Collision with terrain following an engine power loss involving Cessna 172M, VH‑WTQ, 12 NM (22 km) north-west of Agnes Water, Queensland, on 10 January 2017

Overview

On 10 January 2017, a Cessna 172M, registered VH-WTQ, was being operated by Wyndham Aviation Pty Ltd on a passenger charter flight from Agnes Water aeroplane landing area (ALA), Queensland to a beach ALA on Middle Island, about 12 NM (22 km) to the north-west. There was a pilot and three passengers on board.

The flight departed at about 1030 Eastern Standard Time.^[1] At 1036 the pilot commenced descent and soon after he was approaching the landing area from the south to conduct an airborne inspection of the ALA. While flying parallel to the beach and landing area, at about 60 ft above mean sea level (AMSL), the engine sustained a sudden and total power loss.

After conducting initial checks, the pilot turned left towards the beach. During the continued turn, the aircraft impacted the beach. One of the rear-seat passengers was fatally injured and the other three occupants sustained serious injuries. The aircraft was destroyed.

Background information about the flight

On the morning of 10 January 2017, the operator was transporting 12 passengers from Agnes Water ALA to the Middle Island ALA, which was located next to a camp site where the passengers would be staying.

The operator utilised two Cessna 172 aircraft for these flights: VH-JER (flown by the chief pilot) and VH-WTQ (flown by the operator’s other pilot). Each aircraft could carry a maximum of three passengers. Therefore, the operator planned for each of the pilots to conduct two flights from Agnes Water to Middle Island.

The accident involving VH-WTQ occurred on the first flight of the day. VH-WTQ departed first, with VH-JER departing a couple of minutes behind.

The operator’s passenger charter flights were conducted under visual flight rules (VFR). Weather conditions were fine and clear for the flight, and the pilots reported there was a south-easterly wind of about 10–15 kt. VH-WTQ had sufficient fuel on board for the flight.

The ATSB’s examination of the sequence of events during the flight was based on interview information and recorded data. In particular:

• Following the accident, the ATSB successfully recovered data from a global positioning system (GPS) unit on board VH-WTQ. This GPS data included recorded values of time, latitude, longitude and altitude, which updated every 6–10 seconds throughout the accident flight.
• The passenger in the front right seat recorded a video of the entire flight on a mobile phone. The file primarily included footage of the view outside the aircraft, but also included some footage of inside the aircraft, including occasional footage of cockpit instruments. For the purpose of the investigation, the video footage elapsed time was synchronised with the GPS data time.^[2]

Take-off, climb and cruise

The pilot of VH-WTQ commenced the take-off roll at Agnes Water to the north at 1030:06. The aircraft reached an altitude of about 1,000 ft AMSL at about 1032:50, and the pilot levelled off soon after.

Figure 1 shows the track of the aircraft for the whole flight, based on the GPS data.

Figure 1: VH-WTQ’s flight path between Agnes Water ALA and the accident location on Middle Island

The flight path was based on data downloaded from the GPS unit on the aircraft. The insert image shows the location of the accident on a map of Australia. 
Source: Google earth, modified by the ATSB.

The operator’s passenger charter flights to the beach ALA routinely included various manoeuvres while en route to provide some additional enjoyment for the passengers (see Manoeuvres during flights). Accordingly, while en route to Middle Island, the pilot of VH-WTQ conducted a series of manoeuvres including steep turns, steep climbs and descents and yawing^[3] the aircraft left and right. Recorded GPS and radar data indicated that, during these manoeuvres, the aircraft’s altitude ranged between about 600 ft and 1,000 ft.

Descent

At about 1036:15, the pilot commenced the descent. At this time the aircraft was positioned above the main beach on Middle Island at an altitude of about 750 ft, heading north (Figure 1).

The GPS and radar data indicated that, during the descent, the aircraft had a constant groundspeed of about 125 kt and an average descent rate of about 400 ft/min. Audio analysis of the video footage indicated that the engine/propeller speed was about 2,670 revolutions per minute (RPM).

Because the pilot of VH-WTQ was conducting the first of the operator’s flights of the day to Middle Island ALA, he was required by the operator to conduct an airborne inspection of the beach landing area to ensure the landing surface was suitable.

Due to the surface wind direction, the pilot intended to land on the beach heading to the south. Consistent with the operator’s normal practices, he planned to descend close to the beach and inspect the landing area while flying to the north, in a clean configuration (no flap) and at normal cruise speed. He then planned to climb to about 500 ft, conduct a turn around Bustard Head and come back to land to the south (see Review of airborne inspections at Middle Island ALA).

Figure 2 shows the last 36 seconds of recorded GPS data (represented by the red line). As indicated in the figure, at 1037:26, the aircraft was approaching the southern end of the landing area and still descending.

Figure 2: VH-WTQ’s flight path just prior to the accident

This image shows the altitude and position data from the last five recorded data points prior to impact. The red lines are direct connections between each recorded data point and do not represent the aircraft’s actual flight path between points. The landing area is based on reviewing the GPS data for many previous landings; most landings to the south would use the northern end of the area. The Google Earth image was taken in May 2016, and reflects conditions with a lower tide than at the time of the accident.

Source: Google earth, modified by the ATSB.

Engine power loss

The video footage indicated that, at 1037:34, the engine sustained a sudden power loss. At the time of the power loss, the aircraft was above the water and close to the beach abeam the landing area. The aircraft was at about 60 ft (see GPS information) and had a groundspeed of about 124 kt (about 230 km/h). Figure 3 provides a still image from the video footage of the view outside the aircraft at the time of the engine power loss.

Figure 3: A still image taken from the video footage at the time of engine power loss (1037:34)

The image shows Bustard Head in the background (to the north). The vertical, black areas are the propeller blades captured by the video footage.

Source: Queensland Police Service.

The pilot stated that, just prior to the power loss, he had pulled back the throttle slightly. He recalled that as soon as he did this the engine suddenly stopped, and he realised that there had been a total power loss. He later described the power loss as being similar to the mixture control being pulled back.

The pilot reported that, immediately following the power loss, he conducted checks of the aircraft’s systems to identify the reason for the problem. He stated he checked the master switch (ON), magnetos (selected to BOTH), fuel selector (selected to BOTH tanks) and mixture (full rich), and could not identify the problem. He said that he had his right hand on the throttle with full power selected.

The pilot stated that he had very limited time to make a decision about how to respond to the emergency situation. The aircraft was descending and the speed was decreasing, and he did not believe he had any suitable emergency landing options available ahead (within a narrow arc of his current heading). He thought that if he continued straight ahead the aircraft would end up in the channel between the landing area and Bustard Head (given his current position, aircraft configuration, airspeed and tailwind). He also believed that attempting to ditch in the water would involve a very high risk, and therefore he wanted to avoid a water landing.

Figure 4 shows the view of the remaining landing area at 1037:36, 2 seconds after the engine power loss. This shows an area of beach visible ahead, but does not show a further area of beach that was available for an emergency landing around a bend to the left (see Figure 2 and Beach available for an emergency landing north of the landing area).

Figure 4: A still image taken from the video footage 2 seconds after engine power loss (1037:36)

At the time this image was taken the phone camera was oriented to the left of the aircraft’s heading. The image shows an area of sand on Middle Island beach, just prior to a bend to the left with further beach beyond.

Source: Queensland Police Service.

The pilot recalled that, having decided that he wanted to avoid a water landing, he then looked for the best place on the beach to conduct an emergency landing. During this process he raised the aircraft’s nose to gain height and achieve the best glide speed (70 kt), and he decided the safest option was to turn left towards the beach (to a heading about 90º left of the aircraft’s current heading). He stated that his intention at that time was not to land on the beach but to simply get the aircraft to the beach.

The video footage showed that, at 1037:37, the aircraft commenced a slight turn to the right in a nose-high attitude (climbing), and at 1037:43 the aircraft commenced the left turn with a bank angle of about 30–40º back towards the beach (while still climbing).

During the left turn, at 1037:52, the stall warning started to sound intermittently. At about this time the aircraft also started descending. The pilot recalled that, as he approached the beach, he realised the aircraft may hit a large sand dune behind the beach. He therefore continued the left turn, using the rudder to swing the tail of the aircraft around, to avoid the sand dune.

At 1037:59, the aircraft collided with terrain. Based on the video footage, the indicated airspeed just prior to impact was about 60 kt (about 110 km/h) and the indicated descent rate was over 600 ft/min. The aircraft’s bank angle increased to about 60° just prior to impact, and the aircraft had a significant nose-down attitude. The location of the accident site is shown in Figure 2.

One of the rear-seat passengers was fatally injured and the other three occupants sustained serious injuries during the impact. The aircraft was destroyed. Figure 5 shows the aircraft wreckage (see also Wreckage and impact information).

Figure 5: Accident site, facing north-east with Bustard Head in the background

Source: ATSB.

Post-impact events

An employee at the camp site on Middle Island had conducted an inspection of the area of beach where arriving aircraft taxied and parked, and he had placed a marker on the beach to indicate the limit of the suitable taxiing area. He was waiting near the landing area together with a guest staying at the camp site when they observed VH-WTQ fly past and then soon after impact terrain. The employee told the guest to go to the camp site and call emergency services while he proceeded to the aircraft to provide assistance.

The chief pilot, flying VH-JER, was about 2 NM (4 km) behind VH-WTQ. He reported that he did not see the accident sequence or hear a MAYDAY^[4] call but observed the wreckage of VH-WTQ as he approached the landing area. He immediately contacted air traffic services and made a PAN PAN^[5] call to advise there had been an accident. He landed soon after at the beach ALA. Figure 6 shows the area around the accident site, as viewed from VH-JER immediately following the accident.

Figure 6: Accident site, as viewed from VH-JER

Source: Queensland Police Service.

Following the impact, the aircraft cabin was inverted, and the occupants were all held in place by their restraints. A significant amount of fuel was observed to be leaking from the aircraft’s fuel tanks. The camp site employee, the chief pilot and other first responders extracted the occupants and moved them away from the wreckage to provide first aid. One of the rear-seat passengers was unresponsive, so the first responders provided cardiopulmonary resuscitation (CPR) but she could not be revived. A subsequent post-mortem examination determined that her injuries were not survivable (see also Occupant injuries).

Emergency services arrived on the scene at about 1143.

__________

1. Eastern Standard Time (EST) is Coordinated Universal Time (UTC) + 10 hours.
2. The last recorded GPS data point occurred at 1037:56. This was estimated to have been about 3 seconds prior to impact. The take-off commenced at an elapsed time of 14 seconds on the video file and the impact occurred at an elapsed time of 8 minutes and 7 seconds.
3. Yawing: the motion of an aircraft about its vertical or normal axis.
4. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
5. PAN PAN: an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Pilot information

Qualifications and experience

The pilot of the accident flight was issued with a Private Pilot (Aeroplane) Licence (PPL) in December 1978 and a Commercial Pilot (Aeroplane) Licence (CPL) in October 2008. His licence included a rating for single-engine aircraft under 5,700 kg maximum take-off weight (MTOW). He also had endorsements for manual propeller pitch control and retractable landing gear. The pilot did not hold a low-level flight rating or aerobatic flight activity endorsement.

The pilot had been employed on a casual basis by Wyndham Aviation for about 6 years, primarily conducting passenger charter flights from Agnes Water to Middle Island or the other beach aeroplane landing area (ALA) the operator regularly used (known as Aircraft Beach). Based on figures from his logbook, it was estimated that he had conducted over 1,100 flights from Agnes Water to a beach ALA, with many additional flights between the two beach ALAs.

Overall, the pilot had approximately 3,550 hours total flying experience. He had flown about 62 hours in the last 90 days, which included 35 hours in VH-WTQ conducting flights to and from the beach ALAs.

The pilot of the accident flight and the chief pilot both reported that the pilot of the accident flight normally flew VH-WTQ and the chief pilot normally flew VH-JER. A comparison of the pilot’s logbook and data downloaded from the GPS unit on board VH-WTQ indicated that the pilot conducted almost all of the flights in VH-WTQ during the period from 12 November 2016 to 10 January 2017.

Flight reviews and proficiency checks

To exercise the privileges of his licences and rating, the pilot was required to complete an aeroplane flight review (AFR) every 2 years with an approved instructor. The requirements of a flight review were met when the instructor conducting the review was satisfied the pilot had demonstrated competency for the applicable licences and ratings according to the Civil Aviation Safety Authority (CASA) Part 61 Manual of Standards (MOS). Flight instructors were responsible for designing appropriate content for a pilot’s flight review.

The pilot last completed an AFR on 22 August 2016. The AFR was conducted from Agnes Water ALA in a Beechcraft A36 Bonanza. The instructor recalled that the review covered the basics required for a flight review. He could not recall conducting any simulated engine failures after take-off or having any discussions about such an event (and this was not a formal requirement) ⁶. However, there was a simulated engine failure flown to a practice forced landing to a beach that was terminated with a go-around from about 200–300 ft.

The instructor who conducted the AFR was familiar with the type of activity undertaken by the operator. However, the AFR was not required to examine the pilot’s knowledge of the operator’s procedures or demonstrate competency in using those procedures, including the procedures for conducting a precautionary search and landing or an airborne inspection of a beach ALA.

Records supplied by the operator showed that the pilot had satisfactorily completed an annual emergency procedures proficiency check on 20 August 2016, which was valid until 20 August 2017 (see Training and checking).

Medical information and recent history

The pilot held a class 1 medical certificate, which was valid until 6 October 2017. The certificate included the restriction that reading correction be available when exercising the privileges of the licence, and the pilot was observed to be wearing spectacles in photographs taken just prior to and during the flight. No significant medical concerns were noted in the pilot’s recent aviation medical examinations, and he reported that he had no medical issues on the day of the accident.

The pilot reported that he was well rested and had been sleeping normally in the days prior to the accident flight. His last recorded flights prior to 10 January 2017 were on 2 January (0.8 hours flight time^[7]) and 4 January (1.2 hours flight time). These flights were conducted in VH-WTQ and mostly involved flights between Agnes Water and Middle Island or Aircraft Beach, with the other flight being a scenic flight over the Middle Island area.

Aircraft information

General information

The Cessna 172M is a four-seat, high-wing, all metal, unpressurised aircraft with a fixed landing gear. It has a single, reciprocating piston engine driving a fixed-pitch propeller. The Cessna 172 was certified to carry a maximum of four occupants.

VH-WTQ was manufactured in 1973 and acquired by Wyndham Aviation in October 2013. In 2015 the aircraft was fitted with wider than normal tyres to assist with beach operations.

Tables 1, 2 and 3 provide details of VH-WTQ’s airframe, engine and propeller. The total time in service (TTIS) and other times in the tables are based on the information in the aircraft’s current maintenance release^[8] and other maintenance documentation. A detailed review of the available information identified that the documented flight times were less than the ATSB’s estimated flight times, as indicated in the tables (see Airworthiness and maintenance). All flight times in the tables refer to the situation just prior to the accident flight, which involved about 0.1 flight hours prior to the accident.

Table 1: Aircraft information

Manufacturer and model:	Cessna Aircraft Company 172M
Year of manufacture:	1973
Serial number:	17261931
Registration:	VH-WTQ
Operator:	Wyndham Aviation Pty Ltd
Certificate of registration:	21 Oct 2013 (issue date)
Certificate of airworthiness:	28 Nov 1973 (issue date)
Total time in service:	6,838.4 flight hours (documented)[9] 6,934.9 flight hours (estimated)
Maintenance release:	A166148 valid until 6,904.7 flight hours (documented) or 20 Sep 2017 (whichever came first)
Time since last maintenance:	33.7 flight hours (documented) 43.8 hours (estimated)

Table 2: Engine information

Manufacturer:	Lycoming
Model:	0-320-D2J
Type:	Normally aspirated, four-cylinder piston engine
Serial number:	L-20550-39E
Time since overhaul:	633.5 flight hours (documented) 730.0 flight hours (estimated)
Total time in service:	Unknown

Table 3: Propeller information

Manufacturer:	McCauley
Model:	1C160/DTM7557M1
Type:	Two blade, fixed pitch
Serial number:	A6D44009
Total time in service:	633.5 flight hours since new (documented) 730.0 flight hours since new (estimated)

Airworthiness and maintenance

Relevant information regarding VH-WTQ’s airworthiness and maintenance history included the following:

• The aircraft had a current certificate of registration and certificate of airworthiness.
• The aircraft was maintained in accordance with CASA’s maintenance schedule 5^[10] and all airworthiness directives (ADs) applicable to the aircraft. Maintenance schedule 5 outlined requirements for daily inspections (conducted prior to the first flight of each day) and periodic inspections (conducted every 100 hours or 12 months, whichever came first).
• The chief pilot was the operator’s head of aircraft airworthiness and maintenance control (HAAMC) (see also Personnel).
• All scheduled and unscheduled maintenance (except daily inspections, oil and oil filter changes and other maintenance allowed to be conducted by pilots) was conducted by an external maintenance organisation.
• The engine was required to be overhauled every 2,000 flight hours. An overhauled engine was installed in the aircraft in January 2013.
• The last periodic inspection was conducted on 20 September 2016. Each periodic inspection included (among other things) an engine compression check, engine run and functional check, and inspections of the engine, oil system, ignition system, induction system and fuel system. The inspection of the fuel system included (among other things) draining and flushing the carburettor and removing and inspecting the fuel strainer.
• The aircraft’s maintenance documentation and worksheets were examined, and there were no ongoing or outstanding defects identified with the aircraft.
• There were no outstanding defects or inspections listed on the aircraft’s current maintenance release, issued on 20 September 2016.
• The chief pilot and the pilot of the accident flight both reported that they conducted a daily inspection of VH-WTQ prior to the first flight of a day on those days when the pilot of the accident flight was conducting flights.^[11] Neither pilot identified any problems with the aircraft prior to the accident flight.
• The pilot of the accident flight routinely flew VH-WTQ and had conducted most of the recent flights in the aircraft. He reported that there were no recent or ongoing problems with the aircraft, and that the engine performed well during the flight up until the time of the power loss.

The ATSB identified that it was very likely that the aircraft’s flight time documented on the aircraft’s last three maintenance releases underestimated the aircraft’s actual flight time (see Appendix A). More specifically:

• A comparison of the flight time recorded on the GPS unit with the flight time documented on the current maintenance release for the period 14 November 2016 to 4 January 2017 indicated that the maintenance release flight time underestimated the actual (GPS-based) flight time by 5.3 hours (or 28 per cent) during this period. The underestimation was associated with a number of discrepancies, including the flight time associated with many flights between Agnes Water and a beach ALA being slightly underestimated, short flights between the beach ALAs not being included, and some flights between Agnes Water and a beach ALA not being included.
• The aircraft was fitted with an hour meter that recorded the aircraft’s flight time. The operator documented the current hour meter readings on the aircraft’s maintenance release up until 29 May 2015.
• Based on an hour meter reading documented in maintenance worksheets on 12 November 2015, the flight time documented on the maintenance releases underestimated the actual flight time by 62.2 hours (or about 40 per cent) during the period from the periodic inspection on 1 May 2015 to the next periodic inspection on 12 November 2015.
• Based on the hour meter reading after the aircraft impacted terrain on 10 January 2017, the flight time documented on the maintenance releases underestimated the actual flight time by 34.3 hours (or about 20 per cent) during the period from the periodic inspection on 12 November 2015 to 10 January 2017.
• Overall, a comparison of the flight time obtained from hour meter readings and the flight time documented on the aircraft’s maintenance releases indicated that the maintenance release figures underestimated the flight time by 96.5 hours (or about 32 per cent) during the period from 1 May 2015 to 10 January 2017. During this period, 207.3 flight hours were documented whereas the ATSB estimated that 303.8 flight hours were conducted.
• The chief pilot reported that he normally entered the flight times on the maintenance releases. He advised that he was unaware that the flight hours documented on the maintenance releases underestimated the actual flight times.

Based on the aircraft’s estimated flight time, from 1 May 2015 until 10 January 2017 three periodic (100 hourly) inspections should have been conducted but only two periodic inspections were conducted. However, the last periodic inspection (20 September 2016) was conducted about 43.8 hours prior to the accident flight. Except for the periodic inspections and oil and oil filter changes (see below), no other scheduled maintenance requirements appeared to be affected by the underestimation of the aircraft’s flight time.

An examination of the aircraft’s recent maintenance releases identified some other anomalies. These included:

• Between periodic inspections, oil and oil filter changes were required. The requirement for the engine fitted to VH-WTQ was for an oil and oil filter change after 50 hours flight time or 4 months (whichever came first).^[12] On all VH-WTQ’s maintenance releases from 22 May 2014 until the time of the accident, part 1 of the maintenance release included a 50-hour requirement for the oil and oil filter change but the 4-month requirement was not stated. The maintenance organisation that conducted the periodic inspections and issued the maintenance releases advised the ATSB that it had not understood there was a 4-month requirement in addition to the 50-hour requirement.
• Given the time period between the periodic inspections in November 2015 and September 2016 (over 10 months), two oil and oil filter changes should have been conducted during this period, and both documented on the maintenance release.
• Between the second last periodic inspection on 12 November 2015 and the last periodic inspection on 20 September 2016, there was no annotation on the maintenance release to certify that an oil and oil filter change had been conducted. The aircraft continued to be flown after the specified TTIS.^[13] When asked in 2019, the chief pilot could not recall whether the oil and oil filter change was conducted, but he believed he would have done it as required by the required time (after 50 hours).
• The maintenance release issued on 22 May 2014 also had no annotation to certify that an oil and oil filter change had been conducted after 50 hours, whereas on the aircraft’s other maintenance releases (issued on 3 October 2013, 7 October 2014, 16 December 2014, 1 May 2015), the chief pilot had annotated the maintenance release to certify that the activity had been conducted.
• The maintenance release issued on 12 November 2015 listed two Cessna Special Inspection Documents (SIDs), requiring inspections to be completed by 31 December 2015. The SIDs related to inspections of seat rails and door posts. There was no annotation on the maintenance release to certify that these inspections were completed, and the aircraft continued to be flown after the specified date. The inspections were completed during the next periodic inspection (20 September 2016)
• There were multiple days on which flights were recorded on the aircraft’s GPS unit and/or the pilot of the accident flight had included flights in VH-WTQ in his logbook, but there was no certification on the maintenance release stating that a daily inspection or flights had been conducted (see Appendix A).
• The aircraft’s current maintenance release was not located in the aircraft. The chief pilot (and aircraft owner) advised that he kept the aircraft’s maintenance release in his possession.^[14]

Fuel system

The aircraft had two fuel tanks, one in each wing. The integral fuel tanks had a combined maximum capacity of 159 L (or 42 US gallons), with the maximum usable capacity being 144 L (38 US gallons).

Figure 7 provides an overview of the Cessna 172M’s fuel system. As indicated in the figure, fuel from each tank flows by gravity to the fuel selector valve. Depending on the setting of the valve, fuel from the left tank, right tank or both tanks flows through a fuel strainer, the carburettor and then to the engine. If the fuel selector is selected to BOTH and one of the tanks runs out of useable fuel, the engine will keep operating from the fuel flowing from the other tank. If the fuel selector is selected to OFF in flight, the engine will stop very soon after.^[15]

Figure 7: Overview of Cessna 172M’s fuel system

Source: Cessna.

The Cessna 172M Owner’s Manual stated:

The fuel selector valve should be in the BOTH position for take-off, climb, landing, and maneuvers that involve prolonged slips or skids. Operation from either LEFT or RIGHT tank is reserved for cruising flight.

The pilot of the accident flight reported that he always conducted the flights from Agnes Water to or from the beach ALAs with the fuel selector switched to BOTH for the whole flight.

The Owner’s Manual also included the following statement:

NOTE:
With low fuel (1/8th tank or less), a prolonged steep descent (1500 feet or more) with partial power, full flaps, and 80 MPH or greater should be avoided due to the possibility of the fuel tank outlets being uncovered, causing temporary fuel starvation. If starvation occurs, levelling the nose should restore power within 20 seconds.

Further information about the fuel quantity and fuel quality on VH-WTQ is provided in Fuel information.

Recorded information

Review of video footage

The video footage of the flight was taken using an iPhone 5S mobile phone. The Queensland Police Service (police) recovered the phone from the accident site and downloaded the video file.

The video footage provided continuous video and audio information throughout the entire flight. The footage primarily included views outside the aircraft, but also included some footage of inside the aircraft, including occasional footage of cockpit instruments. Where relevant, this information has been included in The occurrence and other sections of this report.

Table 4 provides a more detailed summary of events and observations following the engine power loss at 1037:34 based on the video footage.

Table 4: Summary of events and observations based on video footage after the engine power loss

Time (hhmm:ss)	Observations
1037:34	The engine sustained a sudden and total power loss. The engine/propeller speed immediately reduced and then gradually decreased for the remainder of the flight (see Audio analysis of the engine/propeller speed).
1037:37	The aircraft banked slightly to the right with a nose-high attitude.
1037:42	The aircraft commenced a turn to the left with a nose-high attitude.
1037:48	The altimeter indicated about 120 ft, the vertical speed indicator (VSI) indicated over 500 ft/min rate of climb and the indicated airspeed was 75–80 kt. The aircraft’s artificial horizon indicated a bank angle of 30–40° during most of the remainder of the turn. The control column was pulled back a significant amount.
1037:52	The stall warning horn sounded for 1 second. It then subsequently sounded three further times prior to impact. The altimeter indicated about 140 ft, the indicated airspeed was about 65 kt and the indicated bank angle was about 40°. The VSI indicated 0 ft/min. The control column was pulled back an extensive amount, and the pilot’s right hand was on the throttle, in a position consistent with full or near full power.
1037:54	The aircraft began to skid[16] in the turn (consistent with pilot applying left rudder input). The indicated airspeed was about 65 kt, the VSI indicated about 550 ft/min descent rate and the indicated bank angle was about 30°.
1037:57	The altimeter indicated about 70 ft, the VSI indicated more than 600 ft/min descent rate, the indicated airspeed was about 60 kt and the indicated bank angle was about 30–35°. The stall warning commenced for the fourth time and remained on until impact.
1037:59	Impact with terrain. The aritifical horizon and other instruments were not visible in the 1–2 seconds prior to impact. However, based on visible terrain features, the bank angle significantly increased during this period, reaching about 60° at impact. The aircraft also had a significant nose-down attitude at impact.

At various times from 1037:48 until impact, some cockpit control settings were observed in the video footage. These included flaps selected UP, master switch ON, magnetos selected to BOTH, mixture full rich and carburettor heat off.

It should be noted that for some of the indicated altitudes the altimeter appeared to be over reading (see Appendix B). In addition, airspeed, altitude and descent rate indications may become less reliable in uncoordinated flight and indicated airspeed may become less reliable as the aircraft approaches a stall (see Stall speed).

Audio analysis of the engine/propeller speed

Audio analysis of the video footage was conducted to examine the engine/propeller speed throughout the flight.^[17] Key results were:

• during the take-off the engine/propeller speed increased to 1,610 revolutions per minute (RPM)
• during the climb the engine/propeller speed was about 2,480 RPM
• during the en route and manoeuvring phase the engine/propeller speed was about 2,670 RPM
• during the descent, up until the power loss, the engine/propeller speed was the same as during the cruise (about 2,670 RPM)
• at 1037:34, there was an initial rapid reduction of engine/propeller speed (over about 1 second) followed by a more gradual reduction for the remainder of the flight, with specific figures including:
• 2,680 RPM at 1037:33 (1 second prior to the power loss)
• 1,600 RPM at 1037:37 (3 seconds after the power loss)
• 770 RPM at 1037:56 (3 seconds prior to impact)
• 700 RPM just prior to impact.

The low values of RPM after the sudden power loss were consistent with the effect of the propeller windmilling in the airflow (rather than the propeller being driven by reduced engine power). As the airspeed decreased, the windmilling effect that drove the propeller decreased.

RPM values derived from the audio analysis were consistent with images of the RPM indicator present in the video footage in the 13 seconds prior to impact.

Prior to the sudden engine power loss at 1037:34, the only anomaly in the engine/propeller sound during the flight occurred at 1036:13, when there was a momentary reduction of engine/propeller speed before it recovered to its normal setting. This occurred during a rapid though brief pitch-down manoeuvre. The brief reduction in power appeared to be consistent with what would expected with the normal operation of the carburettor in such a manoeuvre and would have had no long-term effect.

This pitch-down was the last in a series on intentional manoeuvres, which also included rapidly pitching the aircraft down then up (three times) and quickly yawing from side to side (two times). The pilot reported that he thought the brief reduction in power was related to the manoeuvres rather than a problem with the engine or the aircraft. He stated that such reductions were not common but he had encountered them before in the same circumstances.

The ATSB received multiple reports from former passengers and/or residents in the area that the operator’s en route manoeuvres sometimes included a pilot briefly cutting the engine power. However, the chief pilot and the pilot of the accident flight both advised the ATSB that they had not conducted that practice.

GPS information

The global positioning system (GPS) unit on board VH-WTQ was a Garmin 296 Portable Aviation Receiver. The unit was hard-wired into the aircraft and connected to an antenna fitted to the aircraft. The chief pilot stated that, as far as he was aware, the unit was never removed from the aircraft and used in other aircraft.

The ATSB downloaded the available data from the unit using the manufacturer’s procedures and software. Data was successfully downloaded for the accident flight and numerous previous flights conducted between 12 November 2016^[18] and 4 January 2017.

The Garmin 296 GPS unit has a published accuracy of less than 15 m in both horizontal and vertical planes. In other words, most of the recorded data points will be within 15 m of the actual position in each plane. However, the manufacturer has advised the following in relation to accuracy:

• In steady flight the horizontal accuracy is closer to 5 m and the vertical accuracy is typically about 1.5 times the horizontal accuracy (that is, 7.5 m or 25 ft).
• The accuracy of the GPS data degrades if the aircraft is accelerating at the time. In other words, the data is less accurate if the aircraft is conducting steep turns or climbing or descending at changing rates. Nevertheless, even with 2 g acceleration, the accuracy would still be within 25 m.

The accuracy of GPS data is affected by the number of satellites visible and their positions, and with ionospheric conditions. The manufacturer’s stated accuracy takes such variations into account, although sometimes there may be unusual conditions where the GPS is less accurate than normal. Based on satellite positions and ionospheric conditions at the time of the accident, the manufacturer’s expected level of accuracy during steady flight should have been achieved.

There was no evidence available to indicate that the specific GPS unit fitted on VH-WTQ was less reliable than any other Garmin 296 unit. Examination of recorded position and altitude data was consistent with the location and elevation of take-off and landing areas for the accident flight and preceding flights. The pilot of the accident flight reported that the aircraft was at about 150–200 ft when he conducted the airborne inspection of the ALA and when the engine power loss occurred. However, the recorded GPS data indicated that the aircraft was at about 70 ft just prior to the power loss (Figure 2) and therefore at about 60 ft when the power loss occurred.

In addition, the pilot reported that the engine power loss occurred at about the position annotated with the time 1037:38 in Figure 2 rather than the position annotated by the time 1037:34. That is, he believed the power loss occurred about 240 m further north than indicated by the recorded GPS data (after calibrating this data with the video footage).

The ATSB conducted a detailed comparison of the GPS data with the video footage, radar data and other sources of information to determine the accuracy of the data. This comparison found that the recorded GPS data was within its expected level of accuracy during the descent and up until the time of the engine power loss. More specifically, the engine power loss occurred at close to the position indicated in Figure 2, while the aircraft was probably between 40 and 80 ft (and therefore probably close to the GPS-based altitude of 60 ft). This altitude was consistent with the GPS data from previous airborne inspections of the ALA flown by the pilot of the accident flight (Review of airborne inspections at Middle Island ALA).

Consistent with the known limitations of GPS data, the recorded GPS altitude data was less accurate earlier in the flight (during the cruise when manoeuvres were conducted) and during the climb and left turn following the engine power loss.

Details of the ATSB’s verification of the recorded GPS data are provided in Appendix B.

Radar data

A review of Airservices Australia recorded radar data showed a number of secondary radar returns^[19] that were confirmed to be from VH-WTQ. The radar data provided track and altitude information from 1032 until the accident. The radar data was consistent with that provided by the GPS data, although the altitude had a lower resolution (see Appendix B).

A review of the radar data also showed that another aircraft followed VH-WTQ, with a similar flight path. This aircraft had no associated altitude information, consistent with its transponder’s altitude encoder being unserviceable or turned off during the flight. The operator’s chief pilot was also flying to the same beach location, and was about 2 NM (4 km) behind VH-WTQ, in VH-JER. It was therefore concluded that the other radar returns were from VH-JER.

In 2019 the chief pilot recalled that VH-JER had a transponder failure at about the time of the accident. He identified the problem after 10 January 2017 during a flight conducted through controlled airspace.

Missing recording devices

During the early stages of the on-site investigation, the ATSB became aware that the two passengers who occupied the rear seats had GoPro video recording cameras on board the accident flight. One had a camera fitted with a yellow float handle and one had a camera fitted with a black handle.

During interviews with police officers, a witness stated that about 5 days prior to the flight he observed the owner of the GoPro camera with a black handle install a memory card into that GoPro camera. Furthermore, he recalled that on the morning of the accident flight the two rear- seat passengers stated they were both going to film the flight using their GoPro cameras. Photographs showed the passengers were holding their cameras just before boarding the aircraft, and a photograph of one of the passengers during the flight showed her still holding her camera.

Some photographs taken just after the accident showed a GoPro camera with a yellow float handle in front of the aircraft’s right wing. It was also reported by a first responder that another GoPro camera with a black handle was seen near the nose of the aircraft.

Given the high degree of potential importance as evidence, an extensive search of the accident site for the GoPro cameras was conducted by the ATSB, police and state emergency service volunteers. That search did not locate either of the missing cameras.

Several first responders were interviewed regarding any recording devices found at the accident site. The chief pilot initially provided the ATSB with one of the mobile phones recovered from the site, and other mobile phones were located either at the site or were provided by other first responders to the police. Subsequently, the chief pilot recalled that he had been given a GoPro camera at the accident site, and he advised one of the rear-seat passengers’ friends that he had the camera but it had no memory card in it. The police took possession of the camera from the chief pilot and confirmed there was no SD memory card installed. The camera was in a good condition and was clamped down in a handle cradle and had an access door to the memory card slot closed and secured by a latch.

The reason why there was no memory card in the black-handled GoPro camera could not be determined, and the yellow-handled camera was never located.

Wreckage and impact information

Impact information

The accident site was located above the high tide line on a beach on Middle Island, 12 NM north-west of Agnes Water. A photograph taken by a first responder shortly after the accident showed that the left wingtip had scraped on the beach prior to the aircraft nose impact point (Figure 8). The impact marks were subsequently removed by the next high tide, which occurred before the arrival of ATSB investigators the next day.

The distance between the nose impact point and the main wreckage was about 5 m on a magnetic bearing of 210⁰. The wreckage distribution and distance from the impact point indicated that the aircraft impacted terrain in a significant nose-down and left-wing low attitude. The aircraft came to rest facing in the opposite direction to flight.

