Loss of control

Safety summary

What happened

On 7 November 2017, a chief flying instructor (CFI) and pilot under instruction (PUI) were flying a Eurocopter AS350BA Squirrel, registered VH-BAA. They were conducting practice emergencies under visual flight rules at Hobart Airport, Tasmania. During hydraulic system failure practice, control of the helicopter was lost and the aircraft collided with terrain. The CFI was fatally injured and the PUI was seriously injured.

What the ATSB found

Flight manual emergency procedures stipulate that in order to maintain control following a hydraulic system failure (or simulated failure), a shallow approach should be made into wind and the helicopter should not enter a hover. On this occasion, the aircraft approached crosswind and came to a high hover without hydraulic assistance. Consequently, the helicopter was rendered uncontrollable. A delay in restoration of the hydraulic system prevented the crew from regaining control before collision with terrain.

The ATSB also identified that:

• An intermittent fault in the hydraulic cut-off switch may have delayed restoration of flight control hydraulic pressure.
• A pre‑flight brief was not conducted between the CFI and PUI which may have led to confusion over aircraft control and delayed restoration of the hydraulic system.

Due to a lack of available information, the influence, if any, of these two factors on the accident sequence could not be determined.

What's been done as a result

Following this accident, the operator:

• employed a trained and regulator-approved safety manager
• updated the training school operations manual with stricter controls on performing AS350 sequences as per the flight manual requirements
• installed an electronic system for tracking competencies and currencies.

The operator has also separated key roles of chief executive officer, chief flight instructor and the head of flight operations, which were previously conducted solely by the chief flight instructor.

Safety message

Compliance with the AS350 flight manual requirements following a real or simulated hydraulic failure ensures that the helicopter remains controllable during all phases of flight.

As this, and many other similar accidents illustrate, hovering an AS350 without hydraulic assistance can lead to a rapid, catastrophic loss of control even for highly experienced pilots. The Royal Australian Air Force found in evaluation of the AS350, while hovering without hydraulics, that the AS350 is subject to random perturbations, and reduction in control authority. Additionally the AS350 flight manual notes that without hydraulics the helicopter is subject to rapid changes in control direction and force.

In a training context, the rapid development of this accident, reinforces the need for a clear understanding and coordination between instructor and student when conducting hazardous activities such as simulated system failures.

Summary video

The occurrence

What happened

On 6 November 2017, a commercial helicopter pilot commenced a 2‑day AS350 helicopter endorsement as a pilot under instruction (PUI). The first day was spent with an instructor covering aircraft systems, and pre‑flight inspection. The PUI and instructor also conducted a 1.1-hour flight that afternoon covering the initial flying components of the endorsement.

On 7 November 2017, the PUI studied the aircraft’s electrical system, and theory on handling of in-flight emergencies, including hydraulic system emergencies, with the same instructor. Following the classroom session, the PUI conducted an inspection of the aircraft under the supervision of the instructor.

Flight records showed that at 1002 Eastern Daylight‑saving Time,^[1] the PUI and instructor commenced a training flight of 1.2 hours covering pinnacle approaches and confined areas, followed by run-on landings.^[2] The PUI’s next planned flight was with the chief flying instructor (CFI) at 1500 for the conduct of emergency sequences. The CFI was unable to depart at the pre‑arranged time as he was attending to business matters. The PUI reported that he also took the opportunity to catch up on his own business needs during the delay. The actual takeoff was delayed by 1 hour and 22 minutes.

The instructor advised the ATSB that, prior to the accident flight, the CFI conducted a brief handover with him to ascertain the standard of the PUI’s flying and the sequences briefed. At the aircraft, the PUI explained his requirement for a low-level approval and type endorsement with the CFI however, no pre‑flight brief was conducted.

The PUI and CFI boarded the aircraft and began the flight at 1622. Pre-flight checks included testing of the hydraulic system and switches with no apparent faults identified. The PUI recalled that following the low-level phase of the training flight, the CFI demonstrated some upper air emergencies and had the PUI perform them. After satisfactory completion, they flew back to Hobart Airport for a continuation of practice emergencies.

The PUI recalled that upon joining the circuit at left base for approach to area X-Ray parallel to runway 12 (Figure 1),^[3] the CFI announced a simulated hydraulic failure and activated the hydraulic test (HYD TEST) switch. As expected, a warning light and horn sounded. The PUI slowed from 90 kt to below 60 kt, consistent with the flight manual profile for hydraulic failure (see the sections titled Hydraulic failure training and Hydraulic system). The PUI then activated the hydraulic cut-off (HYD CUTOFF) switch. Following that, it is highly likely that the HYD TEST switch was released, though it is not known specifically when that occurred.

The PUI was to fly a run-on landing at around 10 kt without hydraulic assistance as per the requirements of the flight manual procedure. The PUI said he was comfortable to do so knowing the CFI was there to step in if anything were to go wrong. The PUI had very little further recollection, beyond the initiation of the event.

Table 1 and Figure 1 show the progression of the helicopter through the accident sequence. Paths, angles and rates are inferred from CCTV footage, air traffic control (ATC) data, and airport photographs. Due to limitations in the data available, these are approximate values only.

Table 1: Accident sequence from CCTV

Figure 1: Approximate path of VH-BAA

Source: Hobart Airport, annotated by the ATSB

At the end of the observed flightpath, the front left side of the cabin impacted the ground first. The CFI, seated on the left, was fatally injured, and the PUI in the right seat was seriously injured. The helicopter was destroyed.

1. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. Run-on landing: Touching down with forward speed with the skids aligned with the direction of travel of the helicopter, and slowing to a full stop while maintaining constant contact with the ground.
3. Runway number: the number represents the magnetic heading of the runway in ten degree increments.

Context

Personnel

Chief flight instructor

The chief flight instructor (CFI) had 30 years of experience flying helicopters and had accumulated 14,200 hours of aeronautical experience. His time on type for the AS350 was over 1,000 hours. He held an Air Transport Pilot License (Helicopter) and an authority to examine pilots for issuance of licences and endorsements. He had accumulated 45.3 hours flight in the previous 28 days.

The CFI was medically fit, qualified for the flight, and had demonstrated proficiency through flight checks in:

• Flight instruction on 3 August 2017
• Single Engine Helicopters on 30 June 2016
• Low level flight on 31 March 2016.

Instructor

The instructor was an experienced helicopter pilot with 4,000 hours’ total aeronautical experience and 1,000 hours of AS350 experience. He had previously flown with the pilot under instruction (PUI) while working for a different operator. The PUI sought out this instructor to conduct his endorsement.

Pilot under instruction

The PUI was a commercial helicopter pilot with over 1,200 hours of rotary wing experience and he was medically fit for the flight. The PUI was also managing director of a local helicopter company. The endorsement was associated with the company’s introduction of AS350 helicopters to their fleet.

Organisational and management information

The operator had been in business for 26 years and established in Tasmania at Hobart International Airport for 17 years. They specialised in charter, aerial work, and flight training operations.

The CFI was also the owner of the business, head of flight operations, chief executive officer, and undertook operational flying.

Flight endorsement training

General information

The Civil Aviation Safety Authority, through Civil Aviation Advisory Publication 5.14‑2(0) Flight Instructor Training (Aeroplane), established the need for two briefings prior to flight: a classroom brief and a pre-flight brief. These two forms of briefing prepare students for learning and performing complex sequences. A long brief in the classroom links theoretical knowledge of emergencies to practical application of those principals in the aircraft. The pre-flight brief establishes procedures and management of the aircraft between the crew. This format was not applied for the accident flight. The first instructor conducted the classroom brief, but there was no pre-flight brief between the CFI and PUI.

Hydraulic failure training

Training for loss of hydraulics in the AS350 required adherence to instructions in two rotorcraft flight manual (RFM) sections: Supplement 7 for the training procedure itself, and Section 3 for emergency procedures for management of the aircraft without hydraulics.

Supplement 7 training procedure

Supplement 7 of the AS350 RFM was incorporated in 2003; it carried specific instructions for hydraulic failure training. The sequence was divided into two distinct phases, and the hydraulic cut-off (HYD CUTOFF) switch and hydraulic test (HYD TEST) switch would not be engaged at the same time. This prevented depletion of tail rotor hydraulic pressure accumulators (not fitted in VH‑BAA) and ensured only one switch would be required to restore hydraulics at any time. Figure 2 illustrates the two phases of the procedure.

Figure 2: AS350 Rotorcraft flight manual hydraulic failure training procedure

Source: ATSB. Flow chart derived from AS350 Rotorcraft Flight Manual

Incorrect sequence taught during endorsement

The instructor and the PUI advised that the flight school taught a different version of the hydraulic failure training procedure during the endorsement and used it during the accident flight.

The procedure used had the student activate the HYD CUTOFF switch before the HYD TEST switch was released. This was a commonly‑used procedure before the release of Supplement 7. An investigation into a similar accident in Canada (A13Q0021) related that flight instructors found this sequence accurately simulated a hydraulic failure. Figure 3 illustrates the procedure.

Figure 3: Hydraulic failure training procedure as taught

Source: ATSB. Flow chart derived from accounts of procedure used by flight school

VH-BAA was not fitted with a yaw load compensator. Using this procedure on an AS350 equipped with a yaw load compensator will cause total loss of tail rotor control hydraulic assistance.

Section 3 hydraulic failure emergency procedure

For completion of the transition to landing referred to in phase 2, the hydraulic failure emergency procedure from Section 3 of the RFM was to be applied. It stated:

Keep the aircraft to a more or less level attitude. Avoid abrupt manoeuvres.

The RFM also carried the following caution:

DO NOT ATTEMPT TO CARRY OUT HOVER FLIGHT OR ANY LOW SPEED MANEUVER. THE INTENSITY AND DIRECTION OF THE CONTROL FEEDBACK FORCES WILL CHANGE RAPIDLY. THIS WILL RESULT IN EXCESSIVE PILOT WORKLOAD. POOR AIRCRAFT CONTROL. AND POSSBILE LOSS OF CONTROL.

RFM Instructions for approach and landing were:

Over a clear and flat area, make a flat final approach, nose into wind.

Perform a no-hover/slow run-on landing around 10 knots.

Do not hover or taxi without hydraulic pressure assistance.

Helicopter details

General information

The Eurocopter AS350BA,^[4] was manufactured in France in 1987 (serial number 2015). It was first registered in Australia on 4 April 2000 and at the time of the accident, had accumulated 5,612 hours total time in service. It was previously registered as VH-RLU and the registration mark was changed to VH-BAA by its current owner on 20 March 2007.

VH-BAA had seating for a pilot and five passengers and was certified for day and night charter operations under the night visual flight rules. The helicopter was powered by one Turbomeca Arriel 1B turboshaft engine.

A review of Maintenance Release entries for maintenance due, showed that a 6-month inspection was required on 7 October 2017, with an over-run tolerance of 60 hours or 18 days. With the tolerance applied, the maintenance would fall due on 25 October 2017. The maintenance related to periodic greasing of the main rotor blade retaining pins.

At the time of the accident, the maintenance had not been certified on the maintenance release as complete and was overdue. No record was found in the aircraft logbook that the maintenance had been completed. While it is a pilot responsibility to ensure that a flight does not commence unless all maintenance has been completed, it is highly unlikely that the non-lubrication of the main rotor blade pins contributed to the accident.

The operator reported that VH-BAA was on temporary hire for the purposes of the endorsement training. Between 5 November and 7 November, the helicopter was operated for about 2.5 hours in the training role. Neither the initial instructor nor the PUI reported problems with the performance of the helicopter or its operation.

Hydraulic system

The aircraft was equipped with a single hydraulic system, energised by a belt-driven hydraulic pump. The hydraulic pump was regulated to provide a constant pressure of 40 bar to four flight control servo actuators. A red warning light will light at hydraulic system pressures of less than 30 bar.

There were three Dunlop servo actuators for control of the main rotor and one Dunlop servo actuator for control of the tail rotor (Figure 4). With hydraulics operating, the input force required to move the rotor blades, at the cyclic,^[5] is less than or equal to 0.3 kgf. For that cyclic input, at 40 bar, the system provides an output of 183.5 kgf.

Because the aircraft exhibits increasing control loads without hydraulics at high speed, and control may be lost without hydraulics in the hover, back-up accumulators are available in the hydraulic system. These accumulators store hydraulic pressure and deliver it to the servo actuators in the event of a hydraulic failure. The accumulators carry enough stored pressure for the pilot to establish the aircraft at the safety speed from cruise or from a high hover to a landing. A safety speed of 40-60 kt was stipulated in the emergency procedures section of the rotorcraft flight manual (RFM).

Figure 4: AS350 servo locations

Source: Airbus Helicopters

A yaw load compensator was fitted to later iterations of the aircraft in order to overcome excessive forces in yaw control in the absence of hydraulic assistance. VH-BAA was not fitted with a yaw load compensator and did not have an accumulator on the yaw control. In the AS350BA, in the absence of hydraulic assistance, yaw control loads are felt directly and immediately.

Hydraulic system switches

The hydraulic system is managed via two switches. The guarded, console-mounted push-button HYD TEST switch, and the recessed, collective-mounted^[6] HYD CUTOFF switch (Figure 5).

The HYD TEST switch exists to test the accumulators for the main rotor servo actuators before flight. The HYD TEST switch is OFF (out) in normal operation. Pressing the HYD TEST switch to TEST (in) creates a bypass in the hydraulic distribution block, routing pressurised fluid from the pump directly to the reservoir. This leaves the back-up accumulators to supply pressure to the main rotor servo actuators.

The HYD CUTOFF switch is ON (out) in normal operation. Pressing the HYD CUTOFF switch OFF (in) bypasses the servos by connecting the pressure inlet and return outlet in each one. The effect is to depressurise the servos and the back-up accumulators of the main rotor servo actuators. It is used in the event of an in‑flight emergency, once the safety speed of 40-60 kt has been established, to ensure that residual accumulator pressure causes no asymmetry in forces across the flight controls.

In emergency procedure training, the HYD TEST switch is used to induce hydraulic failure in flight and the HYD CUTOFF switch is used to conduct hydraulic off landings. If either switch is in, the system will not provide hydraulic pressure to the controls. As previously detailed in the section titled Hydraulic failure training, they should not be activated together in the AS350BA, so hydraulics can be restored with one switch.

Figure 5: HYD TEST switch and HYD CUTOFF switch locations

Source: Airbus Helicopters

Main rotor system

The AS350 was fitted with a starflex hub (Figure 6). This design replaced hinges with elastomeric (rubber type) bearings. Without hydraulic assistance, the pilot must exert significant effort to push or pull the flight controls to deform the elastomeric bearings, change the pitch of the blades, and control the helicopter.

Figure 6: AS350 main rotor pitch change mechanism

Source: Airbus Helicopters

The RFM states in section 3.2 that the expected control input forces without hydraulic pressure are:

• Left-hand cyclic load 4 to 7 kgf
• Forward cyclic load 2 to 4 kgf
• Collective 20 kgf.

The RFM states in section 7.7 that the maximum forces a pilot should have to exert are:

• Lateral cyclic 15.3 kgf
• Longitudinal cyclic 17.3 kgf
• Collective forces were not stated.

Tail rotor system

The AS350 tail rotor is built on one continuous composite spar (Figure 7). Without hydraulic assistance, the pilot must push the pedals and twist the spar to change the pitch of the tail rotor blades. While helicopter weight and speed affect pedal force, the Royal Australian Air Force (RAAF) Aircraft Research and Development Unit (ARDU) (see section titled Research) found that a tail rotor pitch change requires a force of up to 50 kgf. Airbus Helicopters advised they were able to demonstrate significantly lower required forces in flight tests while observing flight manual limitations.

Figure 7: AS350 Tail rotor

Source: Airbus Helicopters

Automatic pilot

The aircraft was fitted with a two-axis automatic pilot system. The installation included two servos in line with the cyclic control’s pitch and roll control rods. The optional collective-to-yaw linkage, that can accompany this equipment, was not a part of this installation. The automatic pilot system was not a component of the endorsement, nor was it used during the endorsement. When the automatic pilot is disengaged, the servos of the automatic pilot system act in the same way as a push/pull rod. There was no evidence to indicate that the automatic pilot system was a factor in the occurrence.

Site and wreckage inspection

Aerodrome information

Hobart Airport is on the south-east coast of Tasmania and has a single north‑west/south‑east runway (Figure 8). Helicopter training area X-Ray was used on the day of the accident.

Area X-Ray was on the western side of, and 60m outside of, the runway. It was under the control of air traffic control (ATC), who provided clearances for all aircraft movements on and around the airport. A clearance was required for helicopters to overfly active taxiways and cross the runway.

Figure 8: Helicopter training area X-ray at Hobart International Airport

Source: Google earth, annotated by the ATSB

Site inspection

As the accident closed the only runway, Tasmania Police assisted the ATSB by documenting the site prior to the arrival of the on‑site investigators. This allowed the wreckage to be removed, and the airport to be reopened, without jeopardising important physical evidence such as ground contact marks. ATSB investigators examined the wreckage in a secure location nearby.

There was evidence that the engine was running for a period of time after the helicopter impacted with terrain, as indicated by burnt grass in the area of the engine exhaust, though there was no fire on site. Figure 9 shows the aircraft before removal.

Figure 9: Accident site image

Source: Tasmania Police

Survivability

Immediately after the accident, ATC activated the emergency response and closed the runway. The aviation rescue and firefighting services (ARFF) stationed at the airport responded immediately to the event, reaching the accident site in 1 minute 40 seconds. The ARFF recovered the CFI from the left seat and assisted the PUI from the right seat.

Damage was indicative of significant impact on the front left side. The flexible steel legs of the skid gear, four-point harnesses, crash-resistant seats and light alloy frame of the cabin floor, all offer protection to occupants during accidents if the helicopter contacts the ground in a level attitude. The polycarbonate construction of the cabin offers very little protection to occupants if the collision involves contact with the canopy.

Investigation of previous AS350 hydraulic failure accidents identified that on initiation of the loss of control event the aircraft often rolled to the left, and initial impact with ground was on the left-hand side. Consequently, the left seat occupant is likely to experience the highest impact forces during a collision. In this accident, the helicopter impacted the ground nose down while rolling to the left. As a result, there was significant disruption to the survivable space on the left side of the helicopter’s cabin.

Both pilots were wearing seatbelts with upper torso restraints, and the seatbelts and seats held during the accident sequence. This kept the right-seat pilot within a disrupted but liveable space within the cabin, contributing to his survival.

Wreckage inspection

The aircraft was inspected at a facility in Hobart.

Engine controls were found connected and secured with all attaching hardware present. The engine oil system was inspected, the oil filter, chip detector and oil were free from debris and discoloration. Fuel was tested for presence of water with no positive indication. The fuel had a clear appearance, the fuel filter was clean, and the bypass indicator was indicating normal operation.

The main rotor transmission had clean oil, the casing was intact, and the chip detector was free of debris. The tail rotor gearbox rotated freely with no binding, and the chip detector and gearbox oil was free of debris. The oil quantity was at the correct level.

Flight control linkages to the main rotor and tail rotor were connected, and securing hardware was in place. The hose supplying the tail rotor servo with pressure was found fractured; detailed examination concluded that was a result of impact damage.

The hydraulic system lines were mounted and connected correctly, and the hydraulic pump and drive belt were intact. The hydraulic fluid had a clear appearance, and the oil, chip-detector and filter were free of debris.

The back-up accumulators fitted to main rotor servos were checked for nitrogen charge and found to be serviceable. All hydraulic system shutoff valves (main and servo-mounted) were present and in place, with the wiring connected. Servo actuators were securely mounted with all electrical plugs and control rods securely in place.

Hydraulic system configuration

The HYD CUTOFF switch and the HYD TEST switch were found in the correct position for restoration of hydraulic pressure at the time of impact (Figure 10). It is possible that one or both switches moved during the impact sequence. The HYD TEST switch unit was found outside of the aircraft, in the off (normal operation) position.

Figure 10: HYD CUTOFF switch and control console as found

Source: ATSB

No pre-existing defects were identified. All damage noted was consistent with impact forces during the accident sequence.

The following items were collected for further assessment:

• Pilot’s collective lever HYD CUTOFF switch
• HYD TEST switch
• Caution and Warning panel.

Hydraulic cut-off switch examination

The HYD CUTOFF switch is an ‘on condition’^[7] component which is tested during pre-take-off checks, prior to every flight. Neither the initial instructor nor the PUI reported any anomaly with the switch prior to the accident flight.

Laboratory examination and comparative analysis of the HYD CUTOFF switch from VH-BAA was conducted with a new switch. They found that the switch fitted to VH-BAA at the time of the accident was susceptible to intermittent operation. The switch had a level of wear, corrosion, contamination and internal damage (Figure 11). Consequently, the mechanical latching and unlatching which cycled the internal contacts to ON or OFF could stick, and require additional effort to latch or unlatch.

Therefore, it was possible to action the HYD CUTOFF switch without restoring hydraulics, inducing a genuine emergency. The system’s normal 3-second activation period could delay diagnosis of a fault.

Additionally, Part 4.3 of section 7.7 of the RFM describes abnormal operations of the hydraulic system. It discusses the possibility that the switch may fail to dump hydraulic pressure from the accumulators in the event of an emergency.

The HYD CUTOFF switch may not be effective in opening all the electro-valves, and dumping all the pressure in the accumulators simultaneously…if the hydraulic cut-off switch is rendered ineffective due to the loss of electrical power, broken wires, or a faulty switch.

The manual made no comment on the opposite case of the switch failing while restoring hydraulics after hydraulic failure training.

It could not be determined if the intermittent operation was due in part to impact‑induced damage.

Figure 11: Corrosion, contamination, and wear in VH-BAA switch

Source: ATSB

Hydraulic warning system light bulb analysis

When the hydraulic system is inoperative, two incandescent bulbs light the red HYD warning light (Figure 12). Both of these bulbs were inspected for impact damage (Figure 13). The left bulb was intact and the right bulb exhibited pole whip damage (Carver, 1987). The pole whip created a brittle fracture between the terminal and the support post. There was some observed filament sag, which is consistent with an aged bulb exposed to high-impact forces. If the bulbs were illuminated at impact, provided the impact forces were sufficient, it is likely that the filaments would show evidence of stretch-type deformation damage. Therefore, it is considered probable that the HYD warning light was not illuminated at the time of impact.

Figure 12: VH-BAA Warning – Caution – Advisory Panel

Source: ATSB

Figure 13: HYD. Warning Light bulbs

Source: ATSB

Meteorological information

The automated weather information service^[8] for Hobart Airport at the time of the accident on 7 November 2017 recorded the following conditions:

• wind from 200°, minimum 15 kt maximum 25 kt
• visibility greater than 10 km
• cloud scattered^[9] at 5,000 ft.
• temperature 15° C
• barometric pressure (QNH) 1019 hPa.

Recorded information

The aircraft did not carry any recording devices, nor was it required to.

Closed circuit television

Closed circuit television (CCTV) from the regular public transport apron of the Hobart Airport captured VH-BAA during approach, loss of control and impact. Figure 14 shows the point of view from the apron CCTV.

Figure 14: Apron CCTV point of view

Source: Hobart Airport, Google Earth, annotated by the ATSB

Related occurrences

The ATSB reviewed 34 investigations of accidents involving AS350 series helicopter’s hydraulic systems worldwide. Figure 15 collates the data from ten of the accidents that occurred prior to the accident in VH-BAA, involving simulated hydraulic failure during flight training. It indicates that loss of control accidents during training do happen to highly experienced pilots. Refer to Appendix A for a synopsis of the reports and the Transport Safety Board of Canada’s report A05F0025 for a list of AS350 loss of control events.

Figure 15: Overview of related hydraulic failure training accidents.

Source: ATSB

Reports of unmovable controls have been a feature of a number of accidents following commanded/uncommanded hydraulic failures in AS350 helicopters. First-hand accounts relate that, as well as the rapid and intense changes in direction and magnitude of control forces described in the flight manual, the controls can become immobile.

The manufacturer is clear on avoidance of loss of control, yet the concern of unmovable controls, which is still reported in contemporary production models of the AS350 (see AAIB report EW/C2017/05/01 page 5), is not accepted by the manufacturer. Airbus Helicopters contends that pilots are surprised by the forces required and that prevents pilots from applying sufficient force to the flight controls.

Research

AS350BA controllability research and recommendations

In 1997, the RAAF ARDU conducted an evaluation of the handling characteristics of the AS350BA, in flight without hydraulic assistance.

ARDU found lateral forces with a 30 kt wind from 30° to the front right (a 15 kt crosswind component) caused lateral cyclic forces to vary continuously and ‘satisfactory lateral control could not be achieved’.

The forces required at the controls without hydraulics recorded during that evaluation were:

• longitudinal cyclic 14.8 kgf forwards at 1,700 kg all up weight while established in a hover
• lateral cyclic 6.8 kgf with a crosswind component of 15 kt
• collective (lifting) 16.2 kgf at 1,950 kg all up weight into wind at 15 kt.

Furthermore, ARDU found that at low speed with hydraulics out, pedal authority was reduced by up to 27 per cent, and that passage through free play in the pedals was required to effect a change in heading. These conditions made control difficult to retain and harder to recover. Right pedal force of 50 kgf was required to maintain a heading into wind at 15 kt.

The ARDU report concluded that with hydraulics out:

• reduced authority, free play, and excessive control forces in primary flight controls were unacceptable
• controllability below 15 kt airspeed was not reliable, and hover flight could lead to loss of control.

Following the evaluation, ARDU recommended that when conducting hydraulic failure training:

• use only one hydraulic switch at a time to simulate failure of the hydraulic system
• maintain over 15 kt during the run-on landing
• do not use over 30° angle of bank
• conduct run-on landings into wind.
   

4. AS350 Squirrel: The AS350 Squirrel was originally designed and manufactured by Aérospatiale in 1975, which became Eurocopter through merger in 1992. Eurocopter was purchased and became Airbus Helicopters in 2014. At the time of writing, the AS350 was manufactured as the H125.
5. Cyclic: a primary helicopter flight control that is similar to an aircraft control column. Cyclic input tilts the main rotor disc, varying the attitude of the helicopter and hence the lateral direction.
6. Collective: a primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity.
7. On condition: an on condition item has no designated service or replacement schedule. These items would only be replaced when found to be unserviceable.
8. Aerodrome weather information service (AWIS): actual weather conditions, provided via telephone or radio broadcast, from Bureau of Meteorology (BoM) automatic weather stations, or weather stations approved for that purpose by the BoM.
9. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘scattered’ indicates that cloud is covering between a quarter and a half of the sky.

Safety analysis

Introduction

The pilot under instruction (PUI) was unable to recall the majority of the practice hydraulic failure exercise after the accident. As such, there was no firsthand account of the final stages of the accident flight and the sequence of events was largely assembled from closed circuit television (CCTV) footage and wreckage examination.

This analysis will examine the observed aircraft behaviour associated with the simulated hydraulic system failure, instructor intervention, and crew coordination.

Flight manual requirements

In order to safely conclude a practice hydraulic failure sequence, the rotorcraft flight manual (RFM) requires a flat final approach into wind and a no-hover/slow run‑on landing around 10 kt. This is a compromise to keep the helicopter in ground effect and avoid hovering while maintaining a manageable run-on landing speed for potentially unprepared surfaces. Additionally, the requirement to conduct the run-on landing into wind provides a level of consistency in the direction of airflow across the main rotor. This simplifies the pilot’s task by minimising changes to direction and magnitude of cyclic input.

Assurance of control does not require restoration of hydraulics if the helicopter is accelerated into forward flight before the aircraft slows too much. The aircraft becomes easier to control as it is accelerated from 10 kt to the RFM safety speed of 40‑60 kt. If restoration of hydraulics fails at the safety speed, the pilot in command has ample controllability to manage the genuine emergency.

Loss of control

Approaching crosswind

While the RFM requires an into wind approach, the sequence in VH-BAA was planned for approach and landing in a right crosswind of 15-25 kt. Crosswind changes the airflow across the main rotor as the aircraft slows and the crosswind becomes the dominant flow. As detailed in the Royal Australian Air Force Aircraft Research and Development Unit (ARDU) research report, this creates unpredictable changes in direction and magnitude of cyclic input, which are more pronounced when the crosswind is variable, as it was on the day. This significantly increased the pilot’s workload and can render the helicopter uncontrollable.

Analysis of the flight path of VH-BAA from the CCTV footage showed the helicopter to be controlled during the early stages of the approach. As the aircraft slowed, and the crosswind became the dominant airflow the helicopter was observed to drift and vary in pitch and yaw, consistent with the ARDU flight test observations.

