Collision with water involving a de Havilland Canada DHC-2 Beaver aircraft, VH‑NOO, at Jerusalem Bay, Hawkesbury River, New South Wales, on 31 December 2017

Flight from Rose Bay to Cottage Point

On 31 December 2017, at about 1045 Eastern Daylight-saving Time,^[1] five passengers arrived via water‑taxi at the Sydney Seaplanes terminal, Rose Bay, New South Wales (NSW) for a charter fly‑and‑dine experience to a restaurant at Cottage Point on the Hawkesbury River. Cottage Point is about 26 km north of Sydney Harbour in the Ku‑ring-gai Chase National Park, a 20 minute floatplane flight from Rose Bay. At about 1130, prior to boarding the aircraft, the passengers received a pre-flight safety briefing.

At about 1135, the pilot and five passengers departed the Rose Bay terminal for the flight to Cottage Point via the northern beaches coastal route, in a de Havilland Canada DHC-2 Beaver floatplane, registered VH-NOO and operated by Sydney Seaplanes. The flight arrived at Cottage Point just before midday and the passengers disembarked. The pilot then conducted another four flights in VH-NOO between Cottage Point and Rose Bay.

Taxi at Cottage Point prior to accident flight

The pilot arrived at Cottage Point at about 1353. After securing the aircraft at the pontoon and disembarking passengers from that flight, the pilot walked to a kiosk at Cottage Point for a drink and food. At about 1415, the pilot received a phone call from the operator via the kiosk, asking the pilot to move the aircraft off the pontoon, which could only accommodate one aircraft at a time. This was to allow the pilot of the operator’s other DHC-2 aircraft (VH-AAM) to pick-up other restaurant passengers. The pilot of VH-NOO immediately returned to the aircraft and taxied away from the pontoon into Cowan Creek. The operator’s records indicated that VH-AAM arrived at the pontoon and shut down the engine at about 1419, and subsequently departed at about 1446. The pilot of VH-NOO returned to the pontoon after having taxied in Cowan Creek with the engine running for up to 27 minutes, while waiting for the other aircraft. During the taxi, closed‑circuit television footage from a private residence at Cottage Point showed VH-NOO at 1444, with the pilot’s door ajar.

After shutting down the aircraft, the pilot briefly went into the restaurant^[2] to see if the passengers were ready to leave, and then returned to the aircraft.

Return flight to Rose Bay

The return flight to Rose Bay, scheduled to depart at 1500, provided sufficient time for the passengers to meet a previously booked water-taxi to transport them from Rose Bay to their hotel at 1545.

At about 1457, the passengers commenced boarding the aircraft and at around 1504, the aircraft had commenced taxiing toward the designated take-off area in Cowan Creek. At about 1511, the aircraft took off towards the north-north-east in Cowan Creek, becoming airborne shortly before passing Cowan Point (Figure 1).

Figure 1: Photographs taken by the passenger in the front right seat through the front windscreen while taxiing to the designated take-off area (left) and shortly after take-off (right)

Note: Images from passenger camera captured at 1504:39 (left) and 1511:45 (right).

Source: Passenger camera, annotated by the ATSB

The aircraft climbed straight ahead before commencing a right turn into Cowan Water. A witness, who was travelling east in a boat on the northern side of Cowan Water, photographed the aircraft passing over a location known as ‘Hole in the wall’ (Figure 2). These photographs indicated that the aircraft was turning to the right with a bank angle of 15-20°. Witnesses observed the right turn continue above Little Shark Rock Point and Cowan Water (Figure 3).