Figure 8: VH-WTQ accident site showing impact marks

This image also shows the sand dunes behind the beach, in the direction where the aircraft was headed prior to impact.

Source: Wyndham Aviation chief pilot.

Aircraft structure

The aircraft was significantly disrupted by ground impact forces. The main fuselage structure had fractured at the rear of the engine firewall and just aft of the rear passenger seats. The cabin area was twisted and compressed and both wings had separated from the fuselage structure at the wing root (Figure 9).

The aircraft structure was examined for pre-impact defects, with none identified. All of the aircraft and its components were accounted for at the accident site. There was no indication of any fire.

Figure 9: VH-WTQ aircraft wreckage viewed from the right

Source: ATSB.

Flight controls and cockpit switches and controls

All of the flight control systems were examined from the cockpit through to the control surfaces, and no pre-impact defects were identified. The flap actuator was examined and the flap positon was determined to be in the fully UP position. The elevator trim was in full nose-down position; however, that was not considered to be an accurate reflection of the position set before impact due to wreckage disruption and distortion.

The cockpit was examined to ascertain switch, flight control and engine settings. The following positions were noted:

• throttle was in the full power position
• mixture was in the full rich position
• carburettor heat was fully closed (off)
• fuel tank selector was in the BOTH position
• master switch was OFF (consistent with it being switched off by the first responders to the accident)
• magnetos were in the OFF position (consistent with them being switched off by the first responders to the accident).

Fuel system examination

Examination of the fuel system identified the following:

• Both the left and right fuel tank caps were in place and secured. The caps had ventilation holes to prevent negative pressure in the fuel tanks.
• The fuel feed and ventilation lines were inspected, with no defects noted.
• Both fuel tanks were damaged during the accident sequence and fuel subsequently leaked into sand in the surrounding area. A small amount of fuel remained in both tanks. A sample of the fuel was drained into a purpose-made fuel storage container. The fuel appeared to be clean with no evidence of foreign particles and it had a smell and colour consistent with 100 LL (low lead) aviation fuel. The sample was subsequently sent for laboratory testing (see Fuel quality).
• The fuel strainer bowl located on the engine firewall was examined externally for damage. The outlet line to the engine had fractured at the base of its thread as it entered the bowl housing. That fracture was examined and determined to be caused by ductile overload due to impact forces.
• The fuel strainer bowl was removed from its housing to determine the amount and quality of fuel that was retained. A clean and dry container was utilised to capture the fuel that came out of the bowl when it was removed. About 80 mL of fuel was drained from the bowl and examined. The fuel had a cloudy appearance and had a section of what appeared to be water and debris in the bottom 20 mL of the sample. Water finding paste was utilised and came back with a positive test for water in the fuel strainer bowl sample (Figure 10).
• The fuel strainer filter was removed and examined. A small amount of debris was found in the inlet side of the filter. The amount and type of debris was not considered to be excessive or abnormal.

Figure 10: Fuel strainer bowl and contents showing signs of water and debris

Source: ATSB.

Carburettor examination

The carburettor was examined in order to inspect the fuel inlet finger filter, throttle and mixture controls (in full power and mixture rich position) and air intake filter and by-pass. No pre-impact issues were identified (Figure 11).

Figure 11: Carburettor and air intake assembly

Source: ATSB.

The carburettor was oriented about 80° on its right side with the fuel inlet facing upwards. It was removed from the engine and inspected, with no defects noted.

As part of the removal process, care was taken not to invert the carburettor so as to prevent fuel draining out of the unit. With the carburettor in an upright position, the carburettor bowl drain was removed in order to ascertain if any fuel remained in the unit (Figure 12). No fluid of any kind was drained from the unit. It is possible that some fuel had leaked out of the unit while it was on its side; however, the orientation of the unit meant that some fuel should have remained in the carburettor bowl.

Figure 12: Carburettor showing drain point located at its base

Source: ATSB.

Engine examination

The engine was removed from the aircraft and taken to a certified overhaul facility where it was disassembled and examined under the supervision of the ATSB. Key results from the examination included:

• No pre-accident defects were identified with the mechanical components of the engine.
• The carburettor was disassembled and inspected, with no faults identified. There were no foreign particles and debris, apart from a small amount of rust-like residue at the drain point reservoir (Figure 13). The fuel metering orifice was also clean and free of foreign particles and debris. Given that no actual particles or debris were found in the carburettor, the presence of this rust-like residue was very unlikely to have contributed to the engine power loss.
• The magnetos were checked for correct timing and then removed for functional testing. Both magnetos functioned as designed with no faults identified.
• All the spark plugs were removed from the engine, inspected and tested. No faults were identified.

The exhaust system fitted to VH-WTQ at the time of the accident was an aftermarket, tuned exhaust system. The system was different from the standard exhaust in that it did not have a muffler to attenuate noise but rather had four exhaust tubes feeding into one manifold tube. The exhaust was removed from the engine and inspected in the inlet and outlets for obstruction, with no obstructions detected. The exhaust was also shaken in order to ascertain if there were loose items internal to the exhaust; there was no audible sound of loose items in the exhaust system.

Figure 13: Disassembled carburettor showing internal components

Source: ATSB.

The propeller was examined on site for evidence of correct and secure fitment, with no issues identified. The propeller blades were examined for evidence of rotation damage at the point of impact. Only minor abrasion damage was observed on the blades with no other indications of rotation (Figure 14). That damage was consistent with very low or no power being delivered by the engine at impact.

Figure 14: Propeller blades showing slight paint abrasion damage

Source: ATSB.

Re-examination of the aircraft

Following inspection and testing of several components and analysis of the available evidence, the ATSB conducted a re-examination of the aircraft wreckage in May 2017, with a particular focus on the fuel storage, fuel ventilation and the airframe side of the engine ignition system. This included an examination of the fuel tanks and a re-examination of the fuel caps, with a test of both caps indicating they were capable of providing ventilation to the tanks. The re-examination did not identify any notable defects within the airframe fuel and ignition systems that may have contributed to the engine power loss.

The fuel selector was removed from the aircraft for detailed examination and testing. The fuel selector was subsequently X-rayed in order to examine the internal components without disturbing any possible defects. The X-ray showed that the selector was in the BOTH position with the left and right fuel inlet ports in the OPEN position. Further, there was no apparent damage to the internal components. A functional test of the selector was conducted by applying fluid to both sides of the inlet ports individually and together. That test showed that the fluid flowed freely through the outlet as designed on all occasions.

The ignition switch was removed from the aircraft for detailed examination and testing. The switch was X-rayed so that an internal inspection of the working components could be conducted without disturbing the internal components. There were no defects identified in the internal components of the switch. The switch was disassembled and inspected with no evidence of internal arcing or defects identified. A resistance test was conducted on the internal poles, with no defects identified.

Following a query from the chief pilot, the ATSB conducted a more detailed examination of the exhaust system. Each of the exhaust components was examined externally and internally. The heater shroud was removed from the exhaust mixer and the tubes were inspected externally with no defects identified. Each exhaust system component was examined internally utilising a borescope fitted with a camera. Viewing access was gained to all parts of each exhaust component. No obstructions or pre-impact defects were identified.

Fuel information

Fuel quantity

The examination of the wreckage could not provide an accurate estimate of the amount of fuel on board the aircraft at impact due to the extent and nature of the damage.

The ATSB reviewed the available information from the video footage, interviews and other sources to determine the best estimate of the fuel on board the aircraft at the time of the engine power loss (1037:34). The following information was considered:

• According to the aircraft’s maintenance schedule, VH-WTQ’s fuel quantity gauges were required to be calibrated every 4 years. They were last calibrated on 1 May 2015. The calibration card located in the aircraft indicated that the left and right gauges provided similar indications of the amount of useable fuel in each tank.^[20]
• The video footage taken during the accident flight showed the aircraft’s fuel quantity gauges on multiple occasions. During the period immediately prior to the engine power loss, the indicated fuel quantity was about one quarter full on the left tank gauge and slightly above half full on the right tank gauge.^[21] This equated to a useable fuel load of about 80 L.^[22]
• There was no record on the aircraft’s maintenance release to indicate that either of the fuel quantity gauges was indicating incorrectly. Both the chief pilot and the pilot of the accident flight stated that the fuel gauges on a Cessna 172 aircraft were not very accurate, but they did not recall any specific problems associated with the gauges on VH-WTQ.
• With regard to normal fuel loads and fuel burns:
• The operator’s Operations Manual stated that each flight was to carry 45 minutes fixed fuel reserve, with no variable reserve required for short flights (within 30 NM of the departure aerodrome). The manual also stated that a block flight planning fuel burn of 42 L/hour was to be used for short flights.
• The chief pilot reported that the operator’s fixed reserve for a Cessna 172 had been calculated to be 27 L.^[23] He also said that he did not like operating the aircraft such that the fuel remaining was close to the fixed reserve.
• The chief pilot and the pilot of the accident flight both reported that flights from Agnes Water to one of the beach ALAs and return used about 13 L. This equated to a total flight time of about 19 minutes for the two flights (based on a fuel burn of 42 L/hour).^[24]
• The chief pilot stated that he and the pilot of the accident flight generally used pre-calculated load and trim sheets when conducting flights between Agnes Water and a beach ALA. The most commonly used sheets were sheet 9 (with 66 L of fuel, sufficient for three trips), sheet 10 (with 53 L of fuel, sufficient for two trips) and sheet 11 (with 40 L of fuel, sufficient for one trip).
• The chief pilot reported that, depending on the number of trips flown during the day and the fuel remaining, they would often refuel the aircraft at the end of the day to a standard fuel load for two trips (53 L).
• The aircraft was normally refuelled from a fuel storage tank at Agnes Water ALA (Figure 15). The fuel storage tank was not fitted with a meter to accurately measure the amount of fuel dispensed when refuelling an aircraft. However, the chief pilot and the pilot of the accident flight stated that 25 turns of the handle produced about 20 L. After refuelling an aircraft, the amount of fuel on board would be checked using a calibrated dipstick.
• The pilot of the accident flight stated there was about 53 L (38 kg) of fuel on board at the time of his pre-flight inspection, as per the pre-calculated load and trim sheet 10; sufficient fuel for two trips. However, he initially could not recall if he added additional fuel prior to the flight; he vaguely recalled adding an additional amount of about 20 L but was not sure. He also stated that if he knew he was conducting two trips on the same day (as he did on the day of the accident) he would normally ensure he had enough fuel on board for three trips (outbound and inbound) at the beginning of the day in case there was a requirement to transport additional passengers.^[25] The pilot of the accident flight subsequently advised that he did not recall refuelling the aircraft on the day of the accident, but had checked the fuel quantity prior to flight using the dipstick and there was 53 L on board.
• The operator’s Operations Manual required a pilot to complete a trip log for the day’s flights conducted in an aircraft. The log required the fuel remaining at the end of a trip, the fuel added, the fuel on board at the start of each trip and the flight time to be recorded. The ATSB did not obtain the trip logs for VH-WTQ after the accident, and the chief pilot was not able to provide the logs when they were requested in 2019. The pilot of the accident flight recalled that he did not complete trip logs, but provided relevant figures to the chief pilot who completed the logs.

In summary, the aircraft’s fuel gauges indicated there was about 80 L of fuel on board during the flight, and therefore a slightly higher figure prior to take-off. The pilot of the accident flight stated that, consistent with the pre-calculated load and trim sheet 10, there would have been 53 L on board at take-off. Overall, the ATSB concluded there was probably more than 53 L on board prior to departure, and potentially up to about 80 L, but the exact amount could not be determined.

Fuel quality

The fuel storage tank at Agnes Water ALA (Figure 15) was utilised by both of the operator’s Cessna 172 aircraft, with the same batch of fuel being used in the period leading up to the day of the accident without any problems being noted.

Figure 15: Fuel storage tank containing aviation grade gasoline

Source: ATSB.

The chief pilot stated that the fuel in the storage tank was checked visually for quality and the presence of water prior to each aircraft refuel. When the fuel storage tank was empty it was taken to Bundaberg Aerodrome and refuelled with 100LL aviation grade gasoline.

On 2 February 2017, inspectors from the Civil Aviation Safety Authority (CASA) conducted an on-site inspection of the operator’s facilities. During this inspection, the chief pilot demonstrated an inspection of the fuel in the storage tank, and no problems were identified.

The chief pilot stated that on the morning of the accident flight he performed a pre-flight inspection of VH-WTQ, which included a water drain check of each of the aircraft’s three fuel drains. He then signed the daily inspection on the aircraft’s maintenance release. The chief pilot stated that he was not present at the time the pilot of the accident flight performed his own pre-flight inspection of VH-WTQ.

The pilot of the accident flight stated that, regardless of whether the chief pilot had conducted a pre-flight inspection, he always conducted his own inspection, including water drain checks. He did not identify any water or other problems with the fuel prior to the accident flight.

As noted in Fuel system examination, a small sample (about 1 L) of fuel was decanted by the ATSB into a purpose-made fuel storage container from the fuel remaining in the wing tanks. That sample was sent to a chemical test facility. The fuel sample test report stated that, apart from high tetra ethyl lead content, the fuel test point specifications fell within the normal limits for 100LL aviation gasoline.

Excessive tetra ethyl lead content can lead to fouling of the spark plugs and build-up of residue on piston heads. The ATSB’s examination of the spark plugs and piston heads during the engine disassembly did not identify any issues due to excessive build-up of residue in relation to lead content.

Weight and balance information

Aircraft loading requirements

Civil Aviation Regulation (CAR) 235 (Take-off and landing of aircraft etc) stated that a pilot in command must not allow an aircraft to take off if its gross weight exceeded its maximum take-off weight (MTOW),^[26] and that the load of the aircraft should be distributed so that the centre of gravity of the aircraft was within the limitations specified in the aircraft’s flight manual.

Civil Aviation Advisory Publication (CAAP) 235-1(1) (Standard Passenger and Baggage Weights) provided advisory information about methods to use for determining passenger and baggage weights. It recommended:

Because the probability of overloading a small aircraft is high if standard weights are used, the use of standard weights in aircraft with less than seven seats is inadvisable. Load calculations for these aircraft should be made using actual weights arrived at by weighing all occupants and baggage.

The Operations Manual stated:

Load calculations for all Company aircraft are to be made using actual weights for all passengers and baggage.

The operator used a series of pre-calculated load and trim sheets for its passenger charter flights. The Operations Manual stated that, when using these sheets, the pilot in command must ensure that actual passenger weights were not greater than the weights specified in the sheet being used.

The operator had scales available at Agnes Water to weigh passengers and baggage. The chief pilot advised the ATSB that he and the pilot of the accident flight were experienced at estimating the weights of passengers (by visual inspection) and baggage (by visual inspection and handling the items). They only weighed them if they appeared to be close to or exceed the weights specified in the selected pre-calculated load and trim sheet. He also advised that he and the pilot of the accident flight did not always complete a specific load sheet for each flight by annotating actual (estimated or measured) weights to the standard load and trim sheet; rather they just accepted the standard weights as being applicable.

During an audit of the operator in March 2015, CASA made a finding (observation) that the operator used a standardised loading system for determining aircraft take-off weights that did not include the use of the actual weights of passengers and cargo (see Schedule site inspection in 2015). In response, in May 2015 the chief pilot advised CASA in writing that the operator would weigh all passengers and baggage on future flights. The pilot of the accident flight advised the ATSB that he was not made aware of the CASA finding and the chief pilot’s response, and had he been advised to weigh all passengers and cargo he would have done so.

Pre-calculated load and trim sheet data

The current weight and balance certificate for VH-WTQ was issued on 20 November 2014, following the fitment of an approved landing gear modification. The aircraft’s basic empty weight was recalculated as 679.1 kg (an increase of 22.1 kg from the previous weight of 657 kg). The MTOW was 1,043 kg (2,300 lb).

On 13 January 2017, the chief pilot provided the ATSB with a version of pre-calculated load and trim sheet 10. At that time he stated it was the sheet used for the weight and balance for VH-WTQ on the morning of the accident flight. This version of sheet 10 used the aircraft’s previous basic empty weight (657 kg). It also had figures of 38.2 kg (53 L) for fuel, 88 kg for the pilot, 77 kg for each passenger and 22 kg for baggage. Soon after, the chief pilot provided CASA with a copy of sheet 9, and this document also included a basic empty weight of 657 kg.

Subsequently, in early November 2018, the chief pilot provided the ATSB with a second version of sheet 10. It had the same fuel load as the previous version (53 L) with a slightly modified weight (37.6 kg), but had the correct aircraft basic empty weight (679.1 kg). It also had modified figures for the pilot (85 kg), each passenger (70 kg) and baggage (22 kg).

In mid-November 2018, the chief pilot provided a third version of sheet 10, and stated it was the version used by the pilot of the accident flight on the day of the accident. It had the same fuel weight, basic empty weight and pilot weight as the second version, but had different figures for each passenger (65 kg) and baggage (48 kg).

The chief pilot could not explain why the initial sheets provided to the ATSB and CASA had an incorrect aircraft basic empty weight.^[27] For the purpose of the investigation, the ATSB considered the third version of sheet 10 provided by the chief pilot (see Aircraft load on the accident flight).

As noted above, CAAP 235-1(1) stated that standard passenger weights should not be used for aircraft with less than seven seats. It also stated that the use of the same standard weight for all types of aircraft with seven seats or more was inappropriate, because the probability of overloading increases as the capacity of the aircraft decreases. More specifically:

For example, when a standard weight of 77 kg is used in a 12 passenger aircraft instead of actual weights, the statistical probability of overloading the aircraft is as high as 25%. This probability diminishes to 0.0014% if the same standard weight of 77 kg is used on a very large capacity aircraft, such as a 400 passenger Boeing 747.

The CAAP, issued in 1990, suggested weights for an aircraft with 7–9 seats of 86 kg for an adult male, 71 kg for an adult female, 65 kg for an adolescent male and 58 kg for an adolescent female. As the size of the aircraft increased, slightly lighter weights were suggested. For the largest aircraft, weights of 81, 66, 61 and 55 kg were suggested for the four categories of passenger.

The average weight of people has increased over the years. Recent figures from the Australian Bureau of Statistics noted that in 2011–12 the average weight of an Australian male was 86 kg and the average weight of an Australian female was 71 kg, with both increasing about 4 kg since 1995.

Aircraft load on the accident flight

In addition to three passengers, VH-WTQ was loaded with the passengers’ baggage and various camping supplies. One of the passengers on board the operator’s other aircraft (VH-JER) also stated that his baggage was on board VH-WTQ.

Both the chief pilot and the pilot of the accident flight advised the ATSB that, in their opinion, VH‑WTQ was significantly below its MTOW prior to its departure on 10 January 2017. Neither the chief pilot, nor the pilot of the accident flight, used scales to verify the actual passenger weights or the weights of the baggage and supplies loaded on board VH-WTQ. Passengers on board VH‑WTQ and VH-JER did not recall being weighed, being asked for their actual weights or having their baggage weighed.

The copy of sheet 10 that was provided to the ATSB in mid-November 2018 had annotations regarding passenger and baggage weights specific to the accident flight, and it was signed by the pilot of the accident flight. He subsequently advised the ATSB that the sheet had been in his private vehicle, which is why it had not been identified during the on-site investigation. The annotated figures on the sheet indicated that the aircraft’s weight was 1,027.7 kg, or about 15 kg below the MTOW.

During the on-site investigation, the ATSB recovered personal baggage and camping equipment from the baggage compartment of VH-WTQ. The ATSB also recovered camp food and drink supplies from the baggage compartment, as well as some of these supplies from the aircraft cabin and a small number of similar items from the surrounding area that were potentially on board the aircraft (Figure 16). The majority of the items were weighed by the police. For some other items not weighed by the police, including camp food supplies and a 10 L water container, the ATSB used weights provided by and agreed to in writing by the chief pilot. The total weight of all items recovered from the aircraft, or known to be on the aircraft at the time of the accident, was calculated to be 42.4 kg. This was considered to be an underestimate, as some other additional food and drink items close to the wreckage may also have been on board.

Figure 16: Some of the contents from VH-WTQ’s baggage compartment at the accident site

Some other items recovered by the ATSB from the wreckage are not included in this photograph. Those included cans of alcohol. It was reported that a full carton of rum and cola drink was on board but only 18 cans were recovered and included in the baggage weight. A large (3 kg) pumpkin was found close to the wreckage but not included in the final calculation. Only one of the 1.5 L water bottles shown in the photograph was included in the ATSB weight calculation (although others were found nearby and were potentially on board). The rubber mat was also not included in the ATSB calculations.

Source: ATSB.

The ATSB obtained the weight of the left rear-seat passenger from the post-mortem report and the right rear-seat passenger from that passenger. The ATSB used the weights of the pilot and the front-seat passenger that the pilot of the accident flight had annotated on his load and trim sheet. The annotated weight for the pilot matched the weight documented in his recent aviation medical examinations.

Table 5 provides a comparison of weights from the operator’s revised pre-calculated load and trim sheet 10, the pilot’s annotated load and trim sheet and the ATSB’s estimates. As indicated in the table, the ATSB estimated that the aircraft’s weight was at least 1,060 kg, or at least 17 kg above the MTOW (rounded to the nearest kg). This was considered to be a conservative estimate, as the fuel load could have been more than 53 L (see Fuel information) and the baggage / camp supplies weight may have been higher than 42 kg.

As indicated in the table, both the baggage / camp supplies weight and the passenger weights were higher than estimated by the pilot of the accident flight. The chief pilot was present at the time the aircraft was being loaded, and he provided similar estimates of the passenger and baggage weights as the pilot of the accident flight.

Table 5: Comparison of loading data for VH-WTQ between operator load and trim sheet weights and actual weights (rounded to the nearest 1 kg except where stated)

	Operator’s revised load and trim sheet 10 (kg)	Pilot’s amended load and trim sheet 10 (kg)	ATSB estimated weight (kg)	Difference between pilot estimate and ATSB estimate (kg)
Basic empty weight	679.1	679.1	679.1	0
Pilot	85.0	85.0	85.0	0
Passengers	195.0	200.0	217.0	+17.0
Baggage / camp supplies	48.0	26.0	42.4	+16.4
Fuel[28]	37.6	37.6	38.2	+0.6
Taxi / take-off fuel	-2.0	0	- 2.0	-2.0
Take-off weight	1,042.8	1,027.7	1,059.7	+32.0
Comparison to MTOW  (1,043 kg)	-0.2	-15.3	+16.7

 

Aircraft load on VH-JER

The operator’s other Cessna 172 aircraft, VH-JER, was reweighed in February 2015 and had a basic empty weight of 722 kg. Due to approved modifications associated with the aircraft’s flaps, it had a maximum MTOW of 1,089 kg (2,400 lb).

On the morning of the accident flight, VH-JER departed with the chief pilot, two adult male passengers and one adult female passenger on board. One of the male passengers reported that he was 110–115 kg. The chief pilot’s weight documented during a recent aviation medical examination was 92 kg. The aircraft was also loaded with two of the passengers’ baggage and some camping supplies. A photograph taken prior to the flight and video footage taken during the flight showed that multiple items of baggage were loaded on the aircraft.

The ATSB did not obtain copies of the pre-calculated load and trim sheets for VH-JER, or of any load sheet used for the flight. However, the ATSB estimated the aircraft’s take-off weight as being 1,110 kg based on the following:

• basic empty weight: 722 kg
• weight of pilot and passengers: 359 kg (based on 92 kg for the pilot, 110 kg for one male passenger, and average passenger weights of 86 kg for the other male passenger and 71 kg for the female passenger)
• minimum fuel load for one trip: 29 kg (40 L).

Based on this estimate, VH-JER was 21 kg above the MTOW of 1,089 kg for its first flight on 10 January 2017. Although it is possible that two of the passengers may have been less than the average weights, it should be noted that the ATSB estimate did not include any baggage / cargo, and the fuel load was probably more than 40 L (given that the aircraft was normally refuelled to a standard fuel load of 53 L for two trips).

Aircraft balance and centre of gravity

Aircraft balance refers to the location of the centre of gravity, along the longitudinal and lateral axis. In order to assure predictable aircraft control, the aircraft manufacturer established limitations along the longitudinal axis at fuselage stations measured in inches (in), in relation to a reference point or datum (located at the forward face of the engine compartment firewall).

The centre of gravity limitation for operation of VH-WTQ in the normal category at the MTOW of 1,043 kg (2,300 lb) was a forward limit of 977.9 mm (38.5 in) aft of the datum and rearward limit of 1,201 mm (47.3 in) aft of the datum.

ATSB calculations indicated that the aircraft’s centre of gravity was inside of the allowable aft centre of gravity envelope, regardless of whether the fuel load was 53 L (38 kg) or up to 80 L (58 kg).

Unrestrained cargo

Civil Aviation Order (CAO) 20.16.2 (Air Service Operations – Loading) contained requirements to secure cargo loaded on board an aircraft. The operator’s Operations Manual required the pilot in command to ensure all cargo was ‘properly restrained by the appropriate use of ropes, tie-down straps and/or cargo nets’. The manual also stated:

All cargo carried shall be restrained in a manner which prevents any article from moving under the maximum accelerations to be expected in flight or in the event of an emergency landing or ditching.

During the ATSB on-site investigation, no cargo restraint, net, or barrier was observed in the wreckage and all of the baggage/camp supplies was unsecured. The chief pilot and the pilot of the accident flight confirmed that they did not use cargo nets or similar means to restrain cargo in any of the operator’s aircraft.

Aircraft performance

Stall speed

An aerodynamic stall occurs when the wing’s angle of attack exceeds the critical angle at which the smooth airflow begins to separate from the wing. When a wing stalls, the airflow breaks away from the upper surface, and the amount of lift is reduced to below that needed to support the aircraft.

The speed at which a stall occurs is related to the load factor of the manoeuvre being performed. Load factor increases with the application of nose-up elevator, such as to maintain altitude in a turn, and therefore the level-flight stall speed will also increase with bank angle. An aircraft’s centre of gravity can also influence stall characteristics.

The level-flight stall speeds for the Cessna 172M were contained within the aircraft’s Owner’s Manual (Figure 17). Below these speeds, the aircraft would not be able to maintain altitude. The stall speed guidance was based on the aircraft’s maximum take-off weight (1,043 kg or 2,300 lbs) with the engine power at idle RPM. The stall speeds quoted in the figure are in miles per hour (mph). They were also stated for calibrated airspeed, as indicated airspeeds become less reliable near a stall.

Figure 17: C172M stall speed data

The stall speeds are stated in mph rather than kt, and they are also stated for calibrated airspeed rather than indicated airspeed.

Source: Cessna.

In the context of the VH-WTQ accident, the aircraft’s bank angle during most of the final turn to the left was about 30-40⁰ (see Table 4), and the flaps were selected UP. Therefore, during most of the turn the level-flight stall speed was calculated to be about 61–65 mph (53–56 kt). Just prior to impact, when the bank angle increased to about 60°, the level-flight stall speed was about 81 mph (70 kt). When below these speeds, applying enough nose-up elevator to maintain altitude would cause the aircraft to stall.

If full flap had been selected, the stall speeds would have been reduced by about 10 mph (9 kt) for the same bank angle.

The Cessna 172 Owner’s Manual stated that the aircraft’s stall characteristics were ‘conventional’ and that an aural warning was provided by a stall warning horn, which sounded between 5‑10 mph (4–9 kt) above the stall in all configurations.

As noted in The occurrence, the aural stall warning first sounded at 1037:52 and then sounded intermittently for most of the following 7 seconds until impact. Based on the available information, the aircraft’s stall warning appeared to operate as designed.

Given the stall warning was intermittently sounding for the last 7 seconds, and the indicated airspeed decreased from 65 kt to 60 kt, it is very likely that the aircraft was close to the stall speed during this period. In the last 1–2 seconds, as the bank angle increased to about 60° and the indicated airspeed was about 60 kt, the aircraft may have entered the stall. The pilot’s use of left rudder in this period increased the potential to stall.

Landing distance

The Cessna 172M Owner’s Handbook stated that the landing distance at maximum weight on a hard, dry runway at sea level with no wind and using full flap was 1,250 ft (381 m). This included the distance from 50 ft above ground level (AGL) until the end of the landing roll. The landing roll under the same conditions was 520 ft (159 m).

The landing distance would be longer if the aircraft had a higher groundspeed or no flap was selected. In addition, the landing distance would be shorter if the aircraft encountered soft sand during the landing roll.

Meteorological information

General information

At about the time of the accident, Bureau of Meteorology weather observations recorded at Seventeen Seventy (10 NM south-east of the accident site) were an easterly wind at 9 kt and a temperature of 29 °C. The recorded dewpoint was calculated as being 23.6 °C.

The chief pilot, who landed at Middle Island ALA shortly after the accident, stated the wind was a south-easterly wind between 10 kt and 15 kt. Two witnesses on the ground at the beach ALA who were associated with the charter operation reported that the weather conditions at the time were fine with a light sea breeze.

A video recording of the entire accident flight also provided evidence that weather conditions such as visibility and turbulence did not contribute to the accident.

Carburettor icing

Carburettor icing occurs as a result of vaporisation of fuel and a reduction in pressure as the fuel/air mixture passes through the venturi in the carburettor. These effects cause a drop in temperature which, if it falls below the dew or freezing point of water, will result in ice forming on the sidewalls and the butterfly valve in the carburettor. As the ice builds up, it gradually blocks the venturi and alters the fuel/air balance, which causes the engine to run roughly and lose power.

Given a temperature of 29 °C and a dew point of 23.6 °C, there was only a ‘light’ risk of carburettor icing at cruise power settings.

The Cessna 172 Owner’s Manual stated:

Carburetor ice, as evidenced by an unexplained drop in RPM, can be removed by application of full carburetor heat...

Take-off is made normally with carburetor heat off…

Carburetor heat may be used to overcome any occasional engine roughness due to ice…

A gradual loss of RPM and eventual engine roughness may result from the formation of carburetor ice.

Audio analysis of the video footage did not identify any evidence of a loss of RPM or engine rough running during the descent and airborne inspection prior to the power loss (see Audio analysis of the engine/propeller speed).

The flight time up until the accident was only about 7 minutes in duration. The pilot reported that he had not selected (or needed to select) carburettor heat at any point during the flight.

Tide times

The tide chart for 10 January 2017 at Clews Point (about 3 NM north-west of the accident site) indicated that the last high tide was 3.24 m at 0642 with a low tide of 0.44 m at 1306. The approximate time of the accident was 1038 (about 4 hours after high tide and 2.5 hours before low tide). Therefore the tide height at Clews Point at the time of the accident was about 1.5 m with an outgoing tide.

Aeroplane landing area information

General information about landing areas

An aeroplane landing area (ALA) is an area of ground suitable for the conduct of take-off and landing and associated aeroplane operations under specific conditions. It is not authorised as an ‘aerodrome’ but can be used for aircraft involved in private, aerial work, or charter operations. They are not recommended for aircraft with a MTOW of more than 5,700 kg.

Under Civil Aviation Regulation (CAR) 92 (Use of aerodromes), aircraft may land at a ‘place’ other than an aerodrome if it:

…is suitable for use as an aerodrome for the purposes of the landing and taking-off of aircraft; and, having regard to all the circumstances of the proposed landing or take-off (including the prevailing weather conditions), the aircraft can land at, or take-off from, the place in safety.

Civil Aviation Advisory Publication (CAAP) 92-1(1) (Guidelines for aeroplane landing areas) provided guidance regarding the suitability of landing areas. The CAAP discussed factors such as runway width, runway length, longitudinal and transverse slopes, marking, lighting, runway surface and geographic location.

Civil Aviation Order (CAO) 82.1 (Conditions on Air Operator’s Certificates authorising charter operations and aerial work operations) stated that a charter operator was required to provide various types of documentation, including:

…a catalogue of authorised landing and alighting areas where operations are frequently conducted showing, in diagrammatic form, location by co-ordinates or in reference to prominent geographic features or nearest navigation aid, direction of runways, length and width of runways, nature of surfaces, elevation above sea level, hazards in the area, and the name, and method, of contacting the owner or controlling authority…

Such a catalogue was generally known as an ‘ALA register’.

Middle Island aeroplane landing area

The operator regularly conducted passenger charter flights from Agnes Water ALA to two beach ALAs at Aircraft Beach and Middle Island. Aircraft Beach was located just to the north of Middle Island ALA. The ALA at Middle Island was only used by the operator and was not a publically-listed ALA.

The operator’s Operations Manual included information about all three ALAs in an ALA register. The manual also contained a section written by the chief pilot on operations into both beach ALAs. Basic information about Middle Island ALA in the manual included:

• It was oriented in a 17/35 direction.
• It was 60-200 m wide and 8,000 m long, varying with tides.
• Tide heights were the most critical factor for landing, with the surface below the high tide mark (2.3 m) being sufficiently hard for a landing surface. Landings were only permitted if the tide was 1.7 m or less.
• The landing surface was fine, hard sand with a slight transverse slope.
• The natural indicator of hard sand was small sand balls made by ghost crabs.
• Ruts could be present on the beach after large tides or storm activity.

For landings at Middle Island ALA, the manual discussed hazards associated with the beach landing surface such as large ruts and tide movements. There was no information about the local terrain surrounding the ALA or the position, slope and condition of likely forced landing sites or associated hazards.

The ALA register in the Operations Manual included space for a diagram of each ALA. In the version of the manual submitted to CASA in August 2010, these spaces were blank.^[29] CASA advised that, as far as it could determine, it had not received or obtained any ALA diagrams from the operator. The pilot of the accident flight could not recall ever seeing any ALA diagrams, and another pilot who briefly conducted flights for the operator in late 2015 also reported that he had not seen any ALA diagrams and there were none contained in his copy of the Operations Manual. The chief pilot recalled preparing ALA diagrams but could not explain why they were not in the copy of the Operations Manual provided to CASA in August 2010.

Beach available for an emergency landing north of the landing area

A review of Google Earth images over the period from 2013 to 2019 showed that the size and shape of the sand areas around the Jenny Lind Creek inlet varied with tide height and also over time due to longer-term factors. Nevertheless, even though the accident flight arrived 2.5 hours before low tide, there was still a significant amount of beach on the island to the north of the landing area.

Figure 18 shows a Google Earth image of the landing area and beach north of the landing area. This image was taken in May 2016, and it was the Google Earth image that most closely represented the conditions at the time of the accident flight. Based on reviewing video footage taken from the accident flight, and the following flight in VH‑JER, there was significantly less beach area around Jenny Lind Creek inlet at the time of the accident compared to this Google Earth image. The width of the beach near the landing area was also slightly narrower. However, there was still a substantial amount of beach surface north of the landing area at the time of the accident.

Figure 18: Image of Middle Island aeroplane landing area and the beach area to the north

Note; Actual location of the ALA was not documented and the ATSB’s estimation of the ALA’s location is based on GPS locations of previous landings and take-offs. Source: Google earth, modified by the ATSB.

Figure 19 shows the beach area to the north of the accident site as seen just after the accident. As indicated in this image, most of the sand area shown in Figure 18 was present at this time. The beach included an area of shallow water just south of the accident site, areas of hard sand, areas of hard sand with ruts and very shallow puddles and areas of soft sand. Figure 20, also taken from VH-JER just prior to it landing, shows the beach from the accident site up to the camp site.

