that in situations where a LOC-I can occur, pilots must recognise when the aircraft is approaching a stall or has stalled and execute the correct procedure to recover the aircraft. This requires training that includes slow flight, stalls, spins, and unusual attitudes.

US FAA Advisory Circular 120-109 – Stall prevention and recovery training was aimed at reducing LOC-I accidents and incidents. The circular stated that a ‘recurring causal factor in LOC-I accidents and incidents is the pilot’s inappropriate reaction to impending stalls and full stalls’. Further, the circular advised that reducing the angle of attack was the most important pilot action to recover from an impending or full stall and therefore this should be emphasised in stall training. 

Safety analysis

Introduction

On the morning of 4 December 2021, after completing the fifth spray run of the eleventh chemical load on a property near Moree, New South Wales, VH-ACQ was observed to climb, enter a right procedure turn, then descend rapidly and impact terrain, followed almost immediately by an intense fuel-fed fire.

The investigation found no evidence of a bird or tree strike, or anything likely to have jammed the flight controls affecting controllability. Continuity of the flight controls was established, the main wing spar was intact, and the engine was making power and driving the propeller when the aircraft impacted the ground. At the time of the accident, the aircraft was below the maximum take-off weight approved for aerial application operations and the centre of gravity was within the extrapolated limits.

This analysis will discuss development of the accident sequence and the effect of the environmental conditions. The pilot’s experience and how this contributed to workload and fatigue will also be examined. Further, it will consider the management of flight risk and factors affecting survivability.

Loss of control

Witness observations of the aircraft turning and descending rapidly were consistent with an aerodynamic stall and loss of control in flight. These observations were consistent with the accident site, in which the aircraft wreckage was confined in a small area, with evidence of a high vertical impact and low forward speed.

The last recorded GPS position left of the last spray run and about 180 ft above the ground, was consistent with the pilot conducting a right procedure turn – a shallower turn about 45° to the left, followed by a steeper right turn – at the end of the spray run. That last recorded height was very likely not the maximum reached, as the data from previous turns showed the aircraft generally climbed to about 250 ft above the ground.  

The loss of control in flight was consistent with a rapid entry to the stall. That stall was a result of the angle of attack being too high from moving the elevator control stick position too far aft while increasing the bank angle during the turn. The stick force experienced by the pilot on the elevator control depended on the trim position, which could not be determined. Regardless of the stick force, the stick position that a pilot needs to set to recover from a stall will be the same. Stall prevention requires monitoring the position of the elevator control stick, awareness of its position at which the aircraft will stall, and to maintain the control stick forward of that position. Stall warning or buffet should alert the pilot to move the stick forward, but the pilot may have had very little warning. The pilot reportedly had the stall stick position demonstrated, and although they had on occasion pulled the stick back too far in a turn during training, this was a common training error, which the pilot had been observed to have rectified. Analysis of recorded GPS data from the pilot’s flights prior to the accident, showed the pilot generally employed sound technique in the turns.  

The Airplane Flight Manual stated that the aircraft would lose 220 ft in recovering from a straight and level stall at the published maximum weight, based on flight testing. Recovery height would be increased by an accelerated stall and uncoordinated turn. Accident site analysis showed the aircraft impacted the ground nose-down and wings almost level, which suggested the pilot had acted to recover from the stall but had insufficient height to complete the recovery.

Effect of field shape

As evidenced by the recorded GPS data, the pilot had not flown hazard checks on the accident day. The operator assessed that as the pilot had overflown the accident block several times in the previous days, they were probably familiar with it. However, it could not be determined whether the pilot had identified the uneven southern boundary and shape of crop to be sprayed before commencing the accident turn.

Due to the shape of the target block, the pilot needed to turn the aircraft further beyond the southern boundary or wider than the previous turns, to line up on the next spray run at a suitable height to commence spraying. Consideration of additional turn radius was also required due to the 10–18 kt gusty south-westerly wind becoming a tailwind during the turn, thereby pushing the aircraft closer to the crop.

The recorded GPS data from the pilot’s flights on the day prior to the accident showed that the aircraft was usually lined up on the next spray run about 200 m prior to the crop boundary. The location of the accident and the position where the loss of control occurred was about 110 m south of the target crop. At that point, the aircraft was too high and too close to the southern boundary to manoeuvre safely to commence spraying the crop at the start of the next spray run. From this position, the pilot likely attempted to tighten the turn rather than miss the additional crop (and skip that spray run).

Experience, workload, and fatigue

Experience

The pilot had commenced aerial application training immediately after attaining a commercial pilot licence in the minimum timeframe. On achieving their aerial application and low-level ratings, the pilot commenced aerial application operations as an employee of the aircraft operator, in September 2021. The pilot then conducted the required supervised aerial application flight time in a piston-engine aircraft. One week before the accident, the operator assessed that the pilot was ready to transition to turbine-engine Air Tractor aircraft.

Although the pilot had demonstrated competence in the aircraft and aerial application to a high level of skill for their experience, at the time of the accident, they were still relatively inexperienced in overall flight time, aerial application, and particularly in the AT-400 aircraft. This inexperience likely affected many facets of the operation, including aircraft handling, workload and fatigue.

Workload 

Agricultural pilots operating at low altitudes must visually scan external cues to control the aircraft and avoid obstacles, while also monitoring inside the cockpit including instruments, spray systems and property maps. Due to the close proximity to obstacles, terrain and the airspeeds at which the aircraft are flown, agricultural pilots have less time to respond to abnormal situations. As a result, any lapse in concentration or imprecision in control input could lead to catastrophic consequences (NTSB, 2014).

During the morning, the increased temperature, change in wind direction and increase in wind strength and gust speed, made the flying conditions increasingly turbulent. The conditions half an hour after the accident were described as quite windy and rough. Turbulence has been found to increase physical and mental workload, which can lead to degradation in the pilot’s ability to safely and effectively operate the aircraft. This is due to human perceptual systems breaking down, as a result performance can diminish, leading to fatigue, motion sickness and reduced mental performance. (Dodd and others, 2014). These conditions increased the pilot’s workload through additional physical aircraft handling and discomfort.

The pilot’s text message regarding the temperature, radio call regarding drift, and the aircraft’s track on the accident load, were indicative of the pilot making decisions in response to the changing conditions. While such decision-making is a usual part of spraying operations, it requires cognitive resources, thereby increasing workload. The pilot’s radio call about 20 minutes before the accident, suggested the pilot was experiencing stress and high workload. During the morning, the pilot had been in radio contact with the operations manager and other company pilots including the Aircair general manager. However, resources usually available to assist in managing the pilot’s workload and aid in decision‑making, were diminished on the accident day as the loader had no radio and it was the first day that the chief pilot was not supervising the pilot.

Without these resources to assist, the pilot was possibly assessing whether to cease flying due to the conditions, further adding to their cognitive load. Making such a decision may also have been more difficult while other company pilots were continuing to operate.

The pilot’s concern about drift precipitated a change of plan, whereby the pilot elected to move from the western to the eastern boundary, abandon the incomplete racetrack pattern and resume spraying in a back-to-back pattern. The change in spray pattern briefly required the pilot’s focus inside the cockpit to change GPS settings, introducing the potential for distraction and increasing workload. However, there was no evidence to demonstrate this distraction occurred at the time of the accident.

Due to a combination of inexperience, the environmental conditions, decision-making, and absence of supervision, the pilot’s workload was likely at a level known to increase error rates, reduce performance and lead to important information being missed (Green and others, 1996).

Fatigue

The pilot had several early starts and long days in the month prior to the accident, consistently reporting to a friend (but not to the operator) being very tired at the end of each day. As the accident day was the pilot’s ninth day of duty, there was an increased risk of cumulative fatigue. In the 3 days prior to the accident, the pilot had recorded their longest consecutive flight and duty times since commencing aerial application operations. Additionally, the pilot’s commute by car to and from the base was extended due to recent flooding, which reduced the opportunity for recovery between flight duties.  

All the pilot’s recent flight time was cognitively demanding low-level aerial application with short breaks during refuelling. Additionally, the cognitive demands would have been higher than for a more experienced pilot, particularly the pilot’s very limited flight time in the turbine-engine aircraft. At the time of the accident, the pilot had been operating for approaching 6 hours, with several short (10-minute) breaks during refuelling, including one about 15 minutes prior to the accident. Research on sustained attention during a task has shown that decreases in performance and self-rating experiences of fatigue increase over time (Rosa and others, 2020). However, work breaks can be temporarily beneficial in reducing the effects of fatigue (Caldwell 2008; Mallis and others 2022).  

The pilot’s sleep history and the accident time of day were unlikely to have affected the pilot’s performance. However, the consecutive long flight and duty times in the days leading up to the accident, in what would have been a high cognitive workload environment for the pilot, likely resulted in the pilot experiencing fatigue at a level known to affect performance.

Effects of workload and fatigue

Several factors increased the pilot’s workload at the time of the accident, including the conditions and inexperience. Those same factors and the high workload itself, combined with long flight and duty times in the preceding days, also likely contributed to the pilot experiencing fatigue.

The pilot had probably encountered similar environmental conditions while flying a piston-engine Cessna 188B aircraft in the previous weeks, but had more experience in that aircraft. That aircraft also had more docile stall characteristics and gave more warning of an impending stall. After commencing flying VH-ACQ 5 days before the accident, the pilot had demonstrated competence in that aircraft and operated it effectively, including spraying over 1,000 hectares in the previous 2 days. However, on the accident day, the pilot mishandled the aircraft during the turn. This handling error was likely a result of fixating on making the crop, and not monitoring the aircraft state or allowing adequate margin for the conditions. These errors and impaired awareness were consistent with the effects of both overload and fatigue.

Flight risk management

Management of fatigue is a shared responsibility between the aircraft operator and the pilot. Although the pilot had self-assessed as being tired on many occasions in the previous weeks, including the evening prior to the accident, there was no evidence this had been reported to the operator. Additionally, this tiredness had been noted in the evenings, following which there was a sleep opportunity for the pilot to recover (to some extent) before commencing the next morning.

Based on the regulatory duty time limitations, had the pilot been off duty for between 9 and 10 hours when they commenced on the morning of the accident, they were within a discretionary period that required a self-assessment of being mentally and physically fit to fly. The pilot commenced on the accident day close to the 10-hour rest period and it was unknown whether the pilot conducted this self-assessment. However, pilots were required to ensure they were fit to fly prior to every flight. There was also no evidence that the operator was aware the pilot had commenced duty on the accident day within or approaching the discretionary duty time window.

The aircraft operator’s operations manual stipulated that fatigue be managed in accordance with Civil Aviation Safety Regulations, which provided maximum flight and duty times (and minimum rest periods) for aerial application operations. However, there was no consideration of environmental conditions or experience – total aeronautical experience, aerial application flight hours, or hours in an aircraft model – nor how this may affect fatigue. Given inexperience and environmental conditions can increase fatigue, these factors in combination should be considered as part of fatigue risk.

Furthermore, fatigue risk is just one component of overall flight risk. A flight risk assessment provides a comprehensive assessment of factors that increase risk and the effect of combination of these factors. Although it was not required by regulations at the time, the aircraft operator had a safety management system. However, it did not include a flight risk assessment tool, which is a key component of a safety management system (FAA, 2016).

The 2014 US National Transportation Safety Board Special investigation report on the safety of agricultural aircraft operations outlined that risk management guidelines and best practices specific to agricultural aircraft operations were necessary to help operators and pilots mitigate their unique risks. These practices should include information and checklists for performing pre-flight risk assessments and identifying mitigation strategies.

A flight risk assessment tool specific for aerial application operations should include consideration of pilot (experience, recency, supervision, fitness to fly), aircraft (including role equipment), environment (weather, task, chemical, hazards) and operational pressures. Use of a flight risk assessment tool before commencing a flight also acts as a prompt for a pilot to reassess the risk when the considered factors change. Although the operator was attempting to manage the risk associated with inexperience, having a formal process may have integrated all the hazards present on the accident day. Had a flight risk assessment tool been available to the pilot on the accident morning, the combination of the weather conditions, inexperience, complexity of the task, absence of supervision, and probable fatigue, would have been expected to generate an elevated risk rating that would have required mitigation and/or approval for the pilot to conduct or continue the flight.

Survivability

The post-mortem examination identified that the pilot succumbed to the effects of fire. The fire was likely a hot, flash-over fire resulting from the rupture of the fuel tanks and misting of the fuel. Local workers who witnessed the accident were on site within minutes of the accident, however, the fire erupted within seconds of impact.

The tolerance of the human body to accident impact is a function of many variables, including individual characteristics, such as age, sex and general health. The restraint system significantly contributes to the overall probability of survival in an accident (Coltman and others, 1989). Contact injuries are reduced by 4-point (and 5-point) restraints and aviation-standard helmets. Restraints, energy-absorbing structure and seats reduce acceleration injuries. If these injuries do occur, they can contribute to fire-related fatalities and more serious injuries, by preventing self-extrication from an aircraft in the event of a post-impact fire.

An estimate of the impact forces, based on the bending of the pilot seat frame, indicated the accident would have likely resulted in severe injury. However, the pilot did not sustain impact-related injuries likely to have contributed to mortality. The pilot was almost certainly wearing a helmet and a 4-point restraint, and the cockpit maintained survivable space around the pilot’s torso. The crushing of the hopper and forward section of the aircraft likely absorbed a significant amount of the of the forward impact, aiding in reducing acceleration injuries.

Crash-resistant fuel systems

Air Tractor aircraft, like many others, use the aircraft wing structure as an integral fuel tank. The AT-400 fuel tank met or exceeded the certification requirements. In an impact with the ground, traditional aircraft wing structures are comparatively rigid and will rupture, allowing their fuel contents to escape. Due to the high fluid pressures generated inside the fuel tank in ground impacts, fuel forced through these ruptures tends to mist into a large cloud, which increases the risk of ignition and conflagrates quickly into a large encompassing fire.

An aircraft fuel tank lined with a crash-resistant bladder can be more resistant to spilling or leaking due to its ability to retain its contents if distorted. Being flexible, the bladder can withstand changes to its shape without rupturing or splitting. The bladder is also more tolerant of penetrating objects being able to deform around the intruding body to some extent. There have been no fatal or serious injuries to occupants as a result of post-impact fire in Robinson R44 helicopters in Australia since fitment of bladder tanks was mandated after a fatal accident in 2013. Prior to that time, accidents involving Robinson R44 helicopters without bladder tanks resulted in a significant proportion of post-impact fires. Of the (fixed-wing) aeroplanes involved in fatal accidents with post-impact fire in Australia between 2010 and 2022, 2 were fitted with fuel bladders. However, these were not made of crash-resistant materials.

