Collision with terrain involving Cessna 172, VH-ZEW, near Millbrook, Victoria, on 8 September 2015

On the morning of 8 September 2015, a student pilot commenced preparing for an upcoming training flight. As part of that preparation, she completed a flight plan for the flight, which was her first solo navigation training exercise. Her instructor stated that she had shown him the pre‑flight plan and they discussed the expected en-route weather, which was poor in the morning but forecast to improve in the afternoon.

The instructor approved the flight plan and at about 1410 Eastern Standard Time,^[1] the student pilot of the Cessna Aircraft Company 172S Skyhawk SP, registered VH-ZEW (ZEW), departed Point Cook Airport, Victoria, on a return training flight via various waypoints, including Ballarat Airport (Figure 1). GPS data indicated that the aircraft had passed through the third waypoint of the planned journey, cruising at about 1,000 ft above ground level when it started to descend rapidly.

Figure 1: Map showing the aircraft’s flight path, take-off point and accident site. ZEW was between the Ballarat airfield to Melton Reservoir waypoints at the time of the accident.

Source: Google Earth, modified by the ATSB

Witnesses stated that at about 1540 they observed the aircraft flying very low and heading toward a high terrain feature called Black Mount, near Millbrook. The aircraft then crested Black Mount before it disappeared from sight.

About 10 minutes before the accident, a pilot operating an aircraft in the local area overheard the pilot of ZEW providing a position report by radio, overhead Ballarat Airfield. The pilot did not report any difficulties. The pilot did not hear any further radio transmissions from the pilot of ZEW.

A property owner in the area heard a noise, which they later realised was the aircraft flying nearby. As they travelled to a paddock on the property, they located the aircraft at the accident site (Figure 2). The pilot was the sole occupant, and had sustained fatal injuries. The aircraft was destroyed.

Figure 2: Last recorded aircraft position, witness locations, and accident site. The high terrain is an extinct volcano called Black Mount

Source: Google Earth, modified by the ATSB

1. Eastern Standard Time (EST) was Coordinated Universal Time (UTC) +10 hours.

Pilot information

The pilot was enrolled as a student conducting training for a Commercial Pilot (Aeroplane) Licence through a university Associate Degree in Aviation.

The pilot had passed the general flight proficiency test in the month prior to the accident, and had applied for an aeroplane Recreational Pilot Licence.^[2]

The last recorded flight hours for the pilot was on 4 September 2015, with a total of 53.8 hours, all of which was in a Cessna Aircraft Company 172S (172S). The accident flight was the first navigational flight conducted by the pilot without a flight instructor on board.

Medical information

The pilot was reported to have been fit and well with no observed problems with health or behaviour. The pilot held current Class 1 and 2 Aviation Medical Certificates with no restrictions.

The autopsy and toxicology examinations did not reveal any issues that would have contributed to the accident.

Aircraft information

General

The Cessna Aircraft Company C172S (172S) is a four seat, high wing, all metal, fixed undercarriage aircraft with a single reciprocating engine, driving a fixed pitch two bladed propeller (Figure 3).

Figure 3: Exemplar Cessna 172S

Source: ATSB

VH-ZEW

VH-ZEW (ZEW) was a Cessna 172S aircraft, built in 2011, and certified in the normal and utility aircraft categories. It had accumulated 2,218 flight hours at the time of the accident. The aircraft was registered in Australia in May 2011. It had a current certificate of airworthiness and maintenance release with no annotated defects. The last maintenance inspection was conducted about two weeks prior to the accident. Examination of the maintenance documentation did not indicate any anomalies.

A post-accident analysis of the aircraft weight and balance indicated that the aircraft was within limits during the entire flight.

Engine information

The engine was a four cylinder horizontally opposed, normally aspirated, fuel injected piston engine.

The engine manufacturer’s recommended time before overhaul had been exceeded by 218.7 flight hours due to a replacement engine supply issue. As a consequence, the aircraft was downgraded from Charter to the Aerial work category and the engine was maintained in accordance with the on-condition requirements of CASA Airworthiness Directive (AD)/ENG/5.

Integrated instrument and avionics system

The 172S was factory fitted with a Cessna Nav III, comprising of a Garmin G1000 integrated avionics system (G1000). The G1000 provided display and control interface for communication, navigation, surveillance, automatic flight control system (AFCS), primary flight instrumentation, engine indication, and annunciation systems on two liquid crystal display units and an audio panel.

The two display units consisted of a Primary Flight Display (PFD) on the left (pilot side), and the Multi-Function Display (MFD) on the right (Figure 4). The audio panel can be seen located between the two display units. The aircraft was not fitted with the optional Terrain Awareness and Warning System (TAWS) but it did have a coloured topographical map feature to enhance pilots’ awareness of the local area terrain.

Recording capability

The G1000 system was capable of storing 60 flight and engine parameters on a data memory card, which is inserted into the lower card slot of the MFD. Data was logged to a new file each time the MFD was switched on. All parameters were recorded at one‑second intervals.

Figure 4: Exemplar cockpit layout showing G1000 avionics system, with primary flight display (left), multi-function displays (right) and memory card position

Source: Cessna Aircraft Company, modified by the ATSB

Automatic Flight Control System

The AFCS is primarily intended to assist the flight crew in the basic control and tactical guidance of the airplane. The system may also provide workload relief to the pilots, provide a capability to fly a flight path more accurately than by hand, and to assist with control if the aircraft is inadvertently flown into instrument meteorological conditions.

The 172S was manufactured with two AFCS options, the Bendix/King (now Honeywell) KAP140 fitted to earlier manufactured 172S, or the fully integrated Garmin GFC700 fitted to later model 172S, including VH-ZEW.

Autopilot operation

The GFC700 included a two-axis autopilot that operated flight control surface servos to provide automatic flight control. The autopilot controlled the aircraft pitch and roll attitudes following commands received from the flight director. Pitch trim was controlled automatically through an automatic trim (autotrim) function, which provided trim commands to the pitch trim servo, to relieve any sustained effort required by the pitch servo.

The servo motor control limits the maximum servo speed and torque. The servo gearboxes are equipped with slip-clutches set to certain values. This allows the servos to be overridden in case of an emergency.

Pitch Axis and Pitch Trim

The autopilot pitch axis uses pitch rate to stabilise the aircraft pitch attitude during upsets and flight director manoeuvres. Flight director pitch commands are rate- and attitude-limited, combined with pitch damper control, and sent to the pitch servo motor.

When the autopilot is not engaged, manual electric trim (MET) is active and may be used to command the pitch trim servo. This allows the aircraft to be trimmed by using the control wheel split switch rather than the trim wheel, located below the throttle control knob. The left switch is the ARM contact and the right switch controls the UP (forward) and DN (rearward) contacts. Manual trim commands are generated only when both sides of the switch are operated simultaneously. If either side of the switch is active separately for more than three seconds, the MET function is disabled and ‘PTRM’ is enunciated on the PFD. Operation of the pitch trim servo also results in movement of the trim wheel. Trim movement speeds are scheduled with respect to airspeed so that trim movement slows down when airspeed increases to provide a response that is more consistent.

Roll Axis

The autopilot roll axis uses roll rate to stabilise aircraft roll attitude during upsets and flight director manoeuvres. The flight director roll commands are rate- and attitude-limited, combined with roll damper control, and sent to the roll servo motor.

Autopilot controls

The autopilot can be selected ON by depressing the Autopilot (AP) button. The autopilot can be selected OFF in a number of ways by pressing the:

• AP button after the autopilot was selected ON
• red autopilot disconnect (AP DISC) button, which is located on the pilot’s control wheel
• manual electric trim (MET) left pitch trim and arm switch
• go around (GA) button (located beside the throttle control knob)

Manual disengagement is indicated by a five second flashing yellow ‘AP’ annunciation and a two second autopilot disconnect aural alert.

Automatic autopilot disengagement is indicated by a flashing red ‘AP’ annunciation and autopilot disconnect aural alert, which will continue until acknowledged by pushing the AP DISC or MET switch. Automatic disengagement occurs due to:

• system failure
• invalid sensor data
• inability to compute default flight director modes (flight director also disengages automatically)

Further, the selection of the control wheel steering (CWS) button will momentarily disengage the pitch and roll servos for the time that it remains depressed, allowing the aircraft to be hand flown (Figure 5). The ‘AP’ annunciation is temporarily replaced by ‘CWS’ in white for the duration of CWS manoeuvres. In most scenarios, releasing the CWS button reengages the autopilot with a new reference. AFCS behaviour may vary depending on the flight director mode active at the time CWS button is depressed.

