International

Safety summary

What happened

The pilot of a Cessna 208B aircraft, registered VH-FAY (FAY), was contracted by the aircraft operator to ferry FAY from Jandakot Airport, Western Australia to Mississippi, United States. On the morning of 27 September 2018 local time, the aircraft departed Saipan International Airport, Northern Mariana Islands, for a planned flight to New Chitose Airport, Hokkaido, Japan. After climbing for about an hour, the aircraft levelled off at flight level (FL) 220.

After 2 hours 20 minutes flight time, the pilot contacted Tokyo Radio flight information service at the first mandatory reporting position. The aircraft passed the next reporting point at the same altitude, 1 hour 20 minutes later, but the pilot did not contact Tokyo Radio as expected. Tokyo Radio made repeated attempts to communicate with the pilot, without success. Having received no communications from the pilot for 4.5 hours, two Japan Air Self‑Defense Force (JASDF) aircraft intercepted FAY. The pilot did not manoeuvre the aircraft in response, in accordance with international intercept protocols.

After about 30 minutes, the JASDF pilots observed FAY descend into cloud. The aircraft descended rapidly and disappeared from radar less than 2 minutes later. Within 2 hours, search and rescue personnel located the aircraft’s rear passenger door. No other aircraft parts were located and the pilot was not found.

What the ATSB found

While the aircraft was in the cruise on autopilot, the pilot almost certainly became incapacitated and did not recover. About 5 hours after the last position report, without pilot intervention to select fuel tanks, the aircraft’s engine stopped, likely due to fuel starvation. This resulted in the aircraft entering an uncontrolled descent into the ocean.

The cause of incapacitation could not be determined. While a medical event could not be ruled out, the pilot was operating alone in an unpressurised aircraft at 22,000 ft and probably using an unsuitable oxygen system, which increased the risk of experiencing hypoxia and being unable to recover.

What's been done as a result

The aircraft operator amended their operations manual to include additional guidance for international ferry flights. They also created an oxygen use guide and a specific risk assessment for positioning (ferry) flights.

Safety message

Operating unpressurised aircraft above 10,000 ft requires careful oxygen management and planning. Where an increased risk of hypoxia exists, good risk management practices should be used for flight planning. Because the effects of hypoxia can be insidious, training in recognition of early symptoms of hypoxia can increase the time available to react, descend and resolve any issues. The Flight Safety Australia (2014) article Do not go gentle: the harsh facts of hypoxia provides further information, including anecdotal experiences of hypoxia.

VH-FAY with full survey equipment installed

Source: Sid Mitchell, Aviation Spotters Online

The occurrence

What happened

The pilot of a Cessna 208B aircraft, registered VH-FAY (FAY), was contracted to ferry the aircraft from Jandakot Airport, Western Australia (WA), to Greenwood, Mississippi in the United States (US). The pilot planned to fly via the ‘North Pacific Route’ (Figure 1).

At 0146 Coordinated Universal Time (UTC)^[1] on 15 September 2018, the aircraft took off from Jandakot Airport, WA, and landed in Alice Springs, Northern Territory at 0743. After landing, the pilot advised the aircraft operator that the aircraft had a standby alternator fault indication. In response, two company licenced aircraft maintenance engineers went to Alice Springs and changed the alternator control unit, which fixed the problem.

Late the next morning, the aircraft departed Alice Springs for Weipa, Queensland, where the pilot refuelled the aircraft and stayed overnight.

On the morning of 17 September, the pilot conducted a 1-hour flight to Horn Island, Queensland. About an hour later, the aircraft departed Horn Island with the planned destination of Guam, Micronesia. While en route, the pilot sent a message to the aircraft operator advising that he would not land in Guam, but would continue another 218 km (118 NM) to Saipan, Northern Mariana Islands. At 1003, the aircraft landed at Saipan International Airport.

The next morning, the pilot refuelled the aircraft and detected damage to the propeller anti-ice boot. The aircraft was delayed for more than a week while a company engineer travelled to Saipan and replaced the anti-ice boot.

Figure 1: North Pacific Route

Source: Aircraft operator – annotated by ATSB

At 2300 UTC on 26 September, the aircraft departed Saipan, bound for New Chitose Airport, Hokkaido, Japan. Once airborne, the pilot sent a message from his Garmin device, indicating that the weather was clear and that he had an expected flight time of 9.5 hours.

About an hour after departure, the aircraft levelled out at flight level (FL) 220.^[2] Once in the cruise, the pilot sent a message that he was at 22,000 feet, had a tailwind and the weather was clear. This was followed by a message at 0010 that he was at FL 220, with a true airspeed^[3] of 167 kt and fuel flow of 288 lb/hr (163 L/hr).

At 0121, while overhead reporting point TEGOD (Figure 2), the pilot contacted Tokyo Radio flight information service^[4] on HF radio. The pilot was next due to report when the aircraft reached reporting point SAGOP, which the pilot estimated would occur at 0244. GPS recorded track showed that the aircraft passed SAGOP at 0241, but the pilot did not contact Tokyo Radio as expected. At 0249, Tokyo Radio made several attempts to communicate with the pilot on two different HF frequencies, but did not receive a response. Tokyo Radio made further attempts to contact the pilot between 0249 and 0251, and at 0341, 0351 and 0405.

Figure 2: VH-FAY GPS recorded track

Source: Aircraft operator, Google Earth – annotated by ATSB

About 4.5 hours after the pilot’s last communication, two Japan Air Self-Defense Force (JASDF) aircraft intercepted FAY. The pilot did not respond to the intercept in accordance with international intercept protocols, either by rocking the aircraft wings or turning, and the aircraft continued to track at FL 220 on its planned flight route. The JASDF pilots were unable to see into the cockpit to determine whether the pilot was in his seat or whether there was any indication that he was incapacitated. The JASDF pilots flew around FAY for about 30 minutes, until the aircraft descended into cloud.

At 0626 UTC, the aircraft’s GPS tracker stopped reporting, with the last recorded position at FL 220, about 100 km off the Japanese coast and 589 km (318 NM) short of the destination airport. Radar data showed that the aircraft descended rapidly from this point and collided with water approximately 2 minutes later. The Japanese authorities launched a search and rescue mission and, within 2 hours, searchers found the aircraft’s rear passenger door (Figure 3). The search continued until the next day, when a typhoon passed through the area and the search was suspended for two days. After resuming, the search continued until 27 October with no further parts of the aircraft found. The pilot was not located.

Figure 3: Rear passenger door

Source: Aircraft operator

__________

1. Coordinated Universal Time (UTC): the time zone used for aviation. Local time zones around the world can be expressed as positive or negative offsets from UTC.
2. Flight level (FL): An aircraft’s height above mean sea level when the pressure at sea level is 1013.2 hPa, called pressure altitude. FL 220 equates to 22,000 ft pressure altitude.
3. True airspeed (TAS): the speed of the aircraft relative to the air mass in which it is flying.
4. A flight information service is a form of air traffic service available to aircraft within a flight information region that provides information pertinent to safe and efficient conduct of flight including information on other potentially conflicting traffic.

Context

Pilot information

According to information provided by the aircraft operator, the pilot had accrued over 13,600 hours of aeronautical experience and had conducted more than 200 ferry flights for various companies. The pilot held a valid US First Class Medical Certificate issued on 19 March 2018, with the restriction of vision correction. The 66 year-old pilot was reported by acquaintances to be a non-smoker, in good health for his age, and there was no evidence of any underlying medical conditions. In the nights before FAY departed from Saipan, the pilot had reportedly not slept well, but there was insufficient evidence to determine whether he could have been experiencing a level of fatigue that would affect performance.

The pilot was a Norwegian/American dual citizen with a United States (US) Airline Transport Pilot Licence issued in January 2018. For the ferry flight, a Certificate of Validation was issued by the Civil Aviation Safety Authority (CASA) on 14 September 2018 for a Commercial Pilot Licence (Aeroplane). This included the conditions that the flight ‘must be conducted in accordance with [the aircraft operator’s] operations manual and CASA legislative requirements pertaining to the flight planned route.’ In January 2018, the pilot had ferried another Cessna 208B aircraft, VH-FHY (FHY) from Canada to Perth, WA.

Aircraft information

VH-FAY (FAY) was a Cessna Aircraft Company C208B aircraft manufactured in the US in 2001. At that time, the aircraft was issued with a Certificate of Airworthiness and an associated Airplane Flight Manual.^[5]

The aircraft was fitted with a Honeywell TPE331-12JR engine and a Hartzell Propeller Inc. HC-B4TN-5QL/LT10891NK (De-ice) propeller under a Supplemental Type Certificate (STC). Also under an STC, the aircraft had been fitted with an improved landing gear axle. This increased the maximum landing weight from 3,856 to 4,082 kg and the maximum take-off weight (MTOW) from 3,969 to 4,110 kg. Flight Manual Supplements (FMS) to the Airplane Flight Manual had been issued for each of these modifications.

FAY was fitted with a Garmin GTN 750 GPS. Among other options, the aircraft’s autopilot could be selected to ‘Altitude hold’, and lateral navigation mode could be selected to capture a GPS programmed flight plan.

The aircraft’s last Maintenance Release^[6] was issued on 7 September 2018 following completion of extensive maintenance in preparation for overseas operations. It was valid for 14 months or 230 hours. At issue, the aircraft had 9,269.8 hours total time in service and was approved in the aerial work category and for flight under the instrument flight rules (IFR).^[7]

On the morning of 27 September, prior to departure from Saipan, the aircraft had a total of 9291.7 hours in service.

Survey equipment

The aircraft was usually used for aerial survey work and had been fitted with an electromagnetic (EM) loop system under an Engineering Order^[8] (EO) and an associated FMS had been issued. The system consisted of a copper cable loop suspended around the aircraft and supported by nose, wingtip and tail stingers with a transmitter mounted in the cabin. A receiver (bird) could be towed behind the aircraft on a cable, extended and retracted using a winch. The cable, bird and its cradle, and wingtip stingers had been removed in preparation for the ferry, and the tail stinger had been shortened but was still fitted to the aircraft. EM equipment in the cabin had also been removed, except for some fixed cables.

As the equipment was fitted under an EO, the aircraft had a Special Certificate of Airworthiness (CoA) that limited aircraft operation to the restricted category, for the purpose of aerial surveying.

The FMS for the EM loop limited the aircraft to a maximum operating airspeed of 161 kt and a maximum operating altitude of 20,000 ft, however, most of the equipment had been removed from the aircraft for the ferry. The design holder of the EM loop system advised the ATSB that exceeding the altitude limit had no safety implications in that configuration.

Although the aircraft was permitted to operate in IFR conditions, flight into known icing conditions was prohibited.

Ferry fuel tank and special flight permit

An aircraft that is not operated in accordance with its Type Certificate (and approved Supplementary Type Certificates) is not permitted to operate in foreign countries without a Special Flight Permit (SFP) and the approval of all countries the aircraft flies over or into.

For the ferry, FAY had been fitted with a ferry fuel tank under an engineering order with an associated FMS. The ferry fuel tank fitment meant that the aircraft no longer met the design requirements for the aircraft. Therefore, the aircraft was required to operate under an SFP. An SFP was issued on 6 September 2018 by a person authorised by CASA to issue SFPs, but not to issue overweight approvals.

The aircraft Type Certificate Data Sheet (TCDS) stated that the aircraft was structurally satisfactory for ferry flight up to 130 per cent of the TCDS MTOW (which equates to 11,375 lb or 5,160 kg). However, without overweight approval, the aircraft was required to be operated not above the STC MTOW of 9,062 lb (4,110 kg). The ferry tank FMS stated that ‘the ferry tank may only be able to be partially filled to stay within the aircraft 9062 lbs MTOW.’

