Ditching involving Cessna 421C, VH-VPY, 53 km east of Sunshine Coast Airport, Queensland, on 10 November 2023

The investigation

Decisions regarding the scope of an investigation are based on many factors, including the level of safety benefit likely to be obtained from an investigation and the associated resources required. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report, and allow for greater industry awareness of findings that affect safety and potential learning opportunities.

The occurrence

On the morning of 10 November 2023, a Cessna 421C registered VH-VPY (VPY), was prepared for a transpacific ferry flight from Sunshine Coast, Queensland, to Oakland, California in the United States under the instrument flight rules (IFR). On board were the pilot in command (PIC) who held a commercial pilot licence and an aircraft maintenance engineer familiar with the aircraft who also held a commercial pilot licence. The submitted flight plan included the requirement for fuel stops at Pago Pago, American Samoa, and then at Honolulu, Hawaii. To complete the flights between these locations, the aircraft had been fitted with additional long range ferry fuel tanks that provided approximately 14 hours of endurance.[1] To account for the weight of the additional fuel, a special flight permit had been issued that allowed the flight to be conducted with a 10% increase above the maximum take-off weight of the aircraft.

The pilots had originally planned for the flight to depart Sunshine Coast Airport at 0500 local time, however rain showers delayed the departure. The crew subsequently revised the flight plan to depart after daylight when the conditions had improved. The delay meant that the aircraft would have arrived in Pago Pago after last light. On the morning of the flight, the engineer/pilot accepted an offer by the PIC to fly the aircraft based on their familiarity with the aircraft and they agreed that they would operate from the left seat where they felt most comfortable. At 0733 the aircraft departed and commenced climbing to the planned cruising altitude of flight level (FL)210.[2] For the next 49 minutes the crew reported that the aircraft performed as expected for the higher weight, and that all engine indications were normal.

About 213 km from the Australian coastline and while the aircraft was climbing through FL120, both pilots reported hearing a loud muffled bang from the left engine. The pilot in the left seat observed a large bulge to the cowling and oil streaming from the left engine. The pilots immediately completed the engine failure checks and while securing the failed engine, identified that the propeller would not fully feather.[3] 

The PIC, who was seated in the right seat, notified Brisbane Centre air traffic control (ATC) of the engine failure and advised that that they would be returning to the Sunshine Coast but would not be declaring an emergency. ATC initiated an alert phase.[4] At 0825 the crew provided an update to ATC, advising that they had shut down the left engine and that the aircraft was unable to maintain height. ATC activated the distress phase[5] and notified the Joint Rescue Coordination Centre (JRCC)[6] which immediately began coordinating a search and rescue response.

The aircraft continued to gradually descend; the pilots determined that it was unlikely they would reach land, and at 0839 the pilots declared an emergency to ATC. The pilots reported that during the return they worked to maximise their range. The pilot in the right seat called airspeeds, rates of descent and operated the radios, that then allowed the pilot in the left seat to concentrate on hand flying the aircraft. To maximise the aircraft performance, the pilots attempted to reduce the fuel on board by overfilling the wing tanks using the ferry tank provisions that then vented excess fuel overboard. 

ATC maintained regular contact with the pilots throughout the descent. They requested activation of the emergency locator transmitter and to be advised of what emergency equipment was on board the aircraft. 

Two rescue helicopters were tasked to attend to the emergency, with the first helicopter departing from Sunshine Coast Airport at 0854. A nearby Royal Flying Doctor Service (RFDS) aircraft was also routed by ATC to monitor VPY and provide updates in the event of a ditching. At 0900 the crew of VPY confirmed to ATC that they would be ditching. 

The pilots explored various configurations to minimise the rate of descent and determine the handling characteristics of the aircraft with a windmilling propeller. These tests formed the basis of their decision to attempt the ditching in a configuration that differed from the manufacturer’s guidance in the flight manual. They decided against the use of full flaps to avoid a nose low attitude, and instead, adopted a nose high attitude to achieve a slower speed for the touchdown.

The pilot flying recalled that their priority was to maintain control by keeping the aircraft tracking straight with wings level and to complete the ditching at low speed. To assist with this, they shut down the functional right engine in the final phase of the descent and glided the aircraft from approximately 200 ft above the surface of the water. The ditching occurred at 0907 and approximately 53 km from Sunshine Coast Airport (Figure 1).