Figure 5: GFC 700 autopilot controls on the PFD, MFD and control yoke

Source: Garmin, modified by the ATSB

Flight director operation

When the flight director is activated (FD switch ON), the flight director commands can be flown by the pilot. The flight director is displayed as command bars on the primary flight display, indicating the pre-selected flight path of the aircraft. When the autopilot (AP) is selected ON, the flight director is activated and provides commands to the autopilot.

Flight director modes

The autopilot system has numerous modes of operation. A brief description of the relevant pitch and roll modes with the autopilot selected to ON are listed below.

• Pitch Hold Mode (PIT) – When the autopilot is selected on, the flight director is activated and Pitch Hold Mode (PIT) is selected by default. In PIT, the flight director maintains a constant pitch attitude called the pitch reference. The pitch reference is set to the aircraft attitude at the moment of mode selection.
• Altitude Hold Mode (ALT) – Altitude Hold Mode can be activated by pressing the ALT Key, the aircraft then maintains the current altitude to the nearest ten feet as an altitude reference, shown in the AFCS status box.
• Heading Hold Mode (HDG) – Heading Select Mode is activated by pressing the HDG key. Activation of the heading mode commands the autopilot to acquire and maintain the aircraft’s selected heading.
• Heading/Altitude (HDG/ALT) – Combination of two modes that hold selected heading and reference altitude when selected.
• Heading/Pitch (HDG/Pitch) – Combination of two modes that hold selected heading and current pitch attitude when selected.
• Wings level/altitude (WL/ALT) – rolls the aircraft to level the wings and holds the reference altitude.

Autopilot pre-take-off checks

The operating limitation section of the Garmin GFC 700 AFCS pilot operating handbook stipulated that:

The GFC 700 AFCS pre-flight test must be successfully completed prior to use of the autopilot, flight director or manual electric trim.

The normal procedures section of the POH stated that pre-take-off checks included:

…

Autopilot – ENGAGE (if installed) (push AP button on either PFD or MFD bezel)

Flight Controls – CHECK (verify autopilot can be overpowered in both pitch and roll axes)

A/P TRIM DISC Button – PRESS (if installed) (verify autopilot disengages and aural alert is heard)

…

Manufacturer autopilot limitations, cautions and warnings

Cessna 172S fitted with the Bendix King KAP140 autopilot

The Cessna 172S aircraft were originally manufactured with the KAP140 autopilot system when they were first produced. The KAP140 had a two-axis autopilot control with functions and inputs such as altitude selection and barometric correction that operated independently from the G1000 avionics system.

The Pilot Operating Handbook Supplement 3, titled ' Bendix/King KAP 140 2 axis autopilot' contained the following warning on page S3-29:

DO NOT MOVE THE CONTROL WHEEL WHEN THE AUTOPILOT IS ENGAGED. IF THE PILOT TRIES TO FLY THE AIRPLANE MANUALLY WHEN THE AUTOPILOT IS ENGAGED OR TRIES TO "HELP" THE AUTOPILOT, THE AUTOPILOT WILL ADJUST THE PITCH TRIM TO OPPOSE CONTROL WHEEL MOVEMENT AND CAUSE THE AIRPLANE TO GO OUT OF TRIM. THE OUT-OF-TRIM CONDITION WILL CAUSE LARGE ELEVATOR CONTROL FORCES WHEN THE AUTOPILOT IS DISENGAGED.

Further to that warning, Operating Limitation number 9 stated:

Manually overriding the autopilot to change pitch or roll attitude is prohibited (Disengage the autopilot before moving the control wheel manually).

The Bendix King KAP140 Autopilot System manual indicated the system was capable of generating aural alert annunciations. Aural alerts relating to pitch trim were:

1. "TRIM IN MOTION, TRIM IN MOTION…" - which activated with pitch trim running for more than 5 seconds.

2. "CHECK PITCH TRIM" - which activated when an out of trim condition has existed for more than 15 seconds

Cessna 172S fitted with the GFC700 autopilot

The GFC700 (fitted to VH-ZEW) superseded the KAP140 autopilot part way through production of the Cessna 172S.

In contrast to the warnings and limitations given in the Bendix/King KAP140 2 axis autopilot manual, the ATSB was unable to locate any similar advice, limitations, or warnings applicable to the GFC700 automatic flight control system (AFCS) about manually overriding the autopilot, even though the autopilot reacts the same way. Further, the system did not provide aural alerts or warnings for pitch trim in motion or out of trim conditions such as those provided in the KAP 140 system.

Other aircraft types fitted with the GFC700 autopilot

Numerous other aircraft types have the G1000 avionics system with the GFC700 fitted. The ATSB conducted a search of the Pilots Operating Handbooks for the Cessna Caravan 208, Cirrus SR20/22, Aerospatiale TBM 850, Beechcraft G36 and G58, Mooney M20 (M, R, TN) and Diamond DA42. Of those, the Beechcraft, Diamond, and Mooney aircraft had warnings that would inform a pilot about the issues surrounding the sustained application of an override force with the autopilot ON and engaged.

For example, the Diamond DA42 Normal operating procedure for operation of the GFC700 has a warning at the front of section 4A.6.8 which states:

It is the responsibility of the pilot in command to monitor the autopilot when it is engaged. The pilot should be prepared to immediately disconnect the autopilot and to take prompt corrective action in the event of unexpected or unusual autopilot behaviour. Do not attempt to manually fly the airplane with the autopilot engaged. The autopilot servos will oppose pilot input and will trim opposite the direction of pilot input (pitch axis only). This could lead to a significant out-of-trim condition. Disconnect the autopilot if manual control is desired.

The ATSB asked the aircraft and avionics manufacturers about this disparity between autopilot written and aural warnings, a summary of their response is provided below.

The avionics manufacturer stated that the presence of a limitation, caution or warning is generally left up to the certifier of the equipment in the airplane. They also indicated that they did not believe that a limitation, caution or warning was required because:

• Virtually all autopilots certified in that category react the same way. Therefore, it is common knowledge not to try to fly the airplane while the autopilot is flying, any more than a pilot should not try to fly the airplane while the other pilot is trying to do so.
• The primary pitch servo can only generate a certain amount of force, and in Garmin autopilots that force is always set such that the pilot can overpower the servo at less than the certification requirement limits.
• When the primary pitch servo reaches its maximum value, the airplane will depart from the selected vertical reference, which will be obvious to the pilot.
• The Garmin autopilot also has an amber “ELE” [visual] alert on the PFD when the pitch servo reaches a certain level of effort.
• Practically speaking, an aircraft flight manual note, limitation or caution would not be effective against an inadvertent input.
• For a deliberate attempt by the pilot to manipulate the flight controls while the autopilot is flying, the initial response of the autopilot would be to input servo torque to oppose the pilot effort. It does not do so at maximum servo effort, but only ramps up to the maximum servo effort when the initial inputs are ineffective.
• The pilot will be well aware of the continually increasing control wheel force and should either disconnect the autopilot or quit inputting force into the flight controls.
• AC 25.1329-1C^[3] also deals with this scenario and only requires that the disengagement not result in a potential hazard. Since the pilot can overpower the out-of-trim condition at that point, and will have at least one hand on the control wheel disconnect, there is no hazard.

The aircraft manufacturer concurred with the avionics manufacturer in that they did not believe written limitations, cautions or warnings were required.

The visual ELE alert mentioned by the avionics manufacturer may indicate a mistrim situation and provides an up or down arrow to indicate the direction of force (up arrow nose up etc.) that is required by the pilot when the autopilot is disconnected. The alert is not accompanied by an aural warning. Figure 6 is an extract from the G1000 cockpit reference guide, which shows the amber caution with an explanation.

Figure 6: Status alert for elevator mistrim

Source: Garmin

Autopilot electric trim failure procedure

The emergencies section of the Cessna 172S Nav III Pilot Operating Handbook procedure for autopilot or electric trim failure stated:

Section 3 Emergencies

Page 3-22 – AUTOPILOT OR ELECTRIC TRIM FAILURE (if installed)

AUTOPILOT OR ELECTRIC TRIM FAILURE (if installed) AP OR PTRM ANNUNCIATOR(S) COME ON

1. Control Wheel - GRASP FIRMLY (regain control of airplane)

2. A/P TRIM DISC Button - PRESS and HOLD (throughout recovery)

3. Elevator Trim Control - ADJUST MANUALLY (as necessary)

4. AUTO PILOT Circuit Breaker - OPEN (pull out)

5. A/P TRIM DISC Button - RELEASE

WARNING

FOLLOWING AN AUTOPILOT, AUTOTRIM OR MANUAL ELECTRIC TRIM SYSTEM MALFUNCTION, DO NOT ENGAGE THE AUTOPILOT UNTIL THE CAUSE OF THE MALFUNCTION HAS BEEN CORRECTED.

Autopilot altitude limitations

The operating limitations section of the Cessna 172S Nav III Pilots Operating Handbook stipulates that:

The autopilot must be disengaged below 200 feet AGL [above ground level] during approach operations and below 800 feet AGL during all other operations.

