Loss of control

Executive summary

What happened

On 4 December 2021, the pilot of an Air Tractor AT-400 aircraft, registered VH-ACQ and operated by Aircair Aviation Operations Pty Ltd (Aircair), was conducting aerial spraying operations on a property 75 km west-south-west of Moree, New South Wales.

At 0632 Eastern Daylight-saving Time, the aircraft took off from the property’s airstrip with the first spray load. The pilot then completed 10 spray loads, each time returning to the airstrip where the loader mixed about 1,250 L of chemical into the aircraft’s hopper. During that period, the loader also refuelled the aircraft twice.

Prior to departing with the eleventh load, the loader again refuelled the aircraft to full and mixed chemical into the hopper. The aircraft then returned to the western side of the target block, where the pilot had been spraying in a racetrack pattern on the previous load. After descending to recommence spraying towards the south, the aircraft climbed and turned away to track north and overfly a flood-affected area. The pilot radioed the company operations manager expressing concern about the weather conditions and the potential for chemical to drift onto a neighbouring property. About 5 minutes later, the aircraft returned to the target block, this time on the eastern boundary.  

The pilot then conducted 2 ‘smoker’ runs to assess the drift, followed by 5 back-to-back (parallel) spray runs. At the end of the fifth spray run, the aircraft was observed to climb then enter a right procedure turn. During the turn, the aircraft descended rapidly, collided with terrain, and was subsequently destroyed by fire. The pilot sustained fatal injuries.  

What the ATSB found

The ATSB found that the aircraft was too close to the start of the spray run during the turn, which probably resulted in the pilot tightening the turn. This almost certainly resulted in an aerodynamic stall at a height too low to recover before colliding with the ground.

Mishandling the turn was probably a result of the combined effects of the pilot experiencing high workload and fatigue due to long flight and duty times, inexperience, the complexity of the task and the weather conditions. The combination of these factors would likely have identified an elevated flight risk, had an aerial application-specific flight risk assessment been conducted. However, it was not a requirement to conduct a flight risk assessment or to have a flight risk assessment tool.

The pilot was almost certainly wearing a helmet and 4-point restraint increasing their chances of survival in an accident. However, the aircraft’s fuel tanks ruptured during the accident sequence resulting in a fire and fatal thermal injuries to the pilot.

The aircraft was not fitted with a crash-resistant fuel system, nor was it required to be under the standards in place at the time of manufacture. The current standards also do not require it. The ATSB found that on average, post-impact fire in VH-registered certified aeroplanes results in one fatality every 2 years in Australia. As such, post-impact fire presents a significant risk of fire-related injuries and fatalities to occupants of general aviation aeroplanes.

What has been done as a result

As a result of this accident, Aircair has implemented additional fatigue management measures, which include an assessment of other factors that may contribute to fatigue and flight risk, within the regulatory fatigue requirements.

In August 2022, the operator’s pilot group completed training with an expert instructor in advanced stall and spin prevention, recognition and recovery. The operator is investigating ways to incorporate such training into its pilot induction program.

Safety message

An aerodynamic stall occurs when the aircraft’s wing exceeds the critical angle of attack. The angle of attack of the wing is caused by the angle of deflection of the elevator, independent of the airspeed, pitch attitude, angle of bank, weight and power. Therefore, pilots should remain aware that if they pull the control stick (or column) back too far and deflect the elevator too far, it will increase the angle of attack of the wing beyond the critical angle and stall it. The control stick position at which an aircraft will stall is therefore also independent of airspeed, pitch attitude, angle of bank, weight and power, but specific to the aircraft and may change with flap configuration. To un-stall the wing, the pilot has to move the control stick forward to a position corresponding to an angle of attack below the critical angle of attack.

Aircair pilots who completed the advanced stall/spin training (after the accident), found that discovering the stall stick position and its independence of other factors was very beneficial, particularly because they frequently operated at low level in a loaded aircraft, often towards the margins of the aircraft’s flight envelope. They also identified that the stall stick position in Air Tractor aircraft was forward of other aircraft types they had flown.

The US Federal Aviation Administration’s Airplane Flying Handbook (2021) stated that reducing the angle of attack is crucial for all stall recoveries. As aerial application pilots are usually operating at a height too low to recover from a stall, stall prevention by maintaining an awareness of elevator control input is key to preventing similar accidents.

The 2014 US National Transportation Safety Board Special investigation report on the safety of agricultural aircraft operations identified that risk management guidelines and best practices specific to aerial application operations were necessary to help operators and pilots mitigate their unique risks. These practices should include checklists for performing flight risk assessments to identify hazards specific to the task. Mitigation strategies should then be implemented to support pilot decision-making, particularly during high-risk activities.

Post-impact fire has been found to present a significant risk to aircraft occupants, including those conducting aerial application operations. Crash-resistant fuel systems have been proven effective in helicopters and in automotive applications. Implementing requirements for similar engineering countermeasures in existing, newly manufactured and newly certified FAR 23 aeroplanes, would reduce the incidence of fire-related serious injuries and fatalities in otherwise survivable accidents (TSB, 2006).

The occurrence

On 4 December 2021, the pilot of an Air Tractor AT-400 aircraft, registered VH-ACQ and operated by Aircair Aviation Operations (Aircair), was conducting aerial application (spraying) operations on a property 75 km west-south-west of Moree, New South Wales.

At 0604 Eastern Daylight-saving Time,[1] the aircraft departed Moree Airport and tracked to the property’s airstrip, 43 km south-west of Moree Airport. A loader was stationed at the property’s airstrip, whose role was to mix and load chemical into the aircraft’s hopper, and to refuel the aircraft.

A GPS tracker onboard the aircraft recorded data at 15-second intervals. The data showed that commencing at 0632, the aircraft took off from the property airstrip and sprayed 11 loads over the course of the morning.

For the first 8 loads, the aircraft remained within sight of the loader. Those loads were sprayed using a racetrack pattern (Figure 1). Each of the 8 loads took about 20 minutes, except the third load, which took 32 minutes as it included clean-up spray runs (across the direction of the pattern) and tracking to the next target area. Each time the aircraft landed at the airstrip, the loader mixed chemical and water totalling 1,250 L into the hopper. On 2 of those occasions, the loader refilled the aircraft fuel tanks.

Figure 1: Racetrack spray pattern

Source: ATSB

At 0914, while the pilot conducted the seventh load, the operations manager sent the pilot a text message advising that 4 of the target fields marked on the map were no longer to be sprayed (marked in orange in Figure 2). On the next (eighth) load, the pilot overflew an area marked on their map to be sprayed that day, which was adjacent to a river and under water due to flooding. As a result, the pilot radioed the operations manager to ask whether to spray the flood-affected area. The operations manager reported that they contacted the property owner but were subsequently unable to communicate with the pilot via radio to provide a response. 

Figure 2: Operating area including target spray blocks, location of airstrip, property boundary and neighbouring house 

Source: Aircraft operator information overlaid on Google Earth, annotated by the ATSB

At 1053, the aircraft took off with the tenth load and continued to fly north-south racetrack patterns from the western side of blocks 127 and 128, followed by an inspection of the northern end of the target area, before returning to land at the airstrip again at 1120. The loader then filled the aircraft with fuel and loaded 1,250 L of chemical into the hopper. While the loader did those tasks, the pilot had a snack and a drink, and conducted a walk-around of the aircraft, which they had done consistently during refuelling breaks throughout the day.

At 1126:15, the aircraft departed on the eleventh load and tracked again towards blocks 127 and 128 to recommence spraying the next run from where they had left off (as can be seen in Figure 3), in the racetrack pattern. The pilot commenced a run to the south, but before reaching the target crop, the aircraft climbed and turned left. The aircraft then overflew the northern boundary of block 127, which was also the property boundary. The operations manager heard the pilot on the radio expressing concern about the potential for chemical spray to drift towards a house on the neighbouring property due to the wind. The aircraft then tracked north and again overflew the flood-affected area (top of Figure 2 and Figure 3), before returning to the north‑eastern end of block 127 (Figure 3).

Figure 3: GPS data showing the aircraft’s track on the accident load

Source: Aircraft operator TracPlus data overlaid on Google Earth, annotated by the ATSB

A witness reported that on the first and second runs along the eastern boundary, which were towards the south and north respectively, the pilot used smoke to assess the drift from the wind, before commencing spraying on the next (third) run. Instead of a racetrack pattern, the pilot conducted back-to-back spray runs with a procedure turn at each end. In a procedure turn, the aircraft is initially turned away from the direction of the turn, usually about 45°, before reversing the direction and completing the turn to position the aircraft on the reciprocal heading for the next spray run (Figure 4).

Figure 4: Back-to-back patterns with procedure turns

Source: Aerial Application Pilots Manual (Aerial Application Association of Australia, 2011), annotated by the ATSB

After the two ‘smoker’ runs, the aircraft sprayed 4 runs. At 1145, the aircraft commenced a spray run towards the south, at the end of which the aircraft climbed. The aircraft’s last recorded position was at 1145:30 about 170 m beyond the southern end of the field and 180 ft above the ground.

A witness (‘Witness 1’, Figure 5) located in the neighbouring paddock to the east, observed the aircraft turn slightly left then enter a right turn, consistent with a procedure turn. During the turn, the witness observed the aircraft’s nose pitch down and it descended rapidly, right‑wing low, then disappeared behind trees. The witness reported seeing a black plume of smoke rise almost immediately afterwards.

Figure 5: Aerial photo of target spray area taken 10 December 2021, showing accident site and witness location  

Note: The yellow lines represent the block boundaries.

Source: Aircraft operator, annotated by the ATSB

Another witness positioned about 1 km south of the accident site, observed the aircraft’s distinct yellow colouring as it descended among trees and impacted the ground. The witness estimated this was followed within about 2 seconds by flames and smoke. The pilot was fatally injured, and the aircraft was destroyed.

Context

Pilot information

Medical, licence and qualifications

The pilot held a valid Class 1 Aviation Medical Certificate issued on 15 October 2021 with no recorded medical issues and was reported to have been fit and healthy. The pilot’s Commercial Pilot Licence (Aeroplane) was issued on 30 March 2021.

The pilot also held ratings for:

• single-engine aeroplane
• low-level
• aerial application[2]

and endorsements for:

• tailwheel
• manual propeller pitch control
• gas turbine engine.

The pilot attained Spraysafe accreditation[3] through the Aerial Application Association of Australia (AAAA) on 2 July 2021 and had been issued a Pesticide Licence by the New South Wales Environment Protection Authority on 24 August 2021.

At the start of the accident day, the pilot had accumulated 372.5 flying hours, 203.3 of which were conducting aerial application operations (including training), 31.7 of which were in VH-ACQ. 

Recent history

The pilot’s recent sleep-wake and work history was determined from a combination of interviews, text messages, logged flight times and recorded flight data.

The pilot lived about 30 km from their assigned base and about 70 km from the operator’s Moree base. In late November, the pilot’s commute was increased by about 1 hour as a road was inaccessible due to flooding.

On 2 December 2021 (2 days prior to the accident), the pilot left home at about 0600, returned at 2000 for dinner and was in bed by 2100. That day, the pilot recorded 13 hours of duty time and 8 hours of flight time. The pilot had described this as a huge day – the most spraying so far in one day – and was very tired at the end of the day.

The day prior to the accident, the pilot was awake by 0412 and left for work at 0530. That day, the pilot recorded 13 hours of duty time and 7.9 hours of flight time. At 1816, the pilot sent a text message to a friend stating that they were about to fall asleep in the aeroplane (but did not advise the operator), before ferrying the aircraft to Moree Airport for maintenance, arriving at about 1900. Rather than drive home, the night before the accident, the pilot stayed with another company pilot in Moree. The company pilot reported that the accident pilot was happy and was proud of having sprayed 1,100 hectares that day and 1,000 hectares the previous day. They went out for dinner at about 2100 and went to bed between 2200 and 2215. Others described the pilot that evening as a bit tired but nothing out of the ordinary.

The accident day was the pilot’s ninth consecutive day of duty. That morning, the pilot was awake by 0510 and picked up another company pilot at 0530. They purchased breakfast, snacks and lunch from a petrol station before heading to Moree Airport. The company pilot recalled that the pilot reported having had a good sleep, appeared fresh and not tired, and was very happy that morning. Other company pilots who had seen the pilot in the 24 hours prior to the accident reported that the pilot did not seem overwhelmed or stressed.

For the 3 days prior to the accident, the recorded flight times were the longest consecutive logged by the pilot (7.7, 8.0 and 7.9 hours) and the longest duty times (12, 13 and 13 hours).

Flight training

The pilot completed their commercial pilot licence flight test on 24 March 2021 with 166 hours total flying time. The pilot had completed an integrated training course, combining ground theory training with practical flight training for their private and commercial pilot licences. During this training, the pilot was described as a good student who was well-prepared, focused and dedicated. The pilot’s non-technical skills were assessed as being very good, and their aircraft handling skills were described as exceptional – including maintaining the aircraft well within the required tolerances in steep turns, practice forced landings and circuits. 

Aerial application training

The pilot commenced training for aerial application and low-level ratings on 15 June 2021, and achieved those, along with a tailwheel endorsement, on 30 June 2021. At that time, the pilot had accrued 204.3 hours total flying time. This included the aerial application rating training, which consisted of 31.1 hours dual (including test) and 5.5 hours solo aerial application flight time, conducted in a Piper PA-25 two-seat dual-control aircraft.

The instructor who conducted the pilot’s aerial application rating and endorsement, noted in the second lesson (16 June) that the pilot had carried out stalls in all configurations at 1,000 ft above ground level. The pilot was reported to have handled these well for their total flying experience and achieved a good standard in recovery from stalls during climbing turns with left- and right-wing drops.

The lesson conducted on 20 June was conducted on a field similar to the accident field – with a diagonal boundary and trees – and included conducting back-to-back runs with procedure turns (Figure 6). On the training day, the wind was about 5 kt in the downwind direction at the diagonal boundary. The lesson notes indicated the pilot initially had difficulty lining the aircraft up on the spray run after the turn. The notes from the following day’s lesson (21 June) included ‘needs to back off on turns, pulling too tight…at times near stall’. A similar comment was made on 28 June. The instructor reported providing feedback to the operator of VH-ACQ (Aircair), to keep an eye on this aspect, but overall assessed that the pilot flew very well when taking into account the limited hours of experience at that time. 

Figure 6: Diagonal boundary paddock example  

Source: ATSB

Employment at Aircair

The pilot was inducted into Aircair Aviation Operations (Aircair) in July 2021, and initially commenced working as ground crew – mixing and loading chemical. On 9 September, the pilot satisfactorily conducted an operational proficiency check flight with the chief pilot in a Cessna 185 aircraft. The pilot’s first aerial application job at Aircair was on 15 September 2021 in a Cessna 188B (C188B) aircraft – a conventional single-seat, piston-engine, strut-braced low-wing agricultural aircraft – having completed 2.4 hours of familiarisation in the aircraft in the previous 2 days. The pilot’s emergency dump training[4] in the C188B aircraft was assessed satisfactory on 21 October 2021, although recorded in the pilot’s logbook as 13 October.

The pilot then conducted aerial application in the C188B aircraft and on 22 November 2021, the chief pilot signed off that the pilot had completed the required 110 hours of aerial application under supervision. At that time, the pilot had accrued 321 hours of flying time.

The pilot was described as having a natural ability to pick things up quickly, flew very nicely and did everything they were asked to. The chief pilot and general manager of Aircair assessed that the pilot was then ready to progress to turbine-engine aircraft.

Gas turbine design feature endorsement

On 26 November 2021, the pilot commenced gas turbine engine endorsement training. The Civil Aviation Safety Regulations Part 61 Manual of Standards Schedule 2 detailed the skills and knowledge required to operate a gas turbine powered aircraft on the ground and in the air during normal and abnormal operations. The elements specified in the Schedule were starting, stopping and managing a gas turbine engine, and managing abnormal and emergency actions applicable to a gas turbine engine.

The endorsement required the pilot to complete ground (theory) components including studying the applicable flight manual, and then submit a written exam on the engine and aircraft to the examiner, which the pilot completed on 26 November 2021.

The pilot also received ground familiarisation of the engine and aircraft, followed by 7.5 hours of flight time in a two-seat dual-control turbine Air Tractor AT-504 aircraft. This included normal and abnormal situations, stalls and steep turns, and aerial application operations. The pilot’s stall training in the AT-504 aircraft consisted of climbing to a safe height, at which the supervising pilot demonstrated a straight and level stall, with the accident pilot following on the controls. The supervising pilot pointed out the stall buffet and the stall stick position, then demonstrated recovery from the impending stall, by reducing back pressure on the control stick. The supervising pilot commented that the AT-504 always tended to drop the right wing about 5° in the stall. The accident pilot then conducted two stalls. On the second of those, during the recovery, the aircraft nose lowered, and, assuming the aircraft had recovered from the stall, the pilot reapplied back pressure. However, as the wing was still stalled at the time, this action resulted in a secondary stall, from which the pilot performed a successful recovery.

Having demonstrated the ability to identify and recover from stalls, the pilot then conducted their first aerial spraying activity under supervision in the AT-504. The supervising pilot reported that the pilot had initially applied too much back pressure on the control stick (‘pulled too hard’) during the turn. This was due to trying to keep the aircraft too close to the paddock and led to a stall buffet during the turn. The supervising pilot reported that they reiterated the importance of the stall stick position, and the need to reduce back pressure on the control stick. The amount of force required on the control stick depended on the trim setting. If the aircraft was trimmed such that forward pressure was required during a spray run, the back pressure required to stall the aircraft was small.

The supervising pilot also reported advising the pilot to increase the amount of initial turn (‘fade’) away from the direction of the turn in the procedure turn, so the resulting turn was not as tight. They commented that the pilot subsequently flew the spray pattern ‘beautifully’.

The pilot received their gas turbine endorsement on 27 November 2021. The pilot had completed the requirements of the endorsement; however, it was noted that the theory examiner had signed off the endorsement although the flying component was conducted by a different pilot. At the time the theory component was conducted, a dual-seat aircraft was not available to conduct the in-flight competencies, and as a result, the examiner would have had to observe the pilot solo in a single seat aircraft from the ground. The operator assessed it would be more effective and safer to wait until the dual-seat aircraft was available. The theory examiner was not available when the dual-seat aircraft became available and the flying component was supervised by a pilot whose instructor rating was not current as it had not been renewed, primarily due to COVID restraints. They had however, previously conducted 5 gas turbine endorsements before their rating lapsed, and subsequently renewed their instructor rating in 2022.

Transition to the AT-400

On the morning of 28 November, the pilot conducted circuits in the AT-504 in preparation for transitioning to the single-seat AT-400 aircraft.

The operator reported that they had put many less-experienced pilots in VH‑ACQ over the last 40 years, primarily because it never lacked take-off performance, even when fully loaded. They assessed that the biggest differences the pilot would have found in transitioning from the C188B to the AT-400, were that the operating speed of VH-ACQ was about 20 kt faster, it was heavier and had more inertia. Due to its inertia, it would take longer to recover from an impending stall than the C188B. The operator noted that the cockpit layout of VH-ACQ was very similar to the C188B but more ergonomic. The main difference was the Satloc GPS display, which had a touchscreen in the C188B, but a keypad in the AT-400. The pilot had reportedly noted during their endorsement that this was something they would have to get used to.

Before the accident pilot’s first flight in the AT-400 (VH-ACQ), the Aircair general manager reported briefing the pilot about the aircraft. This included cautioning the pilot to keep the airspeed up in the turns because of the shorter wings, without Hoerner wing tips (Appendix A – Hoerner wingtips), and higher wing loading[5] than the AT-504. As a result, VH-ACQ tended to give less pre-stall buffet indication before stalling. However, the general manager advised the pilot that the stall characteristics were similar to the AT-504, in that the AT‑400 would likely drop a wing in a stall and stall recovery required the pilot to reduce back pressure on the control stick. This was consistent with descriptions by other pilots who had flown VH-ACQ. They described it as providing a stall buffet later in an impending stall than an AT-502. Additionally, that it tended to drop a wing when close to the stall, and that all Air Tractors can produce a significant wing drop when close to the stall in an unbalanced turn.

On 29 November, the pilot conducted familiarisation and circuits in VH-ACQ, before commencing revenue operations with a reduced hopper load (1,000 L), mentored from the ground by the chief pilot. The next day, the chief pilot approved an increase to 1,200 L hopper loads for 3 days, before assigning a maximum hopper load of 1,300 L on 3 December. That was still the pilot’s assigned limit on 4 December.  

The chief pilot reported that the pilot appeared to be coping well with the transition to VH-ACQ. The pilot had described the transition to the AT-400 as ‘like learning to fly again’ and had remarked that they loved flying VH-ACQ. The pilot had reportedly commented that because of the air conditioner in VH-ACQ, they did not get as tired as when flying the C188B. The pilot and chief pilot had spoken each day that the pilot flew VH-ACQ, up to the accident day. The chief pilot reported that this included discussion of general management of the turbine engine, and that the pilot had not indicated any deficiency in operating the aircraft.

Ongoing supervision and mentoring

During the pilot's flights at Aircair, they were typically supervised either by the chief pilot or the general manager flying in the same area or observing from the ground. Regardless of having completed the mandatory supervised hours, the chief pilot advised that inexperienced pilots were typically ‘spoon fed’ up until 800–900 hours of agricultural flying.

The pilot had been conducting aerial spraying on the same property on the 2 days before the accident. The chief pilot had briefed the pilot at the end of the day prior to the accident, and discussed what blocks had been done, which to do next and the expected weather noting the wind direction and forecast high temperature. The chief pilot was absent on the accident morning and did not speak to the pilot.

The chief pilot reported that they would have been on the radio with the pilot if they had not been called away on leave that day. As a result of that leave, on the day of the accident, the pilot was unsupervised for the first time. However, the Aircair general manager radioed the pilot at 0645 to check how they were going, and the pilot responded that they were good and had a plan for the day’s operation.

Aircraft information

VH-ACQ

VH-ACQ was an Air Tractor Incorporated AT-400 single-seat low-wing tailwheel agricultural aircraft manufactured in the United States (US) in 1980. It was first registered in Australia – to Aircair – in November 1980 to operate in the Agricultural category, and was later operated in the Restricted category.[6] The Certification basis was US Federal Aviation Regulation (FAR) 21.25(a)(1) and the aircraft met the structural requirements of FAR 23, basis February 1, 1965, through Amendment 23-9. The flight criteria, propulsion, system and equipment items met the requirements of Appendix B, Civil Aeronautics Manual (CAM) 8, November 15, 1951, as amended through January 10, 1956.

The aircraft was powered by a Pratt & Whitney PT6A-15AG turboprop engine, which drove a Hartzell HC-B3TN-3D three-blade constant speed reversible pitch propeller.

The aircraft was fitted with two fuel tanks, located in the inboard section of each wing and an integral part of the wing structure. Both tanks gravity fed into a small header tank, located behind the hopper. Their combined total fuel capacity was 476 L, of which 454 L was usable. This equated to a maximum usable fuel weight of 363 kg (using a specific gravity of 0.8 for Jet A1 fuel). The aircraft was also fitted with dispersal equipment for spraying and spreading, and a system that allowed the hopper contents to be dumped if required. The hopper had a capacity of 1,514 L.

Maintenance history

The aircraft was maintained by a Civil Aviation Safety Authority (CASA)-authorised maintenance organisation in accordance with a CASA-authorised system-of-maintenance. A periodic inspection, including annual, 150 and 300-hourly, was completed on 28 September 2021, with the current maintenance release issued at that time. Scheduled and preventative maintenance conducted during this time included:

•  engine overhaul and fitment of an overhauled propeller assembly
•  replacement of lower spar caps (due life limit), with wing disassembly allowing for wing repairs and hopper refurbishment
•  testing of the airspeed indicator, altimeter, compass and pitot/static system
•  corrosion treatment and repainting.

At the time of the accident, the aircraft had accrued 18,869.2 hours total time in service. The aircraft had flown 4 hours 42 minutes since maintenance, having undergone a scheduled 75-hour inspection the evening prior, which included checking air and fuel filters, tyres, brakes and governor. The maintenance release had likely been destroyed in the post-impact fire and was not recovered from the accident site. However, there was no report of any aircraft defects prior to the accident. Furthermore, a general review of the maintenance records did not identify any anomalies.

Aircraft operating weight

The AT-400 type certificate data sheet[7] specified a maximum weight of 2,722 kg (6,000 lb). For VH-ACQ to operate above that weight, Air Tractor Service Letter 304 – Establishing and operating with a special purpose operating weight for Air Tractor aircraft, applied. The Service Letter referenced methods described in CAM 8 to enable operations up to a maximum recommended weight of 3,565 kg (31% overload). A placard affixed to the aircraft stated the maximum take-off weight as 3,565 kg. The Service Letter stated:

When operating at weights above the certificated maximum weight, please note that the stall speeds will increase from the published stall speed numbers in the Airplane Flight Manual. For example, when operating at a 31% overload weight, the stall speed will be approximately 15% higher than at the certificated maximum weight. During the required flight check, the new stall speeds should be determined.

On 23 October 2018 at 18,098.2 hours total time in service, the airframe logbook included an entry stating that the aircraft was flight checked on that day in accordance with CAM 8.10-3(e). It was found to be safely controllable and to operate satisfactorily with the hopper load of 1,356 kg and aircraft total weight of 3,565 kg.

Accident load weight and balance

The Airplane Flight Manual (AFM)[8] for VH-ACQ included a load data sheet to calculate the aircraft’s weight and balance. The sheet contained a table with entries for the weight, arm and moment of the aircraft with sprayer and spreader configurations, pilot, baggage, hopper and fuel. The table also provided forward and aft centre of gravity (CG) limits for weights up to 2,269 kg and for 2,722 kg, with a straight-line variation between those points.

For the accident load, VH-ACQ had been refuelled to full and the hopper loaded to about 1,250 L. Using a fuel consumption rate of 225 L/hr for spraying based on the company’s operations manual, the probable fuel remaining was approximately 387 L (310 kg). The pilot had completed 4 spray runs about 1,700 m long at an 18 m wide swath, using a chemical application rate of 18 L/ha, which left about 1,030 L in the hopper. The accident weight was therefore approximately 3,066 kg, below the demonstrated maximum gross weight of 3,565 kg, and the CG was about 534 mm aft of the datum. This was within extrapolated CG limits.

The hopper load calculation table for VH-ACQ stated that with full fuel, the maximum permissible hopper load was 1,348 kg.

Fuel tank certification and testing

For the aircraft’s certification, CAM 8.3052 Tank Tests required that all fuel tanks should be pressured tested to 3.5 PSI to provide an indication of the ability of the tank to resist distortion and leakage under vibratory, accelerating, and surging loads, which may be encountered in flight and landing conditions.

FAR 23.967 (e)(1) stated that the fuel tank must withstand 9 G ultimate fore and aft load from emergency landing conditions. Air Tractor simulated this in testing by converting the acceleration to an internal pressure. Air Tractor provided an extract of the engineering report covering the fuel tank testing. Their testing found that using 20 PSI, the fuel tanks were capable of withstanding 27 G before leaking.

These two requirements were for flight, landing and emergency landing conditions, but did not assess the tank for tolerance to direct impingement. There was no requirement in the design standards for normal category aeroplanes to be tested for fuel tank crashworthiness.

Installed GPS systems

Systems

The aircraft was fitted with a TracPlus surveillance system, which provided real-time tracking through a satellite or mobile phone network. It reported position, altitude, and speed at set time periods, in this case every 15 seconds. The ATSB obtained TracPlus data for the accident day and several previous flights.

A Satloc aerial guidance system provided the pilot with guidance commands to fly accurate spray patterns. It was set to record at 2-second intervals. The Satloc data from the accident flight was unrecoverable due to extensive fire damage to the Satloc unit. However, the ATSB obtained Satloc data for several of the pilot’s previous flights. 

Satloc increase/decrease

The Aircair Air Tractor fleet all had the same control stick switch configuration. The Satloc stick switch (button) provided a ‘remote’ function to increase or decrease the run number, which could also be done on the Satloc keypad (Figure 7).

Figure 7: Satloc stick switch and keypad

 

Source: ATSB

The Satloc keypad could be set to either increase or decrease the run numbers. When set to increase, pressing the stick switch (button) once, increased the run number by one, and when set to decrease, pressing the stick switch once decreased the run number by one. When a pilot had set up the Satloc GPS to spray a racetrack pattern, then changed to fly a back-to-back pattern, they would then be spraying every second run number (with the alternate numbers on the other side of the programmed racetrack pattern). Therefore, the next parallel spray run required the switch to be double-clicked at the end of each run to spray the adjacent, parallel run.

The stick switch could only make the run numbers go one way: up if increase was set or down if decrease was set. Therefore, if a pilot inadvertently clicked the button too many times and needed to go back, that would have to be done using the keypad.

When the Satloc was set to decrease, this swapped the direction function of the keypad buttons: the up arrow on the keypad (labelled ABC) would then decrease the run number and the down arrow on the keypad (labelled DECR) would increase the run number. Reportedly, this frequently resulted in pilots pressing the incorrect (for example, up arrow) button first, then having to press the correct one (for example, down arrow) multiple times. This would require ‘head in cockpit’ time and the potential for distraction from controlling the aircraft. The US Federal Aviation Administration (FAA) Advisory Circular 137-1A stated that pilots should ‘use extreme caution when using GPS swath-marking equipment to prevent diverting attention away from the task of flying the aircraft safely’. 

Meteorological information

Bureau of Meteorology

Between 0600 and 1145 on the accident day, the pilot was operating within the NSW - West subdivision of the Bureau of Meteorology Graphical Area Forecast.[9]. The forecast for NSW - West issued at 0323 on 4 December and valid 0400–1000 was for visibility greater than 10 km and no cloud. The graphical area forecast issued at 0325 and valid 1000–1600 included scattered high cloud above 10,000 ft and, from 1100, isolated cumulonimbus clouds with visibility reducing to 2,000 m in isolated thunderstorms and rain. Moderate turbulence below 10,000 ft was forecast in thermals and dust devils[10] from 1200.

The nearest Bureau of Meteorology weather station was at Moree Airport, 80 km east-north-east of the property airstrip. The aerodrome forecast[11] for Moree Airport issued at 0424 and valid from 0600–1900 included wind from 360° at 8 kt, changing from 1100 to 240° at 14 kt and CAVOK.[12] Between 1100 and 1500, there was a 30% probability of variable winds at 20 kt gusting to 40 kt with visibility reducing to 2,000 m in thunderstorms with rain and associated scattered cloud at 800 ft above aerodrome elevation. The maximum temperature was forecast to reach 34 °C.

Oz Forecast

For more accurate local weather information (temperature and wind speed/direction), company pilots usually referenced the closest Oz Forecast weather station. The wind was measured 2 m above ground level and recorded in km/h and degrees true (°T). The nearest Oz Forecast weather station was located 11 km west of the property airstrip. Data from that weather station recorded at 15-minute intervals and converted to kt, is shown in Table 1.

Table 1: Weather recorded at 15-minute intervals from 0600–1200 EDT

Time	Temperature	Wind direction (°T)	Wind speed (kt)	Wind gust (kt)
0600	21.6	250	0.5	1.6
0615	21.5	227	2.4	5.4
0630	22	230	4.0	5.9
0645	22.8	227	4.1	5.9
0700	23.9	225	4.2	5.9
0715	24.8	219	4.6	7.0
0730	25.6	217	4.3	7.0
0745	26.3	196	4.5	5.9
0800	27.1	194	4.4	7.0
0815	27.5	195	5.1	7.6
0830	28.1	191	5.8	10.3
0845	28.4	192	6.6	11.3
0900	29.2	198	7.1	12.4
0915	29.6	190	7.6	11.3
0930	30	209	6.0	10.3
0945	30.3	192	5.3	9.7
1000	30.9	221	5.4	11.3
1015	31.3	221	5.4	10.3
1030	31.8	220	5.7	11.3
1045	32.2	228	8.2	14.0
1100	32.5	215	9.6	17.3
1115	32.3	230	10.6	17.3
1130	32.5	213	9.4	16.7
1145	32.6	225	10.2	18.4
1200	32.5	221	10.3	18.9

Source: Oz Forecast

At the time of the accident (1145), the wind was from the south-west at 10 kt gusting to 18 kt and the temperature was 32.6 °C. On the last spray run, as the aircraft had been tracking south, the wind was primarily a headwind. As the aircraft started to turn, it initially encountered more of a crosswind. The accident occurred as the wind became a quartering tailwind, but before completion of the turn to the north.

Other observations

A witness described the wind at about the time of the accident as ‘chopping and changing directions, was more stop and start again…gusts on and off’. The loader also described the weather as ‘windy’ and reported that the wind had become stronger throughout the morning.

At the time of the accident, the Aircair general manager was flying near Moree Airport, where the temperature was about 32 °C. They described the flying conditions as starting to get ‘bumpy and uncomfortable’ and about 30 minutes after the accident, as ‘quite windy and rough’. They reported that on the accident day, the wind had started from the north-east and went around to the north-west during the morning, in the usual summer pattern, but that it was stronger than normal, and increased around the time of the accident.

Another company pilot operating in the area that day recalled that it was the first hot, rough day of the season.

The chief pilot reported that on the evening before the accident flight, during their briefing with the pilot, they discussed the forecast 35 °C temperature. This included discussion of the associated increased thermal activity, which may lead the pilots to cease spraying operations.

At the time of the accident, the sun was not in a position to affect the pilot’s visibility.

Operational information

Work orders

The pilot had operated at the same property on 2–4 December. The blocks allocated to the pilot to be sprayed were depicted on multiple work orders for the property, one of which is depicted in Figure 8. Of the blocks depicted in Figure 8, on 4 December the pilot sprayed blocks M10, M11, M24, M25, M118, before commencing blocks 127 and 128. Block 117 was the wet area along the river and 123, 124 and 125 were not to be sprayed (although as they had powerlines in them, the pilot had been told not to spray them anyway).

Figure 8: Work order map depicting areas to be sprayed and location of the accident site

Source: Aircraft operator, annotated by the ATSB

Field selection

The operator reported that they selected blocks for spraying appropriate to a pilot’s experience and ability – including the block shape and whether there were powerlines in or near the target area. The accident pilot had not yet sprayed a block with a powerline in it, but had sprayed blocks with a powerline along one edge in the previous two weeks. Although not documented, it was reported that when any new aspects of the spraying task were introduced, the chief pilot or general manager would be there to mentor the pilots – either on the ground or flying next to them. The gradual progression to more complex blocks continued with the pilot’s transition to a more powerful, faster, heavier aircraft.

The field the pilot was spraying at the time of the accident (127 and 128 – Figure 8) was selected by the chief pilot because it was considered suitable for the pilot’s level of experience, with no powerlines or difficult obstacles. The blocks sprayed by the pilot the previous day were irrigated blocks – squarer and more defined. The accident field was a dry-land block with a few small trees. The field was near rectangular, but it had a diagonal border at the southern end, and the eastern and western fence lines were not quite parallel. The diagonal border angled down toward the western side, which would have made the back-to-back spray runs with a procedure turn at each end slightly more difficult for the pilot when incrementing runs from east to west. This is because with a diagonal end, each subsequent time the pilot pulled the aircraft up to make the procedure turn, the aircraft had to be further beyond the boundary to allow enough distance to line up for the next run (Figure 6).

Back-to-back pattern

According to the AAAA Aerial Application Pilot’s Manual (2011), the back-to-back pattern was the most common pattern flown prior to the availability of on-board GPS systems. It was usually the first pattern pilots learnt in their initial aerial application rating training. Flying back-to-back patterns was the preferred pattern when working around a hazard, such as a powerline, tree, susceptible crop, or house. This was because in a back-to-back pattern, the aircraft would be gradually moving towards a hazard. In contrast, when flying a racetrack pattern, the aircraft moves away from the hazard, which could be more easily forgotten on the next run. In a back-to-back pattern, during the procedure turn at the end of each run, the aircraft is turned through 180°. During the turn, ‘most of the speed is squandered and you arrive back on the same [reverse] heading at which you started the turn, with time and speed both going in the wrong direction’ (AAAA, 2011).

The operator reported that during a procedure turn, pilots judge how far to turn away (fade) by using the GPS light bar for guidance, counting (for example, for 3 seconds) in their head, or by feel, before banking the opposite way around the turn. If they do not get it right, it can be difficult to line up on the next run. In that case a pilot would normally skip that run and write the missed run number on their hand. They would then either return to spray it later or leave it and advise the operations manager at the end of the day, so that it would get done another day. The chief pilot reported having previously seen the pilot with missed run numbers written on their hand.

In a procedure turn, after the fade, as a pilot banked to turn the aircraft in the opposite direction, they would extend some flap during the turn, usually up to about 15° in the Air Tractor aircraft. They would then retract the flap as the aircraft lined up for the next spray run. The chief pilot reported that the key instrument referenced by a pilot during the turn was the airspeed indicator, while also cross-referencing the GPS light bar, and using the turn and balance indicator (ball) to ensure a balanced turn. The target airspeed they were referencing on the airspeed indicator depended on the aircraft weight.

Flight and duty review

Aircair flight and duty time limitations were in accordance with Civil Aviation Safety Regulations Part 137.Q. The key limitations were:

• maximum flight time of 170 hours in 28 days and 1,200 hours in 365 days
• daily tour of duty limit of 14 hours including a rest period of at least 8 hours after a duty of 10 hours or less, or 10 hours after a duty of more than 10 hours
• following a tour of duty of more than 10 hours, a pilot was permitted to recommence after 9 hours off duty, if they believed they were mentally and physically fit to do so and would not breach any other regulation in the subpart
• at least 36 hours continuous off duty in any 14 days
• 44 hours cumulative duty time limit in 3 days (72 hours) and 98 hours in 7 days (168 hours). 

The Aircair Administration and Policy Manual stated that for aerial application operations, duty time was calculated from 30 minutes prior to the flight to 15 minutes after the flight. The regulations defined flight time as commencing when ‘the aircraft first moves under its own power for the purpose of taking off’.

On the accident morning, the aircraft engine started at 0553, take-off roll commenced at 0559 and it took off at 0600. According to Aircair’s procedures, recorded duty time would commence no later than 0529, although the pilot arrived at the airport at about 0550. According to the operator’s flight and duty records, the pilot had been on duty for 13 hours the previous day, having commenced duty at 0700 and ended at 2000. Recorded data showed the aircraft was shut down at 1919 that evening and duty time should therefore finish no earlier than 1934.

As the previous day’s duty time exceeded 10 hours, the pilot was required to have a rest period of 10 hours, but could recommence duty after 9 provided the pilot assessed themselves ‘mentally and physically fit to do so’. The pilot’s start time was close to the 10-hour rest period, accounting for imprecision of the recorded duty times. It could not be determined whether the pilot made this assessment, however, regulations required pilots to ensure they were fit for duty prior every flight. Civil Aviation Safety Regulation 137.300 described that a pilot was not fit for duty if they had not had adequate rest, food or drink; or was adversely affected by a medical condition or a psychoactive substance.

The pilot commenced flying for Aircair on 9 September 2021 and flew 15.5 hours total for the month. In October, the pilot flew 54.8 hours in the C188B aircraft, over 18 days, with the longest flight time 7.3 hours on 6 October followed by 6.3 hours on 7 October. From 1 to 24 November, the pilot conducted 50.4 hours in the C188B. In that period, the longest flight time was 6.6 hours on 16 November which was also the longest duty day of 10.5 hours. The previous longest flight time recorded was on 6 October (7.3 hours). Both those days had been preceded by significantly shorter flight times.

The pilot’s most recent day off work prior to the accident was 25 November. After their day off, on 26 November the pilot commenced the transition to turbine-engine aircraft. Figure 9 and Table 2 show the pilot’s flight and duty records from 26 November to 3 December. The first time (ever) that the pilot flew VH-ACQ, was 5 days before the accident on 29 November. On that day, the pilot was awake at 0454 and home at 2126, having logged 5.6 hours of flight time in VH-ACQ.

Figure 9: Recorded flight and duty times from 26 November to 3 December 2021

Source: Aircraft operator data analysed by the ATSB

Table 2: Flight and duty records from 26 November to 3 December 2021

Date	Aircraft	Flying hours	Activity	Duty hours (and times)
26 Nov	AT-504	0.9	Dual training	10 (0800–1800)
27 Nov	AT-504 CA188B	6.1 (dual) 1.7	2.6 training plus 3.5 spraying Spraying	10 (0700–1700)
28 Nov	AT-504 CA188B	0.5 3.0	6 circuits ICUS Spraying	6 (0800–1400)
29 Nov	VH-ACQ (AT-400)	5.6	5 circuits (Tracplus shows 4 circuits at Moree) plus spraying 1,000 L load limit	8.5 (0800–1630)
30 Nov	VH-ACQ	2.5	Spraying 1,200 L load limit	6 (0930–1530)
1 Dec	VH-ACQ	7.7	Spraying 1,200 L load limit	12 (0730–1930)
2 Dec	VH-ACQ	8.0	Spraying 1,200 L load limit	13 (0700–2000)
3 Dec	VH-ACQ	7.9	Spraying 1,300 L load limit	13 (0700–2000)

In the 8-day period since the pilot’s last rest day, there were some discrepancies between the logged flight and duty times and the recorded GPS data for the aircraft. On 3 December, the aircraft was rolling at 0647, 13 minutes prior to the recorded duty commencement. On 29 November, the aircraft landed at 1841 and on 26 November, the aircraft landed at 1932, both times after the recorded end of duty period. It was the pilot’s responsibility to enter the flight and duty times and it could not be determined how the inconsistencies occurred. The chief pilot reported that they checked the entered data occasionally.

Operational tempo

A review of text messages the pilot sent to a friend (but not to the operator) showed that since October and throughout November, the pilot had often mentioned that they felt tired, and had frequently been awake at or before 0500, and getting to bed after 2100. 

The accident pilot had flown more than 30 hours in VH-ACQ in the 4 days prior to the accident. The chief pilot commented that the company pilots had been doing a lot of flying and were approaching the flight and duty limits every day. Other company pilots reported that they had been working long, but not excessive, days. Further, that although they had early starts, they were not finishing very late.  

On the day before the accident, the chief pilot had reported being worried about the company pilots with the workload ahead. The chief pilot sent a text message to check they were all managing the workload and reminding them to work together with each other and the ground crew, stick to the routine and keep it simple. Later that day, a company aircraft struck a powerline, which resulted in minor damage and no injuries to the pilot.

In response, on the morning of the accident flight, the chief pilot sent a message to all company pilots, reminding them, among other things, to be aware of the effects of successive early starts and late finishes. The message advised pilots to manage their time and rest when they could, consider load sizes particularly following refuelling, maintain wire awareness, and to be safe, have fun and keep it simple.

Communications

The UHF radio in VH-ACQ had malfunctioned on the day prior to the accident and been fixed that evening. The UHF radio was used to communicate with the operations manager, other company pilots in the area and normally, with the loader. However, the loader did not have a radio that day as they were not driving a (company) vehicle fitted with one. Normal procedure involved the pilot communicating with the loader via radio so the loader could prepare the next chemical load prior to landing. The operator also had a procedure for loaders to operate with an unserviceable UHF, which required the loader to either mix load by load only, or to continue mixing until further notice, and to have a mobile phone. The loader had a mobile phone.

During refuelling prior to the accident load, the pilot sent a text message to the operations manager and received an immediate response. After departing with the accident load at about 1130, a company pilot operating in the area heard the accident pilot on the radio to the operations manager advising of their concern about drift onto neighbouring property and that the wind was picking up. That company pilot later reported that they thought the pilot sounded nervous. The operations manager reportedly responded suggesting they could spray a different area or cease operating.

Analysis of recorded data

The TracPlus data for 4 December 2021 indicated that the pilot had not flown a hazard check of any block before commencing spraying or conducting clean-up runs. This meant the pilot had not overflown the south-eastern area of the block (127 and 128) where the accident occurred.