Bladder tanks are one technology designed to improve crashworthiness of fuel systems. Crash‑resistant fuel systems reduce the risk of post-impact fire and provide occupants with more time to escape or be rescued. VH-ACQ was not fitted with crash-resistant fuel tanks or systems. The certification standards at the time the aircraft was manufactured did not require it, nor did the fixed-wing aircraft standards at the time of the accident. This differed from the requirements for rotary-wing aircraft.

The US National Transportation Safety Board and the Transportation Safety Board of Canada found a significant risk associated with post-impact fires in general aviation aircraft. As a result, they made recommendations to the US Federal Aviation Administration aimed at addressing the crashworthiness of fuel systems in these aircraft. A review of VH-registered aeroplane accidents in the ATSB occurrence database from 2010–2022 found a significant risk for post-impact fire fatalities, consistent with that previously identified in the US and Canada. Nearly 4% of the fatalities (5 fatalities in 10 years) in general aviation accidents in Australia were solely the result of the post impact fire. A fatality percentage of 5% was used by the Federal Aviation Administration to justify fuel system crash resistance tests and features for new helicopter designs.

The design principles and technologies for crash-resistant fuel systems exist and have been proven effective in helicopters and the automotive industry. Incorporating these in aeroplane design would reduce the risk of impact-induced fire in otherwise survivable accidents.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.  Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving Air Tractor AT-400, VH-ACQ, 75 km west-south-west of Moree, New South Wales, on 4 December 2021.  

Contributing factors

• The aircraft was too close to the start of the spray run during the turn, which probably resulted in the pilot tightening the turn. This almost certainly resulted in an aerodynamic stall at a height too low to recover before colliding with the ground.
• The pilot was likely experiencing high workload and fatigue due to long flight and duty times, inexperience, the complexity of the task and the weather conditions. The combined effects of these factors probably resulted in the pilot mishandling the turn.
• The aircraft’s integral fuel tanks ruptured during the accident sequence. This resulted in a fire which led to the pilot’s fatal injuries.

Other factors that increased risk

• The aircraft was not fitted nor required to be fitted with a crash-resistant fuel system under the current standards or those in place at the time of manufacture. As a result, post-impact fire presents a significant risk of fire-related injuries and fatalities to aircraft occupants. (Safety issue)

Other findings

• A flight risk assessment tool is used in some aerial work operations, however for aerial application operations it is not a requirement and generally not used. A flight risk assessment tool tailored to aerial application would likely have identified an elevated risk on the day of the accident, due to the combination of the pilot’s inexperience, weather conditions, complexity of the task, absence of supervision and probable fatigue.
• The pilot was almost certainly wearing a helmet and 4-point restraint increasing their chances of survival in an accident.

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. The directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation. Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Crash-resistant fuel system

Safety issue number: AO-2021-052-SI-01

Safety issue description: The aircraft was not fitted nor required to be fitted with a crash-resistant fuel system under the current standards or those in place at the time of manufacture. As a result, post-impact fire presents a significant risk of fire-related injuries and fatalities to aircraft occupants.

Safety recommendation description: The ATSB recommends that the United States Federal Aviation Administration take action to address certification requirements for crash-resistant fuel systems for fixed wing aircraft to reduce the risk of post-impact fire.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.

Additional safety action by Aircair Aviation Operations Pty Ltd (Aircair)

Aircair has considered whether there could be a risk associated with fatigue that does not necessarily correlate to flight and duty hours worked. As such, they are investigating if other means of measuring fatigue risk can be developed, such as a point score system that includes any other contributory factors such as conditions, experience, overall wellbeing and difficulty of the task. Further, they intend to explore technology available in modern cars and machinery that measures operator fatigue.

In August 2022, Aircair’s pilot group underwent advanced stall and spin prevention, recognition and recovery training with an experienced aerobatic instructor. Due to its success, Aircair is investigating ways of incorporating such training into its new pilot induction program.

Aircair recommended that the risks associated with mobile phone use in the cockpit (as referenced in the Aircair Operations Manual) are reiterated to pilots on a regular basis by way of pilot meetings and safety notices.

Aircair intends to ensure that pilots are regularly reminded of the possibility of becoming distracted by guidance systems and the impact this may have on safe operations. As part of this process, pilots should be reminded to only attend to GPS related issues when at a safe height above the ground.

Pre-application field inspections form a critical component for a safe application operation (particularly for unfamiliar fields). The requirement to conduct such inspections is set out in the Aircair Operations Manual and is tested during Aircair Operator Proficiency Checks (OPC). The importance of pre‑application field inspections will be reinforced to pilots on a regular basis by way of pilot meetings and safety notices.

Glossary

AAAA               Aerial Application Association of Australia

AFM                 Airplane Flight Manual

AIMS                Aerial Improvement Management System

CAM                 Civil Aeronautics Manual

CAR                 Canadian Aviation Regulation

CAS                 Calibrated airspeed

CASA               Civil Aviation Safety Authority

CASR               Civil Aviation Safety Regulations

CG                   Centre of gravity

EDT                  Eastern Daylight-saving Time

FAA                  Federal Aviation Administration

FAR                  Federal Aviation Regulation

FCM                 Flight crew member

IAS                   Indicated airspeed

ICAO                International Civil Aviation Organization

LOC-I                Loss of control in-flight

NASA               National Aeronautics and Space Administration

NPRM               Notice of proposed rule making

NTSB                National Transportation Safety Board

PSI                   Pounds per square inch

SMS                 Safety management system. A systematic approach to organisational safety encompassing safety policy and objectives, risk management, safety assurance, safety promotion, third party interfaces, internal investigation and SMS implementation.

TSB                  Transportation Safety Board (of Canada)

UTC                  Coordinated Universal Time

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• aircraft operator and chief pilot
• other company pilots
• Civil Aviation Safety Authority
• New South Wales Police Force
• aircraft manufacturer
• aircraft maintainer
• accident witnesses
• recorded data from the aircraft’s GPS units
• Bureau of Meteorology and Oz Forecast.

References

Air Tractor (2012). Service letter 304: Establishing and operating with a special purpose operating weight for Air Tractor aircraft.

Australian Transport Safety Bureau (2017). ATSB Safety Investigation. Canberra, Australia: ATSB.

Bafna, T. & Hansen, J. P. (2021). Mental fatigue measurement using eye metrics: A systematic literature review. Psychophysiology, 58(6), 13828-n/a. doi: 10.1111/psyp.13828

Beilock, S. L., Carr, T. H., MacMahon, C., & Starkes, J. L. (2002). When paying attention becomes counterproductive: Impact of divided versus skill-focused attention on novice and experienced performance of sensorimotor skills. Journal of Experimental Psychology: Applied, 8, 6-16.

Boksem, M. A. S., Meijman, T. F., & Lorist, M. M. (2005). Effects of mental fatigue on attention: An ERP study. Brain research. Cognitive brain research, 25(1), 107-116. doi: 10.1016/j.cogbrainres.2005.04.011

Byrne, A. J., Murphy, A., McIntyre, O., & Tweed, N. (2013). The relationship between experience and mental workload in anaesthetic practice: an observational study. Anaesthesia, 68(12), 1266-1272. doi: 10.1111/anae.12455

Caldwell, J. A., Caldwell, J. L., & Schmidt, R. M. (2008). Alertness management strategies for operational contexts. Sleep medicine reviews, 12(4), 257-273. doi: doi:10.1016/j.smrv.2008.01.002

Civil Aviation Safety Authority (2012). Fatigue Management Strategies for Aviation Workers: A Training & Development Workbook.

Civil Aviation Safety Authority (2020). Advisory Circular AC 61-16 v1.0: Spin avoidance and stall recovery training.

Coltman, J. W., Van Ingen, C., Johnson, N. B. & Zimmerman, R. E. (1989). Aircraft crash survival design guide: Volume II – Aircraft design crash impact conditions and human tolerance. US: United States Army Aviation Applied Technology Directorate.

Dawson, D., & Reid, K. (1997). Fatigue, alcohol and performance impairment. Nature, July 1997, 388:235.

Dodd, S., Lancaster, J., Miranda, A., Grothe, S., DeMers, B., & Rogers, B. (2014). Touch Screens on the Flight Deck: The Impact of Touch Target Size, Spacing, Touch Technology and Turbulence on Pilot Performance. Proceedings of the Human Factors and Ergonomics Society 58th Annual Meeting, 58(1), 6-10. https://doi.org/10.1177/1541931214581002

Eiband, A. M., Human tolerance to rapidly applied accelerations: A summary of the literature, NASA Memorandum 5-19-59E, National Aeronautics and Space Administration, Washington, D.C., June 1959.

Faber, L. G., Maurits, N. M., Lorist, M. M., & de Lange, F. P. (2012). Mental Fatigue Affects Visual Selective Attention. PloS one, 7(10), e48073-e48073. doi: 10.1371/journal.pone.0048073

Fan, J., & Smith, A.P. (2017). The impact of workload and fatigue on performance. Conference Paper in Communications in Computer and Information Science, June 2017. doi: 10.1007/978-3-319-61061-0_6

Federal Aviation Administration (2021). Airplane Flying Handbook, FAA-H-8083-3C. US: FAA. Retrieved from: Airplane Flying Handbook | Federal Aviation Administration (faa.gov)

Fletcher, A., Lamond, N., van den Heuvel, C., & Dawson, D. (2003). Prediction of performance during sleep deprivation and alcohol intoxication by a quantitative model of work-related fatigue. Sleep Research Online, 5(2), 67-75.

Fletcher, A. (1999). Measurement and management of work-related fatigue: Development and preliminary validations of a predictive model. Ph.D. Thesis, 1999, The University of South Australia.

Folkard, S., & Åkerstedt, T. (2004). Trends in the risk of accidents and injuries and their implications for models of fatigue and performance. Aviation, space, and environmental medicine, 75(3), A161-A167.

Gawron, V. J. (2016). Overview of self-reported measures of fatigue. The International Journal of Aviation Psychology, 26:3-4, 120-131. doi: 10.1080/10508414.2017.1329627  

Goode, J. H. (2003). Are pilots at risk of accidents due to fatigue?. Journal of safety research, 34(3), 309-313. doi: 10.1016/s0022-4375(03)00033-1

Green, R. G., Muir, H., James, M., Gradwell, D., & Green, R. L. (1996). Human Factors For Pilots (2nd ed.), Ashgate, England.

Harris, D. (2011). Human Performance on the Flight Deck. Ashgate, England.

Hawkins, F.H. (1993). Fatigue, Body Rhythms and Sleep. In H.W. Orlady (Eds.), Human Factors in Flight (2nd ed., pp. 56-83). Ashgate.

Heywood, B. (1999). Pilot Fatigue and the Limits of Endurance, Flight Safety Australia (1999, April). Retrieved from: https://skybrary.aero/sites/default/files/bookshelf/1080.pdf.

Hursh, S. R., Balkin, T. J., Miller, J. C., & Eddy, D. R. (2004). The fatigue avoidance scheduling tool: Modeling to minimize the effects of fatigue on cognitive performance. SAE transactions, 111-119.

InterDynamics (n.d.). FAID® Quantum Version 1.1 User Guide.

International Civil Aviation Organization (2020). Manual for the Oversight of Fatigue Management Approaches (Doc 9966).

Li, P. C., Wang, Y. X., Chen, J. H., Luo, Z. H., Dai, L. C. (2021). An experimental study on the effects of task complexity and knowledge and experience level on SA, TSA and workload. Nuclear engineering and design, 376, 111112. doi: 10.1016/j.nucengdes.2021.111112

Liu, C-C., Wang, C-Y., Shih, H-C., Wu, J. J-K., Huang, C-I., Hsu, H-S., Huang, M-H., Huang, M-H., Huang, M-S. (2009).  Prognostic factors for mortality following falls from height. Injury, International Journal of the Care of the Injured, 40 (2009) 595–597.

Mallis, M., Banks, S., Dorrian, J., & Dinges, D. F. (2022). Aircrew fatigue, sleep need, and circadian rhythmicity. In Keebler, J.R., Wilson, K.A., Lazzara, K.H., & Blickensderfer, E.L. (eds) Human Factors in Aviation and Aerospace (pp. 309-339). Academic Press.

National Aeronautics and Space Administration (2010). Human Integration Design Handbook (HIDH). Retrieved from: https://www.nasa.gov/sites/default/files/atoms/files/human_integration_design_handbook_revision_1.pdf

National Transportation Safety Board (1980). General Aviation Accidents: Postcrash Fires and How to Prevent or Control Them (NTSB-AAS-80-02).

National Transportation Safety Board (2014). Special Investigation Report on the Safety of Agricultural Aircraft Operations (NTSB/SIR-14/01). Retrieved from: https://www.ntsb.gov/safety/safety-studies/Documents/SIR1401.pdf

Orlady, H.W., & Orlady, L.M. (1999). Human Factors in Multi-Crew Flight Operations. Ashgate, England.

Papadimitriou-Olivgeris, M., Panteli, E., Koutsileou, K., Boulovana, M., Zotou, A., Marangos, M., Fligou, F. (2021). Predictors of mortality of trauma patients admitted to the ICU: a retrospective observational study. Brazilian Journal of Anesthesiology, 71 (2021) 23-30.

Perrella, W.M. Jr. (1978), Tests of Crash-Resistant Fuel System for General Aviation Aircraft, (FAA-RD-78-28), interim report prepared for the US Department of Transportation, Federal Aviation Administration.