Figure 1: VH-VPY flight path and key moments during the flight

Source: Google Earth and Flightradar24, annotated by the ATSB

The pilots reported that on contact with the water the aircraft initially skimmed the crest of a wave, followed by very rapid deceleration when the nose pitched into the water. Water washed over the windscreen and the aircraft settled upright in a slight nose down attitude. The crew quickly made their way back through the cabin and over the partially emptied ferry bladder fuel tank to the rear door. There they deployed the life raft before exiting into the water. 

The RFDS aircraft overflew the ditching site and provided coordinates and updates on the pilots to ATC and the inbound rescue helicopters. The first helicopter arrived on scene at 0920 and at 0939 completed winching operations to rescue the pilots (Figure 2). The aircraft sank during the rescue and was not recovered. Although uninjured, the pilots were transported to hospital for precautionary treatment.

Figure 2: VH-VPY remained partially afloat after the ditching and the pilots are nearby using the inflated life raft

Source: RACQ LifeFlight Rescue

Context

Pilot qualifications

The pilot in command (PIC) owned the aircraft and occupied the right seat during the accident flight. They were issued an Australian private aeroplane licence in 1981 prior to the CASA regulatory reform. The introduction of the flight crew licensing suite of regulations on 1 September 2014 included a transition period that expired on 31 August 2018. When the new flight operations regulations became effective, existing Civil Aviation Regulations (CAR) – Part 5 licence holders were required to transition to the new Civil Aviation Safety Regulations Part 61 licence to continue to operate. CASA stated that the PIC’s CAR 5 licence was not transferred to a Part 61 licence and was not valid at the time of the accident. 

The PIC also held a US-issued commercial pilot licence with multi-engine class rating and the appropriate design feature endorsements to operate a Cessna 421C under the instrument flight rules (IFR). They had a total flying experience of about 4,000 hours with 1,000 hours instrument flying experience and 30 hours on multi-engine aircraft. Although they had limited experience operating the aircraft model, they had completed a specific Cessna 421 initial pilot training course at a Federal Aviation Administration (FAA) approved provider that included about 16 hours of ground instruction and 10 hours of training in an FAA approved simulator.

The training covered multiple emergency scenarios in the simulator including flight with one engine inoperative. While not demonstrated in the simulator, the ground instruction covered the manufacturer’s recommended ditching procedure published in the aircraft flight manual.

Holders of a foreign flight crew licence granted by the national aviation authority of an International Civil Aviation Organization contracting state wanting to operate an Australian registered aircraft in Australian airspace were required to obtain an Australian certificate of validation.[7] The PIC did not have a certificate of validation for their FAA licence.

On review of the draft report, CASA advised:

CASA has previously provided guidance on the training pilots should complete prior to conducting flights from a seat they have not previously flown from to ensure they satisfy CASR 61.385(1) Limitations on exercise of privileges of pilot licences – general competency requirement. That is the pilot must be competent to exercise the privileges of the licence and ratings from whatever seat they occupy and may require training to comply with the reg [sic].

The pilot flying the aircraft from the left seat held an Australian commercial pilot licence with multi‑engine class rating and the appropriate design feature endorsements to operate a Cessna 421C under the visual flight rules (VFR), however, they did not hold an instrument rating. They had a total flying experience of about 1,400 hours with 500 hours on multi‑engine aircraft, and about 100 hours on type. They were also an aircraft maintenance engineer with the company that had installed the ferry tank installation in the aircraft.

Survival preparation

Neither pilot had previously conducted an extended international ferry flight over open water. In their planning for the flight they had engaged with other ferry pilots and industry professionals familiar with this type of operation to develop an understanding of what to expect from such a journey.

Following these discussions, a comprehensive suite of emergency survival equipment and personal provisions was acquired, which included:

• manual inflation lifejackets and a 2-person life raft 
• personal GPS, satellite communicator and satellite phone
• handheld VHF transceiver and a portable HF radio.

Further guidance on preparation and considerations for overwater operations is included in the Flight Safety Foundation’s publication Flight Safety Digest – Waterproof Flight Operations.

Aircraft details

The Cessna Aircraft Company 421C type aircraft is a twin-engine, low-wing pressurised aircraft equipped with retractable landing gear. VH-VPY was fitted with 2 Teledyne Continental GTSIO‑520-L piston engines, each driving a 3‑bladed McCauley propellor. The aircraft was manufactured in the United States in 1979 and issued serial number 421C0688. First registered in Australia in 2013, it was purchased by the current owner in August 2020. 