For the accident load, several data points were recorded at the northern and southern ends during the turns. Analysis of these points indicated the maximum height reached during the turn at each end of the field was about 250 ft above the ground.

Analysis of Satloc data from the pilot’s flight the day prior to the accident, showed that in more than 75% of procedure turns, the peak angle of bank was 50–70° and peak acceleration was between 1.5 and 1.9 G. The angle of bank exceeded 80° three times and the peak G on average occurred at about the same time as the peak angle of bank. In the turn technique described in the AAAA’s Aerial Application Pilot’s Manual (AAAA, 2011), the peak G would be reached before the peak angle of bank:

A key pilot technique in aerial application is to unload the aircraft from excessive G before applying aileron to initiate a turn. This is most likely to be relevant during a pull out of a paddock at the end of a run. Pull back to get out of the paddock and establish the aircraft in a climb, unload the G, and then initiate the turn. 

The Satloc data from the day prior to the accident also showed that during back-to-back spray runs with procedure turns, the aircraft was usually lined up (within half a swath width) on the next spray run about 200 m prior to the crop boundary.

Aerodynamic stall

A wing generates lift when the airflow around the upper and lower surfaces results in a pressure difference between those surfaces. At a certain angle of attack (the relative angle between the chord line of the wing and the approaching airflow), which is a characteristic of the wing design, the flow over the upper surface of the wing separates from the surface. This condition is known as an aerodynamic stall (or simply a stall) and results in a rapid reduction in the lift generated and an increase in drag. Due to the sudden reduction in lift from the wing and rearward movement of the centre of lift, an uncommanded nose-down pitch ensues.

A wing drop occurs when one wing stalls before the other, which can be exacerbated by uncoordinated (or ‘unbalanced’) flight. A cross-control stall occurs when the critical angle of attack is exceeded while aileron is applied in one direction and rudder in the opposite direction.

As a loss of altitude also occurs during recovery from a stall, it is possible to stall with insufficient height above the ground to recover. The AFM for VH-ACQ stated the altitude loss from a wings-level stall was 220 ft at 2,722 kg gross weight. The main indications of an impending stall in the AT-400 are airframe buffeting (vibration) and an aural stall warning (horn).  

Aerofoils of the type used on aircraft such as the AT-400, typically stall at angles of attack of around 16°. This critical angle of attack can be exceeded at any airspeed, any (pitch) attitude and any power setting. As most small aircraft do not have an instrument that indicates the aircraft’s angle of attack, the angle of attack at which the stall occurs may be referenced to an airspeed. The AFM for VH-ACQ provided stall speeds at 2,722 kg gross weight, power off, wings level (0° angle of bank), in a balanced level turn at selected angles of bank, and with the flaps up (retracted) and flaps down (fully extended) (Table 3).

Table 3: Angle of bank and stall speed at 2,722 kg, power off (adapted from AFM)

Angle of bank	0°	15°	30°	45°	60°
Stall speed (kt) – flaps up	66	67	71	78	93
Stall speed (kt) – flaps down	59	60	63	70	83

However, the airspeed at which a stall will occur is not fixed to a single value, and varies with weight, centre of gravity, load factor,[13] and power setting. Tight turns and rapid pull-ups increase the load factor and therefore increase the stall speed. A stall that occurs at a stall speed greater than the +1 G stall speed, such as when turning or pulling up, is termed an accelerated stall. Increasing an aircraft’s weight by 25% will result in the stall speed being about 12% faster.

At the probable aircraft weight at the time of the accident (3,066 kg), the stall reference speeds in the AFM (Table 3) would increase by a factor of 1.06. For the referenced angle of bank stall speeds, if the pilot did not move the control stick aft to maintain level flight, and the aircraft descended while turning, (at the same radius), the G would be less, therefore the stall speed would be lower than when maintaining a level turn.

The primary control for angle of attack is the aircraft’s elevator. Pulling back on the control stick will increase the angle of attack and pushing forward will decrease the angle of attack. If a pilot pulls the stick too far back and deflects the elevator too far, it will increase the angle of attack of the wing to the critical angle and stall it. The elevator control stick (or column) position at which the critical angle of attack is reached is independent of factors including airspeed, angle of bank, power, and pitch attitude. Recovery from a stall requires reducing the angle of attack by moving the control stick forward, which normally means lowering the aircraft nose (pitching down). A secondary stall can result following a stall if, during the recovery, the pilot again pulls the stick past the position at which the critical angle of attack is reached in an effort to regain horizontal or climbing flight too quickly.

As VH-ACQ was the ‘first of type’ AT-400 registered in Australia, flight tests were conducted at Ballarat airfield, Victoria, on 31 October and 2 November 1980. At the flight-tested weight of 3,042 kg, the report concluded that the handling characteristics were acceptable. It found the airframe (pre-stall) buffet was felt at 76 kt indicated airspeed (IAS) with the flaps up (fully retracted) and was ‘not violent’. There was a ‘clear and distinctive’ stall warning onset at 80 kt IAS with flaps up (fully retracted) and at 68 kt with flaps down (fully extended). The stall characteristics were described as ‘satisfactory’.

Human performance considerations

Workload

Workload is defined as the sum of task demands placed on an individual’s cognitive resources that are used for attention, perception, decision making and action (Skybrary, 2010). Humans are limited in the amount of new information the brain can process at once. Once the limit of cognitive resources has been reached, performance starts to decline with increased error rates and/or delayed responses. Factors that can increase workload include excessive task demands, time pressures, a lack of operator skills and knowledge, or environmental conditions (NASA, 2010).

Task complexity and an individual’s level of experience and knowledge can have a significant impact on their workload (Li and others, 2021). Less experienced pilots typically have a higher cognitive workload compared to those that are more experienced due to their continual learning and development of skills. A more experienced and knowledgeable individual can rapidly interpret a situation based on past experiences and knowledge, and subconsciously pattern-match. This frees up cognitive capacity for a pilot to maintain vigilance and monitor performance, and, if they choose, reflect on their actions, whereas a less experienced individual may not (Byrne and others, 2013).

Green and others (1996) described the effect of practice on motor skills such as flying an aeroplane. With experience, skill acquisition progresses from the cognitive phase, in which the learner has to think consciously about the action, through the associative phase and on to become automatic, and the skill can then be executed without conscious control. Until this occurs, central processing capacity is needed to perform the task. Thus, a pilot with fewer hours in an aeroplane type would be expected to experience a higher workload than a more experienced one for the same task.

The instructor who conducted the pilot’s aerial application rating described the increase in workload for a pilot progressing from the C188B to the AT-400 as: ‘The workload is just so high for [the AT-400 aircraft] – they’re fast, nippy in the turn. If you are going to fly it on the edge, things are going to happen. It has more than double the weight and inertia’ of the C188B. They further reported that aerial application work is ‘not mundane’, that the pilot would be concentrating all the time, and has to consider other factors such as drift and temperature, in addition to flying. To conduct effective aerial application, while manoeuvring the aircraft at low altitude, a pilot must visually scan external cues and monitor internal resources (NTSB, 2014).

High workload is associated with increased error rates and reduced safety margins (Harris, 2011). It also leads to a degradation in performance and at extremely high levels of workload, important information may be missed due to the narrowing or focussing of attention onto only one aspect of the task (Green and others, 1996).

Fatigue

Overview

The Civil Aviation Safety Regulations define fatigue for a flight crew member (FCM) as:

a physiological state of reduced alertness or capability to perform mental or physical tasks, which:

• may impair the ability of the FCM to safely operate an aircraft
• is caused by 1 or more of the following: 
  • the FCM’s lack of sleep;
  • the FCM’s extended wakefulness;
  • the FCM’s circadian phase at any relevant time;
  • the FCM’s workload of mental activities, or physical activities, or mental and physical activities at any relevant time.’

The International Civil Aviation Organization (ICAO) (2020) defines fatigue as:

… a physiological state of reduced mental or physical performance capability resulting from sleep loss or extended wakefulness, circadian phase, or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety-related operational duties.

Factors that can cause fatigue include (CASA, 2012):

• emotional strain
• mental workload
• strenuous or sustained physical exertion
• inadequate food and fluid intake
• adverse environmental conditions, such as extremes of temperature, low light levels, vibration and confined spaces
• disrupted and lost sleep.

Mental fatigue results from long periods of cognitive activity. Its effects can include reduced concentration and manual dexterity, increased reaction time, performance monitoring, error management and decision making (Boksem and others, 2005; Bafna & Hansen, 2021, CASA, 2012; Heywood 1999).  

Self-assessment of fatigue

Although there are some known limitations of self-rated fatigue, research on airline flight crew has shown correlation between self-rated fatigue and performance in vigilance tasks, for example using the Samn-Perelli 7-point fatigue scale[14] (Garwon, 2016, Petrilli, 2007 and Roach, 2012). There was no regulatory or operator requirement for pilots to determine (or provide) a standardised fatigue estimation prior to, or during, operations.

Sleep and time of day

Inadequate quantity and quality of sleep is a contributor to fatigue. Most people generally require 7–8 hours of sleep to achieve a maximum amount of alertness and performance. Sleep debt can be cumulative and can result in degraded performance and uncontrolled sleep episodes (Orlady & Orlady, 1999; Hawkins, 1993). The pilot’s 72-hour history indicated they had adequate sleep opportunities in the preceding nights and the pilot was reported to have no sleeping issues.

Circadian rhythms are the body’s internal clock that regulates the sleep-wake cycle and repeats roughly every 24 hours. According to the International Civil Aviation Organization (2016) there are two times of peak sleepiness within a 24-hour cycle. The main peak is in the early morning between 0300–0500 known as the window of circadian low, another smaller peak around 1500–1700 is known as the afternoon nap window. For each individual these times can vary. The period between when the pilot arrived at Moree Airport and the accident was outside these peak sleepiness times.

Effect of multiple long days

The instructor who conducted the pilot’s aerial application rating, when asked what the effect of the previous long days would be, reported that it was not just the last couple of days; the season had effectively continued since July without a break. Research has found self-ratings of fatigue (Rithemeister and others 2021) and risks of successive incidents both increase for each consecutive day worked (Folkard and Akerstedt 2004).

As documented by ICAO (2020) biomathematical modelling is ‘a computer programme designed to predict aspects of a schedule that might generate an increased fatigue risk for the average person, based on scientific understanding of the factors contributing to fatigue…All bio-mathematical models have limitations that need to be understood for their appropriate use.’ Biomathematical models can only forecast the effects of sleep and circadian rhythms[15] on performance and cannot account for other factors known to impact performance such as training, experience, stress and illness. Additionally, the models were not designed for aerial agricultural operations and did not consider the pilot’s cognitive workload.

The ATSB used two software programs, Sleep Activity Fatigue Task Effectiveness-Fatigue Avoidance Scheduling Tool (SAFTE-FAST) and Fatigue Assessment Tool by InterDynamics (FAID) Quantum, which are biomathematical models to assess fatigue based on the pilot’s duty hours and sleep opportunity in the days leading up to the accident. Each model has specific applications and limitations.

SAFTE-FAST predicts future performance based on the recent sleep history of the projected population or individuals. The output is a performance score indicating a percentage of cognitive effectiveness at a point in time. The lower the performance score, the higher the effect of fatigue. The model is based on biological determinants of fatigue such as: hours of sleep, hours of wakefulness, current sleep debt, the circadian process and sleep fragmentation (awakenings during a period of sleep) that reduce quality (Hursh and others 2004). SAFTE-FAST indicated that the pilot’s performance was not affected by sleep history and circadian processes.

FAID uses work hours as its input to predict the effect on fatigue and performance of different duty periods or work schedules. The FAID output is a score indicating different levels of fatigue exposure for different work hours. The higher the FAID score, the higher the fatigue exposure. The FAID score is based on the following biological determinants of fatigue: time of day of work and breaks, duration of work and breaks, work history in the preceding 7 days, and biological limits on recovery sleep (InterDynamics n.d). FAID indicated a high fatigue exposure risk for the pilot on the accident day, but lower (although still high) at the time of the accident than the start of the day.

The outputs of the two models were inconsistent. The differences in results can be explained by the underlying parameters in each model.

Time on task

Agricultural operations are known to place high demands on the pilot’s attention for sustained work periods, which can result in a degradation of performance, even if the pilot has obtained adequate sleep. This is due to the continuous, repetitive, low altitude flying associated with this type of operation, while also managing the spray application (NTSB, 2014).

Rosa and others (2020) found that during a simulated 11-hour flight mission, participants' self-ratings of fatigue increased over time and their response time was slower after 7 hours. This demonstrates that sustained attention and vigilance were adversely affected by time on task.

Having started the aircraft’s engine at 0553, the pilot had been operating for nearly 6 hours when the accident occurred at 1145. Consistent with previous days and normal operations, the pilot took short breaks while the loader was refuelling, to get out of the aircraft, eat and drink. These breaks occurred approximately every hour and would last about 10 minutes. One fatigue countermeasure is activity breaks. These can reduce the impact of accumulating workload and alertness and performance will improve briefly due to providing a mental break from a continuous task (Caldwell 2008; Mallis and others 2022). Therefore, breaks can be temporarily beneficial in reducing the effects of fatigue.

Combined effects of workload and fatigue

Fatigue and workload can have similar effects on vigilance, perception and reaction/response times. A study of workload and fatigue in rail workers (Fan & Smith, 2017) found that both high workload and fatigue were associated with performance impairments. High workload was also found to increase fatigue, which then leads to a reduction in performance. The United Kingdom Civil Aviation Authority Flight-crew human factors handbook – CAP 737 (2016) described symptoms of increasing workload, including attentional and task focusing, task shedding, increased fatigue, and chance of error. It stated that:

Sustained workload contributes to fatigue. Very high workload (particularly fast onset) and feelings of not coping with the workload can cause high arousal or stress. All these things make error more likely.

The handbook lists effects of fatigue, similar to those associated with mental fatigue described earlier, including reduced awareness, easy distraction and increased slips and mistakes.

Accident site and aircraft damage  

Accident site and impact

The wreckage was located at the southern end of a stand of trees and had been subject to a significant post-impact fuel-fed fire. There were no powerlines in the area and there was no evidence the aircraft struck a tree or bird prior to the collision with terrain.

On-site examination of the wreckage and surrounding ground marks indicated that the aircraft impacted terrain upright, in a nose-down attitude of about 40°, with the right wing down about 10°. The propeller, main wheels and wing leading edge impacted the ground first (Figure 10), during which the fuselage right bottom longeron[16] fractured and punctured the right wing main spar (Figure 11). Two propeller blades were located at the engine point of impact.

Figure 10: Initial impact points – right wing, main landing gear and propeller

Source: ATSB

Figure 11: Fuselage frame longeron fracture and associated impact damage with main spar damage to right wing

Source: ATSB

Forward momentum then collapsed the forward section of the fuselage and resulted in the main spar rotating about 120° and separating from the fuselage. The aircraft then continued a short distance rotating to the right, consistent with a right turn/spin, and came to rest facing approximately east.

The engine fractured in half around the flange ‘C’ area (ring of bolts joining the exhaust casing to the gas generator casing), with the gas generator module remaining near the fuselage. The propeller hub, with propeller blade, the engine power section module, including power turbine wheel, was recovered about 27 m from the impact point, in the direction of the target crop (north). The liberated compressor turbine disc was found a further 30 m beyond the hub in a similar direction (north-east), and at the edge of the fire zone (Figure 12).

The flame front and debris trail were in the direction of the wind (towards the north-east) and towards the target crop (north). The propeller hub displacement and fire zone were consistent with the aircraft’s trajectory prior to the loss of control, and with ignition at the final resting place. There was no evidence of fire at the initial impact point.

Figure 12: Overview of accident site and fire zone

Source: ATSB

Wreckage examination

Although the throttle position could not be determined from the wreckage, examination of the damage to the engine and propeller blades was consistent with the engine producing power at impact. Seat frame distortion was consistent with a nose-down attitude at impact. Although impact and fire/heat damage precluded inspection of some control tubes and cables, flight control continuity was established via examination of connections, for example steel rod ends securely attached to bellcranks.

Aircraft configuration

Flap actuator measurement and corresponding flap setting indicated the flaps were extended about 18°. Due to impact damage, the position of the dump lever and of the hopper door could not be determined.

Fuel testing

A fuel sample was collected from the operator’s fuel tank at the property. The fuel was tested for the presence of water with none identified. A visual inspection did not identify any particulate matter in the fuel. There were also no reports of fuel quality concerns with the operator’s other aircraft using the same fuel source.

Survivability

Post-mortem and toxicology results

An autopsy report was prepared for the NSW Coroner. The report provided to the ATSB included the results of a post-mortem examination conducted by a forensic pathologist and toxicology testing.

The post-mortem examination found one minor fracture and multiple heat-related injuries, with no (life-threatening) traumatic injuries identified. No natural disease pathology was identified and no substances likely to have contributed to the accident were found in the toxicology results. The cause of death was found to be the effects of fire.

Restraint and helmet

The pilot’s seat was fitted with a 4-point harness, the webbing of which was destroyed by the fire. Despite this level of damage, the left and right lap belt attach points were found secured and the lap belt and shoulder harness steel buckle was secured. Additionally, the lap belt and shoulder harness webbing had been replaced in January 2020, and therefore would be very unlikely to have failed due to deterioration.

The pilot was always known to wear a helmet and was almost certainly wearing it at the time of the accident.

Impact force analysis

The ATSB analysed deformation of the pilot’s seat frame to determine peak impact deceleration. The pilot’s seat frame was bent at the two seat attachment locations, but the seat pan was undeformed. This indicated that the angle of deceleration was mostly forward rather than vertical. It was assessed that the seat rail was at the lowest height adjustment. The 4-point restraint was being worn at impact.

In conducting a dynamic loads analysis, a conservative evaluation of the peak deceleration for the pilot seat was 75 G. Based on a stall speed with flaps retracted of 60 kt, this equates to a square wave deceleration pulse[17] duration of 42 milliseconds.

The Aircraft crash survival design guide Volume 2 – Impact conditions and human tolerance (Coltman and others, 1989) placed this forward deceleration in the ‘area of severe injury’. Severe injury included life-threatening injuries such as major haemorrhages, spinal, abdominal and thoracic injuries, multiple fractures, concussion and long-time unconsciousness (Eiband, 1959). This was based on experiments of whole-body impact tolerance conducted on human volunteers to (mostly) subcritical levels, and test animals. Whole-body tolerance criteria were assessed with subjects seated in the upright posture and wearing full-torso restraints (and in some cases head restraint). The tolerable magnitude of accelerative force is a function of the duration; higher G were tolerated for a shorter pulse duration.

Post-impact fire safety

Post-impact fire and survivability

A potentially survivable accident is one in which the impact forces are within the limits of occupant tolerance, the aircraft structure preserves the required survival space, and the occupant restraint is adequate. As detailed below, for aircraft (including fixed and rotary wing) with a maximum certified take-off weight of 5,700 kg or less, post-impact fire (PIF) has been shown to contribute significantly to injuries and fatalities in accidents that are otherwise potentially survivable (TSB, 2006).

Aircraft certification requirements

Aircraft certification is found primarily in three regulatory structures: the US Federal Aviation Regulations (FARs), the Canadian Aviation Regulations, and the European Aviation Safety Agency requirements. These requirements are harmonised such that light aircraft manufactured in the US, Canada and Europe all meet basically the same standards.

Part 23 of the FARs prescribes the airworthiness standards for aeroplanes in the normal, utility, aerobatic, and commuter categories. There are only three FAR 23 fuel system certification requirements designed to reduce the risk of PIF. These specifically apply to aircraft with retractable landing gear in the event of a wheels-up landing.

The AT-400 aircraft was certificated under FAR 21 in the restricted category. It met the structural requirements of FAR 23, and the flight criteria, propulsion, systems and equipment items of CAM 8, Appendix B (FAA TCDS A9SW).

Fuel tanks in accident impacts

In an accident impact, metal fuel tanks are prone to rupturing, allowing fuel to spill. The rupture of the tank causes the fuel to escape at high pressure and velocity which in turn causes the fuel to form a fine mist, which can be ignited by a source such as a hot engine or electrical arcing, and produces a very intense fire.[18]  

The rupturing of the tanks results from high fluid pressures caused by inertial accelerations during the impact. The pressure distorts the tank walls and rupture will occur when the strain[19] of the distortion reaches the rupture strain (also known as the ‘ultimate’ or ‘fracture’ strain) of the tank wall material.

To improve crashworthiness, fuel bladders and cells have been constructed of materials that are less prone to rupturing, that is, they have a higher rupture strain. These are able to withstand more deformation and a puncture is less likely to expand or tear and form a larger opening from which fuel can escape.   

The rupture strain for airframe aluminium (2024-T3 alclad sheet) is about 18%. Elastomers[20] tolerate severe deformation without rupturing – for a typical elastomer, the rupture strain is about 300% – significantly higher than metals. Additionally, even if elastomeric walls are punctured, the probability of fuel misting is very low because the flow rate for the puncture is much less than through a split tank wall. As an example, Robinson R44 helicopter bladder tanks are elastomer.

The resistance of elastomers to rupture and puncture can be substantially increased by incorporating high-strength fibres, such as Kevlar, into the material. For ultimate post-crash fire resistance (as in motor racing), fuel tanks (or cells) use double elastomeric walls with material such as Kevlar in the outer layer. This substantially reduces the probability of tank wall rupture, puncture and of fuel misting.

Prevention of post-impact fires

The US National Transportation Safety Board (NTSB) special study report General Aviation Accidents: Postcrash Fires and How to Prevent or Control Them (NTSB, 1980), found that PIF occurred in about 8% of the 22,002 general aviation accidents in the US during 1974–1978. Fatalities resulted from about 59% of the accidents involving PIF and 13.3% of the accidents without fire. The study tested the hypothesis that PIF occur more often in severe accidents. Severe accidents included collisions with the ground or objects such as trees/poles, stall/spin accidents, and some following engine failure/malfunction. These made up almost 80% of fatal accidents. In severe accidents, fatalities occurred in 18% of the accidents without PIF, but in more than 60% with PIF. For non-severe accidents, less than 1% involved fatalities without PIF and 19% involved fatalities with PIF. The report summarised that fire, rather than impact, was the major contributor to fatalities in general aviation accidents involving PIF.

The study found that PIF was occurring in survivable accidents. It noted that in contrast to civil aviation, the US Army had used fuel containment technology to dramatically reduce fire injuries and deaths. A crash resistant fuel system is designed to absorb energy in controlled failures of sacrificial structures to minimise impact loads on the fuel tank and eliminate the escape of flammable fluid in a crash. The intent was that the aircraft occupants would then have sufficient time to escape or be rescued without the threat of fire.

The report identified that technology for crash-resistant fuel systems existed (in 1980) suitable for general aviation aircraft. The 1980 NTSB special study report stated that ‘the concept of fuel containment is both feasible and achievable now’. The report Tests of Crash-Resistant Fuel System for General Aviation Aircraft (Perrella, 1978) concluded that lightweight, flexible, crash-resistant fuel cells used in combination with self-sealing break-away fuel-line couplings can effectively reduce PIF in general aviation aircraft equipped with wing tanks. Safety fuel cells were developed in the 1960s to prevent post-crash fuel-fed fires in race cars to improve survivability.

However, aircraft design and certification regulations did not reflect the technologies available. In response, the US NTSB issued 6 recommendations to the US Federal Aviation Administration (FAA) to implement regulations aimed at addressing the issue of post-crash fires – A-80-90 to A-80-95.

On 17 September 1985, the FAA issued an advance notice of proposed rulemaking that informed the public of the FAA’s intent to formulate rules to improve the crash-resistance of small airplanes' fuel systems and requested economic and technical information to assist in economic analysis and technical decisions for future rulemaking.

After several years of studies and discussions, on 20 May 1988, the FAA advised the NTSB that they had drafted a notice of proposed rulemaking (NPRM). On 14 February 1990, the FAA issued an NPRM proposing changes to the airworthiness standards to improve the crash resistance of fuel system on normal, utility acrobatic, and commuter category airplanes. These proposed design changes were to limit fuel spillage near ignition sources and would provide additional time for survivors of an accident to evacuate the aeroplane.

After some changes and review of the NPRM, in 1995, the FAA concluded that the recommendations could not be justified on a benefit-to-cost basis and therefore planned to take no action on these recommendations.

In 1996, the NTSB assessed that no tangible action had occurred in the 16 years since the issuance of these recommendations, and classified recommendations A-80-90 to -92 as closed with unacceptable safety action.

Since that time, crash-resistant fuel bladders/tanks have been introduced in rotorcraft. Crash-resistant fuel system technologies have also advanced significantly, particularly in motor sports.

Regulation of helicopter fuel systems

In 1994, US helicopter standards FAR 27.952 and FAR 29.952 introduced fuel system crash resistance tests and features for new design certification. These were introduced because it was estimated at the time that 5% of occupants in survivable rotorcraft accidents were killed or injured by PIF. There were no equivalent test requirements for fixed wing aircraft.

Research for ATSB investigation AO-2013-055, found that in Australia from 1993 to 2013, PIF occurred in 7 of 47 impact-related accidents (with usable fuel remaining) involving Robinson R44 helicopters not fitted with bladder tanks. Six of those accidents resulted in fatalities. The investigation found that PIF occurred in a significantly higher proportion of accidents involving R44 helicopters without bladder-type tanks than in other similar helicopter types. In response to ATSB safety recommendation AO-2013-055-SI-01, in April 2013, CASA issued an airworthiness directive requiring Australian operators of R44 helicopters to comply with the manufacturer’s service bulletin to replace all-aluminium fuel tanks with bladder-type tanks on R44 helicopters. Since then, there have been 68 R44 and R44 II accidents in Australia, 4 of which had PIF. There were no recorded fatalities as a result of PIF in R44 helicopters in that period.

Transportation Safety Board of Canada safety issues investigation

The Transportation Safety Board of Canada (TSB) conducted a safety issues investigation – Post‑impact fires resulting from small-aircraft accidents. The investigation examined TSB data for the 13,806 accidents involving aircraft weighing 5,700 kg or less, that occurred between 1976 and 2002. The TSB determined that PIF had occurred in 521 (3.8%) of those accidents, resulting in 728 (22%) of the 3,311 total fatalities. Of the 728 fatalities, 205 were assessed as due to fire as were 80 of the 231 total serious injuries. The aircraft included 382 production aeroplanes, 94 production helicopters, 27 amateur-built aeroplanes, 2 amateur-built helicopters, 1 gyroplane and 17 ultralights. Two of the accidents were mid-air collisions between 2 aeroplanes.

The investigation found that PIF presented a significant risk of fire-related injuries and fatalities to the aircraft occupants following a collision because of:

• the proximity of fuel to the occupants
• limited escape time
• limited energy-absorption characteristics of the airframes in crash conditions
• high propensity for immobilising injuries
• inability of firefighters to suppress PIFs in time to prevent fire-related injuries and fatalities.

The investigation concluded that there should be improvements to prevent PIF and reduce fire-related injuries in otherwise survivable accidents. It found that ‘the most effective defence against post-impact fire is to prevent the fire from occurring at impact, either by containing fuel or preventing ignition, or both’.

The investigation also reviewed the history of post-impact fire safety action and identified that previous attempts to amend certification requirements for small aircraft had been unsuccessful. The report stated that post-impact fire-resistant fuel system technology had been demonstrated to be effective in race car and automotive applications, and in certified civilian helicopters. However, there was no requirement to incorporate these engineering countermeasures into new or existing small aeroplanes (or helicopters certified before November 1994).

While acknowledging the difficulty of implementing design improvements in new and existing (FAR 23 and equivalent) aircraft, the investigation found that doing so would reduce the incidence of fire-related injuries and significantly increase the rate of occupant survival.

ATSB post-impact fire occurrences

Post-impact fire data

As not all accidents were likely to have a post-impact fire risk, ATSB identified a subset of accidents, which were impact-related and therefore expected to be more likely to result in fire. The ATSB occurrence database held records of 316 collision with terrain or controlled flight into terrain (CFIT) accidents involving VH-registered (fixed-wing) aeroplanes between 2012 and 2021.

PIFs occurred in 34 (11%) of these accidents. Of the 316 accidents, 81 resulted in fatal injuries, 24 of which had PIF, in 36 the highest injury level was serious, 5 of which had PIF, and 199 resulted in only minor or nil injuries, 5 of which had PIF. As a proportion of PIF accidents, 71% were fatal, 15% were serious injury accidents and 15% resulted in minor or nil injuries. By comparison, 20% on non-PIF accidents were fatal, 11% resulted in serious injuries and 69% in minor or nil injuries.

Figure 13: Proportion of accidents with and without PIF

The 316 accidents resulted in a total of 137 fatalities and 61 serious injuries. The 34 PIF accidents accounted for 35 of the fatalities (26%) (similar to the TSB issues investigation which found 22%), and 10 (16%) of the serious injuries (Table 4).

Table 4: Number of fatal and serious injuries in PIF vs all aeroplane accidents 2012-2021

All collision accidents (316 total)
Injury category	Number	Rates per accident
Fatalities	137	0.43
Serious injuries	61	0.19

All accidents resulting in PIF (34 total)
Injury category	Number	Rates per accident
Total fatalities	35	1.03
Total serious injuries	10	0.29
Fatalities due to fire	5	0.15
Serious injuries due to fire	4	0.12

Survivability analysis

The ATSB analysed available information from the 34 PIF accidents to determine which fatalities and serious injuries were due to fire or impact. Information sources included post-mortem reports, coroners’ reports and published ATSB investigation reports. Post-mortem reports were not available for all the fatal accidents and were generally only of flight crew (not passengers). Further, for non-fatal injuries, recorded details of the injuries were limited. For this analysis, the severity was assessed as having been increased due to fire only where burns or smoke inhalation were specifically mentioned. Where information was unavailable, these were not counted as fire-related injuries/fatalities. As the NTSB found, fire rather than impact was the major contributor to fatalities in general aviation accidents involving PIF.

There were 2 accidents in which the cause of death was a combination of multiple injuries and fire, and where the injuries included head/skull injuries. These were assessed as probably not survivable because head injuries and skull fractures were significantly associated with mortality in studies of falls from heights and motor vehicle accidents (Liu and others, 2009, Papadimitriou-Olivgeris and others, 2020).

In 5 of the 34 PIF accidents (15%), a total of 5 fatalities were assessed as a result of fire following survivable injuries received in the impact. This was about 4% of all the VH-registered aeroplane impact-related accident fatalities. Two additional accidents resulted in a total of 4 serious injuries due to fire. Detail of the analysis is in Appendix B. In summary, analysis of the 34 PIF accidents found:

• 5 were considered survivable without the post-impact fire, where occupants were fatally injured
• 18 in which the accident impact was not considered survivable or were probably not survivable
• 2 resulted in serious fire-related injuries
• 9 in which occupants egressed and survived without further injury.

Five of those 34 accidents with a post-impact fire occurred during aerial application operations:

• 2 were probably not survivable as the occupants sustained multiple injuries including skull fractures
• 1 in which the occupant survived and exited the aircraft before it was destroyed by post-impact fire
• 1 in which the pilot died from the effects of fire
• 1 in which the pilot died from the effects of fire and sustained injuries that would probably have prevented the pilot extricating themselves from the wreckage.

Fuel tank type

Three types of fuel tanks were used in the accident aircraft – integral, rigid and bladder tanks:

• Integral fuel tanks are part of the aircraft structure. They are manufactured by assembling parts of the aircraft structure with sealant to form a fuel-tight compartment, most commonly in the wings.
• A rigid tank can be made of various materials including aluminium alloy, steel or composites. They are usually removable and mounted into the airframe structure.
• A bladder type fuel tank is a rubber/elastomer cell dependent on the structure of the cavity it sits in to support the weight of the fuel within it. Bladder (or ‘bag’) tanks have historically been installed in the wing in lieu of sealing the structural components but not made of crash-resistant materials. Crash-resistant materials are capable of providing impact and puncture resistant fuel bladders and cells such as those used in helicopters and racing cars.

For the aircraft involved in the 34 PIF accidents:

• Non-crash-resistant bladder tanks were fitted in 2 aircraft involving 6 fatalities. No serious injuries were recorded for those aircraft and neither accident was survivable.
• Rigid tanks were fitted in 9 of the aircraft involving 7 fatalities, none of which were survivable. Two resulted in serious injuries that were not fire related.
• Integral tanks were fitted in 23 of the aircraft involving 22 fatalities, 5 occupants of which would have survived without for the fire. In those aircraft, 8 serious injuries occurred, 4 of which were attributable to fire.

Organisational information

Aircair overview

Aircair was founded in 1980 and was one of the largest aerial application operators in Australia. The CASA-issued Air Operator’s Certificate current at the time of the accident was re-issued to Aircair on 11 June 2021, valid until 30 June 2024. Under the certificate, Aircair was authorised to conduct aerial application and aerial work operations. At the time of the accident, Aircair had a fleet of 13 aircraft conducting application operations and engaged 12 pilots. As well as VH-ACQ, the aircraft fleet included a radial-engine Air Tractor AT-301, turbine-engine AT-502, AT-504 and AT-802 type aircraft, and a piston-engine Cessna 188B, which the company had purchased specifically for the accident pilot to operate during their initial supervised hours of aerial application operations.

Safety management

At the time of the accident, although Aircair was not required to have a safety management system, they had implemented the AAAA’s Aerial Improvement Management System (AIMS). AIMS was designed to meet the safety management and quality assurance requirements of the multiple regulators that an aerial application employer is bound by, including CASA. AIMS incorporated safety management of all facets of the business, including aviation, and was designed to integrate with the company’s Operations Manual.

The AIMS section associated with planning and conducting an application detailed that the operations manager or general manager could select a particular pilot for a given application based on their experience. The section also included a detailed drift risk assessment, which was to be followed by a plan to manage the application risks, including identifying if a forecast temperature would result in a decision to cease spraying. There was no requirement for the risk assessment to be documented or retained. The chief pilot reported having discussed the application plan and forecast with the pilot the evening prior to the accident, and the pilot had confirmed the temperature spray limit with the operations manager while the aircraft was being refuelled shortly before the accident. 

The AIMS section also required the pilot to complete a hazard check on arrival to the treatment area.

Similar occurrences

Loss of control in flight

The CASA Advisory Circular 61-16 – Spin avoidance and stall recovery training (CASA, 2020), stated that stall-spin accidents accounted for about a quarter of all general aviation accidents worldwide. Further, that other than those which occurred during dual flight instruction, most of those losses of control occurred at a height too low for recovery.  

The ATSB occurrence database recorded 269 accidents that occurred due to a loss of control between 2010 and 2020 involving (fixed-wing) aeroplanes. Of those accidents, 32 occurred while manoeuvring or conducting airwork, 17 of which resulted in fatal injuries. Of the 32 accidents that occurred during manoeuvring/airwork, 14 were conducting aerial application or mustering operations.

The following is a sample of ATSB investigations into fatal accidents that resulted from an aerodynamic stall at a height too low to recover before the aircraft impacted terrain.

AO-2008-069

The pilot of a Piper Aircraft PA36-375 Pawnee Brave was conducting aerial baiting operations in the Pilton Valley, Queensland when the aircraft collided with terrain. The aircraft was seriously damaged by impact forces and a post–impact, fuel- and magnesium-fed fire. The pilot was fatally injured.

The investigation found that the topography of the area and the strong gusty wind conditions at the time, probably resulted in turbulence that increased the hazardous nature of the low-level application task. It is likely that the pilot lost control of the aircraft as a result of that turbulence, at a height from which recovery was not possible before the aircraft struck the ground.

AO-2009-070

The pilot of a Cessna A188B aircraft was fatally injured when the aircraft impacted terrain during spraying operations. The investigation determined that the aircraft stalled at an altitude from which the pilot was unable to recover before the aircraft impacted terrain.

AO-2011-082

A PZL-Mielec M18A Turbine Dromader aircraft impacted terrain on a cotton station near Dirranbandi, Queensland while conducting aerial spraying. The pilot was fatally injured, and the aircraft was destroyed by impact forces.

The ATSB found that, for reasons that could not be determined with certainty, the aircraft departed from controlled flight during a turn at low height and the pilot was unable to recover before impacting the ground.

AO-2012-059

The owner-pilot of a Cessna 150 aircraft was aerial stock mustering on a cattle station about 55 km north-east of Bourke, New South Wales. The aircraft was observed circling over an area (where cattle were not moving,) then entered a steep descent followed by the sound of an impact. The aircraft was seriously damaged, and the pilot sustained fatal injuries.

The ATSB found that, while manoeuvring at low level, the pilot inadvertently allowed the aircraft to aerodynamically stall, resulting in a high rate of descent and collision with terrain. There was insufficient information about pilot control inputs to establish the factors that precipitated the stall.

AO-2014-192

On 29 December 2014, a Cessna 172S aircraft departed Cambridge Airport, Tasmania to photograph yachts participating in the 2014 Sydney Hobart race. On board the aircraft were the pilot and a photographer.

At about 1815, the aircraft commenced low-level photographic runs on yachts. Shortly after completing a run on one yacht at a height of about 50 ft, the aircraft entered a steep climbing turn. The aircraft had almost completed a 180° turn when the upper (right) wing dropped sharply while the aircraft’s nose pitched down to almost vertical. The aircraft impacted the water’s surface in an almost vertical nose down attitude with wings about level. Both aircraft occupants were fatally injured, and the aircraft was substantially damaged.

As a result of the steep climbing turn, the aircraft’s upper wing aerodynamically stalled, resulting in a rapid rotation out of the turn. The steep pitch attitude indicated that, because of the stalled upper wing, the aircraft entered a spin. There was insufficient height for the pilot to recover the aircraft.

Addressing loss of control in flight occurrences

The US FAA Airplane Flying Handbook (2021) chapter 5 Maintaining aircraft control: upset prevention and recovery training, stated that a loss of control in flight (LOC-I) is the leading cause of fatal general aviation accidents in the US and commercial aviation worldwide. The text listed situations that increase the risk of loss of control, including uncoordinated flight, distraction, turbulence and poor risk management. It further stated that in situations where a LOC-I can occur, pilots must recognise when the aircraft is approaching a stall or has stalled and execute the correct procedure to recover the aircraft. This requires training that includes slow flight, stalls, spins, and unusual attitudes.

US FAA Advisory Circular 120-109 – Stall prevention and recovery training was aimed at reducing LOC-I accidents and incidents. The circular stated that a ‘recurring causal factor in LOC-I accidents and incidents is the pilot’s inappropriate reaction to impending stalls and full stalls’. Further, the circular advised that reducing the angle of attack was the most important pilot action to recover from an impending or full stall and therefore this should be emphasised in stall training. 

Safety analysis

Introduction

On the morning of 4 December 2021, after completing the fifth spray run of the eleventh chemical load on a property near Moree, New South Wales, VH-ACQ was observed to climb, enter a right procedure turn, then descend rapidly and impact terrain, followed almost immediately by an intense fuel-fed fire.

The investigation found no evidence of a bird or tree strike, or anything likely to have jammed the flight controls affecting controllability. Continuity of the flight controls was established, the main wing spar was intact, and the engine was making power and driving the propeller when the aircraft impacted the ground. At the time of the accident, the aircraft was below the maximum take-off weight approved for aerial application operations and the centre of gravity was within the extrapolated limits.

This analysis will discuss development of the accident sequence and the effect of the environmental conditions. The pilot’s experience and how this contributed to workload and fatigue will also be examined. Further, it will consider the management of flight risk and factors affecting survivability.

Loss of control

Witness observations of the aircraft turning and descending rapidly were consistent with an aerodynamic stall and loss of control in flight. These observations were consistent with the accident site, in which the aircraft wreckage was confined in a small area, with evidence of a high vertical impact and low forward speed.

The last recorded GPS position left of the last spray run and about 180 ft above the ground, was consistent with the pilot conducting a right procedure turn – a shallower turn about 45° to the left, followed by a steeper right turn – at the end of the spray run. That last recorded height was very likely not the maximum reached, as the data from previous turns showed the aircraft generally climbed to about 250 ft above the ground.  

The loss of control in flight was consistent with a rapid entry to the stall. That stall was a result of the angle of attack being too high from moving the elevator control stick position too far aft while increasing the bank angle during the turn. The stick force experienced by the pilot on the elevator control depended on the trim position, which could not be determined. Regardless of the stick force, the stick position that a pilot needs to set to recover from a stall will be the same. Stall prevention requires monitoring the position of the elevator control stick, awareness of its position at which the aircraft will stall, and to maintain the control stick forward of that position. Stall warning or buffet should alert the pilot to move the stick forward, but the pilot may have had very little warning. The pilot reportedly had the stall stick position demonstrated, and although they had on occasion pulled the stick back too far in a turn during training, this was a common training error, which the pilot had been observed to have rectified. Analysis of recorded GPS data from the pilot’s flights prior to the accident, showed the pilot generally employed sound technique in the turns.  

The Airplane Flight Manual stated that the aircraft would lose 220 ft in recovering from a straight and level stall at the published maximum weight, based on flight testing. Recovery height would be increased by an accelerated stall and uncoordinated turn. Accident site analysis showed the aircraft impacted the ground nose-down and wings almost level, which suggested the pilot had acted to recover from the stall but had insufficient height to complete the recovery.

Effect of field shape

As evidenced by the recorded GPS data, the pilot had not flown hazard checks on the accident day. The operator assessed that as the pilot had overflown the accident block several times in the previous days, they were probably familiar with it. However, it could not be determined whether the pilot had identified the uneven southern boundary and shape of crop to be sprayed before commencing the accident turn.

Due to the shape of the target block, the pilot needed to turn the aircraft further beyond the southern boundary or wider than the previous turns, to line up on the next spray run at a suitable height to commence spraying. Consideration of additional turn radius was also required due to the 10–18 kt gusty south-westerly wind becoming a tailwind during the turn, thereby pushing the aircraft closer to the crop.

The recorded GPS data from the pilot’s flights on the day prior to the accident showed that the aircraft was usually lined up on the next spray run about 200 m prior to the crop boundary. The location of the accident and the position where the loss of control occurred was about 110 m south of the target crop. At that point, the aircraft was too high and too close to the southern boundary to manoeuvre safely to commence spraying the crop at the start of the next spray run. From this position, the pilot likely attempted to tighten the turn rather than miss the additional crop (and skip that spray run).

Experience, workload, and fatigue

Experience

The pilot had commenced aerial application training immediately after attaining a commercial pilot licence in the minimum timeframe. On achieving their aerial application and low-level ratings, the pilot commenced aerial application operations as an employee of the aircraft operator, in September 2021. The pilot then conducted the required supervised aerial application flight time in a piston-engine aircraft. One week before the accident, the operator assessed that the pilot was ready to transition to turbine-engine Air Tractor aircraft.

Although the pilot had demonstrated competence in the aircraft and aerial application to a high level of skill for their experience, at the time of the accident, they were still relatively inexperienced in overall flight time, aerial application, and particularly in the AT-400 aircraft. This inexperience likely affected many facets of the operation, including aircraft handling, workload and fatigue.

Workload 

Agricultural pilots operating at low altitudes must visually scan external cues to control the aircraft and avoid obstacles, while also monitoring inside the cockpit including instruments, spray systems and property maps. Due to the close proximity to obstacles, terrain and the airspeeds at which the aircraft are flown, agricultural pilots have less time to respond to abnormal situations. As a result, any lapse in concentration or imprecision in control input could lead to catastrophic consequences (NTSB, 2014).

During the morning, the increased temperature, change in wind direction and increase in wind strength and gust speed, made the flying conditions increasingly turbulent. The conditions half an hour after the accident were described as quite windy and rough. Turbulence has been found to increase physical and mental workload, which can lead to degradation in the pilot’s ability to safely and effectively operate the aircraft. This is due to human perceptual systems breaking down, as a result performance can diminish, leading to fatigue, motion sickness and reduced mental performance. (Dodd and others, 2014). These conditions increased the pilot’s workload through additional physical aircraft handling and discomfort.