Weight and balance

The load sheet indicated that on departure from Saipan, the aircraft’s take-off weight was 4,430 kg and it was loaded within the centre of gravity and structural limits.

Journey logs

The pilot completed journey logs for each flight sector, which included a daily inspection certification, take-off, landing and flight times, and fuel information. The pilot had also recorded engine condition trend monitoring information including the exhaust gas temperature (EGT) and RPM percentage. These are depicted in Table 1.

Table 1: Trend exhaust gas temperature (EGT) and engine RPM

Source: Aircraft operator

Operating the engine at 100.2 to 100.9 per cent was within the normal continuous engine speed allowable range. The FMS for the engine specified the maximum EGT as 650 °C. The engine manufacturer advised that operating at an average EGT of 658 °C relative to 650 °C increased fuel flow by about 5 lb (2.8 L) per hour under the conditions of the accident flight. The aircraft operator’s head of airworthiness and maintenance control advised that no inspection was needed for the recorded temperature exceedances, which could be avoided if the pilot reduced RPM to 100 per cent.

The journey logs were sent to the operator each day, however they were not reviewed during the ferry flight.

Communications

Radio equipment

The aircraft was fitted with the following equipment:

• two VHF radios
• one HF radio
• a Spidertracks GPS connected via a switch on the instrument panel to a hot bus straight to the aircraft battery, so it would continue to operate in case of electrical failure
• one Artex G406-4 emergency locator transmitter fitted with a G shock and remote panel switch
• a satellite phone was installed in the aircraft, docked and with Bluetooth connection
• four personal locator beacons (MT410G) and one Kannad marine sport emergency position indicating radio beacon were on board, all of which needed to be manually activated.

The pilot had a Garmin inReach system from which he could send and receive messages, navigate and track flights and ‘if necessary, trigger an SOS to get emergency help from a 24/7 global monitoring via the 100% global Iridium® satellite network.’

Push to talk

When the company licenced aircraft maintenance engineer (LAME) arrived in Saipan, the pilot advised him that the pilot-side push-to-talk (PTT) button had only been working intermittently and reported that he had been using the co-pilot-side PTT. The LAME cleaned and tested the button, which the pilot then verified was transmitting correctly.

Recorded data

GPS data

The on-board Spidertracks and Garmin GPS devices recorded the aircraft’s position and geometric altitude at 2-minute intervals. The recorded altitude of all sectors flown from Jandakot Airport to the last recorded position is shown in Figure 4. About half of the first leg, from Jandakot to Alice Springs, was flown at FL 210 before descending to FL 130, which was also the cruise altitude on the following sector to Weipa. On the flight from Horn Island to Saipan, having conducted a climb to FL 200, the pilot then made a descent over Papua New Guinea, possibly to avoid weather near Mount Hagen, before climbing and then maintaining FL 200.

The geometric altitude for the occurrence flight from Saipan showed a gradual descent from top of climb at 23,412 ft to the last recorded position at 22,770 ft. This was consistent with the aircraft flying into reducing temperature and barometric pressure. The corresponding radar data recorded pressure altitude at intervals of about 10 seconds and showed a constant altitude at 22,000 ft AMSL.

The pilot sent several messages from the Garmin device after departing Saipan and before the aircraft reached reporting point TEGOD. The last position recorded by the Spidertracks and Garmin devices was at 0626 UTC at FL 220. The aircraft took less than 2 minutes to descend from FL 220 to the ocean and there were no GPS recorded points below that altitude.

Figure 4: Geometric altitude of all flight sectors

Source: Spidertracks analysed by ATSB

Radar and ADS-B data

Japanese air traffic services recorded mode C radar and automatic dependant surveillance broadcast (ADS-B) data from FAY. Secondary surveillance radar (SSR) returns depend on an aircraft transponder’s reply to an interrogation from the ground. In response to a mode C interrogation, the aircraft transmits an encoded return with the aircraft’s selected SSR code and pressure altitude.

Radar data recorded the aircraft’s position (in X and Y coordinates) from the ground radar site and pressure altitude (referenced to 1013 hPa and quantised to the nearest 100 ft) at approximately 10-second intervals. ADS-B data transmitted from FAY’s GPS included the aircraft’s altitude within about 25 ft.

The aircraft was recorded by radar at 22,000 ft at 0627:36 and there were five valid radar returns after that. The data showed that the aircraft descended from 22,000 to the last recorded position of about 11,500 ft in 62 seconds, with an increasing descent rate of up to 22,000 and 23,000 ft/min. That descent rate was less than the dive speed (VD)^[9] for the aircraft (250 kt calibrated airspeed), which corresponded to a vertical descent rate of about 25,300 ft/min.

Recorded audio transmissions

The ATSB obtained recorded audio of the pilot’s transmissions on HF radio to Tokyo Radio and VHF transmissions while tracking across Australia. Comparative analysis of these was carried out with the aim of determining whether the pilot was likely to have been using a nasal cannula and/or affected by hypoxia in the final transmission. Indicators of hypoxia include timing of microphone keying, voice onset time and fundamental frequency range of the pilot’s voice, but these could not be measured due to the noise in the HF channels. The pilot’s communications with Tokyo Radio at TEGOD included some hesitation and a misstated time, but the tempo of the pilot’s next transmission appeared normal and he corrected the time error. The ATSB was unable to make any conclusions based on the recorded audio.

Fuel

The aircraft was fitted with left- and right-wing tanks, which held a combined total of 1,257 L (2,225 lb) of usable fuel. The ferry tank held 924 L (1,635 lb) of usable fuel. The ferry tank was fitted under an engineering order with an associated FMS.

Based on the journey log and fuel dockets, the aircraft ferry and wing tanks were filled in Saipan on 18 September. Although the pilot had taxied the aircraft for maintenance, the fuel was likely close to full on departure. The LAME in Saipan had seen the pilot conduct a pre-flight fuel sample drain from the aircraft and check for contaminants, on the morning prior to departure.

There was no published fuel flow data for flight at FL 220, but the pilot reported an in-flight fuel consumption rate of 163 L/hr (288 lb/hr), which would have been relatively constant for the 6.4 hours in cruise. The aircraft took about 1 hour from taxi to reaching top of climb at 22,000 ft. The operations manual specified a planned fuel burn rate of 450 lb/hr in the climb and the design holder for the engineering orders estimated a taxi and climb fuel consumption of 353 lb. Given the pilot had previously started the aircraft and taxied for maintenance, an estimated fuel consumption for the taxi and climb was 400 lb. Based on these figures, the estimated total fuel used at the last recorded position was 1,241 L (2,196 lb), which was approximately the combined volume of the wing tanks.

Fuel transfer and imbalance

The fuel transfer protocol detailed in the ferry tank FMS was to conduct the take-off and climb to altitude using both aircraft main fuel tanks and, when established in the cruise, turn the left-wing tank selector to off, as fuel in the ferry tank could only be transferred to the right-wing tank. Two electric ferry tank pumps could be selected with different flow rates – 440 lb/hr (low) and 600 lb/hr (high). There was no gauge to indicate fuel quantity remaining in the ferry tank, and the pilot was required to monitor the fuel quantity of the right-wing tank to ensure fuel was transferring as planned and that fuel was not venting overboard.

The FMS specified 200 lb as the maximum permitted fuel imbalance between the left and right tanks. When more severe sideslip is maintained (due to imbalance), the unusable fuel quantity increases. In this occurrence, if the left tank selector was set to off at the top of climb and the right tank was used until empty, it was possible to have a 900 lb imbalance.

In August 1998, the Cessna Aircraft Company conducted flight tests at the request of the US National Transportation Safety Board to determine controllability of the Cessna 208B at various airspeed and lateral fuel imbalance combinations. A Cessna 208B aircraft was flown to a maximum 600 lb imbalance, at airspeeds between 70 and 120 kt at flap settings of 0° and 20°. The maximum control wheel deflection attained was about 28°, of the maximum available 55° control wheel deflection. Control deflection versus lateral imbalance curves were derived from the test. The ATSB extrapolated the data and found that for a 900 lb imbalance, at the aircraft’s likely airspeed, this equated to a control wheel deflection of +14°-17° and right aileron travel of +5-7°.

The aircraft manufacturer (now Textron Aviation) advised the ATSB that the autopilot servo was capable of driving the ailerons to the travel limits of 25° +4°/-0° up and 16° +1°/-0° down in the hangar. This indicated that if the aircraft had a fuel imbalance of 900 lb, there was adequate aileron control to maintain level flight at the aircraft’s likely airspeed, however the autopilot force required to maintain this was not assessed. Photos from the JASDF of FAY in the final 30 minutes of the flight did not show any visible aileron deflection.

Weather

During the last 30 minutes of the flight, the aircraft was observed to be situated between two layers of cloud. The weather conditions that the aircraft likely encountered at FL 220 included strong south-westerly winds averaging about 50 kt, temperature about -15 °C and moderate turbulence. Moderate icing and light rain were present in cloud.

Supplemental oxygen

Because of reduced atmospheric pressure, operation of unpressurised aircraft in Australia above 10,000 ft requires supplemental oxygen.

Flight crew oxygen requirements

Australian Civil Aviation Order (CAO) 20.4 – Provision and use of oxygen and protective breathing equipment, stated:

A flight crew member who is on flight deck duty in an unpressurised aircraft must be provided with, and continuously use, supplemental oxygen at all times during which an aircraft flies above 10 000 feet altitude.

CAO 108.26 – System specification – oxygen systems included that portable oxygen units may be used to meet the crew or passenger breathing requirements and that:

…flight crew members may use nasal cannula manufactured under the name “Oxymizer”, subject to the following conditions… (b) the flight crew members must use the nasal cannula only during private, aerial work, or charter, operations; (c) the aircraft must not operate above 18 000 feet altitude.

Further, it stated that ‘Dispensing units provided in an aircraft operating above flight level 180 must be designed to cover the nose and mouth.’

Aircraft oxygen system

The aircraft was fitted with a 13-port oxygen system with a 3.312 cubic metre (116.95 cubic foot) capacity oxygen cylinder located in the fuselage tail cone. The cylinder had been tested and maintained in accordance with requirements, was within its 15-year life limit and had been filled with aviator breathing oxygen (ABO) prior to the aircraft’s departure from Jandakot.

Oxygen from the cylinder was first reduced to 70 PSI by a pressure regulator and then by two altitude-compensating regulators located between the pressure regulator and oxygen supply lines, which automatically varied the flow of oxygen to the masks with changes in altitude. A remote shut-off valve in the overhead console was used to shut off the supply of oxygen to the system when not in use. A cylinder pressure gauge was located on the overhead console above the pilot’s (and copilot’s) seat.

A microphone-equipped Cessna mask with a vinyl plastic hose and flow indicator was stored under the pilot’s seat. It was observed to be in its packaging (unused) when the aircraft was in Saipan.

On-demand system

The pilot had a battery-operated Mountain High (MH) Pulse-Demand™ Electronic Delivery System (EDS) O2D1 (single-person) model (Figure 5). The EDS unit supplied a measured pulse of oxygen at the beginning of each inhalation and was oxygen-compensating (increasing flow with altitude). The unit had audible and illuminating flow fault and apnoea alarms. A representative from Mountain High advised that although the ceiling of the MH EDS is 25,000 ft, at 22,000 ft it is at the maximum flow rate requirement for oxygen.