Figure 2: Witness photographs showing the aircraft turning near the Hole in the wall

Source: Images provided by witness captured at about 1512:08, annotated by the ATSB

The last photograph taken by the passenger was when the aircraft was heading in a southerly direction towards Cowan Bay (Figure 3). At that time, the aircraft was estimated to be at an altitude of about 30 m (98 ft).^[3]

Figure 3: Cottage Point area and approximate initial flight path

Source: ATSB

Shortly after the turn in Cowan Water, several witnesses observed the aircraft heading directly towards and entering Jerusalem Bay flying level or slightly descending, below the height of the surrounding terrain (Figure 3 and Figure 4). Witnesses also reported hearing the aircraft’s engine and stated that the sound was constant and appeared normal.

About 1.1 km after entering Jerusalem Bay, near the entrance to Pinta Bay, multiple witnesses reported seeing the aircraft flying along the southern shoreline before it suddenly entered a steep right turn^[4] at low-level. Part-way through the turn, the aircraft’s nose suddenly dropped before the aircraft collided with the water, about 95 m from the northern shore and 1.2 km from the end of Jerusalem Bay (Figure 4). The aircraft came to rest inverted and with the cabin submerged. A number of people on watercraft who heard or observed the impact, responded to render assistance. Those people could not access the (underwater) aircraft cabin. The entire tail section and parts of both floats were initially above the waterline, but about 10 minutes later had completely submerged. The pilot and five passengers received fatal injuries.

Figure 4: Approximate flight path in Jerusalem Bay

Source: ATSB

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. In Australia, restaurants are legislated as non-smoking areas. In addition, the restaurant was well ventilated with the full height doors to the deck overlooking Cowan Creek, which, as seen in passenger photographs, were open at this time.
3. See analysis of the photographs taken by the passenger in the front right seat in the section titled Passenger camera. .
4. A steep turn is one greater than a 45° bank angle. Witnesses estimated the bank angle to be 80° 90°.

Pilot information

The pilot’s logbook combined with the operator’s records showed a total flying experience of about 10,762 hours up until 30 December 2017. In the previous 90 and 30 days, the pilot had flown about 147 and 61 hours respectively. In the 72 hours before the day of the accident, he had flown 8.7 hours, all of which were in the Cessna 208 (amphibian). On 31 December, prior to the accident flight, he had flown about 2 hours,^[5] all in VH-NOO (Table 1).

Pilot’s licence

The pilot commenced flying in Canada in 1997 and obtained his Canadian Commercial Pilot (Aeroplane) Licence in 1998. He also attained his multi-engine rating in 1998, floatplane endorsement and instrument ratings in 1999, and later his Air Transport Pilot (Aeroplane) Licence.

On 4 May 2012, the Civil Aviation Safety Authority (CASA) first issued the pilot with an Australian Commercial Pilot (Aeroplane) Licence. On return to Australia after working as a pilot overseas for about 3 years, CASA reissued the pilot with the licence on 21 March 2017, following a flight review and proficiency check. The pilot held the following ratings and endorsements:

• single and multi-engine aeroplane class ratings
• floatplane, manual propeller pitch control, gas turbine engine, and retractable undercarriage design feature endorsements
• multi‑engine instrument rating.

The pilot’s current CASA licence, found in the wreckage, was annotated indicating that he had conducted a single-engine aeroplane flight review on 29 June 2017, which was valid to 30 June 2019. The pilot held the appropriate licence, endorsements and ratings to conduct the flight.

The pilot held an Australian Class 1 Aviation Medical Certificate valid until 6 March 2018 and he was reported to have a high standard of health and fitness (refer to section titled Medical and pathological information).

At the time of the accident, the pilot also held valid Canadian and Republic of Maldives Airline Transport Pilot (Aeroplane) Licences.

Floatplane experience

The pilot’s logbook showed that the majority of his flying experience, at least 9,000 hours, was on floatplanes. He had experience on a number of float-equipped aircraft including the Cessna 172, 182, 185, 206 and 208, and the de Havilland Canada DHC-2 and DHC‑6. A summary of the pilot’s floatplane experience is below.