The aircraft was fitted with a Micro Aerodynamics Incorporated vortex generator kit. This kit increased the maximum take-off weight (MTOW) by 129 lb to 7,579 lb and reduced the clean stall speed from 86 kt to 79 kt. 

The aircraft maintenance logbooks, current weight and balance loading system and documentation required for the ferry flight were onboard the aircraft when it sank. 

Aircraft ferry tank design and installation

The aircraft contained a main fuel tank in each wing that provided a combined fuel quantity of 810 L of Avgas. It was also fitted with one of the factory option 108 L wing locker tanks in the left engine nacelle (Figure 3). To achieve the additional endurance required between the available refuelling locations, an engineering order was obtained to install a long-range ferry fuel system. 

One 1,134 L ferry bladder tank was installed in the cabin of the aircraft and restrained to the floor by straps. The second bladder tank was installed in the nose locker and provided an additional 132 L of Avgas. The ferry fuel system fuel management controls were located on a panel behind the pilot’s seats and included electric fuel pumps and fuel control valves. The total fuel capacity of the aircraft was 2,184 L. 

The engineering organisation responsible for the design of the ferry tank system was experienced with such installations and had previously designed a similar system for another Cessna 421C. The tanks’ design data release[8] package included engineering instruction sheets, technical drawings and ferry operating instructions. Flight with the system installed was subject to the Civil Aviation Safety Authority (CASA) issuing a special (ferry) flight permit and the aircraft complying with continued airworthiness requirements detailed in CASA exemption EX90/23 Design of Temporary Modifications or Repairs (Special Flight Permit) Instrument 2023. 

The bladder tank was designed to be a top-up tank for the main fuel tanks located in the wings and did not incorporate a means to jettison or quickly drain the contents. The manufacturer of the bladder tank reported that incorporating of means to jettison introduced complexity and potential failure points in the system. Consequently, top-up systems were less prone to failure or mismanagement.

The pilots reported that the tank was tested for leaks prior to installation and again in flight.[9] No faults were identified with the system. 

The bladder tank was located in the passenger cabin of the aircraft behind the pilot and copilot seats and was restrained[10] with multiple ratchet straps to the existing seat tracks. CASA guidance relating to the restraint of the ferry equipment is covered in Advisory Circular AC 21-09 v4.1 –­­ Special Flight Permits section 5.1.4: 

The aircraft and ferry fuel system, including the restraints of internal ferry tanks against emergency landing loads, must be found safe for the intended flight.

Following the ditching, both occupants reported that the bladder tank did not move, and the aircraft remained intact.

In addition to the ferry tank bladder located in the cabin, the aircraft was configured with a 35 USG (132 L) bladder tank stored in the nose locker. This bladder tank was connected to the ferry fuel control panel. This tank and its connection was an unspecified modification to the approved ferry tank system. 

Figure 3: Fuel tanks in VPY included the main wing tanks, a left locker tank, a nose locker tank (unapproved) and the ferry tank (approved)

Source: Cessna, modified by the ATSB

Special ferry flight permit

For ferry flights where the aircraft meets all airworthiness requirements, except those that cannot be met because of an overweight condition, a special (ferry) flight permit can be issued by CASA. The issued permit for a particular flight usually contains conditions tailored to the type of operation. This is common when conducting international ferry flights in smaller aircraft.

For flights that do not exceed 110% of the certified MTOW and the type certificate holder of the aircraft or the national airworthiness authority of the state of design supports the overweight operation in writing, no further engineering evaluation is required. 

CASA had issued the owner a special flight permit and some of the listed conditions to conduct the flight included:

• the pilots must be instrument rated, current and properly rated for the aircraft
• life jackets and a life raft must be carried in a location that allows ready access in the event of a ditching
• MTOW not to exceed 110% of the manufacturer’s certified limit
• the aircraft was to be flown in VMC while above MTOW.

Weight and balance

The engineering instruction sheet for the ferry system required that a temporary loading system amendment was generated to incorporate the ferry tank installation. The pilot advised that a temporary loading system was not obtained for the flight and that the previous loading system issued in 2020 was used. A copy of the most recent weight and balance record for VPY was obtained. While this load data system expired in July 2023 and did not incorporate the ferry system, it provided the last known empty weight of VPY as 2,438.81 kg. 