Figure 19: Image taken from VH-JER soon after the accident showing area of beach to the north of the landing area

Source: Queensland Police Service.

Figure 20: Image taken from VH-JER on approach to land soon after the accident showing area of beach to the north of the landing area

Source: Queensland Police Service.

In summary, most of the beach area north of the ALA indicated in Figure 18 was present at the time of the accident flight. More specifically, as indicated in the video footage from VH-WTQ, the aircraft was almost over the beach at the time of the engine power loss (1037:34). Figure 18 compares this location with the estimated touchdown point of VH-JER (heading south) a few minutes after the accident (see also Figure 6). Based on a review of video footage from VH‑JER, from 1037:38 (just after the pilot commenced a right turn), there was about 440 m (1,440 ft) along the beach until abeam where the aircraft wreckage was located. In addition, there was about 380 m (1,250 ft) from the accident site around to the north-west tip of the beach (past the camp site).

Airborne inspections and precautionary search and landings

General information about precautionary search and landing

The operator advised that its practices for conducting an airborne inspection of a beach ALA were based on the widely-known industry procedure for a precautionary search and landing.

A precautionary search and landing is a procedure for conducting a safe, powered landing away from an aerodrome or an ALA with known suitable landing surface conditions. It is normally conducted for two reasons:

• a landing on an unprepared landing surface made necessary due to an abnormal or emergency situation, such as deteriorating weather, insufficient remaining daylight, fuel shortage, technical problem, developing medical condition or any other reason determined by a pilot
• a pre-planned landing when the pilot is unfamiliar with the landing area or its condition is unknown.

Conducting a precautionary search and landing was a requirement for obtaining a private pilot licence (PPL). The relevant competency requirement included some key elements for conducting a search, but it did not prescribe the number of inspection circuits or height of each inspection. Pilots were not required to hold a low-level flying rating to conduct a precautionary search and landing procedure.

CASA did not provide pilots or operators with formal guidance material about conducting a precautionary search and landing. However, CASA’s Flight Instructor Manual (version 2, 2006) included the following guidance for flight instructors:

...fly parallel to and normally to the right of the proposed landing path. This run should be made with the optimum flap setting at slow cruising speed. This preliminary inspection should be sufficiently low for the surface to be inspected but not so low that it is necessary to avoid obstacles. If not satisfied with the surface complete at least one other inspection run at a lower height if necessary.

When satisfied with the area, complete a circuit keeping the field in sight.

A subsequent section of the Flight Instructor Manual on conducting an air exercise stated:

When in a suitable area descend to about 500FT above the ground…

Choose a suitable airstrip and demonstrate how to inspect the surface. Fly at low safe cruising speed with the optimum flap setting. Fly over the field slightly to the right of the intended landing path. Fly over the field slightly to the right of the intended landing path at about 100FT to make the first check. On this run check the surface and drift and note any high ground and obstacles in the overshoot area. Climb up to about 500FT and make a circuit keeping the field in sight and placing the aeroplane in a favourable position to make a dummy approach, again to the right of the landing path. On this approach re-check the surface and drift. Repeat the circuit and if quite satisfied with the surface carry out a short field landing procedure or go around procedure.

The information in the manual did not include the number of inspection circuits or recommended heights or configurations for a precautionary search.

CASA advised that many flying training organisations have adopted the guidance provided by the Aviation Theory Centre, a publisher of commonly-used flight training manuals in Australia. This guidance included the following for carrying out a safe approach and landing at an unfamiliar field with engine power available:

• conduct a first inspection at 500 ft AGL circuit height, slightly to the right of the landing area (to check for obstacles on approach and departure and general condition of the landing surface)
• conduct a second inspection at 200 ft, climb back to 500 ft before turning and conducting a 500 ft circuit (for a closer examination of the landing surface and other hazards)
• a third inspection at 50 ft, climb back to 500 ft before turning and conducting a 500 ft circuit (if required for a closer inspection of the landing surface)
• conduct the inspections with some flap extended (to provide a slower speed and other advantages, such as a smaller turn radius and better view from the cockpit due to a higher nose attitude).

The ATSB reviewed samples of guidance material about precautionary search and landing provided by or distributed by flying training organisations. The guidance was generally consistent with that provided by the Aviation Theory Centre, although some advocated that the second inspection should be conducted at 250 ft and some advocated that the third inspection should be conducted at 100 ft. Some guidance material advocated two inspections rather than three.

The Civil Aviation Authority of New Zealand (CAANZ) provided formal, detailed guidance for the conduct of a precautionary search and landing procedure. It advocated a first inspection at 500 ft and, if required, a second inspection no lower than 200 ft. It stated that:

Descent below 200 feet agl is not recommended, because it takes considerable concentration to fly the aeroplane level and look at the landing site surface. Also, there is a possibility of unseen obstructions, and since a climb to 500 feet agl will be initiated on completion of this inspection, the climb is minimised.

The major portion of the aeroplane’s inertia will be spent in the first two thirds of the landing roll. Therefore, it is generally recommended that the low-level inspection is not prolonged, but a climb to 500 feet agl initiated about two thirds of the way along the landing site…^[30]

None of the guidance material regarding precautionary search and landings reviewed by the ATSB specifically discussed the importance of considering (and managing the risk of) an engine failure while conducting a low-level inspection.

Civil Aviation Regulation 1988 (CAR) 157 (Low flying) stated that a pilot must not fly lower than 1,000 ft over built-up areas, or 500 ft over any other area. It also stated that this height was the height above the highest point of the terrain and any object on it within a radius of 600 m (for aircraft other than a helicopter). These requirements were also specified in the operator’s Operations Manual. CAR 157 also stated that the minimum height requirement did not apply if the aircraft was ‘actually taking-off or landing’ or conducting a baulked landing or missed approach. Flying a precautionary search and landing procedure below 500 ft of an ALA prior to landing was also exempt from the requirement.

Operator’s practices for airborne inspections of a beach landing area

The operator’s normal practice was to conduct an airborne inspection of the Middle Island ALA on the first fight of the day to the ALA and at other times when deemed by the pilot as necessary to inspect the beach landing surface. The chief pilot and pilot of the accident flight stated that between them they normally conducted one inspection each day that flights were conducted.

The chief pilot reported that, following a high tide, the beach conditions could change. The airborne inspection was therefore necessary in order to detect if there were any hazards such as ruts, pot holes, washaways, debris or areas of soft sand. He advised a good indicator of hard sand was the sand balls made by crabs.

The operator’s Operations Manual contained no guidance as to what height or configuration to use when conducting an airborne inspection, or how many passes to conduct. The manual required a pilot to look for the sand balls, and the chief pilot stated that in order to conduct an appropriate inspection (including looking for the sand balls) a pilot had to be at a low level.

In terms of how the operator’s pilots conducted airborne inspections at Middle Island:

• The chief pilot stated that he normally conducted the inspections at 50 ft above the landing surface, while flying to the north. He also advised that he conducted the inspections in a clean configuration (that is, with no flap selected and at normal cruise speed). He recalled being trained to conduct a precautionary search in a clean configuration so that there was less drag and more climb performance following the procedure.^[31]
• The pilot of the accident flight stated that he normally conducted the inspections at 150–200 ft, while flying to the north. As noted in the following section, review of GPS data for previous flights indicated that he normally conducted the inspections at 50–100 ft. The pilot also advised that he conducted the inspections in a clean configuration.
• Another pilot who briefly conducted flights for the operator in late 2015 stated that he conducted the inspections at not below 500 ft, while flying to the north, and if necessary would conduct additional passes at a lower height. He stated that he conducted the inspections either with a clean configuration or with 20º of flap, depending on the wind and other conditions at the time.

Both the chief pilot and the pilot of the accident flight advised the ATSB they were aware of the general industry guidance to conduct a precautionary search and landing with inspections at a series of decreasing heights. The pilot of the accident flight stated that such guidance applied to situations where a pilot was dealing with an unknown landing area, whereas their operations to Middle Island ALA involved a known landing area with conditions that could have changed.

The Operations Manual contained no guidance on what to do in the event of an engine failure at low level during an airborne inspection. The chief pilot stated that he had not considered the possibility of an engine failure during a low-level inspection. He also noted that pilots received training for engine failures at low level as well as precautionary search and landing during their basic training, and therefore he had not considered it necessary to require any further training or guidance in these areas.

Both the chief pilot and pilot of the accident flight noted that, at almost all stages of their flights to the beach ALAs, they had more than sufficient height to glide to and safely land on a beach in the event of an engine failure. They stated that the only exception, identified following the accident, was when doing an airborne inspection at the Middle Island ALA to the north (such as during the accident flight) (although see also Review of take-offs from Middle Island ALA and Operations over water and ditching procedures).

The pilot who briefly conducted flights for the operator in late 2015 stated that, depending on the position of the aircraft at the time of an engine failure, the best option would be to land on the remaining area of the ALA or the sand to the east of the camp site. He stated that although the latter area had soft sand, it was still a safer option than landing on the water.

Review of airborne inspections at Middle Island ALA

The ATSB reviewed the data on the GPS unit recovered from the accident site. A total of 19 airborne inspections of the Middle Island ALA were identified during the period from 12 November 2016 to 4 January 2017. Based on a high degree of correlation between the GPS data and the pilot of the accident flight’s logbook, it appeared that all of these inspections were conducted by the pilot of the accident flight.

• All of the airborne inspections involved flying slightly to the right of the ALA and heading north, towards Bustard Head. The average (mean) lowest altitude was 70 ft and the median was 56 ft.^[32] The lowest altitude for one inspection was 190 ft, two were about 110 ft, four were 70–90 ft, and the remainder (12) were 60 ft or lower.

Of the 19 airborne inspections:

• 11 were followed by a landing to the south on the ALA
• 6 were followed by a landing to the north
• 2 were immediately followed by a landing at the nearby Aircraft Beach ALA (prior to the aircraft returning to land at Middle Island ALA).

No airborne inspections of Aircraft Beach ALA were identified in the GPS data, even though that beach ALA was often used. The pilot of the accident flight advised the ATSB that, due to the firm and consistent nature of that beach, airborne inspections were not required. However, due to the potential for conditions to change at Middle Island ALA, an airborne inspection at that ALA was always required for the first flight after a tide.

Most of the airborne inspections that were followed by a landing on Middle Island ALA to the south involved the following pattern (Figure 21):

• the aircraft remained at about 50–100 ft above mean seal level (AMSL) until past the operator’s camp site (located at the northen end of the ALA)
• passing the camp site the aircraft climbed over the Jenny Lind Creek inlet
• the aircraft reached a maximum altitude of 450–600 ft AMSL while the pilot made a right turn over Bustard Head
• the pilot established the aircraft on the beach ALA centreline and conducted an approach and landing to the south.

Figure 21: VH-WTQ GPS-derived regular flight path for an airborne inspection on the southerly beach landing area (green line)

Source: Google earth, modified by the ATSB.

In general, the aircraft passed within 300 m to the east of the lighthouse (which had a focal height of 336 ft) on Bustard Head during the approach to landing, often at an altitude of about 450–500 ft AMSL, passing directly over terrain which was up to 280 ft AMSL. In a small number of cases, the right turn over Jenny Lind Creek was completed to the west of Bustard Head, with the aircraft reaching an altitude of 350–600 ft prior to the approach.

Most of the airborne inspections that were followed by a landing on Middle Island ALA to the north involved the following pattern (Figure 22):

• the aircraft remained at about 50–100 ft AMSL and flew past the operator’s camp site
• passing the camp site the aircraft commenced a climbing left turn over the Jenny Lind Creek inlet
• the aircraft reached a maximum altitude of about 300–400 ft AMSL while the pilot conducted a left circuit
• the pilot established the aircraft on the beach ALA centreline and conducted an approach and landing to the north.

Figure 22: VH-WTQ GPS-derived regular flight path for an airborne inspection on the northerly beach landing area (green line)

Source: Google earth, modified by the ATSB.

In all cases, there was a significant segment of the airborne inspection and climb out that had no suitable forced landing areas in the event of an aircraft emergency such as an engine power loss (Figure 21 and Figure 22). In none of the cases was a standard (four-leg) circuit pattern flown after the inspection.

The chief pilot stated that he conducted airborne inspections using similar flight paths as those shown in Figure 21 and Figure 22.

Airborne inspection procedures of another operator

The ATSB obtained the operations manual of another operator that routinely conducted passenger charter flights that involved landings at a beach ALA in small aeroplanes. The manual, last revised in 2015, included specific procedures that stated that beach landing area inspections had to be conducted no lower than 300 ft AGL.

The landing area inspections were generally conducted while flying downwind. However, the operations manual stated that inspections would typically be conducted ‘at an indicated airspeed no greater than 100 knots and it is preferable that a stage of flap is used for this procedure’.

This other operator’s beach ALA had significant areas of beach available at each end, and therefore a pilot could always land straight ahead in the event of an engine power loss during an inspection.

The other operator’s procedures also required that each pilot undergo a proficiency check every 90 days with a check pilot, and that such a check involved conducting a beach inspection.

Procedures following engine failure or power loss

Engine failure rates

A recent ATSB research study examined piston engine failures in small aircraft (up to 800 kg MTOW) in Australia between 2009 to 2014.^[33] The reported failure rate for Textron Lycoming engines was about 13 failures per 100,000 flight hours, Continental engines 12 per 100,000 hours and Rotax engines 15 per 100,000 hours. These statistics did not include fuel exhaustion or fuel starvation events.

These statistics indicate that, although engine failures are relatively rare, they do happen. Given the potential severity of the consequences of an engine failure or power loss in a single engine aircraft, such occurrences therefore need to be planned for and managed.

Training and guidance for managing an engine failure or power loss

An engine power loss after take-off is an event that occurs after the aircraft is airborne and on initial climb immediately after take-off, generally below circuit height, while being within close proximity to the departure aerodrome. Pilots are trained to deal with a total power loss scenario with a set of basic checks and procedures before their first solo flight. Furthermore, that training, which emphasises the limited time available to respond, is regularly practiced in an attempt to ensure that decision making and the conduct of appropriate actions by a pilot is second nature.

Pilots are generally taught that, if an engine fails at a low altitude, the safest course of action is to land in the most suitable area within about 30º left or right of the direction of flight. Pilots are also taught to only consider a turnback manoeuvre once they have achieved a minimum height, which may vary depending on the aircraft type and other factors.

A turnback following a low altitude engine power loss requires accurate flying, during a period of high stress and time pressure, to prevent a stall and possibly a spin occurring. If an aerodynamic stall and or spin occur at low level, there is little likelihood of recovery.

Successful completion of a turnback manoeuvre to land on a runway, beach, or other suitable area, requires well-developed procedures and good pilot proficiency to ensure these procedures are effectively applied. The impact of wind and weather conditions must also be accounted for when electing to conduct a turnback. During a turnback, pilots must constantly assess the ability of the aircraft to complete the procedure and be prepared at any time to cease the turn and land ahead.

In terms of minimum heights for considering a turnback, the United States’ Federal Aviation Administration (FAA) Airplane Flying Handbook (FAA-H-8083-3B) provided the following advice:

Consider the following example of an airplane which has taken off and climbed to an altitude of 300 feet above ground level (AGL) when the engine fails [Figure 23]. After a typical 4 second reaction time, the pilot elects to turn back to the runway. Using a standard rate (3° change in direction per second) turn, it takes 1 minute to turn 180°. At a glide speed of 65 knots, the radius of the turn is 2,100 feet, so at the completion of the turn, the airplane is 4,200 feet to one side of the runway. The pilot must turn another 45° to head the airplane toward the runway. By this time, the total change in direction is 225° equating to 75 seconds plus the 4 second reaction time. If the airplane in a power off glide descends at approximately 1,000 fpm, it has descended 1,316 feet placing it 1,016 feet below the runway.

Figure 23: Illustration of altitudes and distances required to conduct a successful turnback to a runway following an engine power loss at 300 ft

Source: Federal Aviation Administration.

A substantial amount of guidance material has been published about managing engine failures after take-off, and such guidance material continually emphasises the importance of not considering a turnback until a pre-determined safe altitude has been reached. For example, a recent article in CASA’s Flight Safety Australia publication (Stobie 2019) provided the following guidance:

If you’ve passed any level of licence, you’ve been taught how to handle engine failure. The specifics vary between types, but generally the doctrine is: maintain control, identify engine failure, conduct critical immediate actions, perform trouble checks which, if unsuccessful, leads into a forced landing procedure…

Something that should have stuck from basic training was that you should never turn back following engine failure immediately after take-off. There’s good reason for this lesson—countless fatal accidents have involved pilots unsuccessfully attempting to turn back to the airport following an engine failure on upwind at low level. It’s often labelled the impossible turn, and it’s a procedure fraught with risk.

At some point after departure though, returning to the airport is the safest option. A concept many single-engine operators use is a minimum turn-back height, which serves as a decision point within the take-off safety brief. The time to decide this is before take-off.

The minimum turn-back height splits a take-off safety briefing into three parts:

An event (engine failure or otherwise) before rotation, necessitating stopping/preparing for an overrun.

Engine failure between rotation and turn-back height, where you accept the off-airport landing and focus on preparing for that (choosing the most suitable area and configuring for the slowest landing and impact possible).

Engine failure above turn-back height, where you focus on a steep turn back and maximising glide performance to make it back to the airport.

A clear, defined plan removes indecision under pressure. You either are above or below your turn-back height; there’s no grey area. Formalising the decision relieves the temptation to attempt the impossible turn, and conducting a structured take-off safety brief diminishes the startle effect by placing the immediate actions in the forefront of your mind.

There are many considerations for nominating a minimum turn-back height—your abilities as a pilot, aircraft characteristics, wind direction and runway length, to name a few. An instructor familiar with your circumstances will be able to give you guidance here. Better yet, a dual training flight specifically on engine failure after take-off will allow you to determine exactly what height or point in the circuit you can consistently achieve a safe turn back.

CASA’s Flight Instructor Manual stated that, following an engine failure after take-off:

Choice of landing area and height available must be considered together. The amount of turn should be restricted to the minimum dictated by obstacles ahead. It must be stressed that the rate of descent and stalling speed will increase in any turn.

The manual included a diagram (Figure 24) showing the usual areas to consider for landing. It noted that the intention should be to have the wings level (after any turn) by no lower than 200 ft AGL.

Figure 24: Landing area selection following an engine failure soon after take-off

Source: CASA.

Responding to a total engine failure or power loss soon after take-off is undoubtedly an emergency situation associated with a high level of stress and time pressure, which can contribute to inappropriate decisions. There is a well-documented tendency for many pilots (including experienced pilots) to not land straight ahead, but rather attempt to turn back and land at the aerodrome. To help overcome this instinctive tendency, it is widely and strongly recommended that pilots mentally prepare for the possibility of an engine failure prior to take-off, and mentally rehearse the appropriate emergency response action immediately prior to take-off (for example, Civil Aviation Authority New Zealand 2015).

In general, managing a partial power loss in a single-engine aircraft can be more problematic than managing a total power loss, because a total power loss commits the pilot to an emergency landing. Guidance for the partial power loss situation has been provided by the ATSB.^[34]

Aircraft manufacturer’s procedures for managing engine failures

VH-WTQ was a Cessna 172M and VH-JER was a Cessna 172N. The Owner’s Manuals for these Cessna 172 models contained the following emergency procedure for an engine failure after take-off:

Prompt lowering of the nose to maintain airspeed and establish a glide attitude is the first response to an engine failure after take-off. In most cases, the landing should be planned straight ahead with only small changes in direction to avoid obstructions. Altitude and airspeed are seldom sufficient to execute a 180 degree gliding turn necessary to return to the runway. The following procedures assume that adequate time exists to secure the fuel and ignition systems prior to touchdown.

1) Airspeed – 75 MPH (flaps UP).
                       70 MPH (flaps DOWN).

2) Mixture – IDLE CUT-OFF.

3) Fuel Selector Valve –OFF.

4) Ignition Switch – OFF.

5) Wing Flaps – AS REQUIRED (40º recommended).

6) Master Switch – OFF.

Operator’s procedures and practices for managing engine failures

The operator’s Operations Manual stated, for each aircraft type (including the Cessna 172):

Manufacturers checklists for both Normal and Emergency Procedures will be used at all times.

In a section on the use of checklists, the manual stated:

The initial emergency check list actions for fire and/or engine failure are to be actioned by memory recall and completed by cross-check with the printed check list when time permits. The remaining emergency and abnormal check list items are generally to be completed by use of the printed check list.

Another section stated:

For all critical emergencies – e.g., engine failure or fire - Company pilots are expected to be capable of completing the initial actions (annotated *) by memory recall. Since in many instances time is of the essence and any delay in initiating the correct and timely action can severely degrade completion of a successful landing, Company pilots are encouraged to formulate an action plan for all critical phases of flight – such as take-off – and self-brief the initial immediate actions to be carried out in the event of a critical emergency.

The Operations Manual contained no information, procedures or instructions for managing specific emergencies, such as an engine power loss at low level after take-off (or during a go-around or airborne inspection). The manual also contained no guidance on minimum heights to achieve during a take-off before attempting a turn back following an engine failure.

Civil Aviation Regulation (CAR) 16(General requirements for aircraft on the manoeuvring area or in the vicinity of a non-controlled aerodrome) required that a pilot conducting a take-off from an uncontrolled aerodrome maintains the same track as the take-off until the aircraft is 500 ft above the terrain, unless it is necessary to avoid terrain.

The chief pilot indicated that his minimum height before conducting turns was 500 ft. He was aware of the guidance information regarding maintaining a straight heading after an engine failure or power loss unless a safe height had been reached, and that at 500 ft a safe turnback could be conducted. The other pilot who briefly conducted flights for the operator in late 2015 also advised that the normal take-off procedure was to reach 500 ft before turning. He also advised that his personal minimum before attempting a turnback would be 600–800 ft depending on the conditions.

The pilot of the accident flight advised that he would normally consider 400–500 ft as a minimum height after take-off before considering a turnback. He said he was aware of the risk associated with attempting a turn back to land following an engine failure soon after take-off, and he was aware of the industry guidance to land straight ahead or within a narrow arc (or ‘cone of commitment’). However, in the case of the accident flight, at the time of the engine power loss he believed a landing straight ahead would result in a ditching (see Engine power loss). He also believed that a ditching would involve a very high risk due to an aircraft with fixed landing gear likely to cartwheel or flip over. In addition, there was risk associated with a significant current in the channel (due to an outgoing tide), no life jackets on board the aircraft and bull sharks known to be in the channel.

The chief pilot advised the ATSB that the operator’s flights were very safe as they almost always had a (beach) runway underneath them. The chief pilot and the pilot of the accident flight stated most take-offs were to the south, so that they always had beach ahead of them during the climb. They also advised that, if they had to take-off to the north, they would taxi down the ALA to the south so that they would fly over the water at a safe height during take-off.

Review of take-offs from Middle Island ALA

The ATSB reviewed the recorded take-offs from Middle Island ALA on the GPS unit recovered from VH-WTQ. A total of 57 take-offs from Middle Island ALA were identified during the period from 12 November 2016 to 4 January 2017, with most (47) being flights to Agnes Water and the other 10 being flights to Aircraft Beach.

Most of the take-offs were conducted to the south on a flight back to Agnes Water ALA, with the aircraft maintaining a climb straight ahead over the beach until well above 500 ft. However, other flights included:

• Five flights conducted from Middle Island to Aircraft Beach that commenced with a take-off to the south, followed by a sharp turn to the right over terrain (three flights) or left over water (two flights), with the turns commencing below 200 ft AMSL.
• Two flights from Middle Island to Aircraft Beach that commenced with a take-off to the north, with both flights passing over the Jenny Lind Creek inlet at a low height soon after take-off before flying over Bustard Head, just to the right of the lighthouse and at a height of about 200 ft AGL (Figure 25).
• Two flights from Middle Island to Agnes Water that commenced with a take-off to the north, before turning to the left at a low height (below 200 ft AMSL) and then proceeding to Agnes Water (Figure 25).
• One flight from Middle Island to Agnes Water that commenced with a take-off to the south before turning sharply to the left over water, coming back over the northern end of the Middle Island ALA and descending to a lowest height of about 40 ft abeam the camp site, conducting a right turn around the Bustard Head lighthouse at an altitude of about 500 ft AMSL and then proceeding back to Agnes Water (see Figure 26).

In terms of approaches to Middle Island ALA, many of the approaches that did not involve an airborne inspection involved conducting a turn onto final approach below 500 ft AGL.^[35] The most notable flight was an approach to the Middle Island ALA from over the water down to about 80 ft abeam the camp site before a left circuit and return to a landing on Middle Island. During the left circuit the aircraft only reached a maximum altitude of about 200 ft AMSL (when over terrain of about 100 ft) (see Figure 26). This flight was conducted on the same day (1 January 2017) as the last take-off listed above.

Almost all of the specific flights listed above appeared to be conducted by the pilot of the accident flight as they matched flights documented in the pilot’s logbook. However, two of the flights were conducted on 1 January 2017, a day which the pilot did not record any flights in his logbook. There were also no flights certified on the aircraft’s maintenance release that day.^[36] The chief pilot stated that he could not recall conducting any flights in VH-WTQ following its last maintenance (on 20 September 2016), and also reported that no other pilots conducted flights for the operator during this period.

Figure 25: GPS flight paths of take-offs to the north flown in VH-WTQ

Source: Google earth, modified by the ATSB.

Figure 26: Additional observed GPS flight paths flown in VH-WTQ on 1 January 2017

Source: Google earth, modified by the ATSB.

In summary, there were several flights in VH-WTQ during the period from 12 November 2016 to 4 January 2017 at Middle Island where turns were conducted at less than 200 ft after take-off, including some flights over water. In addition, a number of flights involved segments where, if there was an engine failure, a forced landing on to water or hazardous terrain could not have been avoided. It was also relatively common practice to conduct manoeuvring below 500 ft AGL prior to being established on final approach.

The ATSB also reviewed some of the flights to or from Aircraft Beach. Most of the take-offs from Aircraft Beach were conducted to the north-west, and almost all of these involved sharp turns to the left after take-off at or below 200 ft. For many of these flights, if there was an engine failure, a forced landing on to water or hazardous terrain could not have been avoided. Many of the flights to Aircraft Beach involved flying the downwind circuit leg over water before conducting a left turn back to land on the beach. For some of these flights, it is very unlikely that the aircraft would have been able to conduct an emergency landing on land in the event of an engine failure towards the end of the downwind leg. In addition, many of the landings involved turns onto final approach below 500 ft AGL.

Manoeuvres during flights

Requirements for aerobatic manoeuvres

Civil Aviation Safety Regulations (CASR) 1998 (Dictionary, Part 1–Definitions) defined aerobatic manoeuvres as those that involve:

(a) bank angles that are greater than 60˚; or

(b) pitch angles that are greater than 45˚, or are otherwise abnormal to the aircraft type; or

(c) abrupt changes of speed, direction, angle of bank or angle of pitch.

To legally conduct aerobatic manoeuvres, pilots were required to have an aerobatics flight activity endorsement on their pilot’s licence. To obtain this endorsement, a pilot was required to have received training and demonstrated competency in relevant course units, including recovery from unusual attitudes and spins. CASR subpart 61.S (Flight activity endorsements) stated the requirements for aerobatic endorsements. These included:

• an initial aerobatic endorsement would authorise the pilot to conduct aerobatic manoeuvres in an aeroplane above 3,000 ft above ground level (AGL)
• subsequent endorsements were necessary for aerobatic activities at lower altitudes.

Civil Aviation Regulation (CAR) 155 (Aerobatic manoeuvres) stated additional requirements for aerobatics. These included that the only aerobatic manoeuvres that could be conducted were those specified within an aircraft’s certificate of airworthiness and/or flight manual.^[37]

The Cessna 172 was certified for operations in the normal and utility categories. The Cessna 172M Owner’s Manual stated:

The normal category is applicable to aircraft intended for non-aerobatic operations. These include any maneuvres incidental to normal flying, stalls (except whip stalls) and turns in which the angle of bank is not more than 60°…

This aircraft is not designed for purely aerobatic flight. However, in the acquisition of various certificates such as commercial pilot, instrument pilot and flight instructor, certain maneuvres are required by the FAA. All of these maneuvres are permitted in this aircraft when operated in the utility category…

Aerobatics that impose high loads should not be attempted… In the execution of all maneuvres, avoid abrupt use of controls…

To conduct manoeuvres in the normal category, the maximum gross weight was 2,300 lb (1,043 kg) and the flight load factors had to be +3.8 g to -1.52 g (with flaps up). The operator’s Cessna 172 charter flights were conducted in the normal category.

If the aircraft was flown in the utility category, the rear seat and baggage compartment had to be empty. The maximum gross weight was 2,000 lb (907 kg) and the flight load factors had to be +4.4 g to -1.76 g (with flaps up). The manual specified the specific types of aerobatic manoeuvres that were permitted, including steep turns, spins, lazy eights and chandelles. However, abrupt use of the controls for such manoeuvres was prohibited above 112 mph (97 kt).

• CAAP 155-1(0) (Aerobatics) provided pilots with information and guidance on safety aspects related to aerobatic flight. With respect to low-level aerobatic flight (below 3,000 ft), section 7.3.2 of the CAAP stated:

It is highly probable that the consequence of an error or failure during low-level aerobatics will be fatal to the participants.

Operator’s procedures and practices

The operator routinely conducted passenger charter flights from Agnes Water to either Middle Island ALA or Aircraft Beach ALA. These flights were advertised as including various manoeuvres en route to provide passengers with some ‘thrills’ or excitement.

Prior to such a flight, passengers were required to sign a consent form. The form stated:

Passenger request for the pilot to demonstrate manoeuvres within the “normal” ability of the aircraft. If you wish to experience angles of bank up to 60 degrees of bank and “G” forces from ‘0” G and up to 1.5 G force.

DO NOT SIGN THIS FORM IF YOU HAVE ANY FEARS OF FLYING OR HEIGHTS!

The chief pilot stated that passengers wanting a straight and level flight had to request this specifically. He also advised that the en route manoeuvres were an essential part of his business, as passengers wanted and ‘demanded’ the experience. The chief pilot and the pilot of the accident flight stated that the manoeuvres they conducted during their charter flights did not include aerobatic manoeuvres and they were within the required limits for the aircraft type.

Some of the operator’s passengers on the day of the accident indicated that, before arriving at Agnes Water and signing the consent form, they were aware that their flight would include various manoeuvres not normally performed on a passenger charter flight.

The operator’s Operations Manual contained no specific procedures outlining how the en route manoeuvres were to be conducted. Instead, the manual stated:

Passenger comfort is also complementary to safety and in order to maintain maximum passenger comfort and confidence in the air, pilots should take all reasonable steps to avoid:

• areas of atmospheric turbulence;

• sudden or violent flight manoeuvres;

• steep turns; and

• descending at a rate of more than 1000 feet per minute.

Another section of the manual stated that, during cruise:

No turns exceeding 30° angle of bank.

The operator’s Operations Manual contained a section on the conduct of aerobatic flight. It stated:

Acrobatic^[38] flight may only be performed in company aircraft approved for the purpose. Only those pilots specifically authorised by the Chief Pilot are permitted to conduct acrobatic flight, and their personnel records must be certified accordingly.

Acrobatic flight may not be performed at such a height that recovery from any manoeuvre cannot be accomplished by 3000 feet above the highest point of the terrain…

Neither the chief pilot or the pilot of the accident flight held an aerobatics flight activity endorsement on their pilot’s licence.

Manoeuvres conducted during the accident flight

Following the accident, CASA conducted a regulatory review of the operator’s operation and the suitability of the chief pilot and the pilot of the accident flight to maintain their pilot licences. As part of its investigations, it reviewed the video footage of the flight (obtained from the police) and other information. Ultimately, CASA concluded that:

During the flight the pilot engaged in manoeuvres that are capable of being characterised as “aerobatic manoeuvres” as per the definition in Part 1 of the Dictionary in the Civil Aviation Safety Regulations 1998 (CASR). Namely, the observed manoeuvres appear to involve abrupt changes in speed, direction, angle of bank or angle of pitch. The aircraft was observed at various times to bank steeply and to engage in abrupt pitch changes where the aircraft climbs and then steeply descends so as to result in a negative-g situation.

Irrespective of whether the observed manoeuvres were aerobatic in nature, they should not have been engaged in during the course of a charter operation with passengers on board… The act of initiating abrupt pitch control inputs, and high angle of bank manoeuvres below 1000 feet AGL reduces the ability of the pilot to effect a safe outcome subsequent to unexpected aircraft malfunction, or loss of situation awareness leading to altitude loss…

The chief pilot and pilot of the accident flight stated they had reviewed the video footage from the accident flight, and they believed that none of the manoeuvres were aerobatic. The chief pilot analysed a steep right turn conducted during the flight, and believed it to be conducted with a maximum bank angle of 57°.

The ATSB reviewed the video footage. It determined that the steep right bank conducted during the flight briefly reached a maximum bank angle of 65–70°.

Survival aspects

Occupant injuries

The more significant injuries sustained by the four occupants during the impact were (from front to back):

• Pilot in front left seat (seriously injured): fractures of the back and legs, lacerations to the head.
• Front right-seat passenger (seriously injured): broken feet, hairline fracture of the spine, lacerations to the head.
• Rear left-seat passenger (fatally injured): fractured vertebrae in the neck, significant cardiovascular injury, fractured ribs, fractured left upper arm.
• Rear right-seat passenger (seriously injured): fractured vertebrae in the neck, significant internal head injury, fractured pelvis, fractured left ankle.

The rear left-seat passenger’s neck and cardiovascular injuries were not survivable. The front-seat occupants were both conscious immediately following the accident, but the right rear-seat passenger was unconscious and in a coma for an extended period.

There was no evidence from the deceased passenger’s post-mortem examination to indicate that she had been struck from behind by any object (such as loose baggage or camp supplies). Similarly, the injuries reported by the other rear-seat passenger were not consistent with being struck from behind.

Impact forces and survivable space

The distance between the nose impact point to where the aircraft came to rest was about 5 m. The angle of impact was calculated to be greater than 45° nose down and about 60° left bank. The aircraft’s airspeed at the time of impact was about 60 kt (or about 110 km/h). Although the aircraft’s forward speed was not high for an aircraft accident, the short wreckage trail distance and high angle of impact in combination indicated that the aircraft decelerated in a short period of time. This meant that significant impact forces would have been imparted on the aircraft’s occupants.

The liveable space in the aircraft was compromised by significant damage to the cockpit and cabin area. This made it more likely that the aircraft occupants would come in contact with the aircraft structure during the accident sequence, particularly for occupants in the front and/or left side.

Seat belts and upper torso restraints (UTRs)

Requirements

CASR 90.105 required that the seats in the front row of an aircraft must be fitted with an approved safety harness. For small aeroplanes (with MTOW less than 5,700 kg) and helicopters, the safety harness needed to consist of a lap belt and at least one shoulder strap. In Australia, this requirement was specified in a 1995 airworthiness directive (AD) for all aircraft, and previous requirements for new aircraft, until transferred to CASR 90.105 in 2010.