Petrilli, R.M.A., Roach, G.D., Dawson, D., & Lamond, N. (2007). The sleep, subjective fatigue, and sustained attention of commercial airline pilots during an international pattern. Chronobiology International, 23(6): 1347–1362. doi: 10.1080/07420520601085925

Riethmeister, V., Matthews, R. W., Dawson, D., de Boer, M. R., Brouwer, S., & Bültmann, U. (2019). Time-of-day and days-on-shift predict increased fatigue over two-week offshore day-shifts. Applied ergonomics, 78, 157-163. doi: 10.1016/j.apergo.2019.02.010

Roach, G.D., Petrilli, R.M.A., Dawson, D., & Lamond, N. (2012). Impact of layover length on sleep, subjective fatigue levels, and sustained attention of long-haul airline pilots. Chronobiology International, 29(5): 580–586. doi: 10.3109/07420528.2012.675022

Rosa, E., Eiken, O., Grönkvist, M., Kölegård, R., Dahlström, N., Knez, I., ... & Willander, J. (2020). Effects of fatigue on cognitive performance in long-duration simulated flight missions. Aviation Psychology and Applied Human Factors, 10(2), 82. doi: 10.1027/2192-0923/a000191

Skybrary (2010). Workload (OGHFA BN). Skybrary. Retrieved  from: https://www.skybrary.aero/index.php/Workload_(OGHFA_BN)

Tran, Y., Craig, A., Craig, R., Chai, R., & Nguyen, H. (2020). Psychophysiology 57(5), e13554-n/a. doi: 10.1111/psyp.13554

Transportation Safety Board of Canada (2006). Post-impact fires resulting from small-aircraft accidents, (SII A05-01).

Tucker, A. (2015). JHC Commanders’ Guide to Fatigue Management. Retrieved from: https://www.aviation.govt.nz/assets/licensing-and-certification/medical/jhc-commanders-guide-to-fatigue-management.pdf

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the aircraft operator
• the aircraft maintainer
• Civil Aviation Safety Authority
• US National Transportation Safety Board
• Transportation Safety Board of Canada
• Pratt & Whitney Canada
• US Federal Aviation Administration
• Air Tractor Incorporated
• Satloc.

Submissions were received from;

• the aircraft operator
• the aircraft maintainer
• Civil Aviation Safety Authority
• US National Transportation Safety Board
• US Federal Aviation Administration
• Pratt & Whitney Canada
• Transportation Safety Board of Canada
• Air Tractor Incorporated
• Satloc.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A – Hoerner wingtips

Hoerner wing tips Hoerner wing tips were designed to increase wing efficiency, by increasing the effective wing span beyond the actual length of the wing. Effects of this include reduced stalling speed and improved take-off performance. Hoerner wing tips were not an option for AT-400 aircraft, however, in subsequent Air Tractor models, they were either factory-fitted or offered as a post-factory modification. From Air Tractor regarding the AT-402B: ‘We designed a long, high-aspect ratio wing with Hoerner wing tips to increase wing efficiency, reduce drag and to lower stick and rudder forces so the controls are light and responsive, greatly reducing pilot fatigue.’

Appendix B – Post-impact fire mortality

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the night of 19 August 2021, the pilot of a Hawker Beechcraft King Air B200C aircraft, registered VH‑VAH and operated by Pel-Air, commenced the take-off from Essendon Fields Airport, Victoria on a medical retrieval flight to Albury, New South Wales. During the take-off, there was a reduction in power on the left engine and an uncommanded left yaw. The pilot initially managed the situation as an engine power loss and focused on maintaining directional control. However, when troubleshooting, the pilot identified that the left engine power lever had migrated rearwards to the idle position. In response, the pilot moved the power lever back to take‑off power and adjusted the friction lock to prevent further movement. The flight continued to Albury without further incident.

What the ATSB found

The ATSB found that the left engine power lever had migrated rearwards as the friction lock had not been sufficiently adjusted during the pre-flight checks. It was also established that power lever friction locks fitted to the Beechcraft King Air series aircraft required careful adjustment to prevent power lever migration, particularly during take-off. This was more prominent on the left engine, which was a characteristic generally known among King Air operators and pilots.

What has been done as a result

The operator provided additional training to all King Air pilots to demonstrate how the power lever system operated, when power lever migration could occur, and how to check that the friction locks were adequately adjusted to ensure the levers remain at take-off power. A component on friction locks was also included in the King Air pilot ground school training. In addition, the operator published a notice to air crew, which stipulated that all take-offs on sealed runways must be conducted using a standing start take-off. Further, the operator amended the take-off checklist for a standing start to include checking the friction locks to prevent a power lever migration during the take-off sequence.

The ATSB has released a safety advisory notice to all operators and pilots of King Air aircraft advising of power lever migration and the need to be aware of the careful adjustment required for the power lever friction lock.

Safety message

This incident highlights the importance of having a detailed understanding of the characteristics that may be specific to an aircraft type. In the case of the King Air series of aircraft, the design of the power lever system meant that the friction locks required careful adjustment to prevent power lever migration particularly during take-off.

The occurrence

On 19 August 2021, a Hawker[1] Beechcraft B200C King Air aircraft, registered VH-VAH and operated by Pel‑Air, was scheduled to depart Essendon Fields Airport, Victoria on a medical retrieval flight to Albury, New South Wales. On board was a pilot, paramedic, and doctor.

At about 2300 Eastern Standard Time,[2] the pilot began to prepare the aircraft for departure as per the before engine starting checklist. One of the requirements was to set the power lever friction locks. The pilot recalled moving the power levers to the mid-range position to gauge their movement and adjusted the friction locks to establish adequate friction. They also recalled that their usual practice was to check the friction locks were correctly set before take-off.

Soon after, the aircraft was taxied to the runway and the pilot commenced a rolling take-off with their left hand on the control column and right hand on the power levers. When at about 94 kt, the pilot moved their right hand onto the control column and rotated the aircraft. When about 50 ft above ground level, the aircraft suddenly yawed left. Automatic dependent surveillance-broadcast data showed the aircraft tracking immediately left from the runway. The paramedic also recalled being pushed to the right and the aircraft not being aligned with the runway. The pilot looked at the engine instruments and observed that the left engine was showing a power loss, but the right engine appeared to be producing take-off power. Based on these indications, the pilot managed the situation as an engine power loss.

The pilot recalled focusing on maintaining directional control by applying right aileron and rudder. They then assessed the reason for the power loss and whether the propeller was feathered,[3] which they believed it was not. The pilot scanned the cockpit again and observed that the left power lever had migrated rearwards towards the idle position. While moving the left power lever back in-line with the right power lever, the aircraft yawed right as the pilot was still applying right rudder. The power increased on the left engine, the pilot reduced application of right rudder and retracted the landing gear. Immediately after, the left power lever started moving rearwards again. The pilot re‑tightened the friction lock on the left power lever, which resolved the issue. At that time, the aircraft was climbing through 200-300 ft. The paramedic reported that the pilot said the power lever had migrated as the friction lock had not been correctly set.

The flight continued to Albury without further incident. The pilot noted the power lever migration on the aircraft’s maintenance log as that they believed the friction lock was not adequately functioning. The subsequent engineering inspection did not find any technical issues with the power lever assemblies and friction locks.

Context

Pilot information

The pilot held a valid Air Transport Pilot Licence (Aeroplane), multi-engine command instrument rating, and a type rating for the B200C obtained in July 2021. At the time of the incident, the pilot had accrued about 16,000 hours of total aeronautical experience, of which 42 hours were in the B200C.

Engine controls

The aircraft’s engines were controlled using 3 sets of levers located on the centre pedestal.

• The 2 power levers controlled engine power from the idle position through to take-off power. When the levers were lifted and pulled aft over a gate, they controlled engine power for taxi operations, and over another gate for propeller reverse thrust to slow the aircraft after landing.
• The 2 propeller levers controlled propeller speed (rpm). The propellers could be feathered by moving the relevant lever past detents and back to the aft most position.
• Condition levers were used to select high or low idle, and to shut the engines down.

Friction locks

Four friction locks were located on the engine control pedestal. One each for the left and right power levers, one for the propeller levers, and one for the condition levers (Figure 1). The friction lock assemblies consisted of an adjustment mechanism, a phenolic drum, and a friction band. When the friction lock was rotated clockwise, the band around the phenolic drum tightened, which increased the friction between the 2 parts. The respective lever would become progressively resistant to movement, preventing the lever from moving out of position. When rotated counter‑clockwise, the lever moved freely. The design of the friction lock had been used since the 1965 model 88 Queen Air through to current production King Air aircraft.

Figure 1: Engine control levers and friction locks

Source: Pel-Air and Textron Aviation, annotated by the ATSB

A characteristic of the King Air friction locks was that they required careful setting as some aircraft had a narrow range between no friction and too much friction. The operator reported that there was no consistency in setting friction locks for a desired resistance between power levers in the same aircraft and other aircraft, and this changed over time due to wear. Worn friction locks were required to be replaced.

The maintenance log for the aircraft indicated that the left and right power lever assemblies, including both friction locks, were replaced in November 2020 after being observed to be worn, resulting in a reduced range of adjustment. Before the assemblies were replaced, pilots had reported to engineering staff that the friction locks were difficult to adjust.

The operator’s Flight Crew Operating Manual for the B200C aircraft included the following checklists where the friction locks were to be checked by the pilot prior to take-off:

• Internal daily inspection: This checklist was completed prior to the first flight of the day[4] and included checking the power levers friction lock settings in the idle position.
• Before engine starting: After the first flight of the day, the internal daily inspection was replaced by the ‘before engine starting’ checklist, which included a scan procedure beginning at the left side of the cockpit. This checklist required the power levers to be at idle and the friction lock setting checked. Further detail on how to adjust the friction locks was also included:

Place the power lever to the approximate position for take-off power and let go. If they roll back, set them again but tighten the friction.

The power levers have a spring retention configuration that increases resistance the more the levers are advanced. The result of this is the roll back of power levers if the friction lock is set too loose.

• Before take-off: In the before take-off checklist, the pilot would check the friction locks were set. After this, there was no further requirements to check the locks.

These checklists were consistent with the manufacturer’s Pilot Operating Handbook. The ATSB noted that the handbook did not contain further detail on how to adjust the friction lock and the potential for power lever migration.

The operator advised the ATSB that in 2019, there were a number of reported rejected take-offs with serviceable aircraft with no faults found, which were assessed to be related to friction locks not being set correctly prior to take-off. As a result, the operator published an operations note to pilots about friction locks in the before take-off check for the King Air aircraft, with details about their proper adjustment. It was unknown if the incident pilot, who had commenced with the operator in 2021, was aware of this notice.

Power lever migration

Power lever migration on the King Air referred to an uncommanded spring back or migration of the lever towards the idle position. This was typically experienced when the pilot removed their hand from the levers during take-off. If unnoticed, this could result in the aircraft yawing towards the engine experiencing the power lever migration, a significant loss of propeller torque on that engine, and the auto-feather system disarming.[5]

This migration occurred when the friction locks were not appropriately set, and could affect King Air 90, 200 and 300 series aircraft. The propeller and condition levers were not susceptible to migration.

The cockpit to engine nacelle power lever control cables were connected to a cam assembly on the right side of each engine via a lever. This lever was spring loaded towards idle to prevent an uncommanded acceleration in the event of a power lever cable malfunction that could damage the engine when torque and temperature limits were exceeded. The springs also reduced the effect of hysteresis[6] when power was reduced, which could cause the rate one engine’s power reduced relative to the other to be different. An additional spring could be fitted during production or maintenance to further balance the rate of power reduction between both engines. This additional spring was not fitted to the incident aircraft. The effect of the springs migrating the power levers toward idle during normal operations was overcome by setting the friction locks.

In addition, as the power lever cables were connected to the right side of each engine, the cable for the left engine was shorter than the right, and therefore less affected by hysteresis. Due to this, if the friction locks were not correctly set, the left power lever could migrate further aft than the right, resulting in an uncommanded left yaw. The operator demonstrated this on the ground without the engines running. With both power lever friction locks loosened and the levers full forward, when they were released the left engine power lever migrated further aft than the right (Figure 2).

Figure 2: Power lever migration demonstration

Source: Pel-Air, annotated by the ATSB

Prior to the incident, the operator’s training for pilots converting to the B200C was limited to the operation of the friction locks. At interview, the pilot reported that they were new to the B200C aircraft type and unaware that power lever migration could occur during take‑off. Another pilot from the operator noted that, until a pilot experienced a power lever migration, then it could be difficult to know how much to tighten the friction locks.

In addition, the King Air magazine included articles that emphasised the importance of adjusting the friction locks adequately to avoid power lever migration. The articles also described techniques to check that the friction locks were set sufficiently to prevent migration.

Similar occurrences

A review of the ATSB database did not find any reported occurrences involving power lever migration on the King Air series aircraft relating to the adjustment of the friction locks, but the manufacturer stated that they had received such reports. Likewise, the operator’s pilots interviewed recalled they had experienced or heard of others having a similar event. The operator’s senior base engineer also indicated that power lever migration was a known issue.

A review of the operator’s safety management system database found 10 reports from the previous 5 years, 6 of which involved VH-VAH. For example, on 18 August 2021 (the day prior to the incident), VH-VAH was being operated on a patient transfer flight. During take-off, the aircraft lost partial engine power and yawed left. This occurred due to the left power lever migrating aft when the pilot under check moved their hand to the control column to rotate the aircraft. Both the check captain and the pilot under check immediately identified the reason for the loss of power. The check captain moved the power lever forward to full power while the pilot under check applied right rudder to maintain control, retracted the landing gear, and adjusted the friction lock when the aircraft was at safe height. The flight continued without further incident.

In addition, the operator advised the ATSB of another power lever migration occurrence involving a B200 aircraft after the occurrence that was the subject of this investigation. On 31 September 2022, the aircraft was being operated on a patient retrieval flight. During the take-off roll, the pilot detected a migration of the left power lever, resulting in an uncommanded yaw left. This occurred at about the time when the pilot removed their hand from the control column. The pilot rejected the take-off and the aircraft subsequently impacted the runway edge lights.  Engineers replaced the throttle quadrant and the throttle friction assembly. Based on this event, the operator is conducting a review of their take-off procedure including simulator testing and research.

The ATSB also contacted another B200 operator who recorded 4 reports of power lever migration over the previous 5 years.

A review of the United States Aviation Safety Reporting System database found 3 reported power lever migration occurrences due to friction lock adjustment since 1988. In addition, there have been 2 notable international investigations where this was identified as a potential factor that contributed to the accident involving a King Air (detailed below).

UK Air Accidents Investigation Branch investigation (7/2003)

On 23 December 2000, a Beechcraft B200 aircraft departed Blackbushe, United Kingdom to Palma, Spain on a private flight. Shortly after take‑off, the aircraft was observed to bank left before colliding into a factory complex 13 seconds later, resulting in a fire. All on board were fatally injured.