• From 2000 to 2002, commenced flying the Cessna 185 in Canada on a regular basis and conducted two flights in the DHC-2.
• In 2003, regularly flew the Cessna 206.
• Late-2004 to mid-2005, copilot on the DHC-6 in the Republic of Maldives.
• In 2007, returned to Canada flying the DHC-2 and Cessna 182. This included flying over high terrain, and operating to and from alpine lakes.
• From December 2011 to April 2014, with Sydney Seaplanes flying DHC-2 aircraft. The pilot accrued about 447 hours on VH-NOO and 351 hours on VH-AAM (the operator’s other DHC‑2).
• From mid-2014 to 2017, copilot and captain on the DHC-6 in the Republic of Maldives.
• In May 2017, recommenced with Sydney Seaplanes, accruing about 88 hours on VH‑NOO, 24 hours on VH-AAM, and about 269 hours on the Cessna 208 amphibious aircraft by the date of the accident (31 December 2017).

Training and checking

The operator was not required by the regulations to provide a training and checking organisation. However, after the cessation of their regular public transport service between Rose Bay and Newcastle, they maintained this approval and subsequently re-applied when it expired in October 2017. As a result, the operator’s training and checking regime included annual and biannual checks. The operator’s records indicated that, on his return to Australia in May 2017, the pilot successfully completed training and checks on the DHC-2 and Cessna 208 amphibious aircraft.

The operator’s records of checks conducted showed the pilot had completed the following.

Training and checks

• Pilot induction training, which included a theory and flight component.
• Engineering, data and performance questionnaires for each aircraft type, which assessed his knowledge of each aircraft, including the amphibious aspects of the Cessna 208.
• Operator proficiency check flight to a number of locations, including Cottage Point. The flight included emergency actions such as simulated engine failures after take-off and during cruise. The pilot was rated highly.
• Authorised landing area (ALA) authorisation check for various locations, including Cottage Point. This check assessed the pilot’s preparation for the flight; route knowledge; consideration for wires, water depths/channels, tidal effects; and awareness of en route facilities such as communications and emergency services. The check indicated a high standard of proficiency.
• Low-level manoeuvring proficiency check where the pilot was assessed as being at a high standard. This included:
  • level steep turns in cruise configuration
  • climbing steep turns in take-off configuration
  • descending steep turns in landing configuration
  • missed approach and go-around
  • stall^[7] and recovery in approach configuration
  • manoeuvring at low-level after take-off and before landing.
• Non-technical skills training in communication, situational awareness, decision making and workload management.
• Civil Aviation Order 20.11 emergency procedures training on both the DHC-2 and Cessna 208.

Additional training

The pilot had completed a flight crew dangerous goods and non-dangerous goods course, engine compressor/turbine water wash course, fuel barge training, and a CASA alcohol and other drugs ‘managing risk’ training module. In addition, the pilot completed human factors flight operations refresher training in October 2017, which included subjects on information acquisition and processing; decision making; health, fatigue and stress; and operator incidents.

Carbon monoxide awareness

The CASA syllabus and standards for the obtainment of a Private Pilot (Aeroplane) Licence and Commercial Pilot (Aeroplane) Licence have long included the requirement for pilots to be aware of 'the sources, symptoms, effects and treatment of carbon monoxide poisoning'. Similarly, this was also a requirement by Transport Canada. Therefore, it was very likely that the pilot would have been aware of this hazard.

Cottage Point flight experience

According to the operator’s estimates, the pilot had significant experience operating at Cottage Point, having conducted at least 780 return flights there. The majority of these flights were in the DHC-2 aircraft. As such, the pilot was likely very familiar with the area and the routes between Cottage Point and Rose Bay.

On the day of the accident, the pilot had conducted seven flights in VH-NOO. This comprised two scenic flights over Sydney and five flights between Rose Bay and Cottage Point including one positioning flight without passengers (Table 1).