CASR 90.110 required that, for small aeroplanes manufactured on or after 13 December 1986,^[39] each seat in the aircraft being used during take-off or landing must have an approved seat belt and shoulder harness. CASR 90.115 stated a similar requirement for helicopters manufactured on or after 17 September 1992. These regulatory requirements were based on requirements introduced by the United States’ Federal Aviation Administration (FAA) in response to a series of recommendations and safety studies (see Appendix C).^[40] In Australia, these requirements were initially specified in ADs until they were transferred to CASR Part 90 in 2010.

In this report, the term ‘upper torso restraint’ (UTR) is used to refer to a shoulder harness or shoulder strap.

Seat belts in VH-WTQ

Consistent with the regulatory requirements, the two front seats of VH-WTQ (manufactured in 1973) were fitted with a lap belt and UTR (similar to those fitted standard to modern road vehicles) and the two rear seats were fitted with lap belts only. Each of the lap restraints were attached to attachment points on the floor and the UTRs for the front seats were attached to attachment points on the roof structure. If UTRs had been fitted for the rear seats, they would also have been attached to attachment points on the roof structure.

All the occupants were wearing the provided restraints at the time of the accident. There was no indication that any of the restraints had failed. However, during the impact sequence, the floor and roof structures were compromised. In addition, both the front seats and the rear bench seat separated from the floor structure in overload.

The operator’s other Cessna 172 aircraft, VH-JER, was manufactured in 1978 and also did not have UTRs fitted for the rear passenger seats.

Research into the benefits of UTRs

A substantial amount of research has consistently shown that seat belts in small aircraft that include a UTR significantly reduce the risk of injury compared to lap belts only. UTRs minimise the flailing of the upper body and reduce the risk of impacts involving the head and upper body.

For example, a safety study by the United States’ National Transportation Safety Board (NTSB) in 1985 examined 535 accidents involving small aircraft in 1982.^[41] It estimated that 20 per cent of the 800 fatally injured occupants would have had only serious injuries or minor injuries if they had been wearing a UTR. In addition, 88 per cent of 229 seriously injured occupants would probably have had less severe head or upper body injuries, only minor injuries or no injuries if they had been wearing a UTR.

A 2011 safety study by the NTSB examined the rate of serious and fatal injuries of pilots in single-engine aeroplanes during the period 1983–2008. It found that pilots wearing only a lap belt had a 49 per cent greater likelihood of a serious or fatal injury compared with pilots wearing a lap belt and a UTR. Another study which examined take-off and landing accidents involving an engine power loss during 1983–1992 found that pilots wearing only a lap belt were 70 per cent more likely to be fatally injured than pilots wearing a seat belt and a UTR (Rostykus and others 1998).

In general, the forces transmitted to occupants in small aircraft involved in an accident are higher than those transmitted in large transport aircraft involved in an accident. This is still the case when taking into account the lower initial impact energy from slower speeds in small aircraft. The higher impact forces transmitted to occupants is primarily due to the lack of protection from a crushable fuselage structure and therefore reduced energy absorption in a small aircraft (CASA 2001). Front seat occupants in small aircraft will generally be exposed to higher impact forces than other occupants (assuming they are wearing the same types of restraints), but the other occupants can still be exposed to significant forces.

Recommendations for the fitment of UTRs in all seats

Based on the substantial body of research, there have been many recommendations over the years for UTRs to be fitted to all seats in small aeroplanes manufactured before December 1986, particularly for passenger transport operations (Appendix C). These recommendations have been made by investigation agencies in the United States, Canada, the United Kingdom and Australia. To date, none of these recommendations have resulted in any changes to the minimum requirements (see Appendix C).

In Australia, the then Bureau of Air Safety Investigation (BASI)^[42] issued Recommendation R19980281 to CASA in March 1999, following a fatal accident involving a Cessna 185 floatplane.^[43] The recommendation stated:

The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority mandate the compliance of all manufacturers' service bulletins relating to the provision of upper body restraint to occupants of FAR part 23 certified aircraft engaged in fare-paying passenger operations, and emphasise compliance with their instructions on the correct use of the restraint systems.

CASA issued a Discussion Paper for a proposed regulatory change in 2001. In its assessment of the responses to the Discussion Paper, CASA noted that there were difficulties estimating the true costs and benefits, and it concluded that proceeding with a comprehensive cost-benefit analysis was not warranted. It also advised the ATSB in July 2002 that:

The installation and use of shoulder harnesses for all occupants in small aircraft will be strongly recommended to operators and the travelling public, and CASA will publicise the benefits of shoulder harnesses in this class of aircraft. This will be done in the expectation that the air-travelling public will become aware of the desirability of shoulder harnesses; and operators who can make this modification without threatening their economic viability will consider doing so.

The ATSB accepted CASA’s response and closed the recommendation, stating:

While acknowledging the efforts of the Civil Aviation Safety Authority in responding to this recommendation, the Australian Transport Safety Bureau will continue to monitor occurrences involving occupant restraints.

In May 2019, the ATSB asked CASA about what guidance information it had provided operators and/or the travelling public either recommending the use of UTRs or advising of their benefits. CASA replied that, other than the Discussion Paper released in 2001, it could not identify any other guidance information it had provided.

Availability of UTRs for retrofitting aircraft

In September 1992, Cessna issued a mandatory Single Engine Service Bulletin (SEB) SEB92‑28,^[44] which stipulated the fitment of seat belt (lap belt) and shoulder harness installation for single engine airplanes not equipped with such equipment in all seat locations. The SEB stated the purpose of the service bulletin was:

To provide a metal connection type seat belt shoulder harness assemblies for all seat locations. The assemblies utilize a metal-to-metal mechanism to latch the shoulder harness to the seat belt.

Beginning with the 1971 model year, seat belts and shoulder harness assemblies incorporating the metal-to-metal connectors were provided as standard equipment for the front seats and optional equipment for all other passenger seats.

Seat belt and shoulder harness assemblies with metal parts as described above are listed in the Material Section of this Service Bulletin and must be installed in all seat locations.

WARNING: FAILURE TO INSTALL AND PROPERLY UTILIZE SEAT BELTS AND SHOULDER HARNESSES COULD RESULT IN SERIOUS OR FATAL INJURY IN THE EVENT OF AN ACCIDENT.

The SEB stated that compliance was mandatory within 400 hours or 12 months, whichever occurred first. The aircraft manufacturer also issued a mandatory multi engine service bulletin (MEB) at that time to cover some types of twin engine aircraft.

Cessna advised that the cost of a UTR kit could vary depending on the aircraft type and the supplier, and that it would normally take about 30–90 minutes to install. Current advertised prices of a UTR kit for a Cessna 172 are well below US$1,000.

Some other major aircraft manufacturers issued similar mandatory service bulletins at about the same time.^[45] Although these service bulletins were classified as mandatory by the aircraft manufacturers, Australian operators were not required to comply with the bulletins. During the course of previous investigations, CASA advised the ATSB that mandatory service bulletins from aircraft manufacturers are not mandatory unless the operator was maintaining its aircraft to the manufacturer’s maintenance schedule or the regulator from the country of manufacture issued an airworthiness directive that specifically mandated the service bulletin.

Following a recommendation in 2001 by the United Kingdom’s Air Accident Investigation Board (AAIB) (see Appendix C), the United Kingdom’s Civil Aviation Authority evaluated the costs and benefits involved in retrofitting aircraft with UTRs in all seats. It noted that for some aircraft fitting additional UTRs may be simple but for some aircraft the costs may be more significant. It stated, based on data supplied by Cessna, Raytheon and a Supplemental Type Certificate holder, an average cost per seat in 2003 was about US$1,800 (including US$1,000 for parts). Although this average cost would be higher in 2019, it should be noted that the cost for aircraft where kits are already available (such as for Cessna single engine aircraft) would generally be less.

Extent to which aircraft have been retrofitted with UTRs

It is generally assumed that the proportion of the civil aviation fleet that do not have UTRs in all passenger seats will decrease over time as older aircraft are retired and the proportion of the fleet manufactured after 1986 (for small aeroplanes) or 1992 (for helicopters) increases.

It is difficult to determine how many of the existing fleet being used for passenger transport operations was manufactured prior to 1986 and still do not have UTRs fitted to all passenger seats. At the time of its recommendation in 1999, BASI noted that (at that time) very few of the aircraft had been retrofitted. The ATSB has not identified any evidence to suggest this situation has changed. For almost all (18 of 20) the passenger transport accidents (resulting in fatal or serious injuries) involving small aeroplanes in Australia during 1998–2018, the aeroplanes were manufactured before 1986 (see Appendix C). Even during the last 10 years of this period (2009–2018), the majority of the aeroplanes involved (5 out of 7) were manufactured before December 1986. In the ATSB’s experience, for most of the accidents it has investigated involving small aeroplanes manufactured before December 1986, these aeroplanes had not been retrofitted with UTRs in all passenger seats.

In 2018, Textron Aviation advised the ATSB that, for various reasons, it was unable to state how many UTR kits had been sold for Cessna and Beech aircraft based in Australia.

In a recent safety study, the NTSB (2011) noted that a large proportion (69 per cent) of the active general aviation fleet in the United States in 2008 were manufactured before 1984. It also noted there was still a substantial number of small aeroplanes being used that had not been retrofitted.

Guidance information about UTRs

As previously noted, aircraft manufacturers such as Cessna have published safety information letters and service bulletins, encouraging the fitment of UTRs to passenger seats that did not have UTRs fitted when the aircraft were manufactured.

Regulatory authorities in some countries have also published advisory information about the benefits of installing and using UTRs. For example, the FAA issued Advisory Circular (AC) 21-34 (Shoulder harness – Safety belt installations) in 1993. The AC outlined the justification for installing a UTR, and provided guidance on factors to consider when installing a UTR. The FAA also issued a safety pamphlet in 1995 titled Seat Belts and Shoulder Harnesses: Smart Protection in Small Aeroplanes. The pamphlet advocated for the installation of UTRs in all seats.

Transport Canada Advisory Circular No. 605-004 (Use of seat belts and shoulder harnesses on board aircraft, issue 2, 2014) provided information on the benefits of UTRs and recommended their use in all small aircraft. It stated:

Accident experience has provided substantial evidence that the use of a shoulder harness in conjunction with a safety belt can reduce serious injuries to the head, neck, and upper torso of aircraft occupants and has the potential to reduce fatalities of occupants involved in an otherwise survivable accident…

As noted above, no similar guidance information has been issued in Australia by CASA.

Passenger briefings

Civil Aviation Order (CAO) 20.11 (Emergency & life saving equipment & passenger control in emergencies) stated an operator shall ensure all passengers are provided with an oral safety briefing before each take-off. The briefings were required to include (among other things) the use and adjustment of seat belts, the location of emergency exits and the use of floatation devices (where applicable). There was no requirement to orally brief the brace position.

A safety briefing card was only required for regular public transport and passenger charter flights in aircraft with a seating capacity of more than six (including crew). Such a briefing card was required to include, among other things, the brace position for emergency landing or ditching.

The operator’s Operations Manual stated that the passenger briefing before flight was to include the use and adjustment of seat belts and the location and operation of normal and emergency exits. There was no requirement to brief on the brace position, and no safety briefing cards were used.

The pilot of the accident flight reported that he conducted a passenger briefing prior to the flight, which covered aspects of the seat belts and the exits. He advised that he did not provide advice on the brace position, nor was that required.

Operations over water and ditching procedures

Civil Aviation Regulation (CAR) 258 (Flights over water) stated that a pilot must not fly a single-engine aircraft over water at a distance from land greater than the distance from which the aircraft could reach land if the engine was inoperative. However, operations over water were permitted ‘in the course of departing from or landing at an aerodrome in accordance with a normal navigational procedure for departing from or landing at that aerodrome’. In addition, the Aeronautical Information Publication (AIP) stated in ENR 1.1 that CAR 258 did not apply to charter, aerial work or private operations if each occupant was wearing a life jacket, unless they were exempted from doing so under CAO 20.11 (see Life jackets).^[46]

It is a common view that ditching an aircraft with a fixed landing gear is associated with more risk than ditching an aeroplane with retractable landing gear (with the landing gear retracted). In addition, some have expressed the view that ditching an aeroplane with a high wing is associated with more risk than ditching an aeroplane with a low wing.

Civil Aviation Advisory Publication (CAAP) 253-1(1) (Ditching), issued in 2010, provided general guidance to operators and pilots regarding ditching. It included, for aeroplanes with retractable landing gear, ditching with the landing gear selected up. It also stated:

Aeroplanes with fixed undercarriages strike the water wheels first. This is most likely to cause violent nose down pitch with the aeroplane ending up in a near vertical position with the nose buried under the water. Individual aeroplane design may have a significant effect on this outcome with aeroplanes with a significant amount of their structure ahead of the main wheels performing in a less violent manner; however, a misjudged flare may exacerbate the consequences of a ditching…

After the aeroplane has come to rest, high wing aeroplanes may quickly assume an attitude where most of their fuselage, and therefore you, is under water. Low wing aeroplanes are more likely to keep the fuselage above water. How long either type stays in that position before sinking is related to many issues…

The chief pilot and pilot of the accident flight both stated that they had previously discussed the risk associated with ditching a Cessna 172 (with a fixed landing gear) in the water. The chief pilot stated that, because of his concerns about this risk, he included the following statement in the Operations Manual:

Company policy dictates that over water flight are only to be under-taken in aeroplanes with retractable undercarriages.

The Cessna 172 Owner’s Manual included an emergency procedure for ditching (or an intentional emergency landing on water). The procedure included planning the approach into wind, using full flap and sufficient power for a minimum 300 ft/min descent rate at 70 mph (61 kt) and maintaining a continuous descent until touchdown in a level attitude. The procedure also included unlatching the cabin doors prior to touchdown, and placing a folded coat or cushions in front of the occupants’ faces at the time of touchdown.

Research has shown that ditching a high-wing aeroplane with fixed landing gear is normally successful. Newman (1988) conducted a review of ditchings obtained from the NTSB aircraft accident database between 1979 and 1983. There were 144 ditchings in certified single-engine aeroplanes. Of the 77 ditchings involving high-wing aeroplanes with fixed landing gear, eight  (10 per cent) resulted in one or more fatalities. There was no significant difference between high-wing (12 per cent) and low-wing aeroplanes (12 per cent), and between aeroplanes with fixed landing gear (13 per cent) and retractable landing gear (12 per cent). The proportion of light, multi-engine aeroplane ditchings that resulted in fatalities appeared to be higher (20 per cent), but the difference was not statistically significant.

Newman noted that using the proportion of ditchings that had fatalities as an indicator of risk was problematic, as in some cases the occupants may have survived the ditching but not survived during the period after egressing the aircraft. The review also noted that the proportion of ditchings with fatalities for retractable landing gear aeroplanes may be confounded by the presence of some high performance aeroplanes (with higher landing speeds) in this sample.

The ATSB reviewed the NTSB aircraft accident database for all occurrences involving Cessna 172 and 182 aircraft with fixed landing gear between 1998 and 2017 where the words ‘ditching’ or ‘ditched’ was used in the available NTSB report. There were 17 ditchings, and 16 resulted in no fatalities or serious injuries.^[47] With regard to the other accident, none of the three occupants were injured during the ditching, but two did not survive and the other was seriously injured after egressing the aircraft.

Life jackets

CAO 20.11 paragraph 5.1.1 required that a single-engine aircraft be equipped with a life jacket for each occupant when the aircraft was over water and at a distance from land ‘greater than that which would allow the aircraft to reach land with the engine inoperative’. However, this did not apply to an aircraft ‘departing from or landing at an aerodrome in accordance with a normal navigational procedure for departing from or landing at that aerodrome’.

In addition, CAO 20.11 paragraph 5.1.2 stated that passenger-carrying charter aircraft:

shall be equipped with a life jacket or floatation device for each occupant on all flights where the take-off or approach path was so disposed over water that in the event of a mishap occurring during the departure or the arrival it was reasonably possible that the aircraft would be forced to land onto water.

The operator’s Operations Manual included requirements for life jackets that were consistent with CAO paragraph 5.1.1. However, it did not include any requirement related to paragraph 5.1.2.

The operator’s passenger-carrying charter flights from Agnes Water to Middle Island (including the accident flight) were not equipped with life jackets. The flights frequently involved operations over water at a low altitude for a brief period as part of an airborne inspection (see Operator’s practices for airborne inspections of a beach landing area and Review of airborne inspections at Middle Island ALA). A number of other flights also involved operations over water during approach or take-off (see Review of take-offs from Middle Island ALA), although the extent to which passengers were carried on those flights could not be determined.

Life rafts

CAO 20.11 section 5.2 also stated that life rafts were required to be carried for single-engine aircraft conducting flights more than 30 minutes or 100 miles from land. The operator’s Operations Manual included requirements for life rafts that were consistent with the CAO.

On the operator’s flights from Agnes Water to Middle Island and Aircraft Beach (including the accident flight), aircraft were not equipped with life rafts, nor were they required to under section 5.2 of CAO 20.11.

Emergency locator beacon

CAR 252A (Emergency locator transmitters) required that an aircraft could only begin a flight if it was fitted with an approved fixed emergency locator transmitter (ELT) or an approved portable ELT. Various exemptions applied, which included no requirement to carry an ELT if the flight was to take place wholly within 50 miles of the departure aerodrome. Approved ELTs and approved portable ELTs had to meet various requirements, which included the ELT being registered with the Australian Maritime Safety Authority.

The operator’s Operations Manual detailed the minimum emergency equipment to be carried for a charter flight. This included a portable emergency locator beacon (ELB) if the aircraft was not fitted with a fixed ELT. VH-WTQ was not fitted with a fixed ELT.

The ATSB on-site inspection of VH-WTQ identified a portable ELB was on board the aircraft at the time of the accident. However, its registration expired in August 2015. In addition, it was registered to the previous owner of the aircraft, based in Victoria, who had no connection to the operator. As a result, if the ELB had been activated, a subsequent search may have been adversely affected.

The ELB was not required to be activated for the accident flight, due to people on the camp site and the chief pilot (and pilot of VH-JER) being aware of the accident and notifying emergency services promptly.

Organisational information

Operator history

The operator, Wyndham Aviation Pty Ltd, held an Air Operator’s Certificate (AOC) that authorised it to conduct passenger charter operations in Australian territory in single engine piston aeroplanes not exceeding 5,700 kg maximum take-off weight (MTOW). The AOC was initially issued to the operator in June 2009 (for 3 years) and last reissued in June 2015 (for 3 years).

The operator was based at Agnes Water and it primarily utilised its two Cessna 172 aircraft (VH‑JER and VH-WTQ). The majority of its flights involved transporting passengers from Agnes Water ALA to and from camp sites at two nearby beach ALAs, at Middle Island and Aircraft Beach. The operator had conducted these operations since 2009 as Wyndham Aviation, with the chief pilot conducting similar flights before then under a different arrangement (see Investigation of a complaint in 2007).

The operator conducted flights to the beach ALAs on most days, and transported up to 20 passengers a day.

The operator also carried out a small amount of general charter work utilising a Beechcraft A36 Bonanza. All operations were conducted under visual flight rules (VFR).

Personnel

At the time of the accident, the operator had two operational personnel:

• The chief pilot, who was the owner, managing director and chief executive officer of Wyndham Aviation. He controlled the day-to-day management of the organisation as well as supervising its flight operations. In addition, he held the position of head of aircraft airworthiness and maintenance control (HAAMC). The chief pilot conducted most of the operator’s flights, normally in VH-JER. He also managed the commercial side of the operation, and was actively involved in managing the commercial activities at the camp sites.
• The pilot of the accident flight, who had conducted many flights for the operator over the previous 6 years, normally in VH-WTQ.

In late 2015, another pilot briefly conducted flights for the operator while acting in the role of chief pilot (when the regular chief pilot was on leave). The regular chief pilot reported that no other pilots conducted flights for the operator during the period from mid 2010 until the time of the accident.

The position of chief pilot was defined in Section 28(3) of the Civil Aviation Act 1988 as being a key position within an AOC holder’s organisational structure.

CAO 82.0 Appendix 1 outlined the responsibilities of a chief pilot. Those included but were not limited to:

• ensuring flight operations were conducted in compliance with the legislation
• maintaining a record of flight crew licences and qualifications
• ensuring compliance with aircraft loading procedures
• monitoring operational standards of flight crew
• supervising the training and checking of flight crew
• maintaining a complete and up-to-date reference library of operational documents.

CASA’s Chief Pilot Guide described the chief pilot position as one requiring:

… a focus on regulatory compliance and is a critical link between the AOC holder and CASA. To be effective in the role, Chief Pilots must have the knowledge, experience and strength of character to balance the sometimes conflicting demands of safety and commercial considerations.

According to the operator’s Operations Manual, the HAAMC was responsible for, among other things, monitoring aircraft hours, scheduling periodic maintenance, arranging defect rectification and unscheduled maintenance and compliance with airworthiness directives.

Operations manual

Civil Aviation Regulation (CAR) 215 (Operations manual) required an operator to provide an operations manual for the use and guidance of its personnel. The manual was required to contain information, procedures and instructions for flight operations of all types of aircraft operated by the operator to ensure their safe conduct. In accordance with the CARs, the operator’s personnel were required to comply with the instructions in the manual. CAAP 215-1(2) (Guide to the preparation of Operations Manuals) provided operators with detailed guidance.

The operator published the first version of its Operations Manual in May 2009, with several sections amended in August 2010. A small number of minor amendments were made after this time.

Training and checking

The operator did not have, and was not required to have, a flight crew check and training system as specified in CAR 217 (Training and checking organisation).^[48] The required recurrent reviews and proficiency checks for the operator’s pilots were:

• an aeroplane flight review (AFR) conducted every 2 years (which was required to exercise the privileges of the pilots’ licences)
• an emergency procedures proficiency check conducted every 12 months, as required by CAO 20.11 (Emergency & life saving equipment & passenger control in emergencies).^[49]

No other recurrent reviews or proficiency checks were normally required for a charter operator using small aircraft, unless it was required to have a CAR 217 training and checking organisation (in which case two proficiency checks were required for each pilot a year) or its pilots conducted instrument flight rules (IFR) operations (in which case each pilot was required to conduct a proficiency check to maintain the instrument rating every 12 months).

The chief pilot did not hold, nor was he required to hold, any check or training pilot approval or instructor rating. Both the chief pilot and the pilot of the accident flight normally undertook their AFRs with the same instructor, in either Cessna 172 or Beechcraft A36 aircraft. These flight reviews covered the basic requirements of a flight review for a pilot who held a CPL and held an endorsement to fly single-engine (piston engine) aeroplanes less than 5,700 kg MTOW. The AFRs were not specifically tailored to the operator’s operations, and did not involve conducting an airborne inspection of a beach ALA.

The only check flights referred to in the operator’s Operations Manual was an initial check to be conducted prior to a pilot being able to conduct a landing at either Aircraft Beach or Middle Island. These checks were to be conducted by the chief pilot. There was no record in the pilot of the accident flight’s file to indicate that he had been checked before conducting beach landings. However, he reported that he conducted a number of flights with the chief pilot as an observer and then a number with the chief pilot under supervision before he was allowed to conduct operations in to the beach ALAs alone. The chief pilot and pilot of the accident flight reported that, following this induction period, they rarely flew together in the same aircraft (although they conducted flights at the same times in different aircraft to the same ALAs).

The pilot who briefly conducted flights for the operator in late 2015 reported that he received a briefing from the chief pilot and undertook some supervised flights with the chief pilot prior to being approved to conduct operations alone at the beach ALAs. He reported that when he was acting as chief pilot, he conducted most of the operator’s flights (and the airborne inspections). He observed aspects of some flights conducted by the pilot of the accident flight (when he was flying the operator’s other aircraft), and he did not observe anything that contravened the operator’s Operations Manual or caused him concern. As noted in previous sections, this pilot’s description of how he conducted airborne inspections was significantly different to that provided by the chief pilot and the pilot of the accident flight (see Operator’s practices for airborne inspections of a beach landing area).

The operator did not have, nor was a charter operator required to have, a safety management system (SMS).

Further information regarding the operator’s history is provided in Oversight of Wyndham Aviation and its key personnel.

Regulatory oversight

The function of the Civil Aviation Safety Authority

CASA was responsible, under the provisions of Section 9 of the Civil Aviation Act 1988, for the safety regulation of civil aviation in Australia and of Australian aircraft outside of Australia. Section 9(1) stated the means of conducting the regulation included:

(c) developing and promulgating appropriate, clear and concise aviation safety standards;

(d) developing effective enforcement strategies to secure compliance with aviation safety standards…

(e) issuing certificates, licences, registrations and permits;

(f) conducting comprehensive aviation industry surveillance, including assessment of safety‑related decisions taken by industry management at all levels for their impact on aviation safety…

The two primary means of oversighting a specific operator’s aviation activities were:

• assessing applications for the issue of or variations to its AOC and associated approvals (including approvals of key personnel)
• conducting surveillance of its activities.

Processes for assessing variations to approvals

CASA was required by Section 28 of the Civil Aviation Act 1988 to satisfy itself about various matters when processing an application for the issue of, or variation to, an AOC. The matters included whether the organisation was suitable and whether it had suitable procedures and practices to ensure that AOC operations were conducted safely.

CASA’s procedures and guidance for assessing an application for the issue of, or variation to, an AOC were contained in the Air Operator Certification Manual (AOCM) up until October 2012, and the Air Operator’s Certificate Process Manual from October 2012 (with industry guidance provided in the Air Operator’s Certificate Handbook).

Processes for conducting surveillance

Introduction

CASA developed a surveillance program to determine whether aircraft operators and other organisations were meeting the regulatory requirements. CASA’s surveillance program was documented in various manuals over the years. From November 2003 the primary manual was the Surveillance Procedures Manual (SPM), and from July 2012 the primary manual was the CASA Surveillance Manual (CSM). With the introduction of the CSM, CASA also started using Sky Sentinel, an information technology tool designed to help manage surveillance activities.

The CSM stated:

Surveillance is the mechanism by which CASA monitors the ongoing safety health and maturity of authorisation holders. Surveillance comprises audits and operational checks involving the examination and testing of systems, sampling of products, and gathering evidence, data, information and intelligence. Surveillance assesses an authorisation holder’s ability to manage its safety risks and willingness to comply with applicable legislative obligations.

The manual also stated that CASA encouraged the aviation industry to adopt standards higher than the minimum required by regulations.

The ATSB investigation report AO-2009-072 (reopened),^[50] released in November 2017, provided a detailed overview of CASA surveillance processes relevant to charter operators in the period up to November 2009. The following subsections focus on processes after 2009, although there was a significant amount of similarity.

Types of surveillance events

The SPM outlined the following types of surveillance:

• scheduled audits (using a systems audit approach)
• special audits (conducted in response to an assessment of the operator’s risk profile or other safety intelligence)
• spot checks (or product inspections such as ramp checks, en route inspections, port inspections or checks of approved testing officers).

The CSM outlined a similar set of ‘surveillance events’, including:

• systems audits
• health checks (which were similar to systems audits but reduced in scope and duration)
• post-authorisation reviews (conducted within 6–15 months after initial authorisation)
• operational checks (such as site inspections, ramp checks, en route checks, manual reviews or interviews with key personnel).

System audits, health checks and post-authorisation reviews were described as level 1 surveillance events, which meant they were structured, forward-planned and larger in nature. Level 2 events were significantly shorter in duration, and were described as generally being compliance assessments used to verify the process in practice.

Use of periodic assessment tools

Since October 2000, CASA used questionnaire-based tools to assess each operator on a regular basis. Up until 2012, it used the safety trend indicator (STI), which consisted primarily of a series questions requiring yes or no answers about aspects of an operator’s activities and organisation. From mid 2012, it used the authorisation holder performance indicator (AHPI). The AHPI contained a smaller number of questions and used rating scales with word pictures.

The purpose of both the STI and the AHPI were to provide an overall assessment of an operator, which could then be used to help determine surveillance priorities. The tools were required to be completed about every 6 months by an inspector familiar with the operator. If no surveillance or other oversight activity had recently occurred, the inspector was encouraged to make contact with the operator prior to completing the tool.

Frequency of surveillance activities

From 2005 to 2012, the specified frequency of surveillance activities was outlined in the general aviation (GA) surveillance planning matrix. Smaller and less complex GA operators were subject to the ‘functional surveillance’ approach, which did not require systems-based audits. For example, small passenger charter operators did not have a specified audit frequency but required one site visit every 3 years. Other surveillance activities, such as in-flight surveillance or ramp checks, were to be conducted on an ‘opportunity basis only’. Special audits or additional surveillance activity could be planned if there were indications of elevated risk associated with the operator from an STI or other sources.

Under the CSM (from July 2012), the recommended frequency of surveillance activities for a small passenger charter operator was one level 1 health check every 12 months and one level 2 operational check every 12 months. The status of each operator was regularly reviewed, and if required additional surveillance activity would be initiated.

Scoping of surveillance activities

The SPM stated an audit’s scope played a vital role in the development and conduct of a successful audit. It provided guidance for scoping an audit, which involved inspectors reviewing:

• the operator’s previous surveillance and entry-control history (such as requests for corrective action and observations)
• other safety information (such as incident reports or comments from the assigned auditors)
• organisational changes (such as changes or expansion to operations, introduction of new aircraft or equipment, introduction of new procedures, growth or decline in resources, introduction of new staff, changes in key personnel, change in operating environment and introduction of new routes).

Inspectors were provided with a ‘surveillance planning and scoping form’ and guidance for completing the form. The form included sections for:

• previous surveillance / entry control history (including the date of the last audit, elements from the scope of the last audit and matters to note)
• other safety information (including date, source and details)
• organisational changes (including type of change, effective date and how it affects the scope).

The guidance indicated the first section should include significant findings from previous audits that required follow-up and issues from entry-control activities that needed resolution. The final section of the form listed a series of elements to be examined and matters requiring attention.

The CSM provide less guidance than the SPM regarding audit scoping, but still referred to the scoping form. CASA personnel advised the ATSB that (in recent years up to 2017) the scoping form was not commonly used.

The CSM stated that, following a level 1 surveillance event, inspectors were to carry out a control effectiveness review to determine the effectiveness of the authorisation holder’s controls for each of the system risks that were assessed during the surveillance event. The resulting mitigated risk rating formed a system risk profile (SRP). Sky Sentinel stored the results of all system risk assessments, which could be used when scoping future surveillance events. CASA advised that SRPs were not required to be developed following a level 2 surveillance event. CASA personnel noted that utilisation of the SRP process was low.

Associated with the CSM, CASA defined a common set of systems and elements in order to build up a surveillance picture over time and compare authorisation holders. The manual stated:

Taking into consideration the size and complexity of an individual authorisation holder’s operation, all systems and elements must be assessed in a timely manner. As not all system risks are applicable to all authorisation holders, an inspector’s judgement should be used in identifying the most appropriate system risks for which the effectiveness of an authorisation holder’s control is to be assessed…

Within Sky Sentinel, CASA inspectors could select the desired systems and elements to be examined in a surveillance event, and prepare worksheets using a bank of standard questions or questions they developed themselves.

In its AO-2009-072 (reopened) investigation report, the ATSB stated:

… surveillance is a sampling exercise, and each audit cannot examine every aspect of an operator’s activities. In addition, for charter and aerial work operators, CASA did not have the resources to audit each system element within a defined period of time. Therefore, CASA needed to have a sound approach for deciding what to examine in each audit.

With the introduction of the Surveillance Procedures Manual (SPM) in November 2003, CASA’s procedures and guidance for scoping audits required inspectors to consider information such as the results of previous audits, known organisational changes and other known safety information (such as incident reports). All of these are highly-relevant types of information to consider…

However, the use of previous audit findings and incidents reports is largely a reactive approach. Considering organisational changes can be both reactive and proactive, depending on the nature of the change. Another proactive approach, not included in CASA’s procedures and guidance, is to formally consider the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards…

Even though the SPM provided no formal guidance to consider the nature of an operator’s operations when scoping audits, it is possible CASA inspectors were informally considering such aspects. However, the inclusion of appropriate, formal guidance material about proactively scoping audits based on the inherent threats and hazards involved in an operation would provide additional assurance that audits focussed on the most relevant system elements…

The AO-2009-072 (reopened) findings included the following safety issue (AO-2014-190-SI-14):

The Civil Aviation Safety Authority’s procedures and guidance for scoping an audit included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards.

CASA’s response to this safety issue in August 2017 included:

In the preparation process, inspectors are required to review a range of information—including the authorisation holder's policy and procedures manuals—and identify specific areas and risks to be assessed or reviewed. The information, data and history known about the authorisation holder assists in determining the scope and depth of each surveillance event.

CASA has developed safety risk profiles for a number of sectors of the aviation industry, and is continuing to develop safety risk profiles for the remaining sectors. These sector safety risk profiles enable a shared understanding between CASA and industry of hazards that sector participants must address in order to manage their risks and enhance safety outcomes for the sector. CASA is working to enhance the use of sector safety risk data to inform the scoping of surveillance activities.

CASA is currently developing and implementing a National Surveillance Selection Process (NSSP), which will be an enhanced systematic approach to the prioritisation of CASA's surveillance activities…

In November 2017 ATSB acknowledged that CASA’s surveillance processes had undergone significant evolution since 2009, and that it was continuing to review and develop its surveillance processes. The ATSB also noted that it would review CASA’s oversight processes since the introduction of the CSM in 2012 during the course of other investigations (as has occurred during the present investigation).

Oversight of Wyndham Aviation and its key personnel

Overview

For the operator involved in the 10 January 2017 accident, the main assessments relating to the operator’s AOC and key personnel were:

• approval of the initial AOC in June 2009
• approval of the initial chief pilot in June 2009
• approval of the subsequent and ongoing chief pilot in September 2010
• reissue of the AOC in June 2012
• reissue of the AOC in June 2015.

The main surveillance activities conducted were:

• investigation of a complaint in October 2009
• scheduled site inspection in February 2011
• scheduled site inspection in March 2015.

As far as could be determined, there were no ramp checks, spot checks or other surveillance events conducted from July 2009 until the accident on 10 January 2017.

CASA personnel advised that this level of surveillance was consistent with that generally applied to operators of a similar size and complexity conducting passenger charter operations. They also advised that the recommended amount of surveillance activity in the CSM was unrealistic for a small charter operator, given their resources.

CASA inspectors completed three safety trend indicators (STIs) on the operator during the period from July 2009 until mid 2012, and seven authorisation holder performance indicators (AHPIs) from mid 2012 until the end of 2016. None of the scores on these tools indicated a need for elevated surveillance activity on the operator.

Investigation of a complaint in 2007

In 2007, prior to the approval of the operator’s initial AOC for Wyndham Aviation (based at Agnes Water), the organisation Sky Dive 1770 was conducting similar operations, with the person who was Wyndham Aviation’s chief pilot from June 2010 to 2017 being the pilot. The organisation did not hold an AOC.