Hovering without hydraulic assistance

The PUI recalled feeling a need to prevent the helicopter’s airspeed from decaying late in the approach; CCTV shows he was unable to do so. For a 3-second period, as the helicopter slowed to a hover, there appeared to be no positive control on the aircraft. Despite that, there was no apparent intervention to prevent the helicopter slowing to an out of ground effect (OGE) hover, and the sequence progressed past the boundary of assured control.

The helicopter yawed left, putting the wind behind the helicopter, and facing into an active runway. It is unlikely that this situation was commanded by choice. Instead, it is indicative of the tail rotor returning to a neutral pitch in the absence of hydraulic assistance and reduced, or ineffective, control inputs.

The OGE hover increased the magnitude of control inputs required and induced rapid random changes in intensity and direction of control feedback forces. Due to aerodynamic couplings between controls and lag in control input and response, pilots must anticipate control inputs, and make them before they are required. However, a pilot cannot anticipate the inputs required for an aircraft subject to random perturbations in flight controls.

CCTV showed that after the aircraft came to a hover and yawed left, a positive collective input was made, and the aircraft climbed. It is not known who made that input. Shortly thereafter, control of the aircraft appeared to be lost as it crossed the active runway, with excessive pitch nose down, and left roll developing. Given the nature of the helicopter movement and proximity to the ground, there was little opportunity at that point to restore control.

It is extremely unlikely that the chief flying instructor (CFI) would have entered an active runway without clearance in normal operations. An air traffic controller stated that the CFI had never previously departed area x-ray without announcing his intentions and gaining a clearance. It is therefore virtually certain that entering the runway must have been unavoidable once the aircraft departed controlled flight or considered necessary to regain control of the aircraft.

Deviation from standard operating procedures decrease safety margins and increase opportunity for an accident (Sumwalt and Lemos, 2010). Both the flight manual and the ARDU research paper identified that operating outside of the prescribed procedure would probably result in a loss of control.

Control not restored

Hydraulic system restoration

Light bulb analysis of the hydraulic system fault warning lights indicated that it was probable that the HYD fault light was not illuminated at the time of impact with terrain. Further, both the HYD TEST and the HYD CUTOFF switches were in the normal flight (hydraulic system on) configuration during post-accident examination. While the switch position is less reliable than the light bulb analysis, in combination the ATSB concluded that it was likely that the switches were moved to restore hydraulics prior to impact.

The collective input immediately prior to crossing the runway was 9 seconds prior to collision with terrain. The hydraulic system was likely restored at a point between 9 seconds and 4 seconds before impact. As identified during the investigation of past similar accidents, delays in restoration of the hydraulic system can prevent control recovery.

Restoration of the hydraulic system was potentially delayed due to:

• use of an incorrect hydraulic failure training procedure
• lack of a pre-flight brief to develop common understanding between crew
• a potential intermittent failure of the HYD CUTOFF switch.

The level of contribution, if any, of each factor could not be determined, though each increased risk in the operation.

Incorrect hydraulic failure training procedure

The procedure used to simulate failure of the hydraulic system did not match the requirements of the RFM and overlapped the two phases of the procedure. It released the hydraulic test (HYD TEST) switch after activation of the hydraulic cut-off (HYD CUTOFF) switch. This introduced a hazard into the operation.

Distraction could lead to the HYD TEST switch being forgotten and remaining in. In this configuration, a pilot must activate two switches to restore hydraulics. This would lead to a failure to restore hydraulics when commanded via the HYD CUTOFF switch. Such an event would lead to delayed restoration, due to time taken to diagnose the problem and release the HYD TEST switch. Although as detailed in the section above, it is probable that the HYD TEST switch was released during the occurrence flight, it could not be determined at what point that occurred.

Crew coordination and pre‑flight preparation

Instructing is a complex task and instructors must balance the benefit to the student’s learning and experience with safe margins of operation in a dynamic environment. Instructor intervention is a critical control in flight training. It is often the final opportunity to retain control of the aircraft.

In intervention, an instructor has three time-sensitive options:

• adjust – fix the issue and allow student to continue
• restore – return to normal flight
• complete – take over and complete the sequence.

Intervention is supported by clear assessment, communication, and planning. The PUI received a classroom briefing on emergencies from the original instructor and the CFI received a briefing on the status of the PUI from the same instructor. However, possibly due to the delayed departure, the CFI and PUI did not conduct a pre-flight briefing.

The requirement for a pre-flight brief, especially where non-normal operations are conducted is well-established. Such a briefing reaffirms standard operating procedures, promotes predictable behaviour, and sets expectations among crew (Sumwalt and Lemos, 2010). In this case, the absence of a brief was a missed opportunity to establish correct procedure and generate a common understanding of how the practice emergencies would be conducted.

Once in the aircraft, the CFI advised he would announce practice emergencies and expected the PUI to fly and manage the aircraft. Any unannounced emergencies were to be considered real and the PUI should take immediate essential actions; the CFI would take over if necessary. This is a commonly relied upon arrangement in flight training yet, as an unsafe condition can develop rapidly during the simulation of emergencies, it often requires further definition and understanding between the pilots to be effective.

Additionally, during emergency training, the transition from practice emergency to a genuine emergency is not always clear. Ordinarily available cues for an emergency are defeated, warning lights may already be illuminated, and alarms may or may not sound. The PUI has, by definition, little working knowledge of the aircraft to support diagnosis. Not knowing the aircraft state creates ambiguity, which is known to delay decision-making (Orasanu, and others, 2001).

On this occasion, the absence of a shared mental model of when or how to terminate the sequence may have led to:

• no one controlling the aircraft
• both pilots controlling the aircraft
• a late intervention to prevent hovering
• a delay in restoration of hydraulics.

Due to a lack of available information however, it was not possible to determine to what extent the lack of pre-flight brief contributed to the accident.

Findings

From the evidence available, the following findings are made with respect to the fatal loss of control accident involving Eurocopter AS350BA, registered VH-BAA at Hobart Airport on 7 November 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The rotorcraft flight manual hydraulic failure emergency procedures were not followed. Specifically, the final approach was flown with a significant right crosswind and the helicopter was allowed to slow to a high hover.
• The hydraulic failure training sequence was allowed to progress to a point where control was no longer assured.
• Hover flight without hydraulic assistance led to loss of control of the aircraft.
• The hydraulic system was restored too late in the sequence to recover control of the aircraft. The reason for late restoration could not be determined.

Other factors that increased risk

• The operator did not follow the hydraulic failure simulation procedure required by the manufacturer. This introduced a hazardous condition with potential to delay restoration of hydraulic assistance.
• The collective mounted hydraulic cut off switch showed signs of excessive wear and intermittent operation. The switch may have required multiple actions to return hydraulic assistance when activated, potentially delaying restoration of the hydraulic system.
• The chief flying instructor and pilot under instruction did not conduct a pre-flight brief, to develop a shared understanding of how the hydraulic failure sequence would be conducted. This may have led to confusion over aircraft control and delayed restoration of the hydraulic system.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• aircraft operator
• pilot under instruction
• instructor
• Airservices Australia
• Civil Aviation Safety Authority
• previous accident investigation reports
• ATSB aviation occurrence data
• Airbus Helicopters.

References

Civil Aviation Safety Authority 2012, Civil Aviation Advisory Publication 5.14-2, Flight Instructor Training, on-line, www.casa.gov.au/rules-and-regulations/current-rules/civil-aviation-advisory-publications

Kouabenan, D.R., Ngueutsa, R., Mbaye, S. 2015, Safety climate, perceived risk, and involvement in safety management, Safety Science, 77, 72-29.

Orasanu, J, Martin, L, & Davison, J. (2001). Cognitive and contextual factors in aviation accidents, in E Salas and G Klein (Eds.) Linking expertise and naturalistic decision making, Lawrence Erlbaum Mahwah NJ. 209–226.

Sumwalt, R.L., Lemos, K.A. 2010, The Accident Investigator's Perspective, Crew Resource Management, pp. 399-423.

Weber, E.U., Milliman R.A. 1997, Perceived risk attitudes: Relating risk perception to risky choice, Management Science, 43(2), 123-144.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight-training organisation, pilot under instruction, instructor, Airservices Australia, the Civil Aviation Safety Authority, the Bureau of Meteorology, and the aircraft manufacturer.

Submissions were received from the flight-training organisation, the Civil Aviation Safety Authority, the instructor and the aircraft manufacturer. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A - Synopsis of related occurrences

National Transportation Safety Board (US) LAX92FA025 - 1991

At an airspeed of about 2 knots and a skid height of about 1 foot, the helicopter began an uncommanded turn to the left. The pilot attempted to counter the turn but was unable to move the flight controls. The helicopter's left bank angle, nose down attitude and left turn continued until the main rotor blades struck the ground.

National Transportation Safety Board (US) IAD99GA056 - 1999

The aircraft developed an uncontrollable roll to the left while hovering without hydraulic assistance.

…the helicopter began an uncontrollable roll to the left while at the hover…I tried to level the helicopter by using both hands to attempt to pull the cyclic control to the neutral/level position. The helicopter continued to roll left and subsequently the main rotor blades hit the ground.

Excessive flow rates were detected in all servos and two were rejected in a speed test.

National Transportation Safety Board (US) LAX00LA195 - 2000

The student struggled to control the aircraft towards the end of an approach with hydraulics off. The instructor took over and requested return of hydraulics. The student switched on the hydraulic system. Controls remained stiff and the helicopter impacted terrain.

He reported that just prior to touchdown, the aircraft controls became very stiff. At that point, the flight instructor directed the pilot trainee to re-engage the hydraulics isolation switch on the collective control. The student re-engaged the hydraulics but reported that the controls remained stiff, and he was having difficulty applying forward cyclic. As the instructor got on the controls it started a slow turn to the left. As the instructor attempted to counteract the turn rate increased. The helicopter impacted the ground in a left turn with rear lateral movement.

National Transportation Safety Board (US) ATL02LA097 - 2002

The training and checking captain was unable to control the aircraft while hovering without hydraulic assistance.

The check airman then stated that he would demonstrate the handling characteristics of the helicopter in the hydraulics off configuration. The check airman brought the helicopter to a hover approximately three feet above the ground. At that time the helicopters nose appeared to pitch up dramatically. This attitude was followed by a simultaneous rotation about the yaw axis. As the spin accelerated the check airman instructed the airline transport rated pilot to restore the hydraulics, which was done by depressing the switch on the collective. The rotation of the helicopter continued, and the helicopter impacted the ground coming to rest on the right side of the fuselage.

National Transportation Safety Board (US) ANC02FA029 - 2002

He brought the helicopter to a hover about four feet above the road. According to the pilot, the cyclic was frozen in the full aft left position when he lost control. The helicopter rolled left and struck the ground inverted.

Air Accidents Investigation Branch (UK) EW/C2004/10/05 - 2004

The AAIB found that the instructor did not follow flight manual procedure for hydraulic failure training, leading to the HYD TEST switch being activated at the same time as the HYD CUTOFF switch. The instructor did not attempt to restore hydraulics and was unable to recover the aircraft.

Transportation Safety Board of Canada A05F0025 - 2005

As the pilot gradually descended, and at a height of about 10 feet above ground level, he experienced significant binding in the flight controls. The pilot was unable to rectify the control binding and had considerable difficulty maintaining attitude and altitude control of the helicopter.

It should be noted that the pilot had not received any of the conventional alerts of hydraulic malfunction, such as the klaxon or the warning light.

National Transportation Safety Board (US) LAX07GA217 - 2007

While attempting to regain control at the bottom of a failed hydraulics off approach, the student did not restore hydraulics when requested by the instructor. The student stated that they were told it was dangerous to do so as it could induce over control. The instructor was unable to recover the aircraft.

The CFI [chief flying instructor] noted that the slowest airspeed the helicopter ever reached was a minimum of 8 kts. He added that he was not sure if the cyclic was immobile in any additional direction, aside from the forward-right position, as he did not move it into another direction to prevent possible further loss of control of the helicopter. The CFI estimated that he performs hydraulics-off simulated emergency procedures on a regular basis; he has never experienced any problems or difficulty controlling the helicopter.

A lateral servo was found to be rigged out of limits and mushroom deformation existed on the longitudinal servo.

National Transportation Safety Board (US) LAX08IA042 - 2007

Unlocking pressure on one hydraulic servo was too high and created a control lock. The instructor landed the helicopter by following the emergency procedure from the flight manual.

The CFI immediately noticed that an abnormal force was required on the cyclic control to prevent the helicopter's nose from pitching up and to the left.

The CFI elected to continue the landing with the hydraulics off …. He managed to complete a run-on landing without mishap by maintaining an airspeed of about 10 kts. When the helicopter came to rest, the pressure was released on the cyclic and the second pilot restored the hydraulics via the collective switch. Immediately thereafter, the cyclic began a hard over and displaced to the left against the CFI's leg. He attempted to center the cyclic with both hands, but he was unable to move the control.

National Transportation Safety Board (US) WPR10LA046 - 2009

The student lost control during hydraulic failure training. The instructor’s delayed input and a lack of positive exchange of control contributed to accident.

The instructor told the PUI [pilot under instruction] to turn the hydraulics back on. The helicopter continued in a nose low attitude and in a left bank of about 15-30 degrees. The pilots both stated that they could not move the cyclic in the lateral axis. The helicopter continued the rotation with the nose low attitude until ground impact.

Transportation Safety Board of Canada A13Q0021 - 2013

The TSB found that the instructor did not follow flight manual procedures for flight without hydraulic assistance. The instructor encountered heavy unpredictable control forces and could not recover from a steep left roll.

The flight instructor took off in manual mode and again flew a tight left pattern at low speed and low altitude. At the end of the base leg, at the beginning of the final approach, the helicopter momentarily reached a level attitude. Just before the flight instructor handed the controls to the pilot in training, the helicopter banked slightly to the left and then quickly rolled to the left in a nose-down attitude, and the main rotor struck the runway.

Air Accidents Investigation Branch (UK) EW/C2017/05/01 - 2017

The instructor lost control while flying a tight low-level left-hand circuit without hydraulic assistance and at a high angle of bank.

When interviewed, the instructor stated that he had been unable to move the cyclic control to the right to arrest the roll to the left.

Appendix B

For a full copy of the safety information notice click the hyperlink

Airbus Helicopters Safety Information Notice 3246-S-29 Rev1 2019

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

During the afternoon of 28 October 2017, a Cessna Aircraft Company T310R, registered VH-JMW (JMW) was conducting a return flight from The Lakes airstrip, New South Wales to Toowoomba Airport, Queensland with the pilot and one passenger on board.

On the return flight from Toowoomba, during descent to The Lakes, and while about 8 km from the runway, a witness recalled hearing the sound of what he thought was a single-engine aircraft ‘cough’ and then stop. Shortly afterwards, JMW was seen descending slowly with the landing gear extended. The aircraft then ‘jerked’ suddenly, rolled to the left and descended rapidly to the ground.

The pilot and passenger were fatally injured, and the aircraft was destroyed.

What the ATSB found

The ATSB identified that during the final descent towards The Lakes airstrip runway, the left engine was not producing power and the right engine was operating at low or intermittent power.

Following the loss of engine power a safe flying speed was not maintained resulting in a loss of control and collision with terrain due to either an aerodynamic stall, asymmetric power effects or a combination of both.

The loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.

Safety message

A loss of power in an aeroplane requires different responses depending on whether the aircraft has single or multiple engines. However, regardless of the configuration, in order to maximise the survivability outcome it is imperative that the pilot retains control of the aircraft and maintains a safe airspeed. Where the aircraft’s performance degrades to the point that continued safe flight is not possible, the pilot must shift focus to conducting a forced landing.

Pilots also need to routinely exercise good fuel-management practices in order to maintain the highest level of safety and avoid fuel exhaustion or starvation events. Civil Aviation Advisory Publication 234-1(2) provides guidance on the current fuel requirements and good fuel-management practices.

The occurrence

What happened

At about 1000 Eastern Daylight-saving Time^[1] on 28 October 2017, a Cessna Aircraft Company^[2] T310R, registered VH-JMW (JMW), departed The Lakes airstrip, New South Wales, for a private flight to Toowoomba Airport, Queensland with the pilot and one passenger on board. The aircraft arrived in Toowoomba at about 1130 and remained on the ground for a few hours.

At about 1437, the pilot and passenger departed for the return flight to The Lakes. The aircraft was not refuelled at Toowoomba and weather forecasts and reports indicated that conditions were suitable for flight under the Visual Flight Rules.^[3] There was a light westerly crosswind at the cruising altitude of 9,500 ft and a light easterly wind at lower altitudes near the destination.

At about 1541, the passenger sent a cheerful text message to a friend, which indicated that all on board the aircraft was normal. A short time later, the pilot began the descent from 9,500 ft and continued tracking towards The Lakes.

At about 1554, a witness located close to JMW’s track heard a low-flying aircraft to the west of his position travelling south (Figure 1, ‘Witness 1’). He described the aircraft as sounding like a single‑engine aircraft and recalled hearing the engine ‘cough’ and then stop as the aircraft flew past him.

Figure 1: Flight path of VH-JMW

Source: Google Earth modified by the ATSB

A minute later, two other witnesses, both driving south along the Pacific Highway, saw JMW to the west of the highway at low altitude (Figure 1, ‘witnesses 2 & 3’). One witness recalled the aircraft was descending slowly at first with the landing gear extended. Soon after, the witness saw the aircraft ‘jerk’ then roll to the left, pitch down and descend rapidly to the ground.

At about 1555, JMW impacted trees and then collided with terrain. The aircraft came to rest in a narrow wooded strip of land between the highway and the main northern railway line (Figure 2). The wreckage was about 800 m (0.4 NM) from The Lakes runway 16 threshold.

One of the witnesses driving on the Pacific Highway was the first to arrive at the accident site. He recalled smelling fuel on arrival, and the ground around the aircraft’s wreckage being wet. He also noticed a momentary wisp of smoke from sparking electrical components behind one of the wings however, there was no fire. Emergency services personnel arrived at the accident site shortly afterwards. A couple of the first responders reported a fuel smell near the aircraft, but others did not recall smelling fuel.

The pilot and the passenger were fatally injured, and the aircraft was destroyed in the accident.

Figure 2: Accident site

Source: ATSB

__________

1. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. On 29 July 2015, the Type Certificate Holder transferred from the Cessna Aircraft Company to Textron Aviation. All information related to the aircraft manufacturer in this report pre-dates that transfer.
3. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions clear enough to allow the pilot to control and navigate the aircraft visually.

Context

Pilot information

The pilot held a:

• Private Pilot (Aeroplane) Licence issued on 10 October 2000
• current Class 2 aviation medical certificate issued in 2017 without restriction
• Night Visual Flight Rules rating and a Private Instrument Flight Rules rating.^[4]

The pilot had owned a number of single- and multi-engine aircraft and was endorsed for the Cessna 310 in December 2001.

Extracts from the pilot’s logbook showed that he had in excess of 3,200 hours total flying experience on aeroplanes, with more than 300 hours experience on multi-engine aircraft. He last completed a multi-engine flight review with a flight instructor in May 2017. As part of that review, the pilot demonstrated his ability to manage asymmetric power conditions and simulated one‑engine inoperative exercises at various phases of the flight. The instructor recorded the pilot’s response to these exercises as ‘normal’.

Aircraft information

The Cessna Aircraft Company T310R is a low-wing, twin-engine aircraft equipped with retractable landing gear. In 1988, VH-JMW was modified under supplementary type certificates to replace the original Continental IO-520-MB engines with turbocharged engines (TSIO-520-NB) and fit new three-bladed propellers (Figure 3).

Figure 3: VH-JMW – Cessna T310R

Source: Flightaware.com

In December 2016, a periodic inspection was conducted. The maintenance release did not identify any defects. The release was valid for 100 hours or until 14 December 2017. The only scheduled maintenance task carried out during this release period was an engine oil change. Documentation for the aircraft’s prior maintenance history, including fuel gauge calibration, was not available.

At the time of the accident, the aircraft’s optional equipment included:

• a multifunction display
• a digital fuel flow indicator and totaliser (digital fuel system), which had replaced the standard Cessna analogue fuel flow gauge
• an electronic primary navigation display.

Fuel system

The aircraft’s fuel system consisted of two main tanks located on the tip of each wing, two auxiliary tanks and two wing locker tanks. The dual indicating fuel quantity gauge provided a continuous indication of the fuel remaining in the selected tanks based on fuel weight, for both the left and right sides of the aircraft. The aircraft was not equipped with optional low fuel level indicator lights. The total capacity of the main tanks and the auxiliary tanks was 628 L, with 617 L being usable. The total capacity of the wing locker tanks was 155 L with 151 L of usable fuel.

The main tanks were integrally sealed aluminium tanks, which were vented to atmospheric pressure by a flush vent located on the lower aft portion of each main tank. Each auxiliary fuel tank consisted of two interconnected bladder-type fuel cells located between the wing spars in the outboard section of each wing. The wing locker fuel tanks were located in the forward part of each wing locker baggage area and were also bladder-type cells that supplemented the main tank fuel quantity. The wing locker fuel could not be fed directly to the engines; instead, it was transferred to the main tanks by manually‑selected wing locker fuel transfer pumps.

Two fuel selectors, one for each engine, were located on the floor between the pilot and co-pilot seats. The fuel selectors controlled the wing selector valves to enable switching between the main and auxiliary fuel tanks.

The fuel system comprised the following pumps (for each side to the aircraft):

• engine-driven fuel pump (to transfer fuel from the centre sump to the engine)
• auxiliary boost fuel pump (to provide fuel pressure for priming during engine starting, and to supply fuel to the engine in an emergency)
• main fuel tank transfer pump (to transfer fuel from the nose of the main tank to the centre sump and allow steep descent with low fuel quantity)
• wing locker fuel tank transfer pump (to transfer fuel from the wing locker tank to the main tank).

Fuel tank selection

The Cessna T310R Pilot’s Operating Handbook (POH)(Revision 3, 1982) stated:

If auxiliary fuel tanks are to be used, select main fuel for … 90 minutes of flight. This is necessary to provide space in the main tanks for vapour and fuel returned from the engine-driven fuel pumps when operating on auxiliary fuel. If sufficient space is not available in the main tanks for this diverted fuel, the tanks can overflow through the overboard fuel vents.

The POH also stated that in the event of an engine failure, the fuel in the auxiliary tank on the side of the failed engine would become unusable.

The Cessna Aircraft Company’s Pilot Safety and Warning Supplements (1 June 1998) also included this important fuel tank selection sequence. If auxiliary tanks were to be used, this sequence would ensure excess fuel supplied to the engine was collected in the main tanks, and not vented overboard. The incorrect sequence could result in venting fuel, reducing the fuel available to complete the planned flight.

The potential for accidental venting of fuel overboard described above and guidance on correct tank sequence had been widely promulgated for a many years. As such, it was considered unlikely that an experienced pilot would make such an incorrect selection.

Digital fuel system

The aircraft was equipped with a digital fuel system that measured the instantaneous fuel flow to each engine and calculated the aircraft’s endurance based on current fuel flow and the system‑totalised quantity of fuel remaining.

The system did not measure the actual fuel quantity on board the aircraft, instead it relied on a manually entered starting quantity and the system‑calculated quantity of fuel consumed. Additionally, the data presented did not provide the pilot with the quantity of fuel in individual fuel tanks. The pilot had the following manual data entry options:

• input the quantity of fuel added
• update the system’s computation of fuel remaining
• selection of a ‘full’ fuel default.

The ATSB examined the digital fuel system and found that it was correctly configured for the aircraft and operational at the time of the accident. The default ‘full’ value was set to 616 L in the system settings, which closely corresponded with the usable capacity in the main and auxiliary tanks. The system was set to display ‘Lo FUEL’ when the pre-programmed fuel level of 100 L was reached. Once ‘Lo FUEL’ was displayed, the fuel flow information would not display until the pilot acknowledged the warning by pressing ‘enter’.

The system was also configured to display a warning for the flying time remaining (endurance time). When the endurance time reduced below the pre-programmed endurance time of 45 minutes, the data in the right half of the display flashed. This warning required the pilot to acknowledge the warning by pressing ‘enter’.

Operational information

Fuel management

At the time of the accident, the Civil Aviation Advisory Publication, CAAP 234-1(1) Guidelines for Aircraft Fuel Requirements, was in effect.^[5] The CAAP recommended a 45-minute fixed fuel reserve^[6] and that pilots use at least two independent fuel check methods to establish the quantity of fuel.

Fuel quantity

The last known fuel uplift by JMW was recorded on 12 September 2017. The number of flights undertaken between 12 September and the accident flight meant that the aircraft must have been refuelled during that time. However, no records were found to indicate where, when and how much fuel was uplifted. Consequently, it was not possible to determine the fuel quantity on board the aircraft on departure from either The Lakes or Toowoomba.

There was some indication that the pilot considered the runway length at The Lakes was weight limiting on take-off. While this could suggest JMW did not depart from there with full fuel, that could not be verified. The aircraft was not refuelled in Toowoomba prior to the return flight.

The ATSB found the refuelling facility at The Lakes airstrip had appropriate maintenance placards affixed to the bowser indicating that it was in use. The facility’s fuel tank was about one‑third full, and a test of the fuel indicated no fuel quality issues. The facility was not required keep fuel records.

The supplemental type certificate for JMW under which the turbocharged engines were installed did not provide revised fuel consumption rates. No other documents, such as pilot calculations for the aircraft’s fuel consumption or similar records, were found. In the absence of that information, the ATSB used the fuel consumption rates of a Cessna aircraft (of similar size to JMW and fitted with the same engines) to estimate fuel consumption for the accident flight. This calculation indicated that fuel consumption for the round trip from The Lakes to Toowoomba would be in the order of 425 L.

The on-board digital fuel system recorded a consumption of 563 L (based on the pilot’s last entry and system calculations) and displayed 53 L remaining. If the starting fuel quantity was accurate, there should have been 53 L (616 – 563 L) of usable fuel based on calculations remaining at the time of the accident. However, this could not be verified by independent calculations or physical evidence.

Asymmetric operations

The Cessna 310 has two wing-mounted engines that produce symmetrical propeller thrust during normal operation. When one engine is inoperative, the resulting asymmetric forces will cause the aircraft to yaw in the direction of the inoperative engine, which can be countered through the application of rudder and aileron control inputs. The minimum control speed (V_mca^[7]) of 84 KIAS^[8] must be maintained to ensure that the rudder and aileron retain sufficient control authority to maintain directional control of the aircraft. The value of the minimum control speed will vary from the published value with engine power level on the operable engine and aircraft configuration. With the operable engine at low power, the minimum control speed will reduce to a value close to the stall speed.

The intentional one engine inoperative section of the Cessna T310R POH stated that while the aircraft is controllable at V_mca, the performance is so far below optimum that continued flight near the ground is improbable. Therefore, the handbook recommended that a more suitable safe single-engine speed was 92 KIAS. At this speed, altitude could be maintained more easily while the landing gear is being retracted and the propeller is being feathered.^[9]

A single inoperative engine on a twin-engine aircraft may not always result in controllability issues that are immediately obvious to the pilot. This point was highlighted in the United States Federal Aviation Administration (FAA) Airplane Flying Handbook:

An engine failure in a descent or other low power setting can be deceiving. The dramatic yaw and performance loss will be absent. At very low power settings, the pilot may not even be aware of a failure.

Aircraft handling following engine failure

The Cessna 310 POH stated that, following an engine failure, the pilot’s first consideration is to maintain control of the aircraft and ensure the airspeed remains above the minimum control speed. It then stated that the pilot needed to identify the inoperative engine, adjust the operative engine as required, and perform a number of checks relating to fuel flow, tank selection and quantity; engine oil pressure and temperatures; magneto switches and mixture. If the engine could not be re-started, the pilot must ‘secure’ or shutdown the engine, which includes feathering the propeller.

The FAA Airplane Flying Handbook provides further practical guidance for managing such a situation. Importantly, the handbook stated that completely securing a failed engine may not be necessary or even desirable depending upon the failure mode, altitude, and time available.