The pilot’s text message regarding the temperature, radio call regarding drift, and the aircraft’s track on the accident load, were indicative of the pilot making decisions in response to the changing conditions. While such decision-making is a usual part of spraying operations, it requires cognitive resources, thereby increasing workload. The pilot’s radio call about 20 minutes before the accident, suggested the pilot was experiencing stress and high workload. During the morning, the pilot had been in radio contact with the operations manager and other company pilots including the Aircair general manager. However, resources usually available to assist in managing the pilot’s workload and aid in decision‑making, were diminished on the accident day as the loader had no radio and it was the first day that the chief pilot was not supervising the pilot.

Without these resources to assist, the pilot was possibly assessing whether to cease flying due to the conditions, further adding to their cognitive load. Making such a decision may also have been more difficult while other company pilots were continuing to operate.

The pilot’s concern about drift precipitated a change of plan, whereby the pilot elected to move from the western to the eastern boundary, abandon the incomplete racetrack pattern and resume spraying in a back-to-back pattern. The change in spray pattern briefly required the pilot’s focus inside the cockpit to change GPS settings, introducing the potential for distraction and increasing workload. However, there was no evidence to demonstrate this distraction occurred at the time of the accident.

Due to a combination of inexperience, the environmental conditions, decision-making, and absence of supervision, the pilot’s workload was likely at a level known to increase error rates, reduce performance and lead to important information being missed (Green and others, 1996).

Fatigue

The pilot had several early starts and long days in the month prior to the accident, consistently reporting to a friend (but not to the operator) being very tired at the end of each day. As the accident day was the pilot’s ninth day of duty, there was an increased risk of cumulative fatigue. In the 3 days prior to the accident, the pilot had recorded their longest consecutive flight and duty times since commencing aerial application operations. Additionally, the pilot’s commute by car to and from the base was extended due to recent flooding, which reduced the opportunity for recovery between flight duties.  

All the pilot’s recent flight time was cognitively demanding low-level aerial application with short breaks during refuelling. Additionally, the cognitive demands would have been higher than for a more experienced pilot, particularly the pilot’s very limited flight time in the turbine-engine aircraft. At the time of the accident, the pilot had been operating for approaching 6 hours, with several short (10-minute) breaks during refuelling, including one about 15 minutes prior to the accident. Research on sustained attention during a task has shown that decreases in performance and self-rating experiences of fatigue increase over time (Rosa and others, 2020). However, work breaks can be temporarily beneficial in reducing the effects of fatigue (Caldwell 2008; Mallis and others 2022).  

The pilot’s sleep history and the accident time of day were unlikely to have affected the pilot’s performance. However, the consecutive long flight and duty times in the days leading up to the accident, in what would have been a high cognitive workload environment for the pilot, likely resulted in the pilot experiencing fatigue at a level known to affect performance.

Effects of workload and fatigue

Several factors increased the pilot’s workload at the time of the accident, including the conditions and inexperience. Those same factors and the high workload itself, combined with long flight and duty times in the preceding days, also likely contributed to the pilot experiencing fatigue.

The pilot had probably encountered similar environmental conditions while flying a piston-engine Cessna 188B aircraft in the previous weeks, but had more experience in that aircraft. That aircraft also had more docile stall characteristics and gave more warning of an impending stall. After commencing flying VH-ACQ 5 days before the accident, the pilot had demonstrated competence in that aircraft and operated it effectively, including spraying over 1,000 hectares in the previous 2 days. However, on the accident day, the pilot mishandled the aircraft during the turn. This handling error was likely a result of fixating on making the crop, and not monitoring the aircraft state or allowing adequate margin for the conditions. These errors and impaired awareness were consistent with the effects of both overload and fatigue.

Flight risk management

Management of fatigue is a shared responsibility between the aircraft operator and the pilot. Although the pilot had self-assessed as being tired on many occasions in the previous weeks, including the evening prior to the accident, there was no evidence this had been reported to the operator. Additionally, this tiredness had been noted in the evenings, following which there was a sleep opportunity for the pilot to recover (to some extent) before commencing the next morning.

Based on the regulatory duty time limitations, had the pilot been off duty for between 9 and 10 hours when they commenced on the morning of the accident, they were within a discretionary period that required a self-assessment of being mentally and physically fit to fly. The pilot commenced on the accident day close to the 10-hour rest period and it was unknown whether the pilot conducted this self-assessment. However, pilots were required to ensure they were fit to fly prior to every flight. There was also no evidence that the operator was aware the pilot had commenced duty on the accident day within or approaching the discretionary duty time window.

The aircraft operator’s operations manual stipulated that fatigue be managed in accordance with Civil Aviation Safety Regulations, which provided maximum flight and duty times (and minimum rest periods) for aerial application operations. However, there was no consideration of environmental conditions or experience – total aeronautical experience, aerial application flight hours, or hours in an aircraft model – nor how this may affect fatigue. Given inexperience and environmental conditions can increase fatigue, these factors in combination should be considered as part of fatigue risk.

Furthermore, fatigue risk is just one component of overall flight risk. A flight risk assessment provides a comprehensive assessment of factors that increase risk and the effect of combination of these factors. Although it was not required by regulations at the time, the aircraft operator had a safety management system. However, it did not include a flight risk assessment tool, which is a key component of a safety management system (FAA, 2016).

The 2014 US National Transportation Safety Board Special investigation report on the safety of agricultural aircraft operations outlined that risk management guidelines and best practices specific to agricultural aircraft operations were necessary to help operators and pilots mitigate their unique risks. These practices should include information and checklists for performing pre-flight risk assessments and identifying mitigation strategies.

A flight risk assessment tool specific for aerial application operations should include consideration of pilot (experience, recency, supervision, fitness to fly), aircraft (including role equipment), environment (weather, task, chemical, hazards) and operational pressures. Use of a flight risk assessment tool before commencing a flight also acts as a prompt for a pilot to reassess the risk when the considered factors change. Although the operator was attempting to manage the risk associated with inexperience, having a formal process may have integrated all the hazards present on the accident day. Had a flight risk assessment tool been available to the pilot on the accident morning, the combination of the weather conditions, inexperience, complexity of the task, absence of supervision, and probable fatigue, would have been expected to generate an elevated risk rating that would have required mitigation and/or approval for the pilot to conduct or continue the flight.

Survivability

The post-mortem examination identified that the pilot succumbed to the effects of fire. The fire was likely a hot, flash-over fire resulting from the rupture of the fuel tanks and misting of the fuel. Local workers who witnessed the accident were on site within minutes of the accident, however, the fire erupted within seconds of impact.

The tolerance of the human body to accident impact is a function of many variables, including individual characteristics, such as age, sex and general health. The restraint system significantly contributes to the overall probability of survival in an accident (Coltman and others, 1989). Contact injuries are reduced by 4-point (and 5-point) restraints and aviation-standard helmets. Restraints, energy-absorbing structure and seats reduce acceleration injuries. If these injuries do occur, they can contribute to fire-related fatalities and more serious injuries, by preventing self-extrication from an aircraft in the event of a post-impact fire.

An estimate of the impact forces, based on the bending of the pilot seat frame, indicated the accident would have likely resulted in severe injury. However, the pilot did not sustain impact-related injuries likely to have contributed to mortality. The pilot was almost certainly wearing a helmet and a 4-point restraint, and the cockpit maintained survivable space around the pilot’s torso. The crushing of the hopper and forward section of the aircraft likely absorbed a significant amount of the of the forward impact, aiding in reducing acceleration injuries.

Crash-resistant fuel systems

Air Tractor aircraft, like many others, use the aircraft wing structure as an integral fuel tank. The AT-400 fuel tank met or exceeded the certification requirements. In an impact with the ground, traditional aircraft wing structures are comparatively rigid and will rupture, allowing their fuel contents to escape. Due to the high fluid pressures generated inside the fuel tank in ground impacts, fuel forced through these ruptures tends to mist into a large cloud, which increases the risk of ignition and conflagrates quickly into a large encompassing fire.

An aircraft fuel tank lined with a crash-resistant bladder can be more resistant to spilling or leaking due to its ability to retain its contents if distorted. Being flexible, the bladder can withstand changes to its shape without rupturing or splitting. The bladder is also more tolerant of penetrating objects being able to deform around the intruding body to some extent. There have been no fatal or serious injuries to occupants as a result of post-impact fire in Robinson R44 helicopters in Australia since fitment of bladder tanks was mandated after a fatal accident in 2013. Prior to that time, accidents involving Robinson R44 helicopters without bladder tanks resulted in a significant proportion of post-impact fires. Of the (fixed-wing) aeroplanes involved in fatal accidents with post-impact fire in Australia between 2010 and 2022, 2 were fitted with fuel bladders. However, these were not made of crash-resistant materials.

Bladder tanks are one technology designed to improve crashworthiness of fuel systems. Crash‑resistant fuel systems reduce the risk of post-impact fire and provide occupants with more time to escape or be rescued. VH-ACQ was not fitted with crash-resistant fuel tanks or systems. The certification standards at the time the aircraft was manufactured did not require it, nor did the fixed-wing aircraft standards at the time of the accident. This differed from the requirements for rotary-wing aircraft.

The US National Transportation Safety Board and the Transportation Safety Board of Canada found a significant risk associated with post-impact fires in general aviation aircraft. As a result, they made recommendations to the US Federal Aviation Administration aimed at addressing the crashworthiness of fuel systems in these aircraft. A review of VH-registered aeroplane accidents in the ATSB occurrence database from 2010–2022 found a significant risk for post-impact fire fatalities, consistent with that previously identified in the US and Canada. Nearly 4% of the fatalities (5 fatalities in 10 years) in general aviation accidents in Australia were solely the result of the post impact fire. A fatality percentage of 5% was used by the Federal Aviation Administration to justify fuel system crash resistance tests and features for new helicopter designs.

The design principles and technologies for crash-resistant fuel systems exist and have been proven effective in helicopters and the automotive industry. Incorporating these in aeroplane design would reduce the risk of impact-induced fire in otherwise survivable accidents.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.  Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving Air Tractor AT-400, VH-ACQ, 75 km west-south-west of Moree, New South Wales, on 4 December 2021.  

Contributing factors

• The aircraft was too close to the start of the spray run during the turn, which probably resulted in the pilot tightening the turn. This almost certainly resulted in an aerodynamic stall at a height too low to recover before colliding with the ground.
• The pilot was likely experiencing high workload and fatigue due to long flight and duty times, inexperience, the complexity of the task and the weather conditions. The combined effects of these factors probably resulted in the pilot mishandling the turn.
• The aircraft’s integral fuel tanks ruptured during the accident sequence. This resulted in a fire which led to the pilot’s fatal injuries.

Other factors that increased risk

• The aircraft was not fitted nor required to be fitted with a crash-resistant fuel system under the current standards or those in place at the time of manufacture. As a result, post-impact fire presents a significant risk of fire-related injuries and fatalities to aircraft occupants. (Safety issue)

Other findings

• A flight risk assessment tool is used in some aerial work operations, however for aerial application operations it is not a requirement and generally not used. A flight risk assessment tool tailored to aerial application would likely have identified an elevated risk on the day of the accident, due to the combination of the pilot’s inexperience, weather conditions, complexity of the task, absence of supervision and probable fatigue.
• The pilot was almost certainly wearing a helmet and 4-point restraint increasing their chances of survival in an accident.

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. The directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation. Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Crash-resistant fuel system

Safety issue number: AO-2021-052-SI-01

Safety issue description: The aircraft was not fitted nor required to be fitted with a crash-resistant fuel system under the current standards or those in place at the time of manufacture. As a result, post-impact fire presents a significant risk of fire-related injuries and fatalities to aircraft occupants.

Safety recommendation description: The ATSB recommends that the United States Federal Aviation Administration take action to address certification requirements for crash-resistant fuel systems for fixed wing aircraft to reduce the risk of post-impact fire.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.

Additional safety action by Aircair Aviation Operations Pty Ltd (Aircair)

Aircair has considered whether there could be a risk associated with fatigue that does not necessarily correlate to flight and duty hours worked. As such, they are investigating if other means of measuring fatigue risk can be developed, such as a point score system that includes any other contributory factors such as conditions, experience, overall wellbeing and difficulty of the task. Further, they intend to explore technology available in modern cars and machinery that measures operator fatigue.

In August 2022, Aircair’s pilot group underwent advanced stall and spin prevention, recognition and recovery training with an experienced aerobatic instructor. Due to its success, Aircair is investigating ways of incorporating such training into its new pilot induction program.

Aircair recommended that the risks associated with mobile phone use in the cockpit (as referenced in the Aircair Operations Manual) are reiterated to pilots on a regular basis by way of pilot meetings and safety notices.

Aircair intends to ensure that pilots are regularly reminded of the possibility of becoming distracted by guidance systems and the impact this may have on safe operations. As part of this process, pilots should be reminded to only attend to GPS related issues when at a safe height above the ground.

Pre-application field inspections form a critical component for a safe application operation (particularly for unfamiliar fields). The requirement to conduct such inspections is set out in the Aircair Operations Manual and is tested during Aircair Operator Proficiency Checks (OPC). The importance of pre‑application field inspections will be reinforced to pilots on a regular basis by way of pilot meetings and safety notices.

Glossary

AAAA               Aerial Application Association of Australia

AFM                 Airplane Flight Manual

AIMS                Aerial Improvement Management System

CAM                 Civil Aeronautics Manual

CAR                 Canadian Aviation Regulation

CAS                 Calibrated airspeed

CASA               Civil Aviation Safety Authority

CASR               Civil Aviation Safety Regulations

CG                   Centre of gravity

EDT                  Eastern Daylight-saving Time

FAA                  Federal Aviation Administration

FAR                  Federal Aviation Regulation

FCM                 Flight crew member

IAS                   Indicated airspeed

ICAO                International Civil Aviation Organization

LOC-I                Loss of control in-flight

NASA               National Aeronautics and Space Administration

NPRM               Notice of proposed rule making

NTSB                National Transportation Safety Board

PSI                   Pounds per square inch

SMS                 Safety management system. A systematic approach to organisational safety encompassing safety policy and objectives, risk management, safety assurance, safety promotion, third party interfaces, internal investigation and SMS implementation.

TSB                  Transportation Safety Board (of Canada)

UTC                  Coordinated Universal Time

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• aircraft operator and chief pilot
• other company pilots
• Civil Aviation Safety Authority
• New South Wales Police Force
• aircraft manufacturer
• aircraft maintainer
• accident witnesses
• recorded data from the aircraft’s GPS units
• Bureau of Meteorology and Oz Forecast.

References

Air Tractor (2012). Service letter 304: Establishing and operating with a special purpose operating weight for Air Tractor aircraft.

Australian Transport Safety Bureau (2017). ATSB Safety Investigation. Canberra, Australia: ATSB.

Bafna, T. & Hansen, J. P. (2021). Mental fatigue measurement using eye metrics: A systematic literature review. Psychophysiology, 58(6), 13828-n/a. doi: 10.1111/psyp.13828

Beilock, S. L., Carr, T. H., MacMahon, C., & Starkes, J. L. (2002). When paying attention becomes counterproductive: Impact of divided versus skill-focused attention on novice and experienced performance of sensorimotor skills. Journal of Experimental Psychology: Applied, 8, 6-16.

Boksem, M. A. S., Meijman, T. F., & Lorist, M. M. (2005). Effects of mental fatigue on attention: An ERP study. Brain research. Cognitive brain research, 25(1), 107-116. doi: 10.1016/j.cogbrainres.2005.04.011

Byrne, A. J., Murphy, A., McIntyre, O., & Tweed, N. (2013). The relationship between experience and mental workload in anaesthetic practice: an observational study. Anaesthesia, 68(12), 1266-1272. doi: 10.1111/anae.12455

Caldwell, J. A., Caldwell, J. L., & Schmidt, R. M. (2008). Alertness management strategies for operational contexts. Sleep medicine reviews, 12(4), 257-273. doi: doi:10.1016/j.smrv.2008.01.002

Civil Aviation Safety Authority (2012). Fatigue Management Strategies for Aviation Workers: A Training & Development Workbook.

Civil Aviation Safety Authority (2020). Advisory Circular AC 61-16 v1.0: Spin avoidance and stall recovery training.

Coltman, J. W., Van Ingen, C., Johnson, N. B. & Zimmerman, R. E. (1989). Aircraft crash survival design guide: Volume II – Aircraft design crash impact conditions and human tolerance. US: United States Army Aviation Applied Technology Directorate.

Dawson, D., & Reid, K. (1997). Fatigue, alcohol and performance impairment. Nature, July 1997, 388:235.

Dodd, S., Lancaster, J., Miranda, A., Grothe, S., DeMers, B., & Rogers, B. (2014). Touch Screens on the Flight Deck: The Impact of Touch Target Size, Spacing, Touch Technology and Turbulence on Pilot Performance. Proceedings of the Human Factors and Ergonomics Society 58th Annual Meeting, 58(1), 6-10. https://doi.org/10.1177/1541931214581002

Eiband, A. M., Human tolerance to rapidly applied accelerations: A summary of the literature, NASA Memorandum 5-19-59E, National Aeronautics and Space Administration, Washington, D.C., June 1959.

Faber, L. G., Maurits, N. M., Lorist, M. M., & de Lange, F. P. (2012). Mental Fatigue Affects Visual Selective Attention. PloS one, 7(10), e48073-e48073. doi: 10.1371/journal.pone.0048073

Fan, J., & Smith, A.P. (2017). The impact of workload and fatigue on performance. Conference Paper in Communications in Computer and Information Science, June 2017. doi: 10.1007/978-3-319-61061-0_6

Federal Aviation Administration (2021). Airplane Flying Handbook, FAA-H-8083-3C. US: FAA. Retrieved from: Airplane Flying Handbook | Federal Aviation Administration (faa.gov)

Fletcher, A., Lamond, N., van den Heuvel, C., & Dawson, D. (2003). Prediction of performance during sleep deprivation and alcohol intoxication by a quantitative model of work-related fatigue. Sleep Research Online, 5(2), 67-75.

Fletcher, A. (1999). Measurement and management of work-related fatigue: Development and preliminary validations of a predictive model. Ph.D. Thesis, 1999, The University of South Australia.

Folkard, S., & Åkerstedt, T. (2004). Trends in the risk of accidents and injuries and their implications for models of fatigue and performance. Aviation, space, and environmental medicine, 75(3), A161-A167.

Gawron, V. J. (2016). Overview of self-reported measures of fatigue. The International Journal of Aviation Psychology, 26:3-4, 120-131. doi: 10.1080/10508414.2017.1329627  

Goode, J. H. (2003). Are pilots at risk of accidents due to fatigue?. Journal of safety research, 34(3), 309-313. doi: 10.1016/s0022-4375(03)00033-1

Green, R. G., Muir, H., James, M., Gradwell, D., & Green, R. L. (1996). Human Factors For Pilots (2nd ed.), Ashgate, England.

Harris, D. (2011). Human Performance on the Flight Deck. Ashgate, England.

Hawkins, F.H. (1993). Fatigue, Body Rhythms and Sleep. In H.W. Orlady (Eds.), Human Factors in Flight (2nd ed., pp. 56-83). Ashgate.

Heywood, B. (1999). Pilot Fatigue and the Limits of Endurance, Flight Safety Australia (1999, April). Retrieved from: https://skybrary.aero/sites/default/files/bookshelf/1080.pdf.

Hursh, S. R., Balkin, T. J., Miller, J. C., & Eddy, D. R. (2004). The fatigue avoidance scheduling tool: Modeling to minimize the effects of fatigue on cognitive performance. SAE transactions, 111-119.

InterDynamics (n.d.). FAID® Quantum Version 1.1 User Guide.

International Civil Aviation Organization (2020). Manual for the Oversight of Fatigue Management Approaches (Doc 9966).

Li, P. C., Wang, Y. X., Chen, J. H., Luo, Z. H., Dai, L. C. (2021). An experimental study on the effects of task complexity and knowledge and experience level on SA, TSA and workload. Nuclear engineering and design, 376, 111112. doi: 10.1016/j.nucengdes.2021.111112

Liu, C-C., Wang, C-Y., Shih, H-C., Wu, J. J-K., Huang, C-I., Hsu, H-S., Huang, M-H., Huang, M-H., Huang, M-S. (2009).  Prognostic factors for mortality following falls from height. Injury, International Journal of the Care of the Injured, 40 (2009) 595–597.

Mallis, M., Banks, S., Dorrian, J., & Dinges, D. F. (2022). Aircrew fatigue, sleep need, and circadian rhythmicity. In Keebler, J.R., Wilson, K.A., Lazzara, K.H., & Blickensderfer, E.L. (eds) Human Factors in Aviation and Aerospace (pp. 309-339). Academic Press.

National Aeronautics and Space Administration (2010). Human Integration Design Handbook (HIDH). Retrieved from: https://www.nasa.gov/sites/default/files/atoms/files/human_integration_design_handbook_revision_1.pdf

National Transportation Safety Board (1980). General Aviation Accidents: Postcrash Fires and How to Prevent or Control Them (NTSB-AAS-80-02).

National Transportation Safety Board (2014). Special Investigation Report on the Safety of Agricultural Aircraft Operations (NTSB/SIR-14/01). Retrieved from: https://www.ntsb.gov/safety/safety-studies/Documents/SIR1401.pdf

Orlady, H.W., & Orlady, L.M. (1999). Human Factors in Multi-Crew Flight Operations. Ashgate, England.

Papadimitriou-Olivgeris, M., Panteli, E., Koutsileou, K., Boulovana, M., Zotou, A., Marangos, M., Fligou, F. (2021). Predictors of mortality of trauma patients admitted to the ICU: a retrospective observational study. Brazilian Journal of Anesthesiology, 71 (2021) 23-30.

Perrella, W.M. Jr. (1978), Tests of Crash-Resistant Fuel System for General Aviation Aircraft, (FAA-RD-78-28), interim report prepared for the US Department of Transportation, Federal Aviation Administration.

Petrilli, R.M.A., Roach, G.D., Dawson, D., & Lamond, N. (2007). The sleep, subjective fatigue, and sustained attention of commercial airline pilots during an international pattern. Chronobiology International, 23(6): 1347–1362. doi: 10.1080/07420520601085925

Riethmeister, V., Matthews, R. W., Dawson, D., de Boer, M. R., Brouwer, S., & Bültmann, U. (2019). Time-of-day and days-on-shift predict increased fatigue over two-week offshore day-shifts. Applied ergonomics, 78, 157-163. doi: 10.1016/j.apergo.2019.02.010

Roach, G.D., Petrilli, R.M.A., Dawson, D., & Lamond, N. (2012). Impact of layover length on sleep, subjective fatigue levels, and sustained attention of long-haul airline pilots. Chronobiology International, 29(5): 580–586. doi: 10.3109/07420528.2012.675022

Rosa, E., Eiken, O., Grönkvist, M., Kölegård, R., Dahlström, N., Knez, I., ... & Willander, J. (2020). Effects of fatigue on cognitive performance in long-duration simulated flight missions. Aviation Psychology and Applied Human Factors, 10(2), 82. doi: 10.1027/2192-0923/a000191

Skybrary (2010). Workload (OGHFA BN). Skybrary. Retrieved  from: https://www.skybrary.aero/index.php/Workload_(OGHFA_BN)

Tran, Y., Craig, A., Craig, R., Chai, R., & Nguyen, H. (2020). Psychophysiology 57(5), e13554-n/a. doi: 10.1111/psyp.13554

Transportation Safety Board of Canada (2006). Post-impact fires resulting from small-aircraft accidents, (SII A05-01).

Tucker, A. (2015). JHC Commanders’ Guide to Fatigue Management. Retrieved from: https://www.aviation.govt.nz/assets/licensing-and-certification/medical/jhc-commanders-guide-to-fatigue-management.pdf

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the aircraft operator
• the aircraft maintainer
• Civil Aviation Safety Authority
• US National Transportation Safety Board
• Transportation Safety Board of Canada
• Pratt & Whitney Canada
• US Federal Aviation Administration
• Air Tractor Incorporated
• Satloc.

Submissions were received from;

• the aircraft operator
• the aircraft maintainer
• Civil Aviation Safety Authority
• US National Transportation Safety Board
• US Federal Aviation Administration
• Pratt & Whitney Canada
• Transportation Safety Board of Canada
• Air Tractor Incorporated
• Satloc.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A – Hoerner wingtips

Hoerner wing tips Hoerner wing tips were designed to increase wing efficiency, by increasing the effective wing span beyond the actual length of the wing. Effects of this include reduced stalling speed and improved take-off performance. Hoerner wing tips were not an option for AT-400 aircraft, however, in subsequent Air Tractor models, they were either factory-fitted or offered as a post-factory modification. From Air Tractor regarding the AT-402B: ‘We designed a long, high-aspect ratio wing with Hoerner wing tips to increase wing efficiency, reduce drag and to lower stick and rudder forces so the controls are light and responsive, greatly reducing pilot fatigue.’

Appendix B – Post-impact fire mortality

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the night of 19 August 2021, the pilot of a Hawker Beechcraft King Air B200C aircraft, registered VH‑VAH and operated by Pel-Air, commenced the take-off from Essendon Fields Airport, Victoria on a medical retrieval flight to Albury, New South Wales. During the take-off, there was a reduction in power on the left engine and an uncommanded left yaw. The pilot initially managed the situation as an engine power loss and focused on maintaining directional control. However, when troubleshooting, the pilot identified that the left engine power lever had migrated rearwards to the idle position. In response, the pilot moved the power lever back to take‑off power and adjusted the friction lock to prevent further movement. The flight continued to Albury without further incident.

What the ATSB found

The ATSB found that the left engine power lever had migrated rearwards as the friction lock had not been sufficiently adjusted during the pre-flight checks. It was also established that power lever friction locks fitted to the Beechcraft King Air series aircraft required careful adjustment to prevent power lever migration, particularly during take-off. This was more prominent on the left engine, which was a characteristic generally known among King Air operators and pilots.

What has been done as a result

The operator provided additional training to all King Air pilots to demonstrate how the power lever system operated, when power lever migration could occur, and how to check that the friction locks were adequately adjusted to ensure the levers remain at take-off power. A component on friction locks was also included in the King Air pilot ground school training. In addition, the operator published a notice to air crew, which stipulated that all take-offs on sealed runways must be conducted using a standing start take-off. Further, the operator amended the take-off checklist for a standing start to include checking the friction locks to prevent a power lever migration during the take-off sequence.

The ATSB has released a safety advisory notice to all operators and pilots of King Air aircraft advising of power lever migration and the need to be aware of the careful adjustment required for the power lever friction lock.

Safety message

This incident highlights the importance of having a detailed understanding of the characteristics that may be specific to an aircraft type. In the case of the King Air series of aircraft, the design of the power lever system meant that the friction locks required careful adjustment to prevent power lever migration particularly during take-off.

The occurrence

On 19 August 2021, a Hawker[1] Beechcraft B200C King Air aircraft, registered VH-VAH and operated by Pel‑Air, was scheduled to depart Essendon Fields Airport, Victoria on a medical retrieval flight to Albury, New South Wales. On board was a pilot, paramedic, and doctor.

At about 2300 Eastern Standard Time,[2] the pilot began to prepare the aircraft for departure as per the before engine starting checklist. One of the requirements was to set the power lever friction locks. The pilot recalled moving the power levers to the mid-range position to gauge their movement and adjusted the friction locks to establish adequate friction. They also recalled that their usual practice was to check the friction locks were correctly set before take-off.

Soon after, the aircraft was taxied to the runway and the pilot commenced a rolling take-off with their left hand on the control column and right hand on the power levers. When at about 94 kt, the pilot moved their right hand onto the control column and rotated the aircraft. When about 50 ft above ground level, the aircraft suddenly yawed left. Automatic dependent surveillance-broadcast data showed the aircraft tracking immediately left from the runway. The paramedic also recalled being pushed to the right and the aircraft not being aligned with the runway. The pilot looked at the engine instruments and observed that the left engine was showing a power loss, but the right engine appeared to be producing take-off power. Based on these indications, the pilot managed the situation as an engine power loss.

The pilot recalled focusing on maintaining directional control by applying right aileron and rudder. They then assessed the reason for the power loss and whether the propeller was feathered,[3] which they believed it was not. The pilot scanned the cockpit again and observed that the left power lever had migrated rearwards towards the idle position. While moving the left power lever back in-line with the right power lever, the aircraft yawed right as the pilot was still applying right rudder. The power increased on the left engine, the pilot reduced application of right rudder and retracted the landing gear. Immediately after, the left power lever started moving rearwards again. The pilot re‑tightened the friction lock on the left power lever, which resolved the issue. At that time, the aircraft was climbing through 200-300 ft. The paramedic reported that the pilot said the power lever had migrated as the friction lock had not been correctly set.

The flight continued to Albury without further incident. The pilot noted the power lever migration on the aircraft’s maintenance log as that they believed the friction lock was not adequately functioning. The subsequent engineering inspection did not find any technical issues with the power lever assemblies and friction locks.

Context

Pilot information

The pilot held a valid Air Transport Pilot Licence (Aeroplane), multi-engine command instrument rating, and a type rating for the B200C obtained in July 2021. At the time of the incident, the pilot had accrued about 16,000 hours of total aeronautical experience, of which 42 hours were in the B200C.

Engine controls

The aircraft’s engines were controlled using 3 sets of levers located on the centre pedestal.

• The 2 power levers controlled engine power from the idle position through to take-off power. When the levers were lifted and pulled aft over a gate, they controlled engine power for taxi operations, and over another gate for propeller reverse thrust to slow the aircraft after landing.
• The 2 propeller levers controlled propeller speed (rpm). The propellers could be feathered by moving the relevant lever past detents and back to the aft most position.
• Condition levers were used to select high or low idle, and to shut the engines down.

Friction locks

Four friction locks were located on the engine control pedestal. One each for the left and right power levers, one for the propeller levers, and one for the condition levers (Figure 1). The friction lock assemblies consisted of an adjustment mechanism, a phenolic drum, and a friction band. When the friction lock was rotated clockwise, the band around the phenolic drum tightened, which increased the friction between the 2 parts. The respective lever would become progressively resistant to movement, preventing the lever from moving out of position. When rotated counter‑clockwise, the lever moved freely. The design of the friction lock had been used since the 1965 model 88 Queen Air through to current production King Air aircraft.

Figure 1: Engine control levers and friction locks

Source: Pel-Air and Textron Aviation, annotated by the ATSB

A characteristic of the King Air friction locks was that they required careful setting as some aircraft had a narrow range between no friction and too much friction. The operator reported that there was no consistency in setting friction locks for a desired resistance between power levers in the same aircraft and other aircraft, and this changed over time due to wear. Worn friction locks were required to be replaced.

The maintenance log for the aircraft indicated that the left and right power lever assemblies, including both friction locks, were replaced in November 2020 after being observed to be worn, resulting in a reduced range of adjustment. Before the assemblies were replaced, pilots had reported to engineering staff that the friction locks were difficult to adjust.

The operator’s Flight Crew Operating Manual for the B200C aircraft included the following checklists where the friction locks were to be checked by the pilot prior to take-off:

• Internal daily inspection: This checklist was completed prior to the first flight of the day[4] and included checking the power levers friction lock settings in the idle position.
• Before engine starting: After the first flight of the day, the internal daily inspection was replaced by the ‘before engine starting’ checklist, which included a scan procedure beginning at the left side of the cockpit. This checklist required the power levers to be at idle and the friction lock setting checked. Further detail on how to adjust the friction locks was also included:

Place the power lever to the approximate position for take-off power and let go. If they roll back, set them again but tighten the friction.

The power levers have a spring retention configuration that increases resistance the more the levers are advanced. The result of this is the roll back of power levers if the friction lock is set too loose.

• Before take-off: In the before take-off checklist, the pilot would check the friction locks were set. After this, there was no further requirements to check the locks.

These checklists were consistent with the manufacturer’s Pilot Operating Handbook. The ATSB noted that the handbook did not contain further detail on how to adjust the friction lock and the potential for power lever migration.

The operator advised the ATSB that in 2019, there were a number of reported rejected take-offs with serviceable aircraft with no faults found, which were assessed to be related to friction locks not being set correctly prior to take-off. As a result, the operator published an operations note to pilots about friction locks in the before take-off check for the King Air aircraft, with details about their proper adjustment. It was unknown if the incident pilot, who had commenced with the operator in 2021, was aware of this notice.

Power lever migration

Power lever migration on the King Air referred to an uncommanded spring back or migration of the lever towards the idle position. This was typically experienced when the pilot removed their hand from the levers during take-off. If unnoticed, this could result in the aircraft yawing towards the engine experiencing the power lever migration, a significant loss of propeller torque on that engine, and the auto-feather system disarming.[5]

This migration occurred when the friction locks were not appropriately set, and could affect King Air 90, 200 and 300 series aircraft. The propeller and condition levers were not susceptible to migration.

The cockpit to engine nacelle power lever control cables were connected to a cam assembly on the right side of each engine via a lever. This lever was spring loaded towards idle to prevent an uncommanded acceleration in the event of a power lever cable malfunction that could damage the engine when torque and temperature limits were exceeded. The springs also reduced the effect of hysteresis[6] when power was reduced, which could cause the rate one engine’s power reduced relative to the other to be different. An additional spring could be fitted during production or maintenance to further balance the rate of power reduction between both engines. This additional spring was not fitted to the incident aircraft. The effect of the springs migrating the power levers toward idle during normal operations was overcome by setting the friction locks.

In addition, as the power lever cables were connected to the right side of each engine, the cable for the left engine was shorter than the right, and therefore less affected by hysteresis. Due to this, if the friction locks were not correctly set, the left power lever could migrate further aft than the right, resulting in an uncommanded left yaw. The operator demonstrated this on the ground without the engines running. With both power lever friction locks loosened and the levers full forward, when they were released the left engine power lever migrated further aft than the right (Figure 2).

Figure 2: Power lever migration demonstration

Source: Pel-Air, annotated by the ATSB

Prior to the incident, the operator’s training for pilots converting to the B200C was limited to the operation of the friction locks. At interview, the pilot reported that they were new to the B200C aircraft type and unaware that power lever migration could occur during take‑off. Another pilot from the operator noted that, until a pilot experienced a power lever migration, then it could be difficult to know how much to tighten the friction locks.

In addition, the King Air magazine included articles that emphasised the importance of adjusting the friction locks adequately to avoid power lever migration. The articles also described techniques to check that the friction locks were set sufficiently to prevent migration.

Similar occurrences

A review of the ATSB database did not find any reported occurrences involving power lever migration on the King Air series aircraft relating to the adjustment of the friction locks, but the manufacturer stated that they had received such reports. Likewise, the operator’s pilots interviewed recalled they had experienced or heard of others having a similar event. The operator’s senior base engineer also indicated that power lever migration was a known issue.

A review of the operator’s safety management system database found 10 reports from the previous 5 years, 6 of which involved VH-VAH. For example, on 18 August 2021 (the day prior to the incident), VH-VAH was being operated on a patient transfer flight. During take-off, the aircraft lost partial engine power and yawed left. This occurred due to the left power lever migrating aft when the pilot under check moved their hand to the control column to rotate the aircraft. Both the check captain and the pilot under check immediately identified the reason for the loss of power. The check captain moved the power lever forward to full power while the pilot under check applied right rudder to maintain control, retracted the landing gear, and adjusted the friction lock when the aircraft was at safe height. The flight continued without further incident.

In addition, the operator advised the ATSB of another power lever migration occurrence involving a B200 aircraft after the occurrence that was the subject of this investigation. On 31 September 2022, the aircraft was being operated on a patient retrieval flight. During the take-off roll, the pilot detected a migration of the left power lever, resulting in an uncommanded yaw left. This occurred at about the time when the pilot removed their hand from the control column. The pilot rejected the take-off and the aircraft subsequently impacted the runway edge lights.  Engineers replaced the throttle quadrant and the throttle friction assembly. Based on this event, the operator is conducting a review of their take-off procedure including simulator testing and research.

The ATSB also contacted another B200 operator who recorded 4 reports of power lever migration over the previous 5 years.

A review of the United States Aviation Safety Reporting System database found 3 reported power lever migration occurrences due to friction lock adjustment since 1988. In addition, there have been 2 notable international investigations where this was identified as a potential factor that contributed to the accident involving a King Air (detailed below).

UK Air Accidents Investigation Branch investigation (7/2003)

On 23 December 2000, a Beechcraft B200 aircraft departed Blackbushe, United Kingdom to Palma, Spain on a private flight. Shortly after take‑off, the aircraft was observed to bank left before colliding into a factory complex 13 seconds later, resulting in a fire. All on board were fatally injured.

An examination of the aircraft did not identify any technical issues that would have contributed to the accident. However, analysis of the cockpit voice recorder showed a reduction in one of the propeller’s rpm as the aircraft rotated, which would have led to thrust asymmetry. The investigation concluded that, it was probable a migration of a power lever due to insufficient friction being set had occurred. It was also noted that the friction control had been slackened during recent maintenance and it was possible that it was not adjusted adequately by the pilot when doing their checks prior to take-off. As a result of the investigation, a safety recommendation was made to Raytheon Aircraft Company:

The Raytheon Aircraft Company should ensure that reference to the correct adjustment of power lever friction is suitably emphasised in the Beech 200 Aircraft Operating Manual (AOM) and the consequences of insufficient adjustment are not only highlighted in the AOM but also included in the recommended Beech 200 type training syllabus.

The ATSB was unable to find any follow-up action on this recommendation recorded in the investigation site.

US National Transportation Safety Board investigation (CEN19MA190)

On 30 June 2019, a Beechcraft King Air 300 departed Addison, Texas, United States, on a private flight. During take-off, the aircraft was observed to roll left before reaching a maximum altitude of 100 ft above ground level. It then descended and collided with a hangar in an inverted attitude about 17 seconds after take-off. All on board were fatally injured.

Analysis of the cockpit voice recorder showed that 7 seconds after take-off, the propeller speeds diverged, with the left propeller speed decreased to 1,688 rpm and the right propeller speed decreased to 1,707 rpm. An engineering examination did not identify any technical issues with the aircraft, but other evidence suggested a loss of thrust in the left engine was most likely experienced shortly after take-off.

While the reason for the reduction in thrust could not be conclusively determined, the investigation considered inadequate friction setting the most likely cause. It was noted that other circumstances, such as a malfunction within the power control system could have also resulted in a loss of engine thrust. However, the extent of damage to the power control system precluded determining the position of the power levers at the time of the loss of thrust or the friction setting during the flight.

Safety analysis

Uncommanded left yaw

Just after take-off at night, the pilot reported that the aircraft suddenly yawed left. This was consistent with the recorded flight path and the paramedic’s observations. When the yaw occurred, the pilot’s immediate response was to manage the situation as a left engine failure by applying right rudder and aileron to maintain directional control. The pilot then noticed the left power lever had migrated to the idle position and responded by pushing the power lever forward. After resetting the power lever friction lock, the flight continued without incident.

Insufficient friction applied

The friction locks were adjusted by the pilot to a level they believed to be sufficient prior to take-off.  However, as the post-flight engineering inspection did not find any technical issues with the power lever and friction lock assemblies, and the left power lever had migrated twice during the take-off sequence, it was likely that the friction lock had not been sufficiently set during pre-flight checks. This was consistent with the paramedic’s recollection of the pilot indicating that the friction lock had to be re-set.

King Air friction lock characteristics

Due to the spring loading of the power levers on the King Air series aircraft, there was a tendency for the levers to migrate towards the idle position, particularly during take-off, if the friction locks were not appropriately set. This was more prevalent on the left power lever due to the shorter length of its cable. There was also an awareness of the possibility of a narrow range of adjustment, inconsistency in friction lock settings between the left and right engines, and from aircraft to aircraft, which could change due to wear.

While the incident pilot was not aware of the possibility of power lever migration, the need to carefully adjust the friction locks to prevent migration was more broadly known by B200C pilots and operators. This characteristic had been experienced among different operators and pilots as demonstrated in the reported occurrences and had also been considered as a potential factor in two fatal accidents.

Findings

From the evidence available, the following findings are made with respect to the uncommanded power reduction involving Hawker Beechcraft King Air B200C, VH-VAH, Essendon Fields Airport, Victoria, on 19 August 2021.

Contributing factors

• During a night take-off from Essendon Fields Airport, the left-engine power lever migrated to idle, which resulted in an uncommanded left yaw.
• During the pre-flight checks, it was likely that the pilot applied insufficient friction to prevent the left power lever migrating.
• The power lever friction locks fitted to the Beechcraft King Air series aircraft required careful adjustment to prevent power lever migration during take-off, particularly on the left engine. This characteristic was broadly known among operators and pilots.

Safety actions

Safety action by the Pel-Air

As a result of the incident, Pel-Air undertook the following safety actions.

Training

The engineering department and flight operations manager provided additional training to all King Air pilots demonstrating how the friction lock system worked, how power lever migration could occur, and how to check the friction locks were adequately adjusted. In addition, a course on power lever migration has now been included as part of the ground school pilot training for the King Air aircraft.

Revised take-off procedure

The day after the incident, the operator published a notice to air crew, which stipulated that all take-offs on sealed runways must be conducted using a standing start take-off. Further, the take‑off checklist for a standing start in the Flight Crew Operations Manual was amended to include a requirement for pilots to check that the friction locks were set to prevent power lever migration when take-off power had been set.

Safety advisory notice to King Air series aircraft operators

The Australian Transport Safety Bureau advises pilots and operators of the King Air series aircraft (90, 200, and 300) that the power lever friction locks require careful adjustment to prevent power lever migration towards the idle position, particularly during take-off. Inadvertent migration of one power lever towards idle can result in power reduction and yaw that, when occurring at low height, can result in catastrophic outcomes. Operators should ensure pre-flight checks provide opportunities to confirm friction lock settings before the take-off run, and ensure pilots have adequate knowledge of friction lock sensitivity to help prevent and recover from inadvertent power lever migration.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot
• the paramedic
• Pel-Air
• Textron Aviation (type certificate holder)
• United States National Transportation Safety Board.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the pilot
• the paramedic
• Pel-Air
• Textron Aviation
• United States National Transportation Safety Board.

A submission was received from Pel-Air. The submission was reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

In the early afternoon of 19 June 2020, the pilot of an RF Designs Mephisto, remotely piloted aircraft (RPA), was conducting test flights following aircraft maintenance. After completing a successful autonomous test flight, the pilot toggled the automatic mode switch to disengage the aircraft’s automatic mode for taxi back to the hangar.

The pilot then increased the throttle to provide the aircraft with sufficient momentum to taxi. As the aircraft turned towards the pilot, they determined that the aircraft was not responding to commands to reduce the engine thrust. The pilot considered attempting to arrest the aircraft by hand but determined it was moving too quickly and instead toggled the automatic mode switch to regain control of the aircraft and turn it away from bystanders.

The pilot then directed the aircraft across the airfield and it came to rest against the perimeter fence, resulting in minor damage to the aircraft’s skin.

What the ATSB found

The ATSB determined that, following the autonomous flight, the pilot did not correctly disengage the aircraft’s automatic mode. Subsequently, when they increased the throttle to provide the aircraft with momentum to taxi back to the hangar the ’abort landing’ function activated, increasing the throttle to maximum and overriding the pilot’s commands to decrease throttle. The pilot was able to deactivate the ’abort landing’ function by toggling the automatic mode switch.

It was determined that the pilot did not identify visual, audible and tactile cues that indicated the aircraft had not exited the automatic mode prior to increasing the throttle for taxi. The most likely reason for this was that they were experiencing a level of fatigue known to impact performance.

Additionally, the pilot’s controller utilised switches with 3‑positions for 2‑position (on – off) roles, increasing the likelihood of incorrect or incomplete selection. The controller also lacked the means to enable the pilot to immediately shut down the aircraft’s engine.