Figure 5: Mountain High Pulse-Demand Electronic Delivery System O2D1

Source: Mountain High

Cannula

The pilot preferred to use a nasal cannula for oxygen delivery and he intended to use it for the ferry flight. This was consistent with the supplied oxygen mask being unused before departing Saipan, despite two previous sectors above 18,000 ft. The pilot had also sent a message on the previous sector, indicating that he was using the cannula at 19,000 ft.

The ATSB could not establish the cannula model used for the ferry, however the MH EDS manual stated ‘Use only the supplied MH EDS cannula, as other cannulas may not work properly with the EDS.’ The standard MH nasal cannula (Figure 6) differed from the Oxymizer specified in CAO 108.26, which had a reservoir that stored oxygen during the exhalation then added it to the delivery during inhalation to increase oxygenation. Mountain High advised that the risks of wearing a cannula are:

• it is ineffective if the pilot has nasal congestion, is eating, talking or mouth-breathing
• it can come away from the nose, which would also trigger the apnoea alert.

Figure 6: Mountain High nasal cannula

Source: Mountain High

In-line regulator

The EDS was required to be operated with an oxygen inlet pressure between 16 and 20 PSI, which could be achieved with an in-line regulator (Figure 7). The MH EDS manual indicated that the flow of oxygen would be unnecessarily high between 20-30 PSI. The manual also included the warning that higher pressure ‘will not only compromise the performance of the EDS, but is likely to damage the internal breathing sensor, rendering your EDS unit inoperable.’ MH advised that pressures above 30 PSI would cause the valve to open up and result in the EDS working like a constant flow system. In this situation, the apnoea alert would sound out constantly until the oxygen supply was nearly depleted.

The pilot did not have an in-line regulator for the flight. At altitudes above 17,000 ft, the aircraft’s system provided oxygen at 21.55 ± 2.5 PSI, which was higher than the EDS inlet pressure range. At 20,000 ft, this increased 24.45 ± 2.5 PSI. There was no data for the output pressure at 22,000 ft.

Figure 7: In-line regulator to connect EDS to aircraft oxygen outlet

Source: Mountain High

Mountain High aluminium cylinders

In his briefing before the aircraft departed Jandakot, the chief pilot understood that the pilot intended to plug his EDS directly into the aircraft system without an in-line regulator and was concerned about its effectiveness. Therefore, to ensure the pilot had an independent oxygen supply, the operator provided two MH aluminium (AL682) cylinders fitted with MH regulators, each of which had a maximum volume of 0.68 cubic metres (24.1 cubic feet) and a ‘typical volume’ of 0.63 cubic metres (22.1 cubic feet). The cylinders were filled with ABO and secured behind the copilot’s seat, which the pilot could reach if he slid his seat backwards.

Flight above FL 180

The MH EDS manual advised that pilots operating above 18,000 ft should have a supplementary oxygen cylinder gauge and an emergency backup oxygen system. The manual also provided full cylinder duration figures up to its ceiling of 25,000 ft and cylinder duration graphs from which to calculate usable oxygen for altitudes up to 18,000 ft.

The FAA pilot safety brochure Oxygen equipment: Use in General Aviation Operations stated that the use of cannulas was restricted by US Federal Aviation Regulations to 18,000 ft ‘because of the risk of reducing oxygen-blood saturation levels if one breathes through the mouth or talks too much.’

The aircraft operator’s operations manual approved the use of the MH EDS O2D2 and MH standard aviation nasal cannula up to FL 180, above which pilots were required to use a constant flow mask.

Pulse oximeter

To aid in identifying the symptoms of hypoxia, the pilot had a pulse oximeter, which showed blood oxygen saturation levels based on reading from the finger. On a previous flight the pilot was observed only to use the oximeter intermittently.

The US Federal Aviation Administration (FAA) cautions against relying on pulse oximeters as the sole indicator of hypoxia because by the time the oxygen saturation levels fall, it may result in a level of hypoxia sufficient to cause impairment. Further, the haemoglobin oxygen saturation in blood passing through the finger may not reflect oxygen available to the brain.

Pilot’s oxygen usage

An oxygen management plan from the pilot was not provided to the operator, however there were three sources of oxygen available to the pilot – the aircraft oxygen system and two aluminium cylinders, which were all filled prior to departure from Jandakot. It was not known which source the pilot used and when, but only one cylinder remained behind the copilot’s seat prior to the aircraft departing Saipan. This suggests the pilot had used one cylinder during the flights to Saipan. The pilot had not refilled the aircraft or portable oxygen cylinders since commencing the ferry.

The ATSB estimated whether the pilot had sufficient oxygen to complete the sector. This was based on the time at various altitudes flown for all sectors up to the last recorded aircraft position, and the expected endurance of the available oxygen, filled to typical pressures, according to the manufacturer’s documentation. The estimation was also based on using the available equipment as follows:

• oxygen was used at all altitudes above 10,000 ft
• the nasal cannula was used with the MH cylinders at all flight levels
• the aircraft system was used with a mask or cannula, with or without the EDS.

The pilot’s actual equipment usage may have varied from these assumptions and it is acknowledged that oxygen usage can vary significantly between individuals, especially with on‑demand systems. However, it represented realistic usage scenarios and approximate endurance for the available oxygen. Even when conditions of highest usage were considered, there should have been several hours of oxygen remaining at the completion of the sector to Japan.

Hypoxia

Hypoxia is the absence of an adequate supply of oxygen to the tissues. Hypobaric hypoxia is the most common form in aviation and is associated with breathing air at low barometric pressure. A deficiency in alveolar oxygen exchange due to low oxygen tension (partial pressure) of inspired air leads to inadequate oxygen supply to the blood and reduced oxygen available to the tissues.

Hypoxia can be prevented by pressurising the aircraft cabin or by breathing supplemental oxygen. However, hypoxia can still occur in unpressurised aircraft if, for example, the supply equipment fails and/or does not provide an adequate concentration of oxygen or if the supply is not managed appropriately. In an aviation context, acute hypobaric hypoxia is the ‘most serious single physiological hazard during flight at altitude.’ ^[10]

Signs and symptoms of hypobaric hypoxia include:

• darkening and restriction of the visual field and loss of peripheral vision
• increased heart rate, hyperventilation and light-headedness
• syncope (fainting/unconsciousness, pallor, sweating, nausea and vomiting)
• cyanosis (bluish colouration of the skin, nail beds and mucous membranes)
• impairment of mental performance and neuromuscular control, slowed reaction time
• muscular spasms.

From 15,000 to 20,000 ft ‘there is a loss of critical judgment and willpower…the subject is usually unaware of any deterioration in performance or indeed of the presence of hypoxia; it is this that makes the condition such a potentially dangerous hazard in aviation.’ Above 20,000 ft these symptoms and signs become more pronounced. Involuntary jerks of the arms, loss of consciousness and convulsions occur, and after several minutes, death.

Physical activity, cold, illness and certain drugs increase the onset speed and severity of hypoxia.

US FAA Advisory Circular AC_61-107B Aircraft operations at altitudes above 25,000 feet mean sea level or Mach numbers greater than .75 indicated that while the signs of hypoxia can be detected in an individual by an observer, signs are not a very effective tool for hypoxic individuals to use to recognize hypoxia in themselves. The circular carried the following warning:

A common misconception among pilots is that it is easy to recognize the symptoms of hypoxia and to take corrective action before becoming seriously impaired. While this concept may be appealing in theory, it is both misleading and dangerous for crewmembers.

The Skybrary Operator’s Guide to Human Factors in Aviation Briefing Note defined the fourth, or critical stage of hypoxia as above 18,000 ft. It stated:

Above this altitude, complete incapacitation can occur with little or no warning. All senses fail, and a pilot will become unconscious within a very short period of time. No stimuli such as the radio will be able to help a pilot suffering from hypoxia, especially [rapid onset] fulminant hypoxia, above 5,500 meters (18,000 feet).

A less common form of hypoxia in an aviation context is anaemic hypoxia, caused by carbon monoxide poisoning. This is most commonly associated with piston engine aircraft, in drawing air for cabin heating over a damaged or defective exhaust system. Turbine engines produce up to two orders of magnitude lower carbon monoxide emissions than piston engines and utilise compressor bleed air as opposed to an exhaust heat exchanger. In addition, in 1984, the US National Transportation Safety Board investigated the possible effect of engine oil bleed air contamination on pilot incapacitation, from Garrett TPE 331 engines. It was concluded that such contamination was not likely to occur.

Time of useful consciousness

The FAA circular referenced above (AC_61-107B) defined the time of useful consciousness (TUC) as ‘the period of time from interruption of the oxygen supply, or exposure to an oxygen-poor environment, to the time when an individual is no longer capable of taking proper corrective and protective action.’ There are significant variations in TUC between individuals, and it does not mean that everyone will be capable of performing complex tasks in a challenging environment for the duration.

The circular included a graph showing decreasing TUC with increasing altitude (Figure 8). At 22,000 ft, the TUC was 10 minutes, or 5-6 minutes following rapid decompression. However, it goes on to caution that slow decompression is as dangerous as, or more dangerous than, a rapid decompression, as the resultant hypoxia may be unrecognized by the pilot. The circular also carried the warning: ‘The TUC does not mean the onset of unconsciousness. Impaired performance may be immediate.’

Figure 8: Times of useful consciousness versus altitude

Source: FAA AC 61-107B

Pilot exposure and training for high altitude flying

There was evidence from previous flights that the pilot had some exposure to operating at higher altitudes. The pilot also held a valid US type rating for a Bombardier Challenger aircraft which had a service ceiling above FL 250. Under US Code of Federal Regulations Part 61.31 (g), this required completion of ground theory training including the effects, symptoms and causes of hypoxia and any other high-altitude sickness. The pilot had completed theoretical hypoxia awareness training and reported being aware of his own initial signs of hypoxia.

Altitude-induced decompression sickness

Flying unpressurised aircraft above 18,000 ft can not only induce hypoxia, but also result in altitude-induced decompression sickness (DCS). This is the formation of nitrogen bubbles in different areas of the body due to exposure to reduced barometric pressure. According to the FAA pilot safety brochure on decompression sickness, in most cases of DCS, the bubbles form in the joints, but in 10-15 per cent of cases, neurological manifestations occur. These can include similar symptoms to hypoxia such as confusion, seizures and unconsciousness.

While most cases occur at or above 25,000 ft, the risk of DCS increases with exposure to altitudes above 18,000 ft.

Oversight of the ferry flight

The aircraft operator’s Air Operator Certificate (AOC) was for aerial work and as such, it was not a regulatory requirement to have a formal safety management system. Despite this, the aircraft operator had implemented a health, safety and environmental operating management system (HSE-OMS) that applied to their aviation activities, most of which were low-level survey operations.

FAY was routinely ferried to new surveying locations with its specialised equipment installed. Although ferry flights were classed as private operations, they were normally carried out by company pilots, operating under the AOC. The flights were conducted in accordance with the standard operating procedures and the chief pilot was responsible for operational matters affecting the safety of flying operations. However, following the successful ferry of FHY from Canada to Western Australia by the contract pilot 6 months earlier, the operator elected to re‑engage the contract pilot to ferry FAY to the US.

Risk assessment for the ferry flight

The operator initially conducted a gap analysis to identify any changes that had occurred since the ferry of FHY. It identified several actions, including the need to audit the pilot’s qualifications, conduct a familiarisation flight and briefing on the aircraft and fitments, and for flight monitoring by company staff.

At the planning stage of the FAY ferry, the primary concerns of the operator were around managing:

• long sectors over water – fatigue, lack of alternate landing areas and distance from search and rescue assistance
• single-pilot operation – the operator required their own ferry flights to be conducted with two crewmembers, but the contracted ferry pilot preferred to operate alone

routing – including consideration of security in countries to be overflown.