Table 1: Pilot's prior flights in VH-NOO on 31 December 2017

Departure time	Departure location	Route/destination	Flight time (minutes)	Persons on board
1000	Rose Bay	Sydney North	30	7
1100	Rose Bay	Sydney Highlights	15	7
1130	Rose Bay	Cottage Point	15	6
1200	Cottage Point	Rose Bay	15	3
1230	Rose Bay	Cottage Point	15	3
1300	Cottage Point	Rose Bay	15	1
1330	Rose Bay	Cottage Point	15	5

Source: Sydney Seaplanes

Operator observations of pilot’s approach to safety

The operator’s Chief Pilot stated that the pilot had good aircraft handling skills and was conservative with his decision-making. A previous Chief Pilot for the operator also indicated that, while he had not flown with the pilot, he was a reliable, steady operator who did not take risks, and had a very strong attitude to safety. The pilot was described by his work colleagues as being:

• very diligent and methodical
• very meticulous, always correcting small things
• a safe pilot who had all the experience behind him; he had no issues with grounding an aircraft and was safety ‘conscientious’.

72-hour history

The pilot’s specific personal routine in the 3 days prior to the accident was unknown as he lived in shared accommodation. However, a friend of the pilot reported that the pilot’s daily routine was regimented and consistent. The pilot exercised regularly, ate healthily, and would usually go to bed around 2100 on a work night. The friend further indicated that the pilot’s work schedule generally commenced between 0700 and 0800, and finished between 1700 and 1800. The pilot also attended the gym every 2-3 days.

Between 24 and 27 December, the pilot was rostered off work, but on the 27th he volunteered to fly to Proserpine, Queensland to pick up parts for the damaged Cessna 208 (refer to section titled Previous incident). He then flew in the 3 days leading up to the accident. His roster indicated that he had been on duty between 0800 and 1530 on 28 December, 0800 and 1330 on 29 December, and 1330 and 1830 on 30 December.

At about 0630 on the morning of the accident, the pilot phoned a long-term friend in Canada, whom he spoke to regularly. The friend reported that the conversation was normal and positive, and the pilot talked about his future personal and career plans.

On 31 December, the pilot was rostered for duty from 0900 to 1700, with his first flight scheduled for 1000. Work colleagues and persons at the Cottage Point restaurant and kiosk who conversed with the pilot prior to the accident flight and throughout the day reported that he appeared normal, up-beat and happy. This was consistent with comments received from passengers who flew with the pilot earlier and from photographs taken of the pilot throughout the day. The pilot was scheduled for another return flight to Cottage Point following the accident flight. That flight was scheduled to depart Cottage Point at 1600.

Previous incident

On the afternoon of 23 December 2017, the accident pilot was landing an amphibious Cessna 208 at Rose Bay when the aircraft encountered unexpected boat wake. The aircraft momentarily became airborne before impacting the water in a nose-low attitude. There were nil injuries, but the aircraft sustained damage to the landing gear and floats, rendering it unserviceable.

The operator’s internal review found that the incident was the result of ‘bad luck’. The area was busy with boat traffic, which limited the landing opportunities, and the choppy water conditions made it difficult to detect boat wake. While the incident was considered beyond the control of the pilot, a line check was conducted with the chief pilot on 28 December 2017. The Chief Pilot stated that the pilot operated and managed the flight to a high standard and complied with the relevant standard operating procedures and approved him for a return to line flying. In addition, the operator distributed an email to all staff detailing the incident and providing additional guidance on operating in rough water conditions with significant boat traffic.

When discussing the incident with the operator, the pilot expressed disappointment and regret regarding the event and the associated damage sustained to the aircraft. However, the operator reported that they had emphasised to the pilot that the event could have occurred to any of their pilots and that there would not be any consequences. Further, the chief pilot and other company pilots all indicated that the incident did not appear to adversely affect the pilot. Similarly, the pilot's long-term friend, with whom he spoke to on the morning of the accident, also stated that they had discussed the incident, and he did not believe that the pilot was concerned.