What has been done as a result

In response to this incident the operator implemented several changes to their systems and procedures. They advised that 3‑position switches on the aircraft controllers, which were being used for 2‑position roles, have been replaced with 2‑position switches. A formalised taxi-in procedure has been introduced that requires personnel to shutdown aircraft on the runway and push them to the hangar by hand. A gated switch was installed on the remote controller that was capable of overriding all other controls, placing the flight controller into manual mode and commanding the throttle to shut down the turbine engine.

For subsequent operations the flight test timeline was increased from 7 to 10 days with no increase in workload. The additional time was to allow for aircraft setup and testing prior to operations commencing and to ensure that all crew members were provided with adequate rest and recovery time during both setup and operations.

Safety message

This incident has 3 key learnings for RPA operators:

• Fatigue is a risk, particularly in high tempo commercial operations. Even when fatigue management is not mandated, operators should ensure that their fatigue management processes are robust and effective.
• All controls for RPA’s should be as simple and reliable as possible. If a control leaves room for human error, then it will increase the risk of this error occurring even if procedural controls are in place. Consideration should also be given to a system that allows the remote pilot to shut down the aircraft immediately in the event of an unexpected state or failure.
• Operators should be prepared for the RPA to do something unexpected and know and frequently practice emergency procedures.

The occurrence

On the weekend of 13‑14 June 2020 a team of remote pilots and maintainers from Remote Piloted Systems (the operator), RF Designs (the maintainer) and a client company arrived at Bruhl Airfield, 2 km south-west of Tara, Queensland (Figure 1). Over the weekend they set up and prepared for a week of test flying of two autonomous test bed aircraft, the RF Designs Albatross and the RF Designs Mephisto (Mephisto). The aircraft were assembled, following disassembly for transport, and systems tested prior to operations commencing on the Monday morning. This work was overseen by the operator’s chief remote pilot (CRP) and a senior manager of the maintainer.

Figure 1: Location of Bruhl Airfield

Source: Google Earth annotated by the ATSB

Throughout the following week the team conducted multiple test and evaluation flights for the client each day. These usually involved multiple aircraft and multiple pilots through the launch (take-off), mission, and recovery (landing) phases.

On the morning of Friday 19 June, the final operational flights were carried out for the client company. Following this, the client’s personnel commenced packing up and preparing to depart the site. With all relevant permissions and approvals in place, the operator’s CRP took the opportunity to conduct post maintenance test flights on Mephisto HP001, to ensure that it was airworthy and prepared for future operations. During the week, HP001 had undergone maintenance which included the aircraft’s flight controller being removed and reinstalled following its use in another Mephisto aircraft.

The flight plan for the test consisted of two flights, testing all three of the aircraft’s modes (see the section titled Aircraft operations), and the flight controller setup and tuning. The first flight was to involve a launch in manual mode, followed by a circuit and recovery in fly by wire (FBW) mode. If the results of this flight were acceptable the aircraft was to be repositioned to the western end of the runway for the second flight. There it would be transitioned to autonomous mode and conduct a fully autonomous launch, circuit, and recovery.

At 1242 Eastern Standard Time,^[1] HP001 was launched, with both flights completed without incident. Figure 2 shows the Global Positioning System (GPS) tracks of the aircraft during the first and second flights with the track colour indicating the aircraft’s mode. Figure 3 shows the transition between the flights and the completion of the second flight, the initial taxi, loss of control and the recovery.

Figure 2: Mephisto test flights 19 June 2020

Source: Google Earth and operator annotated by the ATSB

Following the autonomous recovery at the conclusion of the second test flight, the pilot attempted to transition the aircraft out of the autonomous mode and back into manual mode for taxi to the hangar. The pilot toggled the automatic mode switch and increased the throttle setting to provide thrust to taxi the aircraft. Once the aircraft had sufficient momentum to allow for the taxi the pilot attempted to reduce the throttle setting. However, the aircraft did not respond to the pilot’s commands and the turbine engine continued to accelerate.

The aircraft was now in relatively close proximity to the pilot and moving towards other personnel who had been observing from nearby. The pilot considered arresting the aircraft by hand but, due to the aircraft’s speed and momentum, they determined that was not practical. The pilot re‑toggled the automatic mode switch, allowing them to regain control. With the aircraft back under control, the pilot directed the aircraft across the runway to the southern side of the airfield away from the hangar and personnel. The aircraft was arrested, at low speed, by the airfield boundary fence.

The aircraft was then attended by the pilot and several other personnel who conducted a normal shutdown before pushing it back to the hangar for inspection. The inspection determined that the aircraft only had minor damage to the skin due to the impact with the fence.

Figure 3: Mephisto test flight 2 - occurrence flight

Source: Google Earth and operator annotated by the ATSB

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours

Context

Aircraft information

The RF Designs Mephisto remotely piloted aircraft (RPA) (Figure 4) is a high-performance autonomous testbed aircraft. First flown in 2019, it is based on the CARF-Models Mephisto large model aircraft and modified by RF Designs at their facility in Brisbane. These modifications included a flight controller, additional fuel tank, additional shielded wiring, and some larger and more robust control components, all allowing for autonomous test operations.

Figure 4: RF Designs Mephisto

Source: RF Designs

The aircraft, which can be disassembled for transport, is a composite construction of carbon fibre and fibreglass, 3.1 m long, with a wingspan of 2.6 m. It has a maximum take-off weight of 35 kg, retractable undercarriage and flaps and is powered by a Kingtech K260G2 turbine. Delivering 26 kg of thrust, the turbine can propel the aircraft to a maximum speed of 85 m/s (165 kt) and an altitude of more than 5,000 feet.^[2]

The client owned a fleet of 6 of the aircraft that were operated and maintained by Remote Piloted Systems and RF Designs respectively. Of the fleet, 5 were operationally capable (Figure 5), and 1 (HP001) was used for testing and training.

For the week of 15‑19 June the operator brought 4 of the fleet to conduct operations for the client, 3 operational Mephistos and the test and training aircraft for backup and spare parts.

Figure 5: Operational Mephisto fleet

Source: RF Designs

Aircraft operations

The Mephisto could be operated in three different modes, manual, fly by wire (FBW) or automatic.

In manual mode the remote pilot in command (RPIC) had full control over all aircraft functionality with no interaction from the flight controller’s stabilisation programming. This required that the aircraft be manually trimmed and stabilised by the RPIC. In FBW mode the RPIC commanded the aircraft directly, however, the flight controller’s stabilisation programming interpreted and implemented these commands to ensure stable flight. This meant that if the pilot removed control input, then the aircraft would continue in straight and level flight.

Finally, in automatic mode a flight plan consisting of a series of waypoints was programmed into the flight controller using the ground control station (GCS). When the RPIC activated the automatic mode and the flight plan, the flight controller commanded the aircraft through the programmed waypoints with full control over aircraft systems. When the automatic mode was disengaged the aircraft’s systems return to the settings commanded by the RPIC’s controller.

The crew of the Mephisto consisted of two remote pilots - the launch and recovery pilot (LRP) and the GCS operator. The pilot who was actively flying the aircraft was designated the RPIC. For the autonomous flights the RPIC was the GCS operator as they were monitoring the flight and had the ability to intervene and take control of the aircraft if required.

The LRP primarily conducted launches and recoveries and operated the aircraft in manual or FBW mode within visual line of sight. This usually involved flying the aircraft to or from a holding point where it was transitioned to or from the command of the GCS operator for automated flight.

The GCS operator monitored aircraft systems during all flights, conducted flights beyond visual line of sight (BVLOS) and monitored automatic flights. Due to the difference in their roles the LRP and GCS operator were located at different points on the field (Figure 3). The LRP was on the flight line next to the runway providing them the best view of the aircraft for launch and recovery. The GCS operator worked from inside a hangar which provided a more stable environment for the equipment used to monitor and control the aircraft while away from the launch and recovery location. Due to their physical separation, the pilots communicated via radio.

Due to the risk to the aircraft of an inadvertent mode change when transitioning from the GCS operator to the LRP following a flight, a specific process was used for the handover. This process started after launch once the LRP handed over control to the GCS operator. At this point, the LRP would place the automatic mode switch (see the section titled Remote controller) on their controller in ’auto on’ and set the flaps to fully retracted.

At the time of the occurrence, following the automated test flight, the GCS operator had handed control back to the LRP for taxi. The pilot advised that prior to the hand over their controller had been set up with the automatic mode switch selected to ’auto on’ and the flap control in the fully retracted position.

Flight controller

Each Mephisto aircraft was fitted with a Pixhawk 2 flight controller, which was programmed with ARDUpilot software to enable flight in all modes. The flight controller recorded a range of parameters which could be downloaded and used for simulation, recreation, and analysis.

The flight controller received a constant stream of data from a range of inputs including control inputs from either the LRP remote controller or GCS, GPS information, airspeed and engine fuel flow. It then controlled the aircraft via a series of servos that manipulated the aircraft flight control surfaces and turbine engine controls.

Abort landing command

The ’abort landing’ command within the flight controllers programming allowed the GCS operator or LRP to abort an autonomous landing via the remote controller or GCS. The LRP controller triggered the command when 3 criteria were met.

- The aircraft was in the autonomous mode.
- The aircraft was in the landing stage.
- The throttle on the LRP controller was increased above 90 %.

When these criteria were met the aircraft overrode control inputs, increased turbine power to the take-off throttle setting (100 %), pitched up and maintained the current heading until a target altitude was reached.

Remote controller

To control the Mephisto the LRP used a TARANIS X9D Plus hand-held controller, manufactured by FrSKY. The TARANIS X9D Plus (Figure 6) was a programmable, 24 channel, 2.4 GHz transmitter that could be used to control a range of remote devices, including RPA. The controller had 8 programmable control switches, (6 3-position and 2 2-position) that the user could assign to modes or operational settings.

For this operation, to ensure redundancy, the 2 position switches activated the ’return to launch’^[3](RTL) function. This meant that 3 position switches were used to control the aircraft’s modes. To reduce risk of the automatic mode being inadvertently deactivated the modes were switched separately. One switch controlled the automatic mode (on and off) and the other selected manual or FBW. The control hierarchy placed the automatic mode switch above the manual or FBW switch so an inadvertent movement of the manual or FBW switch would not disengage the automatic mode.

Figure 6 shows the location of these switches. The operation of any of these switches required a defined movement and the pilot described that changing between positions made an audible ’click’.

The automatic mode switch was configured with 2 ’auto on’ and 1 ’auto off’ position, which was the top position. This configuration had recently been updated from 1 ’auto on’ and 2 ’auto off’ positions. This change was due to a risk to the aircraft associated with inadvertent deactivation of the automatic mode during flight, particularly when the aircraft was BVLOS. To ensure that the switch was in the correct position it was normal for pilots to drive the switch to an end point of the control to ensure that the desired mode had been selected.

The LRP controller was not fitted with the ability to activate the aircraft’s flight termination system (FTS) (see the following section titled Flight termination systems and active failsafe) or operate as a ’kill switch’, cutting power the aircraft’s engine. In the event that the LRP required the FTS to be activated they would request the GCS operator activate it.

Figure 6: TARANIS X9D Plus with key controls identified

Source: FrSKY annotated by the ATSB

Flight termination systems and active failsafe

Under the Civil Aviation Safety Authority (CASA) permission for the operation (see the section titled Operational information) the aircraft was required to be fitted with a primary active failsafe system and primary and secondary flight termination systems. The primary active failsafe system was designed to ensure that the aircraft did not depart the operational area in the event of a communications loss with the controller. It was designed to return the aircraft to either the launch point or some other holding point within the operational area that allowed the RPIC to conduct necessary checks and perform relevant actions to re-establish communications. If necessary, the system could be activated by the LRP, GCS operator or automatically if the aircraft exited the operational area. The aircraft’s RTL function met this requirement.

The FTS was a secondary level of control that was activated if the primary active failsafe failed or was unable to return the aircraft to a stable location. The system worked by bringing the aircraft to the ground as quickly and as safely as possible, with the main aim of protecting personnel and property. In the case of the Mephisto, the FTS was set to place the aircraft flight control surfaces in a configuration to induce a spin and cut fuel to the engine. This arrested as much forward momentum as possible prior to impact with terrain. The FTS was activated by either the GCS on a dedicated control link or automatically if the aircraft departed a contingency area around the operational area.

CASA specifically stated that the FTS was not intended for use on the ground. However, the system’s process meant that, in the event of an issue on the ground, it would provide a way to rapidly arrest momentum of the aircraft and put it into a known state.

At the time of the incident the aircraft in question was fitted with both the primary active failsafe and FTS. However, due to the rapid development of the aircraft the flight manual had not been updated and contained information that the flight termination system had not been fitted and remained in development.

Operational information

The operator, maintainer and client company had been conducting BVLOS, autonomous and multi-aircraft test flights from Bruhl airfield since November 2019. They had been using a range of smaller, primarily electrically driven aircraft types and recently began using the Mephisto, to allow for higher performance operations and testing.

Bruhl airfield, located approximately 265 km west-north-west of Brisbane Airport (Figure 1), was chosen for 3 reasons. Firstly, it was familiar to several of the crew members. Secondly, it was remote and the surrounding area desolate. This meant that the operational area had a low the risk to persons and property in the event of an aircraft malfunction. Finally, it was accessible by road for the operator, maintainer, and client company from Brisbane.

Operational permissions

Permission for autonomous, BVLOS, multi-aircraft operations at Bruhl airfield operations was granted by the CASA in November 2019. The operator was authorised for flight BVLOS above 400 ft within defined areas and in compliance with certain conditions until 30 November 2020 or revoked. These conditions included:

• the fitment of a ’primary failsafe mode’ which could command a return to launch, ensuring that, during this process, the aircraft did not increase height or depart from the operational area
• fitment of both primary and secondary flight termination systems, with the secondary being able to command immediate flight termination in the event of the loss of communications with the primary.

Operational schedule

Operational test flights for the client’s systems were carried out throughout the week, finishing prior to the incident flight at approximately midday. Through the week these operations started at around 0900 and continued throughout the day, with a break for lunch.

Following each flight there was the requirement to download and analyse the aircraft flight data, liaise with the client company, conduct any required maintenance, and prepare aircraft and flight plans for following flights. These tasks were usually carried out by the incident pilot in their role as the operators CRP.

There was no formalised procedure for taxiing the aircraft back to the hangar. However, the pilot reported that there was a standard process that Mephisto pilots followed to provide the aircraft with enough momentum for the taxi. This process, as outlined below, was for a Mephisto aircraft having completed an autonomous recovery and positioned on the runway.

1. LRP to take control of the aircraft.
2. automatic mode to be deactivated with the aircraft in either FBW or manual
3. remote controller throttle advanced to 100 %
4. pilot to wait for the throttle to spool up to the desired level (approximately 30 %), due to throttle lag this could take approximately 6-7 seconds
5. pilot to throttle back on the controller to desired level
6. pilot to taxi the aircraft back to the hangar under its own power.

Crew information

A team of five pilots, all cross trained on the GCS and as LRP for the Mephisto aircraft, were available to conduct the week of flight activity. In addition, at the time of the incident, multiple training pilots were observing the test flight in preparation for CASA flight testing during the following operational period.

For the incident flight the aircraft crew consisted of the LRP, who was also the operator’s CRP, and a GCS operator. Both the LRP and GCS operator held current remote pilot licenses (RePLs) with appropriate category and type endorsements for operation of the Mephisto.

Fatigue

The International Civil Aviation Organization (2016) defined fatigue as:

A physiological state of reduced mental or physical performance capability resulting from sleep loss, extended wakefulness, circadian phase, and/or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety related operational duties.

Fatigue is a known contributor to a range of adverse effects on human performance. These can include, slower reaction times, decreased vigilance, shortened attention span, reduced short term memory capacity, and reduced decision making capability.

The pilot reported that at the time of the incident they, and others undertaking the operation, were experiencing a heightened level of fatigue due to the tempo of the operation.

Three people on site were designated to monitor fatigue of the operational crew, the incident pilot (as the operators CRP), a senior manager of the maintainer’s company, and a representative from the client company. The pilot reported that following an out‑landing incident earlier in the week, the client’s fatigue management personnel reported that they believed that there was a heightened level of fatigue among the operational personnel. This increased awareness of the fatigue levels prompted increased monitoring of the crew. However, no further action was deemed to be necessary.

Fatigue guidance

At the time of the incident, there was no regulation that applied to fatigue management for operators of RPA. However, in the company operations manual, the operator had used guidance from CASA's sample operations manual, which identified the following 3 areas of fatigue management to be followed:

• the chief pilot must consider and minimise the potential for fatigue to effect operations
• pilots were not to conduct RPAS operations if they believed that they were suffering from fatigue that was likely to impair their performance
• pilots must immediately report fatigue related concerns to the chief pilot who would take appropriate action to remedy the situation.

To comply with this, the chief pilot was required to consider several factors relating to each mission, including:

• travel time to the operation
• complexity and duration of the operation
• the time of day that the operation was to take place
• environmental conditions.

Fatiguing conditions

Through a review of the operation and the pilot’s history the ATSB identified 3 factors that could have contributed to a significantly heightened fatigue level. These were environmental conditions, operational requirements, and disrupted sleep.

Environmentally, while the incident occurred during winter, the LRP were operating outside on the flight line, in sunny and warm conditions. While there was no concern about the effect of the temperature, the pilots did identify a risk of dehydration, which can be a contributor to fatigue. These factors were being managed through breaks through the day and access to shade, fluids and food.

Operationally there were 2 periods that would have affected the pilots fatigue levels. Firstly, in the week leading up to the operation the pilot had been undertaking a range of maintenance testing and other preparatory activities. This involved multiple round trips to and from Brisbane to the airfield for test flights, a trip of approximately 3 hours each way. In addition to the flights and aircraft preparation this also involved data download, analysis and associated aircraft tuning both at the airfield and in Brisbane.

These activities were not only fatiguing themselves but limited the pilot’s opportunity for rest in preparation for the operational week, which they were aware was going to have an increased operational tempo. The pilot was aware of the heightened risk of fatigue due to these factors and sought to mitigate them over the weekend prior to the operation by taking more of an oversight role of preparations and leaving individual tasks to crew members.

The pilot reported that during the operational week they had 12 to 14 hours of duty each day. This involved carrying out aircraft test flights for the client company, overseeing LRP and GCS operations for the operational and test aircraft. In their role as CRP, the incident pilot, was also monitoring the crew for signs of fatigue, overseeing maintenance, preparing aircraft, and planning and reviewing data for the operations undertaken each day. The maintenance and preparatory tasks were undertaken in the morning prior to commencement of the days flying operations and, in the evening, following the completion of operations until going to sleep. This meant that, with the exception of mealtimes, there was limited to no time where the operations were not the focus. While the incident occurred in the middle of the day it was at the end of the final test flight of the week’s operations.

The pilot reported that sleep opportunity was in line with their regular habits, getting approximately 7 hours each night. However, during these operations they were staying at the airfield and rooming with another person. The pilot reported that this probably resulted in disrupted sleep. All other members of the crew were roomed off site in individual accommodation, which both promoted sleep opportunity and removed them from the operational environment.

Fatigue review

Unlike crewed aircraft operations, this operation did not need to comply with Civil Aviation Order (CAO) 48.1 Instrument 2019. Despite that, the ATSB reviewed the pilot flight and duty times against the instrument and appendices 1 (basic limits), 4 (any operations) and 5A (daylight aerial work operations and flight training associated with aerial work) to gain an appreciation of what level of fatigue was considered likely to affect performance.

Based on this review it was determined the pilot had exceeded the cumulative duty period limits, had not had sufficient off duty time and did not have adequate sleeping facilities as per the instrument requirements. As such, if the pilot had been seeking to fly a crewed aircraft subject to CAO 48.1 requirements, they would have been considered unfit to fly.

Recorded data

As discussed in the Flight controller section, the Pixhawk 2 flight controller can record and store a range of timestamped flight data and status messages.

The data for the two test flights, was downloaded by the operator and the data and relevant software for interpreting it were provided to the ATSB. Figure 7 shows data from these flights with throttle, flap and altitude traces. Additionally, the active aircraft mode is shown and some of the recorded aircraft status messages.

Figure 7: Flight data showing 19 June test flights

Source: ATSB utilising data provided by the operator

Figure 8 shows data from the second flight with the transition into automatic mode and the aircraft then launching conducting a circuit and being recovered. Following the landing there were a number of mode changes and an aircraft status message that corresponded with the ‘abort landing’ function being activated, the pilot toggling the mode switch to disengage this function and directing the aircraft away from personnel on the flight line.

Figure 8: Flight Data - Mephisto test flight 2 - 19 June

Source: ATSB utilising data provided by the operator

Figure 9 shows greater detail of the incident over the period of 20 seconds from 12:47:00 to 12:47:20, during which the aircraft was under the control of the LRP. This time covers the aircraft on the ground preparing to taxi, the throttle being advanced, and the ’abort landing’ function being activated, as identified by aircraft status message 2. It shows the mode selections by the pilot as they disengaged the abort landing function and toggled into manual mode as the aircraft was directed towards the airfield fence.

The chart shows that the aircraft remained in automatic mode and the flaps remained extended until approximately 12:47:04 when the throttle trace showed an increase to 100 %. At this time the aircraft status message appeared, giving the indication that the ’abort landing’ function has been activated and the flaps retracted while the throttle remained at 100 % as the aircraft followed the ’abort landing’ process.

The data showed the pilot toggling the automatic mode switch to off, and back on, to overwrite the ’abort landing’ function. It shows the throttle trace as the pilot directed the aircraft away from the flight line and across the runway towards the fence, and finally the re-engagement of the manual mode for the aircraft to be shutdown.

Figure 9: Flight Data - Incident - 19 June

Source: ATSB utilising data provided by the operator

__________

2. The aircraft’s maximum altitude was not confirmed – 5,000 ft is the maximum altitude allowed under the operational permissions obtained from the Civil Aviation Safety Authority.
3. When activated the return to launch function automatically flew the aircraft back to the launch point or another designated point and, depending on programming, either held in place (allowing the RPIC to regain control) or conducted an automated recovery.

Safety analysis

Introduction

At 1247 on 19 June 2020, the pilot of an RF Designs Mephisto, remotely piloted aircraft (RPA) completed an automated test flight and attempted to transition the aircraft out of automatic mode to taxi it back to the hangar.

The pilot was unaware they had not deactivated the aircraft’s automatic mode prior to increasing the throttle to provide sufficient momentum for the taxi. This action activated the aircraft’s ‘abort landing’ function and prevented the engine from throttling down as the pilot was commanding.

The following analysis will look at the factors that resulted in the incomplete deactivation of the automatic mode, the pilot not realising the aircraft remained in the automatic mode and the delay in regaining control of the aircraft.

Deactivation of automatic mode

Following the landing, the pilot attempted to deactivate the aircraft’s automatic mode using the automatic mode switch. The switch had 3 positions with 2 positions set for automatic mode on and 1 for automatic mode off. The pilot recalled that they had moved the switch as indicated by the click and movement that was felt. However, they did not recall whether it was moved 2 positions or 1. The data showed no deactivation of the autonomous mode, indicating a single position change.

This meant the aircraft was in a state different to what was intended leading to the activation of the ’abort landing’ function when the pilot advance the throttle, and the subsequent loss of control.

The LRP remote controller (TRANSIS X9D Plus) had only two 2-position switches available, which for redundancy were both being used for return to launch functionality. This meant that the automatic mode selection was relegated to a 3-position switch. The technique of driving the switch to an end point that the Mephisto pilots used went some way towards mitigation of an error. However, the use of a 3-position switch increased the likelihood of a mis-selection and an undesired state.

This potential had been identified by the operator with the change of layout for the 3 positions from off-off-on to off-on-on. It was believed that this was a way to limit the risk of an aircraft accidentally being forced into manual or fly by wire mode while flying beyond visual line of sight. However, it did not overcome the issue of an incomplete or incorrect mode selection.

Aircraft state awareness

There were 3 cues to alert the pilot that the aircraft remained in the automatic mode. Firstly, the aircraft’s flaps had not retracted when they attempted to disengage the automatic mode, despite being set to fully retracted on the controller. Secondly, the pilot should have felt and heard two distinct ’clicks’ as the control moved through the second ’auto on’ position and into the desired ’auto off’ position.

The pilot commented that they did not remember seeing the flaps retract and recalled feeling and hearing 1 click but could not recall the second. The ATSB considered a number of reasons why the pilot may not have detected or reacted to these cues. These included: deliberate pilot action, distraction, expectation bias, and fatigue. Based on the available evidence, it was considered that the heightened level of fatigue was the most likely explanation. This is discussed further below.

Delayed control recovery

In the event of a RPA loss of control on the ground, where the engine was still functioning at a high-power setting, removing engine power is the quickest and easiest way to arrest momentum and bring the aircraft back under control. The flight termination system (FTS), as required under the CASA permission for the operation and fitted to the aircraft, provided the ability override the aircraft’s automatic mode, immediately cut fuel to the turbine and drive the aircraft controls into a configuration to induce a spin.

While this system was designed to operate in the air, its functionality, specifically cutting fuel to the turbine, would have allowed the aircraft’s momentum to be arrested more quickly. However, this system could not be activated from the launch and recovery pilot’s (LRP) controller and relied on communications with the ground control station operator to activate it. The aircraft’s data showed that there were only seconds for the pilot to react and take appropriate action. While calling for the activation of FTS would have stopped the aircraft it would not have been practical in the time available.

Had the LRP’s controller been fitted with a switch that could activate the FTS, there would have been no requirement for the extra control inputs to deactivate the ‘abort landing’ function and regain control of the aircraft.

Fatigue

For this operation the potential effects of fatigue on crew members had been identified and a range of fatigue management and mitigation strategies were in place. However, these strategies did not specifically account for the added work created by the incident pilot’s additional role as the operator’s chief remote pilot (CRP).

For example, in addition to flight operations and testing, they were liaising with the client company, monitoring other team members for signs of fatigue and staying at the field in shared accommodations. Additionally, while the crew was being monitored for fatigue, the 3 personnel assigned to monitor the fatigue - the CRP, the maintainers senior manager and the clients fatigue monitoring personnel did not have anyone assigned to monitor their fatigue levels. Fatigue monitoring is only effective if all personnel are being monitored.

Considering their workload and reduced rest opportunity, the ATSB assessed that it was likely that the pilot was experiencing a level of fatigue that affected performance. Heightened fatigue levels are known to cause a reduction in ability to react to external stimuli and effect a person’s attention and decision-making capacity.

The level of fatigue felt by the pilot at the time of the incident likely had an effect on them missing the visual (flaps not retracting), tactile (not feeling one click rather than two) and audible cues (hearing one click not two) that indicated the aircraft had not exited the automatic mode.

Findings

From the evidence available, the following findings are made with respect to the loss of control during taxi involving RF Designs Mephisto, HP001 at Bruhl Airfield on 19 June 2020.

Contributing factors

• When the throttle was advanced for taxi, the automatic mode, which had not been correctly deactivated, entered an ’abort landing’ state. This overrode the pilot’s commands to decrease throttle and the turbine thrust continued to increase, resulting in a loss of control.
• The use of a 3-position switch (with 2 positive and 1 negative position), for a 2‑position role, increased the likelihood that a pilot would inadvertently not deactivate the automatic mode prior to manoeuvring the aircraft.
• The controller did not have a ’kill switch’ to override the aircraft’s automatic mode and shutdown the turbine in the event of an issue. As a result, the pilot was forced to toggle the aircraft’s mode switches and direct it away from personnel rather than being able to override it.
• The pilot was experiencing a level of fatigue known to impact performance. This likely led to a lack of reaction to multiple cues that the aircraft had not exited the automatic mode.

Safety action

Safety action not associated with an identified safety issue

Safety action by Remote Piloted Systems (the operator).

In response to this incident the operator introduced the following changes to the Launch and Recovery pilot’s controller switch layout and allocations, procedures for taxiing the Mephisto aircraft and operational planning to reduce risks identified:

• 3‑position mode switches were replaced with 2‑position mode selection switches to eliminate issues with incomplete deactivation of the automatic mode.
• All launch and recovery pilot controllers had a ’kill switch’ added that overwrites the aircraft’s mode to manual and drives the throttle immediately to zero thrust. This switch is gated to enable easy to operation, when necessary, but is also difficult to inadvertently activate.
• Taxi procedure has been changed/formalised to require that all aircraft are shutdown on the runway and pushed back to the hangar by hand rather than under their own power.
• The operational timeline has been extended from 7 to 10 days, with additional time to setup and prepare the aircraft and a break before operations commenced.

Safety action by RF Designs (the maintainer).

Since this event the RF Designs has introduced the following two safety improvements:

• The aircraft flight manual has been updated to clarify the presence of the flight termination system, removing the phrase ’not currently fitted, in development’.
• Specific fatigue management requirements, including references to CAO-48.1, have been added to the RPA operations manual.

The ATSB welcomes the prompt safety action taken by the operator and maintainer to address the deficiencies identified in this incident.

Glossary

BVLOS             Beyond Visual Line of Sight

CASA               Civil Aviation Safety Authority

CRP                 Chief Remote Pilot

FBW                Fly by Wire

FTS                  Flight Termination System

GCS                 Ground Control Station

GPS                 Global Positioning System

LRP                 Launch and Recovery Pilot

RePL                Remote Pilot License

RPA                 Remotely Piloted Aircraft

RPIC                Remote Pilot in Command

RTL                  Return to Launch

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• pilot flying
• aircraft manufacturer and maintainer
• Civil Aviation Safety Authority
• Operators manual for the FRSky TARANIS X9D Plus
• recorded data from the aircraft
• ARDUpilot documentation.

References

ICAO. (2016). Doc 9966: Manual for the Oversight of Fatigue Management Approaches 2nd Edition. Quebec, Canada: International Civil Aviation Organisation.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the operator and pilot flying
• the maintenance organisation
• CASA

No submissions were received.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the morning of 12 December 2019, a student pilot took off for a series of solo circuits in a BRM Aero Bristell, registered VH-YVF, at Moorabbin Airport, Victoria. Just after crossing the runway threshold for the first touch and go landing, witnesses observed the aircraft about 10 ft above the runway, when it suddenly pitched up to about 40 ft. The left wing dropped, with the bank angle increasing to the point where the aircraft became inverted.

The witnesses described what they saw as similar to the aircraft being in the first half rotation of a spin entry. The nose then dropped and the aircraft impacted terrain in a steep inverted attitude. The student pilot was severely injured, and the aircraft was destroyed.

What the ATSB found

The ATSB found that the pilot commenced a go‑around at low level when the aircraft deviated from the runway centreline in crosswind conditions. During the go‑around, the aircraft aerodynamically stalled and commenced a spin.

It was also identified that the student pilot did not have the necessary qualifications and skills to safely operate the Bristell solo.

Finally, the required Soar Aviation solo flight dispatch procedures were not followed. As a result, it was not identified that the student pilot was not authorised for, nor met the required competencies, to conduct the flight.

What has been done as a result

Soar Aviation implemented enhanced measures to ensure student pilots were fully briefed and authorised, before conducting a solo flight. These amended procedures included changes to the aircraft booking procedure and having aircraft keys stored such that they were only accessible by flight instructors.

Soar Aviation ceased flight training on 29 December 2020.

Safety message

Familiarity with an aircraft’s specific systems, controls, handling and limitations is essential for safe flight.

Safety-critical procedures and regulations are in place to ensure that pilots have the required level of skill and experience to safely operate an aircraft. The outcome of this accident, which could just as easily have been fatal, illustrates a consequence of deviating from them.

The investigation

The occurrence

On the morning of 12 December 2019, a student pilot conducted a pre-flight inspection of a BRM Aero Bristell S-LSA,^[1] registered VH-YVF, in preparation for a solo flight. A second student (student 2) also conducted a pre-flight inspection of their aircraft at the same time and, after completing their aircraft checks, they returned together to the flight school’s main building. Student 2 reported they then ‘walked into navigation planning to organise dispatch of my flight’ however, they observed that the other student pilot did not. Student 2 later observed the student pilot walking back to the where the aircraft were parked, with their ‘flight bag and aircraft folder’.

The student pilot had the aircraft keys however, they had not endorsed the aircraft’s maintenance release or conducted the required solo flight briefing and sign out procedure with a flight instructor. The student pilot stated to the ATSB that they believed they were authorised for the solo flight. However, they also reported a level of confusion as to whether the solo dispatch procedure was required at their stage of training.

At 0950 Eastern Daylight-saving Time,^[2] the student pilot was cleared by air traffic control (ATC) to take off from runway 17L^[3] at Moorabbin Airport, Victoria, for a series of circuits. The pilot reported feeling ‘uncomfortable’, with the aircraft and its systems during the flight, and that they surmised this was due to their limited experience in the Bristell.

While on the downwind leg of the first circuit, the student pilot advised ATC of their intent to conduct a touch and go, which was subsequently cleared at 0954. During the approach to the runway, the student pilot described that they felt the nose ‘wanted to pitch up’, even though they believed the aircraft was neutrally trimmed.

The student pilot stated that, just after crossing the runway threshold, what felt like a sudden gust of wind pushed the aircraft to the left of the runway centreline. At that point, the student pilot decided to initiate a go-around. The pilot reported that, after commencing the go-around. the aircraft was then ‘ripped up very violently, straight up into the air and then ripped very violently toward the left’. They attempted to recover with full right rudder ‘as far as it would go, but by that time it was too far gone’ (Figure 1).

Witnesses reported observing the aircraft, about 10 ft above the runway, when it suddenly pitched up to about 40 ft. The left wing dropped, with the bank angle increasing to the point where the aircraft became inverted. The nose then dropped, and the aircraft impacted terrain in a steep inverted attitude. The witnesses described what they saw as similar to a spin entry to the left.

Figure 1: Flight track, with the approach to land phase highlighted in yellow

Source: Google Earth, annotated by ATSB using VH-YVF flight data

ATC also observed the accident and initiated an emergency response. The student pilot was severely injured, and the aircraft was substantially damaged. There was no post-impact fire.

Context

Pilot information

The student pilot commenced flying training with Soar Aviation in March 2019 and gained a Recreational Aviation Australia (RAAus)^[4] Pilot Certificate on 30 September 2019. The student pilot then converted their pilot certificate to a Civil Aviation Safety Authority (CASA) Recreational Pilot Licence (RPL), which was issued on 13 November 2019.

Operation of VH‑registered aircraft such as VH-YVF (YVF) required a minimum of an RPL. In order to exercise the privileges of the RPL, the student pilot was first required to complete an aircraft flight review. At the time of the occurrence, this had not been completed. In addition, the student pilot did not hold an RAAus endorsement for ‘in-flight adjustable propeller’, nor the CASA-equivalent ‘manual propeller pitch control’ as fitted to the Bristell (see the section below titled Aircraft information).

The student pilot had accrued about 72 hours flight experience, which included 10 hours of solo flight, all in the RAAus-registered Aeropakt A-32 Vixxen (refer to the Aircraft information section). The student pilot’s last recorded solo flight was on 21 October 2019.

The student pilot underwent their baseline CASA medical examination in March 2019 and at the time of the accident held a current Class 1 medical certificate, with nil restrictions or conditions.

Aircraft information

BRM Aero Bristell

The BRM Aero Bristell S-LSA is a two-seat, all-metal, low-wing aircraft, with fixed tricycle landing gear, steerable nose wheel and stick control. YVF, serial number 330, was powered by a Rotax 912 ULS horizontally opposed four-cylinder normally aspirated engine and a variable pitch MT-Propeller. The aircraft was manufactured in the Czech Republic in 2018 and registered in Australia the same year.

YVF was flown for 2.3 hours on the day before the accident, with no reports of any issues, and had a total time of 997.8 hours. A review of the maintenance logbooks did not identify any prior accidents or major repairs.

Figure 2: VH-YVF

Source: Used with permission

The aircraft manufacturer’s Aircraft Operation Instructions manual had the following guidance on headwind and crosswind limitations (Figure 3).

Figure 3: Bristell wind limitations

Source: Soar Aviation

With regard to the different crosswind limitations, the manual did not define the terms ‘average’ or ‘skilled’ pilots.

Aerokprakt A-32 Vixxen

The Aeroprakt A-32 Vixxen (Vixxen) aircraft is a Ukranian-built two‑seat, high-wing, tricycle gear ultralight. The Vixxen is powered by a Rotax 912ULS engine and a 3-blade KievProp ground‑adjustable propeller.^[5] In addition, the Vixxen is configured with an all‑flying horizontal ‘stabilator’^[] and conventional flight control yoke.

Figure 4: Typical A-32 Vixxen

Source: Ian McDonell

Differences in handling between the Bristell and the Vixxen

When asked about the differences between the Bristell and the Vixxen, in general handling and stall characteristics, flight instructors advised that:

• it would typically take three to four flights to get used to the new type, particularly yoke versus stick
• the Bristell’s elevator was significantly smaller and therefore less sensitive
• significant forward movement of the Bristell’s flight control stick is required with the in‑flight application of power to counter a pitch‑up tendency
• in a stall, the Bristell ‘really did like to drop a wing’, usually the left, and ‘if it does so, it is not normally as gentle as other planes that I’ve flown …, if I was to compare it to the Vixxen, I would say you’d want to be much more aware of what you’re doing in the Bristell’.

Site and wreckage examination

Examination of the wreckage (Figure 5) did not identify any evidence of pre-existing faults or engine issues which may have contributed to the loss of control.

The site and wreckage examination identified that YVF impacted terrain in a nose-down, inverted attitude. In addition, damage to the airframe and engine was indicative of the aircraft being in a moderate spin/yaw to the left, at the point of impact. This was consistent with witness reports that the aircraft pitched up, rolled to the left and impacted the terrain inverted, in what appeared to be the commencement of a spin.

Figure 5: Accident site

Source: ATSB

Recorded flight data

The aircraft was fitted with a Garmin G3X avionics system, which was an integrated flight instrumentation, position, navigation and communication system. The G3X unit had a flight data logging feature which automatically stored flight and engine data to its memory module.

The ATSB was able to download the data from the occurrence flight however, the data stopped just as the aircraft flew over the runway 17 threshold (Figure 6). It is likely the final seconds of data were lost due to the interruption of electrical power to the unit at impact. The last 5 seconds of recorded data captured:

• indicated airspeed reducing from 60 to 51 kt
• altitude decreasing from 106 ft to 76 ft
• vertical speed stable at -255 fpm
• roll no more than 5° either side of wings level
• pitch increasing from about -0.5 to +5.0° but not stable
• yaw varying from 0 to -5°/s
• wind speed and direction: stable at 223° and 15 kt (13 kt crosswind)
• engine RPM decreasing from 3,730 to 2,580 and fuel flow relatively stable at 2.2‑2.4 gallons/hr
• GPS track was aligned with the runway centreline.

Figure 6: Accident site overview

Source: Google Earth and ATSB, annotated by ATSB

Weather

The Bureau of Meteorology (BoM) automatic weather station at Moorabbin Airport recorded observations at one-minute intervals (Table 1), with the loss of control occurring at about 0955. The temperature was steady, at about 15°C, at the time of the occurrence.

Table 1: Moorabbin Airport weather observations

The crosswind component at the time of the loss of control was calculated to be about 13 kt, accounting for the observed 15 kt gust. The Moorabbin automatic terminal information service was advising of a 12 kt crosswind at that time and the student pilot reported noting this during the flight.

Soar Aviation procedures

Gobel Aviation, trading as Soar Aviation (Soar), was a CASA Part 141 authorised flight training organisation. Soar provided flight training from ab-initio through to obtaining a commercial pilot licence (CPL). Soar’s training syllabus, in conjunction with the Soar Operations Manual and CASA Part 61 MOS Competencies into individual flight lesson for training and assessment, outlined the competency requirements for each phase of the flight training, including suggested lesson content and duration. Where a pilot required additional flying training to complete a competency, these flights could be added to the training schedule.

Students typically commenced training on the RAAus-registered Aeroprakt A-22 Foxbat or Vixxen aircraft, and then transitioned to the VH-registered Bristell for the command-building flights during the CPL phase. The syllabus identified 3 hours of familiarisation flight training when transitioning between aircraft types.

Solo training flight procedures

Soar Advanced Flight Training Operations Manual Part 3B Conduct of training operations detailed the procedures for ‘authorisation of training flights’. The procedures for flight preparation and planning, ‘prior to any training flight’ included pre- and post-flight briefings and that ‘the flight is authorised by an approved person’. The student pilot’s records showed that they had ‘read and understood’ the procedures. In addition, they had followed these procedures during their flight training on the Vixxen.

The procedure for solo flights stated that ‘the authorising instructor will only dispatch the flight’ when they had confirmed 13 checklist items, which included:

• the student had completed all training and examinations as prescribed by the syllabus for the solo flight
• the student flight training records indicate that they have achieved the required standard for all elements of competency for the flight, including flight crew licence and endorsements, as applicable
• the student had been briefed on the objectives, conditions and limitations of the intended solo flight, including that task or route to be flown, number of circuits (if applicable), traffic and ATC consideration, and actions to be taken during an emergency
• the student was clear on what they are authorised to do while on their solo flight
• the actual and forecast weather conditions, including runway crosswind and last light limitations were suitable considering the student’s previous competence in similar conditions
• the daily inspection was complete and certified
• solo risk matrix has been completed and authorised by a flight instructor.

The solo risk matrix form included considerations for aircraft serviceability, pilot experience and weather. Pilot experience included a check for ‘5 hours dual training on aircraft type’. The weather section included consideration to wind (gusts and turbulence) and crosswind (Table 2), among other factors.

Table 2: Solo risk matrix crosswind and wind gusts component

The risk rating detailed that dispatch of the flight, at level 3, was at the discretion of a Grade 1 instructor. Level 2 was at the discretion of a Grade 2 instructor and level 1 was ‘limited by the student’s personal minimums’. The solo risk matrix form was to be signed by the student and authorising instructor, prior to flight.

Soar advised the ATSB that, had a solo flight been scheduled for the student pilot, in a Vixxen, the risk assessment would likely have resulted in level 2 ‘at the discretion of a Grade 2 flight instructor’. This would factor in the pilot’s skills and experience in the Vixxen, which indicated 10‑14 kt crosswind for the equivalent skill level of the student pilot. Further, Soar advised that the instructor and the pilot would have reviewed the weather, and discussed operational aspects, prior to the flight being approved.

Flight booking system

Soar required students to book flights in advance, by liaising with operations staff, to ensure their flight training was progressing at an acceptable rate. An aircraft, and an instructor where applicable, were assigned to the booking however, the exact nature of the flight was not assigned until amended by the instructor, as part of the pre-flight briefing.

Bristell flight training

In preparation for their commercial pilot licence training phase, the pilot received a 2-hour familiarisation flight in a Bristell, on 11 December 2019. Due to weather limitations, the lesson entry report noted that the following required competencies were unable to be assessed:

• take off in a crosswind
• land aeroplane in a crosswind
• enter and recover from a stall
• recover from incipient spin
• perform recovery from missed landing.

The lesson entry report identified these items as competency grade 5 ‘the element has not been assessed’^[6] and the instructor noted they were to be completed on a future flight.

The student pilot reported, from their recollection of the post-flight debrief with the instructor, that the aircraft flight review and endorsement for the manual pitch propeller control had been ‘signed off’. Further, they believed they were advised by the instructor as ‘you’re good to go’. From this, the student pilot believed they were instructed, and authorised, to conduct a solo flight in a Bristell.

Despite that belief, the student pilot also advised the ATSB that prior to the solo flight on 12 December 2019, they were:

• feeling apprehensive, ‘after only 1 hour of training’ and still getting used to the different controls and trim mechanism
• aware that they hadn’t received any crosswind or stall training
• only going to conduct circuits, instead of navigation practice, as they didn’t feel comfortable flying the Bristell and wanted ‘to get used it more’.