In accordance with the HSE-OMS, the operator then conducted a risk assessment for the ferry flight. The operator’s risk matrix guidelines included:

The Risk Matrix must be used with good judgment, applying the following recommendations:

- Make use of the experience of several people, with a broad range of experience and backgrounds.

- Within the defined context, the relevant hazards should be identified and documented in the hazard libraries.

- For an identified hazard, the potential consequences (severity) are determined first. A hazard can have a consequence in several categories…

- Risk must be assessed in the context of an activity as hazards manifest themselves differently in different environments or conditions…

The aviation manager reported that he had done the risk assessment based on what the company had experienced in previous ferries and general risk assessment from their operations. The quality assurance manager and flight operations administrator were involved in the assessment process. He also obtained input from the company’s aviation specialist in Canada, who had been involved with the risk assessment for the previous ferry (of FHY). The assessment report was then provided through to their HSE manager.

The HSE manager commented that normally they would get flight operations personnel involved; he, the chief pilot, the aviation manager, a ferry pilot, and a couple of other pilots would form a team. However, the HSE manager had been on vacation during the ferry risk assessment and had not been involved in the process.

The risk assessment identified 32 hazards including one relating to hypoxia:

Unconscious pilot due to oxygen starvation [resulting in] uncontrolled flight into terrain.

It was initially rated as moderate and assessed as unlikely to occur. The nominated control to reduce risk was that there was an oxygen system fitted to the aircraft, with no resultant change to the risk rating (or likelihood). Consideration of specific operational or technical factors that could contribute to hypoxia were not included in the risk assessment. Nor was any form of pilot incapacitation other than hypoxia.

Nearly half of the identified hazards nominated the pilot’s experience (having conducted over 200 ferry flights, including multiple recent Pacific crossings) as one of, or the only risk control. The assessment did not detail whether the pilot had considered the hazards or associated risks, or how he proposed to mitigate them. However, the day before FAY departed Jandakot, the ferry pilot reviewed the risk assessment in conjunction with the operator and suggested additional risks, including road transport, ‘poor decision making due client pressure,’ and access to food and medical support. The chief pilot and a senior company pilot later outlined to the ATSB that they assessed the pilot as being ‘quite organised and competent’, albeit with a clear preference for doing things his own way.

Aircraft operator and pilot agreement

The contract between the pilot and aircraft operator for the ferry detailed the responsibilities of each party, and stipulated how the aircraft was to be operated, including the requirement to adhere to standard operating procedures as specified in the operations manual.

The ‘International Operations’ section of the operations manual included requirements for approvals, permits and documentation associated with travelling to foreign countries as well as flight planning, flight following and emergency equipment. In the agreement between the aircraft operator and the contract pilot, most of these responsibilities had been assigned to the pilot to manage. Of significance, the section stated that ‘In general, the Chief Pilot will manage an overseas operation. Close liaison between the aircrew and the Chief Pilot or their delegate is essential.’

The chief pilot had commenced with the operator on 28 August 2018, two weeks before FAY departed Jandakot on the ferry flight. The chief pilot had previously conducted ferry flights for a different operator, but was inexperienced on the C208 aircraft type. Additionally, because the ferry was assigned to a contract pilot, the chief pilot reported having been informed that he was not required to have involvement in the conduct of the operation, other than briefing the ferry pilot prior to departure.

Along with the risks inherent to the type of operation, the aircraft operator had considered the additional threats posed by financial incentive to complete the ferry as expeditiously and cost-effectively as possible. To this end, the contract included that the pilot would be paid for any days delayed on the ground to reduce pressure to continue the flight in adverse conditions. The pilot was responsible for fuel, oil and other en-route costs such as accommodation and food.

Pre-flight briefing and familiarisation flight

The day before the ferry flight departed from Jandakot, the pilot completed an aircraft familiarisation flight with a senior company pilot experienced in ferry flights, and a briefing with the chief pilot. The familiarisation flight focused on aircraft handling and use of the ferry tank fuel. The chief pilot’s briefing was primarily about the aircraft’s minimum equipment list and safety equipment. These measures had been identified in the gap analysis but not included in the risk assessment.

When the chief pilot briefed the ferry pilot, he was concerned about the pilot’s intention to connect his EDS unit to the aircraft oxygen system without the requisite regulator. To address the concern, he provided the pilot with the two portable oxygen cylinders that were appropriate for use with the pilot’s equipment. The risk assessment did not include the pilot’s oxygen management plan and further risk assessment was not done to assess the effect of the additional oxygen sources.

Flight following

The gap analysis indicated that company operations staff would be responsible for flight following. As required by the contract, the pilot sent the flight plan and journey logs to the operator each day, however they were not reviewed by the operator until after the aircraft disappeared from radar. The logs showed the pilot consistently operated the aircraft engine above the exhaust gas temperature (EGT) limit of 650 °C. Additionally, on the first sector to Alice Springs, the aircraft was flown at 21,000 ft and the final sector from Saipan was at 22,000 ft. Operations staff did not contact the pilot about exceeding the 20,000 ft limit.

Flight plan

The flight plan that the aircraft operator obtained, which was submitted for the planned flight from Saipan to New Chitose Airport, showed the flight planned altitude as FL 250, total estimated elapsed time of 10 hours and 15 minutes and (fuel) endurance of 9 hours and 30 minutes. The discrepancy with the planned flight time exceeding the endurance may have been a transposition error by the pilot, however neither this, the lack of alternates, nor the planned altitude in excess of the 20,000 ft limit was identified or amended prior to departure.

The flight plan obtained by Japan Civil Aviation Bureau was sent from Honolulu at 0507 UTC on 26 September, before the aircraft departed Saipan. That flight plan had a planned cruising level of FL 220 and a total estimated elapsed time of 8 hours and 53 minutes.

Summary of operational oversight

The aircraft operator had processes in place to identify and manage the risks associated with the ferry flight. This included conducting a gap analysis and risk assessment, familiarisation flight and pre-flight briefing, which identified the potential issue with pilot’s intended use of the oxygen system.

The operator also relied on the pilot’s extensive ferry experience to bring level of safety to the ferry flight. However, many of the risk controls relied solely on the pilot’s experience and did not provide any detail on the steps the pilot had taken to manage those risks. The flight also took place outside of the company’s standard procedures and without the normal level of oversight from operations personnel, both of which could have provided an additional opportunity to identify and manage the hazards associated with the ferry flight.

Previous occurrences

ATSB research publication Pilot Incapacitation – Analysis of medical conditions affecting pilots involved in accidents and incidents (2007), reviewed occurrences recorded by the ATSB from 1 January 1975 to 31 March 2006. It identified three cases of hypoxia, which was 3 per cent of the medical/incapacitation events. One of those was a Beech Super King Air aircraft (VH-SKC) near Burketown, Queensland on 4 September 2000. The ATSB investigation report (200003771) assessed that the incapacitation of the pilot and seven passengers was probably due to hypobaric hypoxia due to operating at high cabin altitude and not receiving supplemental oxygen. The report also identified that all the fatal accidents where medical conditions or incapacitation occurred were single-pilot operations where there was no second pilot on board who could assume control of the aircraft and prevent an accident.

The ATSB investigated an incapacitation event involving a Raytheon Aircraft Super King Air 200, VH-OYA, which occurred on 21 June 1999 (199902928). As the aircraft climbed through 10,400 ft, the pilot inadvertently selected the ‘bleed air off’, which prevented the aircraft from pressurising. As the aircraft reached the planned cruising altitude of FL 250, the aircraft deviated from the assigned track and the pilot was observed repeatedly attempting to program the GPS. Shortly afterwards, the pilot lost consciousness. The passenger in the co‑pilot seat took control of the aircraft and conducted an emergency descent, during which the pilot regained consciousness. The investigation findings included that hypobaric training did not provide an effective defence to ensure the pilot (or passengers) would identify the onset of hypoxia.

ATSB investigation AO-2014-134: Flight crew incapacitation involving a Reims F406, VH-EYQ near Emerald Airport, Qld on 1 August 2014. The pilot and navigator were planning to conduct a survey operation at FL 240. The aircraft was unpressurised but fitted with an oxygen system. Having selected the oxygen supply on and donned oxygen masks, passing about FL 180, the pilot noticed the blood saturation level reporting on his oxygen pulse meter was 77 per cent instead of above 90 per cent. In a hypoxic state, the pilot worked to rectify a problem with his oxygen system connection with assistance from the navigator and air traffic control. In this case, the pilot subsequently commented that his hypoxia awareness training had aided his appreciation of his symptoms and effects of hypoxia.

On 23 September 2012, a Metro 3 aircraft, VH-SEF, failed to pressurise on climb (ATSB investigation AO-2012-127). Passing FL 140, the captain started to feel the effects of hypoxia, donned an oxygen mask, and the first officer took over flying the aircraft and conducted an emergency descent to 10,000 ft.

__________

5. The Airplane Flight Manual (AFM) is produced by the aircraft manufacturer and contains detailed information about operation of the aircraft.
6. Maintenance release: an official document, issued by an authorised person as described in Regulations, which is required to be carried on an aircraft as an ongoing record of its time in service (TIS) and airworthiness status. Subject to conditions, a maintenance release is valid for a set period, nominally 100 hours TIS or 12 months from issue.
7. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR). Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
8. CASA defines an engineering order as the implementing document for a repair or modification and it contains all necessary instructions and references to carry out the task.
9. An aircraft must be designed to be capable of diving to the design dive speed (VD) without flutter, control reversal or buffeting.
10. Gradwell DP, Rainford DJ 2006, Ernsting’s aviation medicine, Edward Arnold (Publishers) Ltd London, Chapter 3.

Safety analysis

Introduction

After departing Saipan and climbing for about an hour, the aircraft levelled off at flight level (FL) 220. An hour later, the pilot made a mandatory position report on HF radio and then no subsequent communications. About 5 hours after the position report, while maintaining FL 220 and the flight planned route, the aircraft descended to the ocean. No wreckage other than a part of the aircraft door was recovered and the pilot was not found, limiting the evidence available.

The analysis will consider reasons for the pilot’s lack of any further communication and the aircraft’s subsequent descent. The investigation identified some operational factors that increased the pilot’s risk of experiencing hypoxia. These factors are explored in detail below.

Pilot incapacitation

The absence of any communication by the pilot after reporting at position TEGOD was almost certainly a result of pilot incapacitation. He did not make any further mandatory position reports, or respond to repeated attempts by Tokyo Radio to communicate on HF radio. The pilot had several alternative means of communication available in case of HF radio failure or failure of the aircraft’s electrical system. He would have been able to communicate using one of those means if not incapacitated, as demonstrated by having successfully sent messages from his standalone Garmin device prior to reaching TEGOD.

Additionally, the pilot did not respond in accordance with international intercept protocols, either by rocking the aircraft wings or turning, when intercepted by two Japan Air Self-Defence Force (JASDF) aircraft. The JASDF pilots were unable to see into the cockpit to confirm whether the pilot of VH-FAY was visibly incapacitated.

No evidence was available from which to determine the cause of incapacitation. The two most likely mechanisms for incapacitation were due to the pilot experiencing a medical event or hypoxia. Although the pilot had a valid medical certificate and was reportedly in good health, a medical event could not be ruled out. Similarly, the pilot’s last communications with Tokyo Radio were not of adequate sound quality to determine whether the pilot was affected by hypoxia at that time. In any case, there was ample time after TEGOD for the pilot to experience hypoxia and be unable to recover at the cruise altitude, before the aircraft reached the next reporting point.