The PIC reported[11] the aircraft fuel tanks contained 1,773 L (466.8 USG) of fuel prior to the occurrence flight departure. This quantity of fuel could have provided about 14 hours endurance, 2 hours more than the flight planned elapsed time of about 12 hours. In addition, the pilot reported that the addition of the nose locker tank maintained the centre of gravity within the specified limits. A copy of the flight plan and fuel planning data was requested from the PIC, however a copy was not provided to the ATSB.

ATSB’s review of the CCTV recordings and fuel bowser transaction records showed that a total of 1,732 L of fuel was uplifted into the aircraft with the fuel being distributed throughout the 5 fuel tanks. It could not be determined how much fuel was in the fuel tanks prior to being refuelled on the morning of the ferry flight.

When the aircraft departed, the ATSB determined that with the reported fuel quantity of 1,773 L (466.8 USG) on board, the aircraft was about 50 kg over the special flight permit weight limit. The weight of the emergency equipment and personal luggage carried on the flight was not available to be included, and therefore the actual weight of the aircraft was greater than calculated. ATSB’s review of the aircraft weight and balance identified that when the aircraft departed, it was probably outside the rear of normal centre of gravity envelope.

The pilots attempted to reduce the total fuel on board by overfilling the right main fuel tank using the transfer pumps. The engineering organisation specified a minimum system transfer rate of 3 L/min. When the engine failed, the aircraft had been airborne for about 50 minutes and burnt approximately 71 L from the right main wing tank (half of the total burn of 142 L). Based on the minimum transfer rate of 3 L/min, and the time the pumps would have been operating during the descent, the pumps should have transferred a minimum of 135 L. At the minimum transfer rate, the pumps would have transferred enough fuel from the bladder to overfill the right main tank by about 60 L. For flows above the minimum flow, additional fuel would have vented overboard through the right tank but the quantity of fuel could not be determined. 

Using the fuel consumption rates published in the aircraft flight manual, it was determined that the aircraft would have been about 55 kg under the ferry weight limit at the time the engine failed, and about 150 kg under the ferry weight limit when the aircraft was ditched. The weight of the aircraft was above the normal certified maximum take-off weight for the duration of the flight, up to and including the ditching.

One engine inoperative aircraft performance

On a twin-engine aircraft, feathering the propeller of a failed engine results in both a reduction in drag and a reduction in adverse yaw. A feathered propeller also leads to improved handling characteristics and the engine-out flight performance of the aircraft. The US Federal Aviation Administration FAA Airplane Flying Handbook Chapter 13: Transition to Multiengine Airplanes advises the drag and adverse yaw being produced by a windmilling[12] propeller can be equivalent to the drag produced by the entire airframe.

After the left engine had failed, the pilots reported that the propeller did not fully feather and continued to rotate (windmill). The Cessna 421 aircraft flight manual (AFM) identifies that 400 ft/min must be subtracted from the aircraft climb performance for a windmilling propeller. That performance assumes an unfeathered propeller. The effect of a partially feathered propeller is not specified, however drag produced by the rotating propeller would reduce aircraft climb performance. 

Aircraft climb performance is also significantly affected by weight. The FAA Pilot’s Handbook of Aeronautical Knowledge Chapter 11: Aircraft Performance explains why this is so.

Weight has a very pronounced effect on aircraft performance. If weight is added to an aircraft, it must fly at a higher AOA [angle of attack] to maintain a given altitude and speed. This increases the induced drag of the wings, as well as the parasite drag of the aircraft. Increased drag means that additional thrust is needed to overcome it, which in turn means that less reserve thrust is available for climbing.

Manufacturers conduct extensive flight tests to establish loading limits for their aircraft. If an aircraft is loaded beyond the certified maximum, the centre of gravity[13] limits are invalid (New Zealand CAA, 2023). Some of the effects likely to be encountered when operating an incorrectly loaded or overloaded aircraft include reduced stability and controllability issues as well as a reduced rate of climb and increased stall speed.

Ditching procedure

The Cessna 421C flight manual included an emergency procedure for ditching. The manual advised the procedure had not been flight tested and was based on best judgement. The checklist included a check to ensure the landing gear was retracted, planning the approach into wind, using full flap with sufficient power for a 300 ft/min descent rate at 105 kt and maintaining a continuous descent until touchdown in a level attitude. 