While there was some increase in the pressures for the operator having one aircraft out of service during the busiest time of the year, they managed this by re-scheduling, cancelling or moving passengers to other aircraft. They also had additional flights on their other C208 with ‘split’ shifts, having one pilot fly the aircraft in the morning and another in the afternoon. There was no evidence to indicate that this placed additional pressures on the pilot, or that it otherwise influenced the accident.

When interviewing the operator following the accident involving VH-NOO, they advised the ATSB about the above incident. It was established they had not initially reported the incident to the ATSB due to a misunderstanding in the reporting requirements for this particular event but recognised in hindsight that it should have been notified. However, it had been immediately reported to CASA. The ATSB noted that the reporting requirements, as detailed in the Transport Safety Investigation Regulations 2003, were included in their operations manual. Further, the operator had notified the ATSB of an event that occurred in 2019.

Aircraft information

General

VH-NOO was a float-equipped de Havilland DHC-2 Beaver, a predominantly all-metal high-wing aircraft manufactured in 1963 and first registered in Australia in 1964 (Figure 5). The DHC-2 was originally designed and manufactured by de Havilland Canada, but Viking Air Ltd has been the type certificate holder since 2006.The aircraft was powered by a Pratt & Whitney ‘Wasp Junior’ R-985 nine‑cylinder, single‑row, air‑cooled radial engine, which drove a Hartzell HC‑B3R30-4B three‑blade propeller.

Figure 5: de Havilland Canada DHC-2 Beaver floatplane, registered VH-NOO

Source: Sydney Seaplanes

The DHC-2 was designed and certified to carry one pilot and seven passengers in a three-row configuration. The front row seats were fitted with lap-sash seatbelts, where the lap portion attached to the seats and the shoulder (sash) belts attached to the aircraft structure through an inertia reel. The middle and rear seats were fitted with lap only seatbelts. The three lap belts on the middle row bench seat attached to the seat structure while the rear bench-seat lap belts attached to the aircraft floor structure.

The original undercarriage was removed and EDO model 679-4930 floats, auxiliary vertical fins and a water rudder steering system were fitted to the aircraft in 1999.

Ventilation to the VH-NOO cabin was via circular snap vents in both front fixed side windows, and by opening the pilot and front right sliding windows. The window position was secured by a friction lock mechanism. Two vents were installed in the rear cabin roof above the passenger seats (Figure 6). The aircraft was not fitted with ventilation louvres in the roof at the front of the cabin, which, according to Airag Aviation Services were standard fitment on DHC-2 aircraft. The aircraft did not have a cabin heating system.

Figure 6: VH-NOO cabin ventilation

Source: Sydney Seaplanes, annotated by the ATSB

Maintenance history

General maintenance

Apart from daily inspections, all maintenance was conducted by an external CASA approved maintenance organisation, Airag Aviation Services. The aircraft’s logbook statement indicated that it was maintained in accordance with the operator’s system of maintenance, approved by CASA. This program consisted of daily inspections; engine, airframe and float checks every 50 hours (‘A check’); engine and airframe ‘periodic’ inspections every 100 hours or 6 months (‘B check’); numerous other specialised inspections; and the requirement to comply with the appropriate airworthiness directives and Civil Aviation Orders.

A periodic inspection (100-hourly) of the aircraft was completed on 6 November 2017 and certified by a licensed aircraft maintenance engineer. At that time, other inspections and rectifications were carried out. To allow access for this work, the rudder, elevators and horizontal stabiliser were removed and subsequently refitted. A scheduled engine change was also carried out at this time and the corresponding inspection/s were certified by a licensed aircraft maintenance engineer. The replacement engine had been previously fitted to VH-AAM.

While fitted to VH-AAM, and with about 95 hours time‑in‑service since it was last overhauled, metal contamination was detected in the engine. The engine was disassembled, inspected and reassembled by an Federal Aviation Administration approved repair station in the United States (US) with nil defects evident. The repair station advised that insufficient cleaning of the engine at the last overhaul may have been the reason for the suspected metal contamination. The engine was test run satisfactorily before being returned and fitted to VH-NOO.