The flight instructor’s recollection from the 11 December 2019 Bristell dual training flight included:

• describing the critical differences between the Vixxen and the Bristell
• the student pilot ‘tended to pitch the aircraft more than necessary’ and the importance of avoiding this was ‘stressed a number of times in the circuit’
• the student pilot ‘tended to allow the speed to drift down’ during landing
• landings were fine but on the touch and go, with full power, tended to pitch up too soon
• the requirement to remind the student not to handle the Bristell like the Vixxen
• their belief that the student pilot ‘definitely was not ready for a solo on that aircraft’.

The instructor reported that they didn’t specifically say the student pilot ‘was not cleared for solo’ flight but ‘they don’t normally do that, it is clear from the debrief’’. In addition, the student pilot was advised of the requirement for stall training on their next flight. Finally, the lesson entry report had been endorsed by the both the instructor and the student, indicative of them having received and understood the post-flight briefing.

Following this accident, a number of procedural changes relating to the conduct of solo flights were implemented (see the section titled Safety action).

Go-around

Whenever landing conditions are not satisfactory, a go-around should be initiated. A go‑around is considered a normal procedure and, although it is not often required, with appropriate training, planning and preparation it should not result in increased risk.

The Federal Aviation Administration publication, The Airplane Flying Handbook, Chapter 8 (pages 12 and 13) provides the following guidance for go-arounds:

Although the need to discontinue a landing may arise at any point in the landing process, the most critical go-around is one started when very close to the ground. The earlier a condition that warrants a go-around is recognized, the safer the go-around/rejected landing is. The go-around maneuver is not inherently dangerous in itself. It becomes dangerous only when delayed unduly or executed improperly…

… Attitude is always critical when close to the ground, and when power is added, a deliberate effort on the part of the pilot is required to keep the nose from pitching up prematurely. The airplane executing a go-around must be maintained in an attitude that permits a buildup of airspeed well beyond the stall point before any effort is made to gain altitude or to execute a turn. Raising the nose too early could result in a stall from which the airplane could not be recovered if the go-around is performed at a low altitude.

The Civil Aviation Safety Authority Flight Instructor Manual (p47) provides the following guidance for instructor on go-arounds:

The following points must be emphasised [by the instructor]:

(iv) That large changes of trim may be experienced during this procedure.

Safety analysis

On the morning of 12 December 2019, a student pilot took off from Moorabbin Airport, Victoria, intending to conduct a series of circuits in a BRM Aero Bristell, registered VH-YVF. After passing the runway threshold during the first approach for a touch and go landing, the student pilot lost control of the aircraft and collided with terrain, on a grassed area alongside the runway.

The analysis discusses the student pilot’s preparation for the flight in the context of the flight school’s requirements, as well as the contributing factors that led to the loss of control and collision with terrain.

Solo flight dispatch procedure

Following completion of an instructional familiarisation flight in the Bristell the day before the accident flight, the student pilot incorrectly believed that they were ‘authorised’ to conduct a solo flight in the aircraft. The flight instructor who conducted the familiarisation flight acknowledged that, while they ‘didn’t specifically say that [the student pilot] was not cleared for solo’, it should have been evident as the student had not conducted any crosswind or stall training in the Bristell. Additionally, the post‑flight briefing, signed by the student, detailed that these required sequences were to be conducted on the next flight.

Further, the student pilot continued with the solo flight, despite reporting they were ‘not comfortable operating’ the new aircraft type. They also advised their belief that, as they were in the ‘command building’ phase of their training, the solo flight procedures were not required. There was no statement to that effect in the Operations Manual. In addition, there was no evidence the student pilot sought to clarify whether or not they were authorised and/or if the solo procedures were required.

Had the solo flight approval procedures been followed, they would have identified that the student pilot had not yet achieved the competencies required for solo flight in the Bristell. More generally, following these procedures would have identified the hazard associated with the crosswind conditions and allowed an assessment of the risk for pilots with limited experience on the aircraft type.

Aircraft handling

The student pilot had undertaken only one supervised training flight in the Bristell aircraft, which did not include any go-arounds, crosswind landings or stall training. Therefore, the student pilot’s familiarity with the aircraft type was very limited.

The Bristell exhibits different handling characteristics to the other aircraft type the student pilot had previously operated. Specifically, instructors reported that it is less docile and has a stronger tendency to pitch up when engine power is applied for a go-around. The instructors also reported that the Bristell has less elevator authority to counter the nose-up effect and a greater tendency to drop a wing (usually the left) during a stall.

During the flare prior to touching down, the student pilot detected the aircraft drifting left of centreline, most likely due to the prevailing crosswind, and elected to commence a go-around. After initiating the go-around, they felt the aircraft forcefully pitch up, a behaviour consistent with instructor’s description. Being unfamiliar with the aircraft type, the student pilot was not adequately prepared for this pitch up tendency and did not anticipate or respond effectively to prevent the aircraft stalling.

Once the aircraft stalled, it entered an incipient left spin. Recognising that recovery from the stall at such a low height may not have been possible, as the student pilot was unfamiliar with the aircraft’s stall behaviour, their capability to prevent further rotation or recover the aircraft prior to the collision with terrain was also very limited.

Findings

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving BRM Aero Bristell, VH-YVF on 12 December 2019.

Contributing factors

• The student pilot did not have the necessary qualifications and skills to safely operate the Bristell solo.
• The required Soar Aviation solo flight dispatch procedures were not followed. As a result, it was not identified that the student pilot was not authorised for, nor met the required competencies, to conduct the flight.
• During the conduct of a go‑around at low level following deviation from the runway centreline, the aircraft aerodynamically stalled and commenced a spin.

Safety actions

Safety action by Soar Aviation

Soar Aviation advised the ATSB that they had implemented revised procedures to ensure an aircraft could not be taken by a student for a solo flight, either deliberately or inadvertently. Aircraft keys were now secured and could only be accessed by an instructor once the procedures had been followed and solo flight was authorised.

Further, the booking system was changed so that operations ‘reserve’ an aircraft for a student and allocated an instructor, with the instructor required to change the reserve booking to the authorised ‘flight lesson’.

Soar Aviation ceased flight training operations on 29 December 2020.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Soar Aviation
• the student pilot
• Civil Aviation Safety Authority
• BRM Aero
• witnesses
• Airservices Australia

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Soar Aviation
• the student pilot
• Civil Aviation Safety Authority
• BRM Aero
• Air Accidents Investigation Institute of the Czech Republic.

Submissions were received from:

• Soar Aviation
• the student pilot
• Civil Aviation Safety Authority.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. An S-LSA is a special light-sport aircraft, where the certification and continuing airworthiness is the responsibility of the manufacturer. The aircraft are manufactured to defined standards, which are then accepted by the regulator.
2. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours. 
3. Runway numbering: the number represents the magnetic heading closest to the runway (runway 17 at Moorabbin Airport is oriented 164° magnetic) and L indicates the left most of two parallel runways.
4. Recreational Aviation Australia (RAAus) administers ultralight, recreational, weight shift microlight and LSA aircraft. RAAus train and certify pilots, flying instructors and maintainers, register their aircraft fleet and oversee a large number of flight training schools across Australia.
5. A ground-adjustable propeller can be adjusted between pre-set limits of coarse and fine pitch, to optimise the aircraft for flying conditions. Following adjustment, only on the ground and when the engine is not running, its operation is similar to a fixed pitch propeller.
6. Soar’s competency grading scale ranged from 5 up to 1, where 2 was the level required before solo flight and 1 was where the student had achieved ‘competency to the standard required for qualification issue’.

The occurrence

On 4 July 2019, while conducting a demonstration flight of an Alauda Airspeeder prototype unmanned aircraft system at Goodwood Aerodrome, United Kingdom (UK), the remote pilot lost control of the aircraft. In response, the pilot activated the safety ‘kill switch’ intended to immediately terminate the flight, but it had no effect.

The unmanned aircraft then climbed, to approximately 8,000 ft and entered controlled airspace at a holding point for flights arriving at Gatwick Airport, before its battery depleted and it fell to the ground. It collided with terrain in a field of crops approximately 40 m from occupied houses, outside of its designated operating area. There were no injuries.

Investigation

The UK Air Accident Investigation Branch (AAIB) investigated this occurrence. As Australia was the State of Manufacture of the aircraft, the AAIB requested appointment of an Accredited Representative from the ATSB.

To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.

Conclusion

The AAIB found that the Alauda Airspeeder Mk II was not designed, built or tested to any recognisable standards and that its design and build quality were poor. In addition, the operator’s operating safety case, which formed the basis for gaining an exemption from the UK Civil Aviation Authority, contained several statements that were shown to be incorrect.

The Civil Aviation Authority’s Unmanned Aircraft Systems unit had assessed the operator’s application and, after clarification and amendment of some aspects, issued an exemption to the Air Navigation Order to allow flights in accordance with the operators Operational Safety Case. The Civil Aviation Authority did not meet the operator or inspect the Alauda Airspeeder Mk II before the accident flight.

There have been many other similar events where control of an unmanned aircraft has been lost, resulting in either it falling to the ground or flying away. The AAIB also identified that, even a small unmanned aircraft falling from a few metres could cause a fatal injury if it struck a person.

The AAIB investigation report made several Safety Recommendations and the final investigation report can be found at www.aaib.gov.uk.

Any further information regarding this investigation should be directed to the AAIB via: enquiries@aaib.gov.uk

_____________

The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the AAIB investigation of the occurrence.

Safety summary

What happened

On 28 May 2019, a Cessna 152, registered VH-JIW, was being operated by Basair Aviation College on a training flight from Archerfield Airport, Queensland. On board was a student pilot on their first flight, and a flight instructor.

During the training flight, the instructor was demonstrating the use of trim, with the student flying the aircraft. At about 2,000 ft above ground level, the aircraft abruptly pitched down and entered into a dive. The instructor took control of the aircraft and recovered from the descent at about 400 ft, about 25 seconds after the dive commenced. Subsequently the flight instructor elected to terminate the lesson and returned the aircraft to Archerfield Airport.

The instructor sustained minor injuries and the student was uninjured. An examination of the aircraft identified significant structural damage to the right horizontal stabiliser, which was indicative of in-flight overload during dive recovery. In addition, the instructor inadvertently bent the throttle control in the cockpit, which made movement of the control stiff but still operable.

What the ATSB found

The ATSB found that the student released the control wheel leading to the aircraft entering into a steep dive. The flight instructor had applied a large amount of nose-down trim during the course of instructing the lesson, resulting in a strong nose-down tendency of the aircraft when the controls were released. The flying school’s instructor guide did not specify a limit of trim input for such exercises.

It was also determined that the instructor’s hands were not in a ready position to take control in the event of any mishandling by the student pilot. The recovery by the instructor was likely further delayed after sustaining a head injury during the in-flight upset, and initially being unsure about what had happened and how to then recover the aircraft.

What has been done as a result

The operator has revised its training procedures for use of trim to include detailed instructor demonstrations prior to the student practicing manoeuvres. This ensures the student understands the required use of trim and the effect it has on the aircraft flight characteristics to maintain flight attitudes. The operator has also revised its training procedures to use a consistent moderate amount of trim.

Safety message

The first stages of flight training can be an exciting yet daunting period for a student. Any uncertainty should be raised with the instructor before taking action in case it leads to an unsafe situation. Conversely, instructors need to account for the potential for the student to carry out unexpected actions. This means that lessons should be conducted under the lowest risk conditions that still impart the lesson intent.

The investigation

The occurrence

On 28 May 2019, at about 1110 Eastern Standard Time,^[1] a Cessna 152 aircraft, registered VH‑JIW and operated by Basair Aviation College, departed Archerfield Airport, Queensland, for a training flight. On board was a student pilot on their first flight, and a flight instructor.

During the flight, the instructor demonstrated a number of manoeuvres from the ‘effects of control’ flight-training syllabus. As part of this, the instructor placed the aircraft out of trim with the pitch trim wheel,^[2] while the student was maintaining straight and level flight.

With the aircraft in a nose-up trim, the student then practiced re-trimming the aircraft for level flight while maintaining attitude using nose-down pressure on the control wheel. As the aircraft was approaching overhead Lagoon Island at about 2,000 ft above ground level, with the student flying, the instructor moved the pitch trim to about two-thirds travel nose down. The student maintained attitude with nose-up pressure on the control wheel. The instructor’s feet were lightly on the rudder pedals, left hand on their leg, and right hand resting on the glareshield (next to the control wheel).

The student maintained straight and level flight for a short period. When the procedure was to return the elevator trim to neutral, the student became confused about the correct procedure and let go of the control wheel. The aircraft rapidly pitched nose-down, rolled left, and entered into a dive. During these events, the flight instructor’s headset dislodged from their head.

The flight instructor took control of the aircraft and subsequently arrested the descent at about 400 ft, about 25 seconds after the descent commenced. The available radar data (Figure 1) showed that from when the dive commenced, to when the instructor regained control, the aircraft had an average rate of descent of over 3,000 ft/minute, with the rate being higher in the initial part of the descent.

Figure 1: VH-JIW’s flight path, dive and recovery as derived from radar data

Source: Google Earth, modified by the ATSB

During the occurrence sequence, the instructor pulled the throttle back quite rapidly and, at some stage during the initial stages of the sequence, the throttle was bent. The throttle then became stiff, however was still able to be moved. The instructor recalled applying right rudder during the recovery but did not fully recollect if that was to recover from a left spiral dive or spin. The instructor stated they did not re-trim the elevator system to a neutral position until after recovery from the dive.

When they had recovered from the dive, the aircraft was on a reciprocal heading. The instructor carried out a flight control function check and confirmed the aircraft was controllable. The instructor then terminated the lesson and advised air traffic control that their aircraft had descended 1,500 ft ‘quite suddenly’ and they were returning to Archerfield Airport. The aircraft landed without further incident at about 1139.

During the occurrence, the instructor sustained several minor injuries, including an injury to their left shin after it contacted the underside of the instrument panel, a head injury from impact with the cabin roof, and bruising to the right hip. The student pilot was uninjured. The aircraft sustained damage to the right horizontal stabiliser.

Context

Personnel information

The instructor pilot held a grade 3 instructor rating and had about 320 total flight hours, including 100 hours in Cessna 152 aircraft. They had instructed this lesson about seven times before this occurrence.

The student pilot was conducting their first flight.

Pitch trim system

The pitch trim system on VH-JIW consisted of a manual trim wheel located on the lower instrument panel, which controlled a full-span trim tab on the right elevator only.

Placing the aircraft in an out-of-trim condition places a load on the flight control surfaces that results in the aircraft changing attitude accordingly, if the pilot does not oppose the condition. The flight controls will have a ‘heavy’ feel to them when held against the trimmed attitude. This force is neutralised when the aircraft is either re-trimmed or allowed to adopt the trimmed attitude.

Aircraft damage

A post-flight inspection of the aircraft found that the right horizontal stabiliser was bent and twisted during the occurrence, resulting in creasing on the upper and lower skin sections (Figure 2). The left horizontal stabiliser had no significant damage.

Figure 2: Right stabiliser damage

Source: Operator, annotated by the ATSB

The deformation of the right stabiliser resulted in a number of rivets on the aft lower surface pulling through the skin. The internal structure was cracked and creased (Figure). There was no evidence of damage to attachment points of the stabiliser assembly.

Figure 3: Leading edge removed showing cracking to internal structure

Source: ATSB and Cessna, annotated by the ATSB

An ATSB examination of the right horizontal stabiliser did not identify evidence of pre-existing damage to the structure.

In addition to the bent throttle control, the aircraft compass had detached from its mount on the windscreen.

Meteorological information

The aerodrome forecast (TAF) for Archerfield Airport issued at 0907 on 28 April stated that conditions would be CAVOK (cloud and visibility ok and no significant weather phenomena). The forecast wind was 260° at 10 kt. Recorded weather conditions at 1130 were consistent with the forecast. The area forecast also did not show any adverse weather conditions, such as turbulence, that may have contributed to the aircraft experiencing a rapid change of direction or altitude.

Flight instructor guidance

The flight training school’s instructor guide outlined the procedure for teaching the use of the trim component of the effects of controls lesson. This procedure was in accordance with the guidance provided by the Civil Aviation Safety Authority in Appendix D of Civil Aviation Advisory Publication (CAAP) 5.14-2 (Flight instructor training (Aeroplane)).

The guidance stated that, with the student flying straight and level, the instructor would place the aircraft out of trim. The student then re-trimmed the aircraft to relieve the load on the controls. This was then repeated in the opposite direction of trim travel.

The CASA CAAP referred to the Federal Aviation Administration (FAA) Aviation Instructor’s Handbook, which stated:

Flight instructors should always guard the controls and be prepared to take control of the aircraft.

Safety analysis

Use of trim

When the student released the controls without re-trimming the aircraft, the aircraft entered a sudden dive. Since the flying school operator’s instructor guide did not include a limit to the amount of trim used during the ‘effects of control’ lesson, flight instructors could set the trim to differing amounts. On the occurrence flight, it had been set at about two-thirds nose-down travel. This amount meant that the aircraft’s nose-down response was more abrupt and stronger than needed to convey the intent of the lesson.

Instructor hand position

During the exercise, the instructor’s right hand was resting on the glareshield; this was not an optimal position to guard the controls and to be ready to react to any adverse student inputs. This, coupled with the suddenness of the movement and the instructor’s injuries, and being unsure as to the cause of the dive and best recovery technique, likely led to a delay in taking control of the aircraft and its subsequent recovery.

Dive recovery

The instructor attempted to regain control of the aircraft before placing the elevator trim into a neutral position, leading to the aerodynamic force being concentrated on the right horizontal stabiliser (where the trim tab was located) rather than spread across both stabilisers during the dive recovery.

These asymmetric flight loads, induced by the elevator trim imparting additional load on the right side, twisted the stabiliser at the forward outboard tip, about 30 mm downwards relative to its original position. This likely resulted in the right stabiliser being close to total failure. The large amount of nose-down trim at the time of the upset also increased the effort and effect required to recover from the dive.

Findings

From the evidence available, the following findings are made with respect to the loss of control of Cessna 152, registered VH-JIW, which occurred near Archerfield Airport, Queensland on 28 May 2019.

Contributing factors

• In the course of the student pilot’s first training flight, during a lesson in the effects of control, the student released control wheel backpressure suddenly.
• The instructor’s use of a large amount of nose-down elevator trim for the lesson increased the effect when the student released backpressure on the elevator, leading to a sudden nose-down pitch change and subsequent entry into a dive.
• The instructor was not prepared for the sudden nose-down pitch change, leading to a delay in the recovery from the dive.

Other factors that increased risk

• During the recovery from the dive, the horizontal stabiliser experienced excessive asymmetric flight loads, resulting in bending and buckling of the right horizontal stabiliser structure.

Safety action

The operator proactively revised its instructor guide for the use of trim. The new procedure introduced placing the aircraft into a cruise climb and explaining how the use of trim can reduce the control load. This ensured the student understood the required use of trim and the effect it had on the aircraft flight characteristics to maintain flight attitudes.

The revised instructor guide also included detailed instructor demonstrations prior to the student practicing the manoeuvre. The new procedure was taught with the aircraft in a nose-up condition only and ensured that all instructors were using the same trim input to maintain the best rate of climb.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Basair Aviation College
• instructor and student pilot
• Airservices Australia
• Bureau of Meteorology.

References

Civil Aviation Safety Authority March 2012, Civil Aviation Advisory Publication CAAP 5.14-2(0) Flight Instructor Training (Aeroplane).

United States Department of Transportation, Federal Aviation Administration 2008, FAA-H-8083-9, Aviation Instructor’s Handbook.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight instructor
• the student pilot
• Basair Aviation College
• Civil Aviation Safety Authority.

Submissions were received from:

• the flight instructor
• Basair Aviation College.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time: Coordinated Universal Time (UTC) +10 hours
2. The aircraft’s pitch trim system is utilised to relieve flight loads on the control wheel at a given attitude.

Safety summary

What happened

On 14 April 2019, the pilot of a Pilatus PC-12/47E aircraft, registered VH-OWJ and operated by Royal Flying Doctor Service - Western Operations (RFDS), was conducting a medical transport flight under instrument flight rules from Merredin to Jandakot within Western Australia. A RFDS aeromedical crew consisting of a flight nurse and doctor were on board with a non-critical patient who was being transferred to a hospital in Perth. For the midnight departure, there were almost clear skies with minimal ambient and celestial lighting.

About 1.5 minutes after take-off, ‘Pitch Trim Runaway’ warnings activated and the pitch trim continued to move nose-down without any pilot or autopilot inputs. The pilot initiated the applicable emergency procedure but inadvertently selected the Flap Interrupt switch rather than the Trim Interrupt switch. Consequently (before the next checklist item was actioned), the pitch trim continued to runaway until it reached full nose-down with associated serious control difficulties.

The pilot did not identify the mis-selection and continued to address the emergency procedure without resolving the full out-of-trim condition. With the assistance of the doctor seated in row 2, the pilot managed to return to Merredin for a flapless landing. The aircraft was undamaged and the occupants uninjured.

What the ATSB found

The ATSB found that the pitch trim runaway occurred because of a malfunctioning relay in the manual (main pilot-engaged) stabiliser trim system.

As the (uninterrupted) pitch trim runaway progressed, the reinforcing cycle of increasing control loads, forced descent, and increasing airspeed was initially exacerbated by high engine torque. The airspeed reached 210 kts with increased risk of descent into terrain before the pilot reduced engine torque and airspeed to partially alleviate the control loads and arrest the descent.

After the pilot addressed items 2 and 3 of the emergency procedure, the malfunction was neutralised and the alternate stabiliser trim system was available to adjust the trim. However, the pilot did not identify those positive conditions and continued with items 4 to 8 of the procedure, which disabled the alternate stabiliser trim system, prevented pitch trim adjustment and prolonged the serious control difficulties.

The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches, unnecessarily increased the risk of mis-selection and contributed to the excessive out-of-trim condition.

The ATSB found that the emergency procedures and systems information in the PC-12 Pilot Operating Handbook/Airplane Flight Manual and Quick Reference Handbook did not provide effective guidance or sufficient information for pilots contending with a pitch trim runaway. If the pilot selects the Trim Interrupt switch early in the sequence and does not need to adjust the pitch trim, the risk is not significant. In this incident, the lack of effective guidance and systems information probably had an adverse influence on the pilot’s capability to resolve the uninterrupted trim runaway condition and was a critical factor.

As a factor that increased risk, the effectiveness of RFDS training and checking processes for pitch trim runaway was undermined by incomplete systems knowledge and unrealistic practice exercises associated with training/checking in the aircraft (non-simulator).

What's been done as a result

Pilatus advised that a design change, to reduce the likelihood of a trim runaway, was developed before the occurrence to replace the mechanical pitch trim relays with solid-state relays but was not fully implemented due to limited parts availability. Both applicable service bulletins have now been published.

Pilatus also advised that the probability of erroneous activation of the Flap Interrupt switch instead of the Trim Interrupt switch has been reduced by the publication and active distribution of a Safety Information Letter (SIL-003) to all customers, operators and service centres. This includes a reminder of procedures when encountering a trim runaway condition.

The ATSB acknowledge these positive safety actions but notes that the Trim interrupt and Flap Interrupt switches on the PC-12 do remain identical and co-located, and there is potential for engineering controls to eliminate the mis-selection of the interrupt switches.

RFDS investigated the occurrence and implemented safety action such as increasing pilot awareness about the pitch trim systems and enhancements to their related training and checking processes.

Safety message

The ATSB advises operators of PC-12 aircraft to review their training/checking processes related to the pitch trim system to ensure that pilots are adequately prepared to manage a runaway emergency. More generally, operators and pilots are advised to enhance awareness of expected system behaviour from switch and other control selections.

For flight control emergencies such as out-of-trim conditions, there is an imperative to maintain control while resolving the technical problem. A critical factor for pilots to consider is control of airspeed and associated engine power. 

Operators are encouraged to submit reports of PC-12 pitch trim defects to the Defect Reporting Service to facilitate the Civil Aviation Safety Authority’s monitoring of continuing airworthiness data.

The occurrence

Background

On 13 April 2019, a pilot employed by Royal Flying Doctor Service - Western Operations (RFDS) based at Kalgoorlie, Western Australia was rostered for a night standby duty between 1800 and 0600 Western Standard Time (WST). Soon after starting duty, the pilot and rostered medical crew was tasked to transfer a patient from Kalgoorlie and a patient from Albany to Jandakot within Western Australia. After consideration of the weather forecasts and medical status of the respective patients, the decision was made to proceed direct to Jandakot then conduct a flight to Albany and return, followed by a positioning flight to Kalgoorlie.

For this series of flights, the pilot was operating a Pilatus Aircraft Ltd. PC-12/47E aircraft, registered VH-OWJ, as a medical transport flight in the aerial work category under the instrument flight rules. At 2032, the pilot departed Kalgoorlie with a patient, flight nurse and doctor on board.

During the flight to Jandakot, the RFDS operations centre advised the pilot and medical crew of a patient at Merredin that required transfer to Jandakot as a higher medical priority than the Albany patient. For on-board patient care reasons, the flight continued as planned to Jandakot, landing at 2213. The pilot and medical crew were then re-tasked to conduct a flight to Merredin for the previously advised patient transfer.

The pilot departed Jandakot at 2253 and landed at Merredin aeroplane landing area (ALA) at 2341. This flight was described as normal except for diversions around storm cells that added 15 minutes to the planned flight time. The weather observed at Merredin was almost clear skies with a few scattered clouds to the south of the aerodrome and light winds.

Just after midnight, the pilot taxied the aircraft for runway 28 at Merredin ALA with the patient, flight nurse, and doctor on board. The pilot was seated in the front left control seat and the doctor was seated in the second row on the right, facing backwards.

The pilot conducted a normal take-off and was airborne at 0008:34. For the departure, the pilot was manually flying with the intention to engage the autopilot when the aircraft was established in the climb. As was typical for the phase of flight, the pilot was intermittently engaging the trim switches on the control wheel to make pitch trim adjustments. There was minimal ambient and celestial lighting for the departure.

Emergency condition and initial pilot response

At 0010:05 (about 1.5 minutes after becoming airborne), as the aircraft was on climb through 2,700 ft AMSL (1,400 ft above ground level)^[1] at a (calibrated) airspeed^[2] of 140 kt, the following occurred without any apparent precursors:

• master warning light illumination
• ‘pitch trim runaway’ voice annunciation
• ‘pitch trim runaway’ warning message in red on the multi-function display
• continued pitch trim movement in a nose down direction without pilot or autopilot input at the time (uncommanded).

The pilot recalled hearing and seeing those warnings and that the aircraft pitched nose-down violently shortly afterwards. With both hands pulling on the control column to raise the nose, the pilot found that the force required to move the control column was extremely high and required maximum effort. The pilot was unable to counteract the nose-down force and the aircraft developed a high rate of descent at approximately 2,000 ft/min.

In response to the warnings, the pilot initiated the Pitch Trim Runaway emergency procedure from memory. The pilot recalled that:

• The first action was to select the Trim Interrupt switch on the centre console from NORM (normal) to INTR (interrupt). At the time, the pilot believed that this was carried out and that it was difficult to reach because of the high control column loads. (A ‘Flaps Caution’ was recorded at 0010:11, 6 seconds after the initial trim warning. This caution is consistent with operation of the Flap Interrupt switch instead of the Trim Interrupt and was not noticed by the pilot at the time.)
• After a short interval to focus on raising the nose, the pilot pulled the Pitch Trim circuit breaker on the essential bus to the OPEN position. (An Autopilot Fail Advisory was recorded at 0010:39, 34 seconds after the initial trim warning. This was coincident with cancellation of Pitch Trim Runaway warning and consistent with opening of circuit breaker)
• The Trim Interrupt switch was selected back to NORM. (Based on the first action, this was probably the Flap Interrupt switch.)

Following those actions, the pilot was concerned that there was no change to the condition of the aircraft. This was contrary to the pilot’s expectations from training, which was that the Trim Interrupt switch should have stopped the dive and the opened circuit breaker should have relieved the situation. (Either or both actions would stop the manual trim motor from further operation but would not relieve the control loads existing at the time this action was taken.)

According to the recorded data, the pitch trim continued to operate in the runaway condition until it reached full nose down position 16 seconds after the warnings were issued. During that 16‑second period, the following data was recorded (see the indicative flight data plot in Figure 1):

• engine torque remained at the take-off and initial climb setting of 42 lb (black trace)
• pitch attitude went from +9.5 degrees (nose-up) down to -7.5 degrees (purple trace)
• airspeed increased from 135 kt to 182 kt (red trace)
• altitude initially continued to climb until 3,000 ft then reduced to 2,600 ft (green trace).

Over the next 6 seconds, the situation continued to deteriorate until the pilot reduced engine torque. At about that point, the airspeed had reached 210 kt and the altitude was down to 2,400 ft. The pilot recalled that the control forces eased somewhat following reduction of engine torque.

During the next 2 minutes, the pilot managed initially to raise the pitch attitude to 12 degrees, arrest the descent at 2,000 ft and climb to 2,700 ft, while reducing the airspeed to 125 kt. However, this was momentary as the pitch attitude cycled down to -3 degrees then back to 12 degrees with corresponding descent/climb and airspeed increase/decrease.

Figure 1: Indicative data plot showing key aircraft parameters before, during, and in the 2 minutes after the active phase (yellow band) of the pitch trim runaway.

Parameter scales not shown but are available in Figure 3.

Source: ATSB

Continuation of emergency condition and return to Merredin

By the end of that 2-minute sequence, the pilot was making a slow left turn to return to Merredin ALA and the master caution and pitch trim runaway warning activated for a short period (coincident with cancellation of the autopilot fail advisory). It is not clear from the pilot’s recollection why that occurred but it is consistent with the closing and reopening the pitch trim circuit breaker.

The pilot continued to experience severe control difficulties with another sequence of pitch attitude down to -7.5 degrees and back up to 8 degrees. The aircraft descended to a minimum altitude of 1,700 ft (400 ft above ground level) and reached a maximum airspeed of 180 kt (Figure 3).

After this sequence, the pilot decided that it was not possible to overpower the elevator force alone and requested the assistance of the doctor seated in the adjacent row. The doctor turned in the seat, reached into the cockpit, and pulled on the right control column. This had a positive effect on the variation of pitch attitude and associated airspeed and altitude parameters, although full control was not established.

At this point, the pilot continued with the Pitch Trim Runaway procedure from memory and sought to select the Trim Interrupt switch to INTR again and pulled the Alternate Trim circuit breaker. The pilot then pushed the Alternate Stab Trim switch intermittently, which appeared to have no effect in relieving elevator pressure. (At about this time the master caution and pitch trim runaway warning activated again for a short period, coincident with cancellation of the autopilot fail advisory and consistent with the closing then reopening the Pitch Trim circuit breaker).

As the aircraft was now in the Merredin circuit area, the pilot’s attention was on preparation for landing. When the flaps were selected to 15 degrees, the pilot noticed the ‘Flap’ caution on the crew alerting system (CAS) and realised the flaps were not available.

On the downwind circuit leg for runway 28, the pilot extended the landing gear. This was followed by a rapid descent from 2,150 ft to 1,650 ft (350 ft AGL) with a ground proximity warning system (GPWS) alert (Figure 2). In response, the pilot (with the doctor’s continuing assistance) pulled on the control column to raise the nose, and increased engine torque. Altitude was recovered to a maximum of 2,200 ft.

The pilot turned onto the base circuit leg and allowed the aircraft to descend. As the pilot turned onto the final approach, the aircraft overshot the runway centreline and required adjustment. On short final, the aircraft was high and the pilot was coordinating with the doctor to adjust the pitch attitude for landing. At one point, the pitch attitude was too high and activated the aural stall warning.

At about 30 ft above the runway, the pilot asked the doctor to let go of the control column and reduced engine torque to idle. The aircraft touched down firmly at 0017:15 and the pilot applied full reverse thrust and normal braking to bring the aircraft to a stop about 200 m from the end of the runway. The pilot taxied the aircraft to the parking area and shut down.

The RFDS operations centre dispatched an aircraft to Merredin to transfer the patient and RFDS personnel to Jandakot.

Figure 2: Aircraft track and vertical profile

Source: Google earth, annotated by ATSB

Post-occurrence examination and rectification

RFDS maintenance engineers travelled to Merredin to inspect the aircraft, download data, and remove the lightweight data recorder (LDR) for the ATSB. The engineers reported that the:

• pitch trim was in the full nose-down position (leading edge of adjustable stabiliser fully up)
• Trim Interrupt switch was selected to NORM
• Flap Interrupt switch was selected to NORM
• Pitch Trim circuit breaker was closed (pushed in)
• Pitch Trim Alternate circuit breaker was open (pulled out)
• other switches and circuit breakers were in normal positions.

The engineers secured a copy of the aircraft condition monitoring system (ACMS) and fault history database (FHDB) files for analysis by system technical specialists and provision to the ATSB. The LDR was removed and dispatched to the ATSB laboratory in Canberra where cockpit voice and flight data was recovered and analysed. A flight data plot for the complete flight follows as Figure 3.

When the aircraft was powered up, the Pitch Trim Runaway warning was immediately active. When the Trim Interrupt switch was selected to INTR, it cleared the warning and stopped the trim from operating. Based on the FHDB fault codes and continuing Pitch Trim Runaway warning, the technical specialists advised that the troubleshooting focused on the relays in the left relay panel.

RFDS maintenance engineers found that the manual pitch trim DOWN relay (identification number K161E2) had malfunctioned in a mode consistent with contacts that were stuck closed rather than being open (as would be expected with the coil de-energised). This relay was replaced and applicable operational and functional tests carried out with no further defects identified. The aircraft was certified as serviceable and flown back to Jandakot Airport without incident.

The ATSB notes that based on recorded data, for the last part of the occurrence flight, both the Pitch Trim circuit breaker and Pitch Trim Alternate circuit breaker remained open. Based on correlated parameters in the recorded data, the Pitch Trim circuit breaker was then closed when the aircraft was subsequently powered up on the ground by the pilot.

From other correlated parameters in the recorded data, the Trim Interrupt switch was not selected to INTR at any time during the flight.

Figure 3: Recorded data plot for complete flight showing the key parameters and active phase (yellow band) of the pitch trim runaway with start of doctor assistance (blue line).

Source: ATSB

__________

1. Merredin ALA is at an elevation of 1,300 ft above mean sea level (AMSL).
2. Calibrated airspeed (CAS) is the indicated airspeed corrected for instrument error.

Context

Pilot information

The pilot held a commercial pilot licence with aeroplane category rating, an instrument rating with multi-engine aeroplane endorsement, and a Flight Instructor Rating. On application to RFDS in May 2018, the pilot’s total aeronautical experience was 1,587 hours. This included 1,370 hours as pilot in command, 384 hours multi-engine (Piper PA-31 Navajo and PA-34 Seneca), and 154 hours instrument flight time.

After joining RFDS in July 2018, the pilot received the specified training and assessment for a new pilot without prior PC-12 or similar aircraft type operating experience. This included:

• Pilot induction training – including use of flight check system
• Ground school - PC-12/47E (NG) Engineering Course
• Human Factors and Non-Technical Skills Refresher Course
• Flight training with flight review in PC-12/47E aircraft
• Line Oriented Flight Training (medical transport flights with supervisory pilot)
• Instrument Proficiency Check
• Check-to-line assessment – passed in September 2018.

Training and check records indicate that the pilot progressed without any significant difficulties. The training/check pilot who approved the pilot for line operations recommended that, due to the pilot’s relatively low experience level, a follow-up check be conducted earlier than the required 6 months.

During the first three months of PC-12 operation as a line pilot, the pilot inadvertently exceeded an engine limit on take-off, and extended the landing gear above the maximum landing gear operating airspeed. RFDS investigated the landing gear exceedance and found that the pilot accepted an amended route, was then high on approach, and checked the airspeed, but did not recognise the high speed before extending the gear. As recommended, the pilot was debriefed/counselled with plans to simulate a similar scenario at the next check.

In February 2019, the RFDS Head of Training and Checking (HOTAC) conducted a Progress Check with the pilot during daylight in visual meteorological conditions. This included a pitch trim runaway scenario after take-off that required the pilot to carry out the emergency procedure. The HOTAC advised that the pilot’s response was in accordance with the Pilatus PC-12 Quick Reference Handbook (QRH). There was no record of a specific scenario similar to the landing gear exceedance. The overall assessment was satisfactory/competent and the pilot continued as a PC‑12 line pilot for the next two months until the occurrence.

At the time of the occurrence, the pilot’s total aeronautical experience was 2,108 hours including 521 hours on the PC-12/47E aircraft type. The pilot held a Class 1 medical certificate valid until February 2020.

Aircraft information

The PC-12/47E is a large single-engine turboprop pressurised aircraft designed and built by Pilatus Aircraft Ltd in Switzerland. This aircraft was manufactured as serial number 1411 in July 2013 and registered VH-OWJ in October 2013. At the time of the occurrence, the total time in service was recorded as 7,377 hours.

The aircraft was maintained by the CASA-approved RFDS maintenance organisation in accordance with an authorised system of maintenance based on the Pilatus Progressive Inspection Phases. At the time of the occurrence, a maintenance release^[3] was in effect for the aircraft.

The most recent scheduled maintenance was a Progressive Mini Inspection completed on 28 March 2019 at 7,311 hours’ total time in service. This included a functional check of the Trim Interrupt switch, Alternate Stabiliser Trim switch and runaway aural warning system. No defects were recorded.

There were no significant deferred defects or line maintenance recorded before the occurrence. The pilot who operated the aircraft on the previous shift earlier that day did not record any issues with the aircraft.

PC-12 flight control systems

Pitch trim system

The primary flight controls—aileron, elevator and rudder—are actuated through a conventional system of push-pull rods and carbon steel cables. Each primary control is equipped with an electrically operated (DC) trim system to alleviate the variable aerodynamic loads transmitted by the control system. A visual indication of trim position is displayed to the pilot on the multi-function display (see Pitch trim runaway warnings).

For pitch trim (nose up/down, related to elevator control loads), the leading edge of the ‘T-tail’ horizontal stabiliser is moved up and down through a defined range by an actuator. This actuator contains two separate electric motors that operate independently according to three different control inputs. The ATSB developed a schematic diagram of the three pitch trim power circuits (Appendix A). Refer to Figure 4 for trim system features.

One of those trim motors—manual stabiliser trim motor—provides the primary means for the pilot or copilot to adjust the pitch trim. When the pilot selects the pilot trim engage switch and trim up/down switch on the control wheel simultaneously, the trim control circuit energises the up or down pitch trim relay.^[4] That connects power from the Essential Bus and Pitch Trim circuit breaker through the applicable relay contacts to the manual stabiliser trim motor then circuit to earth via the de-energised relay.

In normal operation, trim movement will cease once the pilot releases the switches. However, in this occurrence, the pitch trim down relay stuck closed and continued to provide power to the manual stabiliser trim motor until the pitch trim circuit breaker was opened.

The other trim motor—alternate stabiliser trim motor—is utilised by either the autopilot or the alternate stabiliser trim switch (labelled as ‘Alternate Stab Trim’). When the autopilot is controlling the pitch trim, the auto drive circuit (from the Modular Avionics Unit) energises the up or down auto pitch trim relay in the Trim Adapter. That connects power from the Essential Bus and Pitch Trim circuit breaker through the respective relay contacts (and auto pitch trim engage relay) to the alternate stabiliser trim motor then circuit to earth via the relays.

The Alternate Stab Trim switch is located on the front centre console. When the autopilot is disengaged, selection of the switch to the nose up or down position provided power from the Main Bus and Pitch Trim Alternate circuit breaker (through the de‑energised auto pitch trim engage relay in the Trim Adapter) to the alternate stabiliser trim motor.

All of the trim power circuits (including rudder and aileron trim) were routed through a ‘Trim Interrupt’ switch located on the front centre console. When this switch was in the default position of NORM (normal), it closed the circuit between the various circuit breakers and related components in each system to allow normal operation. If this switch was selected to INTR (interrupt), it opened every trim power circuit simultaneously and prevented all trim operation until the switch was returned to NORM. (This switch was guarded with a clear perspex cover. All switch labels were backlit).

The ATSB highlights that although the autopilot trim system utilises the alternate stabiliser trim motor, it is powered from the same source as the manual trim system (Pitch Trim circuit breaker) rather than the power source for alternate stabiliser trim (Pitch Trim Alternate circuit breaker). This detail was not explicitly covered in the PC-12 Pilot’s Operating Handbook and Airplane Flight Manual (POH/AFM) and RFDS pilots advised they were not aware of that design characteristic. As discussed in Safety analysis, this had a subtle effect on training/checking practices and interpretation of the pitch trim runaway emergency procedure.

A representative of Honeywell Aerospace, the designer and provider of in-service support for the pitch trim system, advised the ATSB that there was no documented instance of a runaway attributed to the alternate stabiliser trim circuit (Appendix A – blue lines).

Figure 4: Pilatus PC-12/47E trim system features

Source: Pilatus and ATSB

Pitch trim runaway warnings

The pitch trim system monitored the power and control circuits for both trim motors and detected when there was power applied but no corresponding manual trim engagement, autopilot trim drive signals, or alternate stabiliser trim command. In any of those cases, the crew alerting system (CAS) produced the following effects:

• master warning or caution light illuminated
• ‘Trim Runaway’ aural alert
• ‘Pitch Trim Runaway’ message displayed in the CAS window of the systems multi-function display (Figure 5).

Once the master warning or caution is acknowledged, the aural alert is cancelled but the message continues to display while the out-of-limit condition such as a trim runaway is operative. In the case of a malfunctioning relay in the manual trim system (such as this occurrence), the message will disappear if any of the following actions are carried out:

1. Manual trim engage switch on control wheel is activated
2. Trim Interrupt switch is selected to INTR
3. Pitch Trim circuit breaker is pulled open.

The ATSB notes that conditions 2 and 3 will cancel the message and stop a related runaway but condition 1 will only cancel the message without any effect on a runaway condition. The recorded data showed that the pitch trim runaway warning was cancelled and reactivated three times in the 32-second period after the initial warning. This was consistent with the pilot attempting to use the manual trim, which was ineffective in resolving the runaway.

Figure 5: Sample multi-function display showing acknowledged CAS messages

Source: Pilatus

Wing flaps

The wing flap system is electrically actuated and controlled by a selector handle on the centre console to the right of the engine control quadrant. Located forward of the flap selector handle is a Flap Interrupt switch (Figure 4) that disables normal operation of the flap system and generates a ‘Flap’ caution message on the CAS if the switch is selected to INTR. Irrespective of subsequent switch selections, the flaps will not operate until reset on the ground.

In this occurrence, there was evidence from flight data of power being removed from the flap system at the beginning of the initial 16-second trim runaway event, consistent with the operation of the Flap Interrupt switch (see Figure 3 - dark blue trace coded as Flap Controller Fail).

Pilatus advised the ATSB that the Flap Interrupt switch was utilised in the original PC-12 wing flap design as part of the alternate flap switch circuit that allowed the pilot to correct a flap asymmetry. In the PC‑12/47E model, there is no pilot access to the alternate flap switch and no requirement for the pilot to operate the remaining Flap Interrupt switch.

The ATSB notes that, as can be seen in Figure 4 (bottom right), the Flap Interrupt switch and Trim Interrupt switch appear to be the same type of switch and are located on the same panel, either side of the Alternate Stab Trim switch (refer to the following Safety analysis section).

Aircraft operating procedures – Pilatus

Pilot’s Operating Handbook and Quick Reference Handbook

The primary reference for operation of the PC-12/47E is the Pilot’s Operating Handbook and EASA Approved Airplane Flight Manual (POH/AFM) produced by Pilatus. In Section 3 Emergency Procedures, the general comments include the following guidance:

Some situations require rapid action, leaving little time to consult the emergency procedures. Prior knowledge of these procedures and a good understanding of the aircraft system is a prerequisite for safe aircraft handling.

The emergency procedures included a sequential list of action items in case of a pitch trim runaway. These procedures were also presented in the Quick Reference Handbook Emergency Procedures (QRH) booklet produced by Pilatus and available in the cockpit for the pilot to consult as required and as circumstances permitted (Figure 6).