The flight training organisation’s operations manual states:

AUTOPILOT PROCEDURES

The autopilot is not to be used during operations below 1500 ft AGL…

Mode awareness

The flight training organisation’s operations manual stated that:

Autopilot MODE AWARENESS is critical to aircraft safety. Autopilot mode situational awareness is particularly important in the G1000 aircraft with additional mode capability, and the remote position of the annunciator panel. If aircraft performance is not in accordance with the selected mode, re-check the mode annunciation is correct (i.e. the selected mode is engaged). If the problem persists, select basic modes, or over ride and disconnect.

DO NOT persist with the automation if you do not understand what is happening, or selected modes are not doing what they are supposed to.

The Autopilot is a very useful workload management tool, particularly when planning in-flight diversions, lost procedures, or operating in controlled airspace. Prior to use of the autopilot students must read the KAP140 / GFC700 supplement and be deemed competent by an instructor. During solo operations, use of the autopilot is limited to keeping current with autopilot operation and management of high workload situations.

Meteorological information

The Bureau of Meteorology reported that the majority of Victoria was affected by a slow moving high pressure system located in the Great Australian Bight near South Australia. This resulted in a high pressure ridge extending over Victoria, with associated cool, dry south-westerly winds and the presence of a large amount of stratocumulus cloud.

Recorded meteorological observations at Ballarat airport, located about 19 km WNW of the accident confirmed that the surface wind was from the SW at 10 to 15 kt.

After examining all meteorological observations and the surrounding topography, the Bureau of Meteorology advised that apart from the low cloud with a base of approximately 2,000 to 2,500 ft AMSL and the possibility of moderate turbulence between 5,000 ft to 9,000 ft AMSL near the accident site, there was no other significant weather in the area at the time of the accident.

The recorded cloud observations were consistent with witness reports of overcast cloud close to the accident site. A pilot operating near the Ballarat airfield also recalled overcast cloud conditions at about 3,000 ft AMSL around the time of the accident.

Although extensive cloud was apparent in the area of operation, there was no recorded or observed rain activity near the accident site. Reported visibility was greater than 10 km when clear of cloud.

Site and wreckage information

Site information

The aircraft impacted terrain on the south-eastern side of an extinct volcano known as Black Mount (Figure 7). The accident site was:

• about 200 m to the right of the flight-planned track.
• on a 20 degree upslope
• at an elevation of about 2,160 ft AMSL
• on a south-south-east track which was 15 degrees to the right of the flight planned track.

The area surrounding Black Mount was flat and clear farmland, which had a number of suitable off-field landing areas for the pilot to land in the event of an emergency.

Figure 7: Area of accident site on high ground with aircraft impact point highlighted

Source: ATSB

Black Mount was a U shaped feature, which was covered in grass on the south-eastern side that matched the surrounding landscape. That created a visual illusion that the high terrain appeared to be a relatively flat area when viewed from the southwest.

Figure 8 is a picture of Black Mount taken in line with the aircraft’s direction of flight at about 1,000 ft AGL. The picture illustrates the ill-defined rising terrain.

Figure 8: Black Mount viewed at about 1,000 ft AGL in the direction of flight, showing the accident site

Source: Victoria Police, modified by the ATSB

Figure 9 is a profile representation of Black Mount, which shows the rising terrain and location of the accident site.

Figure 9: Black Mount in profile showing the rising terrain, direction of flight, accident site, and peak altitudes

Source: Google Earth, modified by the ATSB

There were several identifiable impact marks in the initial part of the wreckage trail. They consisted of right and left wing impact marks, left, right and nose gear marks, propeller slash marks and nose impact point (Figure 10). Examination of the ground impact marks, wreckage splay, distribution, disruption and location indicated that the aircraft:

• was travelling at a relatively high speed when it impacted with terrain
• was slightly right wing low (in a turn to the right)
• was about level on its pitch axis (in a level attitude)
• travelled a distance of 70 m from the point of impact to the position that the aircraft came to rest.

Figure 10: Overview of accident site, location of aircraft impact marks and main wreckage in the background

Source: ATSB

Wreckage inspection

The ATSB conducted a detailed examination of the aircraft. That examination identified:

• all aircraft parts were accounted for in the local area of the accident site
• no observable pre-accident defects to the airframe or engine
• propeller slash marks, bending and rotational damage indicated that the engine was driving the propeller at the time of impact
• the flaps were retracted
• the elevator trim was about midway between neutral and the full pitch down position.^[4]

Aircraft safety features

The aircraft’s front seat belts were fitted with airbags, designed to inflate in front of the occupants to protect them from coming in contact with the instrument panel. The pilot’s airbag was outside of its casings which was consistent with it deploying during the accident sequence.

Emergency locator transmitter

A fixed 406 MHz emergency locator transmitter (ELT) was fitted to the aircraft. The transmitter was found securely located in its mounting, and appeared undamaged externally. It was set to the auto position and the activation light was illuminated. The ELT was also beeping intermittently, indicating that the internal inertial switch had activated and the ELT was transmitting.

Figure 11 shows the aircraft viewed from the rear, displaying the significant structural damage.

Figure 11: Main wreckage viewed from the rear showing significant disruption

Source: ATSB

Avionics equipment

The G1000 integrated avionics system flight data log memory card had been dislodged during the accident sequence and was located about 20 m from the main wreckage. External examination of the card did not reveal any obvious damage. The memory card was retained for further examination and data download.

Recorded information

G1000 memory card download

The flight data log memory card was successfully downloaded by the ATSB. It provided data for the entire flight, including autopilot and engine parameters, recorded at one second intervals up to about 13-16 seconds prior to the impact. The premature termination of the recording was probably due to power supply disconnection as a result of impact forces, rather than normal system shut down. This likely prevented buffered data being written to the memory card.

The downloaded information did not show any anomalies with the flight and engine parameters that would indicate a mechanical or avionics issue with the aircraft. The ATSB provided the downloaded data from the accident flight to the aircraft and avionics manufacturers. They were asked if the data showed any indications of autopilot malfunction. The aircraft manufacturer stated that:

Based on the data provided, there does not appear to be an autopilot malfunction.

The avionics manufacturer also indicated that the data did not show a failure of the avionics or autopilot systems.

The data indicated a normal flight through all planned waypoints up until about 8 seconds before recording stopped, when the aircraft started climbed slightly before descending from 3,000ft AMSL at an increasingly rapid rate (Figure 12). The maximum vertical descent rate recorded was about 2,500 ft/min. The aircraft travelled a distance of about 900 m and descended a further 640 ft following the end of the recording. The time from the start of the descent until impact with terrain was estimated to be no more than about 20 seconds.

Figure 12: Recorded GPS flight track showing descent before recording ends, estimated track and impact point on Black Mount

Source: Google Earth, modified by the ATSB

Recorded AFCS data

The recorded AFCS data during the accident flight showed that:

• the pilot had conducted an autopilot function check as part of the pre-flight checks just prior to take-off.
• the autopilot was utilised for about one third of the flight in total, with various heading and vertical modes selected
• the autopilot had been switched on and off 14 times, not including the ground function test (Figure 13).

Figure 13: Flightpath plot showing the aircraft’s flight track with autopilot usage and modes utilised during the flight

Source: ATSB

In normal AFCS operation with the autopilot engaged in a vertical mode, the pitch command and pitch attitude should follow each other closely. Towards the end of the recovered data, this was not the case. The data shows a slight pitch up attitude and then a significant pitch down attitude, which is different to the pitch command. This indicated a manual control input from the pilot while the autopilot was on and engaged in a vertical mode. Figure 14 is a graph of the last 50 seconds of flight showing the time of autopilot engagement in the various modes, the flight director pitch commands, and actual aircraft pitch attitude. The graph also shows an increase in engine RPM and fuel flow, which indicates that the pilot did not reduce power before descent.^[5]

Figure 14: Data from the last 40 seconds of flight showing flight parameters, the autopilot selections, when the autopilot was disengaged, and the end of the recorded data

Source: ATSB

Table 1 is a timeline of the last recorded 30 seconds of data with the autopilot mode selections, and the aircraft reaction those selections.