An examination of the aircraft did not identify any technical issues that would have contributed to the accident. However, analysis of the cockpit voice recorder showed a reduction in one of the propeller’s rpm as the aircraft rotated, which would have led to thrust asymmetry. The investigation concluded that, it was probable a migration of a power lever due to insufficient friction being set had occurred. It was also noted that the friction control had been slackened during recent maintenance and it was possible that it was not adjusted adequately by the pilot when doing their checks prior to take-off. As a result of the investigation, a safety recommendation was made to Raytheon Aircraft Company:

The Raytheon Aircraft Company should ensure that reference to the correct adjustment of power lever friction is suitably emphasised in the Beech 200 Aircraft Operating Manual (AOM) and the consequences of insufficient adjustment are not only highlighted in the AOM but also included in the recommended Beech 200 type training syllabus.

The ATSB was unable to find any follow-up action on this recommendation recorded in the investigation site.

US National Transportation Safety Board investigation (CEN19MA190)

On 30 June 2019, a Beechcraft King Air 300 departed Addison, Texas, United States, on a private flight. During take-off, the aircraft was observed to roll left before reaching a maximum altitude of 100 ft above ground level. It then descended and collided with a hangar in an inverted attitude about 17 seconds after take-off. All on board were fatally injured.

Analysis of the cockpit voice recorder showed that 7 seconds after take-off, the propeller speeds diverged, with the left propeller speed decreased to 1,688 rpm and the right propeller speed decreased to 1,707 rpm. An engineering examination did not identify any technical issues with the aircraft, but other evidence suggested a loss of thrust in the left engine was most likely experienced shortly after take-off.

While the reason for the reduction in thrust could not be conclusively determined, the investigation considered inadequate friction setting the most likely cause. It was noted that other circumstances, such as a malfunction within the power control system could have also resulted in a loss of engine thrust. However, the extent of damage to the power control system precluded determining the position of the power levers at the time of the loss of thrust or the friction setting during the flight.

Safety analysis

Uncommanded left yaw

Just after take-off at night, the pilot reported that the aircraft suddenly yawed left. This was consistent with the recorded flight path and the paramedic’s observations. When the yaw occurred, the pilot’s immediate response was to manage the situation as a left engine failure by applying right rudder and aileron to maintain directional control. The pilot then noticed the left power lever had migrated to the idle position and responded by pushing the power lever forward. After resetting the power lever friction lock, the flight continued without incident.

Insufficient friction applied

The friction locks were adjusted by the pilot to a level they believed to be sufficient prior to take-off.  However, as the post-flight engineering inspection did not find any technical issues with the power lever and friction lock assemblies, and the left power lever had migrated twice during the take-off sequence, it was likely that the friction lock had not been sufficiently set during pre-flight checks. This was consistent with the paramedic’s recollection of the pilot indicating that the friction lock had to be re-set.

King Air friction lock characteristics

Due to the spring loading of the power levers on the King Air series aircraft, there was a tendency for the levers to migrate towards the idle position, particularly during take-off, if the friction locks were not appropriately set. This was more prevalent on the left power lever due to the shorter length of its cable. There was also an awareness of the possibility of a narrow range of adjustment, inconsistency in friction lock settings between the left and right engines, and from aircraft to aircraft, which could change due to wear.

While the incident pilot was not aware of the possibility of power lever migration, the need to carefully adjust the friction locks to prevent migration was more broadly known by B200C pilots and operators. This characteristic had been experienced among different operators and pilots as demonstrated in the reported occurrences and had also been considered as a potential factor in two fatal accidents.

Findings

From the evidence available, the following findings are made with respect to the uncommanded power reduction involving Hawker Beechcraft King Air B200C, VH-VAH, Essendon Fields Airport, Victoria, on 19 August 2021.

Contributing factors

• During a night take-off from Essendon Fields Airport, the left-engine power lever migrated to idle, which resulted in an uncommanded left yaw.
• During the pre-flight checks, it was likely that the pilot applied insufficient friction to prevent the left power lever migrating.
• The power lever friction locks fitted to the Beechcraft King Air series aircraft required careful adjustment to prevent power lever migration during take-off, particularly on the left engine. This characteristic was broadly known among operators and pilots.

Safety actions

Safety action by the Pel-Air

As a result of the incident, Pel-Air undertook the following safety actions.

Training

The engineering department and flight operations manager provided additional training to all King Air pilots demonstrating how the friction lock system worked, how power lever migration could occur, and how to check the friction locks were adequately adjusted. In addition, a course on power lever migration has now been included as part of the ground school pilot training for the King Air aircraft.

Revised take-off procedure

The day after the incident, the operator published a notice to air crew, which stipulated that all take-offs on sealed runways must be conducted using a standing start take-off. Further, the take‑off checklist for a standing start in the Flight Crew Operations Manual was amended to include a requirement for pilots to check that the friction locks were set to prevent power lever migration when take-off power had been set.

Safety advisory notice to King Air series aircraft operators

The Australian Transport Safety Bureau advises pilots and operators of the King Air series aircraft (90, 200, and 300) that the power lever friction locks require careful adjustment to prevent power lever migration towards the idle position, particularly during take-off. Inadvertent migration of one power lever towards idle can result in power reduction and yaw that, when occurring at low height, can result in catastrophic outcomes. Operators should ensure pre-flight checks provide opportunities to confirm friction lock settings before the take-off run, and ensure pilots have adequate knowledge of friction lock sensitivity to help prevent and recover from inadvertent power lever migration.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot
• the paramedic
• Pel-Air
• Textron Aviation (type certificate holder)
• United States National Transportation Safety Board.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the pilot
• the paramedic
• Pel-Air
• Textron Aviation
• United States National Transportation Safety Board.

A submission was received from Pel-Air. The submission was reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

In the early afternoon of 19 June 2020, the pilot of an RF Designs Mephisto, remotely piloted aircraft (RPA), was conducting test flights following aircraft maintenance. After completing a successful autonomous test flight, the pilot toggled the automatic mode switch to disengage the aircraft’s automatic mode for taxi back to the hangar.

The pilot then increased the throttle to provide the aircraft with sufficient momentum to taxi. As the aircraft turned towards the pilot, they determined that the aircraft was not responding to commands to reduce the engine thrust. The pilot considered attempting to arrest the aircraft by hand but determined it was moving too quickly and instead toggled the automatic mode switch to regain control of the aircraft and turn it away from bystanders.

The pilot then directed the aircraft across the airfield and it came to rest against the perimeter fence, resulting in minor damage to the aircraft’s skin.

What the ATSB found

The ATSB determined that, following the autonomous flight, the pilot did not correctly disengage the aircraft’s automatic mode. Subsequently, when they increased the throttle to provide the aircraft with momentum to taxi back to the hangar the ’abort landing’ function activated, increasing the throttle to maximum and overriding the pilot’s commands to decrease throttle. The pilot was able to deactivate the ’abort landing’ function by toggling the automatic mode switch.

It was determined that the pilot did not identify visual, audible and tactile cues that indicated the aircraft had not exited the automatic mode prior to increasing the throttle for taxi. The most likely reason for this was that they were experiencing a level of fatigue known to impact performance.

Additionally, the pilot’s controller utilised switches with 3‑positions for 2‑position (on – off) roles, increasing the likelihood of incorrect or incomplete selection. The controller also lacked the means to enable the pilot to immediately shut down the aircraft’s engine.

What has been done as a result

In response to this incident the operator implemented several changes to their systems and procedures. They advised that 3‑position switches on the aircraft controllers, which were being used for 2‑position roles, have been replaced with 2‑position switches. A formalised taxi-in procedure has been introduced that requires personnel to shutdown aircraft on the runway and push them to the hangar by hand. A gated switch was installed on the remote controller that was capable of overriding all other controls, placing the flight controller into manual mode and commanding the throttle to shut down the turbine engine.

For subsequent operations the flight test timeline was increased from 7 to 10 days with no increase in workload. The additional time was to allow for aircraft setup and testing prior to operations commencing and to ensure that all crew members were provided with adequate rest and recovery time during both setup and operations.

Safety message

This incident has 3 key learnings for RPA operators:

• Fatigue is a risk, particularly in high tempo commercial operations. Even when fatigue management is not mandated, operators should ensure that their fatigue management processes are robust and effective.
• All controls for RPA’s should be as simple and reliable as possible. If a control leaves room for human error, then it will increase the risk of this error occurring even if procedural controls are in place. Consideration should also be given to a system that allows the remote pilot to shut down the aircraft immediately in the event of an unexpected state or failure.
• Operators should be prepared for the RPA to do something unexpected and know and frequently practice emergency procedures.

The occurrence

On the weekend of 13‑14 June 2020 a team of remote pilots and maintainers from Remote Piloted Systems (the operator), RF Designs (the maintainer) and a client company arrived at Bruhl Airfield, 2 km south-west of Tara, Queensland (Figure 1). Over the weekend they set up and prepared for a week of test flying of two autonomous test bed aircraft, the RF Designs Albatross and the RF Designs Mephisto (Mephisto). The aircraft were assembled, following disassembly for transport, and systems tested prior to operations commencing on the Monday morning. This work was overseen by the operator’s chief remote pilot (CRP) and a senior manager of the maintainer.

Figure 1: Location of Bruhl Airfield

Source: Google Earth annotated by the ATSB

Throughout the following week the team conducted multiple test and evaluation flights for the client each day. These usually involved multiple aircraft and multiple pilots through the launch (take-off), mission, and recovery (landing) phases.

On the morning of Friday 19 June, the final operational flights were carried out for the client company. Following this, the client’s personnel commenced packing up and preparing to depart the site. With all relevant permissions and approvals in place, the operator’s CRP took the opportunity to conduct post maintenance test flights on Mephisto HP001, to ensure that it was airworthy and prepared for future operations. During the week, HP001 had undergone maintenance which included the aircraft’s flight controller being removed and reinstalled following its use in another Mephisto aircraft.

The flight plan for the test consisted of two flights, testing all three of the aircraft’s modes (see the section titled Aircraft operations), and the flight controller setup and tuning. The first flight was to involve a launch in manual mode, followed by a circuit and recovery in fly by wire (FBW) mode. If the results of this flight were acceptable the aircraft was to be repositioned to the western end of the runway for the second flight. There it would be transitioned to autonomous mode and conduct a fully autonomous launch, circuit, and recovery.

At 1242 Eastern Standard Time,^[1] HP001 was launched, with both flights completed without incident. Figure 2 shows the Global Positioning System (GPS) tracks of the aircraft during the first and second flights with the track colour indicating the aircraft’s mode. Figure 3 shows the transition between the flights and the completion of the second flight, the initial taxi, loss of control and the recovery.

Figure 2: Mephisto test flights 19 June 2020

Source: Google Earth and operator annotated by the ATSB

Following the autonomous recovery at the conclusion of the second test flight, the pilot attempted to transition the aircraft out of the autonomous mode and back into manual mode for taxi to the hangar. The pilot toggled the automatic mode switch and increased the throttle setting to provide thrust to taxi the aircraft. Once the aircraft had sufficient momentum to allow for the taxi the pilot attempted to reduce the throttle setting. However, the aircraft did not respond to the pilot’s commands and the turbine engine continued to accelerate.

The aircraft was now in relatively close proximity to the pilot and moving towards other personnel who had been observing from nearby. The pilot considered arresting the aircraft by hand but, due to the aircraft’s speed and momentum, they determined that was not practical. The pilot re‑toggled the automatic mode switch, allowing them to regain control. With the aircraft back under control, the pilot directed the aircraft across the runway to the southern side of the airfield away from the hangar and personnel. The aircraft was arrested, at low speed, by the airfield boundary fence.

The aircraft was then attended by the pilot and several other personnel who conducted a normal shutdown before pushing it back to the hangar for inspection. The inspection determined that the aircraft only had minor damage to the skin due to the impact with the fence.

Figure 3: Mephisto test flight 2 - occurrence flight

Source: Google Earth and operator annotated by the ATSB

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours

Context

Aircraft information

The RF Designs Mephisto remotely piloted aircraft (RPA) (Figure 4) is a high-performance autonomous testbed aircraft. First flown in 2019, it is based on the CARF-Models Mephisto large model aircraft and modified by RF Designs at their facility in Brisbane. These modifications included a flight controller, additional fuel tank, additional shielded wiring, and some larger and more robust control components, all allowing for autonomous test operations.

Figure 4: RF Designs Mephisto

Source: RF Designs

The aircraft, which can be disassembled for transport, is a composite construction of carbon fibre and fibreglass, 3.1 m long, with a wingspan of 2.6 m. It has a maximum take-off weight of 35 kg, retractable undercarriage and flaps and is powered by a Kingtech K260G2 turbine. Delivering 26 kg of thrust, the turbine can propel the aircraft to a maximum speed of 85 m/s (165 kt) and an altitude of more than 5,000 feet.^[2]

The client owned a fleet of 6 of the aircraft that were operated and maintained by Remote Piloted Systems and RF Designs respectively. Of the fleet, 5 were operationally capable (Figure 5), and 1 (HP001) was used for testing and training.

For the week of 15‑19 June the operator brought 4 of the fleet to conduct operations for the client, 3 operational Mephistos and the test and training aircraft for backup and spare parts.

Figure 5: Operational Mephisto fleet

Source: RF Designs

Aircraft operations

The Mephisto could be operated in three different modes, manual, fly by wire (FBW) or automatic.

In manual mode the remote pilot in command (RPIC) had full control over all aircraft functionality with no interaction from the flight controller’s stabilisation programming. This required that the aircraft be manually trimmed and stabilised by the RPIC. In FBW mode the RPIC commanded the aircraft directly, however, the flight controller’s stabilisation programming interpreted and implemented these commands to ensure stable flight. This meant that if the pilot removed control input, then the aircraft would continue in straight and level flight.

Finally, in automatic mode a flight plan consisting of a series of waypoints was programmed into the flight controller using the ground control station (GCS). When the RPIC activated the automatic mode and the flight plan, the flight controller commanded the aircraft through the programmed waypoints with full control over aircraft systems. When the automatic mode was disengaged the aircraft’s systems return to the settings commanded by the RPIC’s controller.

The crew of the Mephisto consisted of two remote pilots - the launch and recovery pilot (LRP) and the GCS operator. The pilot who was actively flying the aircraft was designated the RPIC. For the autonomous flights the RPIC was the GCS operator as they were monitoring the flight and had the ability to intervene and take control of the aircraft if required.