Figure 6: Quick Reference Handbook Emergency Procedures – Pitch Trim Runaway

Source: Pilatus

Pilots could also select this procedure as one of the electronic emergency checklists on the multi-function display. This operation required a number of button pushes to select the checklist and scroll through the items. RFDS did not advocate use of this feature and that practice was not a factor in this occurrence.

Pilatus advised that if item 1 of the procedure was carried out immediately following a pitch trim runway warning, the control forces would be acceptable and the pilot would be able to perform the subsequent actions without acute stress.

The ATSB noted that in the scenario where items 1-3 would neutralise a pitch trim runaway condition, the subsequent control forces experienced by the pilot could be uncomfortably high due to timing of the trim interrupt or changes to phase of flight and/or aircraft configuration. If that occurs, the pilot can only adjust pitch trim using the alternate stabiliser trim. The procedure, however, did not communicate that clearly and specified alternate stabiliser trim as item 8.

It should also be noted that item 8 will not be effective if the complete procedure is actioned in numerical sequence. In that case, action in accordance with item 5 to open the Pitch Trim Alternate circuit breaker disconnects power from the alternate stabiliser pitch trim circuit. As the pilot in this occurrence found, any subsequent attempts to use the alternate stabiliser trim switch in accordance with item 8 will be futile.

Supplementary information

In February 2017, Pilatus issued Safety Information Letter (SIL) 003 to all customers, operators and service centres as an ‘Important reminder of procedures and operations of PC-12 (all models) when encountering a trim runaway condition.’ For reference, a copy of this letter is at Appendix B.

Some points from the letter that are relevant to this occurrence:

In the case of a trim runaway condition, as an immediate action, activate the guarded “Trim Interrupt” switch (refer to POH Section 3).

Hands-on training reduces the activation time and minimizes the risk of erroneously activating the “Flaps Interrupt” system switch (which cannot be reset in-flight).

By pulling its associated Circuit Breaker (CB), the affected trim motor will be isolated before the pilot can attempt to regain control of the unaffected systems (refer to POH Section 3).

To regain control of the unaffected systems, simply reposition the “Trim Interrupt” switch to NORM (refer to POH Section 3).

A reduction in airspeed will significantly reduce the existing out-of-trim forces and will help the pilot regain full control of the aircraft (refer to POH Section 3).

The PC-12 trim system is designed to assure that the pilot does not have to counteract continuous or excessive control forces after encountering a trim runaway. In case of a runaway on one of the pitch trim motors, the remaining one can be used to regain normal control forces.

Pilatus advised the ATSB that RFDS confirmed receipt of the transmittal notice for SIL-003 on 7 March 2017. Since then, the SIL has been listed as one of the additional technical information items on the Pilatus document portal accessible to RFDS. Pilatus noted that the SIL is also publically available on their website.

The ATSB notes that RFDS did not have a record of having received or formally considered the operational implications of this letter. One of the training/check pilots recalled the letter and advised that RFDS incorporated the pitch trim runaway response from the QRH into check flights. The content of the letter and potential effect in this occurrence is considered in the following Safety analysis section.

Normal procedures

As part of the POH/AFM Normal Procedures section, the daily Pre Flight checklist included items to confirm that the Trim Interrupt and Flap Interrupt switches were in the NORM/GUARDED positions. These were visual checks that did not involve operation of the switches. RFDS normal procedures were consistent with the POH/AFM.

For PC-12 aircraft operated under Transport Canada airworthiness approval, Pilatus specified a daily check of the pitch trim interrupt system in the ‘Before Starting Engine Procedure’. This originated in 1997 as part of the aircraft certification review process by Transport Canada. Transport Canada considered that the trim interrupt system was the sole means of disconnection for an uncommanded runaway and the system failure analysis did not take into account all of the factors. Pilatus responded by including a periodic check of the trim interrupt function in airworthiness limitations and integrating the daily check into the Canadian-specific POH/AFM.

Aircraft operating procedures – RFDS

The RFDS Operations Manual specified general aircraft operating procedures and PC-12 operating procedures. As a general principle, RFDS required pilots to comply with all requirements, instructions, procedures, or limitations in the applicable POH/AFM and QRH.

In an emergency, pilots were required to action the defined recall items from memory and then refer to the appropriate written procedures for confirmation. The subsequent actions were then to be actioned/confirmed as necessary and any notes/warnings reviewed. It was acknowledged that in some circumstances, pilots might need to continue subsequent actions from memory.

The pilot advised that the physical demands of counteracting the serious out-of-trim condition did not allow for review of the procedure in the QRH booklet. In context, this was an unavoidable constraint of single-pilot operation and was not considered to be a factor in the occurrence.

From March 2019 onwards, the RFDS PC-12 operating procedures nominated the first four items of the Pitch Trim Runaway procedure as recall items. These items were recorded in the operations manual and were the same as the POH/AFM and QRH except for item 3 which incorporated a conditional phrase:

3. TRIM INTERRUPT switch if trim runaway continues … NORM

In the POH/AFM and QRH, this conditional followed item 3 and applied to item 4 onwards rather than item 3.

Item 3, as presented by RFDS, could be interpreted to mean that the power to the trim systems was only to be reinstated if the trim runaway continued. However, the trim runaway could not continue without the reinstatement of power through the Trim Interrupt switch (and almost certainly the Pitch Trim circuit breaker), so the phrasing was nonsensical. In the context that the trim interrupt remained in NORM, and the POH/AFM/QRH procedures were primary references, it is unlikely that the procedural inconsistency had any effect on this occurrence.

RFDS advised that the recall items for emergency procedures had recently been added to their PC-12 operating procedures as an update to reflect current practices. They were aware that the RFDS pitch trim runaway procedures varied from the POH/AFM and QRH as a result of inaccurate transcription but this had not been communicated to pilots. This was corrected after the occurrence.

Pilot training and checking – RFDS

Training and checking framework

RFDS held a Civil Aviation Safety Regulation (CASR) Part 141 certificate and operated a CASA‑approved Training and Checking organisation under Civil Aviation Regulation (CAR) 217. The Part 141 certificate authorised RFDS to conduct the required class rating flight training and flight review to qualify pilots for the PC-12 aircraft type. (RFDS referred to this as conversion training.) The CAR 217 approval authorised RFDS to conduct recurrent training and checking including regular operator proficiency checks (OPCs).

The first stage of the RFDS PC-12/47E ‘conversion training’ was a 6-day ground school facilitated by an experienced PC-12 instructor in accordance with a Facilitators Guide. Reference material included the POH/AFM, QRH, engineering training manual, PowerPoint presentations, videos, cockpit mock-up, components, and an aircraft. Information about the pitch trim system was available from the POH/AFM and a guided inspection of an aircraft. Learning assessments were carried out during and at the end of the course.

The second stage of PC-12/47E conversion training was flight training in the aircraft in accordance with a flight training syllabus. This was usually carried out over 5 flights and approximately 12 flight hours. The syllabus included review of CAS warnings/cautions such as Pitch Trim Runaway and use of the QRH. A flight review was incorporated into this training.

Following conversion training, pilots completed 50-100 hours of line oriented flight training (LOFT) with a training/check pilot or supervisory pilot in the aircraft. RFDS specified a number of competency items and discussion topics to be covered during LOFT. These did not specifically include Pitch Trim Runaway.

When pilots had completed all of the LOFT elements and were considered ready, a check pilot conducted a check-to-line assessment consisting of at least two sectors, one night sector, and a minimum of two instrument approaches. RFDS specified a number of elements to be assessed during normal operation and some emergency/abnormal scenarios. These did not include Pitch Trim Runaway.

Once a pilot was checked to line, recurrent checking consisted of two checks in any 365-day period. One of those checks was an instrument proficiency checks (IPC) to satisfy the regulatory requirements of CASR Part 61. The alternate check was an OPC that consisted of a technical quiz and flight sequences to assess pilot response to at least four emergency scenarios. In addition, an annual line check was carried out to allow assessment of a medical flight sector.

Training and checking practices – pitch trim runaway

In the RFDS training and checking framework, it was a requirement that the emergency procedures in the QRH were addressed during PC-12 conversion training, check-to-line, OPC, and as required for IPC. RFDS identified six critical manoeuvres with an increased level of threat (such as emergency descent and engine failure after take-off) that required specific assessment during OPCs. Other emergencies, such as Pitch Trim Runaway, could be addressed in an OPC at the discretion of the check pilot.

Pilatus did not recommend a method for in-flight practice of Pitch Trim Runaway, other than the guidance provided in Safety Information Letter SIL-003 that there was a benefit to hands-on training for correct operation of the Trim Interrupt switch. Although RFDS specified techniques for their training/check pilots to use in simulating some emergencies such as engine failures, there was no documented method for pitch trim runaways. The ATSB derived information about practices from interviews with RFDS training/check pilots including those involved in the pilot’s training and checking.

It was not possible to replicate a pitch trim runaway in a serviceable aircraft nor would that be desirable in-flight. As such, it was common practice for RFDS training/check pilots to introduce a pitch trim runaway scenario by annunciating the warning callout ‘Trim Runaway’ and advising of the associated CAS warning message. The physical effects might be described by the training/check pilot, or represented either by using the alternate stab/manual trim to provide trim input or by application of a progressive force to the control column.

Training/check pilots expected pilots to respond by recalling and following the Pitch Trim Runaway procedure, starting with item 1 - identification of the Trim Interrupt switch. There was variation as to whether the switch was actually selected to INTR or whether this action was indicated in accordance with the touch drill principle. At this point, the training/check pilot would generally stop trim inputs or release force on the control column, as the case might be. The ATSB notes that trim interruption will stop trim inputs but will not alleviate control forces developed to that point.

If the training/check pilot initiated the pitch trim runaway on final approach, the likely outcome was a landing without a requirement for further actions from the emergency procedure. In all other situations, training/check pilots would expect that the pilot would proceed with further items of the procedure. For actions involving circuit breakers (items 2, 5, 6), it was a general principle that these were not pulled opened during practice of emergencies to prevent inducing problems in electrical systems. As such, the circuit breaker action items would be effected through touch drills or referenced by the pilot in discussion with the check pilot.

Although the end-point of a pitch trim runaway scenario was not defined and could vary according to the operational context, it was common for check pilots to facilitate the exercise so the complete procedure was addressed. This was consistent with a general misunderstanding in RFDS that the autopilot trim was powered through the Pitch Trim Alternate circuit breaker (rather than Pitch Trim circuit breaker). Consequently, it was perceived that items 4 onwards of the emergency procedure (Figure 6) may be required to address a malfunction in the autopilot trim system. On completion of the procedure, the check pilot could restore normal trim operation or might advise the pilot to use the alternate stab trim for trim operation during the next phase of flight.

In assessing pilot response to a pitch trim runaway scenario, training/check pilots were focussed on pilot recall of the QRH emergency procedure items and correct identification/confirmation of the applicable switches and circuit breakers. The representation of pitch trim runaway and effects of indicative actions did not consistently reflect actual behaviour of an aircraft during such an emergency.

The pilot of this occurrence expected that the control problems would be rectified when the Trim Interrupt switch was selected to INTR. If the pilot had promptly made that selection as intended, the control loads would have been manageable but the loads would not have been alleviated.

Following the occurrence, RFDS training/check pilots noted that the power control lever could obscure the Trim Interrupt switch when the lever was in the maximum position (used for take-off and initial climb). The ATSB confirmed that this was the case if the pilot’s seat was adjusted to provide a standardised field of vision with reference to the visual alignment device.

Pitch trim runaway occurrences

RFDS Western Operations

RFDS advised of seven pitch trim runaway events involving their PC-12 aircraft, including this occurrence. The ATSB requested data about these events and compiled the following table. For context, please note that all of the aircraft were PC-12/47E NG models and each of the events involved different registrations.

Table 1: RFDS Western Operations Pilatus PC-12/47E pitch trim runaway events

The ATSB reviewed the occurrence descriptions and maintenance records for the five pitch runaway events recorded before the occurrence, and interviewed the pilots involved except for one trainee pilot who was no longer with RFDS.

In one of those events (Ref. 2), the aircraft was on short final and the pilot operating under supervision carried out item 1 of the procedure then landed the aircraft. The training/check pilot advised the ATSB that the aircraft was controllable and there was no requirement or time to action further items of the procedure before landing.

In another event (Ref. 3), the pilot was on approach and the pilot actioned the recall items followed by appropriate use of the Alternate Stab Trim switch. The pilot advised the ATSB that knowledge of the system was gained from RFDS training/checking and from self-study.

In the other three events (Ref. 1, 4, 5), the same pilot was involved as pilot in command including one event under supervision of a training pilot. The pilot involved in the three events had joined RFDS in 2012. Prior to that, the pilot was employed as a corporate jet pilot for 3 years. In 2019, the pilot’s total experience was 11,900 hours including 3,000 hours on the PC-12. These three events are noteworthy in that the Alternate Stab Trim switch was the only means available to adjust trim but was not utilised following the recall items, and there were anomalies in the pilot in command’s technical understanding of the events and pitch trim system.

The pilot response to the first pitch trim runaway was consistent with the recall items of the procedure but the pilot did not realise that manual trim was consequently inoperative and was not aware that the Alternate Stab Trim could be used for trimming. In response to the two other events, the pilot continued the emergency procedure beyond the recall items and in at least one case pulled the Pitch Trim Alternate circuit breaker. That was not consistent with the recorded fault and it is not clear if and how the pilot trimmed the aircraft as reported.

RFDS Central Operations

The ATSB requested pitch trim runaway occurrence data from RFDS Central Operations (RFDSCO), as another operator of similar PC-12 aircraft. RFDSCO advised that there was no record of any verified pitch trim runaway events involving their PC-12 aircraft in the 9 years prior to the occurrence that such data had been recorded. For context, RFDSCO operate a mix of PC-12/47E NG aircraft and earlier series aircraft.

ATSB database

The ATSB conducted a search of the occurrence database for pitch trim runaway events involving the PC-12 aircraft type and a comparative aircraft type, the Beechcraft/Raytheon/Textron King Air. Apart from this occurrence, no pitch runaway events for either type were recorded in the ATSB database.

As reported in a previous section, RFDS identified six other pitch trim runaways involving their PC‑12 aircraft. These were not reported to the ATSB.

In response to a query from the ATSB, RFDS advised that the other pitch trim runaways were considered to be routine defects and handled via the incident reporting and/or maintenance reporting systems. Each of the events recorded in the incident reporting system were reviewed by the Head of Flying Operations and considered to have been handled appropriately.

The Transport Safety Regulations 2003 stipulate reporting of certain events to the ATSB. For a non-air transport operation such as RFDS, the use of any procedure for overcoming an emergency was prescribed as a routine reportable matter. The ATSB considered that a pitch trim runaway required a pilot to action the applicable emergency procedure and was therefore a routine reportable matter.

Pilatus records

At the request of the ATSB, Pilatus provided pitch trim runaway occurrence data for the PC-12 aircraft type. Pilatus recorded 56 pitch trim runaway events world-wide between 1999 and 2019. These occurred in all phases of flight and included at least 45 events involving the PC-12/47E model.

In 47 of the pitch trim runaway events, the recorded maintenance action was replacement of one or both of the manual trim relays or the (autopilot-related) trim adapter unit. None of the recorded maintenance actions were applicable to the alternate stabiliser trim circuit.

The amount of detail in the event descriptions varied and some did not provide information about pilot actions. For 10 events, there was recorded alternate stab trim use by the pilot and for three events, the pilot reported having insufficient time to action the emergency procedure before landing. In one event, the pilot tried to use the alternate stab trim but it did not operate.

Where pilot action was reported, it was common for the Trim Interrupt switch to be selected with associated stopping of the pitch trim runaway. There were no reports of pilot mis-selecting the Flap Interrupt switch instead of the Trim Interrupt switch.

Instructions for Continuing Airworthiness – Pilatus

As the aircraft manufacturer and type certificate holder, Pilatus produced specifications and instructions for continued airworthiness of the PC-12 aircraft type. Those instructions included periodic functional checks of the pitch trim system and procedures for troubleshooting and component replacement. Up to the month before the occurrence, there were no specific maintenance requirements for the manual trim system relays or trim adapter unit. As such, the relays remained in service ‘on‑condition’ until a defect was detected.

In March 2019, Pilatus issued Service Bulletin SB 27-024 to provide for replacement of the trim adapter unit that used electro-mechanical relays (auto pitch trim) with a unit that uses solid-state relays. At the time of the occurrence, Pilatus had prepared Service Bulletin SB 27-023 to provide for replacement of the two electro-mechanical relays in the manual pitch trim system with one solid-state relay. This was not issued until March 2020 due to limited parts availability.

Pilatus advised that the two Service Bulletins were developed to address a known reliability issue with the electro-mechanical relays. Due to frequent switching at their load limits, the relay contacts had a decreased operational life of approximately 25,000 cycles.

Examination of PC-12 pitch trim system relays

The electro-mechanical relays used in the PC-12 pitch trim system were a two-pole, double-throw design. Each pole consisted of a common terminal that was switched between a normally open contact and a normally closed contact. For this installation, only one pole was utilised.

Defective relay removed from VH-OWJ

The ATSB examined the manual pitch trim DOWN relay (identification number K161E2) removed from VH-OWJ to characterise the failure mode and assess the implications for continuing airworthiness. A visual inspection of the relay did not identify any anomalies (Figure 7). The markings were consistent with the specifications.

To record the internal configuration of the relay, the ATSB arranged for an x-ray before the relay was altered (Figure 8). This showed that for both poles of the relay, the normally open contacts were closed and the normally closed contacts were open. Electrical continuity checks of the pins were consistent with that anomalous configuration.

The ATSB detached the casing from the base of the relay to examine the internal mechanism (Figure 9). A visual inspection of the mechanism confirmed the anomalous configuration of the contacts and revealed the failure type for the normally open contacts.

For the relay pole connected to the pitch trim circuit (active), the normally open contact was melted and fused close. There was sooting on surfaces near the contacts and black contaminant from the black caps that covered the contacts. Beads of gold-coloured metallic material was observed on surfaces near the contacts. As a result of the fused contact, the other contacts were fixed in anomalous positions.

The relay manufacturer advised the ATSB that the condition of the contacts was consistent with a significant high-energy event that occurred while the relay was energised. The melting and welding of the contacts without circuit breaker activation is indicative of a short-duration high-current event such as a lightning strike. It was not possible for the manufacturer to determine the root cause of the relay failure.

Figure 7: External condition of defective relay

Source: ATSB

Figure 8: X-ray of defective relay showing anomalous configuration of the contacts (circled).

Source: ATSB

Figure 9: Opposite end views of relay mechanism showing the two sets of anomalous contact conditions

Source: ATSB

Other relay removed from VH-OWJ

The ATSB obtained and examined the manual pitch trim UP relay (identification number K161D2) from VH-OWJ. This relay was installed in the aircraft at the time of the occurrence and was functioning normally at the time of removal.

A visual inspection of the relay did not identify any anomalies and the markings were consistent with the specifications. The ATSB detached the casing from the base of the relay to examine the internal mechanism.

The active normally-closed contacts showed a localised build-up of metallic material on one contact surface (pimple-shaped) with corresponding loss of material from the other surface. This was consistent with electrical arcing.

Defective relay from other PC-12

The ATSB obtained and examined the manual pitch trim DOWN relay (identification number K161E2) from the RFDS aircraft that sustained a trim runaway on 3 August 2019 (Table 1, item 7).

A visual inspection of the relays did not identify any anomalies and the markings were consistent with the specifications. The ATSB detached the casing from the base of the relay to examine the internal mechanism.

The internal condition of the relay was similar to the defective relay from VH-OWJ. The active normally-open contact was melted and fused close. There was sooting on surfaces near the contacts and beads of gold-coloured metallic material was observed on surfaces near the contacts. As a result of the fused contact, the other contacts were fixed in anomalous positions.

The active normally-closed contacts showed localised material transfer that was similar to that observed to contacts in the manual pitch trim UP relay from VH-OWJ.

PC-12 Pitch trim defect reports

The ATSB provided details of the relay examination and analysis to CASA. They conducted a search of the CASA Defect Reporting Service (DRS) database for reports of defects in the PC-12 autopilot and flight control systems. This identified a number of reports including one report of a faulty pitch trim adapter (to a non-RFDS aircraft). No reports of manual pitch trim relay defects were identified.

For aircraft maintained under the Civil Aviation Regulations, it was a requirement that major defects be reported to CASA immediately. This included defects that caused, or that could cause, a control system failure. The list of examples published by CASA included serious malfunction of flight controls without specifying any types.

CASA uses defect reports as a means of identifying trends in design and maintenance reliability for the benefit of aviation safety. Reports are collected by CASA and maintained in a database. It is of benefit to both CASA and the aviation industry that the database contains accurate and relevant information. From this database, information may be:

• obtained to provide reliability statistics and trend monitoring of aircraft, engines, propellers, systems and components - CASA shares this information with other regulatory authorities
• used as a basis for development or review of an Airworthiness Directive (AD)
• used for the development of other advisory publications, such as Airworthiness Bulletins
• used for other appropriate regulatory purposes.

RFDS advised that no defect reports were submitted to CASA in relation to the malfunctions that resulted in pitch trim runaway events. This practice was based on the definition of a major defect as that which affects the safety of an aircraft or cause the aircraft to become a danger to persons or property. As there were secondary systems to manage a pitch trim runaway, RFDS did not consider the associated malfunctions to be major defects.

The ATSB was unable to establish if relay malfunction with pitch trim runaway was classified as a major defect as described in the Civil Aviation Regulations. Nevertheless, operators are encouraged to submit reports of PC-12 pitch trim defects to the DRS to facilitate CASA monitoring of continuing airworthiness data.
__________

3. Maintenance release: an official document, issued by an authorised person as described in Regulations, which is required to be carried on an aircraft as an ongoing record of its time in service (TIS) and airworthiness status. Subject to conditions, a maintenance release is valid for a defined period of operation, in this case 210 hours TIS or 6 months from issue.
4. A relay is an electrically controlled device that opens and closes electrical contacts. The relays used in the pitch trim system were a mechanical type that utilised the electromagnetic force of an inductor to change contact positions.

Safety analysis

In the early stages of a medical transport flight, the pilot was confronted with a pitch trim runaway emergency condition. Despite pilot actions intended to stop the runaway, the runaway was not interrupted and the pilot struggled to control the aircraft for the rest of the flight. The pilot made a good decision to enlist the assistance of the doctor and managed to coordinate their inputs to land the aircraft.

The pilot was qualified to conduct the flight and had about 7 months experience of similar operations in the PC-12 type. This patient transfer from Merredin was not a high priority flight and the aircraft was serviceable for the departure. Although the pilot was on a night shift and the take-off from Merredin was just after midnight, there were no indications of fatigue.

The safety analysis following seeks to explain how the event developed and identify the important safety considerations.

Technical failure and warnings

During normal operation of the PC-12 aircraft with the autopilot off, the pilot seeks to minimise control wheel forces by intermittently selecting the engagement switch in conjunction with the up/down switch on the control wheel. These actions energise the applicable relay and power the trim motor to move the horizontal stabiliser as directed. When the pilot releases the switches, the control circuit de‑energises the applicable relay with the usual effect of opening the power circuit to the manual trim motor and stopping trim movement.

Soon after take-off from Merredin, the pitch trim system continued to operate in a nose-down direction without pilot input or autopilot commands because of a malfunctioning relay in the manual (main pilot‑engaged) stabiliser trim system. The trim system immediately detected a pitch trim runaway and triggered the applicable Crew Alerting System (CAS) warnings.

The Master Warning, ‘Trim Runaway’ callout, and the Pitch Trim Runaway message on the Multi-function Display (MFD) provided an effective alert as to the nature of the emergency and correlated with the anomalous control forces experienced by the pilot. In this fully electric trim system (no trim wheel), the other indication available to the pilot was the trim indicator on the MFD.

As was typical for aircraft such as the PC-12, the CAS warnings did not specify the malfunctioning circuit/components or the required actions. In such cases, the pilot is required to action the applicable emergency procedure to stop the runaway, identify the affected circuit, disable the affected circuit, and utilise the unaffected circuit to make any required trim adjustments.

Initial pilot response

In response to the CAS warnings, the pilot sought to carry out the first recall item of the Pitch Trim Runaway emergency procedure by selecting the Trim Interrupt switch to INTR (interrupt). The pilot managed to action this item about 6 seconds after the warnings activated. However, recorded flight data shows that the pilot inadvertently selected the Flap Interrupt switch to INTR rather than the Trim Interrupt switch and did not identify the mis-selection.

Common aviation operational practice, also advocated by RFDS, involves an ‘identify-confirm-action’ process to minimise the inadvertent selection of wrong switches and buttons. In that context, the ATSB considered the following factors that might have influenced the pilot to mis‑select the interrupt switch:

• emergency flight control condition at low altitude on dark night
• visibility of the Trim Interrupt switch and label
• similar location and appearance of the two interrupt switches
• lack of familiarity with operating the Trim Interrupt switch during training/checking.

In the situation where there is sudden onset of an emergency condition affecting control forces at low altitude on a dark night, it is natural for the pilot to feel a sense of concern and urgency. This might have been heightened by unfamiliarity with the scenario that could not be realistically simulated in the aircraft. As such, it would be expected that the pilot would be experiencing some level of stress.

As the trim runaway progressed, the pilot’s attention was primarily focussed on controlling the aircraft and counteracting the developing pitch-down forces with both hands on the control wheel. Given the pilot reported that any hand movements from the control wheel were quick, it is likely that the pilot allocated a low level of attention to identifying and confirming the appropriate interrupt switch.

During take-off and initial climb the power lever was in a forward position. In a pilot’s normal field of view, the power lever obscured the Trim Interrupt switch but not the Flap Interrupt switch. This rendered the Flap Interrupt switch as relatively more accessible and in the circumstances, at higher risk of being mis-selected. At the same time, the cockpit lighting was dimmed for the dark‑night take-off in accordance with standard practice and that unavoidably reduced the readability of the backlit switch labels.

The Trim Interrupt switch and Flap Interrupt switches were both located in the centre console and appeared to be the same type of switch with a similar function (Figure 4 bottom right). Although the switches were differentiated by being located either side of the Alternate Stab Trim switch, and the Flap Interrupt switch was located forward of the Flap Selector Handle, the similarities increased the risk of mis‑selection.

Training and checking practices were generally oriented towards touch drills and it was unlikely that the pilot was familiar with physical operation of the Trim Interrupt switch. Given the Pilatus advice that hands-on training minimises the risk of erroneously activating the Flap Interrupt switch, it is likely that a higher level of familiarity would have assisted the pilot.

The ATSB considered the contextual factors to identify those that increased risk and might have contributed to the occurrence. Although the operating environment and visibility of the trim interrupt switch increased the degree of difficulty for the pilot, those elements are generally unavoidable and were not considered to be safety factors. The risk associated with the other two factors —interrupt switch similarities and RFDS training/checking practices—is discussed in the following section.

Following inadvertent selection of the Flap Interrupt switch, there were indications that the results were contrary to the pilot’s intention—the pitch trim continued to operate and the runaway warning message remained on the CAS display. Later, the pilot also noticed the ‘Flap’ caution message in association with attempted flap extension. However, the pilot did not associate those indications with the mis-selection.

One of the reasons for this was the surprise and confusion resulting from non-alleviation of the control forces in response to the attempted trim interrupt. That was a natural response that was probably influenced by the inconsistent representation of trim interrupt effects in training/checking. The pilot experienced a high level of stress that adversely affected the pilot’s ability to carry out the next item immediately (which would have stopped the runway) and to problem-solve.

Research has confirmed common-sense understanding that situations involving acute stress, such as an out-of-control aircraft, are particularly harmful to higher order cognitive processes, such as decision-making (Dismukes, Goldsmith and Kochan, 2015). Acute stress impairs decision-making, leading to the consideration of fewer options and an increased tendency to make biased decisions. Attention becomes difficult to control, and tends to be easily distracted by alarms and other threatening signals. Anxious thoughts interfere with the resources needed to understand and resolve the emergency situation.

A potentially complicating factor in the pilot’s response was the momentary cancellation and recycling of the CAS warnings from pilot use of the manual trim switches. This characteristic was only evident because of the unsuccessful trim interrupt and was a subtle indication that manual trim was the affected circuit that had not been de-powered. The pilot was not expected to have that level of implicit systems knowledge and did not consider the possibility of switch mis-selection. In that case, the unexpected aircraft behaviour was confusing and treated as a symptom of the underlying technical problem.

As a consequence of the Trim Interrupt remaining in NORM (normal) due to the inadvertent selection of the Flap Interrupt switch, and the Pitch Trim circuit breaker initially remaining closed, power continued to be supplied through the malfunctioning relay to the manual stabiliser trim motor. The pitch trim reached the full nose down position 16 seconds after the runaway started. This created serious control difficulty for the pilot, which was exacerbated by the increasing airspeed.

Airspeed management

From the start of the pitch trim runaway, as the manual trim motor moved the horizontal stabiliser to a higher angle, the stabiliser produced progressively more lift that translated to nose-down force. The pilot was physically unable to fully counteract that force with the control wheel and the aircraft nose lowered. In the consequent descent, the airspeed increased with an associated increase in stabiliser lift and nose-down force. The pilot found this harder to counteract and the aircraft nose lowered further. This was a reinforcing cycle that reoccurred during the sequence relative to the counteracting effort applied to the controls.

In addition, when the pitch trim runaway began, the power lever was in the maximum engine torque position specified for take-off and initial climb. It remained in that position for the next 22 seconds and was a significant contributor to the initial airspeed increase. The airspeed reached 210 kts with increased risk of descent into terrain before the pilot reduced engine torque and airspeed to partially alleviate the control loads and arrest the descent.

The Pitch Trim Runaway procedure included a note after item 7 advising pilots to reduce speed if the control forces are high. In the circumstances, the most effective means to reduce airspeed was to reduce engine torque.

The ATSB considered that the time taken by the pilot to reduce engine torque after the pitch trim runaway warning was associated with the pilot’s cognitive and physical workload as discussed in the previous section. It is likely that the pilot was prioritising aircraft control and conduct of emergency procedures, and did not perceive an immediate need to reduce engine torque. In addition, as the trim runaway developed, it became more difficult to remove a hand from the control wheel to adjust the power lever.

For flight control emergencies such as out-of-trim conditions, there is an imperative to maintain control while resolving the technical problem. A critical factor for pilots to consider is control of airspeed and associated engine power.

Continuation of emergency procedure

As control loads allowed, the pilot managed to carry out item 2 of the emergency procedure by opening the Pitch Trim circuit breaker. This de-powered the circuit with the malfunctioning relay and manual actuator motor so that the fault condition was effectively neutralised. As the trim had already run to full nose down (due to not stopping when the pilot selected the wrong interrupt switch), the only indication that this action had been successful was removal of the CAS message from the MFD.

The pilot then sought to carry out item 3 of the procedure to return the Trim Interrupt switch to NORM. It is assumed that the pilot returned the Flap Interrupt switch to NORM instead of the Trim Interrupt, consistent with earlier mis-selection of the Flap Interrupt switch. This did not have any further effect as the Trim Interrupt switch remained in NORM throughout the flight and the wing flaps remained inoperative irrespective of subsequent switch selections.

At this point, the pilot was required to make a decision according to the status of the trim runaway. With the fault condition neutralised and power available to the operable trim circuits, the pilot could have adjusted the pitch trim using the Alternate Stab Trim switch and regained full control of the aircraft. That would have been consistent with the intent of the procedure, although it was listed as item 8 in the procedure. However, the pilot did not use the alternate stab trim and decided to proceed with further items of the procedure, consistent with the condition ‘If trim runaway continues’.

The pilot opened the Pitch Trim Alternate circuit breaker as per item 5 and closed the Pitch Trim circuit breaker as per item 6. This had dual adverse effects. First, power was removed from the operative alternate trim system and second, power was restored to the malfunctioning relay and manual trim motor for a short period. (This reactivated the warnings and prompted re-opening of the Pitch Trim circuit breaker.) As a consequence of opening the Pitch Trim Alternate circuit breaker (item 5), when the pilot tried to use the Alternate Stab Trim as per item 8 of the procedure, the circuit was inoperative and this did not have any effect.

While maintaining partial control of the aircraft in difficult circumstances, the pilot managed to neutralise the malfunctioning relay in the early stages of the sequence. However, the pilot missed a critical opportunity to use the Alternate Stab Trim switch to recover control of the aircraft. By continuing the emergency procedure from item 4 onwards, the pilot disabled the operative trim system and prolonged the serious control difficulties.

The ATSB acknowledges that the serious difficulties experienced by the pilot in this phase of the emergency resulted from non-selection of the Trim Interrupt switch and consequent full nose-down pitch trim before the Pitch Trim circuit breaker was pulled. In addition to the extreme flight loads and deleterious effects of acute stress on decision-making, another consequence was absence of trim operation as an indication of runaway status. As such, when the pilot was required to assess the effect of recovery actions, the only effective indicator was activation/cancellation of the Pitch Trim Runway CAS message.

Irrespective of the ineffective actioning of item 1 of the emergency procedure, the subsequent actions required for recovery of control—items 2, 3 and 8—were unchanged. The pilot, however, did not have capability to resolve the out-of-trim condition, which relied in part on resources provided by Pilatus and training/checking provided by RFDS. These aspects are discussed in following sections.

The ATSB notes that pilot capability in this aircraft-specific context should not rely on certain levels of total aeronautical experience levels or operational experience on comparative aircraft types.

Trim Interrupt and Flap Interrupt switches

The pilot’s mis-selection of the Flap Interrupt switch in place of the Trim Interrupt switch contributed to the development of severe control forces. One of the factors identified by the ATSB was the similar location, appearance, and function of the Trim Interrupt and Flap Interrupt switches.

To manage the risk of switch mis-selection generally, RFDS training/check pilots advocated the practice of identify–confirm–action. In relation to the Trim Interrupt switch, pilots were required to identify the switch when pitch trim runaways were addressed during training/checking. RFDS pilots were also familiar with the location of both switches from the pre-flight inspection conducted on a pilot’s the first flight of the day in a particular aircraft.

Pilatus inferred there was a risk of erroneously activating the Flap Interrupt switch and that hands‑on training would reduce that risk. In the RFDS context, mis-identification of the Trim Interrupt switch was not evident during training and checking and, in the previous pitch trim runaway occurrences, the pilots had correctly identified and actioned the Trim Interrupt switch. However, the artificiality of the training/checking environment and the relatively benign conditions experienced by most pilots during the previous pitch trim runaways occurrences (daylight and phases of flight other than take-off/initial climb) were very different from conditions of this occurrence.

In the 57 pitch trim runaway events recorded by Pilatus, there were no reports of mis-selection of the Flap Interrupt instead of the Trim Interrupt switch. Although this indicates that the risk is generally not high, it may be sensitive to phase of flight and environmental conditions. There was insufficient information in the Pilatus data to make an assessment of that risk.

The risk of mis-identification could be reduced by pilots manipulating the switch during training/checking and by increased awareness of the effects of inadvertent selection of the Flap Interrupt switch. Consideration could also be given to daily pre-flight operation of the Trim Interrupt switch as implemented for Canadian PC-12 aircraft. Although these procedural controls reduce the risk, it would be preferable to implement an engineering control to remove the hazard.

The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches unnecessarily increased the risk of mis-selection. While visually distinguishing close proximity switches and controls has long been shown to be an effective strategy (for example, landing gear and flap retraction levers are typically designed to resemble the lever’s function), given pilots are not required to access the Flap Interrupt switch, consideration could also be given to preventing access to it altogether.

Pilatus emergency procedure and systems information

Pilatus advised pilots in the POH/AFM that the prerequisites for safe aircraft handling in an emergency is prior knowledge of the applicable procedure and a good understanding of the aircraft systems. The ATSB used this statement as a reference point to assess the related factors in pilot capability.

Prior knowledge is taken to be familiarity with the content and application of the Pitch Trim Runaway procedure. In this case, RFDS required the pilot to memorise at least the first four items of the Pitch Trim Runaway procedure and addressed this in PC-12 flight training and the recent OPC. Despite mis‑selection of the Trim/Flap Interrupt in this occurrence, the pilot demonstrated familiarity with all of the items of the procedure by addressing each in turn.

Pilatus did not nominate any recall items (also known as memory, phase-1 or bold-faced checks) for PC-12 emergency procedures. In the case of the Pitch Trim Runaway procedure, Pilatus advised the ATSB that their preference would be designation of item 1 as the only recall item to place the focus on the crucial item and positively arrest any trim runaway from any cause. Although the ATSB recognises there are benefits to minimising recall items, there is nothing to indicate that the number of nominated recall items in RFDS procedures were a factor in this occurrence.

The degree of knowledge required for a good understanding of aircraft systems is dependent in part on the complexity of the aircraft and the nature of the pilot-systems interface. Given the relative complexity of the aircraft and regulatory requirements, RFDS provided a PC-12 ground school to the pilot that covered the pitch trim system with reference to the POH/AFM. It would be natural for this theoretical knowledge to be consolidated and/or extended by the PC-12 flying training and operator proficiency checks (OPCs).

Given the pilot was able to recall the emergency procedure and was trained with reference to the Pilot Operating Handbook/Airplane Flight Manual (POH/AFM), the ATSB considered the content and format of the emergency procedure and systems information provided by Pilatus. The associated training/checking aspects are addressed in the following section.

Pitch Trim Runaway emergency procedure

The copy of the Pitch Trim Runaway emergency procedure from Figure 6 is repeated here for ease of reference.

Figure 10: Quick Reference Handbook Emergency Procedures – Pitch Trim Runaway

Source: Pilatus

After item 3 of the emergency procedure, the pilot was required to make an assessment and decision about the status of the runaway and act accordingly. This assessment/decision point was defined in the procedure by the condition—‘If trim runaway continues’. Correctly understood, the implication is that the fault is not in the manual trim system and autopilot trim system but in the alternate stabiliser trim circuit.

The alternate stabiliser trim circuit is not used during normal operations and does not require any relays to be energised for operation. As such, the risk that this circuit would fail in an unsafe runaway condition is very low relative to a manual trim or autopilot circuit failure. This was consistent with advice from Honeywell that there was no record of any such failure.

The alternative condition at the assessment/decision point—if trim runaway does not continue—was implied but not specified in the procedure. In this more likely scenario, the fault in the manual or autopilot trim systems has been neutralised by item 2 (opening of Pitch Trim circuit breaker). Then, without any guidance from the procedure, pilots needed to understand that the procedure from item 4 to item 7 should not be continued and alternate stab trim was the only means available to trim the aircraft for the rest of the flight.

Significantly, alternate stabiliser trim was not specified in the procedure until item 8. This had two related adverse effects. First, pilots are not guided to use the alternate stabiliser trim at the point where it almost certainly would be effective at recovering from an out-of-trim condition (after item 3). Second, if the procedure is carried out in a sequential manner, item 5 (Pitch Trim Alternate circuit breaker open) will render item 8 (alternate stabiliser trim) inoperable.

Another consequence of lack of guidance and continuation of the procedure is that item 6 (Pitch Trim circuit breaker—Close) will reactivate the pitch trim runaway in almost all cases.

One of the notes near the end of the Pitch Trim Runaway procedure advised pilots to ‘Reduce speed if control forces are high’. The pilot response to the abnormal control forces was consistent with this advice but the airspeed reached high-risk figures before the pilot took effective action. In this case, the pilot was probably not prompted by the note in the procedure. However, if the note was positioned earlier in the procedure, it is possible that pilot would have acted earlier to reduce the airspeed and risk of loss of loss of control.

Pilatus advised the ATSB that instead of reliance on descriptions within the emergency procedure, the objective of the emergency procedures must be understood and ingrained during training for the procedure to be effectively executed. This was more applicable when the pilot is managing the emergency and unintended consequences. Pilots were directed to SIL-003 for a clear description of the requirements. A copy of SIL-003 is at Appendix B and ATSB assessment of the SIL is in the next section.

The ATSB considered that the PC-12 Pitch Trim Runaway emergency procedure did not clearly define the two conditions for pilot consideration after item 3. In addition, the specified action in response to the most likely condition—pitch trim runaway discontinues (as indicated by no active warnings)—was out of sequence. Given the confounding situation and complexity of the PC-12 pitch trim system, it is likely that a clearly defined and logically sequenced procedure would have assisted the pilot to regain control.

Pitch trim systems information

From an operational perspective, the primary reference for systems information was the POH/AFM. This included the following information relevant to this occurrence:

• The alternate stabilizer trim motor could be used as a backup through actuation of the Alternate Stab Trim switch.
• In the case of uncommanded trim operation, all trim operation could be stopped by lifting the switch guard and pressing the Trim Interrupt switch.
• If a stabiliser trim runaway of the main system is sensed a CAS ‘Pitch Trim Runaway’ warning will be displayed and a ‘Trim Runaway’ will be heard.

The ATSB notes that although this information is helpful to a pilot contending with a pitch trim runaway, it does not provide guidance as to when the Alternate Stab Trim switch should be used or the significance of the CAS warning as an ongoing indicator of system status.

Additional information about pitch trim runaway was available in Pilatus Safety Information Letter SIL‑003. However, RFDS did not incorporate the SIL into their operational reference material and the pilot was not aware of it.

The additional information would have been generally helpful to the pilot and would have emphasised the importance of reduced airspeed in managing the out-of-trim loads. Nevertheless, the ATSB identified missed opportunities in SIL-003 to explain and clarify aspects of pitch trim runaway:

• Hands-on training was advised to reduce the risk of erroneously activating the Flap Interrupt switch but pilots were not informed of the associated risk factors, symptoms or corrective action if that occurred.
• Information was provided about the purpose of pulling a circuit breaker, without further guidance as to how the affected trim motor would be identified.
• Pilots were advised that control of the unaffected systems could be regained by simply repositioning the Trim Interrupt switch to NORM, without guiding pilots to use the Alternate Stab Trim switch.

Neither SIL-003 nor POH/AFM informed pilots/operators that both the manual pitch trim and autopilot pitch trim were powered from the Pitch Trim circuit breaker. In the absence of that information, there is a risk of misapprehension that the autopilot pitch trim was powered from the Pitch Trim Alternate circuit breaker on the (correct) basis that the autopilot pitch trim utilised the alternate trim motor.

A consequence of this misapprehension is that pilots/operators may not realise that the first 3 items (and item 8 as required) of the pitch trim runaway procedure will almost certainly be sufficient to address a runaway condition. There is a risk that pilots will unnecessarily address all of the items in the procedure and not resolve a pitch trim runaway, as happened in this occurrence. The effect of this misapprehension on RFDS training/checking is discussed in the next section.

Another characteristic not covered in the information for pilots applies when the manual trim circuit is the active cause of a pitch trim runway. If the pilot engages manual trim, perhaps instinctively, the CAS warnings are cancelled for the duration of the engagement then reactivate on manual trim disengagement. Pilot awareness of this characteristic might be of assistance in an ill-defined emergency such as this occurrence.

In the context of this occurrence, the ATSB considered that the systems information in the PC-12 POH/AFM did not provide a detailed description of the pitch trim system or effective guidance in the management of a pitch trim runaway. Although SIL-003 presented additional information, it did not effectively compensate for the lack of detailed systems description and guidance in the POH/AFM.

Summary and finding

The PC-12 pitch trim system is complex and the CAS warnings for pitch trim runaway do not specify the malfunctioning circuit or the required actions. As a result, pilots are required to recall and action emergency procedures, interpret system indications, and act accordingly to resolve a pitch trim runaway.

This occurrence demonstrates that the consequences of a pitch trim runaway can be critical if the trim is not interrupted early in the emergency. In the context of this occurrence, the applicable risk controls such as the emergency procedure and systems information did not provide effective assistance to the pilot. The other RFDS pitch trim runaway occurrences did not have critical consequences but indicate variability in the effectiveness of these risk controls.