In late 2007, CASA received a complaint from a concerned pilot regarding the type of operations conducted by Sky Dive 1770. The provided information included a video of a flight conducted on 4 October 2007. CASA documentation stated that this flight involved ‘aerobatic and erratic’ manoeuvres with three passengers on board.

CASA subsequently identified that, in May 2007, two business partners commenced commercial sightseeing flights based at Agnes Water under the operating name Sky Dive 1770, with one of the partners (who held a CPL) conducting the flights in a Cessna 172. (This pilot was the chief pilot of Wyndham Aviation at the time of the January 2017 accident.) The pilot and his business partner stated that they had entered a verbal agreement with another operator to conduct these operations under that operator’s AOC.

After investigating the complaint, CASA suspended the pilot’s PPL and CPL, and required him to undertake an examination and flight test to demonstrate that he continued to possess appropriate aeronautical knowledge and skills. In August 2008, after the pilot completed the examination and flight test, the licence suspension was lifted. CASA documentation indicated that the pilot was informally counselled regarding his actions, and it was noted that he appeared to have learned his lesson and demonstrated a positive attitude to compliance.

Meanwhile, in accordance with its policies, CASA had referred the matter to the Commonwealth Director of Public Prosecutions. In October 2008, the pilot was charged with six offences, including conducting commercial operations without an AOC, giving instruction without holding an appropriate rating, failing to record aircraft total time in service on a maintenance release, failing to record details of each flight in a logbook, reckless operation of an aircraft, and conducting aerobatic manoeuvres outside the provisions of an aircraft’s flight manual. In July 2009 the pilot pleaded guilty to the first four charges and the other two charges were withdrawn by agreement.^[51]

Assessment and approval of initial AOC and chief pilot (2008–2009)

In early 2008, the two business partners of Sky Dive 1770 purchased Wyndham Aviation Pty Ltd, an organisation based in Western Australia that held an AOC to conduct passenger charter operations in Beech 58, Cessna 182 and Cessna 206 aircraft. Although its AOC did not expire until July 2008, that organisation did not have a chief pilot at the time and therefore could not conduct operations.

The new owners (and directors) of Wyndham Aviation advised CASA of the purchase and their intention to submit applications to renew the AOC and appoint a chief pilot. They stated their intention was to conduct passenger charter (sightseeing) operations for backpackers in Cessna 172 aircraft based at Agnes Water, which would involve landing on beaches.

In October 2008, the directors submitted an application to reissue the AOC, an application to appoint a chief pilot, an application to appoint a HAAMC, and changes to its Operations Manual. The person nominated as the chief pilot candidate was the pilot who was a director (and the pilot who was the subject of the complaint in late 2007). CASA documentation indicated that he was found to be unsuitable for the position at that time because enforcement action associated with the 2007 complaint was still in progress.

In April 2009 the operator submitted a chief pilot application that nominated a different person for the position (who had previous chief pilot experience). CASA approved the operator’s initial AOC and chief pilot in June 2009.

At that time, the operator’s other pilot was the pilot who was a director. He had applied to CASA to be the HAAMC in May 2009 (although was not assessed by CASA for that position at that time). When Wyndham Aviation commenced operations in late June 2009, he performed the roles of HAAMC, office manager and senior line pilot and he was actively involved in managing the operator’s operations.

Investigation of a complaint in 2009

In October 2009, CASA received a complaint from an industry association regarding the advertising on the website for the organisation 1770 Air Adventures, which was a business name of the operator. The advertising indicated that the operator conducted ‘limited aerobatic’ flights with three passengers in Cessna 172 and Fuji FA-200 aircraft and ‘aerobatic’ flights with one passenger in Fuji FA-200 aircraft.

CASA officers visited the operator and spoke to the initial chief pilot and the pilot who was a director. CASA records indicated that the operator’s personnel were advised about the requirements for aerobatic flights, and the operator’s personnel provided assurances that all flights were conducted in accordance with regulations and the flight manuals of the aircraft operated. In addition, they advised CASA that photographs on the web site had been manipulated to appear more dramatic than actual flights, and they included photographs taken prior to the previous investigation involving the pilot who was a director in late 2007.

CASA’s files on the operator indicated that, during the 2009 investigation, the operator’s personnel advised CASA officers that passenger charter flights to the Middle Island ALA did not carry any of the passengers’ equipment on board the aircraft. Instead, this equipment was transported by an amphibious vehicle, so there were no issues with overloading or carriage of dangerous goods.

Given the assurances provided by the operator’s personnel, CASA concluded there was insufficient evidence to pursue the complaint any further.

Assessment of a chief pilot application in 2010

In November 2009, the pilot who was a director advised CASA that he and the operator’s other director were having difficulties with aspects of the initial chief pilot’s behaviour (unrelated to the conduct of flight operations). Accordingly, the directors submitted a chief pilot application form, nominating the pilot who was a director as the candidate.

CASA’s files on the operator indicated that from December 2009 to January 2010 the suitability of the chief pilot candidate was considered with regard to the previous enforcement action undertaken in 2007–2009. A CASA flying operations inspector (FOI) stated that the candidate had responded positively to the licence suspension and court action, and had realised the importance of regulatory compliance. The inspector also noted that because the candidate was one of the operator’s directors ‘he would seek to be particularly compliant’ as a chief pilot. The FOI stated that progressing the application would be in the best interests of the operator and CASA.

The CASA FOI sought advice from CASA’s legal section regarding whether there was a minimum time period after the conclusion of enforcement action before a candidate could be considered for a chief pilot position. The answer stated there was no prescribed limit, and the assessment should be based on a range of factors. Given the situation, CASA agreed to allow the candidate’s application to be progressed.

The initial chief pilot resigned from the operator in June 2010, at which point the operator was required to cease operations. CASA conducted an assessment of the new chief pilot candidate in July 2010. At that time the candidate was found to be unsuitable because his answers to various questions regarding the operator’s Operations Manual and some regulatory requirements was ‘well below the level expected of a chief pilot’. CASA recommended the candidate undertake extensive preparation prior to another assessment.

The pilot and director who was the chief pilot candidate submitted various Operations Manual amendments in August 2010, and advised that he had been studying with the chief flying instructor of a flying school. CASA conducted a second assessment of the candidate in September 2010, and he was then approved as the chief pilot.

Scheduled site inspection in 2011

In February 2011, CASA conducted a scheduled site inspection of the operator. The inspection was effectively an audit with a very limited scope, and it was conducted by one FOI. It involved a review of several sections of the Operations Manual and a 1-day site visit, which included an interview with the chief pilot and a review of various operational records. The stated areas of interest included pilot flight and duty time records, CAO 20.11 proficiency checks, approvals from stakeholders for landing sites, and maintenance releases.

The inspection report noted that overall the operator had adequate facilities, equipment and aircraft. It also noted that the chief pilot appeared to be appropriately qualified and carrying out duties to an acceptable standard, and that he demonstrated willingness and a ‘mature acceptance of a need to improve’ any identified deficiencies.

The report included four findings; three requests for corrective action (RCAs) and an observation.^[52] Two of the RCAs and the observation related to maintenance records and documentation, but there was no indication that required aircraft maintenance had not been conducted. The other RCA related to flight crew records. The findings included:

• the hours flown for each day was not entered on the maintenance release for several days (although the progressive total was entered) (RCA)
• portable ELBs carried on the operator’s aircraft were not receiving a monthly inspection as required by the ELB manufacturer (RCA).

The report described the findings as minor in nature, but noted that they highlighted ‘a need for better commitment to process and supervision of maintaining accurate records’. The report also noted that the operator had proactively addressed the identified deficiencies by the time of the inspection’s exit meeting.

In addition, the 2011 inspection report noted that even although the chief pilot had applied to be the HAAMC in 2009 and had been acting in that role, he had not yet been assessed by CASA for that role. In 2019, CASA advised the ATSB that, as far as it could determine, the chief pilot was never assessed for the position of HAAMC. It also advised that the position of HAAMC did not require the issue of an approval or instrument, and there was no policy to formally assess and accept a HAAMC candidate until about 2014.

In CASA’s file associated with the site inspection, there were no scoping form, worksheets or other documents that identified the specific aspects of each element that was being assessed during the inspection.

Reissue of AOC and assessment of a complaint in 2012

In May 2012, the operator applied to have its AOC reissued for another 3 years. On 19 June the oversighting office (Eastern Region) stated that it had no objections to the operator’s AOC being reissued for 3 years. CASA subsequently identified that the operator had not formally responded to the RCAs issued in August 2011. This was concluded to be a minor issue that should not preclude the issuing of the AOC.^[53]

In addition, in June 2012, CASA received a confidential complaint from a resident of Agnes Water. The complainant alleged that the operator’s chief pilot routinely conducted aerobatic manoeuvres in a non-aerobatic aircraft when flying backpackers to a beach camp site. It noted that such flights were common knowledge in the area, and the complainant stated they had received feedback that many passengers on these flights were ‘genuinely frightened’. The complainant also noted that passengers were apparently not allowed to film the flights, due to a previous warning from CASA. The complainant provided a video, taken from the ground, of a small aeroplane conducting various manoeuvres.

In CASA’s files on the operator, CASA personnel noted that it had insufficient resources and time remaining before the expiry of the AOC (30 June 2012) to conduct a full investigation of the complaint. They considered whether they should renew the AOC for a shorter time period than the standard 3 years. It was noted that it would be very difficult from the video to determine the aircraft registration and operator and the manoeuvres were ‘not excessive’. It was also noted that the operator’s chief pilot had a prior history of conducting aerobatic manoeuvres in non-aerobatic aircraft (see Investigation of a complaint in 2007). Ultimately, CASA personnel concluded that they could reissue the AOC for 3 years and deal with any matters that might arise from an investigation through an enforcement process. The AOC was reissued on 29 June 2012.

On 10 July 2012, CASA completed its assessment of the video. It concluded that the aircraft registration could not be determined, although it appeared to be a high-wing aircraft. It also concluded that the video did not provide sufficient detail of excessive flight attitudes for a Cessna 172 that would require further investigation at that time. However, if a CASA team was programmed to be in the operator’s area, and if time permitted, they would be asked to view flights to verify the assessment.

In May 2013, the author of the June 2012 complaint wrote to CASA, noting that they had not received any feedback on their previous complaint. They stated that the chief pilot was still routinely putting his aircraft in a steep dive during flights so passengers would float around the aircraft. CASA responded to the complainant, and noted it had not previously provided a response because the complainant had stated they were happy to leave the matter in CASA’s hands. It also noted that, in relation to the initial complaint, CASA was unable to take the matter further because ‘there was no clear evidence of a breach of civil aviation regulations’ in the video.

A note on CASA’s files on the operator in December 2013 stated that an FOI had viewed a social media site and identified some ‘unprofessional behaviour’ but no regulatory breaches. CASA later advised the ATSB that CASA management had suggested the FOI review the social media site to see if there was further evidence to substantiate the complaints from the resident of Agnes Water. The inspector had identified some questionable manoeuvres but was unable to determine whether there was a breach of legislation.

Schedule site inspection in 2015

In March 2015, CASA conducted a scheduled, level 2 surveillance event (site inspection) of the operator. The inspection team included two FOIs and an airworthiness inspector (AWI). Prior to the inspection, CASA had noted that the operator had now increased the size of its operation to two aircraft for its passenger charter operations (with the addition of VH-WTQ) and it was transporting up to 20 passengers a day with beach landings.

The inspection involved a 1-day site visit, which included an interview with the chief pilot, a review of various operational records, an inspection of both the operator’s Cessna 172 aircraft and an observation of a briefing provided to a group of passengers prior to them being transported to a beach ALA. The stated scope of the inspection included aircraft load control, AOC operations, operational standards, crew scheduling and various airworthiness aspects.

The inspection report noted that, overall, the operator’s operations were standardised and not complex. It also noted that although the inspection ‘did not reveal an AOC operating in a manner that raised any immediate safety concern there existed a potential for the AOC drifting into a pattern of non-compliance with regulations’. In addition, it noted that the chief pilot, as the owner and manager of a business, had a significant workload and limited time to focus on the responsibilities of the chief pilot and HAAMC. The report also noted that the chief pilot had limited knowledge of the duties and responsibilities outlined in the Operations Manual for the HAAMC position.

The report included nine findings; five non-compliance notices (NCNs)^[54] and four observations. Four of the NCNs and one observation related to maintenance records and documentation, but there was no indication that required aircraft maintenance had not been conducted. The other NCN and one observation related to flight crew records. The findings included:

• the progress total of the maintenance release for VH-WTQ was the hours meter reading and not the TTIS (NCN, see also Appendix A)
• the operator used ‘standard’ load sheets to calculate take-off weight and maximum allowable fuel and these did not include the use of the actual weights of passengers and cargo (observation).

The inspection report was completed in May 2015. The operator promptly responded in May 2015 with action taken or proposed to address all of the findings, including the observations. The response to the observation about standard load sheets stated that the operator would ‘now weigh all passengers and luggage’ and use this data for take-off weight calculations.

In CASA’s documentation associated with the site inspection, there were worksheets developed for the examination of maintenance records. There was no scoping form, worksheets, or other documents that identified the specific aspects of each element that was being assessed in relation to flight operations elements.

Oversight activities from May 2015 until the accident

In May 2015, the operator applied to have its AOC reissued for another 3 years. No concerns were expressed by CASA personnel, and the AOC was reissued on 17 June 2015 for 3 years.

In August 2015, the operator applied to have an alternative chief pilot approved to fill in the role when the chief pilot was on leave. The applicant was a flight instructor who conducted aeroplane flight reviews for the operator’s pilots, and had chief pilot experience. The application was approved by CASA in September 2015.

In late 2015, CASA received a complaint about occupational safety and aviation safety aspects regarding photographs on a social media site showing people climbing on top of the operator’s Cessna 172 aircraft. CASA wrote to the (regular) chief pilot to advise him of the complaint, noting that promotional material of this nature could be perceived as having an impact on the airworthiness of the aircraft, and indicating that CASA would investigate if similar concerns were raised again.

The AHPI completed in December 2015 noted that Wyndham Aviation was an established operator but recent surveillance and reports from third parties had raised awareness of the need to conduct another site inspection of the operator the following year. The two AHPIs conducted on the operator during June and November 2016 did not identify any concerns.

Oversight associated with approaches and landings at beach ALAs

When the operator submitted its initial Operations Manual in 2008, CASA required a number of changes. This included procedures for conducting beach landings. These procedures were included in the copy of the revised manual submitted to CASA in May 2009 and accepted by CASA. No changes were made to these procedures prior to the accident.

There was no indication in the 2011 and 2015 site inspection reports and related documentation that aspects associated with the operator’s approaches, landings and take-offs at the beach ALAs were examined. The CASA inspector who conducted the site inspection in 2011 stated that approaches and landings at beach ALAs were not part of the scope of that inspection and were not considered during the inspection. Two of the three CASA inspectors involved in the 2015 site inspection could not recall approaches and landings at beach ALAs being discussed during the surveillance event.

A comment on the June 2016 AHPI stated that beach landing areas were an ‘identified hazard but risk has been managed’. The CASA inspector who made the comment was familiar with the operator’s operations. He advised the ATSB that no new information had been obtained to indicate that the procedures for beach landings had changed from what had previously been accepted by CASA.

CASA personnel noted that, following the accident, they identified that the operator’s Operations Manual did not fully describe the operator’s practices for conducting airborne inspections. They noted that they may therefore have assumed (prior to the accident) that such activities were conducted in accordance with normal industry guidance for precautionary search and landings. If they were not going to be conducted in accordance with that guidance, they would have expected more detail to be included in the operator’s manual (see for example Airborne inspection procedures of another operator ).

The chief pilot advised the ATSB that he had offered on multiple occasions to take CASA inspectors on one of his flights to observe his operations, but CASA had declined. CASA personnel noted that it would have been logistically difficult to observe the operator’s processes for landing at the beach ALAs unobtrusively. They also noted that, if they had observed any flights, it is quite likely that the performance on such flights would have been different to normal operations.

Additional information

There was no indication in the 2015 site inspection report (or related documentation) about whether the topic of aerobatic or near-aerobatic flight was discussed with the operator. The chief pilot subsequently advised that he believed CASA were well aware of the nature of the en route manoeuvres conducted by the operator to provide passengers with additional enjoyment, as it was discussed during the 2015 site inspection, and CASA FOIs had attended the briefing to passengers where he explained the nature of the flights and the permission form.

CASA personnel from the office oversighting the operator advised that during the 2015 site inspection its inspectors did briefly discuss some aspects associated with aerobatics and en route manoeuvres, and made it clear to the chief pilot that the flights had to conducted within the regulatory requirements. However, the conduct of aerobatic or near-aerobatic manoeuvres was not discussed in CASA’s report on the site inspection. There were no records of any discussion with the operator about the manoeuvres.

The chief pilot also stated that the introduction of the passenger permission form for the en route manoeuvres was at the suggestion of CASA. However, CASA personnel disagreed that this was the case.

Overall, CASA personnel stated that no significant concerns were raised about the operator during its STIs and AHPIs, and the operator was never flagged during monthly planning meetings as an operator that required increased surveillance. They advised that, although CASA had received some complaints about the operator, the evidence associated with these complaints was insufficient to warrant an investigation. They also noted that many complaints it received about operators were vexatious or misguided in nature. Without clear evidence indicating regulatory breaches, or corroborating evidence, it was difficult to justify the resources for an investigation.

CASA personnel noted that CASA generally had very little information available about operator’s like Wyndham Aviation to review when considering surveillance activities or scoping surveillance events. For such operators, CASA conducted very few regulatory service tasks other than the reissue of an AOC. In addition, there were generally very few incident reports or surveillance findings available. CASA personnel also noted that the relatively remote location of the operator in this case increased the logistical difficulty of conducting site inspections.

 __________

6. The AFR assessment form submitted to CASA did not indicate (and was not required to indicate) if a partial and/or total engine power loss was simulated or if engine failure procedures were reviewed. Further, it did not indicate if a precautionary search and landing was demonstrated by the pilot.
7. Flight time in aviation is normally represented in decimals of an hour rather than minutes; 0.1 flight hours is 6 minutes.
8. Maintenance release: an official document, issued by an authorised person as described in Regulations, which is required to be carried on an aircraft as an ongoing record of its time in service (TIS) and airworthiness status. Subject to conditions, a maintenance release is valid for a set period, nominally 100 hours TIS or 12 months from issue.
9. The maintenance release had 0.3 hours flight time documented after 4 January 2017, with a documented TTIS of 6,838.7 hours. The documented date appeared to be 10 January, then amended to 6 January. There were no flights recorded on the GPS unit after 4 January (other than the accident flight), and no flights documented in the pilot’s logbook. The chief pilot also stated he did not conduct any flights during this period. Consequently, the 6 January entry was considered to be erroneous.
10. Civil Aviation Regulation (CAR) 42B (Maintenance schedule: CASA maintenance schedule) stated that the certificate of registration holder could maintain a class B aeroplane in accordance with CASA’s maintenance schedule. Class B aeroplanes included all aeroplanes except transport category aeroplanes used for regular public transport operations.
11. The chief pilot made most of the entries on the aircraft’s maintenance releases to certify that a daily inspection had been completed prior to the first flight of the day.
12. The requirements for oil and oil filter changes between periodic inspections was specified in Airworthiness Directive AD/ENG/4, which required them to be done at intervals as published by the engine manufacturer. Lycoming service bulletin SB480E stated that, for the engine type fitted to VH-WTQ, oil and oil filter changes were required every 50 hours or every 4 months, whichever came first. The oil and oil filter changes could be conducted by a pilot.
13. According to CAR 47, (Maintenance release to cease to be in force) a maintenance release ceased to be in force if any required maintenance specified in part 1 of a maintenance release was not completed. The operator’s Operations Manual also stated that a pilot must review the maintenance release before commencing a flight and, if there is outstanding maintenance, ‘the aircraft must not be flown until a person authorised to conduct that maintenance clears the item.’
14. Under CAR 139, (Documents to be carried in Australian aircraft) the maintenance release was required to be carried on the aircraft.
15. Tests conducted by the United States’ National Transportation Safety Board on a similar Cessna 172K aircraft found that selecting the fuel selector to OFF with the engine at full power would result in the engine stopping after 9 seconds (see Accident number ERA14FA428).
16. Skid: an aerodynamic condition, during a turn, where the tail of an aeroplane moves away from the centre of the turn or tends to follow a path which is outside that followed by the nose.
17. This analysis involved determining the fundamental frequency corresponding to the engine/propeller noise and converting this to revolutions per minute (RPM).
18. The recorded GPS data commenced part way through a flight on 12 November 2016.
19. Secondary surveillance radar relies on an aircraft’s operational transponder transmitting a data signal in response to being interrogated by an air traffic service radar or another receiver (for example, another aircraft’s Traffic Alert and Collision Avoidance System). The radar system determines the aircraft’s position based on the timing of the radar returns. Depending on the type of aircraft transponder, the data signal can provide additional information. The transponder fitted to VHWTQ provided altitude information (Mode C).
20. These were: one quarter 28 L left, 26 L right; half 50 L left and 49 L right; three quarters 62 L left, 60 L right; full 90 L both sides.
21. Each tank had a separate refuelling point. If fuel was only added to one side, this could result in an imbalance, which could be corrected in cruise flight (if required) by moving the fuel selector from the BOTH position to the side with the highest quantity.
22. This reading was taken when the aircraft was on descent and had had a wings-level attitude for a sustained period. A similar reading was observed earlier in the flight when the aircraft had a wings-level attitude and was at cruise height. The readings changed rapidly during turns and other manoeuvres, consistent with the nature of the fuel quantity indicating system (which included a float based in each fuel tank).
23. This amount equated to a fuel burn of 36 L/hour. The Cessna 172M Owner’s Manual estimated the maximum fuel burn at 2,500 ft was about 36 L/hour.
24. The chief pilot also stated that each flight from Agnes Water to a beach ALA (or return) took 7 minutes, for a total duration of 14 minutes. However, a review of the GPS data for VH-WTQ indicated that the total flight time for a return trip was normally about 17.5 minutes and on many occasions also included another short trip of about 2.7 minutes from one beach ALA to the other beach ALA (see Appendix A). Both the chief pilot and the pilot of the accident flight reported that VH-WTQ was the quicker of the operator’s Cessna 172 aircraft.
25. A review of the GPS data for VH-WTQ indicated that, when multiple trips were conducted from Agnes Water to a beach ALA on the same day, there was generally insufficient time to refuel the aircraft at Agnes Water between trips.
26. The MTOW is the maximum allowable aircraft weight at the start of the take-off run.
27. The head of aircraft airworthiness and maintenance control (HAAMC) was required to ensure that aircraft listed on the Air Operator’s Certificate were operated in compliance with the applicable provisions of the Civil Aviation Act, Regulations and Orders. This included the responsibility to update aircraft weight and balance data following any changes to an aircraft’s load data certification.
28. The ATSB used an AVGAS specific gravity of 0.72 kg/L, which is commonly used in general aviation. The operator used 0.71 in its updated sheet but had used 0.72 in its previous load sheets.
29. The sections in the manual that included the ALA register and beach landing procedures were dated May 2009 and they were not listed as being amended in August 2010.
30. This guidance assumes that the precautionary search is conducted in the same direction as the subsequent landing.
31. The chief pilot also reported that he normally used no flap when landing on the beach ALAs, given the long length of the ALAs and that using the flaps increased maintenance requirements. The pilot of the accident flight reported that he normally used full flap when landing.
32. The lowest altitude of each inspection search was determined by averaging the two consecutive GPS data points with the lowest altitudes when the aircraft was abeam or just passed the ALA.
33. ATSB AR-2013-107, Engine failures and malfunctions in light aeroplanes, 2009 to 2014. Available from www.atsb.gov.au.
34. ATSB, 2013, Managing partial power loss after takeoff in single-engine aircraft, Avoidable Accidents Series, No. 3 (AR2010-055). Available from www.atsb.gov.au.
35. The Aeronautical Information Publication (AIP) stated ‘…the turn onto final should be completed by not less than 500FT above aerodrome elevation. This should allow sufficient time for pilots to ensure the runway is clear for landing. It will also allow for the majority of aircraft to be stabilised for the approach and landing.’ The operator’s Operations Manual stated that ‘To assist in ensuring a stable approach, the Company recommends that pilots have the aeroplane configured for landing with all check list actions complete at not less than 500 feet above terrain’.
36. There was one other day when there were flights recorded on the GPS unit but no flights recorded in the pilot’s logbook or on the maintenance release, and three days where there was flights recorded on the GPS unit and in the pilot’s logbook and no flights recorded on the maintenance release.
37. Additional requirements included that, prior to aerobatic flight, all loose articles had to be removed or secured and dual controls removed, aerobatics could not be conducted at night and aerobatics had to be conducted in visual meteorological conditions.
38. Prior to 2014, CAR 155 referred to ‘acrobatic flight’ rather than ‘aerobatic flight’. Although there were changes to some regulations, the general definition and requirements were similar.
39. This requirement did not apply to aeroplane with 10 or more seats.
40. Many studies have also advocated the fitment and use of UTRs in front row seats. However, in the United States, UTRs were only required for front row seats for small aeroplanes manufactured after 18 July 1978.
41. The selected accidents included those where at least one occupant was fatally or seriously injured. The accidents were evaluated to determine the extent to which they were survivable, based on whether one occupant either survived or could have survived if shoulder harnesses or energy-absorbing seats were used. The data suggested that a survivable envelope was defined by impact speeds of 45 kt at 90º angle of impact, 60 kt at 45º angle of impact and 75 kt at 0º angle of impact.
42. BASI became part of the newly-formed ATSB in July 1999.
43. BASI Investigation Report 199802830, Cessna 185E Floatplane, VH-HTS, Calabash Bay, NSW, 26 July 1998. Available at www.atsb.gov.au.
44. Prior to the SEB, Cessna issued Service Newsletter 85-18 in 1985 to advise of the availability of shoulder harnesses. The Owner’s Handbook for Cessna 172M/N aircraft also advised of the availability of UTRs.
45. For example, Beechcraft issued a mandatory service bulletin in 1985 for many of its models of small aeroplanes, and Piper issued a mandatory service bulletin in 1988 for many of its models of small aeroplanes.
46. The AIP also stated that, for passenger-carrying charter operations, the distance from land could not exceed 25 NM.
47. These included two ditchings with four occupants, three with three occupants, four with two occupants and seven with one occupant.
48. A CAR 217 training and checking system was required for regular public transport operators, operators of larger aircraft (with a MTOW exceeding 5,700 kg) and other operators specified by CASA. Such operators were required to provide its pilots with two proficiency checks each year, with the training and checking organisation, check pilots and design of the proficiency checks to be approved by CASA.
49. In accordance with CAO 20.11, pilots of charter or regular public transport aircraft must undertake an annual proficiency test in the conduct of emergency procedures. It consisted of theoretical knowledge and practical demonstration of emergency equipment and procedures which included emergency evacuations, fire extinguishing and use of life jackets and other emergency equipment required for the operator’s flights.
50. ATSB AO-2009-072 (reopened), Fuel planning event, weather-related event and ditching involving Israel Aircraft Industries Westwind 1124A, VH-NGA, 6.4 km WSW of Norfolk Island Airport, 18 November 2009. Available from www.atsb.gov.au
51. Following the accident on 10 January 2017, CASA obtained the pilot’s computer from the Queensland Police Service. CASA identified numerous video files from late 2007 that contained footage of Cessna 172 flights with passengers on board that involved aerobatic manoeuvres and other activities consistent with the video reviewed as the subject of the complaint. A video of a flight conducted during in late 2007 was also published on social media in 2011, and it showed manoeuvres that were clearly aerobatic in nature (such as bank angles of at least 90º).
52. An RCA was issued when there was a failure to comply with regulatory requirements, which necessitated the operator to take corrective or preventive action. An observation was issued to draw the operator’s attention to latent conditions or minor deficiencies that could not be attributed to current regulatory requirements. Operator’s were required to respond to RCAs but were not required to respond to observations.
53. The February 2011 inspection report was completed in August 2011, with a due date of formally responding to the RCAs in September 2011. The operator’s formal responses were received on 20 July 2012 and the RCAs were then acquitted.
54. NCNs replaced RCAs with the introduction of the CSM in 2012. They were effectively the same type of finding.

Introduction

During the conduct of an airborne inspection of a beach aeroplane landing area (ALA), with the aircraft at about 60 ft above mean sea level (AMSL), the Cessna 172M aircraft lost engine power. After conducting initial checks, the pilot turned left towards the beach. During the continued turn, the aircraft impacted the beach in a significant nose-down and left-wing low attitude and with little or no control.

This analysis will first consider potential reasons for the engine power loss. It will then discuss safety factors associated with managing the risk of an engine power loss during a low-level airborne inspection. It will also consider a range of other safety factors identified during the investigation, relating to maintenance control, aircraft loading, survival factors, organisational factors and regulatory oversight.

The accident involved a passenger charter (air transport) flight and resulted in one fatality and three serious injuries. Although the aircraft involved was a small (four seat) aeroplane, the investigation identified a number of safety factors that highlight important lessons for pilots, operators and regulators.

Engine power loss

Based on the video evidence and the pilot’s recollection, the engine suffered a total and sudden power loss. The aircraft’s maintenance documentation and a post-accident inspection of the aircraft’s engine and related systems did not identify any faults or defects that could explain the power loss. Based on the available information, there appeared to be more than sufficient fuel on board.

Carburettor icing is a potential reason for engine power loss on piston engines, particularly when carburettor heat is not being used. If it occurs it is also difficult to prove because the icing is no longer present after impact. However, in this case, carburettor icing was considered unlikely to have occurred. The sudden and total nature of the power loss was not consistent with icing. In addition, the power setting being used, short duration of the flight and the ambient conditions at the time all indicated that the risk of carburettor icing was relatively low.

The examination of the fuel system identified there was a small amount of water and contaminants present in the fuel strainer bowl. However, no similar contamination was found in the carburettor (or in the fuel in the fuel tanks). Therefore, the fuel strainer appeared to have successfully captured the contamination.

The absence of fuel in the carburettor indicated that some form of fuel starvation occurred (that is, fuel was available on the aircraft but did not get to the engine). However, the reason why there could have been fuel starvation could not be determined. The video footage indicated that, about 80 seconds prior to the engine power loss, there was a momentary reduction in engine/propeller speed. However, this reduction was consistent with the nature of the pitch-down manoeuvre being conducted at that time and it would not cause any later engine power loss.

It is possible that the en route manoeuvres being conducted during the flight briefly unported one of the fuel tanks, resulting in air feeding into the fuel line from that tank. However, all of the available evidence indicates that the fuel selector was selected to both tanks during the flight, and air being fed into the engine from one side should not have led to a total power loss. In addition, the en route manoeuvres stopped about 80 seconds prior to the total engine power loss. Overall, it seems very unlikely that the en route manoeuvres could have introduced sufficient air into the engine from both fuel tanks at the same time, resulting in an engine power loss, particularly one occurring so long after the manoeuvres ceased.

The aircraft manufacturer’s Owner’s Manual included a note stating that under certain conditions a prolonged steep descent could lead to a temporary fuel starvation. However, during the accident flight the descent was not steep, and the circumstances did not match the required conditions for this phenomenon to occur.

In summary, the reason for the engine power loss could not be determined. The most likely explanation is some form of fuel starvation, but the reason for any such fuel starvation could not be ascertained based on the available information.

Significant turn at a low height after engine power loss

Regardless of the reasons why it occurred, an engine power loss should not necessarily lead to very serious consequences, even in a single-engine aircraft. Accordingly, the ATSB examined the pilot’s actions and the operator’s risk controls for managing an engine power loss, particularly during an airborne inspection of an ALA.

The pilot stated that, after the engine power loss occurred, he conducted some basic checks to see if the problem could be rectified. After these checks were unsuccessful, the pilot needed to make a decision about what emergency action to take. His options included:

• turn left slightly and land on the remainder of the beach (heading north)
• ditch the aircraft (either in the sea to the right of his current flight path or in the channel north of the landing area)
• attempt to turn back 180º and land on the landing area (heading south)
• gain height to extend the aircraft’s glide distance and identify a suitable area for an emergency landing.

All of the options were likely to result in at least some level of damage and/or injury. However, with the benefit of hindsight and a detailed consideration of all the available information, the option likely to result in the least damage or injury was to land the aircraft ahead on the remainder of the beach (heading north).

At 1037:38 (4 seconds after the power loss), the aircraft was almost over the beach, with at least 820 m (2,690 ft) of beach available ahead for an emergency landing (from a height of close to 50 ft). If the pilot commenced a landing at that time, he should have been able to touch down at the northern end of the normal landing area, albeit at a higher-than-normal landing speed, or even further down the beach. During the landing roll the aircraft would probably have encountered some areas of uneven terrain (with ruts in the sand), puddles of water and/or areas soft sand, all of which would have been unsuitable for a normal landing. It is possible the aircraft’s nose landing gear may have collapsed, and/or the aircraft nosed over or perhaps even flipped over. However, serious injuries would have been unlikely and fatalities would have been very unlikely.

Standard flight training and guidance for pilots is to land straight ahead, or within 30º either side of straight ahead, following an engine failure or power loss at a low height. Although an emergency landing on the beach straight ahead was the lowest risk option in this case, this may not have been readily apparent to the pilot at the time. The pilot was very familiar with the landing area and its surrounds. However, during the period immediately following the power loss, the full length of beach available to use for an emergency landing north of the landing area and up to the camp site was not visible from the cockpit.

The pilot recalled thinking that if he continued straight ahead, he would end up having to ditch in the channel north of the landing area. He emphasised that he did not want to conduct a ditching because he perceived there was a very high level of risk involved. Although a review of previous ditchings of Cessna 172 and similar aircraft shows that most do not result in fatalities (or even serious injuries), there is undoubtedly some risk involved, particularly if the pilot is not prepared for a ditching and does not have time to prepare. In this case, there was additional risk following a ditching due to the absence of life jackets on board the aircraft, and other factors such as the current (if the ditching was conducted in the channel).

A 180º turn back to the landing area would not have been successful, no matter how well the manoeuvre was conducted. Such a manoeuvre from a low height with no engine power will always result in a collision with terrain. Despite pilots being trained not to turn back if an engine fails soon after take-off, unfortunately such turnbacks often still occur, even with experienced pilots.

In this case, the pilot reported that he selected the option to gain height and look for a suitable area for an emergency landing. This ultimately involved a continuous left turn towards the beach, with the resulting heading being about 90º left of the aircraft’s current heading. However, it is not clear that this manoeuvre was his initial intention. Prior to commencing the left turn, the pilot conducted a slight right turn, which took the aircraft further out over the water and away from the beach, while still heading north. The right turn may initially have been associated with the pilot giving the aircraft more lateral spacing to conduct a turn back towards the south, and during this manoeuvre he realised that this was not going to be possible. At this point, he thought simply getting the aircraft back to the beach was the best outcome that could be achieved.