The LRP primarily conducted launches and recoveries and operated the aircraft in manual or FBW mode within visual line of sight. This usually involved flying the aircraft to or from a holding point where it was transitioned to or from the command of the GCS operator for automated flight.

The GCS operator monitored aircraft systems during all flights, conducted flights beyond visual line of sight (BVLOS) and monitored automatic flights. Due to the difference in their roles the LRP and GCS operator were located at different points on the field (Figure 3). The LRP was on the flight line next to the runway providing them the best view of the aircraft for launch and recovery. The GCS operator worked from inside a hangar which provided a more stable environment for the equipment used to monitor and control the aircraft while away from the launch and recovery location. Due to their physical separation, the pilots communicated via radio.

Due to the risk to the aircraft of an inadvertent mode change when transitioning from the GCS operator to the LRP following a flight, a specific process was used for the handover. This process started after launch once the LRP handed over control to the GCS operator. At this point, the LRP would place the automatic mode switch (see the section titled Remote controller) on their controller in ’auto on’ and set the flaps to fully retracted.

At the time of the occurrence, following the automated test flight, the GCS operator had handed control back to the LRP for taxi. The pilot advised that prior to the hand over their controller had been set up with the automatic mode switch selected to ’auto on’ and the flap control in the fully retracted position.

Flight controller

Each Mephisto aircraft was fitted with a Pixhawk 2 flight controller, which was programmed with ARDUpilot software to enable flight in all modes. The flight controller recorded a range of parameters which could be downloaded and used for simulation, recreation, and analysis.

The flight controller received a constant stream of data from a range of inputs including control inputs from either the LRP remote controller or GCS, GPS information, airspeed and engine fuel flow. It then controlled the aircraft via a series of servos that manipulated the aircraft flight control surfaces and turbine engine controls.

Abort landing command

The ’abort landing’ command within the flight controllers programming allowed the GCS operator or LRP to abort an autonomous landing via the remote controller or GCS. The LRP controller triggered the command when 3 criteria were met.

- The aircraft was in the autonomous mode.
- The aircraft was in the landing stage.
- The throttle on the LRP controller was increased above 90 %.

When these criteria were met the aircraft overrode control inputs, increased turbine power to the take-off throttle setting (100 %), pitched up and maintained the current heading until a target altitude was reached.

Remote controller

To control the Mephisto the LRP used a TARANIS X9D Plus hand-held controller, manufactured by FrSKY. The TARANIS X9D Plus (Figure 6) was a programmable, 24 channel, 2.4 GHz transmitter that could be used to control a range of remote devices, including RPA. The controller had 8 programmable control switches, (6 3-position and 2 2-position) that the user could assign to modes or operational settings.

For this operation, to ensure redundancy, the 2 position switches activated the ’return to launch’^[3](RTL) function. This meant that 3 position switches were used to control the aircraft’s modes. To reduce risk of the automatic mode being inadvertently deactivated the modes were switched separately. One switch controlled the automatic mode (on and off) and the other selected manual or FBW. The control hierarchy placed the automatic mode switch above the manual or FBW switch so an inadvertent movement of the manual or FBW switch would not disengage the automatic mode.

Figure 6 shows the location of these switches. The operation of any of these switches required a defined movement and the pilot described that changing between positions made an audible ’click’.

The automatic mode switch was configured with 2 ’auto on’ and 1 ’auto off’ position, which was the top position. This configuration had recently been updated from 1 ’auto on’ and 2 ’auto off’ positions. This change was due to a risk to the aircraft associated with inadvertent deactivation of the automatic mode during flight, particularly when the aircraft was BVLOS. To ensure that the switch was in the correct position it was normal for pilots to drive the switch to an end point of the control to ensure that the desired mode had been selected.

The LRP controller was not fitted with the ability to activate the aircraft’s flight termination system (FTS) (see the following section titled Flight termination systems and active failsafe) or operate as a ’kill switch’, cutting power the aircraft’s engine. In the event that the LRP required the FTS to be activated they would request the GCS operator activate it.

Figure 6: TARANIS X9D Plus with key controls identified

Source: FrSKY annotated by the ATSB

Flight termination systems and active failsafe

Under the Civil Aviation Safety Authority (CASA) permission for the operation (see the section titled Operational information) the aircraft was required to be fitted with a primary active failsafe system and primary and secondary flight termination systems. The primary active failsafe system was designed to ensure that the aircraft did not depart the operational area in the event of a communications loss with the controller. It was designed to return the aircraft to either the launch point or some other holding point within the operational area that allowed the RPIC to conduct necessary checks and perform relevant actions to re-establish communications. If necessary, the system could be activated by the LRP, GCS operator or automatically if the aircraft exited the operational area. The aircraft’s RTL function met this requirement.

The FTS was a secondary level of control that was activated if the primary active failsafe failed or was unable to return the aircraft to a stable location. The system worked by bringing the aircraft to the ground as quickly and as safely as possible, with the main aim of protecting personnel and property. In the case of the Mephisto, the FTS was set to place the aircraft flight control surfaces in a configuration to induce a spin and cut fuel to the engine. This arrested as much forward momentum as possible prior to impact with terrain. The FTS was activated by either the GCS on a dedicated control link or automatically if the aircraft departed a contingency area around the operational area.

CASA specifically stated that the FTS was not intended for use on the ground. However, the system’s process meant that, in the event of an issue on the ground, it would provide a way to rapidly arrest momentum of the aircraft and put it into a known state.

At the time of the incident the aircraft in question was fitted with both the primary active failsafe and FTS. However, due to the rapid development of the aircraft the flight manual had not been updated and contained information that the flight termination system had not been fitted and remained in development.

Operational information

The operator, maintainer and client company had been conducting BVLOS, autonomous and multi-aircraft test flights from Bruhl airfield since November 2019. They had been using a range of smaller, primarily electrically driven aircraft types and recently began using the Mephisto, to allow for higher performance operations and testing.

Bruhl airfield, located approximately 265 km west-north-west of Brisbane Airport (Figure 1), was chosen for 3 reasons. Firstly, it was familiar to several of the crew members. Secondly, it was remote and the surrounding area desolate. This meant that the operational area had a low the risk to persons and property in the event of an aircraft malfunction. Finally, it was accessible by road for the operator, maintainer, and client company from Brisbane.

Operational permissions

Permission for autonomous, BVLOS, multi-aircraft operations at Bruhl airfield operations was granted by the CASA in November 2019. The operator was authorised for flight BVLOS above 400 ft within defined areas and in compliance with certain conditions until 30 November 2020 or revoked. These conditions included:

• the fitment of a ’primary failsafe mode’ which could command a return to launch, ensuring that, during this process, the aircraft did not increase height or depart from the operational area
• fitment of both primary and secondary flight termination systems, with the secondary being able to command immediate flight termination in the event of the loss of communications with the primary.

Operational schedule

Operational test flights for the client’s systems were carried out throughout the week, finishing prior to the incident flight at approximately midday. Through the week these operations started at around 0900 and continued throughout the day, with a break for lunch.

Following each flight there was the requirement to download and analyse the aircraft flight data, liaise with the client company, conduct any required maintenance, and prepare aircraft and flight plans for following flights. These tasks were usually carried out by the incident pilot in their role as the operators CRP.

There was no formalised procedure for taxiing the aircraft back to the hangar. However, the pilot reported that there was a standard process that Mephisto pilots followed to provide the aircraft with enough momentum for the taxi. This process, as outlined below, was for a Mephisto aircraft having completed an autonomous recovery and positioned on the runway.

1. LRP to take control of the aircraft.
2. automatic mode to be deactivated with the aircraft in either FBW or manual
3. remote controller throttle advanced to 100 %
4. pilot to wait for the throttle to spool up to the desired level (approximately 30 %), due to throttle lag this could take approximately 6-7 seconds
5. pilot to throttle back on the controller to desired level
6. pilot to taxi the aircraft back to the hangar under its own power.

Crew information

A team of five pilots, all cross trained on the GCS and as LRP for the Mephisto aircraft, were available to conduct the week of flight activity. In addition, at the time of the incident, multiple training pilots were observing the test flight in preparation for CASA flight testing during the following operational period.

For the incident flight the aircraft crew consisted of the LRP, who was also the operator’s CRP, and a GCS operator. Both the LRP and GCS operator held current remote pilot licenses (RePLs) with appropriate category and type endorsements for operation of the Mephisto.

Fatigue

The International Civil Aviation Organization (2016) defined fatigue as:

A physiological state of reduced mental or physical performance capability resulting from sleep loss, extended wakefulness, circadian phase, and/or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety related operational duties.

Fatigue is a known contributor to a range of adverse effects on human performance. These can include, slower reaction times, decreased vigilance, shortened attention span, reduced short term memory capacity, and reduced decision making capability.

The pilot reported that at the time of the incident they, and others undertaking the operation, were experiencing a heightened level of fatigue due to the tempo of the operation.

Three people on site were designated to monitor fatigue of the operational crew, the incident pilot (as the operators CRP), a senior manager of the maintainer’s company, and a representative from the client company. The pilot reported that following an out‑landing incident earlier in the week, the client’s fatigue management personnel reported that they believed that there was a heightened level of fatigue among the operational personnel. This increased awareness of the fatigue levels prompted increased monitoring of the crew. However, no further action was deemed to be necessary.

Fatigue guidance

At the time of the incident, there was no regulation that applied to fatigue management for operators of RPA. However, in the company operations manual, the operator had used guidance from CASA's sample operations manual, which identified the following 3 areas of fatigue management to be followed:

• the chief pilot must consider and minimise the potential for fatigue to effect operations
• pilots were not to conduct RPAS operations if they believed that they were suffering from fatigue that was likely to impair their performance
• pilots must immediately report fatigue related concerns to the chief pilot who would take appropriate action to remedy the situation.

To comply with this, the chief pilot was required to consider several factors relating to each mission, including:

• travel time to the operation
• complexity and duration of the operation
• the time of day that the operation was to take place
• environmental conditions.

Fatiguing conditions

Through a review of the operation and the pilot’s history the ATSB identified 3 factors that could have contributed to a significantly heightened fatigue level. These were environmental conditions, operational requirements, and disrupted sleep.

Environmentally, while the incident occurred during winter, the LRP were operating outside on the flight line, in sunny and warm conditions. While there was no concern about the effect of the temperature, the pilots did identify a risk of dehydration, which can be a contributor to fatigue. These factors were being managed through breaks through the day and access to shade, fluids and food.

Operationally there were 2 periods that would have affected the pilots fatigue levels. Firstly, in the week leading up to the operation the pilot had been undertaking a range of maintenance testing and other preparatory activities. This involved multiple round trips to and from Brisbane to the airfield for test flights, a trip of approximately 3 hours each way. In addition to the flights and aircraft preparation this also involved data download, analysis and associated aircraft tuning both at the airfield and in Brisbane.

These activities were not only fatiguing themselves but limited the pilot’s opportunity for rest in preparation for the operational week, which they were aware was going to have an increased operational tempo. The pilot was aware of the heightened risk of fatigue due to these factors and sought to mitigate them over the weekend prior to the operation by taking more of an oversight role of preparations and leaving individual tasks to crew members.

The pilot reported that during the operational week they had 12 to 14 hours of duty each day. This involved carrying out aircraft test flights for the client company, overseeing LRP and GCS operations for the operational and test aircraft. In their role as CRP, the incident pilot, was also monitoring the crew for signs of fatigue, overseeing maintenance, preparing aircraft, and planning and reviewing data for the operations undertaken each day. The maintenance and preparatory tasks were undertaken in the morning prior to commencement of the days flying operations and, in the evening, following the completion of operations until going to sleep. This meant that, with the exception of mealtimes, there was limited to no time where the operations were not the focus. While the incident occurred in the middle of the day it was at the end of the final test flight of the week’s operations.

The pilot reported that sleep opportunity was in line with their regular habits, getting approximately 7 hours each night. However, during these operations they were staying at the airfield and rooming with another person. The pilot reported that this probably resulted in disrupted sleep. All other members of the crew were roomed off site in individual accommodation, which both promoted sleep opportunity and removed them from the operational environment.

Fatigue review

Unlike crewed aircraft operations, this operation did not need to comply with Civil Aviation Order (CAO) 48.1 Instrument 2019. Despite that, the ATSB reviewed the pilot flight and duty times against the instrument and appendices 1 (basic limits), 4 (any operations) and 5A (daylight aerial work operations and flight training associated with aerial work) to gain an appreciation of what level of fatigue was considered likely to affect performance.

Based on this review it was determined the pilot had exceeded the cumulative duty period limits, had not had sufficient off duty time and did not have adequate sleeping facilities as per the instrument requirements. As such, if the pilot had been seeking to fly a crewed aircraft subject to CAO 48.1 requirements, they would have been considered unfit to fly.

Recorded data

As discussed in the Flight controller section, the Pixhawk 2 flight controller can record and store a range of timestamped flight data and status messages.

The data for the two test flights, was downloaded by the operator and the data and relevant software for interpreting it were provided to the ATSB. Figure 7 shows data from these flights with throttle, flap and altitude traces. Additionally, the active aircraft mode is shown and some of the recorded aircraft status messages.

Figure 7: Flight data showing 19 June test flights

Source: ATSB utilising data provided by the operator

Figure 8 shows data from the second flight with the transition into automatic mode and the aircraft then launching conducting a circuit and being recovered. Following the landing there were a number of mode changes and an aircraft status message that corresponded with the ‘abort landing’ function being activated, the pilot toggling the mode switch to disengage this function and directing the aircraft away from personnel on the flight line.

Figure 8: Flight Data - Mephisto test flight 2 - 19 June

Source: ATSB utilising data provided by the operator

Figure 9 shows greater detail of the incident over the period of 20 seconds from 12:47:00 to 12:47:20, during which the aircraft was under the control of the LRP. This time covers the aircraft on the ground preparing to taxi, the throttle being advanced, and the ’abort landing’ function being activated, as identified by aircraft status message 2. It shows the mode selections by the pilot as they disengaged the abort landing function and toggled into manual mode as the aircraft was directed towards the airfield fence.