It is recognised that if both engines lose power, the best gliding range will be achieved when the aircraft is flown at the optimum gliding speed and configured for the minimum aerodynamic drag. Guidance for configuring an aircraft following engine failure is provided in the Multi-Engine Pilot Manual by Jeppesen Sanderson (1992):

It is important that the pilot be familiar with the correct order for drag reduction following an engine failure. Normally, a windmilling propeller contributes the greatest amount of drag, followed by full flaps, extended landing gear, and the control deflections required to stop the airplane from turning. Since it is considered unwise to immediately feather an engine before it has been positively identified, drag is normally reduced by first retracting flaps and gear. Next, the failed engine is identified and the propeller is feathered. However, the specific order of drag reduction may vary between types of twin‑engine airplanes, so the manufacturer’s recommendations should be followed.

Based on the estimated weight of JMW, its best glide speed was about 102 KIAS at a glide angle of 4°. Any variation from that target airspeed would have reduced the gliding range. Shortly before the collision, the aircraft’s airspeed was about 67 kt, 35 kt less than the best glide speed.

Aircraft performance degradation

In relation to a previous Cessna 310 accident, the aircraft manufacturer provided information that an unmodified Cessna 310 at maximum landing weight has a single-engine climb rate of about 375 feet per minute at sea level. However, the drag penalties of an unfeathered windmilling^[10] propeller, extended landing gear and full flap significantly degrade single-engine climb performance. Under these conditions with one engine inoperative, a penalty to the climb rate of about 850 feet per minute could be expected.

In comparison to standard engines for its aircraft type, JMW’s engines were higher performing. At the time of the accident, JMW had its landing gear extended, propellers unfeathered and flaps at 15° (see the section titled Aircraft configuration). In this configuration, the aircraft descended about 1,100 ft during the last minute of its flight (see the section titled Recorded data).

Recorded data

The aircraft was fitted with an electronic primary navigation display. The recorded data on the navigation system included aircraft pitch, roll and ground speed.

ATSB analysis of the recorded data (partly illustrated in Figure 4) determined that:

• About 140 seconds before the collision, the aircraft rolled to the left and then to the right. The aircraft was travelling at about 150 kt at an altitude of 1,600 ft and was approximately 4.5 NM from the The Lakes runway threshold. There was a corresponding heading change to the left of approximately 4° followed by a change to the right of approximately 6°. This sequence could be consistent with asymmetric forces on the aircraft due to the loss of left engine power or a course correction onto the final approach path.
• Shortly after, the speed of the aircraft decreased below the maximum flap extension speed (158 KIAS) and the maximum landing gear extension speed (138 KIAS) indicating the pilot did not configure the aircraft into its final configuration until the last 100 seconds of the flight.
• From about 1554 (60 seconds before control of the aircraft was lost) the pitch of the aircraft trends upwards from -5° (nose down) to a maximum of 6.5° nose up just before the loss of control.
• Just after 1554, the aircraft’s altitude was about 1,100 ft^[11] (last known altitude). The aircraft was approximately 2 NM from the runway threshold.
• About 30 seconds before the collision and again about 10 seconds before the collision, the aircraft rolled to the left and pitched down with a heading change to the left (Figure 4). This sequence was consistent with asymmetric forces on the aircraft due to the loss of left engine power.
• Over the last 30 seconds of the flight, the rate of speed decay increased with the aircraft’s speed reducing to below the published (and likely actual) V_mca, and into the stall speed range (68–74 kt).^[12] Constant variations in pitch and roll were evident throughout this stage of the flight, with a continual upward trend in pitch (Figure 4).
• Just before 1555, the aircraft’s speed decayed to 67 kt^[13] (ground speed). The nose continued to pitch up, attaining a maximum pitch of about 6.5 degrees. Shortly after, the left wing dropped and the nose pitched towards the ground.

Figure 4: Last 280 seconds of recorded flight data

Source: ATSB

Wreckage and impact information

The ATSB’s examination of the accident site confirmed that the aircraft was in a left-wing, nose‑down attitude when it collided with terrain. It came to rest between a railway line and the Pacific Highway in a thicket of gumtrees and coastal scrub. The distribution of the wreckage and the damage to the trees indicated that the aircraft had little forward momentum on impact (Figure 2). The impact forces from the collision destroyed the aircraft.

Aircraft structure

All of the aircraft structure was identified at the accident site. There was no evidence of inflight break-up or post-impact fire. Continuity of the flight control cables and aircraft control surfaces were confirmed as secure or fractured due to overstress, consistent with the ground collision.

There were no pre-existing mechanical defects identified during the examination that would have prevented normal operation of the aircraft. However, there was severe disruption to the aircraft pitot tubes, seats and fuel selector system, making it impossible to determine their serviceability.

The aircraft’s occupant restraint system had been in use during the flight and was working normally.

Aircraft configuration

The wreckage examination showed that the aircraft was configured with the landing gear down and locked, and the flaps extended to 15°. Both the left and right engine propellers were towards the fine pitch, and not feathered.

The position of the flight controls, engine controls and fuel tank selectors immediately prior to the loss of control could not be determined due to the severe disruption of the cockpit and fuselage.

Engines

Continuity of the right engine propeller pitch control was established by visual inspection. The left engine propeller pitch control cable had separated at the governor connecting rod, consistent with overstress failure from impact forces.

The left propeller blades showed no evidence of bending, twisting or chord-wise (that is, across the width of the blade) scratching. This indicated that the left engine was not producing power on impact. On the other hand, one blade of the right propeller showed evidence of forward compound bending, and chord-wise scratching across its face. The spinner and propeller hub were partially buried in the ground with evidence of corkscrewing of the propeller pressure dome cover attached to the spinner. The propeller hub fractured at the crankshaft. Examination of the fracture surface showed that dominant failure load was bending, consistent with no significant power on the right engine at the time of impact with terrain.

An external visual inspection of the left and right engine and engine controls did not identify any pre-existing damage or defects. All of the damage identified (including to the left engine fuel pump and oil sump) was consistent with impact damage from the collision.

The cylinders, sparkplugs, crankcase and external accessories were confirmed secure on both the left and right engine. All of the fuel supply and return lines between the engine firewall and the engine were disconnected and inspected. Negligible fuel was found in the lines (they should contain fuel under normal operating conditions). No blockages in the lines that would have prevented fuel reaching either engine were found.

The left engine oil sump was breached during the impact and a quantity of oil had leaked out and been absorbed in the soil. However, the oil cap was secure and some oil was noted on the graduated dipstick. Oil was also identified in the right engine.

The spark plugs, fuel pump, vacuum pump and all cylinder rocker covers on both engines were removed and inspected. Rotation of the crankshaft on each engine demonstrated continuity of the major engine components. During rotation, the pistons, cylinder rocker arms, vacuum pump drive, fuel pump drive and magneto gears were found to move through their normal range. An endoscope was used to determine that the pistons, valves and cylinders were in normal operational condition.

The left and right engine turbo charger inlet and outlet impellors were inspected and nil damage identified. The absence of damage provided inconclusive evidence to indicate whether the turbo chargers were powered at the time of impact.

There was no evidence found during examination of the engines to indicate that either engine was incapable of normal operation.

The fuel system

Both the left and right main fuel tanks separated from the wings following overstress failure at the spar attachments, and were found between 5 and 10 m from the main wreckage. Impact forces from the accident breached both the tanks, but their fuel caps were found in place and secured.

The left and right auxiliary fuel tanks were holed and crushed during the accident. There was some evidence of discolouration under the left wing resulting from fuel weeping from the left auxiliary tank. This weep was assessed as minor and therefore considered to have had a negligible impact on the usable fuel quantity.

The left- and right-wing locker tanks were intact but the interconnecting pipes had fractured during the accident. There was no evidence of fuel in either tank.

There was no fuel-fed post-impact fire or evidence of fuel tank deformation resulting from a large quantity of fuel impacting the internal walls of the fuel tank during the accident. While the first persons to arrive at the accident site reported smelling fuel, others who arrived shortly afterwards did not smell fuel. This could be indicative of the smell of fuel vapour from ruptured tanks, which then dissipated. Further, ATSB investigators found a negligible quantity of fuel in any of the tanks or around the wreckage. They also observed no dieback of vegetation at the accident site in the days following the accident that is typical of a fuel spill.

The main fuel tank transfer pumps were tested and found to be operational; therefore, even with the aircraft in a steep descent all of the usable fuel in the main fuel tank was available for use. The left engine fuel pump could not be tested due to severe impact damage, while the right engine fuel pump was not tested as it was evident that the right engine was producing some power at the time of the collision. A small amount of fuel was found in each of the fuel distributors, indicating that both of the engine fuel pumps were operational prior to the accident. The small quantity of fuel may have been due to a low fuel volume in the tanks.

Related occurrences

The ATSB research report, Power loss related accidents involving twin-engine aircraft (Research and analysis report B2005/0085), found that:

• Power loss accident rates in twin-engine aircraft were almost half that for single-engine aircraft.^[14] However, a power loss accident in a twin-engine aircraft was more likely to be fatal and overwhelmingly the result of in-flight loss of control.
• Of the 58 accidents identified between 1993 and 2002 that resulted in damage following the power loss, seven occurred during the approach phase of flight. Three of these involved a loss of control, including one fatal accident. When compared to the take-off phase, the approach phase is considered to be equally risky, with low altitude and only a little more energy available than during the take-off phase.
• Just over one-third of power loss accidents in twin-engine aircraft occurred during a non‑asymmetric power loss. The majority of these were related to fuel management, and no benefit was derived from the presence of a second engine.

Another ATSB research report, Starved and Exhausted: Fuel management aviation accidents (AR-2011-112) summarised key occurrences related to fuel management and outlined procedures pilots can use before and during the flight to ensure they land with reserve fuel intact.

This report includes the following key safety messages.

• Accurate fuel management starts with knowing exactly how much fuel is being carried at the commencement of a flight. If the tanks are not filled to a known setting, then a different approach is needed to determine an accurate quantity of usable fuel.
• Keeping fuel supplied to the engines during flight relies on the pilot’s knowledge of the aircraft’s fuel supply system and being familiar and proficient in its use. Adhering to procedures, maintaining a record of the fuel selections during flight, and ensuring the appropriate tank selections are made before descending towards your destination will lessen the likelihood of fuel starvation at what may be a critical stage of the flight.

__________

4. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft to operate in instrument meteorological conditions (IMC), which have much lower weather minimums than flights conducted using the visual flight rules (VFR). Procedures and training are more complex as a pilot must demonstrate competency in IMC conditions while controlling and navigating the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
5. In November 2018, CASA 29/18 – Civil Aviation Fuel Requirement Instrument was released which re-introduced a fixed fuel reserve requirement (30 minutes for daytime VFR pilots) and required pilots to conduct in-flight fuel management with regular fuel quantity checks, and, if required, declare MAYDAY fuel. At the same time, the advisory publication was updated to include the new requirements.
6. For visual flight rules flights in an aircraft with piston engines.
7. V_mca is defined as the indicated airspeed at which it is possible to maintain control of the aeroplane when the critical engine is suddenly made inoperative, and thereafter to maintain straight and level flight at the same speed with an angle of bank of not more than 5° towards the operative engine.
8. Minimum control speed taken from STC.
9. Rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown.
10. Windmilling: a rotating propeller being driven by the airflow rather than by engine power; this results in increased drag at normal propeller blade angles.
11. The aircraft’s altitude was sourced from the flightradar24 website.
12. A range for the stall speed has been specified because the stall speed will vary with a number of parameters including weight, which was unknown at the time of the accident. The range has been estimated assuming the aircraft was lightly loaded and had less than 20 degrees angle of bank.
13. The aircraft’s system recorded ground speed of the aircraft. The weather reports for the area around the time of the accident indicate that the winds were light and therefore the groundspeed closely represents what the indicated airspeed would have been.
14. Only aircraft below 5,700 kg maximum take-off weight were included in the analysis.

Safety analysis

Physical evidence at the accident site allowed the ATSB to establish, that VH-JMW (JMW) was operating in a low engine power state when it collided with terrain. Similarly, recorded flight data and witness reports enabled analysis of the sequence of the aircraft’s loss of control in the lead up to the collision. The following analysis details the factors that contributed to the development of the accident.

Engine power loss

Examination of the wreckage identified that the aircraft was configured for a powered approach, in a high‑drag configuration - left and right engine propellers unfeathered, landing gear down and the flaps partially extended. Based on the recorded data, the landing gear and flaps were extended within the last 100 seconds of the flight and the airspeed reduced significantly over the same time period. Maintenance of a high‑drag configuration while the aircraft’s performance declined indicated that either the pilot did not recognise any engine abnormalities until late in the approach, or he assessed that sufficient engine power remained to reach the runway.

The nature, type and extent of damage to the propellers (bending, twisting and scratching to each), and examination of the fractured right propeller flange showed that, at the time of collision:

• the left engine was not producing power
• the right engine was not producing significant power.

No evidence was found to indicate a mechanical defect that would have prevented either engine from developing full power.

The ATSB considered whether the assessed low engine power levels at the time of the collision also existed immediately before the loss of control. While it is possible that the pilot may have reduced the engine power in the final moments, given the significant recorded decline in aircraft performance over the last two minutes of the flight, the low power state probably existed immediately prior to the accident. Distortion of the engine controls during the collision prevented identification of the selected power setting.

The positive nature of the text message sent about 14 minutes before the collision, indicated that the aircraft was performing as expected at that point in the flight. However, about 2 minutes and 20 seconds before the collision, at an altitude of 1,600 ft, the recorded data showed a large deviation in the aircraft roll and heading. Those deviations were consistent with a left engine power loss. Control of the aircraft’s pitch, roll, heading and speed declined from this point on (Figure 4).

In the last minute of flight, JMW’s descent rate was higher than expected for the aircraft type when operating on one engine in a high drag configuration. That indicated that the operative right engine was likely producing reduced power. Based on witness observations, it is possible that the right engine had intermittent power rather than a consistently low output.

In summary, the ATSB assessed that, shortly before the collision, the left engine had stopped producing power and the right engine was operating at low or intermittent power.

Loss of control

From the available evidence, it could not be determined when the pilot became aware of the left engine power loss. Consistent with the guidance in the United States Federal Aviation Administration Airplane Flying Handbook, it is possible that the power loss may not have been obvious as the aircraft was descending. Similarly, apart from extension of the landing gear and flap, it was impossible to determine the pilot’s response to the power loss and his subsequent actions. However, it is relevant to note that he had started an apparently normal descent minutes earlier (soon after 1541). He was also flying over thickly‑wooded terrain, and was very close to the destination before control was lost.

Recorded data enabled the loss of control to be better explained (Figure 4). The low engine power combined with the high-drag configuration meant that the aircraft’s speed and altitude could not be maintained. This in turn led to the airspeed declining to below the published V_mca and into the stall speed range. As the right engine was likely not operating at full power, the actual V_mca was less than the published figure and likely in the region of the aircraft’s stall speed. As the speed continued to decline, the nose was progressively pitched up to about 6.5°. The left wing and nose then dropped towards the ground resulting in a collision with terrain. That flight behaviour with the airspeed in the region of both the stall speed and V_mca, indicated a loss of control due to either a low-speed stall, asymmetric effects or a combination of both.

Fuel-related factors

There was no evidence of a mechanical defect to explain the apparent engine power losses. However, the absence of fuel in the supply and return lines indicated that sufficient fuel was not reaching either engine at the time of the collision. This, and other fuel-related evidence, resulted in the ATSB exploring potential fuel starvation and exhaustion scenarios, and related factors.

As no fuel uplift occurred in Toowoomba before the accident flight, JMW departed The Lakes with a fuel quantity that the pilot considered sufficient for the return flight. However, with no fuel records or other evidence available, that quantity could not be determined. It is possible that there was sufficient fuel for the return flight as anticipated by the pilot and the wreckage examination did not identify any pre-existing fuel tank leaks that could have affected the storage capacity.

After the aircraft began its descent to The Lakes, recorded roll and heading deviations indicated that the left engine lost power first due to insufficient fuel supply. The right engine’s loss of power, some time later, was consistent with the expected slight variation in fuel consumption and tank fuel quantities between the left and right systems.

The on-board digital fuel flow indicator and totaliser indicated there were 53 L of usable fuel in the tanks at the time of the collision. However, this was not a measured quantity but a system‑calculated figure based on consumption, and relied on an accurate starting quantity. While the system was correctly set up, the ATSB could not verify this figure because there were no fuel records or fuel consumption rates. The absence of fuel damage to vegetation at the accident site, no post-impact fire and no strong, persistent fuel smell, supported a conclusion of minimal fuel on board. The ruptured fuel tanks made it impossible to determine (or estimate) the fuel quantity that they had contained.

The investigation considered the possibility of inadvertent venting of fuel overboard due to the incorrect sequence of selecting fuel tanks (auxiliary before main tanks). However, given the pilot’s significant experience and familiarity with the aircraft type, and the well-known tank selection sequence, it is unlikely that he would have made such an error.

The investigation also considered a scenario where the pilot attempted using all usable fuel in the auxiliary tanks before switching the fuel selector to main tanks for landing (to avoid having unusable fuel in the auxiliary tanks in the event of an engine failure on approach). Mis‑timing the switchover could interrupt the fuel supply if the auxiliary tanks were exhausted. This would introduce air into the fuel lines, and manifest as struggling engines, such as observed by the witness. There was insufficient evidence to determine the likelihood that occurred.

In summary, based on the scenarios and fuel-related factors considered, it is possible to state that:

• the fuel quantity when the aircraft departed either The Lakes or Toowoomba could not be determined but may have been sufficient to complete the return flight
• the left engine lost power after its fuel supply was interrupted when approaching The Lakes
• the right engine lost power due to a restriction to its fuel supply (it could not be determined if this was due to control inputs or otherwise)
• at the end of the flight, there was probably less than 53 L usable fuel
• it is unlikely that fuel was vented overboard due to incorrect tank selection sequence
• it is possible that a fuel tank switchover was intended and mis‑timed.

Therefore, the ATSB concluded that the loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.

Findings

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving a Cessna Aircraft Company T310R, registered VH-JMW that occurred 40 km south‑south‑west of Port Macquarie, New South Wales on 28 October 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• During the final descent towards The Lakes airstrip runway, the left engine was not producing power and the right engine was operating at low or intermittent power.
• After losing engine power at low altitude, a safe flying speed was not maintained resulting in a loss of control and collision with terrain due to either an aerodynamic stall, asymmetric power effects or a combination of both.
• The loss of engine power was probably the result of either insufficient fuel for the flight or an in‑flight fuel management error.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• a number of witnesses
• the aircraft manufacturer (Cessna)
• aircraft refuellers
• Textron Aviation
• The Civil Aviation Safety Authority
• The United States Federal Aviation Administration.

References

• Jeppesen Sanderson Inc 1992, Multi-Engine Pilot Manual, Jeppesen Sanderson, Colorado.
• ATSB aviation research investigation report B2005/0085, Power loss related accidents involving twin-engine aircraft.
• ATSB aviation research investigation report AR-2011-112, Starved and exhausted: Fuel management aviation accidents.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to representatives of the aircraft’s occupants, the United States National Transportation Safety Board, the Civil Aviation Safety Authority, and the aircraft manufacturer.

Any submissions from those parties will be reviewed and where considered appropriate, the text of the draft report will be amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 26 January 2017, the pilot of a Grumman American Aviation Corp G-73 amphibian aircraft, registered VH‑CQA (CQA), was participating in an air display as part of the City of Perth Australia Day Skyworks event. On board were the pilot and a passenger. The pilot of CQA was flying ‘in company’ with a Cessna Caravan amphibian and was conducting operations over Perth Water on the Swan River, that included low-level passes of the Langley Park foreshore.

After conducting two passes in company, both aircraft departed the display area. The pilot of CQA subsequently requested and received approval to conduct a third pass, and returned to the display area without the Cessna Caravan. During positioning for the third pass, the aircraft departed controlled flight and collided with the water. The pilot and passenger were fatally injured.

What the ATSB found

The ATSB found that the aircraft aerodynamically stalled during a positioning turn for the third pass, resulting in the collision with shallow water. The manner in which the pilot returned to the display area after the second pass was not in accordance with the display procedures and increased the risk of mishandling the aircraft in an area of relatively close proximity to the public. The pilot’s decision to carry a passenger was also contrary to the requirements of the display instrument and increased the severity of the outcome.

Finally, a safety issue was identified with the current regulatory framework for air display approval and oversight.

What's been done as a result

The Civil Aviation Safety Authority had independently published a revised manual of guidance for air displays in September 2017. The document provided further detail on the key roles and their responsibilities and introduced a requirement to conduct a risk assessment as part of the application process. In April 2018, CASA updated the associated participant form, which was expanded to assist pilots with their display preparation and included a requirement to identify and provide justification for any additional persons on board display aircraft. The form also included a section to provide additional assurance around completion of the display coordinator’s responsibilities.

Finally, the ATSB has issued a safety recommendation to CASA to undertake further work to enhance their tools and guidance for air display approval and oversight, and procedures to ensure the suitability of those responsible for organising, coordinating and participating in air displays.

Safety message

Air displays are activities with inherent and unique risks that pilots, the organisers and the regulators all have responsibilities in addressing. It is important that holders of these key positions have a thorough understanding of their role and responsibilities, to ensure adequate completion of safety critical tasks. Having well-defined, transparent and consistent processes for planning and approval of air displays will assist in identifying risks and implementing effective mitigation strategies.

In addition to complying with regulations, pilots can limit their risk exposure by only participating in displays that are within their own and their aircraft’s capabilities and limitations, and not undertake any impromptu manoeuvres that have not been planned or practiced.

These steps combined will provide greater safety assurance for participants, spectators and the general public.

VH-CQA

Source:  Flightaware.com

The occurrence

On 26 January 2017, the pilot of a Grumman American Aviation Corp G-73 amphibian aircraft, registered VH‑CQA (CQA), was preparing to participate in an air display as part of the City of Perth Australia Day Skyworks (Skyworks) event.

The pilot of CQA and a passenger arrived at Serpentine Airfield, 48 km south of Perth (Figure 1), at about 1500 Western Standard Time,^[1] to prepare the aircraft for flight. The pilot was reported to have used his mobile phone to discuss aircraft performance with another individual and subsequently unloaded some equipment to reduce the aircraft’s weight. At about 1625, once the pilot had confirmed via phone the take-off calculations for the runway length and local temperature of about 42˚C, he and his passenger, who did not have any pilot qualifications, boarded CQA.

The pilot was in the left seat and the passenger in the right seat. CQA departed from runway 23 and tracked out towards the coast. The pilot of another aircraft returning to Serpentine Airfield observed CQA’s departure and described it as a ‘long and slow climb’, which they surmised was due to a combination of the high ambient temperature and the aircraft’s inherent performance.

The pilot of CQA planned on flying ‘in company’ (see the section titled Procedure for fly‑bys) with a Cessna Aircraft Company C208 ‘Caravan’ amphibian, registered VH-MOX (MOX) during the air display. The pilot of MOX received a text message from CQA’s pilot, advising that he would not be landing at Jandakot Airport as previously discussed and requested that they meet up overhead the agreed alternative location of Cockburn Sound (Figure 1). MOX departed from Jandakot at about 1645 and met up with CQA over Cockburn Sound.

Upon meeting up, the pilot of CQA assessed that MOX’s speed was too high for the two aircraft to travel together and requested that the Caravan pilot slow his aircraft down. The pilot of MOX agreed to slow down with a request that CQA ‘didn’t get too close’. Both aircraft then flew the prescribed route to Perth Water, the location of the air display. The weather was fine with a recorded wind of about 20 km/h from the south-west and a temperature of about 39°C.

Figure 1: CQA and MOX flight path

Source: Google Earth, modified by ATSB

Once approved to enter the display area, CQA followed MOX via the prescribed inbound route to the north of Perth city in order to conduct a fly-by parallel to the Langley Park foreshore in a westerly direction (Figure 2). MOX conducted a splash‑and‑go^[2] in front of Langley Park while CQA followed at about 200 ft above the water. The delay associated with MOX’s splash-and-go resulted in the separation between MOX and CQA reducing. MOX lifted from the water surface, entered a climbing turn and conducted a left orbit^[3] within the confines of Perth Water to reposition for a second pass of Langley Park.

Flight data and video footage showed that CQA took longer to initiate the left orbit and subsequently flew at about 500 ft over the built-up area of the South Perth peninsula that connects to the Narrows Bridge, at the western end of Perth Water. CQA then descended to about 200 ft over the south of Perth Water while repositioning for a second pass.

Figure 2: CQA air display flight track, showing the first pass in yellow, the second in magenta and the third in red

Source: Google Earth, modified by the ATSB

When MOX conducted its second splash-and-go in front of Langley Park, CQA was about half an orbit behind, flying in an easterly direction along South Perth foreshore. Following completion of the splash‑and‑go, the pilot of MOX climbed over the Narrows Bridge to about 1,000 ft for the return flight to Jandakot. CQA’s second fly-by of Langley Park was lower than the first, descending to just above the water surface, before a climb was also initiated to clear the Narrows Bridge.

On departure from Perth Water, the pilot of MOX transmitted on the display frequency that he was exiting the display area and returning to Jandakot Airport. CQA flew over the Narrows Bridge and initially followed MOX toward Jandakot, during which time the pilot requested approval to conduct a third pass. This request was authorised via radio by the ‘Ringmaster’,^[4] but as the pilot of CQA did not hear the authorisation, MOX re‑transmitted the approval to CQA, while continuing with their own departure. CQA then conducted a left turn and returned directly to Perth Water, at about 300-400 ft over the built-up area and moored spectator boats.

CQA flew in an easterly direction, parallel with the South Perth foreshore, before commencing a left turn towards Langley Park to position for the third pass. The aircraft was at a similar altitude to the first orbit at the commencement of the turn, but was slower and positioned further towards the middle of Perth Water (Figure 3). Video and still imagery recorded that the wing flaps were in the retracted position. The left turn was tighter than that of the first orbit and during that turn, CQA rolled left and pitched nose-down, consistent with an aerodynamic stall^[5] (Figure 4). The aircraft collided with the water and was destroyed. The pilot and passenger were fatally injured.

Immediately after the accident, the remainder of the air display was cancelled, followed shortly after by cancellation of the entire Skyworks event.

Figure 3: CQA's pass along South Perth, just prior to the final left turn

Source: David Roses

Figure 4: CQA just prior to the collision with water (looking north)

Source: Mike Graham

__________

1. Western Standard Time (WST): Universal Coordinated Time (UTC) + 8 hours.
2. A splash-and-go is a manoeuvre whereby the aircraft descends until the floats/hull briefly contacts the water surface, before climbing away.
3. An orbit is generally recognised as a 360˚ turn at a constant altitude, however this was the terminology used for the air display with respect to the manoeuvres within Perth Water and has been used in this report for consistency.
4. See the section titled Air display roles and responsibilities.
5. Aerodynamic stall: occurs when the airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack, typically greater than 16˚ to 18˚, and results in reduced aerodynamic lift.

Context

Pilot information

The pilot held a Private Pilot (Aeroplane) Licence issued in July 1994, and a current Class 2 Aviation Medical Certificate. His endorsements included floating hull, manual propeller pitch control and retractable undercarriage, and he held single- and multi-engine ratings. The pilot completed his floating hull endorsement in October 2011 on a LA-4-200 Lake Buccaneer Amphibian. In 2012, he completed about 18 hours of flight training^[6] in the Grumman American Aviation Corp G-73 Mallard (Mallard) in the United States, under his Federal Aviation Administration (FAA) licence.

The pilot accrued about 21 hours on VH-CQA (CQA) between 6 and 13 January 2017. Prior to that, he had not flown any aircraft since 29 August 2016. The pilot conducted no further flights until 26 January 2017. At the time of the occurrence, the pilot’s logbook indicated that he had 625 hours flying experience, with about 180 hours in the Mallard.

The pilot had accrued 136 water landings, of which 84 were completed over the two days of his floating hull endorsement. The pilot’s Mallard water landing experience consisted of 37 landings during dual training and 11 while solo. The pilot’s most recent water landing (which was in CQA) was conducted on 28 February 2016.

Post‑mortem examination and toxicological analysis of the pilot and passenger did not identify anything that may have contributed to the accident.

Mallard rating and flight reviews

The pilot’s Mallard training in the United States, was completed on 25 May 2012 and was conducted on the same aircraft that was later registered as VH-CQA (see the section titled Aircraft information). The pilot’s log book was endorsed as ‘training completed’ and ‘unrestricted land and sea use of the G73’ and he commenced flying the Mallard solo, in Australia on 30 July 2012.