Table 1: Autopilot usage during the last 30 seconds of recorded data

UTC	Description
05:17:44	Autopilot selected ON in default Wings Level/Altitude mode (WL/ALT), to maintain a wings level attitude in roll attitude mode, and a reference altitude in altitude hold mode from the time of selection.
05:17:45	Autopilot mode changed to Heading/Altitude mode (HDG/ALT), to hold a reference heading and altitude from the time of selection.
05:17:50	Autopilot mode changed to Heading/Pitch (HDG/PIT) to hold a heading and pitch attitude from the time of selection.
05:17:52	Autopilot mode changed to HDG/ALT.
05:17:55	Autopilot mode changed to HDG/PIT. Pitch reference recorded at the time of selection was -1.9°. The pitch attitude was close to the pitch command value for the first 7 seconds.
05:17:58	While still in HDG/PIT, the recording indicated the aircraft adopted a slight pitch up and then a pitch down attitude that was different to the pitch attitude reference set when HDG/PIT was selected.
05:18:04	Autopilot mode changed to HDG/ALT, an altitude reference of 2,985 ft AMSL should automatically have been selected. Autopilot did not respond as expected, which was to hold the reference altitude. The aircraft nose down pitch angle continued to increase and the aircraft continued to descend.
05:18:08	Pilot disengaged autopilot system manually by either switching the autopilot off at the controller, pressing disconnect on the control yoke or utilising the pitch trim switches on the control yoke. At that point the recorded vertical descent rate was about 1,000 ft/min, aircraft nose down pitch angle of -13.5° and an altitude of about 2,800 ft AMSL.
05:18:11	Recording ends with an increasing vertical descent rate of 2,500 ft/min, nose down pitch angle of about -23°, and an altitude of about 2,615 ft AMSL.
05:18:25	Approximate time of impact with terrain at an elevation of about 2,160 ft AMSL.

Manufacturer analysis of the autopilot data

The ATSB provided the accident flight data to the aircraft and avionics manufacturers for their interpretation of the data. The aircraft manufacturer stated that:

Below is a summation of our analysis of the data provided by the ATSB relating to this accident:

The pilot activated and deactivated the autopilot repeatedly throughout the flight. In addition, multiple pitch modes were selected throughout the flight, though ALT (altitude hold) mode was used the most.

For a majority of the flight, the pitch of the aircraft matches the pitch command recorded. However, there are three negative vertical speed increases. During those times the pitch of the aircraft does not match the pitch command recorded. This occurs while the autopilot was activated. During all three occurrences, a negative pitch command is recorded. At the “peak” of each negative vertical speed increase the autopilot is disconnected by the pilot and the aircraft’s descent rate is decreased. In each of the pitch down sequences the pitch of the aircraft exceeded the pitch command recorded (which would seem to indicate pilot input). It is also interesting to note that after each of those disconnects the autopilot is reengaged almost immediately and a positive pitch command is recorded. After this sequence, the autopilot is disconnected while the ALT mode is still engaged.

Based on the recorded data, the pitch and roll of the actual aircraft logged at the end of the recording was beyond what was being called for by the autopilot. This would seem to indicate pilot input.

The aircraft behavior vs. autopilot behavior would seem to indicate the pilot was experimenting with the aircraft/flight director/autopilot operation. If the pilot was experiencing some type of autopilot malfunction we would assume the pilot would follow the autopilot failure checklist and disable the autopilot.

The vertical mode is switched repeatedly between ALT and PIT (pitch hold) modes at the end of the recording. The data file also shows the autopilot was disconnected by the pilot before the recording stopped. This occurred when the aircraft was approximately 700 feet AGL and approximately 0.5 NM from the accident site.

The avionics manufacturer was unsure what caused the rapid pitch down, but indicated that the amount the aircraft pitched down was beyond the aircraft’s autopilot capability. They indicated that it was a possibility that the pilot had overpowered the autopilot.

ATSB comment

The ATSB analysis largely concurred with the aircraft manufacturer’s analysis of the data, with some variation about the conclusions detailed in points 2 and 4. The aircraft manufacturer indicated that there were three negative vertical speed increases where pitch and pitch command did not match while the autopilot was activated. Those sequences were on the sector between Swan Marsh and Ballarat.

The ATSB analysed the three sequences mentioned and established that the negative vertical speed increases and misalignment between pitch attitude and pitch command occurred just after the autopilot had been switched off (Figure 15). Further, there was no evidence in the data to show any separation between the aircraft pitch attitude and pitch command on any phase of the flight with the autopilot on in a vertical mode other than just prior to the accident.

The avionics and aircraft manufacturers contended that the pilot may have been experimenting with the autopilot during the three sequences identified. The ATSB considered that it was also possible that the pilot did not have a sound understanding of the difference between PIT and ALT modes. During the three highlighted climbs and descents, PIT was set with a positive attitude reference, meaning that the aircraft climbed at the set positive pitch attitude. The autopilot was then switched off and the aircraft manually descended. That indicated that the pilot may have been unaware that when PIT is selected it will hold an aircraft attitude rather than altitude. In summary, a lack of understanding and/or experimentation could have resulted in the altitude variation seen in the data.

Figure 15: Autopilot operation and altitude variations on the accident flight sector between Swan Marsh and Ballarat waypoints

Source: ATSB

Autopilot verification flights

The ATSB provided some recorded data information to the flight training organisation and discussed the interpretation of the data. This included possible factors that may have contributed to a rapid pitch down, which began with the autopilot engaged in a vertical mode. The flight training organisation advised that they were unsure why the autopilot reacted the way it did, but suspected it may have been due to manual manipulation of the flight controls.

Subsequent to that discussion, the flight training organisation conducted their own autopilot function verification flights with a Cessna 172S, fitted with the same avionics and autopilot systems. They advised the ATSB that during the verification flights:

• back pressure was applied to the control yoke with the autopilot ON and engaged in HDG/PIT mode
• the autopilot started to trim nose down to maintain reference attitude
• the control forces increased significantly against pilot control input
• the pilot released back pressure on the controls, which resulted in an immediate aircraft pitch down attitude
• the aircraft descended rapidly at a rate of up to 4,500 ft/min with a corresponding increase in airspeed from 110 to 145 kt
• with the exception of one test where the autopilot disconnected at about 20 degrees pitch down, the autopilot did not disconnect, re-trim or recapture the pitch reference attitude
• the autopilot did not provide an aural or visual warning that the trim was running (apart from elevator trim wheel movement), that a mistrim existed, or that the autopilot reference attitude was not recaptured
• in all but one case the autopilot was switched off manually and in all cases manual trim inputs were required to recover the out of trim situation.

The recorded data from the verification flight was obtained by the ATSB and compared to the accident flight data (Figure 16).

Figure 16: Data from one of the verification flights with application of override force with the autopilot ON in HDG/PIT mode

Source: ATSB

The verification flights did not completely match the accident flight profile. Some of the conditions varied, such as the autopilot vertical mode, which was constant during the verification flight but not for the accident flight. The initial increase in pitch was also greater in the verification flight and the power was reduced to decrease the airspeed in the descent. However, a comparison between the data of the two flights showed significant similarities which included:

• slight pitch up before significant pitch down
• a rapid pitch down (beyond 2,500 ft/min) and descent with the autopilot ON and engaged in a vertical hold mode
• the autopilot not holding a set reference attitude/altitude
• the autopilot remaining ON and engaged when reference attitude/altitude was not recaptured
• a 600 ft reduction in altitude in about 15 seconds.

The recorded movements of the aircraft were only possible in the verification flight if the pilot manually manipulated the flight controls with the autopilot on in a vertical hold mode, and followed by pilot inaction/slow reaction in rectifying an out of trim situation during the rapid pitch down event.

Ground testing

Ground testing was conducted by the ATSB in conjunction with the flight training organisation, utilising a Cessna 172S. With the autopilot engaged in a vertical mode, backpressure was applied to the control column with the following results:

• the trim started to move in the opposite direction to the control column force about three seconds after initiation of back pressure
• only a small amount of back pressure was required to initiate movement
• the greater the back pressure applied, the faster the trim moved to a nose down position

Conversely, when forward pressure was applied to the control column the trim moved to a nose up position. The trim activation and rate of movement was similar to the nose down trim scenario.

With the seat pulled up to the flight position, the elevator trim wheel and therefore trim wheel movement was outside the pilot’s normal field of vision. This was exacerbated if the seat was moved further forward, as would be required by relatively short pilots (such as the pilot of ZEW).

Airservices recorded data

A review of surveillance data provided by Airservices Australia showed a symbol indicating an unidentified radar track with a secondary surveillance radar^[6] (SSR) code 1200^[7] that, based on time tracking details, was likely the occurrence aircraft. When compared to the aircraft’s downloaded GPS track, the SSR track was found to match in location and altitude.

The SSR track recording provided two more location and altitude data points about three and eight seconds after the data stopped recording in the aircraft. The final location points were not considered accurate enough to be useful to the investigation.

Flight operations

Pre-flight planning

The pilot created a full flight plan, which included:

• The chosen route, with waypoints identified
• The altitude on each sector
• Estimated times and fuel usage
• Analysis of the current weather in the area of operation
• Aircraft weight and balance
• Entering the waypoints for the flight into the G1000, so that they would be available for tracking.