Regardless of his initial intention, a continued turn from a very low height with no engine power would inevitably result in a collision with terrain, either in controlled flight with a significant bank angle or preceded by a stall and loss of control. In this case, the aircraft was close to the stall speed towards the end of the turn and the aircraft may have stalled just prior to impact. Regardless of whether the aircraft stalled, the aircraft impacted terrain with little or no control and a significant descent rate.

If the pilot had selected some or full flap prior to or during the left turn, he would have been able to extend his glide distance further and reduce the aircraft’s stall speed, and potentially the aircraft’s speed at impact.^[55] However, given the location of the aircraft when he commenced the left turn, and the nature of the surrounding terrain, it is very unlikely that a collision with terrain could have been avoided.

Stress, time pressure and surprise

There was no evidence to indicate that the pilot’s response to the emergency was affected by fatigue, a medical issue or similar factors. However, the pilot was making decisions under a high level of stress and time pressure. A substantial amount of research has shown that people often do not make optimal decisions in such situations.

Some commonly reported effects of stress and/or time pressure include attentional narrowing, with people searching fewer information sources (Staal 2004), and focusing on cues that are perceived to be the most salient or threatening (Burian and others 2005, Wickens and Hollands 2000). Working memory and the ability to perform complex calculations is impaired (Burian and others 2005), and the ability to retrieve declarative knowledge (or facts) from long term memory is affected (Dismukes and others 2015). People can also act more impulsively (Dismukes and others 2007).

Research has shown that experts under time pressure often make recognition-primed decisions rather than systematically compare all the available options (Klein 1998). That is, experts intuitively evaluate a situation and select a solution based on their experience. In some cases they may need to mentally simulate whether the solution will work, and if not then either refine the solution or consider other options. Although this recognition-primed approach is generally successful when a person has relevant expertise in making the type of decision, high levels of stress and time pressure can still reduce the effective search for information and affect the ability to mentally evaluate a solution.

If a person does not have the relevant expertise to make recognition-primed decisions and instead attempts to identify and compare options, stress and time pressure will usually have more influence. In addition to the effects discussed above, a person will generally consider fewer alternatives, and not be as systematic when evaluating alternatives (Dismukes and others 2015, Staal 2004).

Related to stress and time pressure are the concepts of surprise and expectancy. In general, if a person is not expecting an emergency or abnormal event to occur, their response to the situation will often be slower and more variable. This effect has been demonstrated in several research studies involving experienced pilots (for example, Casner and others 2013, Landman and others 2017).

The exact cognitive mechanisms that lead to the tendency of many pilots to not land straight ahead following an engine failure or power loss soon after take-off have not been researched in detail. However, in addition to the general effects of stress, time pressure and surprise, there is often probably an influence associated with a pilot knowing that landing straight ahead will definitely lead to some adverse outcomes, but instinctively believing (often incorrectly) that turning may lead to an outcome with no or fewer adverse outcomes. Research has shown that when a person is faced with two options that are framed as losses (or with adverse outcomes), they tend to be risk seeking (Kahneman 2011). That is, rather than selecting a loss option that is certain but has a low loss magnitude, people will tend to select a loss option with less likelihood but higher loss magnitude. However, research on the extent to which time pressure influences the tendency to be risk seeking for losses is unclear, and there has been very little research that has examined the influence of this risk seeking tendency in emergency situations.

In summary, the pilot was undoubtedly faced with a very difficult situation. He had limited options available, all of which were likely to result in adverse consequences, and very limited time to make a decision. Ultimately, his decision to gain height over the water and then conduct a significant, continued left turn towards the beach was probably not the option with the lowest risk. However, his decision making during the event was consistent with the known effects of stress and time pressure on human performance. It was also consistent with the limited risk controls put in place by the operator to manage the risk of an engine power loss during an airborne inspection of an ALA.

Airborne inspection procedures and practices

The beach surface on Middle Island that the operator used as an aerodrome landing area (ALA) changed with tidal action. Accordingly, it was important for the operator to have processes in place to inspect the landing area prior to the first landing of the day to ensure it was suitable. However, the operator’s practices and procedures for conducting airborne inspections, and for managing the risk of an engine failure or power loss during these inspections, were problematic for several reasons. These included:

• The operator’s normal practice was to conduct these inspections at a very low height, between 50–100 ft, when heading north abeam the landing area and up to crossing the Jenny Lind Creek inlet. During the initial part of the inspection, the pilots always had the option of landing straight ahead on the beach if there was an engine failure or power loss. However, for the latter part of the inspection, there was no suitable land ahead for an emergency landing within 30º either side of straight ahead. Therefore, pilots would have been required to ditch the aircraft or conduct a significant turn to reach land (some of which was potentially unsuitable for an emergency landing). Ditching was the only option available towards the end of the inspection.
• The inspections were conducted at normal cruise speed with no flap selected, and often downwind. The resulting groundspeed (in this case 230 km/h) reduced the potential effectiveness of any visual search, and also increased the general risk associated with low flying.
• The procedures for conducting an airborne inspection were not clearly specified in the Operations Manual. Although both of the operator’s pilots appeared to have a common understanding of how the task was conducted, clearly specifying the procedures (and the hazards associated with the procedures) would have provided them the opportunity to review their practices and consider their suitability. The operator’s practices were also significantly different to general industry guidance for a precautionary search and landing (in terms of height, configuration and number of inspections). Clearly stating the procedures would have also provided more opportunity for other parties, such as the regulator or temporary pilots, to understand how the task was normally performed and provide feedback on the suitability of the procedures.
• There were no clearly specified or understood emergency procedures for responding to an engine failure or power loss at some stages during an airborne inspection. As previously noted, human performance is quite vulnerable to error when people are performing tasks under stress and time pressure. Such errors can be significantly reduced for emergency situations if pilots are provided with clear emergency procedures and regularly practice the procedures, or at least regularly brief or rehearse the required actions. In this case, clearly specified and rehearsed emergency procedures could have included decision points for when it was appropriate to land straight ahead on the beach, conduct an emergency landing on other terrain or conduct a ditching. If a ditching was the most suitable alternative, prior preparation for a ditching, including equipping the aircraft with life jackets, should have been considered.

Engine failures and power losses are rare events, but they need to be planned for, particularly during commonly conducted activities. Based on comments from the chief pilot and the pilot of the accident flight, it appeared that the operator had not systematically considered the risk of an engine failure or power loss during an airborne inspection. Had the operator conducted a risk assessment, it should have identified the problem associated with the limited options available for responding to an engine failure or power loss in the later stages of an inspection.

The operator could have introduced a number of options to reduce the risk, similar to what another charter operator that routinely conducted beach landings had done. For example, the operator could have conducted the inspections such that a beach landing area was always available in the event of an engine failure or power loss. More specifically, inspections could have been conducted to the south, or the landing area could have been moved further south, so that a beach landing was always available during an inspection conducted to the north. In addition, the operator could have provided suitably-trained personnel based at the operator’s camp site to conduct a ground inspection of the landing surface prior to the aircraft arriving, and organised to have these personnel in radio contact with the operator’s pilots.

Furthermore, the minimum height required for an airborne inspection could have been carefully reviewed. Although the chief pilot and the pilot of the accident flight reported that they needed to be at a low level to see cues such as sand balls, it is worth noting that the pilot who conducted operations in late 2015 did not believe that such a low height was required. Conducting the inspections at a slower speed may also have meant that they would have been effective at a greater height.

If none of these options were introduced to change the way the airborne inspections were conducted, the operator could have at least introduced clear guidance on decision points and emergency response actions, and required pilots to self-brief or mentally rehearse those response actions prior to the inspection. It could also have recognised that there was a need to be prepared to conduct ditchings, and ensure that its pilots were prepared to conduct the manoeuvre if required, and the aircraft were equipped with life jackets and passengers were appropriately briefed on their use.

In summary, the operator’s practices for conducting an airborne inspection of the Middle Island ALA placed its pilots in a very difficult situation in the event that an engine failure or power loss occurred during the manoeuvre. Towards the end of their normal inspection, they were placed in the unnecessary position where all the emergency response actions were significantly problematic, with no clear guidance as to what action to take. This created the potential for pilots to not select the lowest risk option when under stress and time pressure. Overall, the operator’s risk controls did not effectively manage the risk of an engine power loss during airborne inspections of the ALA.

Precautionary search and landing guidance

Pilots are provided with training and guidance for conducting precautionary search and landings, and this guidance is generally quite consistent in terms of the minimum height, configuration and number of passes to conduct at different heights.

The ATSB notes that Civil Aviation Safety Authority (CASA) has not provided any formal guidance material regarding the conduct of precautionary search and landings. This should not generally be problematic if there is widespread industry agreement on the procedure. However, it is worth noting that the regulator’s Flight Instructor Manual recommends demonstrating the search at 100 ft, with no other heights mentioned. This could be misinterpreted as indicating that 100 ft is an appropriate height to conduct the first pass of a precautionary search and landing procedure, which is inconsistent with general industry guidance information.

A more significant concern is that none of the guidance material on precautionary search and landings reviewed by the ATSB specifically discussed the importance of considering the risk of an engine failure when conducting the procedure. Pilot training and guidance emphasises the importance of considering engine failure or power loss soon after take-off, because of the significant risk associated with such a scenario due to  the low height and limited performance of the aircraft. The same risk also applies to any other manoeuvre conducted at a very low height, including a go-around / missed approach or a precautionary search and landing.

The ATSB recognises that, in many cases, a precautionary search and landing is being conducted in the context of an abnormal or emergency situation. It may also be the case that many pilots would intuitively consider the risk of an engine failure when conducting precautionary search inspections below 500 ft. Nevertheless, it would be useful and important to enhance the guidance, and advise that conducting precautionary search inspections at a low height should be considered the same as a take-off situation in terms of the risk of an engine failure, and that prior planning and preparation for such a scenario should be undertaken. This would be relevant to all situations, but particularly relevant to situations were pilots were conducting precautionary search and landings at the same landing area on a regular basis.

The extent to which the lack of specific guidance for considering the risk of an engine failure during a precautionary search and landing had an influence on the development of this accident is unclear. The pilots both had significant experience and were aware of the general guidance on precautionary search and landings. However, they had adapted their practices at Middle Island to be different to that recommended in general industry guidance material.

Upper torso restraints

A substantial body of research has demonstrated that wearing upper torso restraints (UTRs) in small aircraft significantly reduces the severity of injuries compared to wearing only a lap belt. In particular, UTRs reduce the risk of head, neck and upper body injuries, associated with the person’s upper body flailing forward, and potentially striking seats, the side of the aircraft or other objects. Many studies have concluded that the single biggest improvement that could be made to crashworthiness in small aircraft is the fitment of UTRs. Accordingly, the United States’ Federal Aviation Administration (FAA) mandated that all small aeroplanes manufactured after December 1986 had UTRs fitted to rear seats (with a similar requirement for helicopters manufactured after September 1992).

The proportion of the Australian small aeroplane fleet manufactured before December 1986 is gradually decreasing, but even now a significant proportion of the fleet being used for passenger transport operations was manufactured before this date. Although kits are available to retrofit UTRs to many small aircraft, a large number of aircraft manufactured prior to the specified dates still have not been retrofitted, even for aircraft used for passenger transport operations, such as Wyndham Aviation’s Cessna 172 aircraft. Despite recommendations from numerous investigation agencies around the world, including in Australia in 1999, there has been no change to the regulatory requirements, even for passenger transport operations.

In this accident, both rear-seat passengers suffered significant neck injuries, and the passenger on the left also received a significant cardiovascular injury and the passenger on the right received a significant head injury. Even though the rear bench seat had separated from the floor structure in overload during the impact sequence, UTRs, if fitted and worn, would still have provided some restraint to the passengers’ upper bodies. It is also noteworthy that the two front seats had also separated from the floor in overload, and the front-seat occupants, who were both wearing UTRs, had less serious injuries than the rear-seat passengers.

Overall, it is very likely that the severity of the rear-seat passengers’ neck / head injuries would have been reduced if they had been provided with and were wearing UTRs. Nevertheless, it is difficult to determine whether the fatal outcome for the left rear-seat passenger would have been prevented with the use of a UTR, given her other injuries. The left side of the aircraft was exposed to higher impact forces than the right side.

Requirements for briefing passengers on the brace position

If UTRs are not fitted for all passenger seats, another intervention that can reduce the risk of injury is to ensure passengers use an appropriate brace position. Adopting a brace position can reduce the impact forces associated with the body flailing and can therefore potentially reduce the severity of injuries during an impact. Although using a brace position with a lap belt is not nearly as effective as using a UTR with a lap belt, an appropriate brace position will still reduce the risk of an injury compared to wearing a lap belt only and sitting upright.

At present, there are no requirements for operators of aircraft with six or less seats to demonstrate or brief a brace position for passengers, or to provide passengers with such information. Although many passengers have been exposed to such information when travelling on large airline aircraft, they may not realise that the brace position is also suitable, and the potential benefits are equally as applicable, to a small aircraft.

In this case, it is difficult to determine whether briefing the rear-seat passengers about the brace position prior to flight would have reduce the severity of their injuries in this case. After the engine power loss, the pilot was experiencing a very high workload and did not have time to provide any advice to the passengers about the impending impact or provide a brace call. The extent to which the rear-seat passengers were aware of the severity of the situation, until immediately prior to impact, could not be determined.

Carriage of life jackets

The operator’s Operations Manual stated that overwater flights were only to be conducted in aircraft with retractable landing gear, which did not include the operator’s Cessna 172 aircraft. The chief pilot also stated that he believed a ditching in such aircraft involved a high risk. However, based on a review of Global Positioning System (GPS) data from VH-WTQ, many of the operator’s flights involved segments conducted such that, if an engine failure or power loss occurred, a ditching was the only option available or (in some cases) a ditching was probably the best option available. These segments included most of the airborne inspections, but also some take-offs and approaches.

Civil Aviation Order (CAO) 20.11 stated that life jackets were required for all charter flights when ‘in the event of a mishap occurring during the departure or the arrival it is reasonably possible that the aircraft would be forced to land onto water’. Accordingly, life jackets were required for the accident flight, given the manner in which the airborne inspection was planned to be completed. In addition, life jackets would have been required for most of the airborne inspections conducted by the operator with passengers on board. They would probably also have been required for some of the operator’s other flight segments, if passengers were being carried. However, the extent to which passengers were carried on most of those flights could not be determined.

The operator did not routinely carry life jackets on board its two Cessna 172 aircraft for flights to Middle Island or Aircraft Beach, and no life jackets were on board VH-WTQ for the accident flight. The absence of life jackets would have reduced the chances of survivability and/or rescue of occupants in the event of a ditching.

It should be noted that the operator (and the operator’s pilots) could have conducted airborne inspections, take-offs and approaches at the beach ALAs in such a way as to not be exposed to the need for ditching (and therefore the need to carry life jackets). The manner in which the flight segments were done, and the absence of life jackets, is consistent with the operator (and its pilots) not fully appreciating the risk of its operations at the beach ALAs.

Maintenance control

A comparison of the data on the aircraft’s GPS unit, the pilot of the accident flight’s logbook and the aircraft’s current maintenance release identified that the total flight time documented on the maintenance release underestimated the actual flight time during the period from 14 November 2016 to 4 January 2017. A detailed review of maintenance documentation and other information confirmed that the flight time documented on the aircraft’s maintenance releases underestimated the actual flight time by 96.2 hours (or 32 per cent) from 1 May 2015 until the accident on 10 January 2017.

The underestimation of the aircraft’s flight time was not associated with a small number of errors or one type of error. It appeared to involve a more systematic pattern of not including many flights and also underestimating (slightly) the duration of many flights. It is apparent that even though an hour meter was on board to accurately record flight time, it was not being used during this period.

The effect of the underestimation of the aircraft’s flight time was that, from 1 May 2015 until 10 January 2017, three periodic inspections should have been conducted but only two periodic inspections were conducted. In addition, at least one if not more additional oil and oil filter changes should have been conducted during this period.

It is not possible to conclude that the omission of this scheduled maintenance during this period contributed to the engine power loss. As previously stated, no defects with the actual engine were identified following the accident. In addition, a periodic inspection of the aircraft was conducted about 43.8 flight hours (and just under 4 months) prior to the accident.

Nevertheless, routine maintenance of an aircraft and its engine in accordance with regulatory requirements and manufacturer requirements is vitally important for continuing airworthiness, particularly for passenger transport operations. Given that the aircraft was being operated on beaches (and therefore exposed to salt and salt spray), was conducting short sectors and regularly conducting near-aerobatic manoeuvres, it would have been prudent to do more than the required level of maintenance rather than conduct less.

Aircraft loading

Excessive weight reduces the performance of an aircraft, with the most significant deficiencies of an overweight aircraft being a longer take-off distance required, reduced rate of climb and higher (faster) stalling speed. In addition, continued overweight operations can also accelerate the onset of structural failure induced by metal fatigue.

The operator’s process for managing aircraft weight was based on pre-calculated load and trim sheets, with default weights for fuel, pilot, passengers and baggage. The operator’s pilots relied on estimated weights of passengers and baggage, and they stated they only weighed passengers or baggage (or sought accurate weights) if they believed their estimated weights were more than the pre-calculated load and trim sheet weights.

In this case, both the chief pilot and the pilot of the accident flight believed the passengers and baggage was such that VH-WTQ was loaded well below its maximum take-off weight (MTOW). However, a detailed review of the available information found that the aircraft was at least 17 kg over its MTOW, and the pilots had underestimated the weight of the passengers and the baggage. The available evidence also indicates that the operator’s other aircraft (VH-JER), flown by the chief pilot, was loaded above its MTOW on the first flight of the day.

Guidance material from CASA released in 1990 advised against the practice of using standard weights for aircraft with less than seven seats, and it advocated for the use of accurate weights. CASA had also specifically advised the operator during a site inspection in 2015 against the practice of using standard weights, and the chief pilot had replied in writing that in future the operator’s pilots would weigh all passengers and baggage. Unfortunately, that did not occur.

There was some doubt regarding which version of the operator’s pre-calculated load and trim sheet 10 was used for the accident flight. The old version (initially provided to the ATSB) had an incorrect basic empty aircraft weight, and a later version had the correct basic empty weight but also had a default passenger weight of 65 kg. This default passenger weight was significantly below the Australian average weight for adult males (86 kg) and it was also below the average weight for adult females (71 kg).

If the load and trim sheet was being used as a guide for determining when to weigh passengers, then a default weight of 65 kg would mean that almost all the passengers the operator transported should have been weighed, particularly when three passengers were on a flight. The use of such a weight should have raised a significant concern with the operator (and its pilots) about the suitability of the pre-calculated load and trim sheet.

There was insufficient evidence to determine what, if any, effect the overweight operation of the aircraft had on the flight characteristics or the development of the accident. The excess weight would have had resulted in a minor increase in the stall speed, but even if the aircraft was below the MTOW then similar consequences would very likely have resulted. Although the aircraft was overweight, it was still loaded within balance.

Contrary to both regulatory requirements and the operator’s written procedures, the baggage and camp supplies in the aircraft were not restrained by any means. This increased the risk of load shift in-flight and loss of controlled flight, and/or injuries to the aircraft’s occupants through the movement of unrestrained objects caused by in-flight turbulence or by unusual accelerations during in-flight manoeuvres or a collision. However, in this case, as far as could be determined, the unsecured baggage and camp supplies did not contribute to any of the occupant’s injuries during the collision with terrain. Nevertheless, the operator did not have any cargo nets or similar means for securing loads in its aircraft, and this increased the risk of injury on the operator’s other flights due to unsecured loads.

Aerobatic and near-aerobatic manoeuvres

The operator’s passenger charter flights to the beach ALAs routinely involved various manoeuvres conducted to provide passengers with additional enjoyment. During the accident flight, these manoeuvres included steep turns, steep climbs and descents, quickly pitching down then up and quickly yawing from side to side. One of the turns involved a bank angle of slightly more than 60º, and therefore could be classified as an aerobatic manoeuvre as per the applicable regulations, although this bank angle was only exceeded for a brief period (less than 1 second). The extent to which the other manoeuvres could be classified as aerobatic depends largely on the interpretation of the term ‘abrupt’.

The chief pilot and the pilot of the accident flight stated that their manoeuvres were not aerobatic and were within the specified limits. There was very limited video information available from other flights in recent years to assess the extent to which their flights involved aerobatic manoeuvres.

Regardless of whether the flights involved manoeuvres that could be classified as aerobatic, they were still problematic. Firstly, the manoeuvres were not consistent with the requirements of passenger charter flights specified in the operator’s Operations Manual. The operator had developed a passenger consent form that provided details of some limits for the manoeuvres. However, its manual did not contain any details of how the manoeuvres were to be conducted, the limits for all the manoeuvres and any controls in place to ensure that these limits were not exceeded.

Secondly, the operator did not have appropriate procedures and practices in place to minimise the risk associated with conducting near-aerobatic manoeuvres. As a minimum these should have included securing all loads prior to conducting any manoeuvres. It would also have been prudent to consider removing the controls in the right front-seat position, fitting upper torso restraints (UTRs) to the rear seats, conducting the manoeuvres at a height significantly more than 1,000 ft, and checking each pilot’s performance of the manoeuvres on a regular basis through proficiency checks or flight reviews.

Ultimately, the performance of near-aerobatic (and potential aerobatic) manoeuvres on the accident flight occurred a significant time before the engine power loss. Although these manoeuvres may have unported one of the fuel tanks during the en route phase, there was insufficient evidence to conclude that they contributed to the subsequent engine power loss during the airborne ALA inspection. Nevertheless, the conduct of the manoeuvres was another aspect of the operator’s activities that was not effectively controlled by the operator.

Wyndham Aviation organisational factors

The operator’s passenger charter activities were fairly basic in nature. They involved the use of relatively simple, small aircraft on short visual flight rules (VFR) flights to the same locations, with very little aircraft traffic to consider. Nevertheless, the operations did involve some hazards that had to be effectively controlled. In addition to the normal hazards associated with flying any aircraft, these included conducting take-offs, approaches and landing on beaches and near water, as well as the use of various en route manoeuvres that were not consistent with a normal passenger charter flight.

As already indicated in this safety analysis section, a number of problems were identified with the operator’s procedures and practices. The problem most directly related to the accident was the procedures and practices for airborne inspections of the Middle Island ALA not managing the risk of an engine failure or power loss. In addition, other problems already discussed included:

• pilots relying on estimated rather than actual weights of passengers, baggage and cargo when calculating an aircraft’s weight and balance
• baggage and cargo routinely not being secured for flight
• conduct of near-aerobatic manoeuvres without any procedures specified for such manoeuvres
• the documented flight hours for VH-WTQ significantly underestimating the actual flight hours
• aircraft not being equipped with life jackets on flights were life jackets were required.

In addition, a number of other problems were identified during the investigation. These included:

• no diagrams of the ALAs included in the Operations Manual
• departures from the beach ALAs often involving turns after take-off conducted well below 500 ft above ground level (AGL) and approaches to the beach ALAs routinely being conducted with turns onto final approach below 500 ft AGL
• manoeuvring in the circuit area at the beach ALAs often below 500 ft AGL, particularly around the lighthouse at Bustard Head
• flights being conducted in an aircraft with maintenance requirements listed on the maintenance release not being certified as being completed
• the portable emergency locator beacon (ELB) on board VH-WTQ not having a current registration and not being registered to the operator.

These limitations included some routine deviations from regulatory and Operations Manual requirements (such as securing loads), routine deviations from widely-accepted practices (turns below 500 ft) and activities conducted without relevant procedures documented to reduce the risk (such as the near-aerobatic en route manoeuvres). There was also evidence of previously identified problems not being effectively addressed (such as the use of estimated rather than actual weights for passengers). Overall, the number of the problems, and the nature of some of the problems, indicated that the operator’s activities were not being effectively controlled and they were not consistent with the safe conduct of passenger charter operations.

The operator was very small in nature, with the chief pilot holding all the key positions and owning both aircraft. He also managed the commercial side of the operation, and was actively involved in managing the commercial activities at the camp sites. In addition, the chief pilot conducted most of the operator’s flights. The pilot of the accident flight was the only other employee, who conducted a small proportion of the flights, but normally at the same time as flights conducted by the chief pilot. However, even for that pilot’s flights, the chief pilot still completed most of the associated paperwork, including the maintenance release.

There could be many reasons for the number and nature of the limitations with the operator’s procedures and practices. The chief pilot was probably experiencing a significant workload with his many roles and activities, but the extent to which this was excessive or led to any of the problems was difficult to determine. There was also some evidence to indicate that the chief pilot was not familiar with all of the requirements associated with his role of head of aircraft airworthiness and maintenance control (HAAMC). However, the requirements associated with accurately recording flight hours on a maintenance release were not complex. In addition, the nature of the operator’s flights, to take customers to an adventure camp site, provided incentives to entertain the passengers during the flight.

Regardless of the reasons for the number and variety of problems, a salient aspect of the operator’s activities was that there was no regular, independent process of reviewing operations to ensure they met appropriate standards. Without regular review, there was the significant potential for operations to drift away from appropriate standards, particularly when no standards or procedures were actually prescribed in the first place.

One potential mechanism for reviewing operations would have been through the operator conducting regular proficiency checks of the pilots. However, there was no requirement for a small passenger charter operator such as Wyndham Aviation to conduct regular proficiency checks. The pilots were only required to undertake an aeroplane flight review every 2 years with an instructor to maintain the privileges of their licences, but this review covered basic flight operations and was not required to be tailored to the operator’s operations or use the operator’s aircraft.

Because the chief pilot wanted to take some leave, he organised for another pilot to act as chief pilot for a short period in late 2015. However, the extent to which this acting chief pilot was able to provide a review of practices was unclear, as he conducted little observation of the other pilots’ activities during routine operations and, because the procedures for some key tasks were not well defined, he may not have realised exactly how operations were normally conducted. Another potential review mechanism was the oversight by CASA, which is discussed in the next section.

There was no requirement for the operator to have a safety management system (SMS), nor would it be reasonable to expect that an operator this size could have all of the facilities and processes required for a mature SMS. Nevertheless, to help ensure that operations are conducted to an appropriate standard, the use of regular, independent review mechanisms of actual operations would be important for this type of operator to prevent the accumulation of multiple problems increasing the risk associated with the operation.

Regulatory oversight

As noted in ATSB’s investigation report AO-2009-072 (reopened), released in November 2017:

AOC approval and surveillance processes will always have constraints in their ability to detect problems. In particular, there is restricted time and limited resources available for these activities. Regulatory surveillance is therefore a sampling exercise, and cannot examine every aspect of an operator’s activities, nor identify all the limitations associated with these activities. Even when surveillance is conducted on some system elements, problems may subsequently develop as the nature and size of operators change over time…

Given such constraints, the limited number of oversight activities CASA undertakes need to be as effective as possible. With regard to Wyndham Aviation, CASA’s primary surveillance activities were the investigation of a complaint (about advertised aerobatic manoeuvres) in late 2009 and site inspections conducted in 2011 and 2015.

CASA was aware that the operator’s primary activity was conducting passenger charter flights to beach ALAs, and it was aware that there was some specific hazards and inherent risk involved in such activities. Although it had required the operator to include procedures for beach landings in its Operations Manual prior to issuing the operator with its initial air operator certificate (AOC) in 2009, as far as could be determined, it had not examined the operator’s procedures or practices for beach operations at any stage after it commenced operations.

The two site inspections did examine a range of elements that have relevance to many small passenger transport operators using small aircraft, such as maintenance records, pilot records and aircraft loading. However, the lack of any apparent focus on operations at the beach ALAs indicates that the surveillance was not planned with the specific activities, hazards and risk controls of the operator in mind. Unfortunately, the full nature of the considerations undertaken by CASA inspectors when scoping the surveillance events was difficult to determine given the limited documentation available about these events.

Another relatively unique aspect of the operator’s activities that could reasonably have been considered in the scope of the surveillance events was the conduct of near-aerobatic manoeuvres. The available evidence indicates that CASA personnel had awareness that such activities were being conducted, and they were discussed during the 2015 surveillance event to some extent. However, a more detailed examination would have been warranted given previous complaints, and the absence of any associated procedures in the Operations Manual.

The ATSB recently noted limitations with CASA’s surveillance processes of charter operators during the period up to 2009 in its AO-2009-072 (reopened) investigation report (released in November 2017). It concluded there was a safety issue at that time with the procedures and guidance for conducting surveillance events not formally including the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards. With the introduction of the CASA Surveillance Manual in 2012, there appeared to be no additional guidance procedures or guidance that addressed this issue. A review of the available evidence associated with the surveillance of Wyndham Aviation suggests that this safety issue still existed in practice during the period up to 2017.

It is difficult to determine whether additional focus by CASA during surveillance events on operations at beach ALAs would have identified the specific problem associated with the airborne inspections and the management of the risk of engine failures during these inspections. If CASA had identified exactly where the beach landing area at Middle Island was, this should have led to questions regarding how approaches, landings and take-offs (and potentially airborne inspections) were conducted close to the water. However, given some of the evidence discussed in this investigation report, it is possible that the operator’s description of these activities may not have been accurate. It is also possible that any observed activities may not have reflected normal operations.

In summary, CASA conducted a small amount of surveillance of Wyndham Aviation after issuing its initial AOC in June 2009, consistent with its available resources and priorities. However, the effectiveness of these surveillance events could have been enhanced with a more systematic approach to considering the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that are important for managing those threats or hazards. Providing specific procedures and guidance to inspectors about this issue could improve the quality of some future surveillance events.

__________

55. The Cessna 172M Owner’s Handbook stated that it would take about 7 seconds for the flaps to fully extend during flight.

From the evidence available, the following findings are made with respect to the collision with terrain involving a Cessna 172M, registered VH-WTQ, that occurred at Middle Island aeroplane landing area, Queensland on 10 January 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• While the pilot was conducting an airborne inspection of the beach aeroplane landing area (ALA) at an altitude of about 60 ft, the aircraft’s engine had a sudden and total power loss.
• Under significant time pressure, the pilot elected to conduct a significant left turn to the beach at a very low height. Although he believed it to be the safest option under the circumstances, it was inconsistent with standard training and guidance to land within 30º either side of straight ahead following an engine failure at a low height.
• During the continued left turn toward the beach, the aircraft did not have sufficient performance to avoid a collision with terrain, and it impacted terrain with little or no control and a significant descent rate.
• The operator normally conducted airborne inspections of the Middle Island aeroplane landing area at about 50–100 ft while flying at normal cruise speed towards an area of water, and its procedures did not ensure the effective management of the risk of an engine failure or power loss when at a low height. [Safety issue]
• The aircraft was not fitted with upper torso restraints for the rear passenger seats, which very likely increased the severity of the injuries sustained by the two rear-seat passengers.
• Upper torso restraints (UTRs) were not required for all passenger seats for small aeroplanes manufactured before December 1986 and helicopters manufactured before September 1992, including for passenger transport operations. Although options for retrofitting UTRs are available for many models of small aircraft, many of these aircraft manufactured before the applicable dates that are being used for passenger transport have not yet been retrofitted. [Safety issue]

Other factors that increased risk

• General industry guidance on the conduct of precautionary search and landings provides information on many important aspects, including recommended heights and configurations. However, little (if any) of the guidance specifically discusses the importance of considering the risk of an engine failure or power loss when conducting precautionary search inspections at a low height.
• There was no requirement for operators of passenger transport flights in aircraft with six or less seats to provide passengers with a verbal briefing, or written briefing material, on the brace position for an emergency landing or ditching, even for aircraft without upper torso restraints fitted to all passenger seats. [Safety issue]
• The operator routinely conducted passenger charter flights into aeroplane landing areas with airborne inspection, arrival and departure flight paths over water, such that if an engine failure occurred the pilot would have been required to ditch. However, life jackets were not carried on board the aircraft for such flights.
• The flight time documented on the aircraft’s maintenance releases often did not reflect the actual flight time, resulting in a total underestimation of the actual flight time by about 96 hours (or 32 per cent) during the period from May 2015 until January 2017. This underestimation resulted in the aircraft receiving less periodic (100 hourly) inspections and oil and oil filter changes than was required.
• The aircraft was at least 17 kg above its maximum take-off weight when it departed for the flight, and baggage and camp supplies stored in the baggage compartment were not effectively secured.
• Although the operator’s procedures required that actual weights be used for passengers, baggage and other cargo, this procedure was routinely not followed, and pilots relied on estimated weights when calculating an aircraft’s weight and balance. [Safety issue]
• Although the operator’s procedures required that baggage and cargo be secured during flight, this procedure was routinely not followed, and the aircraft were not equipped with cargo nets or other means for securing loads in the baggage compartment. [Safety issue]
• The operator’s pilots routinely conducted near-aerobatic manoeuvres during passenger charter flights. However, procedures for these manoeuvres were not specified in the operator’s Operations Manual, and there were limited controls in place to manage the risk of these manoeuvres. [Safety issue]
• There were a significant number and variety of problems associated with the operator’s activities that increased safety risk, and the operator’s chief pilot held all the key positions within the operator’s organisation and conducted most of the operator’s flights. Overall, there were no effective mechanisms in place to regularly and independently review the suitability of the operator’s activities, which enabled flight operations to deviate from relevant standards. [Safety issue]
• Although the operator’s primary activity since July 2009 was passenger charter flights to beach aeroplane landing areas (ALAs), regulatory oversight by the Civil Aviation Safety Authority had not examined the operator’s procedures and practices for conducting flight operations at these ALAs.
• The Civil Aviation Safety Authority’s procedures and guidance for scoping a surveillance event included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards. [Safety issue]

Other findings

• The reason for the sudden and total engine power loss could not be determined. A fault or defect with the engine and carburettor icing were both considered unlikely, and there was more than sufficient fuel on board the aircraft for the flight. However, airframe issues such as fuel supply faults could not be excluded.

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Operator’s procedures and practices for airborne inspections of a landing area 

Safety issue number: AO-2017-005-SI-01

Safety issue description: The operator normally conducted airborne inspections of the Middle Island aeroplane landing area at about 50–100 ft while flying at normal cruise speed towards an area of water, and its procedures did not ensure the effective management of the risk of an engine failure or power loss when at a low height.

Operator’s aircraft loading practices

Safety issue number: AO-2017-005-SI-02

Safety issue description: Although the operator’s procedures required that actual weights be used for passengers, baggage and other cargo, this procedure was routinely not followed, and pilots relied on estimated weights when calculating an aircraft’s weight and balance.

Operator’s practices for securing baggage and other cargo

Safety issue number: AO-2017-005-SI-03

Safety issue description: Although the operator’s procedures required that baggage and cargo be secured during flight, this procedure was routinely not followed, and the aircraft were not equipped with cargo nets or other means for securing loads in the baggage compartment.

Operator’s conduct of near-aerobatic manoeuvres during charter flights

Safety issue number: AO-2017-005-SI-04

Safety issue description: The operator’s pilots routinely conducted near-aerobatic manoeuvres during passenger charter flights. However, procedures for these manoeuvres were not specified in the operator’s Operations Manual, and there were limited controls in place to manage the risk of these manoeuvres.