The current maintenance release was issued on 9 November 2017 at 21,786.6 hours total time‑in‑service.

On 11 December 2017, an ‘A Check’ was carried out and certified by a licensed aircraft maintenance engineer.at 21,835.9 hours total time-in-service. This check, conducted on the water, involved inspections of the engine including an oil change, airframe, floats and their associated components. Two minor additional maintenance items were carried out at this time, consisting of minor propeller leading edge repairs and rectification of a leak in the engine fuel primer system. The associated maintenance worksheets did not identify any further defects. At the time of the accident, the aircraft had flown 85.9 hours since the engine change and had a total time‑in‑service of 21,872.5 hours.

Engine exhaust system inspections

The DHC-2 engine exhaust system (collector ring) consisted of seven segments, each of which connected to the cylinder exhaust port on the engine by an integral elbow and flange. The segments terminated in a ‘Y’ piece, which connected to the exhaust ports of cylinders number 4 and 5, and to the exhaust tailpipe (Figure 7). Exhaust gases were expelled through this tailpipe on the lower, right side of the engine bay.

Each of the segments were joined using connecting sleeves (slip joints). These were a friction-fit join, which permit individual segment maintenance. They were designed to expand with heat when the exhaust system reaches operating temperature, effectively sealing the joints. A licensed aircraft maintenance engineer (LAME) from the maintenance organisation reported that the slip joints were generally not completely sealed.

Figure 7: DHC-2 exhaust collector ring

Source: Viking Air, annotated by the ATSB

The exhaust system for the DHC-2 was an ‘on-condition’ component and therefore its time‑in‑service was not tracked. The maintenance schedule for the aircraft required a periodic inspection of the entire exhaust system at the ‘B’ check or every 12 months. In addition to this, a scheduled inspection of the exhaust collector ring segments under the carburettor heater muff (cylinders number 6, 7, 8 and 9) was required under a CASA airworthiness directive (AD/DHC‑2/33) every 150 flight hours. According to the DHC-2 maintenance manual, minor cracks in the segments could be repaired by welding. However, if further cracking developed from these repair welds, the segment was to be replaced. It was also recommended that, if major breaks, cracks other than minor, or burning was detected, the segment should be replaced, and no attempt should be made to carry out the repair.

The maintenance organisation advised that this inspection was performed at every 100‑hourly, in conjunction with the ‘B’ check. The aircraft’s maintenance records indicated that this inspection was certified completed in November 2017 as part of the engine change. This included certification for:

• an overhaul of the exhaust system and heater muff assembly (as stated in the engine build‑up worksheets), which the maintenance organisation advised consisted of a thorough inspection
• fitment of new exhaust flange gaskets
• fitment of new exhaust ring and heater muff assembly locknuts.

The records did not indicate that any cracks had been identified, or repairs to the exhaust system were performed at that time. However, it was noted that the ‘Y’ section was replaced in June 2015, with one from another aircraft (history unknown).

Engine firewall and inspection

The firewall is a fireproof wall between the engine/accessory bay and aircraft cabin. The aircraft was fitted with both a main firewall between the accessory bay and cabin, and then an accessory firewall between the accessory and engine bays. The main firewall was fitted with two panels, to allow easy access to the magnetos from within the cabin under the instrument panel (Figure 8).  This provided for adjustment and/or maintenance of the magnetos with the engine installed. A gasket was bonded to each panel, and the panel was to be secured to the main firewall using four hex-head AN3-3A^[7] (AN3) bolts (as specified by Viking Air) into a self-locking metal nut plate. There was no requirement by the manufacturer for the bolts to be torqued to a specific value and therefore, they were to be assembled as per standard airframe practice using proper judgment to avoid a collapsed fitting, but to ensure a tight joint.