The configuration used by the pilot in this occurrence differed from that specified in the manufacturer’s procedure. They elected not to extend flaps and did not fly a constant descent rate to the ditching. Approaching the water, the aircraft was flared and allowed to slow in a nose-high attitude which permitted a controlled touchdown onto the water at 80 kt, significantly slower than the airspeed specified in the ditching checklist. 

The manufacturer advised the ATSB that the situation was unique and as such, they were unable to advise whether the pilot’s actions increased or decreased the risk during the ditching.

Background to ditching guidance

Textron Aviation reported that the ditching procedure prescribed for the Cessna 421C had been produced during the development program for certification of the aircraft, approximately 50 years prior. They advised that the ‘best judgement’ information used to develop the ditching procedure was probably sourced from the US military. Extensive information on aircraft ditching and considerations is provided in the publication National Search and Rescue Manual Volume II Planning handbook. The images and considerations in the Cessna 421C checklist are consistent with the advice provided in the handbook.

The FAA[14] reviewed ditching procedures for several transport category aircraft and found the following common considerations:

• If possible, a reduction in weight should be attempted since this would reduce the landing speed.
• Maximum flaps should be utilized to reduce touchdown speed to a minimum.
• The final rate of descent should be kept as low as possible.
• At touchdown, the aircraft should be in a specified nose up attitude. Generally this attitude is between 10 and 14 degrees.
• The final approach should be made with the aircraft straight and level, with roll correction and yaw angles below 10 degrees.
• The undercarriage should be retracted if possible.

Further analysis of ditching accidents between 1959–1995 in FAA Report AR-95/112 Transport Water Impact Part II identifies that an aircraft would be very likely to sustain little or no damage to the main fuselage if controlled contact with the water was made with a nose up attitude of between 5°–14° and at speeds below 95 kt. 

CASA Advisory Circular AC 91-09 v1.0 - Ditching provides general guidance to operators and pilots regarding ditching. It identifies that (when applicable) a ditching should be completed with the landing gear retracted. It also states:

Individual aeroplane design may have a significant effect on this outcome with aeroplanes with a significant amount of their structure ahead of the main wheels performing in a less violent manner; however, a misjudged flare may exacerbate the consequences of a ditching…

In his research of ditching occurrences, Newman (1988) identified that ditching an aircraft is normally survivable. He noted that using the proportion of ditchings that had fatalities as an indicator of risk was problematic, as in some cases the occupants may have survived the ditching but not survived during the period after egressing the aircraft. The guidance from AC 91-09 shows that in cold water, the largest threat to survivable post-ditching is a loss of body heat. Figure 4 illustrates the expected survival times at various water temperatures.

Figure 4: Upper limit of survival times in water for people wearing normal clothing

Source: CASA Advisory Circular AC 91-09 - Ditching

Emergency response

After leaving a ditched aircraft, survival is the primary consideration until rescue arrives. Prompt communication with the air traffic service provider or nearby aircraft/vessels to notify authorities is crucial to minimise the emergency response time. A summary of the emergency response is provided below in Table 1. Significantly, the rescue helicopter was airborne before VPY had ditched and onsite 13 minutes after it had ditched. While rated to be capable of holding 2 persons, the pilots reported that it was difficult for them to both fit within the raft. Both pilots were safely recovered 32 minutes after the ditching (Figure 5).

Table 1: Search and rescue activities

Time	Activity
0830	ATC notifies JRCC
0836	ATC advise JRCC that VPY is unable to maintain height
0839	AMSA tasks a rescue helicopter at Sunshine Coast
0840	Coordination of the operation is transferred from JRCC to AMSA
0850	ATC request a nearby Royal Flying Doctor Service (RFDS) aircraft to intercept and monitor as VPY descends
0901	ATC advise AMSA that the pilot of VPY has confirmed they will be ditching
0903	Rescue helicopter departs Sunshine Coast
0907	RFDS aircraft relays that VPY has ditched and the location of the occupants to ATC who pass those details to AMSA
0920	Rescue helicopter arrives onsite and commences winch retrieval of the pilots
0939	Both pilots safely recovered

Figure 5: A pilot in the life raft being retrieved by a helicopter rescue crewman 

Source: RACQ LifeFlight Rescue

Safety analysis

The ATSB was unable to conduct an inspection of the aircraft and relied on the account of those involved in determining the sequence of events and contributing factors. This analysis considers the engine failure, the effect of weight on the aircraft performance, pilot preparation, the execution of the ditching and the response to the emergency.