Operator’s processes for reviewing its operations

Safety issue number: AO-2017-005-SI-05

Safety issue description: There were a significant number and variety of problems associated with the operator’s activities that increased safety risk, and the operator’s chief pilot held all the key positions within the operator’s organisation and conducted most of the operator’s flights. Overall, there were no effective mechanisms in place to regularly and independently review the suitability of the operator’s activities, which enabled flight operations to deviate from relevant standards.

Requirements for upper torso restraints in small aircraft

Safety issue number: AO-2017-005-SI-06

Safety issue description: Upper torso restraints (UTRs) were not required for all passenger seats for small aeroplanes manufactured before December 1986 and helicopters manufactured before September 1992, including for passenger transport operations. Although options for retrofitting UTRs are available for many models of small aircraft, many of these aircraft manufactured before the applicable dates that are being used for passenger transport have not yet been retrofitted.

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Civil Aviation Safety Authority consider mandating the fitment of upper torso restraints (UTRs) for all seats in small aeroplanes and helicopters, particularly for those aircraft (a) being used for air transport operations and/or (b) for those aircraft where the aircraft manufacturer has issued a mandatory service bulletin to fit UTRs for all seats (or such restraints are readily available and relatively easy to install).

Safety advisory notice description: The Australian Transport Safety Bureau strongly encourages operators and owners of small aeroplanes manufactured before December 1986 and helicopters manufactured before September 1992 to fit upper torso restraints to all seats in their aircraft (if they are not already fitted).

Requirements for briefing the brace position in small aircraft

Safety issue number: AO-2017-005-SI-07

Safety issue description: There was no requirement for operators of passenger transport flights in aircraft with six or less seats to provide passengers with a verbal briefing, or written briefing material, on the brace position for an emergency landing or ditching, even for aircraft without upper torso restraints fitted to all passenger seats.

Regulatory surveillance – scoping of surveillance events

Safety issue number: AO-2017-005-SI-08

Safety issue description: The Civil Aviation Safety Authority’s procedures and guidance for scoping a surveillance event included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards.

ATSB safety recommendation to the Civil Aviation Safety Authority 

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Civil Aviation Safety Authority undertake further work to improve its procedures and guidance for scoping surveillance activities to formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards.

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Civil Aviation Safety Authority

Oversight of the operator following the 10 January 2017 accident

On 11 January 2017 (the day after the accident), the Civil Aviation Safety Authority requested the operator to cease flight operations under its Air Operator’s Certificate (AOC) until CASA could be assured that operations could continue safely. On 27 January 2017, following subsequent investigation by CASA, the operator was issued with a notice of immediate suspension of its AOC. On 10 March 2017, the operator requested that CASA cancel its AOC.

Regulatory changes

In December 2018, Civil Aviation Safety Regulation (CASR) Part 135 (Australian air transport operations–Smaller aircraft) and CASR Part 119 (Australian air transport operators–certification and management) were made. These new regulations come into effect in March 2021 and include some new requirements for operators conducting passenger transport flights using small aeroplanes.

With relevance to some of the safety issues identified with Wyndham Aviation in this investigation, these requirements include more frequent proficiency checks of pilots and safety management requirements. More specifically:

• Part 135 includes a requirement for operators to conduct proficiency checks on pilots. The draft Manual of Standards (MOS) for Part 135, publicly consulted in September 2018, includes specific requirements for recurrent proficiency checks.  For VFR flights, these include a proficiency check initially between 5 and 7 months after commencing unsupervised line operations for the operator and subsequently at intervals of not more than 12 months. The proficiency checks are required to demonstrate that a pilot is competent to carry the applicable duties of the pilot in the operator’s aeroplane.
• Part 119 includes a requirement for an operator to have a safety management system. The requirements for introducing a safety management system for current charter operators will be the subject of public consultation in late 2019.
• Part 119 also includes a requirement for an operator to have a safety manager. The same person can not hold the position of safety manager and the position of chief executive officer (except in an unforeseen circumstance). The requirements for engaging a safety manager are included in the rules pertaining to the introduction how a safety management system is to be introduced. 

__________

NOTE: The full bulletin, and other CASA cabin safety bulletins, is available on the CASA website at www.casa.gov.au/aircraft/standard-page/cabin-safety-bulletin.

Pilot details

Licence details:	Commercial Pilot (Aeroplane) Licence, issued August 2016
Endorsements:	Manual propeller pitch control; Retractable undercarriage
Ratings:	Single engine aeroplanes less than 5,700 kg maximum take-off weight
Medical certificate:	Class 1, valid to October 2017
Aeronautical experience:	Approximately 3,550 hours
Last flight review:	August 2016

Aircraft details

Manufacturer and model:	Cessna 172M
Year of manufacture:	1973
Registration:	VH-WTQ
Operator:	Wyndham Aviation Pty Ltd
Serial number:	17261931
Total time in service	6,838.4 flight hours (documented) 6,934.9 flight hours (estimated)
Type of operation:	Charter - passenger
Persons on board:	Crew – 1	Passengers – 3
Injuries:	Crew – 1 (serious)	Passengers – 3 (1 fatal, 2 serious)
Damage:	Destroyed

Sources of information

The sources of information during the investigation included:

• the pilot of the accident flight and another pilot who conducted flights for the operator
• the operator and the chief pilot of Wyndham Aviation Pty Ltd
• the Civil Aviation Safety Authority
• the Queensland Police Service
• the aircraft manufacturer
• the maintenance organisation for VH-WTQ
• Airservices Australia
• some of the passengers on the operator’s aircraft and people at the camp site on the day of the accident
• video footage of the accident flight and other photographs and videos taken on the day of the accident
• recorded data from the Global Position System (GPS) unit on the aircraft.

References

Burian BK, Barshi I & Dismukes K 2005, The challenge of aviation emergency and abnormal situations, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2005-213462.

Casner SM, Geven RW & Williams RT 2013, ‘The effectiveness of airline pilot training for abnormal events’, Human Factors: The Journal of the Human Factors and Ergonomics Society, vol. 55, pp.477-485.

Civil Aviation Authority New Zealand 2015, ‘The impossible turn’, Vector, July/August, pp.4-6.

Civil Aviation Safety Authority 2001, Proposed Airworthiness Directive, General Series – Upper torso restraints for occupants in small aircraft, Discussion Paper, Document DP 0109CS, December 2001.

Dismukes RK, Berman BA & Loukopoulos LD 2007, The limits of expertise: Rethinking pilot error and the causes of airline accidents, Ashgate Aldershot UK.

Dismukes RK, Goldsmith TE & Kochan JA 2015, Effects of acute stress on aircrew performance: Literature review and analysis of operational aspects, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2015-218930.

Kahneman D 2011, Thinking, fast and slow, Allen Lane London.

Klein G 1998, Sources of power: How people make decisions, Massachusetts Institute of Technology.

Landman A, Groen EL, van Passen VV, Bronkhorst AW & Mulder M 2017, ‘The influence of surprise on upset recovery performance in airline pilots’, The International Journal of Aviation Psychology, vol. 27, pp.2–14.

National Transportation Safety Board 2005, General aviation crashworthiness project: Phase two – Impact severity and potential injury prevention in general aviation accidents, Safety Report NTSB/SR-85/01.

National Transportation Safety Board 2011, Airbag performance in general aviation restraint systems, Safety Study NTSB/SS-11/01.

Newman RL 1988, ‘Ditchings: A case history and a review of the record’, SAFE Journal, vol. 18, pp.6–15.

Rostykus PC, Cummings P & Mueller BA 1998, ‘Risk factors for pilot fatalities in general aviation airplane crash landings’, Journal of the American Medical Association, vol. 280, pp.997-999.

Staal MA 2004, Stress, cognition, and human performance: A literature review and conceptual framework, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2004-212824.

Stobie N 2019, ‘You’re one and only: Mitigating the risk of engine failures in singles’, Flight Safety Australia, uploaded March 2019. Available from www.flightsafetyaustralia.com.

Wickens CD & Hollands JG 2000, Engineering psychology and human performance, 3rd edition, Prentice-Hall International Upper Saddle River, NJ.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the operator, the pilot and the Civil Aviation Safety Authority (CASA).

Submissions were received from the operator, the pilot and CASA. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A – Review of VH-WTQ’s total time in service

Introduction

A review of data from the Global Position System (GPS) unit on board VH-WTQ identified an apparent discrepancy between the hours documented on the aircraft’s maintenance releases and the flight hours recorded by the GPS unit on several days. A review of maintenance records and other sources of information was undertaken to confirm whether there was a discrepancy.

Comparison of GPS data with other information

The ATSB compared the data from the GPS unit recovered from VH-WTQ for the period from 14 November 2016^[57] to 4 January 2017 with other sources of evidence. Relevant information included:

• The GPS unit on board VH-WTQ was hard-wired into the aircraft, and the chief pilot stated that, as far as he was aware, the unit was never removed from the aircraft and used in other aircraft.
• The pilot of the accident flight documented daily flight times in his logbook using standard amounts of 12 minutes (0.2 hours) corresponding to each standard flight from Agnes Water aeroplane landing area (ALA) to one of the beach ALAs or return (that is, 0.4 hours for a return trip).^[58]
• Based on this pattern, there was a perfect correspondence between the pilot’s logbook for flights in VH-WTQ and the GPS data for the number of standard flights between Agnes Water and a beach ALA. The number of standard flights was the same for each of the 27 days that flights were documented in the pilot’s logbook and recorded on the GPS unit (a total of 122 flights).^[59]
• There were 2 other days (a total of four standard flights) where flights were recorded on the GPS unit but no flights were documented in the pilot’s logbook. During this period, the only other pilot conducting flights for the operator was the chief pilot. The chief pilot could not recall conducting any flights in VH-WTQ after the aircraft’s last periodic inspection on 20 September 2016.
• The flight time of each flight recorded on the GPS unit was estimated.^[60] Overall, the total flight time for the period from 14 November 2016 to 4 January 2017 (the last flights recorded on the GPS unit prior to the accident flight) was 19.3 hours. The total flight time documented on the current maintenance release during this period was 13.95 hours. This difference indicated that the maintenance release flight time underestimated the GPS-based flight time by 5.3 hours (or about 28 per cent) during this period.

In terms of the manner in which the underestimation of the flight time occurred:

• For almost all the days with documented flights from November 2016 to January 2017, the daily flight time figure on the maintenance releases was in units of 0.25 hours (or 15 minutes).^[61] This appeared to indicate that each trip from Agnes Water to one of the beach ALAs and return was estimated to take 15 minutes. A review of the flight times from the GPS data indicated that such trips averaged 17.5 minutes (0.3 hours).
• On many of the trips from Agnes Water to a beach ALA, there was one or more additional short flights from one beach ALA to the other beach ALA. These trips averaged 2.7 minutes (0.05 hours) and did not appear to be included in the figures on the maintenance release (or the pilot’s logbook).
• Daily flight times for 3 days on which flights were recorded on the GPS unit and documented in the pilot’s logbook were not included on the maintenance release.
• Daily flight times for 2 days on which flights were recorded on the GPS unit but not documented in the pilot’s logbook were not included on the maintenance release.^[62]
• For several days, the number of standard flights between Agnes Water and a beach ALA recorded on the GPS unit and indicated in the pilot’s logbook was more than that indicated in the daily flight times on the maintenance release.

In summary, a comparison of the flight time recorded on the GPS unit with the flight time documented on the current maintenance release for the period 14 November 2016 to 4 January 2016 indicated that the maintenance release flight time underestimated the actual (GPS-based) flight time by 5.3 hours (or 28 per cent) during this period. The underestimation was associated with a number of discrepancies, including the flight time associated with many flights between Agnes Water and a beach ALA being slightly underestimated, short flights between the beach ALAs not being included, and some flights between Agnes Water and a beach ALA not being included.

Review of maintenance records

In order to confirm whether the discrepancy in estimated flight hours between the GPS data and the maintenance release could be confirmed during the same period and or other periods, the ATSB conducted a review of the aircraft’s maintenance documentation. Relevant information included:

• The aircraft was fitted with an Omron H7ET hour meter, which provided a digital display of cumulative time based on output signals received from a sensor (Figure A1).^[63] A label next to the meter stated that it displayed ‘FLIGHT SWITCH HOURS’.
• It is common and accepted practice to use estimated flight time (or hours flown) rather than engine time for determining the maintenance requirements of small aircraft.^[64] The aircraft had an airswitch sensor located under the right wing. The exact mechanism for triggering the recording of hours on the meter was not determined, but it was probably based on the airswitch sensing an air pressure corresponding to an airspeed value (which approximated when the aircraft was airborne).
• The aircraft’s maintenance records indicated that the hour meter was last reset to a value of 0 hours in February 1998, when the aircraft total time in service (TTIS) was 3,862.0 hours. Therefore, the hour meter readings should have been about 3,862 hours less than the TTIS.
• After Wyndham Aviation acquired the aircraft in November 2013, the progressive total documented on the aircraft’s maintenance releases^[65] after a day’s flights was the current figure displayed on the hour meter. The aircraft’s TTIS was calculated at each periodic (100 hours) inspection by maintenance personnel subtracting the current hour meter reading from the documented hour meter reading at the time of the previous periodic inspection, and adding this figure to the TTIS documented at the previous periodic inspection.
• In a site inspection conducted in March 2015, the Civil Aviation Safety Authority (CASA) identified that the operator was documenting the current hour meter reading in the progressive total column for VH-WTQ after each day’s flights whereas the TTIS should have been documented in that column. It issued the operator with a non-compliance notice (NCN) to address the deficiency.
• On 1 June 2015, the operator started documenting the TTIS in the progressive total column on the maintenance releases after each day’s flights. As of 29 May 2015, the TTIS was 6,631.1 hours and the hour meter reading was 2,773.4 hours. No further hour meter readings were documented on the aircraft’s maintenance releases. The difference between the TTIS and the hour meter reading (3,857.7 hours) at that time was very close to the TTIS when the hour meter was last reset 17 years before (3,862.0 hours), indicating that the hour meter was regularly being used to record the aircraft’s flight time.
• During the period from January 2014 to May 2015, the pilot of the accident flight conducted many flights in VH-WTQ. In the vast majority of cases, the flight times documented on the maintenance releases were less than the flight times documented in the pilot’s logbook.^[66] This is consistent with the hour meter recording the estimated flight time whereas the pilot’s logbook figures included flight time and taxi time.
• The next periodic inspection was conducted on 12 November 2015. At that time the TTIS documented on the maintenance release was 6,704.9 hours, which indicated there had been 93.7 hours flown since the last periodic inspection on 1 May 2015 (see Table A1).
• On maintenance worksheets for the 12 November 2015 periodic inspection, an hour meter reading of 2,909.1 hours was documented, which indicated there had been 155.9 hours since the 1 May 2015 periodic inspection. These figures indicated that the flight time documented on the maintenance releases underestimated the actual flight time by 62.2 hours (or 40 per cent) during the period from 1 May 2015 to 12 November 2015. The underestimating only appeared to start from 1 June 2015, after the practice of documenting the current hour meter readings on the maintenance releases was discontinued.
• The last periodic inspection prior to the accident was conducted on 20 September 2016. No hour meter reading was documented in the maintenance documentation. The TTIS was documented as 6,804.7 hours, which indicated there had been 99.8 hours since the 12 November 2015 periodic inspection.
• The current maintenance release at the time of the accident (issued 20 September 2016) had a TTIS prior to the accident flight of 6,838.4 hours, which indicated there had been 33.7 hours since the 20 September 2016 periodic inspection and 133.5 hours since the 12 November 2015 periodic inspection.
• The hour meter reading after the accident was 3,077.0 hours (Figure A1), and this figure was also visible in the video footage of the accident flight at 1037:39 (20 seconds prior to impact). The reading prior to take-off would therefore have been about 3,076.9 hours. This figure indicated there had been 167.8 hours flight time since the 12 November 2015 inspection. It also indicated that the flight time documented on the maintenance releases underestimated the actual flight time by 34.3 hours (or 20 per cent) during the period from 12 November 2015 to 10 January 2017.
• There was no evidence in the maintenance records that the hour meter was considered faulty during the period that Wyndham Aviation used the aircraft from 2013 to 2017. The chief pilot and pilot of the accident flight reported that they were not aware of any problems with the aircraft’s hour meter.

Figure A1: Hour meter on VH-WTQ displaying the value at the time of impact

Source: ATSB.

Table A1: Recorded TTIS and hour meter readings during the period VH-WTQ was used by Wyndham Aviation

Date	Event	TTIS	Hour meter	Comment
05/10/2013	Periodic inspection	6,249.4	2,391.4	During this period, the increments in the documented TTIS matched the increments in the hour meter readings.
22/05/2014	Periodic inspection	6,349.1	2,491.6
07/10/2014	Periodic inspection	6,448.9	2,591.4
16/12/2014	Periodic inspection	6,515.1	2,657.6
01/05/2015	Periodic inspection	6,611.2	2,753.2
29/05/2015	After this time recording TTIS on maintenance release progressive totals	6,631.1	2,773.1
Total (05/10/2015-01/06/2015)		381.7	381.7
12/11/2015	Periodic inspection	6,704.9	2,909.1	During this period, the increments in the documented TTIS were less than the increments in the hour meter readings. Total discrepancy was 96.5 hours.
20/09/2016	Periodic inspection	6,804.7	Not documented
10/01/2017	Prior to accident flight	6,838.4	3,076.9
Total (01/06/2015 -10/01/2017)		207.3	303.8

In summary, a comparison of the flight time obtained from hour meter readings and the flight time documented on the aircraft’s maintenance releases indicated that the maintenance release figures underestimated the flight time by 96.5 hours (or about 32 per cent) during the period from 1 May 2015 to 10 January 2017. During this period, 207.3 flight hours were documented whereas the ATSB estimated that 303.8 flight hours were conducted.

This information was consistent with that provided by the comparison of the documented flight times on the aircraft’s maintenance release with the data recorded on the GPS unit for the period from 14 November 2016 to 4 January 2017 (an underestimation of about 28 per cent).

Other observations

Given a total underestimation of 96.5 hours since 1 May 2015, the aircraft’s TTIS prior to the 10 January 2017 accident flight should have been 6,934.9 hours rather than 6,838.4 hours.

As previously stated, the hour meter reading was not documented during the last periodic inspection conducted on 20 September 2016. The current maintenance release indicated that 33.7 hours flight time was conducted between the inspection and the accident flight.

To estimate the actual flight time since the last maintenance, the ATSB used the GPS data for the period from 14 November 2016 to 4 January 2017 (19.3 hours). For the period from 20 September 2016 to 12 November 2016, the ATSB used the average underestimation based on hour meter data information for the period from 12 November 2015 to the accident flight (20 per cent), after accounting for the period from 14 November 2016 to 4 January 2017.^[67] Overall, the estimated flight hours since the last periodic inspection on 20 September 2016 was 43.8 hours.

Appendix B – Verification of the recorded GPS data from the accident flight

Introduction

As outlined in GPS information, the expected level of accuracy of the recorded global positioning system (GPS) data from the Garmin 296 Portable Aviation Receiver fitted to the aircraft when in steady flight was 5 m for position or horizontal accuracy and 7.5 m (or 25 ft) for altitude or vertical accuracy.

Video footage showed that, during the aircraft’s descent and the airborne inspection of the landing area up until the engine power loss, the aircraft was in steady flight. Therefore, the recorded GPS data accuracy during this period should be similar to the expected level of accuracy stated by the manufacturer. After the engine power loss, when the aircraft was turning, climbing and descending, the expected level of accuracy would have been less than in steady flight.

To verify whether the recorded GPS data was within the expected level of accuracy, the ATSB conducted a detailed comparison of the recorded GPS data with other sources.

Verification of the recorded GPS position data

Details of the recorded GPS position data were provided in Figure 1.

The pilot of the accident flight reported that the engine power loss occurred at about the position annotated with the time 1037:38 in Figure 2 rather than the position annotated by the time 1037:34. That is, he believed the power loss occurred about 240 m further north than indicated by alignment of the recorded GPS data with the video footage.

The ATSB compared the recorded GPS position data with radar data obtained from Airservices Australia. The GPS and radar data were independent. The GPS was a standalone unit that determined position and altitude internally using broadcasted satellite signals, whereas the radar data was based on signals sent from the aircraft’s transponder. A composite position derived from multiple secondary surveillance radar returns^[68] from VH-WTQ’s transponder was recorded every 5 seconds when the aircraft was above the limits of radar coverage in the area.

The recorded GPS position data and the recorded radar position data were consistent, with reduced accuracy during periods of manoeuvring (consistent with the known limitations of both types of data). The two sources of data agreed within about 50 m for the 1-minute period leading up to the engine power loss. The nearest data points to the engine power loss agreed within 33 m.^[69]

The ATSB also compared the recorded GPS position data with the location of terrain features in the video footage. Key results included:

• During the take-off roll, the recorded GPS data showed the aircraft moving down the centre of the runway at Agnes Water aeroplane landing area (ALA), consistent with the video footage. The ATSB considered that it would be reasonable to expect that if the recorded positions were accurate at the beginning of the flight they would remain accurate when the aircraft was in steady flight.
• At 1037:26, alignment of geographical features in the video footage indicated that the aircraft was close to the recorded GPS point at that time.
• At 1037:36, 2 seconds after the engine power loss, the video footage showed that the aircraft was still a significant distance south of the bend in the beach on Middle Island (see Figure B1 and the location of the bend in Figure 2). Given the aircraft’s groundspeed was about 124 kt (or 64 m/s) at that time, the image shown in Figure B1 was taken about 130 m north of the engine power loss. If the engine power loss had occurred at the position reported by the pilot, then the area of beach north of the bend should have been visible in Figure B1. Instead, this image is consistent with what would be expected if the engine power loss occurred at the position indicated in Figure 2 (based on the recorded GPS data).

Figure B1: A still image taken from the video footage 2 seconds after engine power loss (1037:36)

At the time this image was taken the phone camera was oriented to the left of the aircraft’s heading. The image shows an area of sand on Middle Island beach, just prior to a bend to the left with further beach beyond.

Source: Queensland Police Service.

The position of the aircraft indicated by the video footage also appeared to be consistent with the recorded GPS and radar position data at other times during the flight.

In summary, the recorded position data from the GPS unit was confirmed to be within the expected accuracy level based on comparing the data with available information from other sources, including radar data and the video footage.

Verification of the recorded GPS groundspeed data

The GPS calculated and recorded groundspeed data at each data point by dividing the distance between that data point and the previous data point and dividing by the time between the data points. The average recorded groundspeed in the 1-minute period up to 1037:32, 2 seconds prior to the power loss, was 125 kt. The average groundspeed in the 12 seconds up to 1037:32 was 124 kt (or about 230 km/hour).

The pilot of the accident flight reported that he did not think the aircraft was flying with a groundspeed as high as 124 kt during the airborne inspection.

The radar data provided similar groundspeeds to the GPS data in the period leading up to the engine power loss.

In addition, the ATSB considered the following information:

• The audio analysis of the video footage found that the engine/propeller speed at this time was about 2,680 RPM.
• The Cessna 172M Owner’s Manual stated that at 2,500 ft altitude, 2,700 RPM and a weight of 2,300 lb the aircraft would cruise at 134 miles per hour (116 kt).
• The reported wind at the time was 10–15 kt from the south-east, which would have provided a tailwind of about 7-11 kt.
• In the 6 seconds up to 1037:32, the aircraft was descending. Without a change in power settings or configuration, a descent will normally result in an increase in the aircraft’s groundspeed.

In summary, the recorded groundspeed data from the GPS unit was confirmed to be within the expected accuracy level based on comparing the data with available information from other sources.

Verification of the recorded GPS altitude data

Details of the recorded GPS altitude data during the later part of the flight were provided in Figure 2. More specifically, the recorded GPS altitudes above mean seal level (AMSL) at key times were:

• 45 m (148 ft) at 1037:20 (14 seconds prior to the engine power loss)
• 36 m (118 ft) at 1037:26 (8 seconds prior to the engine power loss)
• 21 m (69 ft) at 1037:32 (2 seconds prior to the engine power loss)
• 19 m (62 ft) at 1037:38 (4 seconds after the engine power loss)
• 42 m (138 ft) at 1037:46 (12 seconds after the engine power loss)
• 25 m (82 ft) at 1037:56 (22 seconds after the engine power loss and 3 seconds prior to impact).

The pilot reported that the aircraft was at about 150–200 ft when he conducted the airborne inspection and when the engine power loss occurred.

The ATSB compared the GPS data with the available information from radar data, video footage of terrain features, video footage of the altimeter and other sources to determine the best estimate of the altitude of the aircraft at the time of the engine power loss (1037:34).

The recorded radar data included transponder altitude. This is an air pressure measurement from the aircraft, measured by an encoder using the same static pressure lines as the aircraft’s altimeter but with an independent sensor, then transmitted by the aircraft’s transponder. The transponder altitude data was only recorded in 100-ft intervals. Within this limitation, the QNH-corrected^[70] transponder altitude was consistent with the GPS altitude during the flight, with the exception of some data points when the aircraft was manoeuvring (Figure B2). In particular, during the aircraft’s descent prior to the engine power loss, the recorded GPS data and radar data were in close agreement.

Figure B2: Comparison of recorded GPS and transponder altitudes

Source: ATSB.

With regard to the video footage of terrain features:

• Photogrammetry analysis^[71] of the terrain features in the video at about 1037:26 indicated that the altitude was close to that indicated by the GPS data (that is, about 120 ft). More specifically:
• The video footage showed a ridge along Middle Island with a distinctive area of sand on top (Figure B3). The top of this ridge was estimated to be at an altitude of about 100–120 ft,^[72] and the distance from the aircraft to the ridge was about 1,250 m.
• In the video, the top of this ridge had a slightly higher apparent height than a saddle 2,300 m behind the ridge (on the other side of the Jenny Lind Creek inlet) that was about 120–140 ft high. This indicated that the aircraft was at or slightly below the ridge height.
• No terrain or horizon was visible behind the high point of the ridge on Middle Island. If the aircraft was significantly higher than the ridge (120 ft), then it would have been possible to see the terrain and/or horizon behind the ridge.
• The aircraft’s vertical speed indicator (VSI) indicated a descent rate of about 350 ft/min at 1037:26, which was broadly consistent with the descent rate at the time derived from the GPS data (about 400 ft/min). Analysis of the video footage showed that the aircraft continued to descend steadily until 1037:28, then with the descent rate decreasing until it appeared to level at 1037:36. Given the recorded GPS altitude at 1037:32 was about 70 ft, and the aircraft continued to descend during the 2 seconds after this time, the estimated GPS-based altitude at the time of the engine power loss (1037:34) was about 60 ft.
• At 1037:36, 2 seconds after the engine power loss, the video footage showed some trees on Middle Island (Figure B2) at about the location of the bend in Figure 2. The apparent height of the top of these trees was notably higher than the saddle on the other side of the Jenny Lind Creek inlet. Although the exact altitude of the top of these particular trees on Middle Island is not known, they were visible in multiple photos and videos taken after the accident. Using a variety of methods, the height of these trees was estimated to be between 40–80 ft, and more likely to be in the middle of this range. Therefore, the aircraft at this time was almost certainly below 80 ft and probably below 60 ft. Based on the video footage, the aircraft appeared to be in approximately level flight around this time.
• Photogrammetry analysis of other terrain features in the video footage between 1037:29 and 1037:44 produced altitudes within about 20 ft of the recorded GPS data during this period. This method used the geometric relationship between the top and base of Bustard Head and the apparent height of the horizon behind it (Figure B4).

Figure B3: Still image from mobile phone video at 1037:26 (altimeter enhanced)

The image shows nearby terrain features: a ridge 100–120 ft high on nearby Middle Island, and a distant saddle 120–140 ft high. An enhanced section of the image shows the altimeter indication at that point, which is about 200 ft and the vertical speed indicator (VSI) showing a 350 ft/min descent. Source: Queensland Police Service.

Figure B4: Video stills at 5-second intervals during descent (last image is 3 seconds prior to engine failure)

Source: ATSB.

With regard to the altimeter indications in the video footage, the last view of the altimeter prior to the engine power loss occurred at 1037:26, when the altimeter indicated about 200 ft (Figure B3). This was significantly higher than the recorded GPS data at the same time (120 ft), and also higher than the transponder altitude and the altitude indicated by an analysis of terrain features in the video footage at the same time.

Figure B5 summarises the available information about the aircraft’s altitude during the last part of the flight. As indicated in the figure, altitude information from the recorded GPS data, radar data, and the analysis of terrain features and the horizon geometry in the video footage was in alignment during the aircraft’s descent up until the engine power loss (at 1037:34).

Figure B5: Summary of information about the aircraft’s altitude from 1037:20 until impact

Source: ATSB.

The GPS altitude and the altimeter both appeared to be higher than the aircraft’s actual altitude in the last 10 seconds of flight (after the engine power loss). This is consistent with the GPS’s reduced accuracy in manoeuvring flight, and possibly with the altimeter being affected by sideslip during that period.

With regard to the accuracy of the altimeter reading of 200 ft at 1037:26 (which was significantly higher than the GPS data and other sources):

• Transponder altitude, which was derived from barometric pressure using a different sensor to the altimeter, was within the range 50–150 ft immediately before (1027:23) and after (1027:28) the 200 ft altimeter indication. Given the aircraft was descending during this period, the radar data was therefore indicating that the altitude was significantly below 150 ft at 1027:26.
• There was inconsistency between altimeter indications. More specifically:
• As indicated above, during the period from 1037:26 until the engine power loss, the video footage showed that the aircraft was descending. Based on recorded GPS data, the ATSB estimated that the aircraft descended about 60 ft during this period. Therefore, if the indicated altitude was 200 ft at 1037:26, it should have been about 140 ft at 1037:34.
• Soon after the engine power loss, at about 1037:36, the pilot raised the aircraft’s nose and the aircraft started climbing. The indicated altitude on the altimeter at 1037:48 was about 120 ft (with the VSI indicating a rate of climb over 500 ft/min), and the indicated altitude at 1037:52 was about 140 ft (with the VSI indicating about 0 ft/min). This information suggests that the aircraft was climbing from about 140 ft for up to 15 seconds.
• If the aircraft was at 200 ft at 1037:26, then the ATSB would expect the indicated altitude on the altimeter to be significantly more than 140 ft at 1037:52 (at the top of the climb following the engine power loss). Therefore, the altimeter indication at 1037:26 was not consistent with the subsequent indications at 1037:48 and 1037:52.
• The altimeter indicated an altitude of about 70 ft just before wingtip impact, when the aircraft’s fuselage was probably 15–20 ft above ground level (which was close to sea level). Given the aircraft may not have been in coordinated flight at that time, the altimeter indication was considered less reliable than the previous indications.

In summary, given the inconsistencies between the altimeter indications and discrepancies between the altimeter indications and other sources of altitude information, none of the altimeter indications could be assumed to provide a high level of accuracy.

In addition to the comparison of the recorded GPS data with radar data and the video footage, the ATSB also considered the following information:

• The pilot of the accident flight reported that he normally conducted airborne inspections of Middle Island ALA at 150–200 ft. A review of the GPS data identified 19 previous inspections of Middle Island ALA, all of which were conducted by the pilot of the accident flight. The lowest altitudes recorded during these inspections were generally below 100 ft with a median value of about 60 ft (see Review of airborne inspections at Middle Island ALA ). Given the relatively constant descents and straight flight paths involved in these inspections, the GPS data was probably within the GPS manufacturer’s expected level of accuracy.
• On the video recording, at about 1036:37, at the start of the descent to the landing area, the pilot made a statement to the passengers that sounded like ‘going to go down to [indistinct] feet’. The rate of speech was consistent with the indistinct part having one or two syllables with an ‘i' sound (as in ‘bit’) in the first syllable. The pilot subsequently advised that he would have said ‘going to go down to one hundred and fifty feet’. Although it was not possible to ascertain exactly what he said, the short duration of the utterance and its sound was consistent with the word ‘fifty’, and it is unlikely that the utterance included any additional words, such as ‘one hundred’, prior to the word ‘fifty’.
• During the initial climb out from Agnes Water, one of the rear-seat passengers took some photos of the cockpit with an iPhone 6 mobile phone, in which the altimeter can be seen. Like the phone used to take the in-flight video, the iPhone 6 is automatically set to network (local) time by default, but it is possible to override this setting. Although it was not possible to confirm that this phone’s time was set correctly, the altimeter indications in the photos (340–360 ft) were consistent with the recorded GPS data at the same time (about 375 ft).

In summary, the comparison between the altimeter indications and the recorded GPS data provided differing values at various times towards the end of the flight. However, in the period prior to the engine power loss, the ATSB concluded that the recorded GPS data was more accurate than the altimeter indication, as it matched the analysis of radar data and terrain features in the video footage. Overall, the ATSB concluded that the altitude at the time of the engine power loss was probably between 40 and 80 ft and therefore probably close to the GPS-based altitude of 60 ft. This altitude was consistent with the recorded GPS data from previous airborne inspections flown by the pilot of the accident flight.

Information about altimeter accuracy

As noted above, the altimeter was indicating about 200 ft at 1037:26 when the aircraft was probably close to 120 ft, and it was indicating 70 ft just before impact. In addition, the indication at 1037:52 was not consistent with the previous indication and the aircraft’s subsequent descent and climb. The reasons for these discrepancies could not be ascertained. The ATSB considered the following information:

• During the post-accident inspection, the QNH set on the altimeter subscale was observed to be between 1,013 and 1,014 hPa. This was close to the actual atmospheric pressure recorded by the Bureau of Meteorology for airports in the area at the time. The QNH setting knob had broken off during the impact. It is possible that the setting had moved during impact, but it was considered unlikely that this would have resulted in a significant change in the setting.
• The aircraft’s maintenance schedule required that the altimeter be checked every 2 years, and such a check involved ensuring the accuracy of the altimeter at difference simulated air pressures. At a simulated altitude of 0 ft (or 1,013 hPa), the altimeter was required to indicate within 20 ft of that altitude (see CAO 100.5, Attachment 1 to Appendix 1). The altimeter on VH‑WTQ was last checked during a periodic inspection in May 2015, 20 months prior to the accident.
• For a visual flight rules (VFR) flight, with an accurate QNH set, an aircraft’s altimeter is only required to be accurate within 100 ft to be considered acceptable by a pilot (see the Aeronautical Information Publication ENR 1.7 section 1.3).
• The overall comparison of the altimeter indications and the GPS data suggests the altimeter values had a short period of lag or delay behind the GPS values. Although there can be a lag in altimeter indications, such a lag generally is generally considered to be very small in normal flight manoeuvres.
• Sideslip (sideways movement), such as in an uncoordinated turn, can affect altitude measurements. However, this was unlikely to be the case during the steady descent.

In summary, it is possible that there was a slight difference between the actual QNH and that set by the pilot,^[73] and the accuracy of the altimeter may have drifted slightly out of tolerance since it was last checked. Although the reasons for the altimeter over reading at 1037:26 could not be determined, it still appeared to be indicating within the required limits for a VFR flight.