Due to an administrative error during conversion of the pilot’s United States flight crew licence, his Civil Aviation Safety Regulations (CASR) Part 61 licence was not issued with a G-73 rating. This was identified by the Civil Aviation Safety Authority (CASA) during the air display application process. The pilot applied for the G-73 rating on 19 January 2017 and his licence was reissued with the type rating on 24 January 2017.

CASA Instrument 186/14 published on 25 August 2014, introduced prescribed aircraft, ratings and variants for the CASR Part 61 licencing system. On 23 December 2014, CASA published Prescription of aircraft and ratings – CASR Part 61, identifying those aircraft considered sufficiently complex or having performance or handling techniques that warranted initial specific training and per-type flight reviews. Schedule 6 of this document identified the Grumman G‑73 Mallard as a type-rated aircraft.

The pilot’s most recent biennial flight review was conducted in April 2016 in a Piper PA-30 Twin Comanche. The flight review prior to that (April 2014) was also conducted in the PA-30. An exemption to CASR Part 61, EX97/16, allowed for a multi-engine aeroplane class rating flight review to satisfy the flight review requirement for a type-rated multi-engine operation. The pilot therefore satisfied the flight review requirement to fly the Mallard, but had not had a review in the aircraft type since his endorsement.

Despite the exemption, all pilots were subject to the CASR 61.385 ‘general competency rule’, which indicated that a pilot is only authorised to fly an aircraft if they are competent to the standards mentioned in the CASR Part 61 Manual of Standards. Outside of the requirement for flight reviews, the pilot was responsible for ensuring his competence to fly the aircraft.

The instructor who provided the pilot’s floating hull endorsement training flew with him again in April 2015, this time in the Mallard. He recalled the pilot as being ‘generally pretty good’, but that he ‘wasn’t quite up to speed with the aeroplane’ and suggested that this may have been due to the pilot’s irregular flying.

Air display experience

The pilot participated in several air displays whilst flying CQA, including the:

• Great Eastern Fly-In (GEFI) events at Evans Head Aerodrome in New South Wales in 2015, 2016 and 2017.
• Brisbane Valley Air Show (BVAS) at Watts Bridge Memorial Airfield, Queensland in 2016.

The programs for these events indicated that the pilot demonstrated a ‘handling display’. Review of video footage showed that the displays included one or more straight and level fly-bys with repositioning turns for return passes.

The pilot’s application to take part in the Perth air display described the proposed display as ‘same display as used previously at GEFI and BVAS, minimum height 300 ft, no aerobatic manoeuvres, multiple passes, no ‘dirty pass’,^[7] all within normal operating manual’.

Familiarity with the Perth Water air display area

On 13 January 2017, during CQA’s repositioning from New South Wales to Western Australia, the pilot undertook a flight from Esperance to the north of the Perth metropolitan area and then tracked south along the coast before turning inland, toward Perth city. During this time, the aircraft flew in an easterly direction along the Langley Park foreshore at about 1,000 ft, before turning right prior to the Causeway Bridge (Figure 6). CQA was then flown in a westerly direction toward the south Perth peninsula, where the aircraft tracked toward Fremantle, then down the coast toward Serpentine Airfield. The pilot did not fly CQA again until the air display on 26 January 2017.

Aircraft information

The Grumman American Aviation Corp G-73 Mallard is a high-wing, medium-sized amphibious aircraft^[8] with under-wing floats, retractable landing gear and two-step hull (Figure 5). It was powered by twin Pratt & Whitney R-1340 Wasp radial engines. The Mallard was designed for regional airline operations with two pilots and ten passengers. Fifty-nine aircraft were built between 1946 and 1951.

Mallard serial number J-35 was built in 1948 in the United States and was first registered in Indonesia that same year. In 1976, the aircraft was relocated to the United States and operated there before the occurrence pilot purchased it and transferred it to Australia in July 2012. The aircraft was then based at Evans Head Airfield, New South Wales.

Figure 5: VH-CQA

Source: David Roses

The aircraft flew in Australia under its United States registration until it was re‑registered as VH‑CQA (CQA) in July 2013. In August 2013, CQA was issued with a Special Certificate of Airworthiness in the Experimental – Exhibition category with defined operating requirements. This included that any passengers were to be made aware that the design, manufacture and airworthiness of the aircraft was not required to meet any standard recognised by CASA and that flight in the aircraft was at their own risk. In addition, warning placards detailing this information were to be placed in full view of all passengers.

Flight characteristics and performance considerations

The ATSB sought the input of two experienced Mallard pilots and a CASA-authorised flight analyst in order to gain appreciation of the flight characteristics of the Mallard and its performance considerations. It was commented that the Mallard could easily be operated by one pilot. However, it was also mentioned that because it has a constant-angle, high performance wing^[9] it ‘requires more care than with a wing that provides more lift at a slower speed’, particularly as a stall can result in the aircraft going ‘straight onto its back’.

Maintenance history

CQA was maintained in accordance with a CASA-authorised System of Maintenance (SOM). This SOM was effective as at May 2013 and the aircraft was required to undergo a conditional ‘periodic’ inspection every 12 months or 100 hours, whichever came first. CQA was maintained by a CASA-authorised maintenance provider, who conducted a periodic inspection and issued the current maintenance release, on 6 January 2017. At the time of the accident, the aircraft had accumulated about 22 hours since that periodic inspection and had a total time in service of 7,336 hours.

As CQA was reportedly being relocated to Western Australia, the maintainer released the maintenance log books to the pilot. However, they could not be located following the accident and the maintenance history could therefore not be reviewed by the ATSB. Information from CASA and other sources did not identify evidence of any previous accidents involving the aircraft.

An installed autopilot was removed from CQA as part of Supplemental Type Certificate SA635SO, prior to its delivery to Australia. Removal of that equipment reduced the maximum certificated take-off weight to 5,700 kg. The aircraft flight manual authorised the G‑73 for single-pilot operation^[10] and CQA’s instrument panel was set up for left-seat, single-pilot operations.

CQA was not fitted with a stall warning device^[11] and there was no requirement for one.

VH-MOX and flight crew information

VH-MOX (MOX) was a Cessna Aircraft Company 208 ‘Caravan’ that was manufactured in 1993 and first registered in Australia in 1994. The Caravan is an all-metal, high-wing aircraft that is powered by a single Pratt & Whitney PT6A turboprop. MOX was fitted with floats with retractable landing gear to allow for land and sea operations. The Caravan had a maximum take‑off weight of about 3,600 kg.

The flight crew of MOX consisted of the pilot in command (PIC), in the left seat, and an observer, in the right seat. The PIC held a current instrument and Grade 1 instructor rating and had extensive float experience operating Caravans. The PIC also had commercial Caravan operations experience within Perth Water and had operated the aircraft there in the week prior to the air display. In addition, the PIC had previous experience participating in the Perth Air Display.

The observer was a pilot with significant experience in float planes and floating hull aircraft, at Perth Water and other locations. He held a Grade 1 instructor rating and had over 27,000 hours flying experience. In addition, he had previous air display experience in light aircraft. Both pilots had low-level endorsements, with recent experience, and had flown with each other previously.

Meteorological information and water conditions

The Bureau of Meteorology reported the weather conditions for 26 January 2017 were ‘fine, very hot and sunny’ with temperatures reaching 42˚C in the Perth area^[12] during the day. Perth Airport records for 1500 indicated the temperature was 41.5˚C with a relative humidity of 9 per cent. Wind speed and direction recordings from nearby Melville Water indicated a wind speed of about 11 knots from 226˚ (20 km/h from the south‑west). Pilots in the air display described the water condition as ‘ideal’, not glassy, with small ripples to assist with depth perception and wind direction identification.

The sun was low in the sky to the west and was unlikely to have affected the pilot’s visibility immediately prior to the collision, when the aircraft was flying east and then turning north.

Recorded data

Analysis of available track data (as depicted in Figure 2) found that the Mallard’s speed on entry to the accident turn was approximately 10 kt slower than at the equivalent point in the previous orbit and within around 10 kt of the aircraft’s stall speed for a coordinated turn at an estimated 30° angle of bank at the commencement of the turn.

Site and wreckage information

CQA collided with water on the Swan River, in a shallow section, approximately mid-way between the Langley Park and South Perth foreshores and about 700 m west from The Causeway. A navigable channel had been dredged parallel with the Langley Park foreshore, the remainder of Perth Water was relatively shallow, with a layer of silt. The mostly‑submerged wreckage was recovered and transported by barge to a nearby secure facility for technical examination.

Damage to the aircraft was consistent with the observed collision with water in a steep nose-down attitude and subsequent contact with terrain, about 1.5 m below the surface. Examination of the wreckage did not identify any evidence of in-flight break‑up, component failure or other anomalies that may have contributed to the collision with terrain, or that would have prevented the engines and propellers from operating normally. This was consistent with witness reports, images and video of the aircraft during the display.

Conduct of the air display

Overview

The City of Perth (CoP) managed the Australia Day Skyworks (Skyworks), which consisted of a series of events on 26 January each year, culminating in a fireworks display from barges moored in the centre of Perth Water (Figure 6). Perth Water is located on the Swan River between Langley Park and the South Perth shoreline, the Narrows Bridge in the west and Causeway in the east. Events included various activities on the Langley Park foreshore and the South Perth foreshore, which was coordinated by the City of South Perth. Water-based events and the air display were managed on behalf of CoP by a contracted events management company. Up to 300,000 people attended each year.

The air display had been a part of the Australia Day activities since 1993. The event was originally organised by an individual, then through the Royal Aero Club of Western Australia, before being incorporated into the CoP’s overall management of the event.

The air display was scheduled to run from 1530 until 2000, before the commencement of the fireworks display. The programme consisted of fly-bys (small vintage aircraft, like Tiger Moths, through to a medium-sized Fokker 100 jet), individual and group aerobatics, banner/flag-towing, aerial displays from water-bombing aircraft and float plane ‘splash-and-go’s’. The participating pilots were mostly volunteers, many of whom had been associated with the event for many years. Several of the pilots also participated in multiple displays on the day.

Figure 6: Perth Water

Source: Google Earth, modified by ATSB

Airspace

Perth Water is located about 10 km west‑south‑west of Perth Airport, in class C airspace. A temporary danger area (TDA)^[13] ‘Area ALPHA’ (Figure 7) was established by Airservices Australia for the duration of the air display, from surface up to 1,500 ft AMSL.^[14] This allowed air display aircraft to operate in Perth Water without the need for specific air traffic control (ATC) clearance. A central point of contact ‑ the Ringmaster ‑ was required to maintain two-way communication with Perth ATC and coordinate aircraft access into Area ALPHA on a specified frequency. Standard airspace procedures were required for operations outside of Area ALPHA.

Figure 7: Google Earth image showing approximate location of Perth Water within Area ALPHA.

Source: Google Earth, modified by ATSB

Air display program and procedures

The CASA-approved air display program documented all participating aircraft, flight crew and routines for the display. Where a routine involved multiple aircraft, one aircraft was designated the ‘lead’ aircraft and would conduct all radio communications on behalf of the group. Each display was scheduled in 10‑15 minute time slots. The display program was often similar to the year before, depending on availability of aircraft. All pilots taking part in the air display were provided with briefing notes, which included a copy of the CASA approval, airspace procedures, air display program and standard display procedures.

Inbound, holding and outbound tracking

The procedures for approach and departure from the display area were detailed in ‘display procedure B2’ (Figure 8). Once aircraft had entered Area ALPHA they were to track toward the holding area XRAY at an altitude of 1,500 ft (D1 INBOUND OUTBOUND HOLDING). If holding was required, aircraft would perform right orbits until they were given clearance by the Ringmaster to track inbound to Perth Water. Unique displays, including aerobatics, entered Perth Water in accordance with their documented routine.

For all non-aerobatic aircraft, the standard inbound route to the display area (Perth Water) was to fly over Kings Park then Northbridge (to the north of Perth City) and via the Graham Farmer freeway toward the East Perth power station (D2 INBOUND DISPLAY AREA). Aircraft descended to 1,000 ft while flying over the Swan River toward the Causeway and Perth Water. Departure from the display area was via the Swan River at 1,000 ft toward Fremantle, until clear of Area ALPHA.

Figure 8: Extract of the CASA‑authorised B2 display procedure supplied to all participants

Source: CASA

Procedure for fly-bys

Fly-bys (procedure D3, Figure 9) were to be performed by groups of aircraft flying ‘in formation’ or ‘in company’. The program noted that ‘formation rated and current pilots [are to] only [fly] in formation groups up to maximum of 6. Other aircraft [including those operating in company] were to maintain 600 metre separation between each other’.

Figure 9: Extract from the ‘display procedures – B2’ diagrams, showing the arrow that indicates the direction and location of the float plane landing area

Source: CASA

Following the standard approach and departure procedure, aircraft conducting fly-bys were to descend from 1,000 ft to not below 500 ft over the channel of water between the pyrotechnic barges (red rectangle, Figure 9) and Langley Park foreshore. The aircraft were to depart over the Narrows Bridge (Figure 6) and track over the Swan River at 1,000 ft, back toward Jandakot Airport.

If additional fly-bys were approved by the Ringmaster, there were two options to re-enter the D2 ’inbound display area’ procedure:

• aircraft could turn right before Kings Park and fly along the freeway on climb to 1,500 ft and re‑join the D2 procedure at the western end of Northbridge, or;
• from the Narrows Bridge they could track along the Swan River and fly over Kings Park on climb to 1,500 ft, before re-joining the D2 procedure at Northbridge.

The standard D3 procedure was to be followed for the remainder of any additional fly-bys. Between one and three fly-bys, per display, had been the standard in preceding years. Fly-bys and multiple passes were not specifically detailed with respect to the float plane procedure.

Procedure for float planes

Float planes had been part of the air display in the past, but not every year. Previous float plane displays had included the Cessna C208 Caravan, a Cessna 206 and a Lake Aircraft LA-4-200 Buccaneer.^[15] The display coordinator (DC)^[16] advised that float planes were added to the air display about 10 years prior to this accident. A representative from CASA observed him demonstrate the intended display in a Cessna 206, before they were approved for inclusion in the display program. The C208 Caravan was the most frequently used aircraft type for this display.

Within Perth Water, the float planes were permitted to descend to the water surface. On some occasions they had landed and back-tracked before turning around and taking off. However, it was reported that when conditions were suitable, float planes were expected to conduct a splash‑and‑go, remaining on the step.^[17] The C208 Caravan float plane procedure submitted to CASA for 2015 and 2017 was essentially the same and is shown in Figure 10.^[18]

Figure 10: Float plane procedure approved by CASA in 2015 and 2017

Source: CASA

A procedure for the Mallard was added to the float plane procedure for the 2017 air display and included ‘touching the water the same as above [the C 208] but without getting off the step’.

Both the floatplane and flying boat procedures contained a contingency to conduct a missed approach while remaining in the display area if water and wind conditions were not suitable. Both procedures also made reference to ’approach…per standard bridge clearance procedure’. There was no reference to what this procedure was, but it was assumed by the ATSB to be the standard approach and departure (B2) procedure.

The B2 display procedure included the ‘D6 Floatplane Landing’ (Figure 9) location at the northern edge of the display box.

Actual conduct of the float plane display

When the float plane display was first introduced, the aircraft would usually land, back-track and then take off. While not documented, the sequence was subsequently altered to a splash-and-go, followed by the left orbit. That variation had reportedly been in place for a number of years.

The float plane procedure in practice was therefore to approach from behind the city to enter Perth Water, conduct a low pass (or splash‑and‑go) at the northern edge of the display box, followed by a left orbit within the confines of Perth Water, before conducting a second pass along the Langley Park foreshore. The float planes would then depart as per the standard procedure or conduct a second left orbit if they were going to do a third pass/splash‑and‑go.

This sequence was consistent with the display briefing given the night before the activity, where the float plane display was described by the DC as follows:

The float planes… will be doing their touch and go…but they won’t be landing fully. If anything they [are] just kissing the water and then do an orbit and then another one and then [depart].

Further, video footage of the briefing showed the DC indicating left orbits on the projected map at this time.

CASA’s understanding of the float plane display sequences

CASA personnel who approved the display advised that they were not aware left orbits within the confines of Perth Water were being conducted during the float plane display. They reported having an understanding that:

• the float planes would conduct the standard approach from behind the city
• perform one low pass, or splash-and-go
• depart via the standard procedure.

They further stated that had they known left orbits were being conducted, they would not have approved a ‘turn into that area in a Caravan, let alone a much larger aircraft’.

The DC advised he had not mentioned the left orbits to CASA as they had never specifically enquired about the float plane sequence. However, CASA staff were present for the briefing conducted the night before the activity, in which the conduct of orbits was described.

Operation within Perth Water

The ATSB spoke with Caravan and Buccaneer float plane pilots who had experience operating within Perth Water and were therefore familiar with the display area. They noted that their aircraft did not have a lot of room to manoeuvre and described Perth Water as a ‘confined’, ‘constricted’ and ‘very tight operating area’.

Air display conditions for conducting the display in Perth Water were captured in the display instrument, and included that:

Non-aerobatic display aircraft are not to be operated below 1.3 times the stall speed for the aircraft’s configuration.

…display aircraft will pass no closer than 200 metres horizontally from spectators. Aircraft below 1500 feet AGL shall not track or manoeuvre directly towards spectators within a horizontal distance of 500 metres.

For aircraft operated by pilots holding a low-flying approval, the demonstration may be conducted with the following manoeuvring limitations:

a) Between 50-200 feet AGL – wings level only

b) Between 200-300 feet AGL – up to 30 degrees angle of bank

c) Between 300-500 feet AGL – up to 60 degrees angle of bank

Despite the differences in understanding of the intended display between CASA and the display participants, and the stated effect on the display approval, the ATSB determined that it was possible to conduct orbits in the Mallard, while adhering to the display conditions, however there was little room for error. A similar conclusion was reached by CASA in their post-occurrence regulatory safety review.

However, following review of the draft investigation report, CASA advised that the conduct of orbits within Perth Water could not be conducted in compliance with Civil Aviation Regulation (CAR) 157. Despite this, the ATSB noted that CASA did approve the conduct of essentially identical manoeuvres in the form of a ‘…go around whilst remaining in the display area’, per the display procedure.

Approval of VH-CQA in the air display

The DC met the pilot of CQA in late 2016. In early 2017, when he became aware the aircraft was coming to Western Australia, he invited the pilot to participate in the air display. In January 2017, leading up to the air display, the following key interactions to facilitate participation of the aircraft and pilot occurred:

• In an email to CASA on 4 January that included documents for the air display application, the DC mentioned the possibility of CQA being involved in the display. The display procedures submitted in this email included one for ‘flying boat’. He also provided details for several display pilots, including the pilot of CQA.
• On 11 January, the DC advised CASA via email that another float plane had been added to the program to fly with CQA. However, a revised procedure detailing this new aircraft was not included in this email.^[19]
• On 12 January, CASA asked the DC if the pilot of CQA was going to get an opportunity to practice prior to the event. He replied that it would be the same as ‘all other displays where pilots will prepare appropriately’, and that he would meet with the pilot of CQA when he arrived in Perth. CASA then requested the pilot of CQA provide a statement in relation to the water depth in the proposed landing area, for the appropriate date and time of the event. The DC replied there would likely be a water depth of about 1 m.
• On 16 January, the DC sent an email to the pilot of CQA where he offered to be ‘co-pilot’ during the display, to ‘help with the radio and procedure’.
• In an email to CASA on 17 January, the DC indicated that he had spoken with the pilot of CQA and agreed that he would only do a splash-and-go and that the aircraft would not get off the step.
• During a phone call on 19 January, the DC was advised by CASA that the pilot of CQA would not be able to participate in the air display without the required G-73 type rating being endorsed on his licence. The DC advised the pilot of CQA of the issue with the type rating via email and that CASA had agreed to wait until midday 23 January when, if no evidence of this type rating was provided, CQA would be withdrawn from the program.
• About a week before the air display, the DC arranged with CASA for MOX to be included in the display and submitted details for the pilot and advised that he was still waiting for confirmation that CQA could participate. The email advised that the pilot of MOX had been in the display three years previous and had ‘done this very sequence’, described as being ‘fly by + touch and go on water’.
• On the evening of 23 January, the DC submitted a revised float plane display sequence showing details solely for the Caravan. The Instrument (the approval - the term Instrument is discussed in the section CASA approval and oversight of air displays) was sent to the DC at 1940 that evening.
• On the afternoon of 24 January, the DC emailed CASA with documents showing that CQA’s pilot now held the required G-73 type rating and an ‘authority to fly letter’ from CASA. He also requested that CQA now be included in the display. He also submitted the float plane display sequence including the Mallard and the Caravan and a revised program, which now showed CQA and MOX. In his email to CASA, the DC also stated that as a member of the CASA team had reportedly had a concern about the ‘first time [participation of a new pilot and aircraft type]’, he would ‘go along to be of support [to the pilot] for the procedure which should mitigate against that concern’. Revision 2 of the Instrument was issued by CASA that evening.

Risk mitigation

CASA personnel reported that they approved the inclusion of CQA on the basis of having the DC on board, to mitigate against the risk associated with having a new pilot and aircraft type involved in the display. CASA’s documented reason for allowing CQA to participate in the display referred to the email received from the DC on 24 January (detailed above), indicating that he would be on board.

The DC reported that he originally offered to be on board to assist the pilot with any procedural aspects associated with his first time in the display. However, he indicated that having CQA follow MOX for the display effectively mitigated that concern. He also indicated that his offer to be on board CQA was not acknowledged by CASA and there was no indication that this was their expectation. Therefore, he believed his presence on board was not a requirement. Additionally, the pilot elected to depart from Serpentine Airfield, rather than the original Jandakot Airport departure point. As the DC was a participant in five displays that day, he would not have had the time to travel to Serpentine in order to be on board.

As part of their post-occurrence regulatory safety review (see the section titled CASA approval and oversight of air displays section) of the lead-up and conduct of the air display, CASA identified that despite their expectation that the DC would be on board CQA, they had not specifically advised the DC of this, nor was this requirement included in the Instrument of approval. CASA also did not advise the pilot of CQA that the DC being on board was a requirement for his inclusion.

Pre-display briefing and flight planning

The CASA air display guidance manual (see the section titled CASA approval process for air displays) detailed that a written brief of the flying program should be circulated in advance of the air display, to pilots and those in other critical roles. In addition, ‘a formal verbal briefing should be given on the day of the display and at any rehearsal, and all participants, where possible, must attend’. Those not able to attend were to be verbally briefed separately. The manual listed the minimum items that were to be covered in the briefing.

The Skyworks pre-display briefing was held at Jandakot Airport the night before the event. All air display participants were required to sign Form 695 Participant signature sheet, acknowledging that they have read the CASA approval for the air display and would operate their aircraft in accordance with the terms of the approval. The briefing was conducted by the DC in a large cafeteria-style room, with participants seated at various small tables. The Ringmaster and CASA also addressed the participants. The event was video recorded by the City of Perth and the footage^[20] was reviewed by the ATSB. Participants were seen reviewing copies of the written brief, which had been provided to them at the commencement of the briefing.

The briefing included a discussion of the display area, air space, radio communications and standard approach, holding and departure procedures. As detailed previously, the extent of the float plane-specific brief was, ‘the float planes… will be doing their touch and go…but they won’t be landing fully. If anything they [are] just kissing the water and then do an orbit and then another one and then [depart]’. The DC also discussed the importance of aircraft serviceability, the anticipated weather conditions, considerations about personal fatigue and to ‘have your own risk management’. He also emphasised that they were the lead-up to the main event and there was ‘no pressure to do anything special’, ‘just do everything as you normally do, don’t do anything different’ and to ‘have your own limitations’. The DC reported that separate ‘formation’ briefs were conducted for participating pilots on the morning of the air display, prior to departure from Jandakot Airport.

The pilot of CQA attended the briefing, where he first met the pilot and observer of MOX. The pilot of MOX reported that:

• he and the pilot of CQA discussed airspeeds, who would lead and who would be on board CQA
• it was arranged that the two aircraft would meet at Jandakot Airport (where CQA could refuel and/or collect the DC) or overhead Cockburn Sound (if CQA flew directly from Serpentine Airfield)
• MOX would be the lead aircraft, handle the radio calls and general procedures, so that CQA could follow.

The pilot of MOX reported that he did not have any expectations of CQA’s pilot, other than CQA would follow MOX. He recalled that the pilot of CQA had suggested he would not touch the water, but conduct a low overshoot. On the day of the display, the pilot of MOX received a text message from the pilot of CQA at about 1515, advising he would meet MOX overhead Cockburn Sound.

Carriage of passengers during the air display

Civil Aviation Regulation (CAR) 2 Interpretation defines a ‘crew member’ as a person assigned by an operator for duty on an aircraft during flight time and ‘operating crew’ as any person who:

• is on board an aircraft with the consent of the operator of the aircraft; and

• has duties in relation to the flying or safety of the aircraft.

CASR Dictionary – Part 1 – Definitions describe the following roles:

Flight crew member means a crew member who is a pilot or flight engineer assigned to carry out duties essential to the operation of an aircraft during flight time.

Passenger, in relation to an aircraft, means a person:

(a) who:

(i) intends to travel on a particular flight on the aircraft; or

(ii) is on board the aircraft for a flight; or

(iii) has disembarked from the aircraft following a flight; and

(b) who is not a member of the crew of the aircraft for the flight.

Under Civil Aviation Order 29.4 Air Displays, one of the conditions of approval to conduct an air display is that ‘passengers shall not be carried for hire or reward during any part of the air display except where specifically approved as part of the program’. While this did not exclude the carriage of passengers for no compensation, the CASA instrument of approval for the 2017 Skyworks air display was more explicit, stating that ‘passengers shall not be carried in display aircraft and only aircrew essential to the operation of the aircraft are to be carried’. Similarly, the following statements were included in the Flight Crew section of the air display manual:

No persons other than operating crew may be on board a civil aircraft during the air display unless the prior written permission from CASA has been obtained.

The responsibility for ensuring that an aircraft is operated in accordance with its Certificate of Airworthiness, Permit to Fly and Air Display Approval rests with the pilot in command. This does not absolve the Display Organiser from the responsibility to take such action as is necessary should a display aircraft deviate from the bounds of any approval or operate in an unsafe manner.

In addition to the regulatory considerations above, as part of the pre-display briefing the DC reinforced that ‘you’re not allowed to carry passengers but you are allowed to carry operational crews’.

During discussions following the pre‑display briefing conducted on 25 January 2017, the DC was made aware that the pilot of CQA intended to have an additional person on board, in the right front seat. The pilot had mentioned to several people that it was necessary for this person to be on board CQA to assist in the case of needing to manually deploy the main landing gear. The Mallard’s flight manual did not include this method for releasing the main gear and other Mallard pilots reported being unaware of it.

This reasoning was also raised by the pilot when questioned by CASA officers after they witnessed two people disembark the aircraft during CQA’s participation at the Great Eastern Fly-In events at Evans Head Aerodrome, New South Wales on 7‑8 January 2017. The outcome of that conversation was that the CASA officers informed the pilot that his passenger did not meet the definition of essential crew.

The CASA officers that participated in the discussion at Evans Head were from the sport aviation office and were not aware of the pilot’s application to participate in the Perth Air Display. The Perth office was similarly unaware of the discussion that had taken place at the Evans Head event when they assessed the pilot’s application for the Perth display.

The pilot’s logbook indicated that his passenger had flown on CQA several times, between 6‑13 January 2017 and had a total time on board CQA of about 19 hours. While it was reported that the passenger was interested in flying training, information received from CASA and the National Transportation Safety Committee (NTSC), Indonesia found that she had not registered with either organisation and did not hold a flight crew licence.

It was also reported that the pilot had invited another person to be on board during the Skyworks display. However, the pilot’s decision to minimise the weight of the aircraft due to the temperature on the day, prior to departure from Serpentine Airfield, resulted in that person not being on the accident flight.

Following a recommendation from their regulatory safety review conducted after this accident, CASA published a revised Form 697 Pilot or essential crew details in April 2018. This expanded form added a checklist of considerations for display pilots in relation to their intended display. Sections were also included to allow for identification and reasons for the requirement of additional crew and a DC checklist to ensure consistency in the application. In addition, this form was now required to be signed by the pilot, crew (if applicable) and the DC.

Air display roles and responsibilities

Documented roles and responsibilities

CASA’s Air Display: Safety and Administrative Arrangements manual (air display manual) provided guidance on the minimum safety and administrative procedures necessary to run an air display. The manual included a list of key personnel and their responsibilities, most notably, that of the Display Organiser, Display Coordinator and flight crew (Table 1).