The chart shows that the aircraft remained in automatic mode and the flaps remained extended until approximately 12:47:04 when the throttle trace showed an increase to 100 %. At this time the aircraft status message appeared, giving the indication that the ’abort landing’ function has been activated and the flaps retracted while the throttle remained at 100 % as the aircraft followed the ’abort landing’ process.

The data showed the pilot toggling the automatic mode switch to off, and back on, to overwrite the ’abort landing’ function. It shows the throttle trace as the pilot directed the aircraft away from the flight line and across the runway towards the fence, and finally the re-engagement of the manual mode for the aircraft to be shutdown.

Figure 9: Flight Data - Incident - 19 June

Source: ATSB utilising data provided by the operator

__________

2. The aircraft’s maximum altitude was not confirmed – 5,000 ft is the maximum altitude allowed under the operational permissions obtained from the Civil Aviation Safety Authority.
3. When activated the return to launch function automatically flew the aircraft back to the launch point or another designated point and, depending on programming, either held in place (allowing the RPIC to regain control) or conducted an automated recovery.

Safety analysis

Introduction

At 1247 on 19 June 2020, the pilot of an RF Designs Mephisto, remotely piloted aircraft (RPA) completed an automated test flight and attempted to transition the aircraft out of automatic mode to taxi it back to the hangar.

The pilot was unaware they had not deactivated the aircraft’s automatic mode prior to increasing the throttle to provide sufficient momentum for the taxi. This action activated the aircraft’s ‘abort landing’ function and prevented the engine from throttling down as the pilot was commanding.

The following analysis will look at the factors that resulted in the incomplete deactivation of the automatic mode, the pilot not realising the aircraft remained in the automatic mode and the delay in regaining control of the aircraft.

Deactivation of automatic mode

Following the landing, the pilot attempted to deactivate the aircraft’s automatic mode using the automatic mode switch. The switch had 3 positions with 2 positions set for automatic mode on and 1 for automatic mode off. The pilot recalled that they had moved the switch as indicated by the click and movement that was felt. However, they did not recall whether it was moved 2 positions or 1. The data showed no deactivation of the autonomous mode, indicating a single position change.

This meant the aircraft was in a state different to what was intended leading to the activation of the ’abort landing’ function when the pilot advance the throttle, and the subsequent loss of control.

The LRP remote controller (TRANSIS X9D Plus) had only two 2-position switches available, which for redundancy were both being used for return to launch functionality. This meant that the automatic mode selection was relegated to a 3-position switch. The technique of driving the switch to an end point that the Mephisto pilots used went some way towards mitigation of an error. However, the use of a 3-position switch increased the likelihood of a mis-selection and an undesired state.

This potential had been identified by the operator with the change of layout for the 3 positions from off-off-on to off-on-on. It was believed that this was a way to limit the risk of an aircraft accidentally being forced into manual or fly by wire mode while flying beyond visual line of sight. However, it did not overcome the issue of an incomplete or incorrect mode selection.

Aircraft state awareness

There were 3 cues to alert the pilot that the aircraft remained in the automatic mode. Firstly, the aircraft’s flaps had not retracted when they attempted to disengage the automatic mode, despite being set to fully retracted on the controller. Secondly, the pilot should have felt and heard two distinct ’clicks’ as the control moved through the second ’auto on’ position and into the desired ’auto off’ position.

The pilot commented that they did not remember seeing the flaps retract and recalled feeling and hearing 1 click but could not recall the second. The ATSB considered a number of reasons why the pilot may not have detected or reacted to these cues. These included: deliberate pilot action, distraction, expectation bias, and fatigue. Based on the available evidence, it was considered that the heightened level of fatigue was the most likely explanation. This is discussed further below.

Delayed control recovery

In the event of a RPA loss of control on the ground, where the engine was still functioning at a high-power setting, removing engine power is the quickest and easiest way to arrest momentum and bring the aircraft back under control. The flight termination system (FTS), as required under the CASA permission for the operation and fitted to the aircraft, provided the ability override the aircraft’s automatic mode, immediately cut fuel to the turbine and drive the aircraft controls into a configuration to induce a spin.

While this system was designed to operate in the air, its functionality, specifically cutting fuel to the turbine, would have allowed the aircraft’s momentum to be arrested more quickly. However, this system could not be activated from the launch and recovery pilot’s (LRP) controller and relied on communications with the ground control station operator to activate it. The aircraft’s data showed that there were only seconds for the pilot to react and take appropriate action. While calling for the activation of FTS would have stopped the aircraft it would not have been practical in the time available.

Had the LRP’s controller been fitted with a switch that could activate the FTS, there would have been no requirement for the extra control inputs to deactivate the ‘abort landing’ function and regain control of the aircraft.

Fatigue

For this operation the potential effects of fatigue on crew members had been identified and a range of fatigue management and mitigation strategies were in place. However, these strategies did not specifically account for the added work created by the incident pilot’s additional role as the operator’s chief remote pilot (CRP).

For example, in addition to flight operations and testing, they were liaising with the client company, monitoring other team members for signs of fatigue and staying at the field in shared accommodations. Additionally, while the crew was being monitored for fatigue, the 3 personnel assigned to monitor the fatigue - the CRP, the maintainers senior manager and the clients fatigue monitoring personnel did not have anyone assigned to monitor their fatigue levels. Fatigue monitoring is only effective if all personnel are being monitored.

Considering their workload and reduced rest opportunity, the ATSB assessed that it was likely that the pilot was experiencing a level of fatigue that affected performance. Heightened fatigue levels are known to cause a reduction in ability to react to external stimuli and effect a person’s attention and decision-making capacity.

The level of fatigue felt by the pilot at the time of the incident likely had an effect on them missing the visual (flaps not retracting), tactile (not feeling one click rather than two) and audible cues (hearing one click not two) that indicated the aircraft had not exited the automatic mode.

Findings

From the evidence available, the following findings are made with respect to the loss of control during taxi involving RF Designs Mephisto, HP001 at Bruhl Airfield on 19 June 2020.

Contributing factors

• When the throttle was advanced for taxi, the automatic mode, which had not been correctly deactivated, entered an ’abort landing’ state. This overrode the pilot’s commands to decrease throttle and the turbine thrust continued to increase, resulting in a loss of control.
• The use of a 3-position switch (with 2 positive and 1 negative position), for a 2‑position role, increased the likelihood that a pilot would inadvertently not deactivate the automatic mode prior to manoeuvring the aircraft.
• The controller did not have a ’kill switch’ to override the aircraft’s automatic mode and shutdown the turbine in the event of an issue. As a result, the pilot was forced to toggle the aircraft’s mode switches and direct it away from personnel rather than being able to override it.
• The pilot was experiencing a level of fatigue known to impact performance. This likely led to a lack of reaction to multiple cues that the aircraft had not exited the automatic mode.

Safety action

Safety action not associated with an identified safety issue

Safety action by Remote Piloted Systems (the operator).

In response to this incident the operator introduced the following changes to the Launch and Recovery pilot’s controller switch layout and allocations, procedures for taxiing the Mephisto aircraft and operational planning to reduce risks identified:

• 3‑position mode switches were replaced with 2‑position mode selection switches to eliminate issues with incomplete deactivation of the automatic mode.
• All launch and recovery pilot controllers had a ’kill switch’ added that overwrites the aircraft’s mode to manual and drives the throttle immediately to zero thrust. This switch is gated to enable easy to operation, when necessary, but is also difficult to inadvertently activate.
• Taxi procedure has been changed/formalised to require that all aircraft are shutdown on the runway and pushed back to the hangar by hand rather than under their own power.
• The operational timeline has been extended from 7 to 10 days, with additional time to setup and prepare the aircraft and a break before operations commenced.

Safety action by RF Designs (the maintainer).

Since this event the RF Designs has introduced the following two safety improvements:

• The aircraft flight manual has been updated to clarify the presence of the flight termination system, removing the phrase ’not currently fitted, in development’.
• Specific fatigue management requirements, including references to CAO-48.1, have been added to the RPA operations manual.

The ATSB welcomes the prompt safety action taken by the operator and maintainer to address the deficiencies identified in this incident.

Glossary

BVLOS             Beyond Visual Line of Sight

CASA               Civil Aviation Safety Authority

CRP                 Chief Remote Pilot

FBW                Fly by Wire

FTS                  Flight Termination System

GCS                 Ground Control Station

GPS                 Global Positioning System

LRP                 Launch and Recovery Pilot

RePL                Remote Pilot License

RPA                 Remotely Piloted Aircraft

RPIC                Remote Pilot in Command

RTL                  Return to Launch

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• pilot flying
• aircraft manufacturer and maintainer
• Civil Aviation Safety Authority
• Operators manual for the FRSky TARANIS X9D Plus
• recorded data from the aircraft
• ARDUpilot documentation.

References

ICAO. (2016). Doc 9966: Manual for the Oversight of Fatigue Management Approaches 2nd Edition. Quebec, Canada: International Civil Aviation Organisation.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the operator and pilot flying
• the maintenance organisation
• CASA

No submissions were received.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the morning of 12 December 2019, a student pilot took off for a series of solo circuits in a BRM Aero Bristell, registered VH-YVF, at Moorabbin Airport, Victoria. Just after crossing the runway threshold for the first touch and go landing, witnesses observed the aircraft about 10 ft above the runway, when it suddenly pitched up to about 40 ft. The left wing dropped, with the bank angle increasing to the point where the aircraft became inverted.

The witnesses described what they saw as similar to the aircraft being in the first half rotation of a spin entry. The nose then dropped and the aircraft impacted terrain in a steep inverted attitude. The student pilot was severely injured, and the aircraft was destroyed.

What the ATSB found

The ATSB found that the pilot commenced a go‑around at low level when the aircraft deviated from the runway centreline in crosswind conditions. During the go‑around, the aircraft aerodynamically stalled and commenced a spin.

It was also identified that the student pilot did not have the necessary qualifications and skills to safely operate the Bristell solo.

Finally, the required Soar Aviation solo flight dispatch procedures were not followed. As a result, it was not identified that the student pilot was not authorised for, nor met the required competencies, to conduct the flight.

What has been done as a result

Soar Aviation implemented enhanced measures to ensure student pilots were fully briefed and authorised, before conducting a solo flight. These amended procedures included changes to the aircraft booking procedure and having aircraft keys stored such that they were only accessible by flight instructors.

Soar Aviation ceased flight training on 29 December 2020.

Safety message

Familiarity with an aircraft’s specific systems, controls, handling and limitations is essential for safe flight.

Safety-critical procedures and regulations are in place to ensure that pilots have the required level of skill and experience to safely operate an aircraft. The outcome of this accident, which could just as easily have been fatal, illustrates a consequence of deviating from them.

The investigation

The occurrence

On the morning of 12 December 2019, a student pilot conducted a pre-flight inspection of a BRM Aero Bristell S-LSA,^[1] registered VH-YVF, in preparation for a solo flight. A second student (student 2) also conducted a pre-flight inspection of their aircraft at the same time and, after completing their aircraft checks, they returned together to the flight school’s main building. Student 2 reported they then ‘walked into navigation planning to organise dispatch of my flight’ however, they observed that the other student pilot did not. Student 2 later observed the student pilot walking back to the where the aircraft were parked, with their ‘flight bag and aircraft folder’.

The student pilot had the aircraft keys however, they had not endorsed the aircraft’s maintenance release or conducted the required solo flight briefing and sign out procedure with a flight instructor. The student pilot stated to the ATSB that they believed they were authorised for the solo flight. However, they also reported a level of confusion as to whether the solo dispatch procedure was required at their stage of training.

At 0950 Eastern Daylight-saving Time,^[2] the student pilot was cleared by air traffic control (ATC) to take off from runway 17L^[3] at Moorabbin Airport, Victoria, for a series of circuits. The pilot reported feeling ‘uncomfortable’, with the aircraft and its systems during the flight, and that they surmised this was due to their limited experience in the Bristell.

While on the downwind leg of the first circuit, the student pilot advised ATC of their intent to conduct a touch and go, which was subsequently cleared at 0954. During the approach to the runway, the student pilot described that they felt the nose ‘wanted to pitch up’, even though they believed the aircraft was neutrally trimmed.

The student pilot stated that, just after crossing the runway threshold, what felt like a sudden gust of wind pushed the aircraft to the left of the runway centreline. At that point, the student pilot decided to initiate a go-around. The pilot reported that, after commencing the go-around. the aircraft was then ‘ripped up very violently, straight up into the air and then ripped very violently toward the left’. They attempted to recover with full right rudder ‘as far as it would go, but by that time it was too far gone’ (Figure 1).

Witnesses reported observing the aircraft, about 10 ft above the runway, when it suddenly pitched up to about 40 ft. The left wing dropped, with the bank angle increasing to the point where the aircraft became inverted. The nose then dropped, and the aircraft impacted terrain in a steep inverted attitude. The witnesses described what they saw as similar to a spin entry to the left.

Figure 1: Flight track, with the approach to land phase highlighted in yellow

Source: Google Earth, annotated by ATSB using VH-YVF flight data

ATC also observed the accident and initiated an emergency response. The student pilot was severely injured, and the aircraft was substantially damaged. There was no post-impact fire.

Context

Pilot information

The student pilot commenced flying training with Soar Aviation in March 2019 and gained a Recreational Aviation Australia (RAAus)^[4] Pilot Certificate on 30 September 2019. The student pilot then converted their pilot certificate to a Civil Aviation Safety Authority (CASA) Recreational Pilot Licence (RPL), which was issued on 13 November 2019.

Operation of VH‑registered aircraft such as VH-YVF (YVF) required a minimum of an RPL. In order to exercise the privileges of the RPL, the student pilot was first required to complete an aircraft flight review. At the time of the occurrence, this had not been completed. In addition, the student pilot did not hold an RAAus endorsement for ‘in-flight adjustable propeller’, nor the CASA-equivalent ‘manual propeller pitch control’ as fitted to the Bristell (see the section below titled Aircraft information).

The student pilot had accrued about 72 hours flight experience, which included 10 hours of solo flight, all in the RAAus-registered Aeropakt A-32 Vixxen (refer to the Aircraft information section). The student pilot’s last recorded solo flight was on 21 October 2019.

The student pilot underwent their baseline CASA medical examination in March 2019 and at the time of the accident held a current Class 1 medical certificate, with nil restrictions or conditions.