The flight training organisations operations manual at section E-2-16 titled Cross-country operations, stipulated that:

Flight plans for the exercises must be checked thoroughly before departure by the student pilot's instructor and are to be handed in for record purposes at the completion of the exercise.

…Private and/or Commercial Pilots engaging in cross country flying are required to submit their flight plan for checking by the instructor authorising the flight.

The pilot’s flight instructor signed the training organisations solo authorisation sheet, after reviewing the pilot’s flight plan and weather information. The instructor left a note in the authorisation sheet that stipulated that the pilot must maintain a height of 1,000 ft above ground level (AGL).

The planned cruise level between Ballarat and Milton Reservoir waypoints was 2,500 ft AMSL. That gave the pilot a ground clearance of 270 ft AGL in the vicinity of the accident site at the flight planned altitude. The flight plan conflicted with the minimum altitude AGL as stipulated by the flight instructor. It was also below the minimum regulatory requirement of 500 ft over unpopulated areas. It should be noted that despite the flight plan, the flight data showed that the pilot was maintaining a height of about 3,000 ft AMSL (770 ft AGL) on the Ballarat Milton Reservoir sector before the rapid descent.

Previous flights on the same route

The route chosen by the pilot was a standard route utilised by the flight training school for navigation flights. When questioned about ground clearance in line with the Black Mount high terrain feature, the flight training organisation indicated that students usually flew to the right or left of track in order to improve ground clearance. Three flight data recordings of previous flights conducted by other students showed that the sector between Ballarat Airfield and Melton Reservoir was either flown at 3,500 ft AMSL, and/or flown either side of Black Mount in order to provide greater ground clearance (Figure 17).

The flight training organisation reported that their training included emphasis on flight adjustments for raised terrain to always comply with the mandated AGL of 500 ft. This included instruction on changes made as part of flight planning to include consideration of that requirements. The accident flight was flown at 3,000 ft AMSL and its flight path was directly over the top of Black Mount. That gave the aircraft a ground clearance of about 800 ft over the high terrain at the aircraft’s cruise altitude.

Figure 17: GPS flight track data from the accident flight and three other training flights in the area of Black Mount

Source: Google Earth, modified by the ATSB

Autopilot training and knowledge

Regulatory auto flight system training requirements

Civil Aviation Safety Regulation 1998 Part 61 Manual of Standards (MOS) Schedule 3 listed the aeronautical knowledge standards required for all licence categories including for the Recreational Pilot Licence (RPL) and Private Pilot Licence (PPL).

The assessable knowledge areas included topics related to basic and general aeronautical knowledge. The RPL knowledge standards did not include topics related to aircraft systems and autopilot knowledge. However, those knowledge standards were included at the PPL level and are as follows:

2.2 Aircraft systems

2.2.1 Describe or state the function of the following typical components installed in aeroplanes, including the possibility of ‘overpowering the system and associated precautions a pilot should take:

(a) stall warning devices;

(b) auto-pilot components, including the following:

(i) roll attitude heading pitch controls;

(ii) trim indicator;

(iii) cut-out mechanisms.

Schedule 5 Section G of the MOS outlined the flight test requirements, knowledge requirements and practical flight standards required to demonstrate competency for the issue of a RPL and aeroplane category rating (RPL (A)). There was no requirement included in that section for pilots to have knowledge of, or have demonstrated use of the aircraft’s auto flight systems.

The CASA Flight Examiners Handbook included guidance for examiners about testing requirements of various licence categories. The handbook referenced knowledge standards and units of competencies included in the MOS. At the time of the accident, the flight examiners handbook did not include a requirement for examiners to test student pilot auto flight systems knowledge.

The July 2017 version of the flight examiners handbook introduced a requirement for examiners to assess a student pilot’s auto flight systems knowledge at the RPL level. The RPL (A) assessment scope and conditions section included:

Where the aircraft is fitted with an autopilot system, the applicant must demonstrate competency in the system.

Despite this inclusion, the MOS was not amended to reflect the additional requirements at an RPL (A) level. In December 2017 the ATSB asked CASA if the MOS should reflect the changes made in the flight examiners handbook. CASA stated that:

The flight test standards in Part 61 of the MOS are being amended currently. The standards will align between the MOS, the flight test forms, and the examiners handbook.

The ATSB also asked CASA how the elements of the MOS support the changes in the flight examiners handbook with respect to autopilot use. CASA stated that:

The new flight test standards in schedule 5 of the Part 61 MOS for the RPL (A) include ‘manage the aircraft systems required for the flight’. This standard is elaborated in the examiners handbook.

With regards to the elaboration mentioned in the examiners handbook the only item identified was the previously mentioned sentence for demonstrate competency in the system.

Additionally, the ATSB asked CASA what its expectations were with respect to the level of knowledge and use of autopilot systems during RPL training. CASA stated that:

The training standards for the grant of a recreational pilot licence focus on the knowledge and skills required to operate a basic light aircraft. The standards do not mandate knowledge and the use of autopilot systems. Competency using any system in an aircraft is finally regulated by regulation 61.385. CASA expects a flight training operator would ensure trainee pilots are competent using the systems in an aircraft he or she is assigned to fly.

CASR 61.385 Limitations on exercise of privileges of pilots licences- general competency requirement, states:

(1) The holder of a pilot licence is authorised to exercise the privileges of the licence in an aircraft only if the holder is competent in operating the aircraft to the standards mentioned in the Part 61 Manual of Standards for the class or type to which the aircraft belongs, including in all of the following areas:

(a) operating the aircraft‘s navigation and operating systems;

(b) conducting all normal, abnormal and emergency flight procedures for the aircraft;

(c) applying operating limitations;

(d) weight and balance requirements;

(e) applying aircraft performance data, including take-off and landing performance data, for the aircraft.

Part 61 of the MOS does not cross reference CASR 61.385 for further information.

Flight training organisation requirements

Pilots at the RPL level were required by the flight training organisation to demonstrate the use of basic autopilot modes for the purposes of turning the aircraft 180° after inadvertent flight into cloud. Additionally, it was reported by the flight training organisation that basic autopilot modes could be used at times of high workload. Observations of the pilot’s ability to use basic auto-flight modes such as heading, and altitude hold were conducted prior to pilots obtaining a RPL and the conduct of solo navigation flights.

In addition to the in-flight observations of autopilot use, pilots conducted at least one hour in-flight using the G1000 avionics system, which included the use of basic autopilot modes in simulated instrument meteorological conditions (cloud) and one hour using the ground based flight trainer. The accident pilot had successfully completed training using the aircraft’s autopilot system and flight trainer.

The flight training organisation reported that during the early stages, pilots were trained only to use basic autopilot functions, however instructors did not have a formal training syllabus that included an assessment of the students underpinning knowledge of the autopilot system as included in the MOS at the PPL level.

The pilot involved in the accident asked their instructor if the autopilot could be used during training flights. The instructor advised the pilot that it was only to be used during high workload situations.

Federal Aviation Administration autopilot guidance for certification requirements

FAA AC Part 23.1329

The autopilot system fitted to the Cessna 172S aircraft is subject to the rules of certification by the country of manufacture (US) for normal, utility, acrobatic and commuter category airplanes.^[8]

The relevant guidelines for certification requirements of autopilots at Part 23.1329 stipulates that:

Automatic pilot system.…

(e) Each system must be designed and adjusted so that, within the range of adjustment available to the pilot, it cannot produce hazardous loads on the airplane or create hazardous deviations in the flight path, under any flight condition appropriate to its use, either during normal operation or in the event of a malfunction, assuming that corrective action begins within a reasonable period of time.

The term 'reasonable period of time' is described in FAA advisory circular AC23.1329 (b) 1)) as being:

(b) A reasonable period of time has been established for pilot recognition between the time a malfunction is induced into the autopilot system and the beginning of pilot corrective action following hands-off or unrestrained operation. The following time delays have been acceptable:

(1) A three-second delay following pilot recognition of an autopilot system malfunction, through a deviation of the airplane from the intended flight path, abnormal control movements, or by a reliable failure warning system in the climb, cruise, and descent flight regimes.

Tests and research

Previous events involving autopilot systems

The ATSB requested information from the aircraft and avionics manufacturers about any incidents or accidents that have occurred involving in-flight upsets with autopilots ON and engaged in a vertical hold mode. The manufacturers did not have information that was similar to the VH-ZEW event.

The ATSB conducted a search of its database for in-flight upsets involving autopilots in light aircraft, it did not reveal any other similar incidents or accidents. The ATSB also conducted a search of the National Transportation Safety Board (NTSB) database. One accident, two incidents and a recommendation highlighting several others accidents were identified.