Table 1: CASA Air Display Administration and Procedure Manual ^[21] terminology of air display roles

The CASA-issued instrument granting approval for the 2017 air display assigned the City of Perth to the role of ‘Display Operator’ and separate individuals to the roles of DC and Ringmaster. The instrument did not assign a DO.

The role of Display Operator was not defined in the air display manual, however they, along with the DC, had a responsibility via the instrument to ensure that the display was conducted in accordance with the relevant legislation.

Recognising the discrepancy between the roles defined in the air display manual and the instrument, the role titles identified in the CASA‑issued Perth air display instrument are used throughout this report for consistency.

Display Coordinator

During the 2017 display organisation and approval, the DC carried out some of the responsibilities of that role, as well as that of the DO, per the air display manual. When interviewed by the ATSB, members of the CASA team referred to the same individual as both the DO and DC. It was noted that this was possible in accordance with the manual.

The DC held an Air Transport Pilot (Aeroplane) Licence and a Commercial Pilot (Helicopter) Licence, for single- and multi-engine aeroplanes and single‑engine helicopters. He held multiple design feature endorsements including floating hull and float plane. The DC was endorsed for aerobatic flight activities and held low-level ratings for both aeroplanes and helicopters.

The DC had been involved as a pilot in the Perth Air Display since its inception and over time voluntarily took on various roles with respect to planning, procedures and approvals. He was directly involved in developing the display program and conducting the pre-flight brief, typically the night before the event. He advised that on the day of 26 January each year, ‘I’m just a display pilot… just like all the other pilots participating in the displays’. The DC advised that responsibility for ensuring the display instrument was being followed on the day of the event was with the Ringmaster.

The DC self-identified as the ‘air display liaison’ which was also reflected on the Airservices Australia letter of agreement (airspace arrangement) and the City of Perth Skyworks emergency contact list. Despite this, the DC had entered his name as DO on the 2015, 2016 and 2017 application forms.

With regard to the approval process, the DC reported that different CASA officers had different application requirements. He indicated his role was to provide information to CASA, to allow them to assess and approve the display. The DC said that CASA had requested to observe a certain routine in the past, before issuing the display approval. It was therefore the DC’s opinion that it was ultimately CASA’s decision as to whether or not to approve a pilot and their display.

In contrast, several CASA officers reported it was the DO/DC’s responsibility to ensure that a pilot and/or display was suitable, before including them in the application. However, CASA officers also stated that it was ultimately the individual pilot’s responsibility to satisfy themselves that they were capable of conducting the intended display.

The DC reported that he did not necessarily have the opportunity to know each pilot and their display, however he would not invite a pilot that he felt was not suitable to be part of the display. The DC noted that some years certain pilots and/or aircraft were not available but on the whole the applications were similar each year, with just an occasional display name change. Other than inviting the participation of the Mallard, the DC could not recall the last time a new display was introduced.

Ringmaster

The Ringmaster carried out a portion of the DC’s responsibilities as they related to controlling the flying program on the day.

The Ringmaster held a Commercial Pilot (Aeroplane) Licence and was a flight instructor. She reported having been involved in the event for about nine years, first as an observer with the DC in a Caravan, then assisting the previous Ringmaster during one display, before taking on that role. The Ringmaster described her role as coordination of the display aircraft and monitoring them for good separation. She advised she would sometimes offer or approve a request for additional fly-bys where time permitted. The Ringmaster also coordinated the various banner/flag aircraft between displays.

For the 2017 display, the Ringmaster was located in a room on the twelfth floor of a hotel, situated on the northern side of Langley Park that provided a full view of the display area (Figure 11). An assistant located with the Ringmaster provided support in visually monitoring aircraft movements when the Ringmaster was conducting radio communications. The assistant advised he was a flight instructor and had been in that role for the last four or five years.

When the approval for CQA’s third pass was granted by the Ringmaster, the assistant reported that their vantage point and the position of the sun made it difficult to identify exactly what the aircraft was doing over Melville Water (Figure 11) prior to returning to the display area. Although the Ringmaster did not specify the manner in which the Mallard was to return for the third pass, the assistant expected the approach to be via the standard procedure, behind the city, and was surprised when he realised CQA was re-entering Perth Water directly. He reported that CQA may have flown over boats^[22] lower than the authorised height, but as the moment had passed, there was no gain in immediately contacting the pilot about it. The Ringmaster advised that she did not observe CQA until just prior to the accident as she was communicating with a banner‑towing helicopter via radio.

Figure 11: The view of Langley Park from the Ringmaster’s vantage point

Source: City of Perth

The Ringmaster had a copy of the Instrument, emergency contact list and display schedule with her on the day. The display schedule contained basic detail of the actual display routines, however it was reported they were generally similar each year. Further, she did not necessarily know who was on board each aircraft, other than the schedule‑listed pilot. The Ringmaster generally didn’t communicate with pilots during their display, so as not to distract them, but would make a call if there was something unsafe.

Suitability assessment for key roles

The CASA air display manual in effect at the time of the occurrence made limited reference to the suitability or experience required for individuals to hold key roles. The guidance was that the DO should have considerable aviation experience if also assuming the function of the DC, or otherwise appoint a suitably qualified person, preferably with display experience. There was no mechanism detailed for assessing the suitability of individuals for the roles and no additional training or accreditation.

By contrast, the Civil Aviation Authority United Kingdom (CAA UK) published Civil Aviation Publication (CAP) 403 Flying Display and Special Events: A Guide to Safety and Administrative Arrangements. CAP 403 provided detailed information about the roles and responsibilities of event organisers and participants. From 1 May 2017, the UK CAA implemented Flying Display Director (FDD)^[23] accreditation. The accreditation scheme required the applicant to ‘demonstrate their knowledge, experience and capability against a number of FDD competencies’ including:

• regulatory compliance
• maintaining flying discipline
• risk management
• ‘understanding of human factor influence on the safety of flying displays’.

The applicant was also required to undergo behavioural and attitudinal fitness assessments.

If successful, the FDD would be authorised to an appropriate tier level, based on degree of display complexity, for a period of three years and must maintain currency for re-accreditation. The United States and New Zealand had similar programs to ensure the knowledge and suitability of the person primarily responsible for coordinating the event.

The CAA UK also required formal evaluation of potential display pilots and their intended routine. This involved having an authorised Display Authorisation Evaluator (DAE) evaluate and mentor a pilot, at which point the pilot can apply for a Display Approval (DA), which was required to participate in a CAA UK authorised event.

Similar to the FDD, to be granted a DA a pilot was required to undergo behavioural and attitudinal assessment to determine their suitability for a flying display role. The pilot’s DA was aircraft type and routine-specific. These accreditation requirements were established in the mid-1980s, with additional restrictions and formalised training introduced after the 2015 Shoreham Air Show accident (see the section titled Related occurrences). As with the FDD role, currency and re‑evaluation was required for re‑validation of the DA. At the time of writing, the United States had a similar pilot evaluation program for aerobatic pilots.

Additional guidance was provided by the CAA UK publication, CAP 1047 Civil Air Displays – A guide for pilots. This publication was ‘intended to provide advice to display pilots to help them avoid the pitfalls which have been experienced in the past’. Topics included personal fitness, planning and practicing for displays, and what to do on display day.

CASA approval and oversight of air displays

Regulations and guidance material

Australia’s Civil Aviation Act 1988, through the Civil Aviation Regulations (CARs) and Civil Aviation Orders (CAOs), provides CASA with the authority to regulate exhibitions of flying, commonly referred to as air displays, flying displays or airshows involving civil aircraft.

CAR 156 and CAO 29.4 cover the regulatory requirements as they relate to air displays. CAR 156 relates to flying over public gatherings. CAO 29.4 outlines the application process and specifies the conditions of approval, planning and control requirements. The order states that an air display shall not be conducted without the written approval of CASA and that the organiser shall be responsible for ensuring that the applicable regulations are met.

CASA also developed the Air Display: Safety and Administrative Arrangements (air display manual) as guidance material to be read in conjunction with the regulations.

Air Display Manual

The air display manual provided guidance on the minimum safety and administrative procedures necessary to run an air display. It outlined the responsibilities of key personnel involved in an air display, including that of the DO, DC and display pilot (flight crew) (see the section titled Air display roles and responsibilities). The guidance in effect at the time of the display approval process was version 1.3 (November 2010). While the air display manual contained detail with respect to responsibilities of the DOs, it was limited in guidance with respect to assessing an application to an expected standard.

In comparison with other jurisdictions, the United States FAA order 8900.1 Volume 3, Chapter 6, Section 1 contained detailed guidance around processing and assessing applications for aviation events (including air displays) to determine whether to issue a certificate of waiver or authorisation to an applicant.

At the time of the occurrence, a revised air display manual had been drafted. Subsequently, version 2.0, significantly revised and renamed the Air Display Administration and Procedure Manual, was published in September 2017, with version 3.0 published in April 2018.

Receipt and processing of air display applications

Applications to conduct air displays were generally submitted to the local regional CASA office, using Form 696 Application for approval to conduct an air display, along with supporting documentation. After assessment of the application, the officers provided advice in the form of a ‘reason for decision’ to the authorised CASA delegate. If approved, the delegate then issued an Instrument under CAO 29.4, identifying the person, or organisation, authorised to conduct the air display. This Instrument formed the approval and permission to conduct the air display, including any CASA‑imposed conditions.

As part of this investigation, the ATSB reviewed Skyworks display approvals conducted by the Western Region (Perth) office, as well as those for the Great Eastern Fly-In conducted by the sport aviation office between 2015‑2017.

Staff in both the Perth and sport aviation offices developed forms or checklists to assist the display approval process. The Perth office developed an ‘Air Display Energy Management’ form, which was used in the 2015‑2017 air display documentation to provide detail for some aerobatic and specialised displays. The form was titled ‘CASA Western Region – Air Display Form’ and had provision for ‘participant’ and ‘DC’ signatures. However, none of the ‘Energy Management’ forms reviewed had been endorsed by the DC.

The sport aviation office developed a spreadsheet to monitor air display pilots’ medicals, licence and endorsements, and aircraft registrations and airworthiness categories. This office also developed a risk assessment document for DOs to complete and submit with their application, and a checklist to monitor the progress and requirements of the approval process. It was reported these additional measures were implemented to ensure consistency and standardisation of the sport aviation office approval process.

The region-specific documents were not referenced in the air display manual nor disseminated more widely. Additionally, the Perth and sport aviation offices were also unaware of the documentation each other had developed.

Air display surveillance

The CASA Western region office increased their involvement in the 2017 air display in response to a drone sighting in Perth Water and a near-collision involving display aircraft, just outside Area Alpha, during the 2016 event.

The office initiated a surveillance activity, which included ramp checks ^[24] at Jandakot Airport before the air display, and observations of the City of Perth and Police coordination centre and Ringmaster locations. CASA advised the DC of these planned activities in early January 2017 and subsequently met to discuss the purpose of the activities and to address concerns of the DC that the surveillance activity may distract the involved pilots.

After CASA staff escalated the DC’s concern internally, the decision was made to continue with the planned surveillance activities as there had not been any formal surveillance of the event for a significant time period, and the staff understood that the upcoming version of the air display manual would require such activity in the future.^[25]

CASA officers attended Jandakot Airport on 26 January 2017, from 1330 until about 1630. The surveillance included a series of ramp checks, observation of formation briefs and general liaison with participants. Due to the proximity of the ramp checks to the display, there was reported concern among the DC, Ringmaster and some of the air display pilots that the checks may have caused stress or distracted pilots immediately prior to flying.

It was reported to the ATSB that the pilot of CQA elected to depart from Serpentine Airfield (instead of Jandakot Airport) to avoid the surveillance activity. While that could not be verified, departure from Serpentine meant there was no opportunity for either CASA, the DC or the pilot of MOX to observe or engage with the pilot prior to the display.

While the Perth office reported they generally attended the pre-display briefings, they did not have a policy to observe, and did not routinely attend the air display. By contrast, the CASA sport aviation office regularly attended the air displays they approved. They reported that this allowed them to observe that the requirements of the display authorisation were being upheld and provided assurance that the documented Instrument was relevant. In addition, the sport aviation office reported that regular attendance of air displays fostered good cooperation with organisers and participants.

Air display risk management and governing framework

Defining risk management

International Standard ISO 31000:2018 Risk management – Guidelines defines risk as the ‘effect of uncertainty on objectives’. That is, deviation from the expected. Risk management is defined as ‘coordinated activities to direct and control and organization with regard to risk’. Some of the key risk management principles include that it:

• be integrated into organisational (or in this case, event-based) activities
• provide a structured and comprehensive approach, allowing consistent and comparable results
• be dynamic, as risks can emerge or change as the context changes
• use the best available information, so that both historical and current information from all stakeholders can inform the risks.

The risk management process in ISO 31000:2018 is outlined in Figure 12, and defined as involving:

…the systematic application of policies, procedures and practices to the activities of communicating and consulting, establishing the context and assessing, treating, monitoring, reviewing and reporting risk.

This process is designed to be an ‘integral part of management and decision making’ and can be applied at any level including operational matters.

Figure 12: The risk management process

Source: International Standard ISO 31000:2018 Risk Management - Guidelines

The elements of this risk management process relevant to air display preparation, included:

• Communication and consultation: where relevant expertise is brought together to ensure the right information is considered when identifying, assessing and controlling risk. In this case, the input of stakeholders such as the City of Perth, DC, Ringmaster, CASA and the display pilots.
• Scope: In the context of an air display, the scope should include all activities that may affect the safety of the flying operations.
• Risk identification: the purpose of risk identification is to ‘find, recognise and describe risks that might help or prevent’ the desired outcome. In this context, it is important that regulators and DOs consider potential threats, indicators of emerging risks (for example, late inclusion of a new display), limitations of knowledge and time-related factors.
• Risk treatment: the purpose is to ‘select and implement options for addressing risk’, including whether a certain risk is to be avoided, changed, shared or retained. Relying on individual pilots to manage their own risks when taking part in an air display is a limited treatment strategy, but combined with more systematic approaches and the collective knowledge of others allows for improved identification of defences.

There is further guidance about the risk management process in ISO 31000:2018 and the September 2017 CASA air display manual.

The concept of a risk framework

As outlined in ISO 31000:2018, a framework for managing risk is designed to ‘assist [organisations] in integrating risk management into significant activities and functions’ for good governance. ‘Framework development encompasses integrating, designing, implementing, evaluating and improving risk management’ across an organisation or group of people.

The United Kingdom (UK) Department for Transport commissioned a study in response to a recommendation from the UK Air Accident Investigation Branch investigation of the 2015 Shoreham accident (see the section titled Related occurrences). The resulting report, A Review of UK civil flying display and special event governance, discussed the concept of governance and how it can range from structured to informal in nature. A governance framework was described as providing ‘an organisation or a group of individuals with common objectives, and reflects the interrelated relationships, factors and other influences on them’. The report stated that good governance should:

• provide a set of processes and procedures to deliver clear direction and oversight to industry
• distil down specific roles, accountabilities and communications, and
• provide a feedback loop that can identify trends and respond to changing circumstances, challenges and regulatory needs.

A visual representation of such a framework, based on good governance principles, was developed to review the UK civil aviation flying display activities, existing around the time of the Shoreham accident. It depicted interactions between the government, the CAA UK and industry (Figure 13). It defined the governance infrastructure as the ‘people, processes and systems to manage day to day activity and reporting’. The top half of the diagram shows those activities that the CAA UK have primary responsibility for defining, developing and participating in, including:

• performance – including monitoring of safety performance indicators, and conducting audits
• strategy – including reviewing and updating legislation
• organisation – including defining the roles of those organising the air display, accrediting the display organisers and briefing display pilots
• talent – including developing CAA UK staff skills, mentoring display pilots and shadowing display organisers

The bottom half outlined the areas to be delivered by industry, where the CAA’s responsibilities were more related to understanding, oversight and monitoring (rather than active involvement). This included the planning of the display, the operations themselves, and compliance with regulations.

Throughout this, the CAA UK is also responsible for establishing a risk management framework, including the application of a risk assessment process, auditing flying displays, and setting a risk matrix applicable for flying displays.

Figure 13: United Kingdom civil flying display governance framework

Source: Helios, 2018

Risk management for air displays

In April 2016, CASA convened a working group to update the air display manual. That group identified that the risk assessment process was likely an appropriate and effective tool for the assessment of air display approvals. Despite that, the air display manual in effect for the 2017 air display did not include a requirement to complete a risk assessment as part of the planning or approval processes. However, the September 2017 version of the Manual included a requirement for the DO to ‘compile and conduct [a] risk assessment’, and provided comprehensive guidance in an appendix.

As previously mentioned, the CASA sport aviation office advised that they expected DOs to include a risk assessment as part of their application. An example reviewed by the ATSB for the Great Eastern Fly-In included risks associated with a range of operational activities, including flight and group operations, maintenance, display pilot matters and airspace.

In reviewing other States’ requirements for their air displays, the ATSB noted that the Civil Aviation Authority of New Zealand (CAA NZ) included in their Advisory Circular AC‑91‑1 Aviation Events that the organiser was expected to risk assess the activity. They add that:

The responsibility of implementing and monitoring risk removal and risk mitigation steps falls to the organiser, flying display director and flying display committee. They should therefore all be involved in the risk assessment of the aviation event.

Similarly, the CAA UK CAP403 Flying Display and Special Events: Safety and Administrative Requirements and Guidance outlined that ‘risk assessment is an essential element in the production of any safety plan…Flying Display applicants are required to submit information about any risks that will be actively managed during the event to CAA as part of the display application process’.

Skyworks risk management activities

The City of Perth developed a risk management plan, covering activities associated with the events and coordination around Skyworks, including the air display. It outlined key responsibilities for stakeholders and the tools that were used to identify, assess and control risk. One of these tools was a risk register, which included a number of aviation-related risks such as ‘aircraft/skydive incident causing injury or ill health’. The mitigation for that risk included the provision of the air display approval, and proposed surveillance, from CASA, a landing area exclusion zone and an emergency response plan. The DC provided input into this risk management plan or risk register. Risks identified from previous years’ events included the effects of falling debris, an ‘aircraft incident on Perth Water’, particularly among the moored boats, and skydivers landing in unintended areas.

A near‑collision occurred during the 2016 air display involving a banner tow aircraft and a group of display aircraft, just outside of Area ALPHA. The occurrence prompted the DC, in late January 2016, to request that CASA assist with a modification to area ALPHA for the 2017 display, to reduce the risk of a repeat occurrence. In conjunction with Airservices Australia, CASA’s Office of Airspace Regulation requested that the DC complete a risk assessment, relating to the proposed airspace changes for the 2017 display. The DC questioned the need for the risk assessment when it had not been required previously. In addition, the DC advised CASA he would sign a risk assessment that CASA prepared, when he returned from an overseas trip in November 2016. In response, CASA encouraged him to develop it as a ‘living document’ rather than rely on his experience in the conduct of the air display and examples of risks were provided to the DC. A completed risk assessment (limited to the scope of airspace changes) was ultimately supplied to CASA and the airspace changes were authorised.

In the lead-up to the air display, the CASA Perth office liaised with the DC on some concerns such as the draught of the Mallard in the water and the single‑engine performance. However, apart from the requested risk assessment relating to airspace matters, there was no formal or systematic way that other types of operational risks were identified, assessed and controlled. There was also no requirement to do so under the current regulations.

Related occurrences

Within limitations of the ATSB occurrence database, there were approximately 22 air display‑related occurrences in the ATSB database between 1969 and 2017. Thirteen of those occurrences resulted in a fatality, therefore averaging one fatal accident every 3.7 years. The majority of the occurrences were related to aircraft handling, resulting in loss of control and collision with terrain.

The ATSB also reviewed other states’ investigations into air display accidents, particularly those involving passengers and/or spectators. The scope of the review was to gain appreciation of risk factors to spectators, and where lessons learned had resulted in improvements to the planning and approval of air displays. A number of occurrences were identified and two of these are discussed below.

United Kingdom

The Air Accidents Investigation Branch, United Kingdom investigated the accident involving Hawker Hunter T7, registration G-BXFI near Shoreham Airport on 22 August 2015. The aircraft crashed on to the Shoreham Bypass while performing at the Shoreham Airshow, fatally injuring 11 road users and bystanders. A further 13 people, including the pilot, sustained other injuries.

Beyond examining the actions of the pilot, the investigation found that:

…the parties involved in the planning, conduct and regulatory oversight of the air display did not have formal safety management systems in place to identify and manage the hazards and risks. There was a lack of clarity about who owned which risk and who was responsible for the safety of the air display, the aircraft, and the public outside the display site who were not under the control of the show organisers.

The regulator believed the organisers of air displays owned the risk. Conversely, the organiser believed that the regulator would not have issued an approval for the display if it had not been satisfied with the safety of the event…and the display organiser believed that it was the responsibility of the operator or the pilot to fly the aircraft's display in a manner appropriate to the constraints of the display site.

No organisation or individual considered all the hazards associated with the aircraft’s display, what could go wrong, who might be affected and what could be done to mitigate the risks to a level that was both tolerable and as low as reasonably practicable.

Controls intended to protect the public from the hazards of displaying aircraft were ineffective.

Additional detail in the report included consideration of risk to spectators outside the event, non‑participants (general public in the area) and proximity of residential, industrial and recreational areas, including schools and hospitals.

United States

On 16 September 2011, an experimental single-seat North American P-51D collided with terrain while participating the National Championship Air Races in Reno, Nevada. The pilot and 10 people on the ground sustained fatal injuries and at least 64 others were injured. The National Transportation Safety Board (NTSB) investigation identified the aircraft was conducting a turn just prior to the loss of control. The NTSB made several recommendations, including evaluation of the course design and safety areas to minimise manoeuvring near, and potential conflicts with, spectators. The event organiser subsequently relocated the course and primary spectator area to ‘create and maintain a greater distance’ between the racers and spectators.

__________

6. The training was conducted over two trips to the United States, each consisting of three days, in March and May 2012.
7. A dirty pass involves the aircraft being configured for landing with flaps and landing gear extended.
8. A seaplane is a fixed wing aircraft that can operate from the water and is identified by two categories: floatplanes, having pontoons or floats as landing gear, and flying boats, where the main source of buoyancy is the fuselage. Amphibian aircraft are capable of routinely operating from land or water. All three terms are often interchanged.
9. The Mallard has a constant angle of incidence (or zero-washout) wing with an identical profile from inboard to outboard. The term washout refers to where a wing is designed with a reducing angle of incidence towards the wing tip, which usually results in a stall progressing from the wing root to the tip, providing increased aileron control during a stall onset and some resistance to spinning. It also provides a softer stall onset and increasing aileron authority during the early stages of a stall.
10. CASA identify some G-73 variants as requiring multi-crew (two pilots) for operations.
11. A stall warning device can give the pilot a warning of an impending stall, which can include aural (horn) or visual (light or angle of attack indicator) signals.
12. The Bureau of Meteorology records weather observations from Perth Airport (10 km from Perth Water), Melville Water (4 km away) and Mt Lawley (4 km away). Data from these locations was analysed to provide conditions most likely experienced within Perth Water.
13. A Temporary Danger Area is an airspace established for a specified period and of defined dimensions within or over which activities of potential danger to aircraft flying over that area may exist.
14. Operations above 1,500 ft AMSL in Area ALPHA, such as aerobatic displays, required ATC clearance to operate in class C airspace.
15. The Cessna 206 is a six-seat aircraft with a maximum take-off weight of about 1,600 kg and the Buccaneer is a fourseat, light amphibious aircraft with a maximum take-off weight of about 1,220 kg. The Cessna 208 aircraft is described in the section titled VH-MOX and flight crew information.
16. Refer to the section titled Air display roles and responsibilities
17. On the step is when the attitude of the aircraft on the water is nearly level and the weight of the seaplane is supported mostly by hydrodynamic lift (the upward force produced by the motion of the floats through the water). The rear section of the float, aft of the step, is clear of the water, which greatly reduces drag during take-off. This is also known as fast taxi.
18. There was no float plane involvement in 2016.
19. The other float plane was later withdrawn from the display due to unavailability.
20. The footage was taken from several angles and contained some gaps in the briefing. It did, however, provide an overall appreciation of the conduct and content of the briefing.
21. CASA procedures and manuals detailed in the section CASA approval and oversight of air displays
22. Flight over moored vessels at this location would also involve flight over the built-up area of the South Perth peninsula.
23. The Flying Display Director’s responsibilities most closely aligned with those of the Display Coordinator in CASA’s Air Display: Safety and Administrative Arrangements manual
24. CASA advise that ramp checks are conducted to make sure flight operations are being carried out safely and in accordance with regulations. A typical ramp check involves the inspection of documentation, flight preparation (including the aircraft).
25. The Air Display Administration and Procedure Manual published September 2017 included the following statement: The scale of CASA attendance at the event, if any, will depend on the nature of the event, scale and location of the display.

Safety analysis

Following two low fly-bys along the Langley Park foreshore as part of the City of Perth Australia Day Skyworks event, the pilot of Mallard VH‑CQA (CQA) manoeuvred his aircraft in order to conduct a third pass. During the final positioning turn, CQA rolled left, pitched nose‑down and collided with water. The pilot and passenger were fatally injured, and the aircraft was destroyed. This analysis will examine the:

• loss of control
• pilot’s actions in returning to the display area for a third pass
• carriage of a passenger
• regulatory framework for approval and oversight of air displays.

As part of the analysis, comparisons have been drawn with other country’s regulations, guidance and practices as a means of benchmarking other methods for managing air displays. Other countries have also published extensive guidance material and some have dedicated air display organisations to support those organising and participating in air displays.

Loss of control

Analysis of recorded flight and video data, and witness reports identified that the aircraft stalled in the positioning turn for the third pass. Such a loss of control in this aircraft type at the relatively low operating altitude meant the situation was unrecoverable before contact with the shallow water.

Technical examination of the aircraft did not identify anything that contributed to the accident. In the absence of a problem with the aircraft, the stall most likely resulted from a handling error and there were several factors that increased the risk of that occurring.

The pilot had limited recent experience operating the Mallard and had not previously participated in a display involving low-level turns within a confined area. Considering this, and noting the limited opportunity available due to his late inclusion and licencing issue, the pilot had not practiced for the event.

The pilot’s lack of familiarity was intended to be mitigated by following another participating aircraft, VH‑MOX (MOX), during the display sequence and having a pilot familiar with the display present in CQA. These defences were not effective however, as CQA parted company from MOX prior to returning to the display area in a different manner to that associated with the first two passes and there was no accompanying pilot on board CQA during the flight.

Additionally, although current and recent in accordance with the regulations, the pilot had not undergone any formal training in the Mallard in the five years since his endorsement and had satisfied the intervening biennial flight review requirement in a different aircraft type. This was despite the Mallard being a type-rated aircraft, considered as having performance or handling techniques that warranted specific training and flight reviews. The lack of assessment in the Mallard since endorsement was a missed opportunity to objectively confirm the pilot’s competency, or identify and correct any degraded skills specific to operation of that aircraft.

Finally, although not a requirement, the aircraft was not fitted with a stall warning device that may have alerted the pilot to the developing situation in sufficient time to take corrective action.

There was insufficient evidence to establish the extent to which any of these factors influenced the development of the accident. Similarly, the degree to which a focus on participating in the event may have distracted the pilot from operating the aircraft could not be determined.

Returning for the third pass

The pilot of MOX only conducted the two planned passes and was unaware of the intention for a third by CQA until it was requested of the Ringmaster. This impromptu action was contrary to the briefed plan that the two aircraft would fly in company to mitigate against potential issues with the pilot of CQA’s unfamiliarity with the display.

After completing the second display pass, MOX departed the display area bound for a return to Jandakot Airport, followed by CQA. By the time CQA turned to return for the third pass, it was well inside Melville Water. On approving the third pass, the Ringmaster did not offer any direction regarding its conduct and the pilot elected to track directly back to Perth Water. The return to the display area was conducted at low altitude over the built-up area of The Narrows and moored watercraft, which was a deviation from the display approval.

Although not observed by the Ringmaster, the assistant assessed that CQA may have passed over boats below the authorised height during the return for a third pass. However, because CQA had then effectively joined the downwind leg of the accepted orbits over Perth Water, no immediate action was considered necessary.

Left orbits in the Mallard within the confines of Perth water were possible while adhering to the display conditions. However, the requirement to remain clear of the spectators, including watercraft, meant that the area was relatively confined. As a result, manoeuvring within the display area, as opposed to entering it in the prescribed manner around the city, required turns at higher bank angles and lower altitudes, which reduced the margin for error. Had CQA re-entered the display area using the standard procedure, the manoeuvres required to position for the pass would have been relatively benign and significantly reduced the risk of mishandling the aircraft.