Aircraft information

BRM Aero Bristell

The BRM Aero Bristell S-LSA is a two-seat, all-metal, low-wing aircraft, with fixed tricycle landing gear, steerable nose wheel and stick control. YVF, serial number 330, was powered by a Rotax 912 ULS horizontally opposed four-cylinder normally aspirated engine and a variable pitch MT-Propeller. The aircraft was manufactured in the Czech Republic in 2018 and registered in Australia the same year.

YVF was flown for 2.3 hours on the day before the accident, with no reports of any issues, and had a total time of 997.8 hours. A review of the maintenance logbooks did not identify any prior accidents or major repairs.

Figure 2: VH-YVF

Source: Used with permission

The aircraft manufacturer’s Aircraft Operation Instructions manual had the following guidance on headwind and crosswind limitations (Figure 3).

Figure 3: Bristell wind limitations

Source: Soar Aviation

With regard to the different crosswind limitations, the manual did not define the terms ‘average’ or ‘skilled’ pilots.

Aerokprakt A-32 Vixxen

The Aeroprakt A-32 Vixxen (Vixxen) aircraft is a Ukranian-built two‑seat, high-wing, tricycle gear ultralight. The Vixxen is powered by a Rotax 912ULS engine and a 3-blade KievProp ground‑adjustable propeller.^[5] In addition, the Vixxen is configured with an all‑flying horizontal ‘stabilator’^[] and conventional flight control yoke.

Figure 4: Typical A-32 Vixxen

Source: Ian McDonell

Differences in handling between the Bristell and the Vixxen

When asked about the differences between the Bristell and the Vixxen, in general handling and stall characteristics, flight instructors advised that:

• it would typically take three to four flights to get used to the new type, particularly yoke versus stick
• the Bristell’s elevator was significantly smaller and therefore less sensitive
• significant forward movement of the Bristell’s flight control stick is required with the in‑flight application of power to counter a pitch‑up tendency
• in a stall, the Bristell ‘really did like to drop a wing’, usually the left, and ‘if it does so, it is not normally as gentle as other planes that I’ve flown …, if I was to compare it to the Vixxen, I would say you’d want to be much more aware of what you’re doing in the Bristell’.

Site and wreckage examination

Examination of the wreckage (Figure 5) did not identify any evidence of pre-existing faults or engine issues which may have contributed to the loss of control.

The site and wreckage examination identified that YVF impacted terrain in a nose-down, inverted attitude. In addition, damage to the airframe and engine was indicative of the aircraft being in a moderate spin/yaw to the left, at the point of impact. This was consistent with witness reports that the aircraft pitched up, rolled to the left and impacted the terrain inverted, in what appeared to be the commencement of a spin.

Figure 5: Accident site

Source: ATSB

Recorded flight data

The aircraft was fitted with a Garmin G3X avionics system, which was an integrated flight instrumentation, position, navigation and communication system. The G3X unit had a flight data logging feature which automatically stored flight and engine data to its memory module.

The ATSB was able to download the data from the occurrence flight however, the data stopped just as the aircraft flew over the runway 17 threshold (Figure 6). It is likely the final seconds of data were lost due to the interruption of electrical power to the unit at impact. The last 5 seconds of recorded data captured:

• indicated airspeed reducing from 60 to 51 kt
• altitude decreasing from 106 ft to 76 ft
• vertical speed stable at -255 fpm
• roll no more than 5° either side of wings level
• pitch increasing from about -0.5 to +5.0° but not stable
• yaw varying from 0 to -5°/s
• wind speed and direction: stable at 223° and 15 kt (13 kt crosswind)
• engine RPM decreasing from 3,730 to 2,580 and fuel flow relatively stable at 2.2‑2.4 gallons/hr
• GPS track was aligned with the runway centreline.

Figure 6: Accident site overview

Source: Google Earth and ATSB, annotated by ATSB

Weather

The Bureau of Meteorology (BoM) automatic weather station at Moorabbin Airport recorded observations at one-minute intervals (Table 1), with the loss of control occurring at about 0955. The temperature was steady, at about 15°C, at the time of the occurrence.

Table 1: Moorabbin Airport weather observations

The crosswind component at the time of the loss of control was calculated to be about 13 kt, accounting for the observed 15 kt gust. The Moorabbin automatic terminal information service was advising of a 12 kt crosswind at that time and the student pilot reported noting this during the flight.

Soar Aviation procedures

Gobel Aviation, trading as Soar Aviation (Soar), was a CASA Part 141 authorised flight training organisation. Soar provided flight training from ab-initio through to obtaining a commercial pilot licence (CPL). Soar’s training syllabus, in conjunction with the Soar Operations Manual and CASA Part 61 MOS Competencies into individual flight lesson for training and assessment, outlined the competency requirements for each phase of the flight training, including suggested lesson content and duration. Where a pilot required additional flying training to complete a competency, these flights could be added to the training schedule.

Students typically commenced training on the RAAus-registered Aeroprakt A-22 Foxbat or Vixxen aircraft, and then transitioned to the VH-registered Bristell for the command-building flights during the CPL phase. The syllabus identified 3 hours of familiarisation flight training when transitioning between aircraft types.

Solo training flight procedures

Soar Advanced Flight Training Operations Manual Part 3B Conduct of training operations detailed the procedures for ‘authorisation of training flights’. The procedures for flight preparation and planning, ‘prior to any training flight’ included pre- and post-flight briefings and that ‘the flight is authorised by an approved person’. The student pilot’s records showed that they had ‘read and understood’ the procedures. In addition, they had followed these procedures during their flight training on the Vixxen.

The procedure for solo flights stated that ‘the authorising instructor will only dispatch the flight’ when they had confirmed 13 checklist items, which included:

• the student had completed all training and examinations as prescribed by the syllabus for the solo flight
• the student flight training records indicate that they have achieved the required standard for all elements of competency for the flight, including flight crew licence and endorsements, as applicable
• the student had been briefed on the objectives, conditions and limitations of the intended solo flight, including that task or route to be flown, number of circuits (if applicable), traffic and ATC consideration, and actions to be taken during an emergency
• the student was clear on what they are authorised to do while on their solo flight
• the actual and forecast weather conditions, including runway crosswind and last light limitations were suitable considering the student’s previous competence in similar conditions
• the daily inspection was complete and certified
• solo risk matrix has been completed and authorised by a flight instructor.

The solo risk matrix form included considerations for aircraft serviceability, pilot experience and weather. Pilot experience included a check for ‘5 hours dual training on aircraft type’. The weather section included consideration to wind (gusts and turbulence) and crosswind (Table 2), among other factors.

Table 2: Solo risk matrix crosswind and wind gusts component

The risk rating detailed that dispatch of the flight, at level 3, was at the discretion of a Grade 1 instructor. Level 2 was at the discretion of a Grade 2 instructor and level 1 was ‘limited by the student’s personal minimums’. The solo risk matrix form was to be signed by the student and authorising instructor, prior to flight.

Soar advised the ATSB that, had a solo flight been scheduled for the student pilot, in a Vixxen, the risk assessment would likely have resulted in level 2 ‘at the discretion of a Grade 2 flight instructor’. This would factor in the pilot’s skills and experience in the Vixxen, which indicated 10‑14 kt crosswind for the equivalent skill level of the student pilot. Further, Soar advised that the instructor and the pilot would have reviewed the weather, and discussed operational aspects, prior to the flight being approved.

Flight booking system

Soar required students to book flights in advance, by liaising with operations staff, to ensure their flight training was progressing at an acceptable rate. An aircraft, and an instructor where applicable, were assigned to the booking however, the exact nature of the flight was not assigned until amended by the instructor, as part of the pre-flight briefing.

Bristell flight training

In preparation for their commercial pilot licence training phase, the pilot received a 2-hour familiarisation flight in a Bristell, on 11 December 2019. Due to weather limitations, the lesson entry report noted that the following required competencies were unable to be assessed:

• take off in a crosswind
• land aeroplane in a crosswind
• enter and recover from a stall
• recover from incipient spin
• perform recovery from missed landing.

The lesson entry report identified these items as competency grade 5 ‘the element has not been assessed’^[6] and the instructor noted they were to be completed on a future flight.

The student pilot reported, from their recollection of the post-flight debrief with the instructor, that the aircraft flight review and endorsement for the manual pitch propeller control had been ‘signed off’. Further, they believed they were advised by the instructor as ‘you’re good to go’. From this, the student pilot believed they were instructed, and authorised, to conduct a solo flight in a Bristell.

Despite that belief, the student pilot also advised the ATSB that prior to the solo flight on 12 December 2019, they were:

• feeling apprehensive, ‘after only 1 hour of training’ and still getting used to the different controls and trim mechanism
• aware that they hadn’t received any crosswind or stall training
• only going to conduct circuits, instead of navigation practice, as they didn’t feel comfortable flying the Bristell and wanted ‘to get used it more’.

The flight instructor’s recollection from the 11 December 2019 Bristell dual training flight included:

• describing the critical differences between the Vixxen and the Bristell
• the student pilot ‘tended to pitch the aircraft more than necessary’ and the importance of avoiding this was ‘stressed a number of times in the circuit’
• the student pilot ‘tended to allow the speed to drift down’ during landing
• landings were fine but on the touch and go, with full power, tended to pitch up too soon
• the requirement to remind the student not to handle the Bristell like the Vixxen
• their belief that the student pilot ‘definitely was not ready for a solo on that aircraft’.

The instructor reported that they didn’t specifically say the student pilot ‘was not cleared for solo’ flight but ‘they don’t normally do that, it is clear from the debrief’’. In addition, the student pilot was advised of the requirement for stall training on their next flight. Finally, the lesson entry report had been endorsed by the both the instructor and the student, indicative of them having received and understood the post-flight briefing.

Following this accident, a number of procedural changes relating to the conduct of solo flights were implemented (see the section titled Safety action).

Go-around

Whenever landing conditions are not satisfactory, a go-around should be initiated. A go‑around is considered a normal procedure and, although it is not often required, with appropriate training, planning and preparation it should not result in increased risk.

The Federal Aviation Administration publication, The Airplane Flying Handbook, Chapter 8 (pages 12 and 13) provides the following guidance for go-arounds:

Although the need to discontinue a landing may arise at any point in the landing process, the most critical go-around is one started when very close to the ground. The earlier a condition that warrants a go-around is recognized, the safer the go-around/rejected landing is. The go-around maneuver is not inherently dangerous in itself. It becomes dangerous only when delayed unduly or executed improperly…

… Attitude is always critical when close to the ground, and when power is added, a deliberate effort on the part of the pilot is required to keep the nose from pitching up prematurely. The airplane executing a go-around must be maintained in an attitude that permits a buildup of airspeed well beyond the stall point before any effort is made to gain altitude or to execute a turn. Raising the nose too early could result in a stall from which the airplane could not be recovered if the go-around is performed at a low altitude.

The Civil Aviation Safety Authority Flight Instructor Manual (p47) provides the following guidance for instructor on go-arounds:

The following points must be emphasised [by the instructor]:

(iv) That large changes of trim may be experienced during this procedure.

Safety analysis

On the morning of 12 December 2019, a student pilot took off from Moorabbin Airport, Victoria, intending to conduct a series of circuits in a BRM Aero Bristell, registered VH-YVF. After passing the runway threshold during the first approach for a touch and go landing, the student pilot lost control of the aircraft and collided with terrain, on a grassed area alongside the runway.

The analysis discusses the student pilot’s preparation for the flight in the context of the flight school’s requirements, as well as the contributing factors that led to the loss of control and collision with terrain.

Solo flight dispatch procedure

Following completion of an instructional familiarisation flight in the Bristell the day before the accident flight, the student pilot incorrectly believed that they were ‘authorised’ to conduct a solo flight in the aircraft. The flight instructor who conducted the familiarisation flight acknowledged that, while they ‘didn’t specifically say that [the student pilot] was not cleared for solo’, it should have been evident as the student had not conducted any crosswind or stall training in the Bristell. Additionally, the post‑flight briefing, signed by the student, detailed that these required sequences were to be conducted on the next flight.

Further, the student pilot continued with the solo flight, despite reporting they were ‘not comfortable operating’ the new aircraft type. They also advised their belief that, as they were in the ‘command building’ phase of their training, the solo flight procedures were not required. There was no statement to that effect in the Operations Manual. In addition, there was no evidence the student pilot sought to clarify whether or not they were authorised and/or if the solo procedures were required.

Had the solo flight approval procedures been followed, they would have identified that the student pilot had not yet achieved the competencies required for solo flight in the Bristell. More generally, following these procedures would have identified the hazard associated with the crosswind conditions and allowed an assessment of the risk for pilots with limited experience on the aircraft type.

Aircraft handling

The student pilot had undertaken only one supervised training flight in the Bristell aircraft, which did not include any go-arounds, crosswind landings or stall training. Therefore, the student pilot’s familiarity with the aircraft type was very limited.

The Bristell exhibits different handling characteristics to the other aircraft type the student pilot had previously operated. Specifically, instructors reported that it is less docile and has a stronger tendency to pitch up when engine power is applied for a go-around. The instructors also reported that the Bristell has less elevator authority to counter the nose-up effect and a greater tendency to drop a wing (usually the left) during a stall.

During the flare prior to touching down, the student pilot detected the aircraft drifting left of centreline, most likely due to the prevailing crosswind, and elected to commence a go-around. After initiating the go-around, they felt the aircraft forcefully pitch up, a behaviour consistent with instructor’s description. Being unfamiliar with the aircraft type, the student pilot was not adequately prepared for this pitch up tendency and did not anticipate or respond effectively to prevent the aircraft stalling.

Once the aircraft stalled, it entered an incipient left spin. Recognising that recovery from the stall at such a low height may not have been possible, as the student pilot was unfamiliar with the aircraft’s stall behaviour, their capability to prevent further rotation or recover the aircraft prior to the collision with terrain was also very limited.

Findings

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving BRM Aero Bristell, VH-YVF on 12 December 2019.

Contributing factors

• The student pilot did not have the necessary qualifications and skills to safely operate the Bristell solo.
• The required Soar Aviation solo flight dispatch procedures were not followed. As a result, it was not identified that the student pilot was not authorised for, nor met the required competencies, to conduct the flight.
• During the conduct of a go‑around at low level following deviation from the runway centreline, the aircraft aerodynamically stalled and commenced a spin.

Safety actions

Safety action by Soar Aviation

Soar Aviation advised the ATSB that they had implemented revised procedures to ensure an aircraft could not be taken by a student for a solo flight, either deliberately or inadvertently. Aircraft keys were now secured and could only be accessed by an instructor once the procedures had been followed and solo flight was authorised.