Appendix C – A review of research on upper torso restraints in small aircraft

Overview

There have been many research studies into the utility of upper torso restraints on small aircraft. Based on these studies, many recommendations have been issued by government investigation agencies around the world. This appendix discusses many of these studies and recommendations.

In this report, the term ‘upper torso restraint’ (UTR) is used to refer to a shoulder harness or shoulder strap.

Research and recommendations in the United States up to 1980

In the United States, the Civil Aeronautics Board (CAB), responsible for investigating civil aircraft accidents prior to the formation of the National Transportation Safety Board (NTSB), noted there were 826 fatalities in general aviation accidents between January and October 1964. It estimated that about 200 of these fatalities could have been prevented if UTRs had been installed and used. Accordingly, it issued a recommendation to the Unites States’ Federal Aviation Authority (FAA) in 1964:

Shoulder harnesses for each occupant be required on all newly certified general aviation aircraft unless it can be demonstrated that the seatbelt alone will preclude the seat occupant from contacting injurious occupants within striking distance of the head.

The FAA replied at that time that it did not believe there was sufficient justification to revise existing regulations.

The NTSB subsequently issued a recommendation in 1970 (A-70-042), which stated in part:

Shoulder harnesses should be required on all general aviation aircraft at the earliest practical date…

The FAA subsequently issued a Notice of Proposed Rulemaking (NPRM) 73-1 regarding crashworthiness on small aeroplanes. As a result of the NPRM process, the FAA required the installation of UTRs in the front seats of small aeroplanes manufactured after 18 July 1978.

Dissatisfied with the FAA’s response to previous recommendations, the NTSB issued additional recommendations in 1977:

A-77-070: Amend 14 CFR 23.785 to require installation of approved shoulder harnesses at all seat locations as outlined in NPRM 73-1.

A-77-071: Amend 14 CFR 91.33 and .39 to require installation of approved shoulder harnesses on all general aviation aircraft manufactured before July 18, 1978, after a reasonable lead time, and at all seat locations as outlined in NPRM 73-1.

In 1980, the NTSB released a safety report that provided a summary of activities relating to improving the crashworthiness of general aviation aircraft.^[74] The report noted that FAA research and other studies since 1944 have shown that UTRs are an essential element to provide effective occupant restraint, even for minor crash forces. The report reviewed many of the research studies, recommendations and responses by the FAA in relation to UTRs. Its conclusions included:

General aviation aircraft are unnecessarily lethal in crash situations which should be survivable.

The majority of serious injuries and deaths in general aviation aircraft crashes result from insufficient occupant restraint systems and inadequate crashworthiness designs of cockpit and cabin interiors.

The installation and compulsory use of shoulder harnesses at each general aviation aircraft occupant seat would be one of the most effective means for markedly reducing the current serious injury and fatality rates.

FAA and industry studies indicate that most effective crashworthiness occupant protection features can be incorporated during aircraft design with little or no increase in manufacturing costs…

Generally, aircraft manufacturers are not voluntarily incorporating proven, effective, and necessary crashworthiness designs into their products…

Private automobile crashworthiness features have improved in comparison with general aviation aircraft, primarily because of government regulatory action…

As a result of the study, the NTSB issued additional recommendations to the FAA:

A-80-125: Require that those general aviation aircraft manufactured to include attachment points for shoulder harnesses at occupant seats be fitted with shoulder harness no later than December 31, 1985 and, in the interim, require this modification as a requisite for change in FAA registration.

A-80-126: Develop in coordination with airframe manufacturers, detailed, approved installation instructions for installing shoulder harnesses at each seat location in current models and types of general aircraft in which shoulder harness attachment points were not provided as standard equipment. Publish and provide there instructions to owners of these aircraft by December 31, 1982.

A-80-127: Require that those general aviation aircraft for which FAA-approved harness installation instructions have been developed be fitted with shoulder harnesses at each seat location no later than December 31, 1985, and, in the interim require this modification as a requisite for change in the FAA registration.

Most of the 1977 and 1980 recommendations were closed in 1986, following regulatory changes by the FAA to require that all small aeroplanes manufactured after 12 December 1986 were fitted with a UTR at each seat. The response by the FAA to recommendation A-77-071 was classified by the NTSB as ‘unacceptable action’.

Research and recommendations in the United States since 1981

In 1982, the FAA released a report^[75] examining crashworthiness aspects associated with 47 survivable or partly survivable accidents involving small aeroplanes during 1973–1979. The 47 accidents involved 138 occupants (including two lap-held children), with 47 pilots, 40 occupants of the copilot (front right) seat and 49 additional occupants. Results included:

• The greatest damage to the occupiable area of the aircraft was to the forward portion of the cockpit/cabin.
• Of the 57 occupants who had a UTR available, only 7 used the UTR, and the use of the restraint appeared to have lessened injuries.
• Of the 136 occupants, 121 or 88 per cent would have benefited from using a UTR. This included 91 per cent of the 87 front-seat occupants and 86 per cent of the 49 occupants in other seats.

In noting the benefits of a UTR, the report stated:

The value of restraining the upper torso cannot be overemphasized. For example, a seated passenger is restrained by a lapbelt and his/her upper torso may weigh as much as 120 lb [54 kg]. In an accident, the lapbelt holds the pelvis and acts as a fulcrum about which the upper torso rotates under the force of deceleration. If the deceleration is low, 2 G's, the upper torso will have an apparent weight of 240 lb 109 kg], so that the occupant can barely resist the forward thrust. At 10 G's, well within the survivability envelope, the apparent weight of the upper torso will be 1,200 lb [544 kg] and it will swing forward with great velocity, possibly hitting the head on the instrument panel and the chest against the control wheel. Based on the velocity of the upper torso and head and the stopping distance, a force of several hundred G's may be exerted on the skull or chest.

In 1985 the NTSB published a safety study examining crashworthiness in general aviation aircraft.^[76] The study examined 535 accidents involving small aircraft in 1982. The selected accidents included those where at least one occupant was fatally or seriously injured. The accidents were evaluated to determine the extent to which they were survivable, based on whether one occupant either survived or could have survived if shoulder harnesses or energy-absorbing seats were used. The data suggested that a survivable envelope was defined by impact speeds of 45 kt at 90º angle of impact, 60 kt at 45º angle of impact and 75 kt at 0º angle of impact.

The NTSB study estimated that 20 per cent of the 800 fatally-injured occupants would have had only serious injuries or minor injuries if they had been wearing a UTR. In addition, 88 per cent of 229 seriously-injured occupants would probably have had less severe head or upper body injuries, only minor injuries or no injuries if they had been wearing a UTR.

In addition, the study noted that there were five survivable accidents in which UTRs were worn by only one of two front-seat occupants. A comparison was made of the relative injuries of each occupant. It was found in each case that injury severity was less for the occupant who wore the UTR. The occupants who wore UTRs had markedly fewer head injuries.

Following the study, the NTSB issued a series of recommendations, including:

A-85-123: Amend 14 CFR Part 91 and Part 135 to require that all occupants of small airplanes use shoulder harnesses for takeoff and landing when they are available in the airplane.

A-85-124: Issue an Advisory Circular to provide pilots, passengers, and maintenance personnel with information regarding the crash survivability aspects of small airplanes. The Advisory Circular should contain, as a minimum, discussion of the benefits of using lap belts and shoulder harnesses during all phases of flight, discussion of the hazards of modifying seats, appendages to seats, and stowage of articles in space designed or available for energy management, and discussion of the need for regular inspection and maintenance of seats.

Recommendation A-85-124 was closed in 1986 (acceptable action), after the FAA prepared an advisory circular. The FAA issued Advisory Circular (AC) 21-34 (Shoulder harness – Safety belt installations) in 1993. The AC outlined the justification for installing a UTR, and provided guidance on factors to consider when installing a UTR.

In 1985, the NTSB also issued a related recommendation regarding UTRs in helicopters:

A-85-070: Amend 14 CFR Parts 27 and 29 to require that all helicopters manufactured after 12/31/1987 have shoulder harnesses installed at all seat locations.

This recommendation was closed (acceptable action) in 1993, following regulatory changes by the FAA to require that all helicopters manufactured after 16 September 1992 were fitted with a UTR at each seat.

The FAA published a study in 1989 that examined the role of seats in injury causation.^[77] The study reviewed 55 accidents involving small aeroplanes during 1981–1986, with the sample accidents involving sufficient energy to test seat performance and cause injury. The study concluded that seat damage by itself did little to define the seat’s role in injury causation. The study concluded that head trauma represented a major manifestation of life-threatening injuries. It also noted that the presence and use of UTRs ‘can improve the injury experience by reducing the likelihood of head trauma’.

A more recent study by the FAA examined fatal and serious injury accidents in Alaska during 2004-2009.^[78] There were 97 accidents involving small aeroplanes and helicopters, resulting in 113 fatalities and 75 serious injuries. The study examined many factors contributing to the accidents as well as post-crash survivability. The study concluded that up to 28 lives could have been saved with the use of UTRs, primarily in passenger seats. The study team developed a large number of suggested interventions, with the second priority intervention being to encourage UTR installation in all seats (with an emphasis on passenger seats).

Another study examined take-off and landing accidents in small aeroplanes involving an engine power loss during 1983–1992.^[79] It found that pilots wearing only a lap belt had a relative risk factor of a fatality of 1.7 compared with pilots wearing a seat belt and a UTR. That is, pilots wearing a lap belt only had a 70 per cent more chance of a fatal injury than if they were wearing a lap belt and UTR.

In 2011, the NTSB issued a report on a safety study about airbag performance in general aviation restraint systems.^[80] This report included an analysis of the effectiveness of UTRs in single-engine, non-amateur built aeroplanes. It compared the rate of fatal or serious injuries for pilots wearing lap belts only versus lap belts and UTRs for accidents during the period 1983–2008 (with the resulting sample size of 8,572 pilots). Pilots wearing only a lap belt had a risk ratio of 1.49 compared with pilots wearing a lap belt and shoulder harness (that is, a 49 per cent greater likelihood of a serious or fatal injury). The risk ratio was higher for take-off/landing accidents (1.95) than other types of accidents (1.24), and also higher for accidents that did not involve a loss of control (1.54) versus loss of control accidents (1.28).

Based on this analysis, the NTSB concluded that lap belt/UTR combinations provided significant protection beyond a lap belt alone, and fatalities and injuries would be reduced if lap belt/UTR combinations were used in all general aviation (GA) airplanes. The NTSB also issued another recommendation:

Require the retrofitting of shoulder harnesses on all general aviation airplanes that are not currently equipped with such restraints in accordance with Advisory Circular (AC) 21-34, issued June 4, 1993. (A-11-4)

In its responses, the FAA noted that thousands of aeroplanes manufactured before December 1986 did not have the structural provisions necessary for the installation of shoulder harnesses. It noted that it was working on an alternative solution involving a two-point inflatable lap belt. The NTSB responded that this would be an acceptable response to the recommendation, if the FAA required owners of all aircraft to either retrofit a UTR or a two-point inflatable lap belt for all seats. The FAA replied that the ‘economic burden levied on the GA fleet with such a mandate would outweigh any potential benefit’, and it was working on a framework to permit aeroplane owners to voluntarily replace lap belts with two-point inflatable restraints. In December 2016, the NTSB closed the recommendation, classifying the FAA response as ‘unacceptable action’.

Research and recommendations in Canada

In Canada, regulatory requirements for UTRs were less comprehensive than in the United States and Australia in the 1980s. In 1987, the Canadian Aviation Safety Board (CASB) conducted a study on UTRs. It concluded that pilots of small aircraft had the responsibility to assist passengers in the event of an accident, and therefore they should be properly restrained. The CASB therefore issued recommendation CASB 87-58 to the Department of Transport, requiring the installation of UTRs, where practicable, in the flight crew seats of all commercial aircraft, regardless of their date of manufacture.

The Canadian National Aeronautical Establishment conducted a literary review of research and development in crashworthiness of general aviation aircraft seats, restraints and floor structures with the results published in February 1990.^[81] The report concluded:

An effective way to increase occupant protection in G.A. [general aviation] aircraft in survivable crashes is the promotion of education for the usage and maintenance of currently installed seat and shoulder harnesses. Several studies have shown that the percentage of usage of installed shoulder harnesses is only about 40%. The installation of shoulder harnesses about (60% of G.A. aircraft seats do not have shoulder harnesses) would provide an immediate benefit. Retrofit work entails engineering design of attachment points for the many different models of G.A. aircraft in use. Retrofit kits are available for some G.A. aircraft.

In 1992, following an investigation into a fatal seaplane accident, the Transportation Safety Board (TSB) of Canada (which replaced the CASB in 1990) issued the following recommendation:

A92-01: The Department of Transport expedite legislation to require the use of a seat-belt and shoulder harness during take-off and landing of small, commercial fixed-wing aircraft.

In 1994, the TSB conducted an analysis of seaplane accidents that occurred during 1976–1990. During this period, there were 1,432 accidents with 452 fatalities.^[82] The aim of the study was to examine occupant survivability in seaplane accidents; therefore, the scope included 103 accidents where the aircraft terminated in the water. The study’s conclusions included:

Failure to successfully exit a sinking aircraft is common for persons who suffer a trauma sustained because of a lack of appropriate restraint at the time of the accident. Yet, few occupants of seaplanes involved in water-accidents had taken advantage of available upper-torso restraint. Even pilots, who are more aware of the importance of being adequately restrained during an accident, and who are responsible for assisting survivors to exit the stricken aircraft after an accident, were often not using the shoulder harnesses that were available...

Although the majority of fatal seaplane accidents in the water involve drowning, approximately one-tenth of these victims were incapacitated from non-fatal impact forces. The availability and use of personal restraint systems could have facilitated a successful egress for many of these victims…

The TSB issued another recommendation:

A94-08: The Department of Transport require the fitment of lap belts and shoulder harnesses in seaplanes and require their use by all pilots during take-offs and landings before the 1995 seaplane season begins.

After recommendation A94-08 was issued, Transport Canada made changes to regulatory requirements similar to those previously introduced in the United States, requiring UTRs in all front seats, and UTRs in all other seats of small aeroplanes manufactured after 12 December 1986.

Upon completion of these changes, the TSB classified the response to these recommendations as satisfactory.

The loss of control and collision with water of a De Havilland DHC-2 in May 2012 again highlighted the benefits of UTRs for passengers.^[83] At the time of the accident, there were no modifications or supplemental type certificate (STC) to incorporate UTRs into this particular aircraft type and therefore no UTRs had been fitted to the rear passenger seats. The rear-seat passenger’s head struck the pilot’s seat, rendering the passenger unconscious, which resulted in drowning.

The TSB noted that the intent of its previous recommendations was not restricted to aircraft manufactured after December 1986. Consequently, the TSB made the following recommendation:

A13-03: The Department of Transport require that all seaplanes in commercial service certificated for 9 or fewer passengers be fitted with seatbelts that include shoulder harnesses on all passenger seats.

Transport Canada’s responses to this recommendation indicated that the redesign and structural modification of these particular types of aircraft would not be feasible for operators. Therefore, it would continue to mitigate through promotion and education. The TSB noted that there were UTR kits available for many of the 600 aircraft referenced by the recommendation, and it was feasible to retrofit other applicable aircraft. Accordingly, the TSB has classified the Transport Canada response as Unsatisfactory (as of September 2018), with the recommendation remaining active pending further responses from Transport Canada.

Research and recommendations in Europe

In 2001, the United Kingdom (UK) Air Accident Investigation Branch (AAIB) published a report on an accident that occurred in 1999 involving a Cessna Titan 404 near Glasgow in 1999.^[84] The accident resulted in eight fatalities and three serious injuries. Most of the injuries were chest injuries, and there were also some head injuries. The report noted that there was ‘clear evidence that these injuries were compounded by the separation and collapse of the seats and by the limitations of the passenger seats, where only a lap strap was available’.

At that time, there was a requirement in the UK all aeroplanes with a maximum take-off weight (MTOW) not greater than 5,700 kg and nine passenger seats or less to have a UTR in each passenger seat. However, this only applied for aircraft that had a certificate of airworthiness first issued on or after 1 February 1989. There was no equivalent requirement in in the European Joint Aviation Requirements (JARs) at that time, except for newly manufactured aircraft as of 11 March 1994 to have UTRs for all seats.

As a result of the accident, the AAIB issued the following recommendation to the UK Civil Aviation Authority (CAA):

Recommendation 2001-40: The increased statistical risk in operating FAR/JAR part 23 aircraft, in comparison with the larger FAR/JAR Part 25 ‘Transport Airplanes’, is a strong incentive to incorporate at least some of upgraded seat requirements into existing light aircraft fleet, particularly for those types continuing production. For example, dynamic testing has shown the advantages of fitting upper torso restraints. Similarly, it is possible for seat attachment fittings to be strengthened without imposing a requirement that the FAR/JAR 23.562 injury criteria be demonstrated.

It is therefore recommended the CAA should undertake a study to identify those elements of the current JAR-23 seat standards which may be used for retrofit into existing aeroplanes whose maximum certificated take-off mass is less than 5,700kg. And, separately, for those designs in continuing production which are not covered by the current JAR standards. These elements should then be applied at least to those that are operated in the Transport Category (Passenger).

The CAA accepted the recommendation and conducted a study. The study noted that, in terms of all the potential seat requirements, only the retrospective application of UTRs was worth pursuing. The study conducted a review of accident statistics and other information and concluded:

Upper Torso Restraint systems are widely recognized as a safety enhancing feature which can reduce the number of fatalities following a survivable accident and reduce the number of seriously injured and severity of those injuries. This recognition is reflected in the airworthiness standards of FAR/JAR/CS 23, which now include UTR as a mandatory requirement within the basic design codes.

While these enhancements have benefitted passenger protection on new aeroplanes, the existing fleet is not immediately affected, and accidents continue to occur where passengers may have benefitted if UTR systems had been fitted…

In the UK, retroactive requirements are conditional on the date of first registration. The UKCAA has analysed UK accidents data and estimated the potential life savings that could be achieved by fitting UTR to passenger seats on light aeroplanes on the UK register… The UK-CAA has also estimated the associated costs with modifying the fleet with such additional UTR.

Based on the UK experience, together with similar US experience that led to publication of FAR Part 23 Amendment 23-32, and with the belief that this experience is likely to be applicable throughout Europe, the UK-CAA has concluded that there is sufficient justification to include in JAR-26 a requirement to mandate the provision of Upper Torso Restraint systems to all aeroplanes engaged in Commercial Air Transportation operations.

It is recommended that this proposal be considered by Central JAA for publication as an NPA, with a view to it being adopted within JAR-26.

In 2005 an accident involving a Pilatus Britten-Norman BN2B-26 Islander occurred. The aircraft was engaged in an air ambulance task with a pilot and paramedic on board. Both the pilot and paramedic passenger were fatally injured, but had survived the initial impact. The AAIB investigation report^[85] released in 2006 identified that the aircraft was fitted with UTRs; however, the lap straps were not compatible with the shoulder harness attachment points. Therefore, there was no shoulder harness available to the paramedic passenger, nor was there a requirement to have one fitted by the operator at the time. The AAIB concluded that the paramedic was probably rendered unconscious in the impact when his head hit the pilot’s seat due to the lack of a UTR. He subsequently drowned.

As a result of this accident, the AAIB released the following recommendation:

Safety Recommendation 2006-101: The European Aviation Safety Agency [EASA] and Joint Aviation Authorities should review the UK Civil Aviation Authority’s proposal to mandate the fitment of Upper Torso Restraints on all seats of existing Transport Category (Passenger) aeroplanes below 5,700 kg being operated for public transport, and consider creating regulation to implement the intent of the proposal.

In 2011, EASA implemented changes to address the recommendation, which it summarised as follows:

The EASA Opinion 04/2011 on air operations, published 01 June 2011, requires aeroplanes with a maximum certificated take-off mass of less than 5700kg and with a maximum seating configuration of less than 9, operated for Commercial Air Transport (CAT), to be fitted with a seat belt with upper torso restraint system for each passenger seat. If the maximum passenger seating configuration is 9 or more, a seat belt but no upper torso restraint system is required [refer to paragraph CAT.IDE.A.205(a)(3) and (4)].

An amendment to the regulation was made to include a requirement to have aeroplanes within this category have a UTR fitted at each passenger seat by 8 April 2015.

In 2015, following an operator survey and an Air Operations Standardisation meeting, EASA made changes to this requirement and related requirements for flight crew seat restraints due to concerns expressed by some parties about the ability to meet the requirements for some aircraft types. Consequently, the requirement for UTRs was changed to be only applicable to aircraft with an initial individual Certificate of Airworthiness first issued on or after 8 April 2015.

Research and recommendations in Australia

In addition to the accident on 10 January 2017 involving VH-WTQ, during the period 1998–2018, there have been at least three other investigations involving passenger transport flights in Australia in small aeroplanes where the absence of UTRs has been raised:

• Investigation 199802830, Cessna 185E Floatplane, VH-HTS, Calabash Bay, NSW, 26 July 1998. During a go-around into a confined area, the aircraft departed from controlled flight and collided with terrain. The pilot and four passengers were fatally injured. The Bureau of Air Safety Investigation (BASI) report found that the pilot and the front-seat passenger were not wearing available UTRs. The other seats were not fitted with UTRs. The BASI report also noted that the type and severity of injuries sustained suggested that, had adequate lap belt and UTRs been fitted and worn, those features would have aided survivability.
• Investigation 200002157, Piper PA31-350 Chieftain, VH-MZK, Spencer Gulf, South Australia, 31 May 2000. During a passenger flight from Adelaide to Whyalla, both engines of the aircraft malfunctioned. As a result, the pilot ditched the aircraft into the Spencer Gulf. The pilot and all seven passengers died, mostly due to drowning. The report noted that the pilot, who was wearing a UTR, had minor impact-related injuries, even though he was sitting in that part of the aircraft that suffered the most structural damage. However, the passengers who only had lap belts received comparatively more severe impact-related injuries. The ATSB concluded that the absence of UTRs and life jackets or floatation devices reduced the chances of survival of the occupants.
• Investigation 200105446, Cessna 210N, VH-LMX, 11 km east-south-east of Kalgoorlie, Western Australia, 14 November 2001. During a passenger transport flight, the engine lost power. During the forced landing, the pilot lost control and the aircraft impacted terrain. The pilot was fatally injured and the three passengers were seriously injured. The front left of the aircraft was exposed to the full force of the ground impact. The passengers received various injuries. The report noted that the upper body and head injuries sustained by the passengers was probably due to the upper torso flailing contact with interior structure and objects, and fitting UTRs to the passenger seats may have reduced the exposure to some of the serious injuries incurred.

Following the 1998 accident, BASI issued Recommendation R19980281 to the Civil Aviation Safety Authority (CASA) in March 1999. The recommendation stated:

The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority mandate the compliance of all manufacturers' service bulletins relating to the provision of upper body restraint to occupants of FAR part 23 certified aircraft engaged in fare-paying passenger operations, and emphasise compliance with their instructions on the correct use of the restraint systems.

Background information to the recommendation noted that:

An inspection of the Australian aircraft register revealed that the majority of light aircraft (FAR Part 23 certified) in Australia were manufactured prior to 12 December 1986. The major US aircraft manufacturers had ceased light aircraft production in the early to mid-1980s. Consequently, the protection afforded to passengers by the requirement for the provision of upper body restraint has not been extensively provided. Anecdotal evidence suggests that only a small percentage of these aircraft engaged in fare-paying passenger operations in this country meet the amended safety standard (FAR 23.2)…

On 4 September 1992, the Cessna Aircraft Company issued Single Engine Service Bulletin SEB92-28 "Seat belt and shoulder harness installation", which was applicable to all single-engine Cessna aeroplanes including the C185E…

An inspection of other US light aircraft manufacturers revealed the availability of similar installation kits…

General inquiries suggested that a small number of kits were imported at the time the service bulletins were issued. Most of these kits were installed in aircraft held at the time by distributors. Only a few aircraft owners wishing to provide greater protection for their passengers have since installed these kits…

By way of comparison, the requirement for upper body restraint (three-point harness) for rear-seat occupants in motor vehicles was introduced in accordance with Australian Design Rule (ADR) 5A. This was applicable to all new vehicles certified after 1 January 1971. A requirement for coaches greater than 5 tonnes to be fitted with upper body restraint for all occupants was introduced on 1 July 1994 by ADR 68/00.

As with many airworthiness directives, ADRs are not retrospectively applied. However, the much greater attrition rates for motor vehicles, compared to aircraft, means that compliance is achieved in a much shorter period…

Despite the availability of kits from most of the large manufacturers that enable aircraft owners to incorporate upper body restraint for all the passenger seats in many of the aircraft manufactured prior to the 12 December 1986, very few have been modified…

The provision of upper body restraint to all passengers in FAR part 23 aircraft has not been effective through the normal process of fleet attrition and replacement, as originally envisaged by the responsible regulatory authorities. Retrospective application was not mandated, for technical and economic reasons, even though manufacturers made available seat belt and harness installation kits for many of their previous models. Voluntary installation of kits by Certificate of Registration holders (aircraft owners) has not been widely adopted. This has resulted in the majority of the affected fare-paying passenger aircraft being operated without upper body restraint for all occupants, despite the safety enhancement that can be readily achieved by such modification.

CASA issued a Discussion Paper for a proposed regulatory change in 2001. In its assessment of the responses to the Discussion Paper, CASA noted:

Fifty-one responses to the Discussion Paper were received by CASA. Seventeen responses were clearly in favour of the proposal and 14 were clearly opposed. A common theme was that the cost of installation of shoulder harnesses in some aircraft would be significant. For example, at least one respondent advised that the cost to modify a Piper PA 31 aircraft in accordance with the Piper Service Bulletin would be approximately $100,000. Implementation in some aircraft would necessitate replacement of seats, and in some of those it is conceivable that floor strengthening would be required…

In view of the difficulty of estimating the true costs and benefits, CASA believes that proceeding with a comprehensive benefit-cost analysis is not warranted. In light of the significant costs CASA believes that action to mandate installation of shoulder harnesses in Australian aircraft carrying fare-paying passengers cannot be justified…

The installation and use of shoulder harnesses for all occupants in small aircraft will be strongly recommended to operators and the travelling public, and CASA will publicise the benefits of shoulder harnesses in this class of aircraft. This will be done in the expectation that the air-travelling public will become aware of the desirability of shoulder harnesses; and operators who can make this modification without threatening their economic viability will consider doing so.

The ATSB accepted CASA’s response and closed the recommendation. Its assessment of the CASA response stated:

While acknowledging the efforts of the Civil Aviation Safety Authority in responding to this recommendation, the Australian Transport Safety Bureau will continue to monitor occurrences involving occupant restraints.

In May 2019, the ATSB asked CASA about what guidance information it had provided operators and/or the travelling public either recommending the use of UTRs or advising of their benefits. CASA replied that, other than the Discussion Paper released in 2001, it could not identify any other guidance information it had provided.

As noted above, during the period 1998–2018, there were at least four accidents involving Australian passenger transport flights in small aeroplanes in Australia where the presence of UTRs in all passenger seats would have reduced the potential for fatal or serious injuries. The ATSB reviewed the other accidents in Australia during the 21 years between 1998–2018 that involved small aeroplanes being used for passenger transport operations to determine the extent to which UTRs were available in all passenger seats.

Overall, there were 20 accidents involving small aeroplanes with a seating capacity of three to 10 seats engaged in passenger transport operations that resulted in at least one serious or fatal injury. In these 20 accidents, almost all (18) of the aeroplanes were manufactured prior to December 1986, and therefore were not required to have UTRs fitted. For the 11-year period 1998–2011, all of the 13 aeroplanes involved were manufactured prior to December 1986. For the 10-year period 2009–2018, 5 of the 7 aeroplanes were manufactured prior to December 1986 and the other 2 were manufactured after December 1986.

The extent to which UTRs had been retrofitted to all seats in these aeroplanes was not noted in many of the investigation reports. However, where that information was available, it indicated that UTRs had not been retrofitted to all seats.

In addition to passenger transport flights, the ATSB has noted the benefits of UTRs in investigation reports into accidents involving aeroplanes which did not have UTRs fitted being used for other types of flights during 1998–2017 (for example, ATSB investigations AO-2014-068 and AO-2011-043). A review of a sample of other accidents in small aeroplanes during this period which resulted in fatal or serious injuries that involved small aeroplanes manufactured before December 1986 did not identify any aircraft that had been retrofitted with UTRs in all passenger seats.

The ATSB has also found that pilots or passengers in the front seats of small aeroplanes have not always worn the available UTRs, exacerbating the severity of their injuries in many accidents (for example, ATSB investigations 199800442, 200605133, AO-2010-053, AO-2012-083, AO‑2012‑142 and AO-2016-074).

The ATSB has also noted the benefits of UTRs in another investigation where a Gippsland Aeronautics GA-8 Airvan aircraft (manufactured in 2005) being used for a passenger charter flight was fitted with UTRs, which contributed to the passengers’ survival, with no serious injuries experienced (ATSB investigation AO-2010-080).

__________

57. Some but not all of the flights on 12 November 2016 were also recorded. Given that this day’s data was incomplete, it was not included in this analysis.
58. In general, a pilot’s documented flight time will be slightly larger than an aircraft’s recorded flight hours as pilot hours generally include taxi time.
59. The only exception to the flights from Agnes Water to a beach ALA in the GPS data occurred on 4 January 2017 and involved a 29-minute flight that departed from Agnes Water and returned to Agnes Water. This flight appeared to be included in the pilot’s logbook figures in addition to the other flights that day.
60. The estimate was made by taking the time from the first data point with a groundspeed higher than 50 km/h (27 kt) to the data point prior to when the groundspeed decreased below 50 km/h. A small number of discrepancies were identified and corrected where the aircraft was taxied with a recorded groundspeed above 50 km/h. The groundspeeds at each data point were based on the distance between the data point and the previous data point divided by the time interval.
61. The same pattern also existed from June to November 2016, but daily flights times had a wider range of values before June 2016. The only exceptions to the use of daily flight time figures in increments of 0.25 hours from November 2016 occurred on 2 January 2017 (0.6 hours) and 4 January 2017 (1.1 hours). The 2 January flights included 4 standard flights and 3 short flights between beach ALAs, with a total flight time of 0.7 hours (based on GPS data). The 4 January included 4 standard flights and 1 long scenic flight, with a total flight time of 1.1 hours (based on GPS data).
62. There were also multiple days in October and November 2016 (prior to 14 November) where there was flight time in VH-WTQ documented in the pilot’s logbook but no flight time documented on the maintenance release.
63. The aircraft had two hour meters. The figures discussed in this appendix were displayed on the Omron meter. The other hour meter displayed a figure at the time of the accident (5,452.2 hours) that did not match any of the documented hour meter readings.
64. CAO 100.5 (General requirements in respect of maintenance for all Australian aircraft) defined ‘time-in-service’ for an aircraft as ‘the time from when the aircraft leaves the ground on a flight until it touches the ground for the purpose of landing at the end of the flight’.
65. A maintenance release includes columns to record each daily flight time and a progressive total of the aircraft’s total time in service at the end of each day on which flying was conducted.
66. In the small number of cases where the maintenance release time exceeded the pilot logbook time, the flight hour figures were relatively large. This may have been due to multiple pilots flying the aircraft on those days.
67. This resulted in an underestimation figure of 19.5 per cent from 12 November 2015 to 12 November 2016, slightly less than the 20.4 per cent overall for the period from 12 November 2015 to the accident flight.
68. Secondary surveillance radar relies on an aircraft’s operational transponder transmitting a data signal in response to being interrogated by an air traffic service radar or another receiver (for example, another aircraft’s Traffic Alert and Collision Avoidance System). The amount of information transmitted in the data signal is dependent on the type of transponder in the aircraft. This can range from the aircraft’s altitude (Mode C) to the identification of the flight and the pilot selected cruising level (Mode S).
69. Part of the difference is probably because the recorded data for both sources were recorded with a resolution of 1 second, so data points could be up to 0.5 seconds apart, or about 32 m at 125 kt.
70. ‘QNH’ refers to the altimeter barometric pressure subscale setting used to indicate the height above mean seal level. Transponder altitude data is based on a standard QNH of 1,013.2 hPa, which was very slightly below the QNH measured at a nearby town (Seventeen Seventy) at 0900 (1,013.4 hPa). This would result in the transponder altitude reading about 6 ft too low. The ATSB corrected the transponder altitude for this analysis.
71. Photogrammetry: analysis of photographic images to obtain measurement data.
72. Heights of terrain features were obtained from both Google Earth and topographic maps downloaded from the Queensland Globe web site (qldglobe.information.qld.gov.au). The estimated height of trees on the ridge was included.
73. If the QNH setting on the aircraft is 1 hPA higher than the actual QNH, the altimeter will over read by about 30 ft.
74. National Transportation Safety Board 1980, The status of general aviation aircraft crashworthiness, Safety Report NTSB/SR-80/02.
75. Kirkham, WR Wicks, SM & Lowrey, DL 1982, Crashworthiness studies: Cabin, seat, restraint, and injury findings in selected general aviation accidents, Federal Aviation Administration Technical Report FAA-AN-82-7.
76. National Transportation Safety Board 2005, General aviation crashworthiness project: Phase two – Impact severity and potential injury prevention in general aviation accidents, Safety Report NTSB/SR-85/01.
77. Colangelo EJ & Russell JC 1989, Injuries to seat occupants of light airplanes, US Department of Transportation Technical Report DOT/FAA/AM-89/3.
78. Federal Aviation Administration, Aviation Safety Alaskan Region 2010, Fatal and serious injury accidents in Alaska: A retrospective of the years 2004 through 2009 with special emphasis on post crash survival.
79. Rostykus PC, Cummings P & Mueller BA 1998, ‘Risk factors for pilot fatalities in general aviation airplane crash landings’, Journal of the American Medical Association, vol. 280, pp.997-999.
80. National Transportation Safety Board 2011, Airbag performance in general aviation restraint systems, Safety Study NTSB/SS-11/01.
81. Huculak P 1990, A review of research and development in crashworthiness of general aviation aircraft: Seats, restraints and floor structures, National Aeronautical Establishment, Aeronautical Note NAE-AN-64.
82. Transportation Safety Board of Canada 1994, A safety study of survivability in seaplane accidents, Report number SA9401.
83. Transportation Safety Board of Canada, Loss of control and collision with water: Cochrane Air Service De Havilland DHC-2 MK.1, C-FGBF, Lillabelle Lake, Ontario, 25 May 2012, Aviation Investigation Report A12O0071.
84. Air Accidents Investigation Branch 2006, Report on the accident to Cessna 404 Titan, G-ILGW, Near Glasgow Airport on 3 September 1999, Aircraft Accident Report 2/2001.
85. Air Accidents Investigation Branch 2006, Report on the accident to Pilatus Britten-Norman BN2B-26 Islander, GBOMG, West-north-west of Campbeltown Airport, Scotland on 15 March 2005, Aircraft Accident Report 2/2006.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.