Pilot decision making

Nature of decision-based errors and motivational factors

In considering whether the pilot’s actions in returning for the third pass were reasonable to him at the time, it is useful to consider the nature of decision-based human error. One such example, knowledge-based mistakes, are defined as ‘errors brought about by a faulty plan or intention’. They arise in novel situations with ‘resource limitation (bounded rationality) and incomplete or incorrect knowledge’ (Reason, 1990) and likely arise from a lack of appreciation of potential consequences (Harris, 2011). Knowledge-based mistakes can be significantly influenced by certain ‘performance shaping factors’ (O’Hare, 2006). These can be external factors, such as environmental conditions, equipment design and procedures, or internal factors, such as a pilots’ emotional state, physical condition, stress, experience, and task knowledge.

As discussed, the pilot was not well-prepared for the planned display. Additionally, although the pilot attended the pre-display briefing and had access to the display procedures, CQA had likely only ever planned to follow MOX and therefore it is possible that the pilot placed less emphasis on familiarisation with the complete display conditions and procedures. These factors may have contributed to a level of unfamiliarity with the task that resulted in the pilot flying the display with an incomplete or incorrect knowledge and/or appreciation of the potential consequences.

As part of the investigation, the ATSB also considered the motivational effects of being part of event such as an air display. The pilot was reportedly enthusiastic about being involved and was known to enjoy displaying what was a unique and interesting aircraft. While it is difficult to quantify the effect of the pilot’s emotional state in this occurrence, these elements have the potential to influence pilot behaviours, which is reflected by the inclusion of display pilot attitudinal assessments in other jurisdictions.

Handling human factors considerations in air displays: other countries

The human factors considerations of air displays is a topic that has gained more traction in recent years. As part of the Civil Aviation Authority United Kingdom (CAA UK) response to the Shoreham accident findings (one of which required them to undertake a study of error paths that lead to flying display accidents), a workshop called Human Factors in Flying Displays was held in 2017, and attended by about 35 DOs and pilots. One of the topics of discussion was the ‘personal qualities and characteristics of display pilots’ and the DOs. Boundaries between ‘confidence and arrogance’ were discussed, and the importance of promoting learnings and good practices among display pilots.

Additionally, the CAA UK-commissioned study authored by Butler and others (2018) raised some considerations for the future, finding that:

the processes related to the assurance of the competence of air display pilots was a recurring contributory factor highlighted in accident reports. These included training, supervision, practical experience and assessment.

They included a recommendation in their report for display pilots to undertake human factors training, provided by the CAA UK to ‘ensure there is an exchange of expertise across the display community’.

Other States have recognised the need to improve air display pilots’ overall proficiency. For example, the Federal Aviation Administration (FAA), United States, established the Aerobatic Competency Evaluation (ACE) program where pilots must obtain a Statement of Aerobatic Competency (SAC) card prior to conducting aerobatics, or other defined manoeuvres. The FAA delegated the ACE program to the International Council of Air Shows (ICAS), subject matter experts.^[26] ICAS published the Air Show Performers Safety Manual to ‘help establish an understanding of the risk factors attendant to air show performances’.

Summary

While the precise reasons for the pilot’s actions will remain unknown, there were several factors that may have influenced the pilot’s decision making, and which reinforce the importance of planning and practicing for displays. A safety message was highlighted in the CAA UK’s guide for display pilots, which emphasised:

Never be tempted to make unrehearsed changes to your display routine and do not undertake any manoeuvres you have not practiced….Stick to your planned routine but always be prepared, particularly at hot and high displays, for reduced aircraft performance…Never press on into a manoeuvre with less than ideal start conditions.

Carriage of a passenger during the display

Participation in an air display is a specialised aviation activity that frequently involves flying the aircraft in a non‑standard manner and in unique locations. As such, there is an increased risk associated with this type of flying and for this reason passengers are not permitted to take part.

This requirement was clearly stated in the conditions of the display. The pilot had also received the display briefing the night before, reinforcing this condition. Additionally, the pilot had previously been informed by staff from the Civil Aviation Safety Authority (CASA) that the person carried was a passenger and was not considered as crew for the purpose of an air display. Despite this, he carried this passenger during the Perth display, which increased the severity of the accident outcome.

Regulatory framework for approval and oversight

According to the International Standards ISO 31000:2018 Risk management – Guidelines and a review of the UK CAA’s approach towards air displays, good governance in this context comes from activities such as:

• having processes and procedures for the industry and the regulator to work by
• clearly delineating and providing guidance in the roles and responsibilities of organisers and pilots
• monitoring safety performance of those involved in the planning and preparation of the air display including ensuring that regulator staff are adequately prepared.

The regulator’s responsibilities are met by ensuring there are the right ‘people, processes and systems to manage day to day [air display] activities and reporting’ (Helios, 2018).

With respect to air displays in Australia, although certain regulatory processes did exist, CASA did not have an effective framework to consistently approve and oversight air displays. This was predominantly due to the following factors, which increased the likelihood that key safety risks associated with the conduct of the air display would not be adequately managed. It could not be determined whether the regulatory framework in place at the time of the accident contributed to it.

Air display approval guidance

The CASA‑published manual, Air Displays: Safety and Administrative Arrangements (air display manual) to provide ‘guidance on the minimum safety and administrative procedures necessary to run such an event’. However, there was no comprehensive guidance for the assessment of an air display application or oversight of the event, including the expected standard for certain criteria.

While those assessing the applications had shared their methodology and local knowledge within their office, this information was not readily accessible to all offices. As regional offices sought to independently ensure completeness and standardisation of their assessment processes, they developed local procedures, forms and checklists. Variability in assessment and approval practices increases the likelihood of applying an inconsistent process or standard to the task, increasing the risk that key safety aspects may be overlooked.

In contrast, both the FAA and CAA UK published documents that provided their staff with specific guidance and processes for assessing and approving an air display, which in turn provides some assurance of standardisation.

Roles and responsibilities

Air displays require careful management and coordination. The scale and complexity may differ, but any lack of clarity around key roles will affect how well they are managed. The roles of the display organiser (DO) and display coordinator (DC) are vital to the planning and safe operation of each air display. For this display, the roles were not clearly or consistently defined and there were differences in the understanding of who held those roles, exactly what their responsibilities were or the standard those responsibilities were expected to be carried out. This meant that key, safety‑related elements of the air display planning and oversight were more likely to be overlooked.

These points indicated that CASA’s processes were not effective in ensuring that key personnel were fully aware of their responsibilities or that they were suitably equipped to carry them out to the expected standard. By comparison, the CAA UK, FAA and CAA NZ have all established accreditation programs for persons taking on the role of the DO or DC (or equivalent roles). While the accreditation process varies between countries, the concept is similar. In addition to requiring knowledge of the regulations and role responsibilities, the candidates are individually assessed for suitability including behavioural and attitudinal fitness for the role. Essentially, the accreditation program is designed to provide organisers, and in some cases participants, with the knowledge and skills to effectively and safely plan and coordinate and/or participate in an air display. As such, it provides necessary assurance to regulators that the roles will be carried out with consistency and to the expected standard.

Identification and treatment of risk

The risk management process is designed to be an ‘integral part of management and decision making’ (ISO, 2018) for an event such as an air display. If organisers and regulators take the opportunity to systematically identify, assess and treat risks, it is possible to reduce the impact of hazards on the safety of the event. The application of the risk management process will not, in all likelihood, capture every possible risk, but the process can trigger identification and validation of those that are foreseeable, and prioritise their treatment. In particular, it increases the chances that changes, such as the late inclusion of an unfamiliar pilot in the air display, can be considered in terms of the potential introduced risk.

The air display manual current at the time of the accident was the main reference for organisers however, it did not include a requirement for any risk management activities to be done. It was therefore less likely that CASA staff (unless requiring a risk assessment as part of their local procedures) involved in the approval and oversight of air displays were in a position to review organisers’ perceptions of operational risks, or apply systematic methods of risk management.

In this case, CASA identified a number of safety-related risks, such as the pilot not having the appropriate endorsement on the Mallard and the benefit in having the DC on board CQA to mitigate against the pilot’s inexperience. However, these were not identified through any systematic means, and the treatment measures were sometimes not implemented (for example, the DC was not on board CQA for the display), or had other unintended consequences (authorising the pilot’s participation two days out from the display significantly limited his available time to prepare and practice). These examples, plus the absence of any documented processes or any requirements for the staff organising air displays to use systematic risk management methods, reduced the chances that identified risks were going to be treated adequately and controls implemented.

It is noted that CASA has revised the air display manual since this accident to include a requirement for a formal risk assessment to be completed by DOs, which reflects the best-practice approach to identifying and controlling display risks (see the section titled Safety issues and actions). However, using a risk-based approach for the assessment and approval process itself would probably provide additional safety benefit.

__________

26. ICAS information can be accessed via www.airshows.aero

Findings

From the evidence available, the following findings are made regarding the loss of control and collision with water involving the G-73 Mallard aircraft, registered VH-CQA 10 km west‑south‑west of Perth Airport, Western Australia on 26 January 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The pilot returned the aircraft to the display area for a third pass in a manner contrary to the approved inbound procedure and which required the use of increased manoeuvring within a confined area to establish the aircraft on the display path.
• During the final positioning turn for the third pass, the aircraft aerodynamically stalled at an unrecoverable height.
• The pilot's decision to carry a passenger on a flight during the air display was contrary to the Instrument of Approval issued by the Civil Aviation Safety Authority for this air display and increased the severity of the accident consequence.

Other factors that increased risk

• The Civil Aviation Safety Authority (CASA) did not have an effective framework to approve and oversight air displays, predominantly due to the following factors: 
  • While the Air Display Manual provided guidance to organisers conducting an air display, it did not inherently provide the processes and tools needed for CASA to approve and oversee one and no other documented guidance existed.
  • Unlike the accreditation models adopted by some other countries, CASA did not have a systematic approach for assessing the suitability of those responsible for organising, coordinating and participating in air displays.
  • CASA did not have a structured process to ensure that risks were both identified and adequately treated.

The combination of these factors significantly increased the likelihood that safety risks associated with the conduct of the air display were not adequately managed. [Safety issue]

Safety issues and actions

The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Air display approval and oversight

Safety issue number: AO‑2017-013-SI-01

Safety issue description: The Civil Aviation Safety Authority (CASA) did not have an effective framework to approve and oversight air displays, predominantly due to the following factors:

• While the Air Display Manual provided guidance to organisers conducting an air display, it did not inherently provide the processes and tools needed for CASA to approve and oversee one and no other documented guidance existed.
• Unlike the accreditation models adopted by some other countries, CASA did not have a systematic approach for assessing the suitability of those responsible for organising, coordinating and participating in air displays.
• CASA did not have a structured process to ensure that risks were both identified and adequately treated.

The combination of these factors significantly increased the likelihood that safety risks associated with the conduct of the air display were not adequately managed.

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Civil Aviation Safety Authority undertake further work to enhance their tools and guidance for air display approval and oversight, and procedures to ensure the suitability of those responsible for organising, coordinating and participating in air displays.

Sources and submissions

The sources of information during the investigation included the:

• Civil Aviation Safety Authority
• Air Accidents Investigation Branch and Civil Aviation Authority, United Kingdom
• National Transport Safety Board and Federal Aviation Administration, United States
• National Transport Safety Committee, Indonesia
• Civil Aviation Authority, New Zealand
• International Council of Airshows
• Perth Air Display organisers, participants and witnesses
• City of Perth
• G-73 and other float plane pilots
• Bureau of Meteorology
• Airservices Australia.

References

AAIB, Aircraft Accident Report AAR 1/2017 – G-BXFI, 22 August 2015, Air Accidents Investigation Branch United Kingdom

ATSB 2009, Avoidable Accidents No.1 Low-level flying, Australian Transport Safety Bureau, Aviation Research and Analysis publication AR-2009-041

Boud and McFarlane, 2018 Review of UK civil flying display and special event governance, Hampshire, United Kingdom

Butler and others, 2018, Human Factors in Air Displays: Transfer of Behaviours and Error Path Study, Health and Safety Laboratory.

CAA NZ, Advisory Circular (AC) 91-1 Aviation Events, Civil Aviation Authority New Zealand

CAA UK, Civil Aviation Publication (CAP) 403 Flying Display and Special Events: A Guide to Safety and Administrative Arrangements, Civil Aviation Authority United Kingdom

CAA UK, Civil Aviation Publication (CAP) 1047 Civil Air Displays – A guide for pilots, Civil Aviation Authority United Kingdom

CASA 2017, Air display administration and procedure manual, Civil Aviation Safety Authority

Harris, 2011, Human Performance on the Flight Deck, Ashgage Publishing Ltd, London, United Kingdom

International Standard ISO 31000:2018 Risk management – guidelines, ISO copyright office, Geneva Switzerland.

NTSB, Accident Brief AAB-12/01, Pilot/Race, The Galloping Ghost North American P-51D, N79111, Reno, Nevada, September 16, 2011, National Transport Safety Board

O’Hare, 2006, Cognitive Functions and Performance Shaping Factors in Aviation Accidents and Incidents, The International Journal of Aviation Psychology, pp.145-156

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority, the City of Perth, the display coordinator, the ringmaster, the ringmaster’s assistant, the pilot of VH-MOX, the National Transportation Safety Board, the Federal Aviation Administration, the International Council of Airshows, the Civil Aviation Authority United Kingdom and the Air Accidents Investigation Board.

Submissions were received from Civil Aviation Safety Authority, the City of Perth, the display coordinator, the ringmaster, and the pilot of VH-MOX. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 21 November 2016, at about 0730 Eastern Daylight-saving Time (EDT), a Bell 206B helicopter, registered VH-CHO, took off from a property about 30 km south of Bathurst, New South Wales. The pilot was conducting an aerial inspection of the property, with the farm manager on board as a passenger.

After overflying a flat area on high ground, the pilot raised the collective^[1] and turned the helicopter to follow down-sloping terrain. At about 75 ft above ground level and an airspeed of about 40 kt, the pilot and passenger heard and felt a bang. The pilot looked outside to see if there was any obvious damage to the spray booms on the helicopter and in the back seat to see whether anything had fallen onto the floor, and assessed that the helicopter was too high to have collided with anything outside.

The pilot initially decided to land as soon as possible in order to check the helicopter to determine the cause of the bang, and started to slow it down. As the airspeed decreased, the helicopter started to yaw rapidly to the right and the pilot, unable to arrest the rotation with left anti-torque pedal, realised they had lost tail rotor authority. The pilot immediately rolled the throttle to the ground idle detent and as the helicopter stopped yawing, lowered the collective. The pilot saw that the rotor rpm had dropped to about 80 per cent and prepared for a hard landing. The pilot cushioned the landing by pulling back on the cyclic,^[2] but the helicopter landed heavily. The belly tank (for spraying) absorbed some of the impact of the landing. The spray booms (fitted to the aircraft for spraying operations) probably helped prevent the helicopter rolling over.

The electronic locator beacon activated on impact. The pilot and passenger sustained minor injuries and the helicopter was substantially damaged (Figure 1).

Figure 1: Accident site showing damage to VH-CHO

Source: Aircraft operator

Post-accident inspection

The tail rotor driveshaft had fractured at the No. 2 bearing (Figure 2).

The tail rotor blades were undamaged in the impact, which indicated that they were probably not rotating when the helicopter collided with the ground. There were scrapes inside the tail rotor driveshaft cowling, which indicates that the shaft was probably rotating when it fractured.

There was no evidence of oil leakage, overheating, or vibration of the tail rotor driveshaft system.

Figure 2: Fractured tail rotor driveshaft

Source: Aircraft engineer

Maintenance history

The helicopter had serial number 714, and was fitted with a long tail rotor driveshaft. The manufacturer required the single long driveshaft to be replaced with a segmented shaft in serial numbers 1252 and above.

The helicopter was fitted with a data augmentation monitoring system, which did not show any abnormalities.

The tail rotor bearings were ‘on condition’ items, that is, were required to be replaced if worn on inspection. The driveshaft was inspected every 1,200 hours and was in good condition apart from the fracture after the accident.

On 18 August 2016, the No. 1 and No. 3 tail rotor driveshaft bearings and tail rotor gearbox were replaced. On 29 September 2016, the No. 1 tail rotor bearing and bearing hanger were replaced. Post-accident inspection did not reveal any abnormalities.

Manufacturer comments

The helicopter manufacturer (Bell Helicopter) reported that the single long tail rotor driveshaft (P/N 206-040-330-001) was replaced with the segmented shafts in Bell 206B helicopters about 45 years ago. At serial number 1252, all Bell 206B helicopters and follow-on Bell 206B3 helicopters were equipped with segmented shafts. The change was made for ease of maintenance in replacing hanger bearings. In addition, if a segmented shaft was damaged, only it would have to be replaced and not the entire long shaft. The long shaft is still procurable through Bell Helicopter. The manufacturer reported that the long tail rotor driveshaft has not been a safety concern with no recent failures recalled.

Manufacturer investigation

The helicopter manufacturer inspected the tail rotor driveshaft and found that it fractured as a result of fatigue cracking. The origin of the fatigue was associated with an area of corrosion pitting, intergranular corrosion and associated cracking on the outside surface of the driveshaft tube, around both sides of the second hanger bearing inner ring location. The driveshaft was otherwise found to comply with the manufacturer’s requirements.

Pilot comments

The pilot provided the following comments:

• When the pilot heard the bang, the helicopter was at a very high-power setting with the blades highly pitched. Although the pilot rolled the throttle off, it took a couple of seconds before the yawing stopped, then they put the collective down and by that time the rotor rpm had dropped.
• There were about 30 gallons (114 litres) of fuel on board and the helicopter was loaded well within weight and balance limitations.
• The temperature was 18.5 °C, the wind light and variable, and the elevation about 3,200 ft above mean sea level. The conditions were well within the performance limitations of the helicopter.
• If the pilot had been able to get into a position where they could do a run-on landing, there may not have been any damage.
• The pilot did not know the tail rotor authority was lost until it was too late to do anything other than land immediately.

Safety analysis

The pilot and passenger heard a bang, which was probably the tail rotor driveshaft failing in flight, as indicated by the scraping inside the tail rotor driveshaft cowling. This resulted in a loss of authority of the tail rotor, and the lack of tail rotor blade damage suggests the blades were (near) stationary at the time of ground impact. The manufacturer’s examination found that the driveshaft tube fractured as a result of fatigue cracking that was associated with an area of corrosion pitting on the outside surface of tube, adjacent to the location of the second hanger bearing. The pilot slowed the helicopter to make an approach to land and check out the cause of the bang, which caused the helicopter to start yawing to the right. The pilot then realised they had lost tail rotor authority, rolled off the throttle to stop the yaw, and as the rotor rpm had dropped they were then committed to an immediate landing.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The tail rotor driveshaft tube fractured as a result of fatigue cracking that likely originated from corrosion pitting on its outside surface. This resulted in a loss of tail rotor authority.
• The helicopter was low and slow when tail rotor authority was lost, limiting the time available for the pilot to assess the circumstances and manage the forced landing.

Safety message

This incident highlights the importance of robust and current training in emergency procedures. Being able to identify a problem and react quickly can reduce the severity of damage and injuries.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Collective: a primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity.
2. Cyclic: a primary helicopter flight control that is similar to an aircraft control column. Cyclic input tilts the main rotor disc, varying the attitude of the helicopter and hence the lateral direction.

What happened

On 27 September 2016, a Pulse Aerospace Vapor 55^[1] remotely piloted aircraft (RPA), was operating a test flight at Lighthouse Beach, Ballina, New South Wales (Figure 1).

Figure 1: Photo of a (different) Vapor 55 RPA

Source: www.skylineuav.com.au

According to telemetry data^[2] recorded on the remotely piloted aircraft system’s ground control station (GCS), at about 0910 Eastern Standard Time (EST), the RPA lifted off from its start position in front of the surf clubhouse (Figure 2). About 30 seconds later, when the RPA was at an altitude of about 36 ft, it entered ‘manual’ flight mode. The RPA then tracked according to manual inputs from the pilot for about 7 minutes, at which time (when at 124 ft altitude) the data-link signal was lost. Thirty seconds later, the RPA entered the ‘home’ flight mode, and commenced tracking to the programmed home position at an altitude of 154 ft. The last position of the RPA recorded by the GCS was about 165 m NNE of the start position, and about 4 km SE of Ballina/Byron Gateway Airport.

In the home flight mode, the RPA did not respond to the flight control inputs made by the pilot and the pilot subsequently lost sight of the RPA. The RPA was not found despite an extensive search.

Figure 2: Recorded RPA track

Source: Google earth and remotely piloted aircraft system operator, annotated by ATSB

Mission planning

Prior to the flight, the pilot’s preparation for the planned mission involved using Google earth on a computer (not the GCS), and selecting a north-western and a south-eastern reference point. These markers defined an outer rectangle, within which the flight was to take place (Figure 3).

Figure 3: Planned operating area defined using NW and SE markers

Source: Google earth, annotated by ATSB

The pilot then transferred an image of the google earth map for the area onto the GCS using a USB stick, and uploaded it to create the ‘Lighthouse Beach’ mission. To georeference^[3] the image, the pilot then overlaid the markers in the image with a point icon on the controller, and entered the latitude and longitude of two positions into the dialogue box on the GCS. The north-western GCS marker is visible in the top left corner of Figure 4, but the latitude and longitude values visible are image text only.

Once the image had been georeferenced, the pilot then used the graphical interface to place the start and home icons and any intervening waypoints for the planned mission (Figure 4).

Figure 4: Image uploaded onto GCS with planned mission overlaid

Source: Remotely piloted aircraft system operator, annotated by ATSB

Incorrect georeference

The remote pilot reported that both they and an observer checked each waypoint before the flight, verifying latitude, longitude, altitude and height. However, the GCS data shows that during the planning phase, while the north-western marker was correctly assigned, the south-eastern marker was incorrectly assigned to a georeference point with a latitude in the northern hemisphere. This resulted in all of the waypoints and home location being incorrect, as they were created by dragging icons on the georeferenced image. Waypoints 2, 3, 6 and 7 had latitudes in the northern hemisphere, and the home position was assigned to 17.222395° S and 153.591582° E. That location was in the Coral Sea Islands about 1,200 km north of the start position (Figure 5).

Figure 5: Actual location of home position and select waypoints from the GCS

Source: Remotely pilot aircraft system operator, Google earth

The RPA’s start position was correct as it was obtained using the RPA’s GPS. As the aircraft entered manual mode after take-off and the pilot did not initiate the automatic mode to fly the programmed mission, it was only when the RPA lost the datalink, stopped responding to the pilot’s manual control inputs and commenced tracking for the programmed home position, that it left the planned operating area. The pilot can also manually give the ‘home’ command. In all home and automatic modes, the handheld controller is ignored unless the pilot gives the ‘manual’ command via the GCS application and manually takes control of the RPA.

The GCS has a ‘flight plan’ tab, which shows the planned distance and time (among other items) for the mission, which could have alerted the pilot to the incorrect latitude references. However, a check of the flight plan tab had not been included in the operator’s pre-flight procedures. In addition, the flight plan tab includes a measure tool that can be used to check that the map size is correct.

The manufacturer advised that the following steps are included in their pre-flight procedure specified in the aircraft flight manual:

• verify flight plans
• verify lost communication home waypoint.

The operator stated that there was no further detail of the verification process in the manual.

The default hemisphere was north (N) in the GCS for entering positions. The manufacturer stated that there was no feature that would change the default (to south (S)). The manufacturer assessed that changing the default could lead to issues with the conduct of appropriate pre-flight checks.

The operator reported that information about the default setting to north was not provided in the Aircraft Flight Manual.

Loss of data-link signal

The RPA system commands homing after 10 seconds of data link loss when in automatic mode and 2 seconds if in manual mode. In this incident, as the RPA was in manual mode, it initiated homing after 2 seconds.

The cause of the lost signal could not be determined. The operator thought that there may have been interference from a media outside broadcast unit located about 30 m from the GCS. However, the media personnel advised the operator that they were using a satellite communications link and therefore should not cause interference.

Appropriate action

The manufacturer advised that once the aircraft commenced tracking to an incorrect home location, the appropriate action would have been to use the ‘hold’ or ‘manual’ command so that the joystick flight control could be used.

The remote pilot advised that they had attempted to use the ‘hold’ command, as they were shown in their training, but the RPA did not respond. No evidence of this was recorded in the GCS data.

Safety analysis

Although the pilot reported having completed the pre-flight preparations and associated checks, the data stored on the GCS showed that the incorrect (northern) hemisphere was assigned to the south-eastern georeference marker at the time the map image was created. This led to the home position being assigned a location in the Coral Sea Islands, so when the RPA lost signal and tracked for home, it headed north and was not recovered. The same outcome would have occurred if the pilot had selected the RPA to fly home, even with a continuous data-link signal. While all of the intermediate waypoints were also incorrect, as the GCS remained in manual mode, the RPA did not attempt to track to any of those waypoints.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The south-eastern point used to georeference the image on the ground control station map was selected to a northern hemisphere latitude, which resulted in incorrect waypoints and home position for the mission.
• The RPA data-link signal to the ground control station was lost, so it commenced tracking to the programmed home position, which was in the Coral Sea Islands at a latitude 17.22° S, about 1,200 km north of the start position.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.

Manufacturer

As a result of this occurrence, the RPAS manufacturer has advised the ATSB that they are taking the following safety actions:

• Audit of training curriculum to ensure that pilots understand how to verify GPS coordinates, interpret their values and signs. The training course will continue to train pilots on the tools available to them within, and outside of the GCS software.
• Share this incident with operator trainers so that new operators can learn from the events of this incident.
• Continued education and outreach discussions with RPAS operators pertaining to decreased mishap rates through training and currency policies.

Remotely piloted aircraft system operator

As a result of this occurrence, the remotely piloted aircraft system operator has advised the ATSB that they are taking the following safety actions:

• The pre-launch checklists have been modified to include additional and enhanced procedures to verify data input and flight plans.
• Investigate the fitting of either GPS or cellular tracking devices to remotely piloted aircraft.
• Update the risk assessment form to include location of external broadcast stations such as television outside broadcast units.
• Brief all company pilots on the event for safety and education purposes.
• Continue liaison with the manufacturer.

Safety message

Incorrect reference data can have potentially serious consequences in remotely piloted and manned aircraft. It is imperative that remotely piloted aircraft systems incorporate means of minimising the opportunity for errors to occur and also for detecting and correcting errors that do occur.

The careful application of operational controls and procedures, underpinned by robust risk assessment, will become increasingly important as relevant technologies develop further and new RPA applications continue to emerge. RPA operators should expect data loss events and prepare for these appropriately.

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One of the safety concerns relates to data input errors.

Aviation Short Investigations Bulletin - Issue 56

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. The Pulse Aerospace Vapor 55 is a helicopter, gross weight 25 kg, with a maximum cruise endurance of 60 minutes, controlled via a laptop computer operating the ground control station and flight controls (joystick).
2. The telemetry data is sent from the RPA to the ground station and stored.
3. Georeferencing means to assign a physical location (coordinates) with a position in an image.

At about 1000 Western Standard Time on 10 September 2016, an Air Tractor AT-502 aircraft, registered VH‑ULV, was conducting aerial agricultural spraying activities at Salmon Gums, near Esperance, West Australia. During a turn at about 200 ft above the ground, the pilot lost control and the aircraft collided with terrain. The aircraft was substantially damaged and the pilot sustained serious injuries.

Figure 1: VH-ULV showing damage
 

Source: Operator

Preliminary enquiries by the ATSB suggest that the accident was attributable to pilot actions. The ATSB considered it was very unlikely that further investigation would uncover any systemic safety issues. The ATSB has discontinued the investigation.

What happened

On 5 June 2016, the pilot of a Cessna 206 floatplane, registered VH-NTK, was taking off from the Southport Broadwater about 6 km south-east (SE) of Southport Airport, Queensland, for a charter flight with two passengers on board.

The wind was blowing from the west-north-west (WNW) at about 18 kt, with gusts of variable speed. The take-off direction to the north-west (NW) was too restrictive due to the presence of boats in the area, so the pilot elected to begin the take-off towards the south-west (SW) (Figure 1). Taking off to the SW would be through a jet-ski course and a crosswind from the right. Once clear of the jet-ski course, the pilot intended to veer right onto a more westerly (into wind) heading to complete the take-off.