An inspection of the main firewall for cracks and structural damage was required to be completed at the ‘B’ check. The maintenance records indicated that this was completed in November 2017. The access panels may have been used during the engine change. However, the LAME reported that the magnetos were already fitted to the engine prior to it being re-installed. Also, there was no indication that the magnetos were adjusted at that time or up to the time of the accident. Further, the maintenance organisation reported that the panels were generally only used for magneto maintenance rather than during an engine change.

It was noted that the left magneto was replaced in April 2017 and the right magneto was replaced in November 2016. The LAME indicated that the left magneto panel disturbance was on 8-9 June 2017 as a report of rough running engine attributed to a left magneto issue. The LAME also commented that the magnetos were not always inspected at a ‘B’ check, unless an issue was reported by one of the operator’s pilots. Sydney Seaplanes reported that all magneto maintenance was performed by the maintenance organisation, Airag Aviation Services.

On 28 September 2020, in response to the draft report, Airag Aviation Services indicated that there were other openings in the main firewall including those for mechanical engine controls. The ATSB noted that the openings for mechanical controls in the main firewall used a fire seal to minimise gaps and prevent the ingress of gases into the cabin.

Figure 8 shows the location of the magneto access panels in an exposed main firewall and is not representative of a main firewall in use.

Figure 8: DHC-2 main firewall with magneto access panels removed

Source: Sydney Seaplanes, annotated by the ATSB

Carbon monoxide detector

While not required, the aircraft was fitted with a disposable carbon monoxide (CO) chemical spot detector (refer to section titled Carbon monoxide information). The detector was affixed to the instrument panel, to the left of the pilot, and below the suction gauge (Figure 9).

The detector had a shelf-life of 3 years when unopened, but once removed from its packaging it had a useful life of 12 months. The detector fitted to the aircraft had a use-by date of 1 April 2018, written on the reverse side of the card.

Figure 9: Carbon monoxide detector fitted to VH-NOO

Source: Previous passenger

The operator advised that their usual practice was to annotate the installation date on the face of the detector in permanent ink, in the space provided (‘date opened’). They further advised that this date was their reference to determine the detectors serviceability and they replaced them as recommended by the manufacturer, during a scheduled maintenance event before the 1-year expiry date. However, no other records of fitment or monitoring of the detector was used by the operator.  

Previous accident

On 15 November 1996, the aircraft was involved in a fatal accident.^[8] At that time, the aircraft was registered as VH-IDI and configured for aerial agriculture operations including a fixed undercarriage for land-based operations.

The aircraft was rebuilt in 1999, during which the floats were fitted, converting it from a landplane to a floatplane. A Certificate of Airworthiness was issued and the aircraft re-entered service in December 1999, initially as VH-IDI and then registered as VH-NOO, in February 2000. Sydney Seaplanes acquired the aircraft in 2006. There was nothing to indicate the previous accident or the rebuild of this airframe 18 years prior had any connection with this accident.

Aircraft system controls

The location of the key aircraft system controls in VH-NOO are detailed below (Figure 10).

• Engine controls: The propeller (left), throttle (middle) and mixture levers (right) were located in the engine control quadrant on the top of the pedestal. A friction control lock was located below each lever.
• Flight control system: The flight control system on the DHC-2 is conventionally operated by a control column and rudder pedals. VH-NOO was fitted with a single control column and dual rudder controls. The upper portion of the control column, including the hand wheel, could be positioned in front of either the balance of the aircraft e left (pilot) seat, or ‘thrown-over’ for use by a copilot in the right seat. This could be done during level cruising flight without disturbing the balance of the aircraft by unlatching the throw-over lock, which held it in position, and rotating the top portion of the control column from left to right. Rudder pedals were placed in front of the left and right forward seats, the left side having ‘toe pedals’ on the top for brake application (no longer required after float conversion) (Figure 11).
• Trim system: Trim tabs were fitted to the elevator and rudder, which could be adjusted through hand wheels on the cockpit roof.
• Flaps: The wing flap selector, UP and DOWN, and hydraulic hand pump were located between the front seats. Intermediate positions of the flaps were made by moving the selector to either the UP or DOWN position and then pumping the hand pump until the desired flap position (‘FULL’, ‘LAND’, ‘TOFF’ and ‘CLIMB’) was shown on an indicator located above the instrument panel.
• Fuel system: The aircraft was fitted with three fuel tanks (front, centre and rear) under the cabin floor. Fuel was fed to the engine from a single tank, with a selector located to the left of the instrument panel to control which tank fed fuel to the engine. The quantity in each tank was presented to the pilot on an indicator in the centre instrument panel. The aircraft was also fitted with optional ‘long range’ fuel tanks in each wingtip, which fed the forward tank under the action of gravity. The operator reported that they very rarely used the wingtip tanks.