With the pilot incapacitated, the aircraft continued on autopilot. The aircraft’s track and altitude were consistent with the flight director selected to hold flight level (FL) 220 and to follow the GPS programmed track.

Fuel starvation and uncontrolled descent

About 5 hours after the pilot’s last transmission, the JASDF aircraft radar showed FAY start to descend at an increasing rate, which was indicative of engine power loss. In the absence of pilot intervention, the power loss would have resulted from either engine failure or fuel starvation. An engine failure could not be ruled out, however this would had to have occurred in addition to pilot incapacitation, and the likelihood of both these events occurring in the same flight was considered to be low. The engine power loss was therefore considered more likely to have resulted from fuel starvation.

The estimated fuel used at the commencement of the descent was significantly less than the total fuel carried. However, as the pilot almost certainly became incapacitated relatively early in the flight, he would therefore not have been able to manually alter the fuel state after that point. It was possible to have starved the engine of fuel around the descent point by switching to the right tank and using some or all of the ferry tank (and venting some). However, this would have resulted in a fuel imbalance that was not evident in photos of the aircraft taken shortly before its descent. Given that the estimated fuel used was approximately equal to the usable fuel in the wing tanks, it was more likely that the wing tanks were selected for the duration and this usable fuel was exhausted, leaving the ferry tank full.

The aircraft’s last computed descent rate was below the dive speed for the aircraft, and was therefore indicative of an uncontrolled descent, rather than an in-flight breakup. There was no recorded data of the aircraft’s collision with the water, however the descent profile and wreckage indicated that the collision with water was not survivable.

Increased risk of experiencing hypoxia

In exploring the potential reasons for pilot incapacitation, there were several operational factors identified that increased the pilot’s risk of experiencing hypoxia and being unable to recover.

The pilot elected to fly solo at FL 220 where, without adequate oxygen supply, the time of useful consciousness (TUC) was in the order of 5-6 minutes. This was limited compared to FL 180, for example, where the TUC was two to three times longer.

The pilot had undertaken a hypoxia awareness course and reportedly knew the initial symptoms that presented in himself, which would aid in identifying and mitigating against the risk of hypoxia. However, particularly above FL 180, impairment and incapacitation can occur quickly, with little or no warning, rendering a person unable to take action to recover. The pilot also had a pulse oximeter to monitor blood oxygen saturation, but had been observed on a previous flight to use it intermittently rather than continuously. Given the limited TUC, had the pilot followed a similar regime on this flight, it may have resulted in insufficient time to alert the pilot to decreasing saturation levels. The pilot elected not to have a second pilot on board, as offered by the operator, which would have provided an additional risk control in assisting to identify the signs of hypoxia in each other and enable recovery action, as illustrated by previous occurrences. This would be especially pertinent at altitudes where there is limited TUC.

There was adequate oxygen on board for the flight, however the pilot was probably using a nasal cannula connected to the pilot’s electronic pulse-demand system (EDS) at all flight levels, as indicated by the fact that the Cessna mask was unused by the time the aircraft was in Saipan, despite having flown above FL180. This increased the risk of reduced oxygen-blood saturation levels.

The pilot had also indicated his intention to connect the EDS to the aircraft system without the in-line regulator that was required to ensure the EDS operated within its limits. At FL 220, this had the potential for the pilot to receive inadequate oxygen supply or for the EDS to be rendered inoperative, resulting in higher oxygen consumption than anticipated. However, it is noted that the pilot had the Cessna mask available which, if used with the aircraft system, would have mitigated this risk.

Findings

From the evidence available, the following findings are made with respect to the uncontrolled flight into water involving a Cessna Aircraft Company 208B, registered VH-FAY, that occurred 260 km north-east of Narita International Airport, Japan, on 27 September 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• During the cruise between Saipan and New Chitose, the pilot very likely became incapacitated and could no longer operate the aircraft.
• The aircraft’s engine most likely stopped due to fuel starvation from pilot inaction, which resulted in the aircraft entering an uncontrolled descent into the ocean.

Other factors that increased risk

• The pilot was operating alone in the unpressurised aircraft at 22,000 ft and probably not using the oxygen system appropriately, which increased the risk of experiencing hypoxia and being unable to recover.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Aircraft operator

As a result of this occurrence, the aircraft operator has advised the ATSB that they are taking the following safety actions:

Risk assessment and standard procedures

The aircraft operator reviewed their risk assessment processes and the standard operating procedures for conduct of ferry flights. As a result, they amended the guidance for international ferry operations in their operations manual including: maximum sector length, fuel planning, mandating two-crew operations, oxygen planning, management and training, operating altitude limitations, and use of contract pilots.

Oxygen use guide

The aircraft operator also created an oxygen use guide and a specific risk assessment for positioning (ferry) flights.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Aircraft operator and maintainer
• Aircraft engineer and design holder
• Japan Transport Safety Board
• Civil Aviation Safety Authority
• Bureau of Meteorology
• Honeywell
• Textron Aviation
• United States National Transportation Safety Board.

References

Campbell RD, Bagshaw M 2002, Human performance and limitations in aviation, Blackwell Science Ltd.

Gradwell DP, Rainford DJ 2006, Ernsting’s aviation medicine, Edward Arnold (Publishers) Ltd London, Chapter 3.

Newman, DG 2004, Flying fast jets: Human factors and performance limitations, CRC Pres LLC.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the aircraft operator, aircraft maintainer, aircraft insurance assessor, Civil Aviation Safety Authority, Japan Transport Safety Board, US National Transportation Safety Board, Textron Aviation, Honeywell, Thomson Design and Mountain High.

Submissions were received from the Japan Transport Safety Board, Honeywell, aircraft insurance assessor, aircraft operator, Thomson Design and Mountain High. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 19 July 2018, a Quest Kodiak 100 aircraft registered P2-NTZ experienced a nose wheel collapse during landing at Mibu Airstrip, Raicoast District, Padang Province, Papua New Guinea. The Papua New Guinea Accident Investigation Commission (AIC) is conducting an investigation into this occurrence.

As part of its investigation, the AIC requested technical assistance from the ATSB. The ATSB was asked to examine the fractured nose wheel fork to determine the failure mode and if there were any pre-existing defects. To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.

The ATSB completed the component examination and found that the assembly fractured as a result of overstress with no evidence of pre-existing defect.

The PNG Accident Investigation Commission is responsible for and will administer the release of the final investigation report into this accident. Further information regarding the occurrence can be found at www.aic.gov.pg or specific enquiries should directed to infor@aic.gov.pg.

__________
The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.

The Australian Transport Safety Bureau was an accredited representative to assist the South African Civil Aviation Authority (SACAA) for their investigation of a General Dynamics Convair 340, registered ZS-BRV, which collided with a building near Wonderboom Airport, South Africa, on 10 July 2018.

During the initial climb, smoke was observed emanating from the left engine. The aircraft subsequently collided with a building. One person on board the aircraft was fatally injured and 18 people were injured. One person on the ground was fatally injured and two people sustained serious injuries.

The SACAA’s Accident and Incident Investigations Division has completed the investigation and the final report is now available. Any enquires relating to the investigation should be directed to the SACAA at: www.caa.co.za

On  4 June, 2018, about 1152 PDT (Pacific Daylight Time), a GippsAero GA10, VH-XMH, was substantially damaged following a loss of control during spin testing and subsequent impact with terrain at Mojave, California.

The crew were assessing the aircraft’s spin characteristics with a belly-mounted cargo pod installed. An attempt to deploy the spin chute to aid the spin recovery failed, resulting in the crew electing to bail out. The two crew successfully exited the aircraft and deployed their parachutes whereupon they landed safely, but suffered minor injuries. The aircraft was operating under an Australian experimental certificate and a Federal Aviation Administration (FAA) special flight authorisation.

The NTSB have released the final report into this investigation.

Any enquires relating to the investigation should be directed to the NTSB: www.ntsb.gov

On 6 August 2017, an Airbus A320, registered VH-VGY and operated by Jetstar Airways, inadvertently descended below a 2,500 ft minimum safe altitude during an arrival procedure into Christchurch, New Zealand.

As the incident occurred in New Zealand, under paragraph 5.1 of Annex 13 to the Convention on International Civil Aviation and in accordance with the New Zealand Transport Accident Investigation Commission Act 1990, the Transport Accident Investigation Commission (TAIC) commenced an investigation into the occurrence. The Australian Transport Safety Bureau (ATSB), representing the state of the operator and in accordance with paragraph 5.18 of Annex 13, provided an accredited representative to participate in the TAIC inquiry. In accordance with the Australian Transport Safety Investigation Act 2003, an ATSB investigation was commenced to support the TAIC inquiry.

The ATSB has finalised its support of this investigation. The TAIC is responsible for the release of the final investigation report into this incident. TAIC have completed the investigation and published the investigation on their website on 2 May 2019 at  AO-2017-007.

Any enquires regarding the TAIC investigation and report should, in the first instance, be directed to the:

Transport Accident Investigation Commission
Level 9, 114 The Terrace
PO Box 10323
Wellington, 6143, New Zealand

The TAIC can also be contacted via: www.taic.org.nz

___________
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003.

Safety summary

What happened

On 5 February 2018, a Boeing 757 freighter aircraft, registered VH-TCA, operated by Tasman Cargo Airlines Pty. Ltd., departed from Auckland International Airport, New Zealand for Sydney International Airport, Australia.

Passing through an altitude of 6,000 ft, the left hydraulic system quantity warning message displayed. The crew actioned the Quick Reference Handbook (QRH) checklist and obtained clearance from Air Traffic control (ATC) to level out at 8,000 ft, in a holding pattern to the north‑west of Auckland Airport.

Shortly after commencing the holding pattern, the crew received further warning messages regarding both the left and right hydraulic systems. Following the appropriate actions in the QRH checklists, the crew shut down both systems. The crew made a PAN call to ATC with a request for an immediate return to Auckland. The flaps and landing gear were extended using the alternative systems and the aircraft landed without further incident.

What the ATSB found

The ATSB identified that the dual hydraulic failure was the result of a number of sequential failures in the hydraulic system. The initial failure was a ruptured left main landing gear flex hose, which resulted in a loss of the left hydraulic system pressure. Subsequently, the power transfer unit (PTU) pressure switch did not operate as intended, following depletion of the hydraulic fluid from the left system. This resulted in overheating and failure of the right hydraulic system. The pressure switch was the subject of a 2010 non-mandatory service bulletin which, if implemented, would likely have prevented the failure of the right system.

What's been done as a result

Following the occurrence, the operator conducted preventative maintenance on the aircraft, replacing all of the main landing gear flex hoses as well as updating the PTU pressure switch to conform to the published service bulletin. In addition, the operator revised the aircraft maintenance plan to introduce improved inspections and a time‑limited life on the flex hoses.

Safety message

This occurrence highlights that although some service bulletins are not deemed to be safety critical, they can still have an impact on aircraft reliability. While operators are required to implement all airworthiness directives, the ATSB recommended that operators familiarise themselves with non-mandatory service bulletins and consider the potential impacts of delaying implementation.

Boeing recommends that operators perform periodic inspection of hose assemblies paying particular attention to the high-risk areas of the landing gear area, the engine/pylon areas and the tail/empennage area. Hose assemblies can be difficult to inspect in-situ due to access constraints and the limitations of visual inspection of the multi-layered construction of the hose. As a result, some operators have chosen to introduce a hose replacement schedule, based on flight time in service or a calendar period, in addition to periodic in-situ inspections.