The pilot set 20° flap and left the water rudders^[1] in the down position to assist with directional control at the start of the take-off run. The pilot applied full power to start the take-off run and the aircraft pitched^[2] backwards into the plowing position.^[3] The pilot retracted the water rudders about five seconds into the take-off run, and about two seconds later, pitched the aircraft forward from the plowing position into the step position.^[4] As the aircraft pitched forward onto the step it veered to the left onto a south-south-west (SSW) heading (this increased the crosswind experienced – see textbox 4 in Figure 1). The pilot maintained the aircraft on this heading until they sighted barrels in the water that were used to mark the jet-ski course.

The pilot could not prevent the veer to the left, even with full right rudder, so after sighting the jet-ski course barrels, the pilot pitched the aircraft backwards into the plowing position to improve directional control on the water.^[5] The pilot then alternated pitching the aircraft between the plow and step position in order to gradually veer to the right onto a more westerly heading (textbox 5 in Figure 1).

As the aircraft was passing a SW heading and was turning towards WSW, the right wing lifted and the aircraft rolled^[6] to the left. The roll continued, despite the application of full right aileron by the pilot, until the left wing impacted the water. The aircraft rotated to the left through about 270° and the nose and propeller ploughed into the water. The aircraft then came to a stop in an upright position, facing in a westerly direction (Figure 1).

The pilot assessed the condition of the aircraft and elected not to evacuate the passengers. The aircraft was then towed to shore by a jet-ski. There were no injuries and the aircraft was substantially damaged (Figure 2 and 3).

Figure 1: Approximate take-off path and key events

Source: Google earth modified by ATSB

Figure 2: VH-NTK left wing damage

Source: Owner

Figure 3: VH-NTK rear strut fracture (view of the left float facing forwards)

Source: Owner

Pilot comments

The pilot provided the following comments:

• the force that veered the aircraft to the left occurred when they pitched the aircraft forward from the plow position to the step position
• they were turning the aircraft right through SW towards WSW when it rolled
• they were holding full into wind (right) aileron control and therefore expected the left wing to lift prior to the right wing
• when they rolled to the left they were ‘shocked’ by the crosswind and ‘surprised’ they could not control the floatplane
• they estimated the strength of the gust that lifted the right wing was about 8–10 kt
• they had about 110 litres of fuel in the left wing tank and about 60 litres in the right wing tank, which may have contributed to the left roll
• the floatplane rolled left at about 30–35 kt airspeed
• the crosswind limit is 20 kt
• the take-off speed is 41 kt with 20° flap set.

Left turn effect

There are four distinct propeller forces, each of which produce a left turning force on an aeroplane, as follows:

• Torque effect: As the engine internal parts and propeller rotate clockwise, as viewed by the pilot, an equal force tries to rotate the aircraft in the opposite direction. This force places more weight and consequently more hydrodynamic drag on the left float of a floatplane.
• Slipstream effect: The clockwise spiralling motion of the propeller slipstream means that the slipstream strikes the left side of the vertical fin. This produces a yawing^[7] moment to the left.
• P-factor: In a nose high attitude the ‘bite of air’ of the downward moving blade of the propeller is greater than the ‘bite’ of the upward moving blade, which moves the centre of thrust to the right side of the propeller disc. This also produces a yawing moment to the left.
• Gyroscopic effect: The rotating propeller behaves like a gyroscope. As such, any time a force is applied to deflect the propeller from its plane of rotation, the resultant force is 90° ahead in the direction of rotation, and in the direction of the effective force (Figure 4). As such, the gyroscopic effect results in a yawing motion to the left when the aircraft is pitched forward from the plow position to the step position.

Figure 4: Gyroscopic effect

Source: FAA pilot’s handbook of aeronautical knowledge

Additional information is available from the United States Federal Aviation Administration (FAA) Pilot’s handbook of aeronautical knowledge, chapter 5: Aerodynamics of flight.

Crosswind take-off

According to the FAA Seaplane operations handbook, crosswinds can present special difficulties for floatplane pilots. If the aircraft turns towards the wind during a crosswind take-off, then centrifugal force will combine with the wind force to produce a rolling moment in the opposite direction to the turn (Figure 5). If strong enough, the combination of wind and centrifugal force may lift the upwind wing and submerge the downwind float, rolling the aircraft until the downwind wingtip strikes the water. This is known as a water‑loop (Figure 6).

Centre of gravity^[8] location also affects the floatplane’s handling characteristics on the water. If the centre of gravity is located to one side of the centre-line, such as a fuel imbalance between the tanks, one float must support more weight and therefore displace more water than the other float, resulting in more water drag on that side (Figure 7).

Figure 5: Effect of wind force and centrifugal force

Source: FAA seaplane operations handbook

Figure 6: Water-loop

Source: FAA seaplane operations handbook

Figure 7: Effect of fuel imbalance on centre of gravity

Source: FAA seaplane operations handbook

ATSB comment

The pilot reported that it was the force from the forward pitching motion of the aircraft from the nose-high plowing position to a nose-level step position that resulted in the aircraft veering left from the planned take-off path. The force that produces this motion is the gyroscopic effect. At the time of the uncommanded roll to the left the aircraft was turning right with a strong crosswind from the right and more fuel distributed in the left tank than in the right tank. These factors probably combined to elevate the risk of submerging the downwind float and lifting the upwind wing, resulting in a water-loop.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:

Changes to operating procedures

The operator is updating their operations manual to incorporate the following procedural changes:

• The channel at the operating base is orientated north-south, which restricts movements orientated east-west, therefore if the wind is forecast to gust more than 20 kt from the west, or within 30° either side of west, the take-off must be rejected.
• If the aircraft veers to the left during the take-off run and requires full control inputs, then reject the take-off.

Safety message

This accident highlights the risk of a water-loop event during a crosswind take-off in a floatplane. The combined forces acting on a floatplane have the potential to significantly reduce the margin of control available to the pilot. The FAA Seaplane operations handbook provides several recommended crosswind take-off techniques, including the considerations associated with arcing manoeuvres during take-off. If an arcing manoeuvre is to be attempted then the FAA handbook recommends placing the centrifugal force and wind force on opposite sides, and reducing the radius of the arc as the floatplane speed increases.

Refer to the FAA Seaplane operations handbook for a detailed explanation of the recommended crosswind take-off techniques.

Aviation Short Investigations Bulletin - Issue 50

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Retractable control surfaces on the back of each float that can be extended downward into the water to provide more directional control when taxiing. They are attached by cables and springs to the air rudder and operated by the rudder pedals in the cockpit.
2. The term used to describe the motion of an aircraft about its lateral (wingtip-to-wingtip) axis.
3. A nose high, powered taxi characterised by high water drag and an aftward shift of the centre of buoyancy. The weight of the floatplane is supported primarily by buoyancy, and partially by hydrodynamic lift.
4. The attitude of the floatplane when the entire weight of the aircraft is supported by hydrodynamic and aerodynamic lift, as it is during high-speed taxi or just prior to take-off. This position, which is also referred to as the planing position, produces the least amount of water drag.
5. When on the step position the keel of the floats tend to resist turning motion.
6. Term used to describe movement of an aircraft about its longitudinal axis.
7. Term used to describe the motion of an aircraft about its vertical or normal axis.
8. Point through which resultant force of gravity acts, irrespective of orientation; in uniform gravitational field, centre of mass.

What happened

On 16 May 2016, the pilot of a Maule MT-7-235 aircraft, registered VH-DRS, conducted a private flight from Greenfields airstrip (near Noosa), Queensland, with two passengers on board.

The aircraft departed Greenfields airstrip at about 1220 Eastern Standard Time (EST) and flew to Gympie ALA, where the aircraft was refuelled. The aircraft then departed from Gympie and flew north towards Maryborough before returning to Greenfields along a coastal route.

The aircraft joined the circuit at Greenfields on the downwind leg for runway 09. The pilot turned on to the final approach at about 800 ft above ground level, with an airspeed of about 70 kt. The pilot noticed they were getting low on the approach and at about 500 ft, they increased the power to regain their approach path. The pilot subsequently assessed that the aircraft was too high and lowered the nose to re-intercept the approach path.

The pilot flared the aircraft for landing, the aircraft landed heavily and bounced into the air. As the aircraft landed again, the nose wheel touched down first (before the main landing gear) with sufficient force that the nose wheel strut fractured. The nose landing gear and propeller then dug into the ground and the aircraft rotated over its nose and slid a short distance inverted before coming to rest.

The pilot and one passenger were uninjured, the other passenger sustained minor injuries, and the aircraft sustained substantial damage (Figure 1).

Figure 1: Accident site showing damage to VH-DRS

Source: Aircraft owner

Pilot comments

The pilot provided the following comments:

• they taxied the full length of the strip before departure from Greenfields and noted the grass surface was in good condition
• they had flown about five flights, totalling about 20 hours in the last 12 months
• the pilot’s previous flight was about 4 to 5 weeks prior to the accident flight
• the pilot had not operated the Maule aircraft with more than one passenger on board prior to the accident flight
• the pilot thought that the higher all-up-weight of the aircraft with an extra passenger on board contributed to a higher sink rate on final than they expected
• the pilot commented that they should have performed a go-around, rather than continuing with the landing manoeuvre.

ATSB comment

Currency versus proficiency

At the time of the accident the pilot was current for passenger-carrying operations, having conducted at least three take-offs and three landings in the last 90 days. However, it was more than one month since their last flight, which was also a local area scenic flight. The take-off and landing phases of flight are critical phases of flight, since the aircraft is operating closer to the stall speed and with less height to recover from a control problem, relative to cruise flight. The requirement for three take-offs and three landings in the last 90 days is a regulatory requirement of currency, but this does not guarantee proficiency. When flying infrequently, proficiency in take-offs and landings can be improved by dedicating a portion of the flight to practicing circuits. The United States Federal Aviation Administration safety briefing September/October 2010 described this as ‘imbuing the quantity of all your flying, however limited, with quality.’

Safety message

Go-around

The pilot commented that conducting a go-around could have prevented an unstable approach and initial bounce from escalating to an accident. General aviation pilots should set their own criteria for when to conduct a go-around manoeuvre, so that they can recognise and respond to the conditions in a timely manner. This will assist pilots to develop a mindset, which the Flight Safety Foundation (FSF) refers to as ‘go-around-prepared’. FSF Approach-and-landing Accident Reduction (ALAR) briefing note 6.1 emphasises the need to be ‘go-around-prepared’ or ‘go-around-minded’ because the execution of a go-around is an infrequent manoeuvre. FSF ALAR briefing note 7.1 provides further information on unstable approaches and how to develop personal lines of defence.

Aviation Short Investigations Bulletin - Issue 50

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the morning of 29 January 2016, a Piper Aircraft Corp PA-28 aircraft, registered VH-PXD, was on a private flight from Moorabbin Airport, Victoria to King Island, Tasmania. After passing over Point Lonsdale, the aircraft entered an area of low visibility. The pilot conducted a 180° turn and initially tracked back towards Point Lonsdale, before heading south over the ocean. After about 2 minutes, the aircraft was again turned right before entering a rapid descent. The aircraft impacted the water at 1227 Eastern Daylight-saving time, 6.6 km south-west of Point Lonsdale. All four occupants of the aircraft were fatally injured.

What the ATSB found

The ATSB found that continuation of the flight beyond Point Lonsdale, and towards an area of low visibility conditions, was likely influenced by the inherent challenges of assessing those conditions.

The ATSB also found that due to the presence of low cloud and rain, the pilot probably experienced a loss of visual cues and became spatially disorientated, leading to a loss of control and impact with the water. The risk of a loss of control in the conditions was increased by the pilot’s lack of instrument flying proficiency.

Safety message

Pre-flight planning needs to include consideration of not only the conditions on departure, but at all stages of the flight. This informs the decision of whether to depart and allows for prior consideration of alternative actions in the case of deteriorating weather, such as returning or diverting.

It is always possible that the actual weather conditions will be different to those forecast. Pilots conducting a flight under the visual flight rules make every effort to avoid areas of low visibility and plan for unforeseen eventualities. However, this is dependent on the pilot perceiving the risks of the situation, which is not inherently easy. Education and training in the practical application of meteorological principles has been shown to enhance pilots’ ability to recognise and respond to deteriorating weather conditions.

The ATSB cautions that, on entering an area of reduced visual cues, the risk of experiencing spatial disorientation and a loss of control is high, measuring from between 60 to 178 seconds from the time of entering the area of low visibility. This risk is highest for those without proficiency or recent experience in instrument flying. Requesting assistance from air traffic control can increase the chances of re-establishing visual cues.

The occurrence

On the morning of 29 January 2016, a Piper Aircraft Corp. PA-28 aircraft, registered VH-PXD (PXD), was on a private flight under the visual flight rules (VFR)^[1] from Moorabbin Airport, Victoria to King Island, Tasmania with four occupants on board. The ATSB was unable, given the physical evidence and available flight documentation, to establish which occupant was the pilot in command of the flight.

Several members of the Royal Victorian Aero Club (RVAC) were planning to fly to King Island throughout the weekend, although there was no coordination between the members.

Two of the occupants of PXD arrived at Moorabbin Airport by about 0800 Eastern Daylight‑saving Time^[2] that day and ascertained that the weather in the vicinity of the airport was not yet suitable for departure. However, other pilots reported advising the occupants of PXD that the weather at King Island was good. It was also reported that one of the occupants formed the understanding that the weather was slowly moving east and that it was clearing to the west. At around 1000, the early arrivals contacted the other occupants of PXD. It was reported that the decision to go was made during that exchange. By 1100, all four occupants were at the airport and preparing for the flight.

At some stage during the morning, one of the occupants logged into their National Aeronautical Information Processing System account^[3] and accessed a number of weather and aerodrome forecasts, weather observations and notices to airmen (NOTAM)^[4] for the day. This same occupant also called the local Bureau of Meteorology phone number. Two of the occupants also made phone calls to the recorded Aerodrome Weather Information Services^[5] for King Island (the evening before) and Moorabbin (that morning). Those products and services were broadly consistent with the intended route.

Recorded radio calls indicated that, as PXD was being prepared to depart, a number of other aircraft requested clearance for their arrivals/departures at Moorabbin under special VFR (refer to the section titled Additional information – Visual flight rules and visual meteorological conditions). This was due to a reported cloud base of 800 ft. The requests for special VFR were made by a pilot departing at 1138 and a pilot arriving into Moorabbin at 1213.

At 1144:32, a transmission was made by the pilot of PXD on the Moorabbin Ground frequency that the aircraft was positioned in the engine run-up bay and that they were ready for departure for King Island. At 1157:55, the pilot of PXD advised the Moorabbin Tower controller that they were at the holding point for runway 13L and ready for take-off. This call did not include a request for special VFR and ATC did not prompt the request. Three minutes later they received clearance for take-off before departing Moorabbin at 1203. The aircraft’s track to Point Lonsdale and a number of pilot actions and other observations are at Figure 1.

Around the same time, one of the RVAC aircraft flying to King Island was nearing Point Lonsdale. The pilot of that aircraft later reported having seen what appeared to be a storm cell over Point Lonsdale and the heads. The likelihood of reduced visibility in the area was reported to have prompted the pilot to return to Moorabbin Airport. The pilot of the RVAC aircraft landed back in Moorabbin at 1220 with a special VFR clearance. This was after PXD’s departure.

A transmission was made by the pilot of PXD on the Moorabbin Tower frequency at 1209. In this transmission, the pilot reported that the cloud base over Carrum was about 800–900 ft. No further radio contact with PXD was recorded. At 1212 the aircraft’s transponder code was switched to ‘1200’ per normal airspace procedures.^[6]

At about 1222, after passing over Point Lonsdale, the pilot conducted a series of left and right turns, followed by a 180° turn to initially track back towards Point Lonsdale. This was followed by a gentle right turn heading south over the ocean for about 2 minutes, before again turning right and entering a rapid descent. At about 1227, PXD impacted the water 6.6 km south-west of Point Lonsdale. All of the aircraft occupants were fatally injured.

Witnesses who were fishing in the vicinity of Point Lonsdale at the time reported hearing an aircraft pass nearby at what they interpreted to be a ‘very low altitude’. Due to the low cloud and visibility in the area they could not initially see the aircraft. The witnesses recalled that, a few minutes later, they saw the aircraft just before it impacted the water. It appeared to be in a nose‑down, right wing-low attitude and the engine sounded as though it was producing power.

Another two aircraft that were also from the RVAC departed Moorabbin for King Island at 1230 and 1250 respectively. Whilst communicating with each other on the RVAC frequency, they discussed the area of low visibility around Point Lonsdale. Both pilots reported descending in the vicinity of Point Lonsdale in an effort to maintain better visibility, particularly over Barwon Heads. One pilot took several photographs whilst flying over the area that show the weather conditions. Showers were reported passing through this area, reducing the cloud base. The two aircraft continued on to King Island.

Figure 1: PXD’s track from Moorabbin Airport until the collision with water near Point Lonsdale with the area between Point Lonsdale and the impact with the water at inset. Noteworthy pilot actions and other observations are annotated.

Source: Google earth, modified by the ATSB

__________

1. VFR: a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.
2. Eastern Daylight-saving Time (EDT) was Coordinated Universal Time (UTC) + 11 hours.
3. NAIPS is a multi-function, computerised aeronautical information system. It processes and stores meteorological and NOTAM information and facilitates the provision of briefing products and services to pilots.
4. NOTAM: A notice distributed by means of telecommunication containing information concerning the establishment, condition or change in any aeronautical facility, service, procedure or hazard, the timely knowledge of which is essential to personnel concerned with flight operations.
5. Aerodrome weather information service (AWIS): actual weather conditions, provided via telephone or radio broadcast, from Bureau of Meteorology (BoM) automatic weather stations, or weather stations approved for that purpose by the BoM.
6. For civil VFR flights operating in Class E or G airspace, a transponder code of ‘1200’ is selected, unless otherwise directed by ATC. On departure from the Moorabbin control zone, PXD entered Class G airspace.

Context

Personnel information

Of the four occupants on board PXD, three were pilots. Of these, two held the necessary qualifications and a current medical to be able to conduct the flight. None of the pilots had ever held an instrument rating. However, there was insufficient evidence to definitively identify the pilot in command for this flight.

Fatigue

An assessment was undertaken of whether any of the aircraft occupants may have been experiencing a level of fatigue known to have an effect on performance. This included consideration of their possible time awake at the time of the occurrence, sleep history and potential workload associated with the task and environmental factors. However, the limited data available on the occupants’ activities in the preceding days meant there was insufficient evidence to determine whether fatigue was contributory to this occurrence.

Aircraft information

General

VH-PXD (PXD) was a Piper Aircraft Corp. PA-28 four seat, low wing, all metal, unpressurised, fixed undercarriage aircraft with a single reciprocating engine (Figure 2). It had current certificates of airworthiness and registration and a current maintenance release, with no noted defects.

The last periodic maintenance inspection on PXD was conducted in Bacchus Marsh on the day before the occurrence. During that inspection, the right-upper wing skin was replaced, the artificial horizon was repaired and all of the aircraft’s control cables were replaced. The maintenance was completed by an appropriately-qualified Licensed Aircraft Maintenance Engineer in an approved maintenance facility.

The 25-minute return flight to Moorabbin after the maintenance at Bacchus Marsh was completed with no reported issues.

Figure 2: VH-PXD, taken in April 2011 in Echuca, New South Wales

Source: Nick Dean (www.airport-data.com)  

Weight and balance

The ATSB was unable to determine the actual weights and seating positions of the occupants and amount of baggage on board at the time of the occurrence. Therefore, the actual weight of the aircraft and its centre of gravity was unable to be calculated.

It was reported that the aircraft was refuelled to full tanks prior to departing Moorabbin Airport that day. The weight of the aircraft on departure from Moorabbin Airport was estimated based on:

• the recorded aircraft weight
• the weight of the fuel
• data from the Civil Aviation Safety Authority (CASA) medical examinations for three of the aircraft occupants^[7]
• a statistical average for the fourth occupant.

That estimate would have meant PXD was about 35 kg under the maximum permissible take-off weight for the flight. However, that weight did not account for the unknown amount of baggage on board. It was therefore concluded likely that the aircraft was close to its maximum take-off weight when it departed from Moorabbin Airport.

Meteorological information

Forecast weather

On the day of the occurrence, there was a complex weather pattern over south-eastern Australia. That weather pattern included a number of low pressure systems, along with upper atmosphere and surface troughs. This was forecast to result in significant areas of low cloud, showers and areas of rain.

An area forecast (ARFOR)^[8] covering the proposed route indicated a surface trough to the east of Melbourne that was forecast to slowly move to the west during the day. There were isolated thunderstorms forecast over the sea, coast and adjacent ranges to the east of Melbourne. Showers of rain, with associated broken^[9] low cloud with a minimum base of 500 ft were forecast in an area starting west of Melbourne and extending to the east. Additionally, there was forecast low cloud south-east of a line extending from King Island, north to Ballarat and then east to Bombala. A pictorial representation of these areas is shown at Figure 3.

Figure 3: Pictorial representation of the Area 30/32 forecast valid from 0900 on 29 January 2016

Source: ATSB

The aerodrome forecast (TAF)^[10] for Moorabbin Airport that was issued at 1003 indicated that the wind would be from the south-east at 8 kt and that the visibility would generally be greater than 10 km. Light rain was forecast with a scattered cloud base at 1,200 ft above the aerodrome and a broken layer at 3,500 ft. The forecast noted that there would also be periods of up to 60 minutes duration, starting from 1100, where the visibility would decrease to 4,000 m in rain and the cloud base would lower to 1,000 ft and the amount of cloud increase to broken.

A TAF for Avalon Airport indicated that the wind would be variable in direction at 5 kt and that the visibility would generally be greater than 10 km. Light showers of rain were forecast and the cloud was forecast to be scattered with a base 1,000 ft above the aerodrome and a broken layer at 3,500 ft. The forecast indicated that, from 0800, there would be periods of 30 minutes duration where the visibility would decrease to 5,000 m in showers of rain, and the cloud base would be scattered at 1,500 ft.

Actual weather conditions

Weather reports (captured by automatic sensors) for Moorabbin between 1100 and 1200 indicated a scattered layer of cloud with a base between 800 and 1,200 ft above the aerodrome elevation and a visibility of 10 km or more. A special report (SPECI)^[11] issued at 1209 indicated that the cloud base was broken at 1,200 ft. None of the weather reports suggested that decreased visibility might have affected PXD’s departure.

A weather report issued at 1130 for Avalon indicated the visibility had reduced to 9,000 m in drizzle with cloud overcast at 2,700 ft. A SPECI at 1133 reported a further decrease in visibility to 6,000 m with cloud unchanged. The 1200 SPECI for Avalon indicated scattered cloud but with a lower base of 1,100 ft, and that the visibility had increased to in excess of 10 km.

Weather radar images from the Melbourne (Laverton) radar recorded the following:

• At 1218, significant rainfall returns, from light to moderately heavy rain to the east of Melbourne, extending from the ranges to Bass Strait. There were also rainfall returns to the south-west of the radar location over land, the coastline and extending out to sea in the area of Barwon Heads. These indicated light rainfall, with the heaviest returns over the sea to the east of Anglesea.
• At 1224, that the rainfall returns to the south-west had increased in area and intensity. The returns were generally orientated along a line in a north‑westerly to south‑easterly direction. That line covered an area estimated from 5 km inland to a point estimated to be 20 km out to sea. A portion of this image is shown in Figure 4, with the aircraft’s track superimposed.
• At 1307, that the area of rain enlarged, extending from Torquay to Anglesea and out to sea.

The weather radar information from 1224, when overlayed with the aircraft track, indicated that the aircraft likely entered an area of low visibility associated with light‑to‑moderate rain at about 1223.

Moorabbin Automatic Terminal Information Service

Relevant aspects of the Moorabbin Automatic Terminal Information Service (ATIS) reports of the actual conditions and requirements at around the time of the flight by PXD are listed in Table 1.^[12] When operating at a controlled aerodrome where an ATIS is in operation, pilots are required to listen to the facility prior to taxi and advise air traffic control of receipt of that information. This advice is part of the pilot’s taxi call.

Table 1: Actual weather conditions and requirements as reported in successive ATIS reports at around the time of the flight by PXD

The pilot of PXD made their taxi call at 1144:32. Although ATIS is a passive facility, there was no indication in the recorded radio calls that the pilot of PXD accessed ATIS information ‘Papa’.

Figure 4: Weather radar recording (orientated with reference to a Google earth map at inset) and associated ‘Rain rate’ at 1224, showing the aircraft’s track

Source: At inset, Google earth, modified by the ATSB and larger image Geoscience Australia (base map) and the Bureau of Meteorology (weather radar), both modified by the ATSB

Closed-circuit television images from Port of Melbourne cameras facing east across the water from Point Lonsdale, and north from Point Nepean both showed drizzle, light rain and reduced visibility including little natural horizon as PXD tracked south along the eastern shore of Port Phillip Bay (Figure 5).

Witnesses that saw the aircraft recalled that the visibility at that time was very low, such that it prevented them seeing the land. The witnesses estimated that the land was between 1 and 4 km away and indicated that it was raining at the time.

Figure 5: Still images taken at 1215 from two different closed-circuit television cameras owned by the Port of Melbourne. One camera (left image) was positioned on the Point Lonsdale lighthouse facing east. The other camera (right image) was positioned at Point Nepean, facing north. The image quality is affected by contaminants on the camera lens, but the extent of the low visibility conditions in the area is evident

Source: Port of Melbourne, modified by the ATSB

Recorded data

Recorded flight data was obtained from an ‘electronic flight bag’ iPad™ application that the occupants were using on the flight. This data was used to assist in the wreckage recovery and in the analysis of the aircraft track.

Flight track information was also obtained from air traffic control (ATC) radar information. This included recorded radar returns from the aircraft from its departure from Moorabbin Airport to the time of the occurrence.

Witnesses that saw the occurrence also provided the ATSB with their ‘fish finder’ Global Positioning System device. Data was downloaded from this device and assisted with locating the wreckage.

Wreckage and impact information

The aircraft impacted the water after a rapid descent, with parts of the wreckage descending to the sea floor. Evidence from the wreckage was consistent with the aircraft impacting the water in a nose-down attitude, with the engine delivering power.

Recovery of the wreckage

A search for the wreckage was commenced by the Victoria Water Police and Air Wing within an hour of the accident. Small items of wreckage had surfaced, or remained on the surface and were recovered by the water police and nearby witnesses. These included items such as a number of the occupants’ personal effects and the three pilots’ CASA flight crew licences and aviation medical certificates.

After several day’s search using surface sonar and underwater robotic equipment, on 2 February 2016 Victoria Police located a large portion of the aircraft wreckage on the ocean floor at a depth of 34 m. The wreckage was about 1 km from shore, off the Point Lonsdale lighthouse.

On the evening of 6 February 2016, the wreckage was recovered to the surface by police divers, supported by a barge and lifting equipment (Figure 6). On 7 February, the ATSB assisted with the removal and transportation of the wreckage to a secure site for inspection.

Figure 6: Recovery by Victoria Police of the aircraft’s fin and left horizontal stabiliser

Source: Victoria Police

Wreckage inspection

The majority of the aircraft’s fuselage, fin, horizontal stabiliser, engine and propeller, flight control cables, main landing gear assembly, instrument panel and some items from the cabin interior were recovered. Figures 7 and 8 show some of the airframe and other items and components that were recovered.

All identified fracture surfaces throughout the recovered wreckage were consistent with overload failure as a result of the impact with water. There was no evidence of pre-existing damage to the airframe, or failure of the primary control systems that may have contributed to the accident. However, the aircraft wreckage exhibited severe disruption.

Some components, such as the engine carburettor, right horizontal stabiliser assembly and left and right-wing structures were not recovered.

Figure 7: Some of the recovered aircraft wreckage. Note the extent of the disruption of the airframe

Source: ATSB

A detailed inspection of the engine and propeller was conducted in a CASA-approved maintenance facility. Nothing was identified during that inspection that may have contributed to the accident, or would have prevented the engine and propeller from normal operation.

Figure 8: Recovered aircraft engine, propeller and propeller spinner, looking at the lower surface of the engine

Source: ATSB

Medical and pathological information

Post-mortem and toxicological examination of all of the aircraft occupants found no underlying medical disorder likely to lead to incapacitation. All occupants on board PXD sustained multiple fatal injuries consistent with the aircraft impacting water.