Engine failure

Both pilots provided a similar account describing the engine failure that resulted in the sudden and complete loss of oil from the left engine. The nature of the failure prevented the left propeller from fully feathering. While the precise loss of performance with a partially feathered propeller could not be quantified, the excess drag from the unfeathered propeller reduced the available climb performance.

Weight of fuel on board

Based on the fuel figures provided by the pilot in command, when the aircraft departed the Sunshine Coast, the weight was over the gross weight limit defined in the special ferry flight permit. Following the consumption of fuel during the climb, the weight of the aircraft would have reduced to less than the maximum allowable weight. However, the weight of the aircraft was above the normal certified gross weight limit for which planning and performance data was available. 

Performance charts in the flight manual showed the negative effect of weight on climb performance. A reduction in the quantity of fuel onboard would therefore have had an accompanying increase in performance. Because there was no way to quickly reduce the quantity of fuel on board, the weight of the fuel, in combination with the one engine inoperative led to the aircraft being unable to maintain height.

Considering the distance from land where the engine failure occurred and the minimum rate of descent that the pilots were able to achieve, a ditching was unavoidable. 

Airworthiness

The aircraft weight and balance documentation had not been updated after installing the ferry system. Weight and balance calculations showed that the aircraft was above the limit specified in the ferry approval documentation and outside the normal centre of gravity envelope. While this would have resulted in reduced stability margins, the aircraft was unlikely to have exhibited any significant adverse control characteristics or instability.

By using a reputable engineering organisation familiar with the aircraft to design the ferry fuel installation, the likelihood of a technical failure related to the fuel system was reduced. However, the additional bladder tank in the nose locker was not part of the engineering organisation’s design and was therefore not compliant with the exemption to use the temporary approved modification for the purpose of ferrying the aircraft under the special flight permit. The unapproved modification did not contribute to the need for the ditching or the outcome of the ditching, however.

By not complying with the permit’s conditional limitations, the safety defences built into the assessment process were removed. While this did not contribute to the occurrence, it increased the likelihood of an adverse outcome.

Licensing

The special (ferry) flight permit required the flight to be flown under the instrument flight rules (IFR) and an IFR flight plan was submitted for the flight. The pilot flying (in the left seat) held an Australian licence with the appropriate ratings to operate the aircraft as pilot in command, however, they were not instrument rated. The pilot in command (in the right seat) held a multi‑engine instrument rating, however, they did not have the required certificate of validation for their FAA licence that would have permitted them to operate an Australian registered aircraft in Australian airspace. Based on the qualifications of the crew, it was determined that they did not hold the appropriate ratings and approvals to comply with the conditions of the special flight permit.

While this action would represent intentional non-compliance with aviation regulations, the main advantage of doing so would be to ensure the pilot with the most experience on the aircraft type was flying while the aircraft was overweight. The hazard being that an emergency early in the flight would require appropriate corrective action while the weight and performance of the aircraft was critical. 

In the context of the occurrence flight, the pilot qualifications did not contribute to the engine malfunction, or the aircraft ditching. However, the delayed departure from the Sunshine Coast in visual meteorological conditions, meant their arrival at Pago Pago would have been after dark. A VFR rated pilot operating the controls from the left seat or an IFR rated pilot operating from an unfamiliar seat on an IFR private flight increases the risks associated with loss of visual reference.

Pilot preparation

Despite not having conducted an overwater ferry flight previously, the pilots had taken measures to ensure they had a good idea of what to expect. Ditchings were not covered in general training and by engaging with industry professionals, they were able to apply their knowledge and experience to their own preparations. By carrying the appropriate survival equipment and being familiar with its use, the pilots were pre-prepared for the ditching. This improved their chances of survival while they were rescued.

Ditching

Most aircraft are not flight tested in a real-world ditching. The emergency procedure in the flight manual was based on the best judgement of the aircraft manufacturer and designers who had expert knowledge of the aircraft’s design. 

While the ditching procedure and configuration used by the pilots was not consistent with the flight manual, the method utilised considered the aircraft configuration, perceived limitations and the prevailing environmental conditions. The method used was found to be similar to that recommended for larger transport category aircraft.