Mooney M20TN accident 27 July 2012 in Adrian, Michigan

NTSB report CEN12FA487 refers to an incident involving a Mooney M20TN with a Garmin G1000 avionics system and a GFC700 autopilot fitted. The autopilot manufacturer advised that the aircraft flight manual contained a warning that manual pilot input was not be applied with the autopilot engaged. The report indicated that with the autopilot engaged the aircraft had a violent pitch-up which required extreme forward pressure on the control yoke to keep the aircraft from pitching up and stalling. The report stated that:

The Airplane Flight Manual contains emergency procedures for use in the event of an autopilot out‑of‑trim event; the third item on the checklist directs pilots to re-trim the pitch, if necessary, using the trim wheel. The pilot noted that he did not attempt to use the manual trim wheel to change the airplane’s pitch attitude because that would have required him to release hand pressure on the control yoke. He was uncertain when or how the autopilot was disengaged.

The report indicated that the probable cause could not be determined as the examination of the aircraft did not identify any anomalies. However, contributing to the accident was the pilot’s failure to use the manual trim wheel to reset pitch trim.

Cessna 172S registered N813SP and N24485

NTSB reports ANC01FA100 and ATL02LA013 refer to Cessna 172S aircraft incidents in 2001 involving uncommanded pitch trim leading to controllability issues. No problems were identified in the trim or autopilot systems, however, manual control inputs with the autopilot ON were considered to have been a likely cause of those incidents. Both aircraft had the KAP140 autopilot systems fitted and the pilot’s guide for that autopilot contained a warning that manual pilot input was not be applied with the autopilot engaged.

NTSB safety recommendation to Beech Aircraft Corporation

Following a number of accidents and incidents in the United States involving light aircraft autopilot systems, the NTSB issued safety recommendation A-94-163 to Beech Aircraft Corporation, which stated:

Since 1983, a number of Beech airplanes, including the single-engine Model A-36 and twin-engine Models 58P and 95-C55, have been involved in 17 accidents and incidents wherein an autopilot failure, malfunction, or systems-related event was determined to be the cause of or a significant factor contributing to the occurrence. Eight of the accidents resulted in a total of 14 fatalities. In addition, from January 1, 1986, to June 10, 1994, 175 service difficulty reports were submitted to the FAA concerning various autopilot systems installed in Beech airplanes.

If the autopilot malfunctions, or if the airplane is improperly operated with the autopilot engaged, significant deviations of the flightpath, mistrimming of the airplane, or excessive control forces may occur. These may result from a runaway electric trim, or pilot attempts to oppose or overpower the autopilot pitch axis. For example, if a pilot attempts to overpower the pitch axis for more than several seconds, the autopilot trim servo, in most cases, will move the elevator trim tab in a direction that will countermand the pilot’s input. If the pilot continues to restrain the control wheel, the trim tab will continue to operate and the wheel control forces may eventually become overwhelming.

…

A review of the accidents discloses that a significant number might have been prevented if the autopilot system had been used correctly, or if appropriate remedial measures or emergency procedures had been performed to correct an autopilot malfunction or problem.

The NTSB recommendation gave three examples of accidents that had occurred in the early 1990s which involved autopilot systems fitted to Beech aircraft. The NTSB recommended that Beech Aircraft Corporation issue a safety communique regarding the function, operation, and limitations of autopilot systems installed in Beech airplanes, and the need for strict adherence to the prescribed operating and procedural instructions contained in the respective airplane flight manual supplements and autopilot operating manuals. The recommendation also stated that the communique should:

…point out the potential hazards of mistrimming the airplane through pilot-induced or other abnormal operation of the autopilot-electric trim system; and emphasize the importance of thoroughly understanding the remedial measures or emergency procedures that may be necessary to resolve an autopilot malfunction or problem.

Beechcraft (Raytheon Aircraft) responded to the recommendation stating that they had sent a safety communique to all known operators for all Beech airplane models in June 1996. During the ATSB’s investigation two Beechcraft POHs (Beechcraft Baron and Bonanza) that were reviewed had limitations and warnings about manual manipulation of the controls with the autopilot on.

Research on Automation in General Aviation

A United States Federal Aviation Administration research paper DOT/FAA/AM-97/24 titled Automation in General Aviation: Two studies of pilot responses to autopilot functions stated that:

...

The NTSB notes that if an autopilot malfunctions or an airplane is improperly operated with the autopilot engaged, significant deviations from the flightpath, mistrimming of the aircraft or the need for excessive control forces may occur. These problems may result from a runaway electric trim or pilot attempts to oppose or overpower the autopilot pitch axis. In most situations when a pilot attempts to overpower the pitch axis for more than several seconds, the autopilot trim servo will move the elevator trim tab in a direction that will countermand the pilot's input. If the pilot continues to restrain the control yoke and the autopilot/electric trim doesn't automatically disconnect, the trim tab will continue to operate and yoke forces may become overwhelming.

…

Contributing Factors

A number of factors are likely to contribute to the chain of events ultimately leading to an autopilot related accident. These may include, but are not limited to: insufficient pilot training, pilot lack of an underlying model of autopilot behavior, misdiagnosis of malfunction, organizational policies, pragmatic considerations, human performance limitations, and system designs that do not capitalize on human factors principles.

Insufficient training. There is presently no regulation stating that a pilot must receive training in the use of an autopilot before flying with one in an aircraft. Although such training is the rule in Part 121 operations for flight management systems, General Aviation is yet another story. Theoretically, one could fly any aircraft that one was checked out in, and if a model of that aircraft happened to have an autopilot, the pilot would be free to use it without specific instruction. The same is true for GPS and other systems that one could conceivably add to the aircraft. The tempering factors, one would expect, would be that a prudent pilot generally would learn everything possible about the airplane to be flown, particularly if it were owned or regularly flown by that pilot. Additionally, if the aircraft were leased, it would be expected that all potential lessees would be thoroughly checked out in aircraft systems operations prior to being allowed to lease the aircraft, usually for insurance purposes. This is often not the case, however.

Lacking conceptual model. It is also possible that pilots lack an underlying conceptual model of how the various components of the autopilot/auto trim system work in concert or in opposition. It has been argued that the ability to diagnose novel malfunctions (those not specifically encountered before) of a system is directly related to the availability of such a mental model of the system. In the case of general aviation, it is likely that many pilots will not have experienced autopilot failures prior to their first need to respond to one as pilot in command. Thus, the need to have a working knowledge of system structure and functional relationships is important to prevent the first encounter from being the last.

Misdiagnosis. The lack of an adequate conceptual model of the autopilot/autonav systems may also, as pointed out in the Chapel Hill accident example, result in a misdiagnosis of the malfunction, leading the pilot to non-productive actions that may further aggravate the flight control problem.

Organizational policies /pragmatic concerns. The way in which the pilot responds to malfunctions may also be dictated by organizational policy, particularly if the organization is responsible for its own ab initio or continuing flight training. Some organizations prefer that pilots "work with" the autopilot rather than immediately disconnecting it in cases where a malfunction is apparently mild and does not pose an immediate and obvious threat to safe flight. There is also a pragmatic consideration when the pilot is also the aircraft owner. If a service technician is to be called upon to remedy an apparent autopilot malfunction following the termination of the flight, additional data on the aberrant behavior will be helpful in localizing the problem, potentially reducing the time required for diagnostics by the technician and, thus, cost.

Human performance limitations. Both perceptual and motor human performance limitations are likely to affect how a pilot responds to autopilot malfunctions. Detection of malfunctions is decidedly influenced by limitations in visual and aural perception, specifically where a stimulus to be detected is not in or near the line of sight or where the stimulus is not above threshold or is steady state. It has been noted that some auditory alarms go unnoticed by pilots who have high-frequency hearing loss due to a combination of aging and work-place exposure to high-amplitude narrow-band sounds.

Human factors and design issues. It is sometimes the case that installed systems simply do not conform to the standard human factors practices and principles. The instrument panel is a land of infinite space, and not everything can be between zero and fifteen degrees below line of sight and located on the centerline of normal vision. This often results in systems that may be added on or optional equipment being located at the bottom of the radio stack or in the most convenient panel location available. If the unit contains displays that require frequent monitoring for continued safe operation, placement may make this impossible. It is also possible that warnings, be they visual or aural, may not conform to standards. One usual departure is the use of steady-state visual and aural warnings rather than alternating on/off/on warnings, which are more likely to attract the attention of the pilot.

Research on distraction

Researchers (United Kingdom Civil Aviation Authority, 2013^[9]) have found that distraction has been a major factor affecting flight crew allocation of attention, particularly when effective monitoring breaks down. Humans are capable of attending to more than one task through the use of selective attention techniques, however they have limited total cognitive capacity. If one of the tasks consumes all the attentional capacity of a pilot, then task shedding will occur and other, important information may be missed by the pilot. Distraction has been found to have been instrumental in the breakdown of monitoring of aircrafts’ instruments and position in many accident investigations.