The relatively experienced pilot involved in three of the previous pitch trim runaway events was familiar with the emergency procedure and POH/AFM but did not interpret the system indications appropriately or act according to the intent of the procedure. During post-occurrence RFDS training/checking, it was apparent that there was variability in pilot understanding of the pitch trim system and associated emergency procedures. Given that variability, the ATSB considered that the occurrence pilot’s relative inexperience was not an important factor in the occurrence.

Pilatus recorded 47 pitch trim runaway events that were associated with defective relays in the manual trim system or the trim adaptor. In those events, the only method available to adjust the trim was use of the Alternate Stab Trim switch, which was reported in 11 of the events (one was unsuccessful). Taking into account those 11 events and the 3 events where the emergency procedure was not fully actioned due to the operational context, there were 33 pitch trim runaways where pilot use or non-use of Alternate Stab Trim is unknown. As such, there is insufficient information to derive a conclusion from the Pilatus data regarding pilot understanding of the pitch trim system and emergency procedure.

Given the pilot in this occurrence was familiar with the emergency procedure and trained by qualified personnel with reference to the POH/AFM, the ATSB considered the content and format of the emergency procedure and systems information in the POH/AFM in the context of RFDS and Pilatus occurrence data.

The ATSB found that the emergency procedures and systems information in the PC-12 POH/AFM and Quick Reference Handbook (QRH) did not provide effective guidance or sufficient information for pilots contending with a pitch trim runaway. If the pilot selects the Trim Interrupt switch early in the sequence and does not need to adjust the pitch trim, the risk is not significant. In this case, the lack of effective guidance and systems information probably had an adverse influence on the pilot’s capability to resolve the uninterrupted trim runaway condition and was a critical factor.

RFDS training and checking

The pilot’s capability to implement the Pitch Trim Runaway emergency procedure with a good understanding of the aircraft systems relied to a large extent on the training and checking provided by RFDS. Their training and checking organisation conducted the required ground school and flight training to qualify the pilot to operate the PC-12 aircraft type. This was supplemented by supervised line flying (LOFT) and operator proficiency checks (OPC) as specified by RFDS.

The PC-12 ground school was the primary means for RFDS to equip the pilot with the requisite knowledge of a wide range of aircraft systems. This included the pitch trim system, which was addressed with reference to the POH/AFM and as part of a guided inspection of an aircraft. Given the POH/AFM did not provide a detailed description of the pitch trim system and RFDS training/checking pilots were unaware of some characteristics, the information provided to the pilot accordingly had some limitations.

By the time the pilot was trained in 2018, Pilatus had issued SIL-003 (in 2017) as a reminder of the trim runaway procedures in the POH/AFM and to highlight decision-making considerations after the trim runaway condition is stopped. RFDS had not formally considered this document and it was not a supplementary reference in the ground school. Although this document would have been generally helpful to the ground school facilitator and this pilot, the focus of the SIL was operational and it did not provide any further significant detail about the pitch trim system. As such, the absence of the SIL from the ground school references was not considered to be a factor in the occurrence.

Although systems knowledge is not the prime focus of flying training, supervised line flying or operator proficiency checks, these processes generally help to consolidate the pilot’s understanding of aircraft systems and might show if there were any critical knowledge deficiencies. There was no indication of any such deficiencies.

The PC-12 flying training and operator proficiency checks were the primary means for RFDS to develop and verify the pilot’s capability to manage in-flight emergencies such as pitch trim runaway. These training/checking activities were oriented to the recall and practice of the applicable emergency procedures in the QRH. As a result, it could be expected that the pilot was familiar with the content of the procedures and location of the applicable switches and circuit breakers.

Although the pilot was able to recall the items in the emergency procedure, the initial switch selection was incorrect and the pilot actioned further items of the procedure without resolving the severely out-of-trim condition. The ATSB considered two aspects of the training/checking processes that might have played a role.

First, the practice exercises for pitch trim runaway were not consistent with the likely failure modes and recovery actions. Prior to this occurrence, RFDS operated on the basis that the manual trim was powered from Pitch Trim circuit breaker and the autopilot trim (utilising the alternate trim motor) was powered from the Pitch Trim Alternate circuit breaker. As a result, in response to a practice pitch trim runaway, pilots were expected to complete the first stage (items 1-3) at a minimum and it was common to continue the procedure (items 4-8) to represent an autopilot-related runaway scenario.

Actually, both manual and autopilot systems are powered from the Pitch Trim circuit breaker so the first stage (items 1-3) and item 8 (as required) of the emergency procedure are sufficient to manage a pitch trim runaway in all recorded cases to date. In the absence of a clear definition of failure modes, the pilot was conditioned to continue the emergency procedure beyond the first stage without use of the Alternate Stab Trim.

RFDS misunderstanding of the pitch trim system can be attributed in part to the lack of specific detail in the POH/AFM and unclear definition of the likely fault conditions in the emergency procedure. Although there was a report of some consideration of SIL-003 and consequent inclusion of pitch trim runaway scenarios in checks, RFDS did not formally consider the implications for their training/checking practices.

The key piece of additional information provided by the SIL was the advice:

Hands-on training reduces the activation time and minimizes the risk of erroneously activating the “Flaps Interrupt” system switch (which cannot be reset in-flight).

In the pre-occurrence context, with no instances of mis-selections in occurrences or training/checking, it is unclear if RFDS would have adopted that practice as an exception to the touch-drill principle. Nevertheless, Pilatus consider SIL-003 to be effective additional guidance for the management of a pitch trim runaway.

Second, the RFDS training/checking was carried out in-aircraft and this has inherent and unavoidable constraints for the practice of some emergencies. It is not technically feasible or necessarily safe to initiate a pitch trim runaway in the aircraft so the training/checking pilot described a scenario and/or discreetly made a flight control input. Accordingly, the trainee did not experience the realistic effects of a pitch trim runaway with the applicable CAS indications. Then, the pilot generally responded with a touch-drill and did not fully experience the physical action and system feedback.

As a consequence of both aspects, the occurrence pilot had developed an expectation that selection of the Trim Interrupt to INTR should have stopped the dive and the opened circuit breaker should have relieved the situation. In reality, the trim interrupt function simply stops the trim where it is and the opened circuit breaker does not provide any further relief at that point.

The ATSB found that the effectiveness of RFDS training and checking processes for pitch trim runaway was undermined by incomplete systems information and unrealistic practice exercises associated with training/checking in the aircraft (non-simulator).

Relay failure

The ATSB examined the defective manual pitch trim DOWN relays removed from VH-OWJ and another PC-12 that sustained a pitch trim runaway. In both relays, one set of the normally open contacts were fused together in a similar way. According to the relay manufacturer, this type of damage was consistent with a short-duration high-current event such as a lightning strike.

The transfer of material between contacts in the manual pitch trim UP relay removed from VH-OWJ and the manual pitch DOWN relay from the other PC-12 showed that the related circuits had been subjected to regular arcing.

Based on examination of the three manual pitch trim relays from two different aircraft, the ATSB considered that the risk of surge voltage and over current in the PC-12 pitch trim system was probably not limited to a particular aircraft. The relay failures recorded by RFDS and Pilatus in connection with pitch trim runaway events are indicative of the same failure mode. Considering the near identical failure mode within the same pitch trim relay of varying aircraft, it is less likely that the cause would be a random event such as a lightning strike. The ATSB considers that the failure is more likely due to a characteristic associated with the pitch trim circuit, such as potential surge currents cause by switching the inductive load of the pitch trim actuator.

At the time of the occurrence Pilatus had identified a reliability issue concerning the mechanical relays in the PC-12 pitch trim system. This is consistent with the ATSB’s concern that a characteristic of the pitch trim circuit may have contributed to the relay failure.

Pilatus have developed service bulletins to introduce solid-state relays into the pitch trim power circuits. The ATSB notes that solid-state relays are also susceptible to failure from surge voltages. A typical failure mode for solid-state relays is short-circuit, in which case the load would not be turned off and a pitch trim runaway would occur.

Although Pilatus service bulletins SB 27-023 and SB 27-024 address the reliability of relays in the pitch trim system, the ATSB considers that the risk of pitch trim runaway may not be significantly reduced. As such, Pilatus may need to conduct further research into the electrical loads present in the PC-12 pitch trim system to identify and address the source of the high energy events that damage relays.

Findings

From the evidence available, the following findings are made with respect to the pitch trim runaway and partial loss of control involving a Pilatus PC-12/47E, registered VH-OWJ that occurred near Merredin, Western Australia on 14 April 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• Soon after take-off in dark-night conditions, the pitch trim system continued to operate in a nose-down direction without pilot input or autopilot commands (pitch trim runaway) because of a malfunctioning relay in the manual (main pilot-engaged) stabiliser trim system.
• In response to the Crew Alerting System warnings, the pilot initiated the Pitch Trim Runaway emergency procedure but inadvertently selected the Flap Interrupt switch rather than the Trim Interrupt switch (item 1). Consequently (before the next checklist item was actioned), the pitch trim continued to runaway until it reached full nose-down with associated serious control difficulties.
• After the pilot addressed items 2 and 3 of the emergency procedure, the malfunction was neutralised and the alternate stabiliser trim system was available to adjust the trim. However, the pilot did not identify those positive conditions and continued with items 4 to 8 of the procedure, which disabled the alternate stabiliser trim system, prevented pitch trim adjustment and prolonged the serious control difficulties.
• The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches unnecessarily increased the risk of mis-selection and contributed to the excessive out-of-trim condition.
• The emergency procedures and systems information in the PC-12 Pilot’s Operating Handbook/Airplane Flight Manual and Quick Reference Handbook did not provide effective guidance or sufficient information for pilots contending with a pitch trim runaway. If the pilot selects the Trim Interrupt switch early in the sequence and does not need to adjust the pitch trim, the risk is not significant. In this case, the lack of effective guidance and systems information probably had an adverse influence on the pilot’s capability to resolve the uninterrupted trim runaway condition and was a critical factor.

Other factors that increased risk

• As the (uninterrupted) pitch trim runaway progressed, the reinforcing cycle of increasing control loads, forced descent, and increasing airspeed was initially exacerbated by high engine torque. The airspeed reached 210 kts with increased risk of descent into terrain before the pilot reduced engine torque and airspeed to partially alleviate the control loads and arrest the descent.
• The effectiveness of RFDS training and checking processes for pitch trim runaway was undermined by incomplete systems knowledge and unrealistic practice exercises associated with training/checking in the aircraft (non-simulator).

Other findings

• The PC-12 Crew Alerting System (CAS) provided clear and salient warnings of the pitch trim runaway and indications of the ongoing status of the pitch trim system. As was typical for aircraft such as the PC-12, the CAS was not designed to specify the malfunctioning circuit.
• In difficult operational circumstances, the pilot enlisted the assistance of non-flying crew to counter the very high control loads and managed to coordinate the dual control inputs to return and land without wing flap at Merredin.
• At the time of the occurrence, the aircraft manufacturer was developing and implementing replacement components for the pitch trim system to improve reliability. Further research into the electrical loads present in the PC-12 pitch trim system may be required to find and address the source of high energy events that damage the relays.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Pilatus PC-12 trim and flap interrupt switches

Safety issue number: AO-2019-019-SI-01

Safety issue description: The similarities between the Trim Interrupt and Flap Interrupt switches and the proximal location of the two switches unnecessarily increased the risk of mis-selection and contributed to the excessive out-of-trim condition.

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

RFDS Western Operations

RFDS safety, quality and risk personnel carried out an investigation of the occurrence with a focus on the cause of the pitch trim runaway and the actions of the pilot and crew in response to the event. This resulted in six recommendations and the following safety action by RFDS:

• Pilatus was asked to investigate more reliable relays for the pitch trim system.
• Feedback was provided to Pilatus regarding the Pitch Trim Runaway emergency procedure and the potential to change it to reduce confusion.
• RFDS considered that the timing of the initial engine torque reduction (when the airspeed reached 210 kt) led directly to a situation where the aircraft and crew were placed at catastrophic risk. With reference to the RFDS Just Culture process, this was considered to be negligent and, taking into account the pilot’s other incidents, the pilot’s employment was terminated.
• RFDS amended the PC-12 operating procedures in their Operations Manual to present the first phase of the pitch trim runaway emergency procedure in accordance with the Pilatus PC-12 POH/AFM and QRH.
• The RFDS Head of Training and Checking convened a review of the adequacy of processes in regard to pitch trim runaway. This led to the following activities:
  • Briefing on revised pitch trim system information to all PC-12 pilots
  • Development of a training presentation to describe operation of the pitch trim system
  • For PC-12 conversion, addition of training between ground school and flight training to provide opportunity for pilots to review and if possible physically action emergency procedures in an aircraft on the ground
  • Refresher training for pitch trim runaway for all PC-12 pilots on next scheduled checks
  • For a practice pitch trim runaway, pilots were now expected to physically action the Alternate Stab Trim switch
  • Provision of the RFDS investigation report (with redactions for privacy) to all PC-12 pilots.

Following the occurrence, senior training and checking personnel had the opportunity to participate in a modified PC-12/47E ground school and simulator flight refresher course provided in the US by Flight Safety International. This included a pitch trim runaway scenario with similar complications to the occurrence.

A number of recommendations were proposed including:

• Enhancement to the PC-12 ground school with more emphasis on emergency procedures and their impact on aircraft systems
• Consideration of practice to retard the engine power lever as initial response to pitch trim runaway for better access to Trim Interrupt switch and enhance control of airspeed and control forces.
• Where possible, allow pilots to physically action controls such as Alternate Stab Trim that are specified in a drill
• Opportunities for training pilots and all PC-12 pilots to practice emergency scenarios in a full motion simulator.

General details

Pilot details

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Pilatus Aircraft Ltd.
• Honeywell Aerospace
• Royal Flying Doctor Service – Western Operations
• Pilot and medical crew of VH-OWJ
• RFDS pilots involved in other pitch trim runaway occurrences
• Royal Flying Doctor Service – Central Operations
• Transport Canada.

References

Dismukes, R., Goldsmith, T. E., & Kochan, J. A. (2015). Effects of acute stress on aircrew performance: literature review and analysis of operational aspects.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority, Transport Canada, Swiss Transport Safety Board, Pilatus Aircraft Ltd, Honeywell Aerospace, Royal Flying Doctor Service – Western Operations, the pilot and medical crew of VH-OWJ, and Royal Flying Doctor Service – Central Operations.

Submissions were received from the Civil Aviation Safety Authority, Swiss Transport Safety Board, Royal Flying Doctor Service – Western Operations, and Pilatus Aircraft Ltd. Those submissions were reviewed and where considered appropriate, the text of the draft report was amended.

Appendices

Appendix A – PC-12/47E Pitch trim system wiring diagram

The ATSB adapted this circuit diagram from the maintenance data produced by Pilatus to show the status of key components of the system at the time of the pitch trim runaway. The red lines trace the active power circuit through the malfunctioning relay. That circuit can be de-energised by the Trim Interrupt switch and/or Pitch Trim circuit breaker. The blue lines trace the power circuit that can be activated by the Alternate Stab Trim switch provided the Pitch Trim Altn circuit breaker is closed and the Trim Interrupt switch is NORM.

Note, both pilot and autopilot controlled pitch trim circuits are powered via the Ess Bus and Pitch Trim circuit breaker. The Main Bus and Pitch Trim Altn circuit breaker only powers the Alternate Stab Trim circuit.

Figure A1: PC-12/47E Pitch trim system wiring diagram 

Source: Adapted from Pilatus PC-12 maintenance data by the ATSB

Appendix B – Pilatus PC-12 Safety Information Letter SIL-003

Source: Pilatus Aircraft Ltd.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

At 2000 Central Standard Time on 13 May 2018, the crew of a Leonardo Helicopters AW139, registered VH-YHF, departed Darwin, Northern Territory, to search for an active emergency position-indicating radio beacon (EPIRB). The crew flew under night visual flight rules with support of a night vision imaging system.

During an approach to a potential EPIRB target, smoke from nearby bushfires affected visibility and the helicopter developed an uncommanded high rate of descent. The Aircrew Officer, in the rear of the helicopter, called ‘Climb! Climb! Climb!’, and the pilot regained control with a rehearsed recovery drill. During the recovery procedure, the power demand exceeded airframe limitations. This exceedance went undetected, and the helicopter was flown on a second sortie that same evening.

What the ATSB found

The pilot entered instrument meteorological conditions during approach, and lost control of vertical speed. The helicopter descended to 31 ft above ground level during the event. Reversion to standard patter and practiced drills allowed the crew to recover the situation and avert an accident.

Two layers of protection available to the crew of the helicopter were not used. Flight instruments were not referred to in the incident approach, and a crewmember trained to support the pilot in monitoring the approach was required to be in the rear of the aircraft.

A main gearbox over-torque of 159.5 per cent occurred during the recovery. The crew could not determine the magnitude of the potential over-torque after the event. Subsequently the aircraft remained in service in a condition of uncertain airworthiness.

What has been done as a result

CareFlight has established three main controls aiming to prevent reoccurrence:

• Stabilised Approach Criteria was written into standard operating procedures, requiring an immediate go-around if the aircraft leaves a prescribed range of approach parameters.
• Controlled flight into terrain (CFIT) avoidance training was incorporated into the ground-based training syllabus.
• Improved advice on use of auto hover functions was written into aircraft handling standard operating procedures. This included a requirement that the function was not to be engaged while the helicopter was descending.

Safety message

Pilots must be aware of the human factors hazards associated with loss of visual references. Pilots can protect themselves by maintaining the use of instrument scans in approaches at night, and making use of monitoring by trained and available crewmembers.

Flight planning should include assessment of the risk of a degraded visual environment. Operators should document their minimum acceptable levels of illumination and levels of tolerable risk. Where the risk exists, predetermined responses should be readily available.

Instrument flight rules (IFR) pilots in IFR-rated aircraft should prioritise use of inadvertent instrument meteorological conditions drills and pre-planned exit routes over recovery of visual meteorological conditions.

Flight crew and engineering teams should not rely solely on indicators, or absence of indicators, to determine airworthiness. If there is any reason to suspect exceedance of aircraft limits, operators should run diagnostics to determine the airworthiness of the aircraft beyond doubt.

People have a responsibility to aid their own rescue. Up-to-date registration of an EPRIB, and correct use of an EBIRB and other signalling equipment, simplifies a rescue of people in need. Australian Maritime Safety Authority guidelines exist to help people prepare for onshore and offshore remote area travel.

The occurrence

Incident flight

On the evening of 13 May 2018 at 1943 Central Standard Time,^[1] the Rescue Coordination Centre (RCC) tasked the crew of a Leonardo Helicopters AW139, registered VH-YHF, to locate an active emergency position-indicating radio beacon^[2] (EPIRB) 38 km north-east of Darwin Airport, Northern Territory. The EPIRB had been activated within the vicinity of a waterway called Salt Water Arm (Figure 1).

Figure 1: Map showing Darwin take-off point, search area, and location of incident event

Source: Google Earth annotated by the ATSB

The area was popular with recreational anglers, so the crew of VH-YHF anticipated responding to a boating event. They also determined that such a response would likely require use of the aircraft’s winch.

The crew configured the aircraft with the pilot on night vision goggles^[3] (NVG) in the front right seat, the aircrew officer (ACO) with NVG in the rear cabin by the right hand door, and the flight nurse in the rear cabin without NVG. Lighting within the cockpit and cabin was NVG-compatible. Two steerable searchlights mounted to the front, one steerable searchlight mounted to the right side of the aircraft, a handheld light operated by the ACO, and LED light bars at the front and rear of the helicopter supported the Night Vision Imaging System^[4] (NVIS).

At about 2000, the crew departed Darwin Airport with good visibility. At that time, a five-metre tide was receding from Salt Water Arm. There was little illumination as the moon had set at 1653, and the sun had set at 1830. There was limited celestial light available through the gaps in the clouds which were forecast as scattered^[5] cumulus and stratocumulus clouds at 2,000 ft, with cloud tops to 10,000 ft. Smoke from outlying grass fires drifted across the search area below 7,000 ft, reducing visibility to 4 km in places. The crew could not easily detect the smoke due to low illumination.

As the crew descended into the search area and commenced the search, smoke became evident as the task progressed. The ACO described visibility as 5 km but dropping in and out due to large amounts of smoke. These conditions are common for the region, and recent check flights for the crew had been conducted in similar conditions.

During the flight, the beam of the search light would reflect off smoke and ash. Backscatter from the beam was affecting visibility, reducing NVG image quality, and reducing peripheral vision. As a result, the beam required frequent adjustment. The ACO contacted the RCC and advised that limited visibility may hamper the operation.

The helicopter was fitted with direction-finding equipment (DF) which enabled the crew to locate the source of a 121.5 MHz beacon signal, such as the EPIRB. The crew found that readings from the DF were erratic and unreliable. This added a level of complexity to the operation, making it difficult to locate the beacon. As a result, the crew conducted a visual search for potential targets from a safe working height of above 800 ft above ground level (AGL).

While the use of NVG allowed the crew to detect targets, the image quality was not high enough to verify the targets from this safe working height. The crew had to fly the aircraft down to 400 ft AGL to verify whether their target was one requiring rescue. The crew flew the descent to the target visually, using searchlights to ensure the approach and departure paths were clear of obstacles. The intent was to decrease rate of descent and airspeed before activating auto-hover (HOV) mode at 400 ft AGL.

At 2110:30, the crew commenced an approach from the north to a point of interest in Salt Water Arm. The pilot reported visibility on approach to the target as good to the north-west, and dark to the north and east. During this approach, the pilot lost visual references. At 2110:40, the pilot activated HOV mode. At this time, the helicopter had already developed an undesired high rate of descent (Figure 2).

Figure 2: Flight path of VH-YHF during the event

Source: Leonardo interpretation of data from the Flight Data Recorder, annotated by ATSB

At the point of activation of HOV mode, the aircraft was at 430 ft, pitched 19.7 degrees nose-up, and descending at over 1,300 ft/min with a ground speed of 14 kt. The autopilot increased collective^[6] pitch to 48 per cent to arrest the rate of descent.

Due to the lighting installed on the aircraft, and prioritisation of peripheral vision, the ACO could see the ground below and advised the pilot of a high rate of descent. The ACO provided advice twice more to the pilot before transitioning to an emergency call of ‘Climb! Climb! Climb!’ The pilot was by now receiving clear visual cues and detected a rapid rate of closure with the ground.

At 2140:46, at a height of 280 ft with a rate of descent of 1,630 ft/min, in a reversion to drilled emergency procedures, the pilot overrode aircraft automatics and used forward cyclic^[7] and collective to reverse the rate of descent. The pilot directed his attention to the attitude indicator and the picture outside. The pilot increased collective pitch to 77 per cent. At this point, the rate of descent increased to 1,952 ft/min, indicative of onset of vortex ring state^[8].

Maintaining forward cyclic, the pilot was aware of engine temperature limits and made a small reduction in collective to avoid exceeding the limits, before increasing collective again to 84 per cent.

At 2140:50, a yellow caution light illuminated and a crew alert system (CAS) message appeared on the display. Occupied with the recovery procedure, the pilot flew solely through the outside picture and the attitude indicator. The aircraft descended to a height of 31 ft AGL before attaining a positive rate of climb. As the pilot’s recovery manoeuvre ceased and control inputs returned to normal, the warning self-extinguished at 2140:57. The pilot noticed the warning, but could not read it before it extinguished.

It is likely that any further delay in conduct of the recovery drill would have led to an impact with terrain.

Return to base

The crew advised the RCC that they would end the flight and return to base. The crew landed the helicopter back at base at 2158. The pilot found that ash had accumulated on the fuselage of the helicopter, confirming flight through streams of smoke. During the flight through smoke, visibility was reduced below the visual minima.

A crew debrief took place and it was thought that a main gearbox overtorque could have occurred. There is no capacity in the aircraft for the crew to check for overtorque without the presence of an aircraft maintenance engineer (engineer). As a precaution, and as per Operations Manual requirements, the crew called a duty engineer to explain the situation and seek advice.

The duty engineer asked the crew to check the CAS system for messages. If an overtorque occurred, a white status message saying ‘maintenance’ would be present. This would signal a requirement to download and analyse data from the aircraft’s central maintenance computer (CMC).

The pilot estimated the extent of a potential overtorque to be within operational limits. The crew did not detect a maintenance message. With this information, the duty engineer advised that no maintenance activity was required.

Subsequent mission flight

Prior to the mission’s second flight, the crew thoroughly discussed the event. They developed a different strategy for the search to prevent reoccurrence, including the use of topography over the DF.

At 2254, the crew departed for the second flight to locate the source of the EPIRB transmission. The crew flew the arms of the river system at 1,000 ft using the autopilot, with the pilot flying with reference to instruments, and the ACO visually searching from the back.

The EPIRB was successfully located and noted to be in the bottom of a 14 ft metal-hulled recreational fishing boat. The boat carried two people and was in total darkness. As the vessel was unlit, the ACO could see the EPIRB flashing in the bottom of the boat. The position of the EPIRB had most likely resulted in the sporadic readout of the DF.

The helicopter crew directed a nearby Northern Territory Water Police vessel to the scene. The Water Police were then able to assist.

Detection of main gearbox overtorque

The following day, the crew related the experience to an engineer in the hangar and requested a download of the CMC data to check for potential issues. An overtorque of the main gearbox is recorded when a torque limit is exceeded. The limits for all engines operative are 110 per cent for five minutes, or 121 per cent for 5 seconds.

The engineer downloaded and analysed the data. An overtorque in excess of 125 per cent requires grounding of the aircraft, and analysis of the data by the engine and airframe manufacturers. He found that a main gearbox overtorque to 159.5 per cent had occurred during the first flight. The extent of the overtorque was such that the helicopter should not have been flown until the engine and airframe manufacturers declared the helicopter serviceable.

The engineer grounded the helicopter and sent data to the manufacturers of the engines and airframe for analysis. This meant that the crew had departed for their second flight of the previous evening in an aircraft of uncertain airworthiness.

Five days later, the engine manufacturer confirmed that the engines were undamaged and suitable for service. The helicopter manufacturer advised that the helicopter’s main gearbox was serviceable and required inspection of oil for metal contamination at 50 flight-hour intervals. The engineers carried out the necessary actions, and subsequently returned the helicopter to service.

__________

1. Central Standard Time (CST): Coordinated Universal Time (UTC) + 9.5 hours.
2. EPIRB: Emergency Position-Indicating Radio Beacon. A distress beacon which, when activated, broadcasts a 406 MHz signal to a network of satellites, and a 121.5 MHz signal for homing in on by search and rescue assets.
3. Night Vision Goggles (NVG): A helmet mounted binocular device that intensifies ambient light, providing flight crew with improved vision at night.
4. Night Vision Imaging System (NVIS): a system of internal and external lighting, combined with night vision goggles, which provides enhanced vision to crew for operation at night.
5. Scattered clouds cover between three eights and one half of the visible sky.
6. Collective: a primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity.
7. Cyclic: a primary helicopter flight control that is similar to an aircraft control column. Cyclic input tilts the main rotor disc, varying the attitude of the helicopter and hence the lateral direction.
8. Vortex Ring State: an undesirable state of powered flight where the helicopter settles in its own downwash.

Context

Personnel

Pilot

The pilot had over thirty-seven years’ experience in flying helicopters. He held an Airline Transport Pilot Licence (Helicopter) and instrument rating (Helicopter), authorising him to conduct night visual flight rules^[9] (NVFR) and instrument flight rules^[10] (IFR) operations as pilot. The pilot had gained experience around the world in military helicopter operations, onshore and offshore resource support, mountain flying, search and rescue, and ambulance helicopter operations. He held a current Class 1 Aviation Medical Certificate.

Table 1: Pilot’s rotary-wing hours accumulated

Source: Pilot

The pilot had more than 100 hours’ experience in command with night vision imaging systems (NVIS) and held a grade 1 NVIS rating. The operator’s training and checking system evaluated the pilot as level 2 night vision goggles (NVG).

The pilot achieved currency with an NVIS proficiency check on 9 May 2018. Notes on file advised the pilot to seek practice opportunities in order to consolidate skills for future upgrade to a level 1 NVG pilot. The report also noted that a lack of opportunity to practice was preventing the pilot from making best use of the aircraft’s automated systems.

The pilot’s roster pattern was week-on, week-off, performing 24-hour standby while rostered on. The most recent pattern started on 09 May 2018. In the 4 days prior to the incident, the pilot had accumulated 27.3 hours of duty and 5.8 hours of flight time. Within the Operator’s Fatigue Risk Management System^[11] (FRMS), scores of 75 or less were considered consistent with safe working practices. The pilot’s score was 51. He reported feeling well and alert.

Aircrew Officer

The Aircrew Officer (ACO) had 23 years’ experience in crewing Search and Rescue (SAR) and Emergency Medical Services (EMS) helicopters as winch operator and down the wire rescue crewmember. He also held a Commercial Pilot Licence (Helicopter). His total experience in crewing helicopters was over 3,500 hours.

The ACO was NVIS and winch current, having undergone currency and proficiency flights on 10 and 12 May 2018. The Operator’s AW139 crewmembers all completed a pilot’s ground school course for the AW139. The ACO was trained and competent in front seat support and rear cabin activities. The ACO was rated as a Level 1 NVG crewmember within the operator’s system. He had over ten years’ NVIS experience, and he was part of a team that first integrated NVIS into company operations.

The ACO worked on a week-on, week-off, 24-hour standby roster. The ACO reported feeling well and rested at the time of the incident. The ACO’s score of 32 in the Operator’s FRMS supported this.

Flight Nurse

The Flight Nurse (FN) was a medical crewmember responsible for patient care, and not expected to be involved in the operation of the aircraft in flight.

Flight crew configuration

Exemption to operate with crewmember in rear cabin

The Civil Aviation Safety Authority (CASA) provided the Operator with an exemption to Supplement 60 of the AW139 rotorcraft flight manual. The exemption allowed the ACO to operate from the rear cabin of the aircraft during flight below 300ft and for landing at unimproved sites.

The Operator provided a risk analysis for landing at unprepared helicopter landing sites (HLS) under NVG to CASA in support of the exemption. For the descent and final approach phases, the identified risks were concerned with unintentional interference from the ground, obstacles, and loose objects. The helicopter manufacturer had no technical objection to the exemption on the provision that, amongst other things, the crewmember focussed on ensuring identification of obstacles.

Focussing on flight below 300 ft, the risk analysis provided for the initial exemption did not consider risks in the approach phase of flight relating to monitoring and the need for a single pilot to transition from outside goggle vision to instruments to supported peripheral vision. This exemption was later rendered unnecessary by an amendment to Supplement 60 in revision 22 of the AW139 rotorcraft flight manual on 19 October 2017. The manufacturer stated that they addressed risks during transition phase in the initial NVIS certification of the aircraft.

Climb-through

The Operator listed the responsibilities of an ACO in their operations manual as:

Under direction of the pilot assist with the operation of all aircraft equipment and systems during the conduct of VFR, NVG and IFR operations;

and

… operate the winch, dispatch, and recovery of personnel and assist the pilot in maintaining clearance from obstacles by lookout and reporting over the intercom.

Company ACOs could not carry out all of their duties from one location in the aircraft. The ACO had to climb between the front and back as operational requirements demanded. CASA’s position was that they supported the role of the ACO in the front left seat and did not support the transfer of the ACO from the front to rear of the cabin and vice versa in flight. CASA preferred operators to land for the ACO transfer through the aircraft to take place.

When responding to an emergency, the ACO would ordinarily begin the flight in the front and assist the pilot, then climb through to the rear to operate the winch as required. When an ACO used the climb-through, the company required the crew to file a report for data collection and analysis of the procedure.

On this flight, with no available landing sites on scene, and a short flight to the search area with anticipated use of the winch, the ACO began the flight in the back of the helicopter.

Aircraft information

General

Leonardo Helicopter’s AW139 is a medium-sized twin-engine helicopter powered by two Pratt & Whitney PT6C-67C engines (Figure 3). Each engine is capable of producing take-off power of 1,252 kW. Each engine produces enough power for the aircraft to climb in the event of one of the engines failing. The main gearbox’s maximum limit for power from both engines is 1,641 kW. Therefore, overtorque of the transmission can occur when a pilot demands excessive engine power with both engines operative.

VH-YHF

AW139 serial number 31108 was registered in Australia on 18 February 2008 as VH-YHF, and at the time of the occurrence had flown 3,423 hours. The helicopter was certified and maintained for IFR and NVIS operations.

The helicopter’s autopilot was a 4-axis system with enhanced 3-cue flight director (FD). The FD is capable of controlling the helicopter’s movement in the pitch, roll, yaw, and vertical axis. The installed version of the FD had auto-hover functionality (HOV) mode, yet did not offer SAR modes that can mark, return, and transition down to a selected target.

Figure 3: AW139 helicopter VH-YHF

Source: Careflight

Auto-hover

HOV mode incorporates two systems to hold the aircraft at a point in space selected by the pilot. The first system controls the pitch and roll of the aircraft to maintain a zero ground speed in all directions. The second uses the barometric altitude or the radio altimeter^[12] (RADALT) information and control of height to maintain the altitude selected by the pilot.

Aside from the panel-mounted autopilot controller, the pilot can activate both systems with the centre of the pitch/roll beep trim selector switch on the cyclic (Figure 4). With the airspeed below 75 kt, ground speed below 60 kt and altitude between 15 ft and 2,000 ft above ground level the system can be engaged. Engaging the system instructs the autopilot to make control inputs to bring the aircraft to a hover at the height showing on the RADALT at the time the pilot presses the switch. There was no vertical speed limit to engage HOV mode. The manufacturer did not intend for HOV mode to be engaged with a high vertical speed, though it did not preclude a pilot from doing so.

If engaged with a high vertical speed, the system would show as engaged and the autopilot would make adjustments necessary to attain the height designated by the pilot. This would induce a magnitude of overshoot relative to the vertical speed at time of engagement. A difference between the reference height and actual height would trigger a warning once large enough. For example, at a reference height of 500 ft, a message ‘HTLM’ appears on the PFD and ‘ALTITUDE, ALTITUDE’ sounds when the actual height passes below 430 ft.

Figure 4: Exemplar AW139 Cyclic and PFD showing HOV Mode engaged

Source: Leonardo Helicopters, annotated by the ATSB

Crew Alert System

The primary flight display (PFD) and the multi-function flight display (MFD) present instrumentation to the pilot (Figure 5). The PFD displays FD modes selected, and their status. The MFD displays engine and aircraft system data and the crew alert system (CAS). The CAS displays messages pertaining to the operation and condition of the aircraft to the crew for information and action.

Figure 5: Exemplar AW139 cockpit displays

Source: Leonardo Helicopters file photo, annotated by the ATSB

The CAS messages appear in order of priority. Red warnings appear at the top of the list, next are yellow caution messages, third are green advisory messages, and fourth are white status messages. The final line in the list is white text stating ‘END.’ Each page shows twelve lines and crew can scroll through pages. When scrolling, red warnings cannot be hidden and remain at the top of the list on each page.

A warning or caution message will show with a coloured background until acknowledged. Once acknowledged, it appears as coloured text on a black background. Some messages such as “XMSN OVTQ” (main transmission overtorque) will disappear when the condition causing them has passed. White status messages will only show on the ground with weight on wheels (Figure 6).

The “MAINTENANCE” message is significant because following exceedance of a limit such as torque, it will illuminate after landing. The presence of the “MAINTENANCE” message is a cue to an aircraft maintenance engineer (engineer) to investigate and rectify the cause of the message before cancelling the message.

Figure 6: Exemplar caution light and maintenance message on CAS

Source: Leonardo Helicopters, annotated by the ATSB.

Night vision imaging system

To improve vision during night operations, the helicopter crew utilised an NVIS. The operator was experienced in application of these technologies. They trained their own crews and offered NVIS training to other operators.

The operator’s NVIS comprises:

• AN/AVS-9 green phosphor Night Vision Goggles (NVG)
• NVG-compatible cockpit lighting
• NVG-compatible cabin lighting
• 2 x 450 W incandescent forward facing steerable search lights
• 1 x 450 W incandescent steerable search light by winch
• White flood lights at the front and back of the aircraft.

The operator mandated the use of NVIS for all visual flight rules (VFR) flights at night.

Goggle position

The human eye carries two sets of light-sensitive receptors: rods and cones. The cones are packed into the fovea, the central part of the retina responsible for focal vision. The rods populate the area of the retina used for peripheral vision. The way in which information from the focal regions and information from the peripheral regions is processed differs significantly (Miller & Tredici, 1992).

Peripheral vision is processed automatically and quickly. Humans utilise peripheral information to orientate themselves within their environment without even noticing. Focal vision requires conscious processing, which happens slowly and takes up cognitive resources (RTCA, 2001). The information delivered to the user through NVG is largely within the focal region. The cognitive resources required take away from other tasks requiring focal vision, such as interpretation of instruments (Salazar et al, 2003).

NVG offer a field of view (FOV) of 40° vertically and horizontally, much narrower than the 200° horizontally and 120° vertically most humans experience (Morawiec and others, 2007). Goggles are normally adjusted to a point where the central image is sharp, and the edge of the picture is slightly blurred yet becomes sharp when focussed upon. This puts the eyepiece approximately 25 mm from the eye.

This operator advised that they extend the NVG further away from the eye again. This reduces the FOV by a couple of degrees and increases the amount of peripheral vision available. This, in combination with copious white light, provides for increased peripheral vision when looking around the goggles below 400 ft in the obstacle environment.

This provides benefit in spatial orientation in low-level hover operations. The effect will be lost if peripheral cues become unreliable and obscure the target, such as happens with backscatter from obscurants like smoke.

White light

The use of white light is fundamental to this operator’s NVIS usage strategy. NVG-friendly^[13] searchlights do not help in obstacle clearance as the NVG do not detect the light reflected by obstacles in the vicinity. White light (detectable by NVG) is amplified by the goggles and provides a clear image of where obstacles are. The crew moves the lights in a ‘scan and pause’ pattern with a wide swath either side of the planned approach and departure paths looking for obstacles.

The combination of peripheral vision and white light likely aided the ACO in his assessment of rate of closure and enabled his timely use of emergency phase Crew Resource Management (CRM).

NVIS approach procedure

Overhead the HLS or point of interest, the pilot marks the target on the GPS. The pilot then flies a circuit at 1,000 ft to set up an approach to the spot. Since the visual acuity afforded by the goggles does not provide ground cover detail until a height of 400 ft, the pilot must use instruments to monitor the progress of the aircraft, as per normal night flight procedures. The company operations manual highlights three critical instruments for the initial stage of the approach:

• attitude indicator, to avoid incorrect attitude adversely affecting airspeed and rate of descent
• vertical speed indicator, to make up for the reduced visual cues for rate of descent
• radio altimeter, to incorporate a visual and audible warning that is set at 400 ft as a defence against unexpected rates of terrain closure

The pilot manually flies to a datum point of 400 ft above ground level (AGL) to attain the visual acuity required to identify the target. It is common to come to a hover at 400 ft to complete the reconnaissance and crew brief. The pilot can select HOV mode to pause. If there is a need to descend to winching height, the crew scans the approach and departure paths with searchlights using a ‘stop, scan, move’ process.

Once clear, the crew agrees to continue and the pilot eases the aircraft forward and down with the autopilot. ACO and pilot will work together to bring the aircraft to the best hover reference.

Meteorological information

During the shift, the pilot monitored weather reports and weather forecasts from sources at Darwin and surrounding airports, and the Bureau of Meteorology (BoM). The Aerodrome Forecast (TAF) for Darwin airport, valid for the duration of the flight, forecast wind as 6 kt from the south‑east, visibility of 10 km or greater, nil significant weather, and nil significant cloud below 5,000 ft. The aerodrome report matched the forecast precisely with the exception of showing wind to be 5 kt.

The BoM issued a Graphical Area Forecast (GAF) at 1332 Central Standard Time (CST), which carried a validity from 2030 CST for six hours. The planned operation was within area B2, and the operations were close to the boundary with B1. The GAF forecast scattered cloud with base 2,000 ft and tops to 10,000 ft in the area of B1. The forecast for the area B2 was visibility over 10 km reducing to 5,000 m with isolated areas of smoke below 7,000 ft. The crew reported that some of the conditions associated with B1 existed in their area of operation.

At 1923 CST, BoM published a new GAF. The new GAF showed visibility of 10 km reducing to 4,000 m with isolated areas of smoke below 7,000 ft in B2. Pilots utilising NVG must maintain visibility of 5,000 m at or above 500 ft above terrain or obstacles (Civil Aviation Order 82.6). In areas of smoke, visibility could be expected to be below that required for VFR flight at night.

Environmental conditions

On the night of the incident, there was very little celestial illumination. The moon had set at 1653 CST, and the sun had set at 1830 CST. The only light was starlight. Clouds obscured much of the starlight available.

Grass fires had been burning to the southeast of the region for several days. Smoke from the outlying grass fires drifted across the search area below 7,000 ft, reducing visibility in places. The operations manual mentioned smoke as a common cause of loss of visual reference, and pilots were required to memorise loss of visual reference drills.

The crew reported that these conditions had prevailed for a week. Training notes from a flight three days prior described similar conditions. The report stated:

…this flight was conducted on an especially difficult NT typical night – no moon, very low illumination, and smoke contamination.

Where operationally viable, the crew flew the helicopter above the smoke inversion, which they reported to be at around 1,000 ft.

Risk management of deteriorating weather and loss of visual references

The operator’s risk management profile recognised the risk of deteriorating weather and loss of visual references during a SAR operation. Among the potential consequences was loss of control leading to an aircraft accident. The management of the risk included controls for prevention of an occurrence, and for recovery should the event occur.

Prevention controls

Documented controls for the prevention of loss of visual references were:

• Training and checking, to ensure that crews have relevant experience of similar conditions, all crew know how to assist in the approach and landing phase, and that procedures are being correctly followed.
• Maintenance of good CRM, to ensure effective mission management and decision making aboard the aircraft.
• Keeping the ACO current to assist the pilot with management of the flight.

Recovery controls

Recovery controls covered four aspects of operation:

• Equipment fit, ensuring that the aircraft is appropriately equipped and has a functioning RADALT and Attitude Indicator.
• Sound knowledge of procedures and limits for visual illusions and inadvertent instrument meteorological conditions (IIMC).
• Crew preparedness: Use of simulator training to ensure crews have exposure to implementing correct technique in recovery procedures.
• Crew Resource Management: Ensuring unambiguous and timely communication in situations requiring urgent action.

Beacon activation

Activating an emergency position-indicating radio beacon (EPIRB) begins a distress signal transmission on the 406 MHz frequency, which is detected by satellites. The transmission contains a code that identifies the registered owner of the EPIRB in a database. The Rescue Coordination Centre (RCC) can use the registration details to source information on the activation of the beacon, and contact the owner or a nominated emergency contact.

In this case, the EPIRB belonged to a Queensland-registered vessel, which was sold some time before without re-registration of the EPIRB. As a result, the RCC had no current contact details or information for the current owner of the EPIRB.

EPIRBs in Australia also transmit on the 121.5 MHz frequency. Search and Rescue Assets carry direction-finding (DF) equipment to home in on 121.5 MHz signals. When the beacon is correctly deployed, the DF shows the crew the direction the signal is coming from.

Similar occurrences

AO-2007-028

On 22 July 2007, the crew of a Bell 412 were searching for the source of an EPIRB transmission. The pilot was IFR-rated and the aircraft IFR-equipped. The crew were operating on a dark night with searchlights without NVG. There was smoke from active bushfires in the area.

During the approach, the pilot lost visual references due to the haze from smoke and dust in the atmosphere. The helicopter entered a high rate of descent. The aircrew officer called ‘zero airspeed.’ The pilot initiated recovery actions and the main gearbox was over-torqued in the recovery.

There was a landing site available and the pilot continued the approach from 200 ft AGL and inspected the helicopter after landing. The Bell 412 had a physical indicator that clearly indicated to the crew that overtorque had occurred.