Further, the booking system was changed so that operations ‘reserve’ an aircraft for a student and allocated an instructor, with the instructor required to change the reserve booking to the authorised ‘flight lesson’.

Soar Aviation ceased flight training operations on 29 December 2020.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Soar Aviation
• the student pilot
• Civil Aviation Safety Authority
• BRM Aero
• witnesses
• Airservices Australia

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Soar Aviation
• the student pilot
• Civil Aviation Safety Authority
• BRM Aero
• Air Accidents Investigation Institute of the Czech Republic.

Submissions were received from:

• Soar Aviation
• the student pilot
• Civil Aviation Safety Authority.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. An S-LSA is a special light-sport aircraft, where the certification and continuing airworthiness is the responsibility of the manufacturer. The aircraft are manufactured to defined standards, which are then accepted by the regulator.
2. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours. 
3. Runway numbering: the number represents the magnetic heading closest to the runway (runway 17 at Moorabbin Airport is oriented 164° magnetic) and L indicates the left most of two parallel runways.
4. Recreational Aviation Australia (RAAus) administers ultralight, recreational, weight shift microlight and LSA aircraft. RAAus train and certify pilots, flying instructors and maintainers, register their aircraft fleet and oversee a large number of flight training schools across Australia.
5. A ground-adjustable propeller can be adjusted between pre-set limits of coarse and fine pitch, to optimise the aircraft for flying conditions. Following adjustment, only on the ground and when the engine is not running, its operation is similar to a fixed pitch propeller.
6. Soar’s competency grading scale ranged from 5 up to 1, where 2 was the level required before solo flight and 1 was where the student had achieved ‘competency to the standard required for qualification issue’.

The occurrence

On 4 July 2019, while conducting a demonstration flight of an Alauda Airspeeder prototype unmanned aircraft system at Goodwood Aerodrome, United Kingdom (UK), the remote pilot lost control of the aircraft. In response, the pilot activated the safety ‘kill switch’ intended to immediately terminate the flight, but it had no effect.

The unmanned aircraft then climbed, to approximately 8,000 ft and entered controlled airspace at a holding point for flights arriving at Gatwick Airport, before its battery depleted and it fell to the ground. It collided with terrain in a field of crops approximately 40 m from occupied houses, outside of its designated operating area. There were no injuries.

Investigation

The UK Air Accident Investigation Branch (AAIB) investigated this occurrence. As Australia was the State of Manufacture of the aircraft, the AAIB requested appointment of an Accredited Representative from the ATSB.

To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.

Conclusion

The AAIB found that the Alauda Airspeeder Mk II was not designed, built or tested to any recognisable standards and that its design and build quality were poor. In addition, the operator’s operating safety case, which formed the basis for gaining an exemption from the UK Civil Aviation Authority, contained several statements that were shown to be incorrect.

The Civil Aviation Authority’s Unmanned Aircraft Systems unit had assessed the operator’s application and, after clarification and amendment of some aspects, issued an exemption to the Air Navigation Order to allow flights in accordance with the operators Operational Safety Case. The Civil Aviation Authority did not meet the operator or inspect the Alauda Airspeeder Mk II before the accident flight.

There have been many other similar events where control of an unmanned aircraft has been lost, resulting in either it falling to the ground or flying away. The AAIB also identified that, even a small unmanned aircraft falling from a few metres could cause a fatal injury if it struck a person.

The AAIB investigation report made several Safety Recommendations and the final investigation report can be found at www.aaib.gov.uk.

Any further information regarding this investigation should be directed to the AAIB via: enquiries@aaib.gov.uk

_____________

The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the AAIB investigation of the occurrence.

Safety summary

What happened

On 28 May 2019, a Cessna 152, registered VH-JIW, was being operated by Basair Aviation College on a training flight from Archerfield Airport, Queensland. On board was a student pilot on their first flight, and a flight instructor.

During the training flight, the instructor was demonstrating the use of trim, with the student flying the aircraft. At about 2,000 ft above ground level, the aircraft abruptly pitched down and entered into a dive. The instructor took control of the aircraft and recovered from the descent at about 400 ft, about 25 seconds after the dive commenced. Subsequently the flight instructor elected to terminate the lesson and returned the aircraft to Archerfield Airport.

The instructor sustained minor injuries and the student was uninjured. An examination of the aircraft identified significant structural damage to the right horizontal stabiliser, which was indicative of in-flight overload during dive recovery. In addition, the instructor inadvertently bent the throttle control in the cockpit, which made movement of the control stiff but still operable.

What the ATSB found

The ATSB found that the student released the control wheel leading to the aircraft entering into a steep dive. The flight instructor had applied a large amount of nose-down trim during the course of instructing the lesson, resulting in a strong nose-down tendency of the aircraft when the controls were released. The flying school’s instructor guide did not specify a limit of trim input for such exercises.

It was also determined that the instructor’s hands were not in a ready position to take control in the event of any mishandling by the student pilot. The recovery by the instructor was likely further delayed after sustaining a head injury during the in-flight upset, and initially being unsure about what had happened and how to then recover the aircraft.

What has been done as a result

The operator has revised its training procedures for use of trim to include detailed instructor demonstrations prior to the student practicing manoeuvres. This ensures the student understands the required use of trim and the effect it has on the aircraft flight characteristics to maintain flight attitudes. The operator has also revised its training procedures to use a consistent moderate amount of trim.

Safety message

The first stages of flight training can be an exciting yet daunting period for a student. Any uncertainty should be raised with the instructor before taking action in case it leads to an unsafe situation. Conversely, instructors need to account for the potential for the student to carry out unexpected actions. This means that lessons should be conducted under the lowest risk conditions that still impart the lesson intent.

The investigation

The occurrence

On 28 May 2019, at about 1110 Eastern Standard Time,^[1] a Cessna 152 aircraft, registered VH‑JIW and operated by Basair Aviation College, departed Archerfield Airport, Queensland, for a training flight. On board was a student pilot on their first flight, and a flight instructor.

During the flight, the instructor demonstrated a number of manoeuvres from the ‘effects of control’ flight-training syllabus. As part of this, the instructor placed the aircraft out of trim with the pitch trim wheel,^[2] while the student was maintaining straight and level flight.

With the aircraft in a nose-up trim, the student then practiced re-trimming the aircraft for level flight while maintaining attitude using nose-down pressure on the control wheel. As the aircraft was approaching overhead Lagoon Island at about 2,000 ft above ground level, with the student flying, the instructor moved the pitch trim to about two-thirds travel nose down. The student maintained attitude with nose-up pressure on the control wheel. The instructor’s feet were lightly on the rudder pedals, left hand on their leg, and right hand resting on the glareshield (next to the control wheel).

The student maintained straight and level flight for a short period. When the procedure was to return the elevator trim to neutral, the student became confused about the correct procedure and let go of the control wheel. The aircraft rapidly pitched nose-down, rolled left, and entered into a dive. During these events, the flight instructor’s headset dislodged from their head.

The flight instructor took control of the aircraft and subsequently arrested the descent at about 400 ft, about 25 seconds after the descent commenced. The available radar data (Figure 1) showed that from when the dive commenced, to when the instructor regained control, the aircraft had an average rate of descent of over 3,000 ft/minute, with the rate being higher in the initial part of the descent.

Figure 1: VH-JIW’s flight path, dive and recovery as derived from radar data

Source: Google Earth, modified by the ATSB

During the occurrence sequence, the instructor pulled the throttle back quite rapidly and, at some stage during the initial stages of the sequence, the throttle was bent. The throttle then became stiff, however was still able to be moved. The instructor recalled applying right rudder during the recovery but did not fully recollect if that was to recover from a left spiral dive or spin. The instructor stated they did not re-trim the elevator system to a neutral position until after recovery from the dive.

When they had recovered from the dive, the aircraft was on a reciprocal heading. The instructor carried out a flight control function check and confirmed the aircraft was controllable. The instructor then terminated the lesson and advised air traffic control that their aircraft had descended 1,500 ft ‘quite suddenly’ and they were returning to Archerfield Airport. The aircraft landed without further incident at about 1139.

During the occurrence, the instructor sustained several minor injuries, including an injury to their left shin after it contacted the underside of the instrument panel, a head injury from impact with the cabin roof, and bruising to the right hip. The student pilot was uninjured. The aircraft sustained damage to the right horizontal stabiliser.

Context

Personnel information

The instructor pilot held a grade 3 instructor rating and had about 320 total flight hours, including 100 hours in Cessna 152 aircraft. They had instructed this lesson about seven times before this occurrence.

The student pilot was conducting their first flight.

Pitch trim system

The pitch trim system on VH-JIW consisted of a manual trim wheel located on the lower instrument panel, which controlled a full-span trim tab on the right elevator only.

Placing the aircraft in an out-of-trim condition places a load on the flight control surfaces that results in the aircraft changing attitude accordingly, if the pilot does not oppose the condition. The flight controls will have a ‘heavy’ feel to them when held against the trimmed attitude. This force is neutralised when the aircraft is either re-trimmed or allowed to adopt the trimmed attitude.

Aircraft damage

A post-flight inspection of the aircraft found that the right horizontal stabiliser was bent and twisted during the occurrence, resulting in creasing on the upper and lower skin sections (Figure 2). The left horizontal stabiliser had no significant damage.

Figure 2: Right stabiliser damage

Source: Operator, annotated by the ATSB

The deformation of the right stabiliser resulted in a number of rivets on the aft lower surface pulling through the skin. The internal structure was cracked and creased (Figure). There was no evidence of damage to attachment points of the stabiliser assembly.

Figure 3: Leading edge removed showing cracking to internal structure

Source: ATSB and Cessna, annotated by the ATSB

An ATSB examination of the right horizontal stabiliser did not identify evidence of pre-existing damage to the structure.

In addition to the bent throttle control, the aircraft compass had detached from its mount on the windscreen.

Meteorological information

The aerodrome forecast (TAF) for Archerfield Airport issued at 0907 on 28 April stated that conditions would be CAVOK (cloud and visibility ok and no significant weather phenomena). The forecast wind was 260° at 10 kt. Recorded weather conditions at 1130 were consistent with the forecast. The area forecast also did not show any adverse weather conditions, such as turbulence, that may have contributed to the aircraft experiencing a rapid change of direction or altitude.

Flight instructor guidance

The flight training school’s instructor guide outlined the procedure for teaching the use of the trim component of the effects of controls lesson. This procedure was in accordance with the guidance provided by the Civil Aviation Safety Authority in Appendix D of Civil Aviation Advisory Publication (CAAP) 5.14-2 (Flight instructor training (Aeroplane)).

The guidance stated that, with the student flying straight and level, the instructor would place the aircraft out of trim. The student then re-trimmed the aircraft to relieve the load on the controls. This was then repeated in the opposite direction of trim travel.

The CASA CAAP referred to the Federal Aviation Administration (FAA) Aviation Instructor’s Handbook, which stated:

Flight instructors should always guard the controls and be prepared to take control of the aircraft.

Safety analysis

Use of trim

When the student released the controls without re-trimming the aircraft, the aircraft entered a sudden dive. Since the flying school operator’s instructor guide did not include a limit to the amount of trim used during the ‘effects of control’ lesson, flight instructors could set the trim to differing amounts. On the occurrence flight, it had been set at about two-thirds nose-down travel. This amount meant that the aircraft’s nose-down response was more abrupt and stronger than needed to convey the intent of the lesson.

Instructor hand position

During the exercise, the instructor’s right hand was resting on the glareshield; this was not an optimal position to guard the controls and to be ready to react to any adverse student inputs. This, coupled with the suddenness of the movement and the instructor’s injuries, and being unsure as to the cause of the dive and best recovery technique, likely led to a delay in taking control of the aircraft and its subsequent recovery.

Dive recovery

The instructor attempted to regain control of the aircraft before placing the elevator trim into a neutral position, leading to the aerodynamic force being concentrated on the right horizontal stabiliser (where the trim tab was located) rather than spread across both stabilisers during the dive recovery.

These asymmetric flight loads, induced by the elevator trim imparting additional load on the right side, twisted the stabiliser at the forward outboard tip, about 30 mm downwards relative to its original position. This likely resulted in the right stabiliser being close to total failure. The large amount of nose-down trim at the time of the upset also increased the effort and effect required to recover from the dive.

Findings

From the evidence available, the following findings are made with respect to the loss of control of Cessna 152, registered VH-JIW, which occurred near Archerfield Airport, Queensland on 28 May 2019.

Contributing factors

• In the course of the student pilot’s first training flight, during a lesson in the effects of control, the student released control wheel backpressure suddenly.
• The instructor’s use of a large amount of nose-down elevator trim for the lesson increased the effect when the student released backpressure on the elevator, leading to a sudden nose-down pitch change and subsequent entry into a dive.
• The instructor was not prepared for the sudden nose-down pitch change, leading to a delay in the recovery from the dive.

Other factors that increased risk

• During the recovery from the dive, the horizontal stabiliser experienced excessive asymmetric flight loads, resulting in bending and buckling of the right horizontal stabiliser structure.

Safety action

The operator proactively revised its instructor guide for the use of trim. The new procedure introduced placing the aircraft into a cruise climb and explaining how the use of trim can reduce the control load. This ensured the student understood the required use of trim and the effect it had on the aircraft flight characteristics to maintain flight attitudes.

The revised instructor guide also included detailed instructor demonstrations prior to the student practicing the manoeuvre. The new procedure was taught with the aircraft in a nose-up condition only and ensured that all instructors were using the same trim input to maintain the best rate of climb.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Basair Aviation College
• instructor and student pilot
• Airservices Australia
• Bureau of Meteorology.

References

Civil Aviation Safety Authority March 2012, Civil Aviation Advisory Publication CAAP 5.14-2(0) Flight Instructor Training (Aeroplane).

United States Department of Transportation, Federal Aviation Administration 2008, FAA-H-8083-9, Aviation Instructor’s Handbook.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight instructor
• the student pilot
• Basair Aviation College
• Civil Aviation Safety Authority.

Submissions were received from:

• the flight instructor
• Basair Aviation College.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time: Coordinated Universal Time (UTC) +10 hours
2. The aircraft’s pitch trim system is utilised to relieve flight loads on the control wheel at a given attitude.