In the case of this accident, the time between the final descent and impact with terrain was around 20 seconds. Based on the recorded data, the avionics manufacturer indicated that there was sufficient time to recover from the descent and the probable out‑of‑trim situation before impact with terrain. They contended that the pilot’s focus of attention was likely to have been on the autopilot, rather than flying by visual references outside the aircraft. As shown in the research above, distraction can lead to a diversion of attention away from the primary task of flying the aircraft by a secondary distracting stimulus such as the autopilot.

The ATSB was unable to confirm if distraction led to a delay in recovery of the aircraft to normal flight. However, it could not be ruled out as a possibility.

Federal Aviation Administration Advanced Avionics Handbook

Federal Aviation Administration educational material FAA-H-8083-6 titled Advanced Avionics Handbook states that:

The Advanced Avionics Handbook is a new publication designed to provide general aviation users with comprehensive information on advanced avionics equipment available in technically advanced aircraft. This handbook introduces the pilot to flight operations in aircraft with the latest integrated “glass cockpit” advanced avionics systems.

The chapter on Automated Flight Control included a section titled ‘How to use an Autopilot Function’ which stated the following text:

6. Allow the FD/autopilot to accomplish the modes selected and programmed without interference, or disengage the unit. Do not attempt to “help” the autopilot perform a task. In some instances, this has caused the autopilot to falsely sense adverse conditions and trim to the limit to accomplish its tasking. In more than a few events, this has resulted in a total loss of control and a crash.

New investigation techniques

Flight data recording

The Cessna 172S has on-board flight data recording capability incorporated into the avionics system. This is becoming more common in newer light aircraft types. Flight data log files can be used for flight training review, trend analysis and troubleshooting defects. In this case, the downloaded data, stored on a removable secure data (SD) card, provided important information that assisted with identifying the contributing factors to this accident.

A previous accident investigated by the ATSB involving a Cessna 172S had a flight data log SD card destroyed by impact forces. Therefore, valuable accident investigation information was lost. In the accident involving ZEW however, the SD card was liberated from its housing and found 20 m from the main aircraft wreckage in a state that permitted the data to be recovered.

Some light aircraft types are fitted with integrated avionics systems that record a duplicate flight data log file to a crash survivable module, similar to that of a flight data recorder in larger aircraft types. This has, and will, continue to protect a valuable source of information for accident investigations worldwide.

2. The pilot’s Recreational Pilot Licence was approved by the Civil Aviation Safety Authority two days after the accident.
3. AC 25.1329-1C – US Federal Aviation Administration Advisory Circular that provides an acceptable means of compliance with the regulatory requirements contained in Part 25 (larger aircraft types) of the US Federal Aviation Regulations for the certification of autopilot systems.
4. The post impact position of the elevator trim was considered unreliable due to significant wreckage disruption.
5. The increase in engine RPM and fuel flow was due to the fixed pitch propeller windmilling effect as the airspeed increased.
6. Secondary radar returns are dependent on a transponder in the aircraft replying to an interrogation from the from a ground station. An aircraft with its transponder operating is more easily and reliably detected by radar and, depending on the mode selected by the pilot; the aircraft pressure altitude is also displayed to the air traffic controller.
7. Code 1200 is the transponder code required when operating VFR in class E and G airspace.
8. The Cessna 172S autopilot is included in this category.
9. United Kingdom Civil Aviation Authority. (2013). Monitoring matters: Guidance on the development of pilot monitoring skills. Loss of control action group. CAA Paper 2013/02.

Introduction

During the pilot’s first solo navigation training flight, and while in the cruise, the aircraft pitched down, descended rapidly, and impacted with rising terrain. The on-site examination of the wreckage and analysis of the recorded flight data indicated that the aircraft was likely in a serviceable condition prior to the accident.

The witnesses in the area of the accident site indicated that Black Mount (the high terrain feature) and the aircraft were not obscured by cloud in the final moments of flight. That information, along with the forecast and actual weather information indicated that a loss of visual reference was not a factor in the accident.

The recorded flight data showed that just prior to the accident, the autopilot was being used in a vertical mode when the aircraft pitched down with a resultant increase in vertical descent rate and airspeed. The witness interviews and aircraft attitude evidence at impact indicated that the pilot had stopped the aircraft’s descent, and was in the process of recovery when the aircraft impacted rising terrain.

The cruise altitude equated to about 800 ft above ground level (AGL) in the local area of the accident site. That was below the minimum stipulated training flight height of 1,000 ft AGL, and the minimum cruise height for flight training autopilot operation of 1,500 ft AGL. The lower than normal altitude limited the pilot’s time to diagnose, react, and recover from an abnormal and emergency situation.

Downloaded data from other Garmin G1000 (G1000) equipped aircraft included training flights that either, operated at an altitude that was 500 ft higher than the accident flight over the same area, or flew around the high terrain feature in order to maintain a minimum altitude of 1,000 ft AGL. The lower altitude used by the pilot on the accident flight was likely due to the extent and base of the cloud.

The following analysis will examine the pitch-down event with the autopilot ON, pilot experience, pilot training, and manufacturer advice, limitations, and warnings.

Autopilot data analysis

The flight data showed that in total, the autopilot was used for about one third of the flight in various heading and vertical modes. This was considered by the flight training organisation to be excessive and beyond the instruction to only use it for brief periods during high workload situations.

The data showed numerous occasions where multiple and rapid flight director mode changes were made, followed by manual altitude adjustments. This indicated that the pilot may not have had an accurate mental model of the flight director modes and was not effective at controlling the aircraft’s altitude utilising the autopilot. Alternatively, it may have been indicative of the pilot experimenting with the autopilot functions, or perhaps a combination of both. The last 24 seconds of recorded data showed that the vertical modes had been changed between pitch and altitude hold six times.

At the initiation of the pitch-down event, the autopilot was on and engaged in a vertical mode. The pitch attitude did not match the pitch command recorded. Additionally, the final descent rate and pitch attitude went beyond the autopilot maximum rate limitations before the autopilot was disconnected. This indicated it was likely that the pilot had manually manipulated the flight controls during autopilot operation.

The autopilot validation flights conducted by the flight training organisation showed that if a rearward control input was made on the control yoke with the autopilot engaged in a vertical mode, the autopilot would trim against this input in order to maintain the set pitch attitude or altitude reference. Control forces continued to increase over time as the backpressure was maintained. Once the backpressure was released, the aircraft descended rapidly in an out of trim condition. Recovery from the descent was the same as the emergency actions required for an autopilot malfunction, which was, apply backpressure on the control yoke, switch the autopilot off, and re-trim the aircraft. The validation flights and accident flight data was compared and showed numerous similarities, such as:

• significant pitch down beyond the autopilot capability
• high vertical descent rates beyond the autopilot capability
• a mismatch between actual pitch and flight director pitch commands
• the autopilot remaining on in a vertical hold mode.

The similarities in data indicated a likely scenario for the accident sequence. That is, the pilot probably, but unintentionally, induced a mistrim situation by applying backpressure to the control yoke with the autopilot switched ON and engaged in a vertical mode. The increased control column force may have led the pilot to release, and/or decrease the backpressure on the flight controls when a significant out of trim condition existed. Analysis of the data indicated that the pilot had no more than 20 seconds between the start of the descent until the aircraft impacted with terrain. Despite this, recovery had commenced and the aircraft descent had been stopped. However, given the terrain was rising in front of the aircraft, this action was insufficient to prevent the impact.

Immediately prior to the pitch‑down event, the aircraft was being operated with the autopilot engaged about 700 ft below the minimum height permitted by the flight training organisation (1,500 ft AGL). Although that relatively low operating height was probably due to the extent and base of the cloud, it was insufficient for the pilot to recover the aircraft from the autopilot‑related mistrim.

The level pitch attitude of the aircraft at impact indicated that, had the weather permitted visual flight at the operator’s minimum autopilot height, the pilot would probably have recovered from a similar mistrim event.

Pilot experience, training and assessment

At the time of the accident, there was no regulatory requirement in the Part 61 Manual of Standards (MOS) for pilots to demonstrate knowledge and competence of the autopilot, its limitations, and the effects of trim until they had reached the Private Pilot Licence (PPL) level. Despite this, some pilots were operating autopilots as part of their training at the Recreational Pilot Licence (RPL) stage. Although pilots may have obtained some level of autopilot systems knowledge during their RPL training, competence in the use of those systems was not required to be formally assessed and therefore could not be assured.

In July 2017, the Civil Aviation Safety Authority (CASA) introduced an element into the Flight Examiners Handbook that required pilots to demonstrate knowledge of the autopilot system if fitted to an aircraft being used for an RPL assessment. At the time of writing this report CASA was in the process of modifying the Manual of Standards (MOS) to reflect the additional training to support the assessment required by the handbook.