Noting that the manufacturer was not able to advise whether the modified procedure employed by the crew increased or decreased the likelihood of a successful ditching, it could not be determined if the decision not to follow the manufacturer’s guidance increased the likelihood of aircraft damage/breakup when compared to the manufacturer's procedure.

The crew worked well together to ensure the aircraft was flown as efficiently as possible. This reduced the distance the aircraft was ditched from the coastline, which minimised the time taken for the rescue to be accomplished.

Emergency response

The occurrence highlights the importance for pilots to contact ATC as soon as practical. Once notified, ATC activated its distress phase protocols. The information ATC obtained from the pilots ensured that the rescue authority (AMSA) was informed and the equipment that could assist in locating the pilots had been activated or was in use.

Additionally, the early coordinated response from AMSA was initiated before the pilots had declared an emergency, with the first rescue helicopter becoming airborne even before the ditching had occurred. This early response and arrival minimised the pilots’ exposure time in the water, increasing their chances of survival.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.  These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the ditching involving Cessna 421C, registered VH-VPY, 53 km east of the Sunshine Coast Airport, Queensland, on 10 November 2023. 

Contributing factors

• While flying over open water the left engine failed. The nature of the engine failure prevented the propeller from feathering and the excess drag from the windmilling propeller reduced the available performance of the aircraft.
• Following the engine failure, as it was not possible for the pilot to quickly jettison sufficient fuel from the ferry tank, the weight of that fuel further reduced aircraft performance, resulting in the aircraft ditching.

Other factor that increased risk

• The aircraft was loaded in excess of the weight and balance limitations imposed by the special ferry flight permit, and in addition, an unapproved modification was made to the ferry fuel system. These actions removed the defences incorporated into the ferry permit approval process and increased the likelihood of an adverse outcome.
• Both pilots did not hold the appropriate approvals and ratings to conduct the ferry flight.

Other findings

• The pilots were familiar with the survival equipment and were well prepared in the event of a ditching.
• While the pilot actions during the ditching were not consistent with the flight manual, the method utilised considered the aircraft configuration and its performance in the prevailing conditions. It could not be determined if this increased the likelihood of aircraft damage/breakup when compared to the manufacturer's procedure.
• Early communication between the pilots, air traffic control and the Australian Maritime Safety Authority’s Response Centre allowed rescue efforts to commence prior to ditching, increasing the chances of survival.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot of the accident flight
• the owner of the aircraft
• Airservices Australia
• Australian Maritime Safety Authority
• Civil Aviation Safety Authority
• Federal Aviation Administration
• the maintenance organisation for VH-VPY
• Textron Aviation
• CASA‑approved design organisation
• the manufacturer of the fuel cell. 

References

Advisory Circular AC 21-08 v2.1–Approval of modification and repair designs under Subpart 21.M. Civil Aviation Safety Authority, December 2022.

Advisory Circular AC 21-09 v4.1 –­­ Special Flight Permits, Civil Aviation Safety Authority, December 2022.  

Advisory Circular AC 91-09 – Ditching, Civil Aviation Safety Authority, November 2021.

Civil Aviation Authority 2023, Good Aviation Practice Weight and Balance. Available at www.aviation.govt.nz

Flight Safety Foundation 2003, ‘Waterproof flight operations: A comprehensive guide for corporate, fractional, on-demand and commuter operators conducting overwater flights’, Flight Safety Digest, vol. 22–23.

Joint Chiefs of Staff Washington DC, National Search and Rescue Manual. Volume 2: Planning handbook (1991). United States.

Newman RL 1988, ‘Ditchings: A case history and a review of the record’, SAFE Journal, vol. 18, pp.6–15. 

Patel AA & Greenwood RP 1996, Transport water impact and ditching performance, US Department of Transportation Technical Report DOT/FAA/AR-95/54. 

Pilot’s operating handbook and Aeroplane Flight Manual Cessna 421C REPORT VB-760 Issued 1 November 1979, Revised 15 August 1996.

Tahliani M, Muller M 1996, Transport Water Impact Part II, US Department of Transportation Technical Report DOT/FAA/AR-95/112.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• pilots from the accident flight
• Airservices Australia
• Australian Maritime Safety Authority
• Civil Aviation Safety Authority
• Federal Aviation Administration
• maintenance organisation for VH-VPY
• Textron Aviation
• CASA‑approved design organisation.

Submissions were received from:

• pilots from the accident flight
• Civil Aviation Safety Authority
• CASA‑approved design organisation.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.