Picture of the ruptured hydraulic flex hose

Source: ATSB

The occurrence

On 5 February 2018, at about 0652 Universal Coordinated Time (UTC), a Boeing 757 freighter aircraft, registered VH-TCA, operated by Tasman Cargo Airlines Pty. Ltd., departed from Auckland International Airport, New Zealand for Sydney International Airport, Australia.

Passing through an altitude of 6,000 ft, the flight crew received a left hydraulic quantity warning message. The crew actioned the Quick Reference Handbook (QRH) checklist and obtained clearance from Air Traffic control (ATC) to level out at 8,000 ft, in a holding pattern to the north‑west of Auckland Airport.

Shortly after entering the holding pattern, the left hydraulic system lost pressure as the hydraulic fluid quantity reduced to zero. The crew received a left hydraulic system pressure warning and followed the QRH checklist, which required switching off the left hydraulic engine driven pump and electric pump.

A few minutes later, the crew received a right hydraulic system, engine driven pump overheat message. In response, the crew actioned the QRH and turned off the right engine driven pump. Shortly after, the crew received a right-hand system pressure warning. The crew actioned the corresponding QRH checklist and shut down the right electric motor driven hydraulic pump, resulting in a loss of both the left and right hydraulic systems.

At about 0710, the flight crew declared a PAN^[1] and requested both an immediate return to Auckland and for emergency services to be put on standby. The crew received clearance from ATC to commence their approach to runway 23L. The flight crew extended the flaps and landing gear using the alternative systems, and the aircraft touched down at approximately 0735. The flight crew brought the aircraft to a halt at the anticipated location using the manual braking system.

There was no damage to the aircraft and no injuries sustained as a result of the occurrence.

After the occurrence, the operator conducted an examination of the aircraft and discovered that the left main landing gear (MLG) downlock actuator retract flexible (flex) hose was ruptured. No faults were detected during an operational check of the right system and the power transfer unit (PTU) (see the section titled Boeing 757 Hydraulic System). The required components were replaced as per the aircraft maintenance manual (AMM) and the aircraft was returned to service.

In March 2018, following discussion of the occurrence with the aircraft manufacturer, the operator replaced the PTU pressure switch and the right, reservoir standpipe selector valve and sent them to the switch manufacturer for further examination.

__________

1. PAN PAN: an internationally recognised radio call announcing an urgency condition, which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Context

Aircraft information

The Boeing 757 aircraft was acquired by the operator in 2013. Before being introduced onto their Air Operator’s Certificate, all maintenance records were uploaded to the maintenance management system and assessed. The audit of the maintenance records was conducted by the operator and was used to verify that all airworthiness directives and mandatory service bulletins (SBs) had been carried out by the previous operator. The records indicated that, although it was not mandated, SB 757-29-0056 (see the section titled Service bulletins) had been incorporated in 2002 to replace the flex line hoses and the PTU pressure switch.

Maintenance and inspection

The flexible hose components were maintained in accordance with the aircraft manufacturer’s requirements and were replaced on-condition^[2].

The operator conducted daily inspections on the aircraft. The daily inspection procedures outlined a number of required checks, including a visual inspection of the right and left MLG assembly to check for wear and leaks. Prior to the occurrence flight, there were no defects identified relating to the MLG assembly.

The details of the relevant components installed on the aircraft at the time of the occurrence are listed in Table 1 below.

Table 1: Components installed on VH-TCA on 5 February 2018

Boeing 757 hydraulic system

The aircraft is equipped with three independent hydraulic systems; left, right and centre. The services operated by each system, or combination of systems, are shown in Figure 1. Flight control system components are distributed so that any one hydraulic system can provide adequate aircraft controllability. An additional layer of redundancy is provided such that after a loss of the left and right hydraulic systems, the flaps, slats, landing gear and speedbrakes all have alternative mechanisms for control.

Each of the left and right systems has two pumps, an engine driven pump (EDP), which is the main system pump, and an electric motor driven pump (ACMP). The pumps are supplied with hydraulic fluid from a reservoir, pressurised by the bleed air system. Each of the reservoirs has two supply outlets: one outlet is connected to a standpipe inside the reservoir, to retain reserve fluid at the bottom of the reservoir. The second (reserve outlet) draws fluid from the bottom of the reservoir.

The left system reserve fluid is maintained for use by the power transfer unit (PTU) in the event of a left system hydraulic leak. The right reserve fluid was maintained for use by the reserve brakes in the event of a right system leak.

The ‘standpipe selector valve’ controls which outlet is used. Operation of the right ‘standpipe selector valve’ to the reserve fluid triggers the right ACMP valve to divert the hydraulic pressure to the reserve brakes only.

Power Transfer Unit

The PTU is a hydraulic motor pump which transfers hydraulic power from the right system to the left system (Figure 2). The PTU is automatically activated when the left EDP pressure is low. When activated, the PTU supplemented the left ACMP to operate the following:

• flaps and slats
• landing gear
• nose wheel steering

If the PTU fails to develop pressure in the left system (as expected following the loss of left system fluid), the pressure switch for the PTU senses the lack of system pressure and shuts down the PTU. If the pressure switch is inoperative, the right hydraulic system fluid will begin to heat, as it drives the PTU motor under a no-load condition, due to a lack of left system fluid. Eventually, the right hydraulic system fluid will heat to the point where the temperature switch in the right EDP actuates, causing the right EDP overheat light to illuminate in the flight deck.

Figure 1: The 757 hydraulic system – services controlled by each system

Source: ATSB

Figure 2: The 757 hydraulic system – power transfer unit operation

Source: ATSB

Service bulletins

The following non-mandatory service bulletins were relevant to this occurrence.

2001 – Downlock actuator hose and PTU pressure switch SB 757-29-0056

SB 757-29-0056 recommended the installation of part number (P/N) 271N6119-X downlock actuator hoses and P/N 211C223-521 PTU pressure switches following six reported incidents of dual hydraulic system loss on the Boeing 757. The sequence of events in each case was the depletion of left hydraulic system fluid through a ruptured MLG downlock hose, followed by overheating of the right system. The overheat was due to malfunction of the PTU control pressure switch that allowed the PTU to run continuously in a dry condition.

Boeing Service Letter SL 757-FTD-29-01001 was issued in March 2001 to recommend implementation of the SB at the next convenient maintenance opportunity. This SB was carried out on VH‑TCA prior to the occurrence.

Boeing noted that operators had reported some failures of the P/N 271N6119-X downlock actuator hoses since implementation of this SB.

2010 – PTU pressure switch SB 29-09-05-02

After entering service, the PTU Pressure Switch (P/N 211C223-521) experienced failures due to moisture ingression into the switch. The moisture contamination caused corrosion and leakage paths past the receptacle O-ring seal, which led to erroneous indications and eventual switch failure. The switch supplier issued SB 29-09-05-02 in 2010 to recommend replacement of the receptacle O-ring and application of sealant between the receptacle and housing. Modified switches were marked with the letter ‘C’ at the end of the serial number. The recommended action was to be performed at the next suitable planned maintenance period.

Boeing Service Letter 737-SL-29-069-C was issued to operators in May 2010. The service letter provided background information to SB 29-09-05-02 and a recommendation for either the incorporation of the design changes on an attrition basis or retrofit of the improved pressure switches to affected aircraft in the operator’s fleet. This SB had not been performed on VH‑TCA.

Component examinations

Hydraulic flex hose

The construction of the hydraulic flex hose consists of three layers; an internal rubber tube, housed in a braided metal hose^[3] and covered with a rubber sleeve (Figure 3).

The following observations were made during the analysis of the hose assembly:

• the chemical composition of the braid material fell within the required specifications
• the direction of the failed wires indicated that the braided hose failed under burst pressure
• the location of the rupture was not coincident with the maximum bend location on the hose, indicating the failure was not due to bending fatigue
• corrosion was limited to the rupture location, indicating that it was likely the wires corroded after the rupture (Figure 4)
• there was some evidence of ductile overstress on the individual wire filaments, but significant corrosion on the fracture surfaces made determination of the failure mode impossible
• no wear, cuts, abrasion or pinching on any of the layers of the hose was evident
• there was no evidence of manufacturing anomalies or kinking/twisting of the hose to indicate improper installation.

Figure 3: Hydraulic flex hose construction

Source: ATSB

Figure 4: Scanning electron microscope images of the ruptured area on the left hose

Source: Aircraft manufacturer, annotated by the ATSB

PTU pressure switch

The examination of the PTU pressure switch revealed that the electrical switch contacts were stuck in the ‘normally open’ state due to an excessive amount of contamination on and around the electrical switch button. The contamination prevented the switch from returning to the ‘normally closed’ (unpressurised) condition. The visual appearance of the contamination was consistent with corrosion, as identified in the 2010 SB (SB 29-09-05-02).

Visual examination revealed a large amount foreign object debris (FOD) throughout the entire unit. Indications were that the FOD entered the unit past the O-ring seal between the receptacle and the unit housing (Figure 5).

Standpipe valve selector

The right reservoir standpipe selector valve was tested and found to be leaking, but functional. The teardown analysis revealed that the electrical connector was corroded, there was damage to the rotor valve and all seals were worn.

Figure 5: PTU pressure switch installed on VH-TCA

Source:  Switch manufacturer, annotated by the ATSB

Related occurrences

In addition to the failures discussed under SB 757-29-0056, Boeing has received reports of four hydraulic hose failures over the past five years. The root cause of each of these failures was not determined, however Boeing identified that they have previously seen hose failure due to high cycle fatigue, physical damage as a result of improper installation and corrosion of the metal braids.

VH-TCA, 1 February 2018

At about 2000 Australian Eastern daylight‑saving Time (UTC + 11 hours), on 1 February 2018, VH-TCA was on approach into Sydney, Australia. As the flight crew extended the landing gear, they received a ‘gear disagree’ and observed that the light for extension of the right MLG did not illuminate. The crew communicated with ATC and conducted a go-around. On the second approach, the flight crew followed the QRH and extended the gear using the alternate system. The main landing gear extended successfully and the aircraft landed without further incident.

An engineering inspection revealed that the right MLG, downlock extend hydraulic flex hose had ruptured. The engineering team replaced the ruptured hose, tested the system in accordance with the AMM and released the aircraft back into service. Detailed examination of the right hose identified similar failure characteristics to those found on the left hydraulic flex hose associated with the 5 February 2018 occurrence.

Aircraft manufacturer’s comments

Boeing advised that the current flex hose assembly, introduced into service via the 2001 SB, is a more robust design and has helped reduce hose failures. Failures, however, do still occur.

Boeing recommends that operators perform periodic inspection of hose assemblies, paying particular attention to the high-risk areas of the landing gear area, the engine/pylon areas and the tail/empennage area. Operators are encouraged to schedule replacing the subject hoses at designated intervals, based on in-service experience. Boeing does not have any concerns with the noted failure of the subject hose nor is there any further action planned.

__________

2. Maintenance tasks (inspections/checks) used to detect potential failures, and consequently to avoid a total functional failure, are called on-condition maintenance tasks. This is because items are left in service on the condition that they continue to meet a desired physical condition and performance standards.
3. Braided metal hose is manufactured from 304 CRES (corrosion resistant stainless steel).

Safety analysis

The sequence of events leading to the dual hydraulic system failure commenced with rupture of the left main landing gear downlock actuator retract flex hose under pressure (during landing gear retraction). This resulted in the depletion of the hydraulic fluid in the left side and, subsequently, low pressure in the left system. The exact mechanism of the rupture could not be determined due to extensive corrosion on the fracture surfaces. However the hose did not exhibit any physical damage that would have made the hose more susceptible to failure.