CASA indicated that pilots operating aircraft with special features such as an autopilot are required to learn about them in accordance with the general competency rules in regulation CASR 61.385. There was no cross reference to this in the MOS or the flight examiners handbook at the time of the accident or at the time of drafting this report.

Although not mentioned in the MOS or flight examiners handbook at the RPL level, the flight training organisation did take measures to ensure student pilots operating the more complex G1000 autopilot equipped Cessna aircraft were familiar with the operation of heading and altitude hold modes. However, the pilot’s underpinning knowledge of the autopilot system could not be ascertained due to the absence of formal assessment against a competency standard.

The flight training organisation’s position was that the autopilot should only be used in high workload situations, or in the case of inadvertent flight into cloud. Examination of the recorded flight data indicated that the pilot used the autopilot extensively during the accident flight. In addition, the pilot’s use of various flight modes demonstrated a limited understanding of, and/or experimentation with, the autopilot system, its operation, and limitations. As such, it was probable that the pilot’s use of the autopilot outside of the basic modes, along with a limited understanding of the autopilot system, led to unsafe operation of the aircraft.

Pilot decision making, reaction times and distraction

As discussed in the Federal Aviation Administration (FAA) research paper Automation in General Aviation, insufficient autopilot training and a lack of conceptual model (how it works) may have undesired effects that lead to autopilot mishandling, misdiagnosis of autopilot issues and slow reaction times.

In the context of the VH-ZEW (ZEW) accident, the lack of underpinning knowledge may have led to the inexperienced student pilot unintentionally mishandling the operation of the autopilot. As a result of this, it would have taken some time to recognise that the autopilot had placed the aircraft in an out‑of‑trim condition, with limited time available to correct the situation. A slower reaction time may have been exacerbated by the lack of an audible alert for mistrim situations.

Research into distraction also indicated that pilots’ attention may be drawn away from the primary task of flying the aircraft by use of visual outside cues, if another secondary task such as resolving a technical issue or misunderstanding becomes the primary focus. While the avionics manufacturer considered distraction to be the reason for the apparent delay in recovering the aircraft, there was insufficient evidence to determine if that occurred. Similarly, the degree to which insufficient knowledge of the autopilot system may have played a part in the accident could not be determined.

Autopilot operational guidance limitations and warnings

The FAA Advanced Avionics Handbook indicated that manual manipulation of the flight controls with the autopilot on should be avoided, as it has led to total loss of control and accidents on several occasions. That was supported by research, which identified numerous small aircraft accidents and incidents relating to the issue.

Student pilots are instructed to read aircraft/avionics manufacturers operational guidance material in order to understand the various aircraft systems and operate the aircraft safely. The operational documentation for the superseded Cessna 172S Bendix/King KAP140 autopilot system contained limitations, cautions, and warnings about the manual manipulation of the flight controls during autopilot operation. Additionally, the system also incorporated an aural warning, to alert pilots if a mistrim or trim movement was occurring. In contrast, the newer integrated Garmin GFC700 (GFC700) autopilot system fitted to ZEW had no limitations, cautions, or warnings in the operational guidance documentation and no aural alert for mistrim or pitch trim movement. This had the potential to reduce pilot’s underpinning knowledge of the system and real time awareness of an issue.

The ATSB conducted a search of aircraft manuals for several other aircraft types that have the G1000/GFC700 fitted. About half of those aircraft types had relevant written limitations, cautions, and warnings.

The Cessna 172 is often used as a primary training aircraft, whose pilots inevitably have limited flight experience and a low knowledge base. Pilots at that level are reliant on operational guidance material and systems training to increase their knowledge on how to safely operate an aircraft. In the case of the ZEW accident, it was likely that the relatively inexperienced pilot was not aware of how the autopilot would react to manual control inputs, and that the autopilot had placed the aircraft in an out of trim situation. In the context that the occurrence pilot had not complied with the flight training organisation’s requirements regarding the use of the autopilot, it is difficult to conclude that additional guidance or alerting relating to its use would have altered the outcome of this accident. However, the inclusion of limitations, cautions, and warnings in the aircraft documentation, along with aural warnings would likely enhance pilot awareness of such situations and the associated hazards. Following on from those inclusions, it is of paramount importance that pilots are educated about the hazards involved in the manual manipulation of the flight controls with the autopilot on.

From the evidence available, the following findings are made with respect to the impact with terrain of a Cessna Aircraft Company 172S, registered VH-ZEW that occurred in Millbrook, Vic. on 08 September 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• During the pilot’s first solo navigation training flight, while cruising at about 800 ft above ground level, the aircraft pitched down, descended rapidly, and impacted with rising terrain. It is likely that the pilot manipulated the flight controls while the autopilot was engaged in a vertical mode. Consequently, the autopilot adjusted pitch trim to oppose manual control inputs, which led to a mistrim condition. For reasons that could not be established the pilot was unable to identify and/or correct the mistrim and recover the aircraft’s subsequent descent in the limited time available.
• While probably influenced by the extent and base of the cloud, the autopilot was used below the minimum height required by the flight training organisation and too low to permit the pilot to recover the aircraft from the mistrim condition.

Other factors that increased risk

• The lack of manufacturer written advice, limitations, cautions, or warnings (written or aural) about autopilot response to manual pilot control inputs meant that pilots may be unaware that their actions can lead to significant out of trim situations, and associated aircraft control issues [Safety Issue].
• At the time of the accident the Civil Aviation Safety Authority’s Part 61 Manual of Standards schedule 3 for a Recreational Pilots Licence (RPL) did not specify that flight training organisations include a requirement for knowledge of all aircraft systems used by a pilot at an RPL level.
• The flight training organisation incorporated some auto flight systems training at the Recreational Pilots Licence (RPL) level so that student pilots could utilise the system under limited circumstances. However, student pilots were not formally assessed against a competency standard to ensure they had an appropriate level of knowledge of auto flight systems, including limitations, cautions and warnings prior to use.

The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Autopilot advice, limitations cautions and warnings (written and audible)

Safety issue numbers: AO-2015-105-SI-01 and AO-2015-105-SI-02

Safety issues description: The lack of manufacturer written advice, limitations, cautions, or warnings (written or aural) about autopilot response to manual pilot control inputs meant that pilots may be unaware that their actions can lead to significant out of trim situations, and associated aircraft control issues.

Proactive safety action

Flight training organisation

Following the accident, the flight training organisation conducted flight tests to determine autopilot reaction to pilot flight control inputs. The results of that testing was shared with the ATSB. Following that testing RMIT amended its standard operating procedures to include the following:

Warning: Pilots are to note that if a force is applied to control column whilst the autopilot is engaged, that the aircraft’s autopilot system will trim against the control column force that the pilot has applied. This can lead the aircraft to be in a significantly mistrimmed situation, and loss of control is possible. The GFC700 Autopilot will give no audible indication when this mistrim situation is developing.

A staff meeting was also held on the 17 August 2016 to discuss the outcome of the flight testing of the autopilot system. It was emphasised to the flight instructors that they must make their students aware of the risks of manipulating the controls with the autopilot on as a mistrim will occur as a consequence. Emphasis was also placed on the need to ensure the autopilot system before take-off checklist was conducted correctly to ensure the correct mode selection and ability to overpower the system.

A check of the safety management system was conducted in an effort to identify any other autopilot related issues. None were identified.

Sources of information

The sources of information during the investigation included the:

• flight training organisation
• pilot’s instructor
• witnesses near the accident site
• pilot operating in the area of the accident site
• Victorian Police Department
• Victorian Institute of Forensic Medicine
• Bureau of Meteorology (BoM)
• Airservices Australia
• aircraft manufacturer
• avionics manufacturer
• Civil Aviation Safety Authority (CASA)
• United States National Transportation Safety Board (NTSB) and Federal Aviation Administration (FAA).

References

US Department of Transportation, Federal Aviation Administration, FAA-H-8083-6, 2009, Advanced Avionics Handbook, Preface & Chapter 4-2.

U.S. Department of Transportation, Civil Aeromedical Institute, Federal Aviation Administration, Dennis B. Beringer & Howard C. Harris Jr. DOT/FAA/AM-97/24, 1997, Automation in General Aviation: Two Studies of Pilot Responses to Autopilot Malfunctions, pp. 2-3.

United Kingdom Civil Aviation Authority. (2013). Monitoring matters: Guidance on the development of pilot monitoring skills. Loss of control action group. CAA Paper 2013/02.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the pilot’s next of kin, the flight training organisation, the pilot’s instructor, the aircraft manufacturer, the avionics manufacturer, the NTSB, the BoM, the Victorian Coroner’s representative and CASA.

Submissions were received from the flight training organisation, the aircraft and avionics manufacturers and CASA. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.