Survival aspects

Due to the extent of the impact forces and aircraft break-up, the occurrence was not survivable. While the occupants of PXD were seen by witnesses to acquire life jackets prior to their departure from Moorabbin Airport, these were not found in the recovered wreckage.

Additional information

Visual Flight Rules and Visual Meteorological Conditions

The CASA Visual Flight Rules Guide outlined that flight under the visual flight rules (VFR) can only be conducted in Visual Meteorological Conditions (VMC).^[13] This was provided that, when operating at or below 2,000 ft above the ground or water, the pilot is able to navigate by visual reference to the ground or water.

Moorabbin Airport was surrounded by Class D (controlled) airspace out to 3 NM (6 km) and below 2,500 ft above mean sea level. The visual meteorological conditions for class D airspace included:

• a flight visibility of 5,000 m
• a minimum horizontal distance from cloud of 600 m and height vertically above cloud of 1,000 ft or vertically below cloud of 500 ft.

When requested by a pilot, ATC could permit operations by day in Class D airspace under special VFR when the weather conditions did not meet the above VMC criteria. Operations under special VFR required pilots to:

• remain clear of cloud
• in the case of aeroplanes, ensure an in-flight visibility of 1,600 m
• operate within the requirements of Civil Aviation Regulation 157 Low flying.

After departing class D airspace, the aircraft entered (uncontrolled) Class G airspace. The following conditions were stipulated for flight under the VFR in this airspace when below 10,000 ft:

• a flight visibility of 5,000 m
• a minimum vertical distance of 1,000 ft and horizontal distance of 1,500 m from cloud.

In addition, in the case of aeroplane operations in Class G at or below 3,000 ft above mean sea level or 1,000 ft above ground level (whichever is higher), the following minimum conditions were stipulated:

• a flight visibility of 5,000 m
• that the aeroplane shall be maintained clear of cloud and in sight of the ground or water
• that a radio must be carried and used by the pilot on the correct frequency.

In this case, the area and aerodrome forecasts for Avalon and the surrounding area indicated that visibility was reduced to 5,000 m and a scattered cloud base of 1,500 ft around Avalon. In addition, there was an overall reduced visibility in the region.

Visual flight into Instrument Meteorological Conditions

The safety risks of VFR pilots flying from VMC conditions into instrument meteorological conditions (IMC)^[14] are well documented. This has been the focus of numerous ATSB reports and publications, as VFR pilots flying into IMC represents a significant cause of aircraft accidents and fatalities. In 2013 the ATSB Avoidable Accidents series was re-published. Of these publications, the booklet titled Accidents involving pilots in Instrument Meteorological Conditions outlined that:

In the 5 years 2006–2010, there were 72 occurrences of visual flight rules (VFR) pilots flying in instrument meteorological conditions (IMC) reported to the ATSB…About one in ten VFR into IMC events result in a fatal outcome.

Additionally, a study conducted by the United States National Transportation Safety Board (2005) found that ‘about two-thirds of all general aviation accidents that occur in instrument meteorological conditions (IMC) are fatal’.

Wiggins and O’Hare (1995) explained that when pilots are not trained or qualified to fly in IMC and find themselves in these conditions, ‘the result will almost inevitably involve loss of control of the aircraft resulting in a fatal crash’.

Loss of visual cues and spatial disorientation in low visibility conditions

Gibb and others (2010) explain that seeing the horizon is ‘crucial for orientation of the pilot’s sense of pitch and bank of the aircraft.’ In conditions of low visibility, the horizon may not be visible to the pilot, during which time they can become rapidly disorientated. Newman (2007) found that ‘the major environmental factors [that contribute to spatial disorientation] are related to time of day and the ambient weather conditions. Poor visual cues are a function of most disorientation illusions, so flight at night or in conditions of bad weather can set a pilot up for a disorientation experience’.

In a discussion of spatial disorientation, Benson (1999) defined the experience as follows:

Spatial disorientation is…[where] the pilot fails to sense correctly the position, motion or attitude of the aircraft or of him/herself [resulting in] errors in perception by the pilot of their position, motion or attitude with respect to their aircraft...

Newman (2007) summarised the primary reason for spatial disorientation as follows:

The visual system is by far the most important of the three systems, providing some 80 per cent of the raw orientation information. In conditions where visual cues are poor or absent, such as in poor weather or at night, up to 80 per cent of the normal orientation information is missing. The remaining 20 per cent is split equally between the vestibular system and the proprioceptive system, both of which are prone to illusions and misinterpretation. In poor or absent visual cue situations, humans are forced to rely on the remaining 20 per cent of orientation information, which is less accurate…In the aviation setting, such a situation can then result in any number of well-described SD [spatial disorientation] illusions being experienced by the pilot…The majority of disorientation events are associated with poor visual cues (as in IMC or night flight).

Extensive research on spatial disorientation indicates that loss of control will likely occur between 60 seconds (Benson, 1983 in Gibb and others, 2010) and 178 seconds (Newman, 2007) after the loss of visual reference. This is the case even when the aircraft is in straight and level flight at the time vision is lost, and is shorter still if the aircraft is in a turn. Gibb and others (2010) state that ‘spatial disorientation accidents have fatality rates of 90–91 percent, which indicates how compelling the misperceptions can be’.

Pilot instrument flying proficiency

When there are no external visual cues, the ability to fly on instruments is essential. Research from the United States has shown that pilots without instrument ratings are five times more likely to have accidents in degraded visual conditions than pilots with instrument ratings (Groff and Price, 2006). The National Transportation Safety Board also noted that ‘Tests and experience have shown that non-instrument-trained pilots or non-proficient pilots are rarely successful in overcoming spatial disorientation’ (NTSB, 1988).

Gibb and others (2010) add that ‘a visual-only general aviation pilot encountering weather or night conditions is severely at risk because of [their] total inexperience, education, and training in using instruments.’ Simulator experiments at the University of Illinois determined that on average, a pilot with no instrument training can expect to retain control of their aircraft for 178 seconds after entering bad weather and losing visual contact (ATSB, 2011).

Although instrument flying proficiency is a very important defence against spatial disorientation, many studies have shown overall flying experience has little, if any, influence on spatial disorientation accident rates (Gawron, 2004). Newman (2007) noted that spatial disorientation can affect ‘any pilot, any time, any where, in any aircraft, on any flight, depending on the prevailing circumstances’.

Related occurrences

The previously-discussed ATSB research reports and educational material were based on occurrences up until 2013 (see the section titled Visual flight into Instrument Meteorological Conditions). In the period 2014 through to October 2016 there were 28 reported occurrences (not including this accident). Six of these included a decision by the pilot to divert or return to the departure airport, and another eight pilots sought assistance from ATC.

In addition, a number of recent ATSB investigations examined VFR into IMC occurrences. Of these, three are summarised below and are available at www.atsb.gov.au.

ATSB investigation AO-2011-100

On 15 August 2011, the pilot of a Piper PA-28-180 Cherokee aircraft, registered VH-POJ, was conducting a private flight transporting two passengers from Essendon to Nhill, Victoria under the VFR. The flight was arranged to return the passengers to their home location after medical treatment in Melbourne.

Global Positioning System data recovered from the aircraft indicated that when about 52 km from Nhill, the aircraft conducted a series of manoeuvres followed by a descending right turn. The aircraft subsequently impacted the ground at 1820 Eastern Standard Time^[15], fatally injuring the pilot and one of the passengers. The second passenger later died in hospital as a result of complications from injuries sustained in the accident.

The ATSB found that the pilot landed at Bendigo and accessed a weather forecast before continuing towards Nhill. After recommencing the flight, the pilot probably encountered reduced visibility conditions approaching Nhill due to low cloud, rain and diminishing daylight, leading to disorientation, loss of control and impact with terrain.

ATSB investigation AO-2014-029

On 21 February 2014, the pilot of a Piper PA-28R aircraft, registered VH-TBB, departed Scone, New South Wales on a private flight to Warwick, Queensland. The flight was planned under the VFR.

The flight proceeded normally until the pilot encountered an increasing amount of cloud and light rain showers while en route between Inverell and Warwick. The pilot initially attempted to pass beneath the cloud, but had difficulty maintaining VMC. Although the pilot reported the cloud appeared to be relatively light with ill-defined edges, they found that forward visibility was restricted. The pilot advised ATC of occasionally encountering IMC, and with the aircraft intermittently identified on radar, ATC was able to assist the pilot with relevant advice.

The pilot had undertaken some instrument flight training about 2 years prior to the incident, which they reported had provided some confidence with respect to aircraft control in marginal conditions.

ATSB investigation AO-2014-139

On 9 July 2014, at about 1340 Eastern Standard Time, a Cessna 206, registered VH-NCR, departed Dubbo, New South Wales on a private flight to the Gold Coast and Archerfield, Queensland, under the VFR, with three passengers on board.

When about 15 NM (28 km) south of Inverell, the pilot observed the weather deteriorating with low cloud about the ranges, and elected to climb and operate VFR on top of the cloud. As the aircraft climbed above 5,000 ft, the pilot observed a widespread frontal mass of cloud with tops around 12,000 ft. As a result, they contacted Brisbane Centre ATC and requested navigation assistance and ATC provided updated weather information.

The pilot initially considered a diversion to Moree, however, they were able to descend through a break in the cloud and elected to divert to Inverell. A turn was commenced, but passing about 3,800 ft during the turn, the aircraft entered cloud. The pilot immediately applied full power and commenced climbing until the aircraft cleared cloud at about 5,000 ft. The pilot diverted to Gunnedah.

One of the safety messages included in the report was to encourage pilots to make conservative decisions when considering how forecast weather may affect their flight. If poor weather is encountered en route, timely and conservative decision making may be critical to a safe outcome.

__________

7. The medical records were up to 6 years old. As a result, the actual weights of the three occupants affected would likely have varied since that time.
8. ARFOR: routine forecasts for designated areas and amendments when prescribed criteria are satisfied. Australia is subdivided into a number of forecast areas.
9. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘ ‘scattered’ indicates that cloud is covering between a quarter and a half of the sky, ‘broken’ indicates that more than half to almost all the sky is covered, and ‘overcast’ indicates that all the sky is covered.
10. TAF: a statement of meteorological conditions expected for a specific period of time in the airspace within a radius of 5 NM (9 km) of the aerodrome reference point.
11. SPECI: an aerodrome weather report that is issued whenever weather conditions fluctuate about, or are below specified criteria.
12. ATIS: The provision of current, routine information to arriving and departing aircraft by means of continuous and repetitive broadcasts during the hours when the unit responsible for the service is in operation.
13. VMC: a series of minimum meteorological conditions in which flight is permitted under the visual flight rules – that is, conditions in which pilots have sufficient visibility to fly the aircraft while maintaining visual separation from terrain and other aircraft.
14. IMC: weather conditions that require pilots to fly primarily by reference to instruments, and therefore under Instrument Flight Rules (IFR), rather than by outside visual reference. Typically, this means flying in cloud or limited visibility.
15. Eastern Standard Time (EST) was Coordinated Universal Time (UTC) + 11 hours.

Safety analysis

While en route from Moorabbin, Victoria to King Island, Tasmania, Piper Aircraft Corp. PA‑28 aircraft, registered VH-PXD (PXD), entered an area of low visibility around Point Lonsdale. The aircraft’s track became increasingly erratic until its impact with the water. There were no significant defects or anomalies found with the recovered components of the aircraft that might have contributed to the accident.

Of the three aircraft occupants that held a pilot licence, the ATSB was not able to establish the pilot in command for the flight. None of these occupants held an instrument rating and the flight was being carried out under the Visual Flight Rules (VFR).

The following analysis examines the decision to depart on the flight and the various human performance factors that likely influenced a VFR pilot, who did not hold an instrument rating, to continue the VFR flight with reduced visual cues. The effect on human performance of spatial disorientation is also examined.

Decision to depart Moorabbin Airport

Prior to departing Moorabbin, the occupants on board PXD had retrieved a number of aerodrome and area forecasts, weather observations and notices to airmen for the day. During their pre-flight preparations, the two early arrival occupants formed a view that the weather conditions at Moorabbin Airport would improve and suggested the last two occupants make their way to the airport.

The weather observations either side of PXD’s departure suggested scattered to broken cloud with a base of between 1,000 and 1,200 ft and a visibility of 10 km or more. The lower of those cloud bases, and content of the earlier Automatic Terminal Information Service ‘Papa’, would explain the use by a number of pilots of previous arrivals/departures to/from Moorabbin of special VFR.

The lack of evidence of the pilot of PXD accessing information ‘Papa’, or later information, could suggest that the pilot did not have that information on taxi. There was also no evidence of the pilot being on Moorabbin Tower frequency until about 1144, after the time the last of the preceding aircraft movements sought clearance under the special VFR. In this case, the pilot of PXD would not have developed an understanding of the implications of the content of information ‘Papa’ or the subsequent information, or of the earlier pilots’ clearance requests for departure from/entry to the Moorabbin control zone under special VFR. In the absence of that understanding, the successful arrival/departure of those aircraft could have contributed the decision by the pilot of PXD to depart Moorabbin.

ATSB analysis of the area forecasts relevant to the flight identified a complex weather system with showers tending to rain, low cloud with a minimum base of 500 ft and isolated thunderstorms over the sea, coast and adjacent areas. These conditions could be expected on the planned route to King Island. Although several sources of weather forecast information were accessed, the ATSB could not determine the extent to which the occupants of PXD considered these forecasts and the associated risk to their flight once they departed Moorabbin. In addition, the recorded weather conditions around the time of PXD’s departure from Moorabbin indicated minimal cloud cover en route to the Point Lonsdale area.

In the event, other pilots also departed Moorabbin for King Island. Of these, a preceding pilot returned to Moorabbin in response to the reduced visibility in the area of Point Lonsdale. The pilot of the returning aircraft indicated that the reduced visibility was due to what appeared to be storms. Two following pilots continued to King Island, although also reported reduced visibility conditions in the Point Lonsdale area.

The importance of careful study of all relevant weather and other operational information affecting a flight was highlighted in the ATSB Avoidable Accident Series booklet Accidents involving pilots in Instrument Meteorological Conditions. The benefits of thorough pre‑flight planning in minimising in-flight decision errors were highlighted as follows:

Prior to a flight, a pilot must study all available information appropriate to the intended operation, including the current weather forecasts. This is a requirement in the Civil Aviation Regulations (CAR 174) and [is] repeated in the Aeronautical Information Publication…Pre-flight planning minimises in‑flight decision errors because it removes the unforeseen element from situations that arise during the flight. Failure to carry out this prior planning can result in decisions being made under a situation of considerable stress and increases the likelihood of poor or incorrect decision making.

The following section examines the decision by the pilot of PXD to apparently continue the flight to King Island in the deteriorating weather conditions.

Flying into areas of low visibility

The United States National Transportation Safety Board (2005) found that ‘reduced-visibility weather represents a particularly high risk to [general aviation] operations’ and that ‘weather may…test the limits of pilot knowledge, training, and skill to the point that underlying issues are identified.’

After ascertaining that it was suitable to depart Moorabbin, the occupants of PXD encountered conditions over eastern Port Phillip Bay that allowed for flight to a recorded altitude of 1,400 ft. This may have strengthened a perception that continuing on their planned track past Point Lonsdale towards King Island was possible.

In contrast, closed-circuit television footage, witness statements and photographs taken by other pilots indicated localised precipitation and low cloud and low visibility conditions in the Point Lonsdale area. These conditions were consistent with the area forecast and would have affected PXD. Although audible, PXD was not visible to witnesses in the reported low cloud and visibility until it descended through, or appeared from behind the cloud and impacted the water.

Wiegmann and Goh (2000) explained that:

One reason why pilots may decide to continue a VFR flight into adverse weather is that they make errors when assessing the situation. That is, pilots are seen to engage in VFR flight into IMC [instrument meteorological conditions] because they do not accurately assess the hazard (i.e., the deteriorating weather conditions)…

The previously mentioned United States National Transportation Safety Board report (2005) added that in these cases, pilots who might appear to intentionally engage in risky behaviour may actually be making choices that they mistakenly believe to be safe:

Even if pilots are able to correctly assess current weather conditions, they may still underestimate the risk associated with continued flight under those conditions, or they may overestimate their ability to handle that risk.

This would explain the pilot’s assessment of the risk associated with the low visibility conditions in the Point Lonsdale area and subsequent decision to continue towards these conditions, rather than to divert. Wiggins and O’Hare (1995) further explained how errors in assessment can take place, acknowledging that weather-related decision making can be highly complex and therefore more prone to errors:

Because of the variable nature of operations in the aviation environment, weather-related decision making is often considered a skill that cannot be prescribed during training. Rather it is expected to develop gradually through practical experience. However, in developing this type of experience, relatively inexperienced pilots may be exposed to hazardous situations with which they are ill‑equipped to cope.

ATSB Aviation Research and Analysis Report B2007/0063 stated that pilots should not attempt to fly into instrument meteorological conditions under the VFR. Pilots should develop a plan prior to take-off on what to do if the weather en route is different from that expected, or deteriorates. This plan should consider a requirement to divert or turn back prior to entering instrument meteorological conditions. However, this depends on a pilot correctly assessing the weather conditions. The United States National Transportation Safety Board (2005) noted that targeted weather-related training programs have had some success in teaching pilots to recognise and respond to deteriorating weather conditions.

Additionally, Wiggins and O’Hare (2003) evaluated the effectiveness of a cue-based training system called Weatherwise, which was designed to equip VFR pilots with the skills to recognise and respond to the cues associated with deteriorating weather conditions during flight. VFR pilots were more likely to use the cues following the training, with subsequent improvements in their weather-related decision-making. The Weatherwise program was made available to pilots by the Civil Aviation Safety Authority (CASA). Additionally, CASA produced a Weather to Fly education program which focuses on topics such as the importance of pre-flight preparation, making decisions early and talking to ATC.

It was not known how the occupants understood the weather conditions ahead of them prior to entering an area of low visibility conditions. The occupants of PXD may have misperceived the severity of the conditions, resulting in them tracking into the area. In this case, the inherent challenges of assessing low visibility conditions in-flight likely influenced the pilot’s continuing towards an area of reduced visual cues, particularly when the pilots had limited instrument flying proficiency. This reinforces the benefits of comprehensive pre-flight planning to minimise the risk of in‑flight decision errors.

Spatial disorientation resulting from a loss of visual cues

PXD entered an area that was reported by witnesses to include low visibility at about 1223, just after passing Point Lonsdale. The pilot had already executed a number of left and right turns approaching this area, conceivably as they sought to avoid cloud or move towards areas of improved visibility. The decision to then undertake a 180° turn was likely an effort to track back over Point Lonsdale and avoid or exit the low visibility conditions.

On entry into the low visibility conditions, the pilot of PXD would have lost visual cues, in particular the horizon. It is well established that a loss of visual cues significantly increases the risk of spatial disorientation.

Along with the loss of visual cues, there was the potential that the 180° turn contributed to the development, or exacerbated the effects of spatial disorientation. Subsequently the aircraft tracked south over the water, initially in a right turn, with a series of climbs and descents varying in height between 500 ft and 1,200 ft. The final right turn was accompanied by a high rate of descent from 1,200 ft, followed by impact with the water.

The time from PXD entering the area of low visibility to impacting the water was about 180 seconds. This is broadly consistent with the time indicated by research between experiencing spatial disorientation and a subsequent loss of control. Reinforcing the high likelihood that, in the conditions, the pilot of PXD experienced spatial disorientation the:

• pilot did not hold an instrument rating
• aircraft’s track and height was erratic once it entered the area of low visibility
• aircraft was seen to exit or appear from behind cloud in conditions of low visibility, reducing the available visual cues and likelihood of a reliable horizon.

The conditions that confronted the pilot of PXD are not alone in contributing to the development of spatial disorientation. All pilots are at risk given certain conditions. The ATSB publication Avoidable Accidents No. 4 – Accidents involving Visual Flight Rules pilots in Instrument Meteorological Conditions outlined that ‘disorientation can affect any pilot, no matter what their level of experience.’

As indicated previously (see the section titled Related occurrences), a pilot’s chances of avoiding and/or exiting disorienting conditions increase if they request the assistance of air traffic control. However, in reality the difficulties of identifying the risk faced in conditions of decreased visual cues, combined with what will likely be increased workload and stress, can often preclude a pilot considering this as an option. It is well-established that the likelihood of a loss of control when experiencing spatial disorientation remains very high.

The ATSB found that due to the presence of low cloud, rain and reduced visibility, the pilot of PXD likely experienced a loss of visual cues and became spatially disorientated, leading to a loss of control and impact with the water.

Findings

From the evidence available, the following findings are made with respect to the collision with water involving a Piper Aircraft Corp PA-28-235, registered VH‑PXD, 33 km south-south-east of Avalon Airport, Victoria on 29 January 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• Continuation of the flight towards an area of low cloud and rain was likely influenced by the inherent challenges of assessing low visibility conditions, particularly without instrument flying proficiency.
• Upon entering an area of low cloud, rain and reduced visibility, the pilot likely experienced a loss of visual cues and became spatially disorientated, leading to a loss of control and impact with the water.

Other findings

• During their pre-flight preparations, the occupants' understanding of improving weather conditions at Moorabbin Airport, potentially reinforced by with the successful departure/arrival of other aircraft at the airport, contributed to their decision to depart.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• a number of witnesses
• Airservices Australia
• the Bureau of Meteorology
• the Civil Aviation Safety Authority
• Victoria Police and Coroner’s office.

References

ATSB 2011, Avoidable Accidents No. 4 Accidents involving pilots in Instrument Meteorological Conditions, Aviation Research and Analysis publication AR-2011-050.

Benson, AJ 1999, ‘Spatial disorientation – general aspects’, in J Ernsting, AN Nicholson & DJ Rainford (Eds.), Operational Aviation Medicine (3rd ed.), Oxford, England, Butterworth Heinemann, pp. 419-436.

Gawron, V 2004, ‘Psychological factors’, in FH Previc & WR Ercoline (Eds.) Spatial disorientation in aviation, Lexington MA, American Institute of Aeronautics and Astronautics, Inc, pp. 145-195.

Gibb, R, Gray, R and Scharff, L 2010, Aviation Visual Perception: Research, Misperceptions and Mishaps, Ashgate Publishing Limited, Surrey, United Kingdom.

Newman, DG, 2007, An overview of spatial disorientation as a factor in aviation accidents and incidents, Australian Transport Safety Bureau, Aviation Research and Analysis Report B2007/0063.

NTSB 2005, Risk Factors Association with Weather-Related General Aviation Accidents, National Transportation Safety Board Safety Study NTSB/SS-05/01, Washington DC, United States.

Wiegmann, D and Goh, J 2000, Visual Flight Rules (VFR) Flight into Adverse Weather: An Empirical Investigation of Factors Affecting Pilot Decision Making, Federal Aviation Administration research DTFA 00-G-010, Illinois, United States.

Wiggins, M and O’Hare, D 2003, Weatherwise: Evaluation of a cue-based training approach for the recognition of deteriorating weather conditions during flight, The Journal of Human Factors and Ergonomics Society, pp.337-345.

Wiggins, M and O’Hare, D 1995, Expertise in Aeronautical Weather-Related Decision Making: A Cross-Sectional Analysis of General Aviation Pilots, Journal of Experimental Psychology: Applied Vol. 1 No. 4, pp. 305-320.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority.

Submissions were received from the Civil Aviation Safety Authority. The submissions were received and where considered appropriate, the text of report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened 

On 1 September 2015, a Cessna 180C aircraft, registered VH-FDH (FDH), departed Normanton for Karumba Airport, Queensland at about 1435 Eastern Standard Time (EST). The pilot and two passengers were on board for the private flight. The aircraft had a tail wheel landing gear and the landing technique planned to be used was a wheel landing (see Landing techniques below).

At Normanton, the aircraft was refuelled and departed at almost maximum take-off weight. The aircraft climbed to about 1,000 feet for the short distance to Karumba (about 20 NM). On approaching Karumba, the pilot used the aircraft radio to contact another pilot who had just landed at Karumba to ascertain the weather conditions and to determine the most suitable runway for a landing. The pilot of the aircraft that just landed indicated to the pilot that the wind was directly across the runway from the north-west and either runway direction would be suitable for a landing. They decided to land on runway 21 (Figure 1) and joined the circuit on the downwind leg. On downwind, the windsock was observed and confirmed that the wind direction was directly across the runway from the north-west and the pilot estimated the wind speed to be about 10 knots.

Accident site of Cessna 180C, VH-FDH

Source: Carpentaria Shire Council

Figure 1: Map of Karumba Airport

Source: Google earth, modified by the ATSB

The aircraft was established in a stable final approach and the pilot determined that there was no crosswind correction required. The main wheels touched down firmly on the runway and the aircraft bounced about 3 to 4 feet. The pilot moved the control column forward slightly to stop the tail from touching the runway. The main wheels touched again at about the same time as the pilot noted that the nose started to move to the right (turning into wind). The pilot moved the aircraft controls to straighten the aircraft in line with the runway, but the aircraft did not respond to the correction. The tail continued to move quickly around (ground loop) ^[1] before the pilot could take any other action. The pilot was pushed up against the cockpit door. A very loud bang was heard as the left main landing gear failed, the left wing folded up and the fuselage tilted onto its side where the aircraft skidded a short distance to a stop. The aircraft stopped, almost pointing back in the opposite direction to the landing, partly on the grass beside the runway (Figure 2). The pilot turned off the engine magnetos, aircraft fuel, and electrical master switch. The two passengers exited the cockpit right door with the help of bystanders and then the pilot exited the same way. The pilot received minor injuries and the two passengers were uninjured. The aircraft was substantially damaged.

Figure 2: Cessna C180 FDH accident site

Source: Carpentaria Shire Council

Landing techniques

There are two landing techniques that can be used in tail wheel aircraft. A wheel landing is where the tail of the aircraft is held off the runway and the main wheels touch down first and then the tail wheel. The other landing technique used in a tail wheel aircraft is the three-point landing where the two main wheels and tail wheel touch the runway together.

Pilot training and tail wheel experience

The pilot had about 1,200 total flight hours with about 84 hours in tail wheel aircraft. The majority of landings in those tail wheel aircraft were three-point landings. The pilot commenced training in 2006 for a tail wheel endorsement, initially training in an Avions Mudry CAP 10, where only three-point landings were practiced. The pilot gained further training in an American Champion Super Decathlon, focussing on the wheel landing technique. During an aerobatics and formation endorsement in the Super Decathlon, the pilot revised both wheel and three-point landings. The pilot was also checked-out to fly an Aviat Aircraft Husky and a de Havilland Chipmunk, although reported only having a few hours in each. The pilot conducted a biannual flight review in March 2015 in a Cessna 172 (tricycle landing gear aircraft). The pilot had flown one other Cessna 180 and in that aircraft, had conducted three-point landings.

Of the pilots 84 hours in tail wheel aircraft, 30 were in a Cessna 180, and in the preceding 30 days, about 23 hours were in FDH.

Pilot comment

The flight was part of an air race and prior to the accident they had conducted about 20 hours of flying, departing Jandakot, and landing at Esperance, Forrest, Ayers Rock, Alice Springs, Davenport Downs, Winton, and Normanton. Of those landings, the pilot reported not being happy with any of the landings. The pilot indicated that this was the first landing in the aircraft that was conducted at almost the maximum landing weight and with a significant crosswind. All the other landings were with little to no crosswind component.

The pilot reported that the owner of FDH, who was also a pilot (medical not current), was extremely proficient at conducting wheel landings and wanted the pilot to conduct wheel landings in FDH. The pilot had conducted circuits with the owner about 2.5 weeks prior to the air race and recalled mentioning to the owner that they felt more comfortable conducting three-point landings.

The pilot reported that during the landing, they were very focused on keeping the aircraft straight with the runway and recovering from the bounce. On another landing in FDH where the aircraft had bounced about 3 to 4 feet, the pilot reported resolving the landing without going around.

Safety message

The US Federal Aviation Administration (FAA) discusses in their publication Airplane Flying Handbook Chapter 13 Transition to Tailwheel Airplanes the importance to land with the aircraft in the longitudinal axis exactly parallel to the direction the aircraft is moving along the runway. If the aircraft lands while in a crab or while drifting, it imposes severe side loads on the landing gear and imparts ground looping (swerving) tendencies. The handbook is available from the FAA website.

Aviation Short Investigations Bulletin - Issue 48

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. A ground loop is an uncontrolled turn during ground operation.