After the crew shut down the left system, the right hydraulic system overheated due to the power transfer unit (PTU) pressure switch being stuck in the open position and the associated pump running continuously without hydraulic fluid in the left hydraulic system. These events were consistent with the failure sequence reported in the 2001 and 2010 service bulletins. The non-mandatory 2010 service bulletin to modify the susceptible PTU switch had not been actioned, which probably resulted in the failure of the pressure switch due to contamination/corrosion.

After the crew shut down the right engine driven pump (EDP), the right hydraulic system was pressurised by the right electric motor driven pump (ACMP) only. The pressure output of the ACMP is lower than the pressure output of the EDP. It is therefore likely that the right system pressure warning annunciated while there was still adequate hydraulic fluid quantity in the right system, because the ACMP output was not sufficient to meet the right hand hydraulic system requirements and simultaneously operate the PTU motor under a no-load condition.

The aircraft was leased by the operator after the publication of the non-mandatory 2010 service bulletin. The audit conducted of the aircraft maintenance records during the aircraft transfer process only pertained to mandatory service bulletins and airworthiness directives. The operator was therefore unaware of the 2010 SB on the pressure switches until discussion of this occurrence with the manufacturer. System testing of the aircraft in maintenance after the occurrence did not identify the issue with the pressure switch. This highlights that an understanding of the impact of all aircraft non-mandatory service bulletins can increase the reliability of aircraft and reduce the time spent troubleshooting maintenance issues.

The flight crew took appropriate action in response to the warning messages received. They followed each of the QRH checklists as required and completed the prescribed actions. The design of the 757 hydraulic system ensures that any one hydraulic system can independently provide adequate aircraft controllability. The QRH clearly notes the alternative mechanisms for activating critical aircraft controls should they become inoperative because of a failure in the main system. After shutting down the left and right hydraulic systems, the flight crew was able to maintain full control of the aircraft by using the alternative mechanisms to activate the critical in‑flight and landing systems. This highlights the redundancies inherent in the 757 hydraulic system design and why the service bulletins contained recommended, rather than mandatory, actions.

Given that the failure of the occurrence left hydraulic hose occurred within 5 days of a right hydraulic hose failure on the same aircraft, the ATSB considered whether the events were related. Under normal operations, the hydraulic system was designed to act as three independent systems. Despite being manufactured in the same batch, the right hose was installed five years before the left, resulting in the hoses failing at a significantly different number of flight cycles. As the hoses were installed on different sides of the aircraft and no common link could be identified as the cause of failure, it is likely that the events on 1 February and 5 February 2018 were isolated and independent.

Findings

From the evidence available, the following findings are made with respect to the hydraulic system failure involving a Boeing 757, registered VH-TCA that occurred near Auckland International Airport, New Zealand on 5 February 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• During initial climb, the left main landing gear downlock actuator retract hose ruptured, resulting in the failure of the left hydraulic system. The cause of the rupture could not be determined.
• After the loss of the left hydraulic system, corrosion inside the power transfer unit (PTU) pressure switch resulted in an overrun of the PTU system and subsequent overheat failure of the right hydraulic system.

Other findings

• Following the failure of the left and right hydraulic systems, full controllability of the aircraft was maintained through the use of alternative systems.
• No connection was found between the hydraulic hose failures that occurred on 1 February and 5 February 2018.

Safety issues and actions

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Tasman Cargo Airlines

Tasman Cargo Airlines Pty. Ltd. advised the ATSB of the following safety actions taken as a result of this occurrence:

• Nose landing gear and main landing gear hydraulic flex hoses were all replaced.
• The 2010 SB for the power transfer unit pressure switch was incorporated.
• A 6-year soft life on all main landing gear flex hoses (replacement of hoses after 6 years rather than just on condition replacement) was introduced.
• An investigation was conducted with Boeing to understand the cause of the electric motor driven pump control valve closure. As a result, Boeing made recommendations for maintenance checks and component replacements, which were incorporated by the operator.
• The crew resource management proficiency training program was updated to include a dual hydraulic failure event.
• Since this occurrence the operator has transitioned to a 767 cargo aircraft, in lieu of the 757, which has a similar hydraulic system. The operator has proposed implementation of the soft life on the flex hoses in the 767 aircraft maintenance plan and improved zonal inspections.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• flight crew
• aircraft operator
• aircraft manufacturer (Boeing)
• United States Federal Aviation Administration.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew, aircraft operator and manufacturer, the Civil Aviation Safety Authority and the United States National Transportation Safety Board.

Submissions were received from the aircraft operator and manufacturer and the flight crew. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

What happened

On 17 January 2018, at about 1700 New Zealand Daylight Time,^[1] a Boeing 737‑800, registered VH-YIR and operated by Virgin Australia Airlines (Virgin), prepared to depart Auckland, New Zealand. The aircraft was operating scheduled passenger flight VA91 to Rarotonga, Cook Islands, with two flight crew, four cabin crewmembers and 135 passengers on board. Runway 05 right was in use and the wind direction and strength was from 040° true at 25 knots gusting to 38 knots. The captain was the pilot flying (PF) and the first officer was the pilot monitoring (PM).^[2]

The flight crew prepared the take-off performance calculations and determined the take-off limit weight to be 76.7 t with an actual take-off weight of 75.0 t. The flight crew elected to use the 24,000 pound thrust rating for the reported weather conditions.

At about 1715, the PF commenced the take-off. During the take-off, the PF maintained a small amount of left aileron input for the crosswind. The aircraft accelerated to V₁^[3] and the automated V₁ announcement sounded, shortly followed by the PM making the ‘rotate’ call at the rotation speed of 149 knots. During rotation, the PF felt a slight side-to-side movement of the aircraft’s tail, which he corrected with minor rudder input, and observed some fluctuation of the airspeed. The PF did not recall the PM announcing any variation in airspeed during the rotation. Just before the aircraft became airborne, the PF noticed the nose-up attitude of the aircraft was slightly higher than the target 8° pitch angle. The PM also recognised this and called out that the pitch attitude was high. As the main wheels left the ground, the flight crew felt a bump from the rear of the aircraft.

After the initial climb, the flight crew discussed the sequence of events and concluded that their observations were most likely the result of a tailstrike. The captain handed control of the aircraft to the first officer and called the cabin supervisor to verify their suspicion. The cabin crewmembers reported that there had been a very loud noise from the rear of the aircraft during take-off.

The captain then contacted air traffic control (ATC), informed them of the suspected tailstrike, requested a runway inspection and asked for the tower’s observations of the take-off.

The flight crew elected to stop the climb at 12,000 ft. Shortly after stopping the climb, ATC confirmed that the tower had not observed any abnormalities, and the runway inspection had identified no debris or damage to the runway.

The captain then called the Virgin ground operations duty manager to report the situation and seek input on whether an overweight landing be conducted or to continue a holding pattern to burn off fuel prior to return to Auckland. Subsequently, the captain elected to return to Auckland for an overweight landing. He then updated the cabin crew and made a passenger announcement advising of the intention to return to Auckland.

The aircraft returned to the airport where an overweight landing was conducted without further incident.

After shut-down, the captain monitored the off-loading of the bags and freight. The captain found that there were 10 fewer bags in the forward compartment of the cargo hold than detailed on the load sheet.

No persons were injured and the aircraft sustained minor damage in the incident.

Engineering inspection

An engineering inspection confirmed that the aircraft had sustained a tailstrike during the take-off. The damage was limited to a scratch on the tailskid shoe that was found to be within the allowable limits. An overweight landing check was completed and the aircraft was determined to be serviceable.

Recorded flight data

Analysis of flight data from the aircraft’s digital flight data recorder indicated the rotation occurred in gusty conditions with aircraft speed reducing during rotation. The data showed:

• a reduction in airspeed of 7 knots (Figure 1), followed by a stagnation in airspeed (the groundspeed continued to increase over this period, indicating the change in airspeed was a result of the variation in headwind component, which reduced by up to 11 knots during rotation)
• at lift-off, the pitch attitude of the aircraft was 10.55°
• maximum pitch rate during the rotation was 3.5° per second
• the average pitch rate during rotation was 2.4° per second
• the aircraft was slow to lift-off the runway (6 seconds from the point of initial rotation).

Figure 1: VH-YIR take-off data

Source: ATSB

Flight crew training manual and Boeing guidelines

The operator’s 737 Flight Crew Training Manual provided the following guidance:

• With a consistent rotation technique, where the pilot uses approximately equal control forces and similar visual cues, lift-off attitude is achieved in approximately 3 to 4 seconds.
• A rotation rate of 2 to 3° per second is required to ensure adequate tail clearance is achieved on take-off.
• At flaps 5 setting, the target attitude to achieve a 51 cm tail clearance to the runway is 8°.
• Under gusty wind and strong crosswind conditions, do not rotate early or use a higher-than-normal rotation rate in an attempt to clear the ground and reduce the gust effect because this reduces the tail clearance margins (tail clearance).
• The PM makes callouts based on instrument indications or observations for the appropriate condition. The PM should monitor engine instruments and airspeed indications during the take-off roll and announce any abnormalities.

Guidelines that relate to Boeing aircraft show that the following factors contribute to reduced tail clearance:

• lateral control deflection
  • activation of flight spoilers, which reduces the amount of lift on the aircraft
• average pitch rate above 2.5° per second
• maximum pitch rate in excess of 4° per second.

Pilot’s comments

The captain stated that the runway in use had slowly rising terrain along the departure path, which created the visual illusion that the pitch attitude of the aircraft was lower than it actually was. He advised that this delayed his appreciation that the aircraft was approaching the pitch attitude where a tailstrike could occur.

The captain stated that during his initial training with the operator in 2012, a training captain had advised that he needed to increase the rotation rate on take-off. The captain advised that, because of this tail-strike, he has reduced his take-off rotation rate to ensure it is within the manufacturer’s recommended limits of 2 to 3° per second.

The captain also advised that, due to the crosswind conditions, significant control wheel input was required to keep the wings level. Even so, the aircraft became airborne with the right wing slightly lower than the left. The captain noted that in strong crosswind conditions, flight crews are required to make a quick decision on the compromise between keeping wings level and avoiding raising a spoiler, which has a corresponding loss of performance.

Operator’s comments

With respect to take-offs in strong crosswind conditions, the operator made the following comments:

• The correct technique is as described below in the Boeing Flight Crew Training Manual:

Limit control wheel input to that required to keep the wings level. Use of excessive control wheel increases spoiler deployment, which has the effect of reducing tail clearance. All of these factors provide maximum energy to accelerate through gusts while maintaining tail clearance margins at lift-off.

• In a swept wing jet aircraft additional momentary aileron input is often required after lift-off to maintain wings level until the control wheel can be neutralised and the aircraft direction controlled with rudder.
• Training on crosswind take-offs is provided to pilots during each simulator session. The simulation is frequently conducted on a 30 m runway, which is more difficult than normal operations on a 45 m runway. Both take-off and landing simulations are conducted at maximum crosswind. Check and training captains assess that the correct procedures are used for the manoeuvres.
• Crosswind technique is further reinforced during the supervised line training components of both intake and command upgrade training.

Safety analysis

Analysis of the flight data determined that, during rotation, as the aircraft continued to accelerate, a reduction in headwind resulted in an initial drop and then stagnation in airspeed until just after lift-off. The airspeed variations were reportedly not identified and called out by the PM, as required in the flight crew training manual. Stagnation in airspeed at rotation had a similar effect to that of rotating too early: reduced lift and an extended the take-off roll, as confirmed by the flight data. The continued rotation with the main landing gear remaining on the runway then resulted in a reduced tail clearance.