AO-2009-077

In December 2009, the crew of a Bell 206L was conducting aerial work on a fire ground. The pilot was not IFR-rated and helicopter was not IFR-equipped. On take-off, the helicopter entered low cloud. The pilot lost control and the aircraft collided with the ground; the pilot was seriously injured and the passenger was fatally injured. There was no option for the pilot to conduct an IIMC drill to stabilise the aircraft and attain a safe profile.

AO-2016-160

On 21 October 2016, the crew of a BK 117-C2 were returning to base from carrying out an EMS mission. The pilot was IFR-rated and the aircraft was IFR-equipped. The flight was conducted under NVFR with NVIS. Conditions were marginal, and on departure, the helicopter entered low cloud.

The ACO declared loss of visibility on take-off. The pilot had poor visibility ahead yet could see well to the right. The pilot thought visibility would improve as they passed ground lighting that was reflecting in raindrops on the canopy.

The visibility did not improve, and the pilot slowed the aircraft to maintain visual meteorological conditions. The low-speed manoeuvre resulted in an undesired aircraft state and a terrain awareness warning activated. The pilot conducted an IIMC drill, restabilised control, and continued the flight before landing safely.

Aeromedical flights in the United States

In an analysis of aeromedical flights in the US, Aherne and others (2016) found that between 1995 and 2013, the US aeromedical industry had 32 fatal accidents resulting in 100 deaths. These flights were all single-pilot operations at night. All flights were operated under VFR, and two thirds of the fatal accidents occurred in instrument meteorological conditions (IMC).

__________

9. Night Visual flight rules (NVFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going, at night.
10. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft to operate in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR). Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
11. Fatigue Risk Management System (FRMS): defined by ICAO as "a data-driven means of continuously monitoring and maintaining fatigue related safety risks, based upon scientific principles and knowledge as well as operational experience that aims to ensure relevant personnel are performing at adequate levels of alertness".
12. Radio Altimeter: a device that detects phase shift between a transmitted and a reflected radio signal, to calculate the height of the aircraft from terrain directly below it. Also known as Radar Altimeter.
13. NVG-friendly: a light system that excludes frequencies detected by the NVG. The intent is for a light to be available for crews that does not dazzle the NVG wearer.

Safety analysis

Introduction

During an approach to a potential search and rescue target, smoke from nearby bushfires affected the visibility for the flight crew. The helicopter developed an uncommanded high rate of descent, and the aircrew officer in the rear alerted the pilot, at which point a recovery was enacted. The recovery manoeuvre resulted in an airframe limitation exceedance, which went undetected for the subsequent flight.

This analysis will examine the operator’s risk management, degraded visual environments, single pilot operations, and airframe limitation exceedance management.

Operator’s risk controls

On this occasion, prevention controls failed and recovery controls worked to save the aircraft and crew. There were, however, gaps in the implementation of all of the documented controls:

• Training and checking achieved the aim of creating relevant experience, yet an identified limited practice opportunity reduced efficacy.
• Crew resource management (CRM) lapsed in a missed announcement of loss of visual references. CRM was, however, restored to good effect in recovery.
• The aircrew officer (ACO) was trained yet not positioned to assist the pilot in managing the approach.

There were no preventative controls that helped crews to define limits of visibility beyond the description of visual flight rules (VFR) minima.

The operations manual stated:

Illumination levels are significantly affected by moon position and strength, cloud presence, and cultural lighting and during NVG operations; illumination levels have a profound effect on the ability of the NVG to clearly discern terrain at distance. Visibility is also affected by the usual day time issues of dust, snow, moisture, bushfire smoke and other atmospheric obscurants.

However, the operations manual offered no guidelines on interpretation of factors affecting visibility or definition of acceptable limits. This meant the crew had to interpret marginal conditions during operations and decide if the minima were sufficient. This meant that the organisation did not set its own tolerance for risk in this regard.

During the event, CRM, the well-rehearsed recovery drill, and use of the attitude indicator were all vital in recovering control of the aircraft. The documented and implemented recovery controls worked as intended.

Contribution of night vision imaging system

Studies have shown that night vision goggles’ (NVG) performance can lead pilots to revert to a daytime model of operation (Rash, 2010), leading them to overlook the threats and complexities of operating with NVG. The operator’s operations manual clearly reminded crew that NVG does not turn night into day, and that the use of NVG carries limitations and risk.

Low-contrast Terrain

The search area was an area of low-contrast terrain for night vision imaging systems (NVIS) operations. This meant that elements of the terrain reflected similar amounts of celestial light, creating a low-quality image in the NVG. This lack of detail reduced visual cues. The reduction in visual cues most likely led to difficulty in perceiving the aircraft’s attitude and estimation of terrain clearance (Parush et al., 2011).

Obscurants

Airborne particles affect the image that NVG produce. The cues that would normally be relied upon for loss of visual meteorological conditions (VMC)^[14] may not be present. Operating unaided, light sources begin to disappear as obscurants increase. Under NVG, as obscurants reduce the light energy reaching the goggles, NVG will continue to amplify the light signal, disguising the worsening visibility (see CAAP 174-01 11). There will be steady reduction in image quality outside of the bright spots as signal to noise ratio reduces. Scintillation^[15] in the image will occur.

Sighting pinpoints of bright light over long distances does not mean that visibility is in excess of 5 km. Visibility must be measured by the distance detail can be seen on the ground. If a pilot using NVG can see lights but no ground detail, they may be in or very close to instrument meteorological conditions (IMC).^[16] An early decision to use a recovery drill if visual references are lost is also vital to ensure entry into IMC does not develop into a loss of control or controlled flight into terrain.

Degraded visual environment

Conditions of degrading visibility create ambiguity. This ambiguity can stall decision-making, as two contextually different situations are faced (Orasanu and others, 2001). Either the approach continues and the target is assessed, or the approach is aborted and the mission is delayed.

Pilots rely on appropriate visual cues to assess quickly and accurately the aircraft’s current and future situation. Darkness, even while utilising a NVIS, reduces availability of these cues. No one is immune to these phenomena and strict adherence to an instrument scan on night approach is the primary protection available.

Pilots tend to underestimate the likelihood of loss of control and overestimate their ability to continue to control the aircraft if visual references are lost (Wiggins and others, 2012). The cues for IMC are an absence of those for VMC. The search area for cues to resolve the ambiguity is external to the aircraft, and as such, attention can be drawn outside (Summerfield & Egner, 2009).

Humans also often incorrectly believe that changes will be easy to detect in their environment. Unless someone observes a change while it is taking place, there is a good chance it will not be picked up (Wickens & McCarley, 2008). While searching outside for cues, changes on instruments can be missed. These missed changes can lead a pilot to believe that their knowledge of their position and trajectory in space is accurate. This belief leads to a reduction in the search for new information or information to the contrary (Wickens & McCarley, 2008).

Above 400 ft, the approach should be predominantly made with reference to instruments (see CAAP 174-01 D.3). The pilot was primarily using goggle vision and looking outside. The narrow field of view of the NVG’s requires a demanding and deliberate scan pattern to integrate the outside with instruments. As the pilot slowed to below 45 kt with reducing visual cues, the picture outside was not giving enough information to manage the closure rate of the aircraft. This resulted in a loss of the ability to recognise, with any accuracy, the aircraft’s position and trajectory.

Single-pilot operation

Monitoring is a fundamental tool to boost threat and error management (Flight Safety Foundation, 2014). Furthermore, inadequate monitoring is related to a high number of approach and landing accidents. While there is a clear benefit to multi-crew operations, there is no requirement for multi-crew in Australian search and rescue (SAR), and emergency medical services (EMS). SAR/EMS Operators in Australia tend to perform reduced crew flight operations, whereby extra crewmembers are called upon only for periods of vulnerability.

Crew in the back of an AW139 cannot hear alarms from the cockpit. The 400 ft warning from the Radio Altimeter (RADALT) and the 150 ft warning from the aircraft are only available to front seat crew. The aircraft descended through 400 ft at 1,430 ft/min. The pilot resumed manual control at the time of the emergency climb call as the aircraft passed through 280 ft, 3.5 seconds later.

Had there been a second person in the cockpit monitoring the approach, their first indication of a loss of visual reference, if not announced by the pilot, would most likely be an unusual combination of attitude and vertical speed. The aircraft had developed an unusually high 900 ft/min rate of descent 12 seconds before passing through 400 ft. This information may take a monitoring Aircrew Officer (ACO) a second or two to process. Once processed, however, the aircrew officer (ACO) is in a position to call for a go-around, and to provide accurate information to the pilot regarding the aircraft state much sooner in the sequence.

While facing a high risk of encountering a degraded visual environment, the requirement to have the ACO in the rear cabin for winch operations degraded the crew’s defences against loss of control. The addition of another trained crewmember would be an ideal risk control for operations in potentially degraded visual environments.

Caution and maintenance messages

There is no option for the crew to review caution messages once the message has self‑cleared, or to interrogate the system to discover the extent of any exceedance. As the main transmission torque limit exceedance message (XMSN OVTQ) was missed because it appeared during a time of high workload in flight, the crew could not know of the nature and extent of the exceedance without the support of an aircraft maintenance engineer (engineer).

The crew and the engineer who downloaded the data the following day reported that no maintenance message was detected on the crew alert system (CAS). Analysis of the central maintenance computer (CMC) log showed that eight minutes before the incident flight, a maintenance message activated for 41 seconds. A maintenance message again illuminated four minutes after landing for 31 seconds until shutdown.

The crew reported that the maintenance message was overly generic and related to a host of issues, ranging from critical to inconsequential. The only way to determine the meaning of the message was for an engineer to access the CMC through a laptop. Given the remote locations and 24‑hour nature of operations, engineer access was often impractical, and some telephone diagnosis had to take place.

Additionally, a software update had previously caused issues by instructing the aircraft that equipment it did not have was fitted. As a result, numerous maintenance messages related to the failure of the non-existent equipment were seen. This nuisance message issue was resolved 6 months prior to the event.

These nuisance alerts and generic nature of the message could combine to dilute the significance of the maintenance message and reduce the likelihood that crews would seek out and respond to genuine alerts.

Automatic hover mode use

The autopilot’s automatic hover (HOV) mode fitted to the helicopter could be engaged while the helicopter had a high rate of descent. If this system was not explicitly understood, the pilot may believe that HOV mode had adequate control of the aircraft upon activation. It would display as engaged even though it could be subject to a considerable overshoot, outside of the system’s capacity to recover before impact with terrain. At the height engaged, the mismatch between reference height and actual radar height would have triggered a PFD message ‘HTLM’ and an aural callout of ‘ALTITUDE, ALTITUDE’ after about 2.5 s, as the aircraft passed through a point between 39 ft and 70 ft below the reference height. The pilot input came 4.2 s after engagement of automatic hover. Without the correct mental model of HOV mode operation, time taken to interpret autopilot performance may have delayed manual recovery actions.

Beacon registration and placement

When the vessel was located, the crew saw the emergency position-indicating radio beacon (EPIRB) laying in the bottom of the boat and not deployed as per Australian Maritime Safety Authority guidance. This resulted in a scattered signal and created inaccuracies in the operation of the Direction Finder (DF). The crew could not resolve the direction of the beacon.

The lack of accurate registration details and sporadic output of the DF caused distraction to the crew and increased their time to find the target. The result for the crew was that they were required to identify a number of targets and make approaches to them for visual identification. This increased the complexity and time taken to complete the operation.

Figure 7: Correct EPIRB placement following activation

Source: Australian Maritime Safety Authority
__________

14. Visual Meteorological Conditions (VMC): an aviation flight category in which visual flight rules (VFR) flight is permitted – that is, conditions in which pilots have sufficient visibility to fly the aircraft while maintaining visual separation from terrain and other aircraft.
15. Scintillation: rapid changes in brightness at random points which to the viewer looks like a sparkling effect across the image.
16. Instrument meteorological conditions (IMC): weather conditions that require pilots to fly primarily by reference to instruments, and therefore under Instrument Flight Rules (IFR), rather than by outside visual reference. Typically, this means flying in cloud or limited visibility.

Findings

From the evidence available, the following findings are made with respect to the loss of control of a Leonardo Helicopters AW139, registered VH-YHF, on 13 May 2018, and the subsequent release of the aircraft without a required inspection. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• During the search for a transmitting beacon, the helicopter crew planned to approach to a hover near a target. However, low celestial illumination and drifting smoke created a high risk of encountering a degraded visual environment. This resulted in a loss of visual references on approach.
• During the approach to hover in a degraded visual environment, searching outside for visual cues drew the pilot’s attention away from the flight instruments. This resulted in flight instruments not being referenced when they were needed.
• The required position of the aircrew officer in the rear of the helicopter prior to descent negated the benefit of having a trained and competent crewmember to assist the pilot, resulting in a degraded monitoring capability in the approach to hover.
• While on approach in a degraded visual environment, without the protections of flight instrument use or monitoring, the helicopter entered an uncommanded, undetected high rate of descent, resulting in a transmission overtorque during recovery.

Other factors that increased risk

• Auto hover had no design limit on vertical speed for engagement, which permitted overshoot following engagement with high rate of descent.
• As the aircrew could not confirm the existence of an exceedance, and a maintenance message was not detected on the Crew Alert System, the aircraft was operated despite requiring an inspection.

Other findings

• Application of good Crew Resource Management and practiced recovery techniques supported the crew in restoring control.
• The emergency position-indicating radio beacon was not registered to the current owner, and was incorrectly placed in the boat. The placement scattered the beacon's signal, leading to loss of accuracy in direction-finding equipment. As a result, mission complexity and time taken to rescue were increased.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot and crew
• Careflight
• Aviation Specialities Unlimited
• the Bureau of Meteorology
• Airservices Australia
• Leonardo Helicopters
• the Civil Aviation Safety Authority.

References

Aherne BB and others, 2016, Pilot Domain Task Experience in Night Fatal Helicopter Emergency Medical Service Accidents, Aerospace Medicine and Human Performance. 87(6). 550-556.

Arthur W and others, 1998, Factors That Influence Skill Decay and Retention: A Quantitative Review and Analysis, Human Performance. 11(1), 57-101.

Australian Transport Safety Bureau, 2004, ASR B2004/0152, Night Vision Goggles in Civil Helicopter Operations

Bailey RE and others, 2017, An Assessment of Reduced Crew and Single Pilot Operations in Commercial Transport Aircraft Operations, 2017 IEE/AIAA 36th Digital Avionics Systems Conference, St Petersburg

Biggs AT and others, 2015, Examining perceptual and conceptual set biases in multiple-target visual search, Atten Percept Psychophys. 77. 844-855.

Civil Aviation Authority, 2013, CAP 739, Flight Data Monitoring

Civil Aviation Safety Authority, 2017, CAAP 174-01 v2.1, Night vision imaging – helicopters

Dismukes RK & Berman B, 2010, Checklists and Monitoring in the Cockpit: Why Crucial Defenses Sometimes Fail, National Aeronautics and Space Administration, Moffett Field

Ersting J & King P, 1995, Aviation Medicine, 2nd ed., Butterworth-Heinemann Ltd, Oxford.

Flight Safety Foundation, 2014, A Practical Guide for Improving Flight Path Monitoring, Washington.

Flight Safety Foundation, 2018, Position Paper: Pilot training and competency, Alexandria.

Miller RE & Tredici TJ, 1992, Night Vision Manual for the Flight Surgeon, Armstrong Laboratory, AL-SR-1991-0002

Morawiec G, Niall KK & Scullion K, 2007, Distance estimation to flashes in a simulated night vision environment, Defence R&D Canada, TR 2007-143

Orasanu J & Martin L, (1998). Errors in aviation decision making: A factor in accidents and incidents. In Proceedings of the Workshop on Human Error, Safety, and Systems Development. 100-107.

Orasanu J, Martin L & Davison J, (2001). Cognitive and contextual factors in aviation accidents, in Salas E and Klein G (Eds.) Linking expertise and naturalistic decision making, Lawrence Erlbaum Mahwah NJ. 209–226.

Parush A, Gauthier M, Arseneau L & Tang D, (2011). ‘The Human Factors of Night Vision Goggles Perceptual, Cognitive, and Physical Factors’, Reviews of Human Factors and Ergonomics. 7. 238-279.

Previc FH & Ercoline WR, 2004, Spatial Disorientation in Aviation, American Institute of Aeronautics and Astronautics, Inc., Reston.

Rash CE, 2010, ‘Lighting Up the Night’, Aero Safety World. August 2010. 14-18.

Robson D, Night Flight, 2008, Aviation Theory Centre, Cheltenham.

RTCA 2001, Concept of Operations: Night vision imaging systems for civil operators, RCTA/DO-268, RTCA, Washington, D.C.

Salazar G and others, 2003, Civilian use of night vision goggles, Aviation Space and Environmental Medicine. 74. 79-84.

Summerfield C & Enger T, 2009, Expectation (and attention) in visual cognition, Trends in Cognitive Sciences. 13(9). 403-409.

Wickens CD & McCarley JS, 2008, Applied Attention Theory, CRC Press, Boca Raton

Wiggins MW and others, 2012, ‘Characteristics of pilots who report deliberate versus inadvertent visual flight into instrument meteorological conditions’, Safety Science. 50(3). 472-477.

Wiggins MW and others, 2014, ‘Cue-utilisation typologies and pilots’ pre-flight and in-flight weather decision-making’, Safety Science. 65. 118-124.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority, the Bureau of Meteorology, Leonardo Helicopters, the crew of VH-YHF, engineers for VH-VHF, and Careflight.

Submissions were received from the Civil Aviation Safety Authority, the Bureau of Meteorology, Leonardo Helicopters, the crew of VH-YHF and Careflight. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A: Flight data

Figure 8: Incident flight data

Source: Operator / Leonardo Helicopters, annotated by the ATSB

Figure 9: Incident flight data

Source: Operator / Leonardo Helicopters, annotated by the ATSB

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 15 May 2018, at 1903 Eastern Standard Time, a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one flight instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.

What the ATSB found

The ATSB found that the pilot, who was conducting his first night training flight, likely became spatially disorientated during a go-around manoeuvre, which resulted in a loss of control at low level and collision with terrain.

The flight instructor did not intervene to take control of the aircraft during the go-around manoeuvre, because she was not aware the pilot had become spatially disorientated and was accustomed to directing the pilot to correct control problems. Inconsistent with Civil Aviation Safety Authority guidance, the instructor, who had previously instructed the pilot for his private instrument rating, did not provide a night flying demonstration before directing the pilot around the circuit.

Safety message

It is important for flight instructors to provide a demonstration when introducing a pilot to a new flight sequence or new flight environment. Time spent demonstrating the key points of a new sequence or environment will usually improve the learning process by ensuring that the development of a new skill is supported and preceded by knowledge and understanding from experience.

The flight instructor reported that for the delivery of future initial night flying training, she would conduct either a separate session of daytime flying training circuits prior to night, or deliver the training as day-into-night circuit training. She also commented that, prior to teaching night flying, flying training organisations should consider conducting refresher training in unusual attitude recoveries, irrespective of a pilot’s level of experience and qualifications.

The occurrence

On 15 May 2018, at 1903 Eastern Standard Time,^[1] a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one flight instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.

The pilot held a private instrument rating and the accident flight was the pilot’s first training flight for a night endorsement to be added to his rating.^[2] The instructor arrived at the hangar in the evening, just as the pilot was completing his pre-flight inspection of the aircraft. They completed the inspection together and then the instructor delivered a night flying brief to the pilot. The briefing included the physiological effects of the night environment, procedural differences for the night circuit, and the instrument and visual sections of the night circuit, which included the need to transition onto instruments on rotation during take-off.

The pilot and instructor boarded the aircraft and completed all the checklist items on the multi‑function display (MFD). The wind appeared to be light and variable and they selected runway 11 for the circuits. The pilot activated the runway lighting while taxiing,^[3] which also provided precision approach path indicator (PAPI) lighting.^[4]

The instructor directed^[5] the pilot throughout the first touch-and-go^[6] circuit to runway 11, which she considered was flown to a good standard with the pilot responding to her direction. On the second circuit, at about 500 ft above ground level on approach to land, the pilot and instructor noted the approach was too steep. The pilot, with direction from the instructor, corrected the approach and they both observed two‑white and two-red PAPI lights on short final approach, which indicated they were on the correct approach path. The pilot flared the aircraft a ‘little high’ for the touchdown, and the aircraft bounced twice. The pilot elected to go-around and applied full power before touching down again.

When full power was applied, the aircraft pitched^[7] up. As the pilot was attempting to transition his scan onto the instruments, the instructor, whose attention was on the attitude indicator,^[8] directed him repeatedly to level the wings—‘wings level’. The pilot observed the runway lights disappear off to the right and felt the aircraft was in a roll^[9] as he was trying to focus his attention on the attitude indicator.^[10] Following a review of the ATSB’s draft investigation report, the pilot also reported that he manipulated the flight controls in an attempt to recover the aircraft. Shortly after, the aircraft collided with the ground, struck a fence and came to rest inverted.

The pilot reported that he ‘kicked the pilot’s door window out’ to exit the aircraft, at which stage the wings were alight and a grass fire had started.^[11] He then pulled the instructor out of the wreckage, who had lost consciousness after becoming disorientated while looking for the emergency egress hammer.^[12] Emergency services located at the airport immediately responded to the accident. Figure 1 shows the wreckage site with reference to runway 11. Weather conditions were not considered a contributing factor to the accident.

Figure 1: VH-PDC wreckage

Source: ATSB

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. A pilot who has a private instrument rating is authorised to operate at night under the instrument flight rules only if that pilot holds a night private instrument endorsement.
3. Pilot activated lighting (PAL) is activated by a pilot keying a series of transmissions, within a specified timeframe, on a specified radio frequency.
4. PAPI is a visual aid that provides pilots with guidance on acquiring and maintaining the correct approach path to a runway. The system consists of four side-by-side lights positioned next to the runway. When the aircraft is on the desired approach path (3°), two red and two white lights will be visible. More than two red lights indicates the aircraft is low on approach, and more than two white lights indicates the aircraft is high.
5. Airborne instruction is based on a building block approach using demonstrate, direct then monitor. The instructor flies the sequence in demonstrate, provides verbal commands to the student in direct and observes the student’s progress in monitor.
6. A procedure whereby an aircraft lands and takes off without coming to a stop.
7. Pitching: the motion of an aircraft about its lateral (wingtip-to-wingtip) axis. Increased thrust over the tailplane will increase the tailplane down force and pitch the nose upward.
8. Attitude indicator is a primary flight instrument, which displays the aircraft pitch and roll against an artificial horizon.
9. Rolling: the motion of an aircraft about its longitudinal axis.
10. The Cirrus SR22 aircraft’s propeller rotates clockwise, as viewed from the pilot’s seat. Therefore, an increase in power will increase the engine torque reaction and propeller slipstream. Without pilot input, the natural response from the aircraft is to roll and yaw (motion of an aircraft about its normal axis) to the left.
11. The fence was electrified, but it was not determined if the fence or the engine was the ignition source for the fire.
12. An eight-ounce ball-peen type hammer is located in the centre armrest. If the cabin doors are jammed or inoperable, the hammer may be used to break through the acrylic windows.

Context

Pilot information

The flight instructor held a valid Commercial Pilot Licence (Aeroplane), a Grade 1 flight instructor rating, an instrument rating and a night visual flight rules rating. She had a total flying experience of about 4,200 hours and last completed a flight review on 3 December 2017.

The pilot held a valid Private Pilot Licence (Aeroplane) and a private instrument flight rules rating. He last completed a flight review on 11 March 2017 (private instrument rating), had accrued about 500 hours on Cirrus aircraft, and about 50 hours of instrument flight time. The pilot had conducted the majority of his training and subsequent flying from Orange Airport, where his aircraft had been hangered.

Closed-circuit television footage

Closed-circuit television footage from Orange Airport depicted the aircraft rolling left at a low height above runway 11 before impacting the ground on the north-east side of the runway at 1903. A small fire ensued after impact, followed by deflagration of the fuel vapour about 7 seconds later. About 9 minutes later, the CAPS^[13] rocket fired. Figures 2, 3 and 4 depict the initial roll of the aircraft, deflagration of the aircraft fuel vapour and firing of the CAPS rocket.

Figure 2: VH-PDC in left roll

Source:  Orange City Council, annotated by the ATSB

Figure 3: Deflagration of fuel vapour

Source:  Orange City Council

Figure 4: CAPS rocket

Source:  Orange City Council, annotated by the ATSB

Aircraft information

Electronic stability and protection

Before take-off, the pilot checked the aircraft’s autopilot and then switched it off. When the autopilot is switched off, the aircraft’s electronic stability and protection (ESP) system is operational. The ESP system automatically activates the autopilot servos to recover the aircraft from excessive roll and pitch attitudes.

The ESP roll protection activates at 45° roll angle, reaches a maximum stick force at 50°, and disengages when the roll angle reduces to 30°. The ESP pitch protection engages at 17.5° nose up, reaches a maximum stick force at 22.5° and disengages at 12.5°. Although the ESP uses the autopilot servos to drive the controls, the pilot retains the ability to override the system.

Recorded data

VH-PDC carried a Garmin G1000 avionics package, and a Recoverable Data Module (RDM). The G1000 is capable of recording various parameters to a secure digital (SD) card, installed on the upper slot of the MFD. The same information is recorded to the RDM, which is an impact and fire resistant unit,^[14] installed on the vertical fin spar. The RDM and MFD modules were removed from the aircraft for examination by the ATSB.

The RDM was recovered from the severely fire damaged fin. The rear portion of the module was exposed to a high temperature and showed external heat damage. Disassembly of the crash hardened enclosure to access the data storage components revealed extensive fire damage to the memory devices. No data was recovered from this device.

Initial observations of the MFD SD card slots revealed they were substantially fire damaged and retained two SD cards; the top slot contained the data logging card, the bottom slot contained the Garmin database card. To access the cards, the MFD was disassembled, and the circuit board holding the two cards was removed. The data logging card was found to be substantially damaged (Figure 5). The encapsulated memory device was removed from the data logging card and cleaned. The data logs were then extracted with a modified SD card reader. A total of 241 flight logs were recovered, including the accident flight (Figure 6).

Figure 5: Data logging SD card

Left: Removed MFD slot with data logging SD card. Right: removed data logging card with card memory identified. 
Source:  ATSB

Figure 6: Recovered accident flight data

Source:  ATSB

The recovered flight data indicated that after touchdown, power was initially increased to about 45 per cent (19:02:15) and a slight left roll initiated. Power was then advanced to about 90 per cent (19:02:18) and the left roll developed to a peak value of -52° (19:02:23) with a pitch attitude of +20° (nose-up)^[15] and airspeed varying from 56–69 kt.^[16] The pitch attitude then increased to a peak value of +29° before lowering to +7° as the aircraft rolled right to a peak value of +27° at a height of about 100 ft above the runway (19:02:25).

The aircraft collided with the ground followed by the airport boundary fence and came to rest inverted during the period 19:02:26–30.^[17] The final track at initial impact was about 60° left of the runway centreline. During the accident sequence, the rate of heading change to the left developed commensurate with the angle of left roll, and the recorded normal and lateral G‑accelerations^[18] were minimal.^[19]

Wreckage information

With the exception of the right rudder cable, no mechanical defect was found that could have prevented the normal operation of the aircraft. The right rudder cable was found attached to the rudder, but the forward end was found with a failure near the connection to the rudder pedals. The cable was removed from the wreckage for examination by the ATSB. A preliminary examination determined it did not fail from fatigue. The aircraft’s flight data demonstrated the rudder was operational during the accident sequence. On that basis, it was concluded that the rudder failure observed was a result of the impact, and no further examinations were conducted on the rudder cable assembly.

Survival factors

The aircraft was fitted with a composite roll cage within the fuselage structure to provide roll protection for the occupants. The front seats were each fitted with a four-point inflatable restraint system with an inertia reel lock. Despite coming to rest inverted after striking the ground at about 60–70 kt, the pilot and instructor reported that they found themselves uninjured, but could not open the doors with the aircraft inverted.^[20] The inflatable restraints (air bag style system) did not activate, but this was considered likely to be due to the gradual level of deceleration.

The iBrace Survivor Questionnaire^[21] was completed for the pilot and instructor with the following results:

• The pilot was able to evacuate unassisted from the aircraft while it was filling with smoke by kicking out a window. He then pulled the instructor out of the burning wreckage after seeing her collapsed inside. He suffered from third-degree burns to 7 per cent of his body.
• The instructor was unable to evacuate unassisted from the aircraft after she became disorientated in the dark, smoke filled environment, which led to a loss of consciousness. She suffered from first and second-degree burns and smoke inhalation injuries, which required her to be intubated.

Closed-circuit television footage identified an ambulance crossing the runway towards the accident site about 3 minutes after impact. In addition, an emergency medical service helicopter was located at the airport with the crew on duty at the time of the accident. They transported the pilot and instructor to Sydney for treatment.

Additional information

Spatial disorientation

The pilot reported that the aircraft pitched up when he applied power for the go-around and that he observed the runway lights disappear off to the right. He felt that the aircraft was in a roll while he was trying to focus his eyes on the attitude indicator as the instructor was directing him to level the wings. He commented that without enough right rudder the aircraft will ‘pull to the left’ [when applying additional power] and that it is normal to apply right rudder, but that ‘it was pitch black’.

There is a small village, Spring Hill, located upwind of runway 11, but the instructor reported that it was not large enough to produce an illuminated horizon below about 200 ft above ground level. She reported that on the night of the accident, at low level with the runway lights obscured, it was ‘pitch black’, and that [for a pilot looking outside] the environment would have been ‘totally disorientating’.^[22]

Benson (1988; as cited in Gibb et al., 2011) defined spatial disorientation as:

The pilot fails to sense correctly the position, motion, or attitude of his [or her] aircraft or of himself [or herself] within the fixed coordinate system provided by the surface of the earth and the gravitational vertical.

The three sensory systems for determining orientation of the human body in space are the visual, vestibular,^[23] and somatosensory^[24] systems. Newman (2007) and others have reported that the visual system provides 80 per cent of the orientation information in normal conditions. However, in the absence of visual cues, orientation and motion information are divided between the vestibular and somatosensory systems. These systems can easily produce false information for a pilot due to local accelerations of the aircraft about the pitch, roll and yaw axes.

The vestibular system responds to head position and movement, which may lead to an incorrect perception of body motion if not supported by a visual reference. For example, an upward pitch (head backward) may be detected as a forward acceleration, and a roll as a lateral (sideways) acceleration. The somatosensory system detects local accelerations on the body, but if the pitching and rolling motions occur at close to +1G flight, such as during the accident sequence, the somatosensory system may not be able to resolve ambiguities generated by the vestibular system.

It was noted by Newman (2007) and Gibb et al. (2011) that spatial disorientation is likely an under‑reported phenomena in aviation. They suggested that this may be due to it resulting in one of two likely outcomes; either the pilot recovers the aircraft with no harm or damage done, and therefore does not perceive the need to report; or it results in a fatal accident and the investigation cannot verify from the evidence available that spatial disorientation contributed to the event.

Flight instruction

Instrument flying proficiency

The Civil Aviation Safety Authority’s (2007) Flight Instructor Manual: Aeroplane, chapter 18: Night Flying, states the following:

Before students undertake night solo circuit operations they must have received sufficient instrument flight training to enable them [to] carry out the following manoeuvres solely by reference to instruments: a) climb and climbing turns, b) straight and level flight and level turns, c) descent and descending turns, d) unusual attitude recovery full panel.

As the pilot already held a private instrument rating, the above training exercises were not required to be conducted as lead-in to his night flying training.

Demonstration

The Flight Instructor Manual stated that ‘airborne sequences must follow an acceptable method of teaching like: demonstrate, direct then monitor. However, the pilot acted as flying pilot for his first night flying training flight without a prior demonstration.^[25] The instructor explained that there were several reasons for this as follows:

• When the pilot first approached the instructor for his private instrument rating training, he was already a qualified pilot [private pilot licence] who owned his own aircraft and was capable of flying it competently. The instructor considered him an advanced student for the instrument training as he had already accumulated several hundred flying hours experience.
• The instructor used the direct method to deliver the pilot’s instrument training. This was about 40 hours of dedicated instrument flying training.
• At the time of the accident flight, the instructor and pilot had accumulated about 50 hours flying together without the need for the instructor to demonstrate a flying sequence or intervene to correct an improperly flown sequence. The pilot’s instrument flying training ensured he had accumulated sufficient minimum instrument flying prior to his first night flying training flight.

Benefit of demonstration

The benefit of demonstration as an instructional technique is that it permits the student to focus their attentional resources on key learning points for new sequences, without the diversion of those resources to managing the flight path. Studies have noted that observational experience, in addition to physical practice, can provide a more effective learning experience than physical practice alone.

In 2000, Shea et al. compared the performance of a physical practice group with a combined observation and physical practice group on a motor learning test. The physical practice group outperformed the combined practice group under the practice test conditions, but when the test conditions were varied from the practice conditions, the combined practice group ‘performed significantly better’ than the physical practice group.

Intervention

After the go-around was commenced, the instructor reported that the aircraft entered an unusual attitude. Both the instructor and pilot reported that the instructor was repeatedly directing the pilot to level the wings. The instructor commented that at the time, she was thinking ‘get that left wing up’, but directing ‘wings level’. At the time, her eyes were focused on the pilot’s attitude indicator^[26] and she was expecting the pilot to recover the aircraft. However, the pilot had become spatially disorientated, which she was not aware of. It was only a matter of seconds between the instructor’s comprehension that the aircraft was not responding and the impact with the ground. The instructor considered that it ‘happened very fast’, and that as she was not in the habit of taking over the controls from the pilot, her natural reaction was to direct what was needed. The pilot also reported that it ‘happened very quickly’, with ‘no height to recover’.

The Cirrus SR22 is fitted with two single-handed side control yokes mounted beneath the instrument panel on the left and right side of the cockpit, and the instructor reported that it is not an easy aircraft for an instructor to take over control from a student. She commented that the single-handed yokes are sensitive in their response, which can lead to ‘fighting over the controls’ if the instructor attempts to follow-through on the controls^[27] while a student is flying. Therefore, she was not following through on the controls during the touch-and-go sequence.

Previous similar accidents

Spatial disorientation

Spatial disorientation presents a danger to pilots as the resulting confusion can often lead to incorrect control inputs and resultant loss of aircraft control. Gibb and others (2010) state that spatial disorientation accidents have a fatality rate of about 90 per cent, indicating how compelling the misperceptions can be. A search of contributing safety factors in the ATSB aviation occurrence database revealed that of the investigated accidents where spatial disorientation was found to be a factor (about one per year), nearly all resulted in fatal injuries.

The United States National Transportation Safety Board’s database was searched for previous accidents involving spatial disorientation. A search of all aircraft categories returned 710 results. Cirrus SR20 and SR22 aircraft returned 18 results for spatial disorientation as a finding between 2003 and 2017, 13 of which were fatal accidents (four of the non-fatal accidents involved use of the Cirrus Airframe Parachute System for recovery). The conditions for all of the accidents were instrument meteorological or night, or combination of both. Of the 18 accidents for Cirrus aircraft, 10 were for instrument-rated pilots and four occurred during take-off.

The ATSB education booklet Avoidable Accidents No. 7, Visual flight at night accidents: What you can’t see can still hurt you (AR-2012-122) outlines a number of night-time accidents that have been a result of spatial disorientation due to dark night conditions.

Loss of control during go-around

A search of the ATSB database for previous SR22 accidents involving a loss of control during a go-around manoeuvre found one result of interest:^[28]

• During a touch-and-go training exercise, the aircraft veered off the runway to the left while under full power for take-off. The pilot reported that his attention may have been diverted to the flap control lever at the time (ATSB reference number 201006782).

The United States National Transportation Safety Board’s database was searched for previous similar accidents. The search criteria were Cirrus SR22, instructional flight, and accident. The search results were then filtered for loss of control events during an attempted go-around. The following results of interest were reviewed:

• Report ERA12FA540: Loss of control in-flight. ‘During the final approach, witnesses saw the airplane drifting to the left while descending at a relatively high sink rate. Witnesses heard the power being adjusted, and, close to the ground, the engine went to high power. The airplane’s nose rose, and the airplane veered to the left. The airplane touched down left wing down off the runway in grass, heading about 40 degrees left of the runway centreline. It then entered woods, where it hit numerous trees and came to rest upside down and on fire…Examination of the wreckage revealed no pre-existing mechanical anomalies that would have precluded normal operation’.
• Report ERA13CA222: Landing area overshoot. ‘According to the instructor, he and the student pilot were practicing short field landings. When the airplane was about 20 feet above the ground on approach to the runway, the airspeed suddenly decreased. The student pilot applied full engine power, the airplane yawed to the left, and the airplane impacted the ground before it reached the runway. The flight instructor reported no pre-impact mechanical malfunctions or failures with the airplane that would have precluded normal operation’.
• Report NYC07CA010. ‘As the pilot of the SR-22 was performing a flare for landing, the airplane’s airspeed “became too slow,” and the pilot applied full power and announced “go-around.” The airplane veered left, and continued approximately 100 yards, before it struck a tree and came to rest upright. The pilot reported no mechanical anomalies with the airplane’.

__________

13. The aircraft was fitted with the Cirrus Airframe Parachute System (CAPS), which is a ballistic parachute recovery system. When the pilot activates the CAPS system, a rocket in the aft fuselage ignites and dislodges the CAPS cover. The rocket then extracts a deployment bag containing the parachute from the aircraft.
14. As advertised by the manufacturer - Heads Up Technologies.
15. The nose-up pitch attitude on take-off and the first touch-and-go circuit was 7–9°. When the aircraft is trimmed for a low power and low airspeed approach, an increase in thrust over the tailplane will increase the down force produced by the tailplane, pitching the tailplane down and the nose up.
16. An approximate stall speed of 73 kt was calculated. Conditions were: full flap, full fuel, two occupants, 20° pitchup, 52° roll, density altitude 2,600 ft and idle power. The use of high power would reduce the stall speed.
17. The airport camera footage timings are about 30 seconds in advance of the aircraft recorded data for reasons undetermined.
18. G load: the nominal value for acceleration. In flight, g load represent the combined effects of flight manoeuvring loads and turbulence and can have a positive or negative value.
19. The peak variation in normal and lateral accelerations were +0.24 and -0.07 respectively (datum = 0.0).
20. The aircraft doors open upwards and forwards relative to the cabin with the aircraft in the upright position.
21. Davies J.M., Wallace W.A., Colton C.L. & Yoo K.I. (in press). Two aviation accident investigation questionnaires for passenger & crew survival factors & injuries. Aviation Medicine and Human Performance.
22. The instructor reported that the township of Orange, to the north of the extended centreline for runway 29, provided more lighting than Spring Hill, but was partially masked by the surrounding terrain and would not have provided any significant light had that runway been used at the height at which this event occurred.
23. The vestibular system consists of the semi-circular canals and otolith organs in the inner ear, which detect angular and linear accelerations of the head.
24. The somatosensory system uses nerves to detect external forces on the body.
25. The accident flight was the instructor and pilot’s first dedicated circuit flying training session together – the instructor was not involved in the pilot’s basic flying training.
26. Although the aircraft was fitted with two MFDs, the primary flight display with the attitude indicator is only displayed on the left MFD, except in the case of a failure of that MFD, in which case the primary flight display will be displayed on the right MFD.
27. For an instructor, ‘follow-through on the controls’ is the practice of holding the controls while the student is flying. This permits the instructor to feel the student’s control inputs and override incorrect control inputs to prevent the development of an unsafe situation.
28. There were other results of loss of control during go-around manoeuvres with full power for the SR22, but these included strong gusting wind conditions as contributing factors.

Safety analysis

Introduction

During a night training flight, a go-around from runway 11 at Orange Airport, New South Wales was commenced. Shortly after, the Cirrus SR22 aircraft, registered VH-PDC, collided with the ground. The flight instructor and pilot received serious injuries and the aircraft was destroyed.

As mentioned above, the presence of a fractured rudder cable in the wreckage was not considered a contributing factor. This was because the rate of heading change during the accident sequence followed the angle of roll, rather than the application of power, and there was no significant lateral acceleration associated with the application of power.

The data logging card did not record pilot control inputs or movement of the autopilot servos. Therefore, it could not be determined if the reversal of the initial rolling and pitching motion was the result of the actions of the pilot, or flight instructor, or the aircraft’s electronic stability and protection system. However, the thresholds for activation of the aircraft’s pitch and roll protection were reached during the accident sequence, and the reversal of the pitch and roll were consistent with the operation of the system. While the system was designed to mitigate an unusual attitude from developing, the act of recovering from a high pitch angle at slow speed will inevitably result in a loss of height.

The final approach on the accident flight was steep at 500 ft. While this was corrected before the landing, it would have increased the pilot’s workload during the approach. Using this as a trigger to conduct a go‑around would have provided the pilot with the opportunity to set up for a more stable approach on the next circuit.

This analysis will examine the conduct of flight demonstrations, and the pilot experiencing spatial disorientation and the flight instructor’s awareness of such.

Flight demonstration

The pilot was undergoing his first night flying training flight for the addition of a night endorsement to his private instrument rating. The flight instructor had previously instructed the pilot for his instrument rating, and considered him an advanced student. His instrument flying training was delivered by the instructor using the instructional method of direct, without the need to demonstrate any sequence or intervene to correct an incorrectly flown sequence. Because of this earlier experience, the instructor elected to use the instructional method of direct without first demonstrating any of the key learning points for the night flying environment.

Night circuits involve a unique runway environment for assessing the approach path and landing, and require a unique procedure for combining visual and instrument flying sequences. The Civil Aviation Safety Authority’s flight instructor manual emphasised that the ‘acceptable delivery rate of new information to the student [pilot] needs to be combined with good demonstrations and adequate student practice’. Consistent with this guidance, best practice is to ensure that the student [pilot] is introduced to a new environment in a gradual way. The lack of demonstration for the pilot’s introduction to night flying likely increased the risk of the pilot not having an adequate opportunity to attend to, and absorb, the key learning points before attempting to practice the sequences as the pilot flying.

Spatial disorientation

The flight instructor reported that the pilot’s first night circuit was flown to a reasonable standard with the pilot responding to her direction. At the end of the second circuit, the aircraft bounced twice during the attempted touchdown and the pilot applied full power to perform a go-around. In response to the application of full power, the aircraft pitched nose-up and started to roll to the left. The pilot reported that he lost all external visual references as the runway lighting disappeared from view underneath the aircraft, and was attempting to focus his attention on the attitude indicator as the aircraft continued to pitch up and roll left.

The pitching and rolling motion of the aircraft, in addition to the pilot and instructor reports that the external environment was ‘pitch black’, were all consistent with the pilot experiencing spatial disorientation. The nose up pitching motion and left rolling motion were consistent with the natural response of the aircraft without corrective pilot control input.

Flight instructor awareness

During the accident sequence, the flight instructor repeatedly directed the pilot ‘wings level’, but her attention was focused on the primary flight display and she was not aware the pilot had become spatially disorientated. Therefore, she did not immediately intervene to recover control of the aircraft during the accident sequence, which only lasted about 7 seconds from the decision to go-around to initial impact.

Findings

From the evidence available, the following findings are made with respect to the spatial disorientation and collision with terrain involving Cirrus SR22, registered VH-PDC, at Orange Airport, New South Wales, on 15 May 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• While attempting a go-around manoeuvre from an aborted touch-and-go, the pilot did not immediately transition his scan onto the attitude indicator and became spatially disorientated, which resulted in loss of control of the aircraft and collision with terrain.
• The flight instructor was not aware the pilot had become spatially disorientated, which resulted in her providing direction rather than intervention during the loss of control.

Other factors that increased risk

• Contrary to best practice, the flight instructor elected to direct the pilot for his first night flight without a demonstration. This decision was influenced by the pilots' experience, private instrument rating, and previous instructional method.

General details

Flight Instructor details

Pilot details