The flight crew training manual indicated that the recommended rate of rotation on take-off to achieve sufficient tail clearance is 2 to 3° per second, with a lift-off target attitude of 8°. The maintenance of take-off and initial climb performance is dependent on rotation at the correct airspeed and rate to the target attitude. Boeing data indicated that average rotation rates above 2.5° per second to 10° pitch attitude, impact tail clearance. Analysis of the flight data showed that the aircraft was rotating at an average of 2.4° per second up to lift‑off, at a pitch attitude of 10.55°. While the average rotation rate was towards the upper end of the recommended limit, it was not likely to have reduced the available tail clearance. Similarly, the maximum rotation rate of 3.5° was not considered to have contributed to the tailstrike.

Boeing data indicates that lateral control inputs can significantly reduce tail clearance on take-off. The small amount of left aileron input maintained during take-off to compensate for the crosswind was not considered to be sufficient to impact lift and consequently reduce tail clearance.

The minor discrepancy between the actual loading of the cargo hold and the load sheet was not significant and did not contribute to the tailstrike.

Following the occurrence event, the flight crew were proactive in gathering information from all available sources, which enabled them to make a complete assessment of the situation. They were decisive in their actions and kept cabin crew, passengers, ATC and ground staff up to date with clear communications.

Findings

This finding should not be read as apportioning blame or liability to any particular organisation or individual.

• A decrease in the headwind component reduced the airspeed during rotation and extended the time required for VH-YIR to leave the runway, resulting in a reduced tail clearance and subsequent tailstrike.

Safety message

External factors can change flight conditions rapidly. How the crew plans for and mitigates threats can make the difference between an uneventful take-off or landing and one that results in a tailstrike. Boeing guidance shows that airspeed loss, lateral control deflection and a greater than average pitch rate can all contribute to reduced tail clearance. The risk of a tailstrike can be mitigated by using recommended take-off techniques. The Boeing Aero-magazine article Tail strikes: Prevention contains a number of useful recommendations on tailstrike prevention, which include stressing the importance of:

• The role of the pilot monitoring to actively monitor and identify airspeed stagnation during the rotation phase to take-off target pitch attitude.
• In gusty conditions, momentarily delay rotation to ensure that the aircraft starts rotation at an average speed above the rotate speed.
• Adherence to the recommended average all-engine take-off rotation rate of 2 to 3° per second.

Following this tailstrike event, the flight crew made good use of resources and were proactive in assessing and resolving the situation. A safe outcome was achieved through the crew’s use of effective communication and by following practiced failure management procedures.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. New Zealand Daylight Time (NZDT): Coordinated Universal Time (UTC) + 13 hours
2. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
3. V₁: the critical engine failure speed or decision speed required for take-off. Engine failure below V1 should result in a rejected take-off; above this speed the take-off should be continued.

On 21 December 2017, the pilot of a Gregory S. Browning  Zodiac 601XL departed Shelbyville Municipal Airport, Tennessee on a flight to Wifferdill Airport, Chapmansboro, Tennessee. A short time later, witnesses in the vicinity of Chapmansboro reported hearing a loud ‘boom’ similar to a crash. The aircraft was found in an open field in an upright position with substantial damage. The pilot, the only person on board, sustained fatal injuries. The National Transportation Safety Board (NTSB) of the United States commenced an investigation into the occurrence.

As Australia is the State of Manufacture of the engine, the ATSB requested to be appointed as an accredited representative to the NTSB investigation in accordance with clause 5.18 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation. An ATSB investigator was appointed as accredited representative to the NTSB on 8 January 2018. To facilitate support to the NTSB investigation, the ATSB also initiated an investigation under the Australian Transport Safety Investigation Act 2003.

The NTSB has completed their investigation and the final report is available on the NTSB website.

Any enquires relating to the investigation should be directed to the NTSB at: www.ntsb.gov

What happened

On 27 October 2017, at about 1900 Co-ordinated Universal Time,^[1] a Jetstar Airways Airbus A320 aircraft, registered VH-VGY, was being prepared for a scheduled passenger service from Auckland International Airport, New Zealand to Sydney, Australia. The captain was designated as the pilot flying and the first officer was the pilot monitoring.^[2]

At about 1909, the leading hand had finished loading the last container into the aircraft hold and was organising his paperwork. As it was raining, he decided to put the clipboard in the right engine (No. 2) cowling to stop his paperwork from becoming wet and blown by the wind, with the intention to retrieve it later. The leading hand went to the flight deck, gave some paperwork to the flight crew, and returned to the ground to organise the aircraft’s push back.

At about 1919, the dispatcher cleared the ground and servicing equipment from the aircraft and conducted the ‘duty of care’ walk-around. During the walk-around, she noticed the clipboard in the right engine and thought that the leading hand would return for it, so she continued with the walk-around. Soon after, the engines reportedly started normally.

At about 1925, when the aircraft was taxiing, the leading hand realised his clipboard with the paperwork was missing and thought the dispatcher had the paperwork. The leading hand asked the dispatcher about the clipboard and she mentioned she saw it in the right engine during the walk-around. The ground crew returned to where they were preparing the aircraft and noticed paper debris on the ground. The ground crew organised for their operations area to contact the flight crew.

At about 1937, the aircraft departed. Shortly after, when on climb through flight level^[3] 150, the flight crew received a radio call from the Auckland Approach air traffic controller to contact the surface movement controller. The captain handed control of the aircraft to the first officer and contacted the surface movement controller who advised that the ground crew had lost their paperwork and it may have been placed on the engine. The captain requested further information about the paperwork, specifically whether the paper was on top of the engine or inside the inlet. The flight crew checked the engine instruments and there were no abnormal indications. The surface movement controller confirmed that the paperwork was placed within the inlet and paper debris was found on the tarmac (Figure 1). The captain then contacted the company engineer at the airport and asked whether it was just paperwork or a clipboard with a metal clip. The engineer advised that a piece of sheared metal had been found. The flight crew decided to return to Auckland.

After landing at about 2048, the engine was inspected by engineers and paper was found throughout the engine. They also found minor damage to an engine fan blade and attrition liner.^[4]

Figure 1: Foreign object debris on the ground behind the aircraft (circled)

Source: Aerocare, modified by the ATSB

Additional comments

The leading hand stated that, due to the wind and rain, he felt the need to shelter the paperwork. Normally, staff use the pushback tractor for shelter during adverse weather and to prepare paperwork for the flight. There is a metal box on the loader to store the folder. However, as the pushback tractor was not yet present at the bay, he used the engine cowling. He recalled that he did not feel pressured to rush the departure.

The dispatcher stated that she did not view the clipboard as a foreign object as it belonged to the leading hand and had the paperwork for the flight. She assumed that the leading hand would retrieve it later, prior to engine start-up.

The captain stated that, to obtain more information about the incident, numerous calls were made to other agencies, which took considerable time. Further, due to poor communications, he was unable to contact the operator’s maintenance controller to discuss the engine’s status.

Procedures

The internal investigation into the incident by the ground handling operator, Aerocare, noted that the Jetstar Airways operational manual detailed the responsibilities of the dispatcher when conducting the ‘duty of care’ walk-around and provided a table of the steps involved for this process. While there was no specific requirement to check the engine cowlings/intakes for foreign objects, the manual stated that all staff operating near the aircraft were to be constantly observant for abnormalities and to report these to the leading hand or supervisor prior to the aircraft departing.

The investigation also noted that there was no procedure for the ground crew to establish communications with the flight crew in the event of a non-normal or emergency situation, either prior to or after the aircraft had departed. Further, there was no guidance on how paperwork was to be prepared and managed by ground crew during adverse weather conditions.

Previous occurrences

A search of the ATSB database found the following occurrence where a foreign object has been left on an aircraft:

• On 3 November 2015, the pilot conducted a maintenance test flight in a Eurocopter AS365 N3 helicopter, registered VH-WPX, at Jandakot Airport, Western Australia (ATSB investigation AO-2015-127). During the post-flight inspection, following this test flight, a licenced aircraft maintenance engineer noticed two large gouges to the leading edge of one of the main rotor blades. A spanner that had been used during the track and balance related adjustments could not be located. It was later located on an adjacent taxiway about 43 m from the hangar. Due to the scuff marks and scratches found on the spanner, it was determined that it had been left in the rotor head area and was likely ejected during engine start up.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• While preparing the aircraft for departure, the leading hand placed a clipboard in the right engine, which was subsequently ingested during start-up.
• During the walk-around, the dispatcher noticed the clipboard in the right engine, but believing it would be retrieved prior to the aircraft departing, the dispatcher did not notify the leading hand or supervisor of the foreign object debris as per company procedures.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Safety notices

Both Jetstar Airways and Aerocare have released a notice, which outlines that foreign object debris also includes items accidentally left behind. It further states that engines are not to be touched or used for the placement of items, and emphasises the responsibilities of ground crew to manage foreign object debris by clearing them and reporting their presence to other crew.

Updated procedures

As a result of this incident, Jetstar Airways released an updated aircraft dispatch procedure, which included:

• a specific warning about not placing items in the engine cowling
• improved detail around checks and responsibilities
• a section on emergency and non-normal procedures
• detailing methods for re-establishing communications between ground crew and flight crew such as visually gaining the attention of the flight or contacting them via radio.

Safety message

The presence of foreign object debris poses a significant threat to aircraft safety. It has the potential to cause aircraft damage during critical phases of flight, costing airlines and airports millions of dollars each year. This incident demonstrates the effect foreign object debris has on aircraft operations and emphasises the importance of not placing objects in aircraft engines. It further highlights that all staff operating near aircraft are responsible for reporting any non-normal events they encounter. It should not be assumed that others will perform a task where a hazard has been identified. Assuming other people will undertake a task, such as removing a hazard increases the risk of the task not being completed.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

1. Co-ordinated Universal Time (UTC): the time zone used for aviation. Local time zones around the world can be expressed as positive or negative offsets from UTC.
2. Pilot flying (PF) and pilot monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
3. At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL150 equates to 15,000 ft.
4. A layer of material lining the inside of the fan case adjacent to the fan blade tips. The attrition liner is designed to abrade away during abnormal, or extreme, engine operation without damaging the fan blades.

On 2 May 2017, the pilot of a Messerschmitt-Bölkow-Blohm BK117-A3 helicopter, registered ZK‑IED, was tasked to relocate power poles from the northern side of the inlet to the southern side at Porirua Harbour, Pauatahanui Arm, New Zealand. The pilot reported that while in the cruise at about 300 ft, the helicopter started an un-commanded yaw, at which point the pilot released the sling load and entered into an autorotation onto the water. The helicopter was substantially damaged, and the pilot was uninjured.

On 3 July 2017, the New Zealand Transport Accident Investigation Commission (TAIC) requested Australian Transport Safety Bureau (ATSB) technical assistance with data recovery from a global positioning system (GPS) device that was onboard the helicopter at the time of the ditching. In accordance with paragraph 5.23 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation, the ATSB appointed an accredited representative (ATSB investigator) to the TAIC investigation. To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.

The ATSB successfully recovered the data from the GPS and provided a copy to the TAIC on 4 September 2017.

TAIC is responsible for the release of the final investigation report into this accident. Any enquiries in respect of the ongoing TAIC investigation or release of the investigation report should, in the first instance, be directed to the:

Transport Accident Investigation Commission
Level 9, 114 The Terrace
PO Box 10323
Wellington, 6143, New Zealand

_______________
The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.