Figure 10: VH-NOO cockpit showing the aircraft system controls

Source: Sydney Seaplanes, annotated by the ATSB

Figure 11: VH-NOO rudder and flap controls

Source: DHC-2 flight manual, annotated by the ATSB

Stalling

An aircraft’s wing is said to be ‘aerodynamically stalled’ when the airflow over the wing separates from the wing; that is, the airflow no longer follows the contour of the top surface of the wing. This results in a rapid loss of lift, which balances the weight of the aircraft, and the aircraft will rapidly descend. Unless the nose is held up, an aerodynamic stall will also normally result in the nose of the aircraft pitching down.

The characteristics of the aerodynamics of an aircraft wing are such that the airflow will separate and the wing stall when the angle of attack (the relative angle between the wing and the approaching airflow) reaches a critical value. Aerofoils of the type used on aircraft such as the DHC-2, typically stall at angles of attack of around 12-16°.

Most small aircraft do not have an instrument that indicates the aircraft’s angle of attack. However, the angle of attack at which the stall occurs may be referenced to an equivalent airspeed. The airspeed at which a stall will occur is not fixed to a single value, and varies depending upon the flap setting, aircraft weight and load factor.^[9]The stall speeds for an aircraft are typically presented in the Aircraft Flight Manual. As the load factor increases with bank angle in a level turn,^[10] the stall speeds are normally presented in relation to the bank angle.

The primary control for angle of attack is the aircraft’s elevator. Pulling back on the control column will increase the angle of attack and pushing forward will decrease the angle of attack. Recovery from a stall normally requires that the nose of the aircraft be lowered (pitched down) by reducing the back force on the control column and moving it forward.

The DHC-2 flight manual stated that the aircraft’s stall speed with nil and landing flaps selected was 60 mph (52 kt) and 45 mph (39 kt) respectively. The manual specifically stated that:

In tight turns, flight load factors may reach the limit loads, and may also increase the danger of an unintentional stall.

Figure 12 shows how the stall speed and load factor increase with the angle of bank with nil flap. The stall figures presented in ‘kt’ (in red) have been annotated by the ATSB.  

Figure 12: Load factors and stall speed with increased angle of attack

Source: DHC-2 flight manual, annotated by the ATSB

Stall characteristics ^[11]

Under the controlled conditions of certification, the DHC-2 stall was described as being gentle. Specifically, the DHC-2 flight manual stated that:

The stall is gentle at all normal conditions of load and flap and may be anticipated by a slight vibration, which increases as flap is lowered. The aircraft will pitch if no yaw^[12]is present. If yaw is permitted, the aircraft has a tendency to roll. Prompt corrective action must be initiated to prevent the roll from developing.

However, the stalling characteristics were more abrupt in a steep turn. Further, and similar to other aircraft, stalling under power in a steep turn could trigger an incipient spin with little to no indications of an impending stall (Transportation Safety Board of Canada, 2017). In addition, less than ideal conditions such as wind turbulence and unintended sideslip may aggravate the stall characteristics resulting in larger roll angles and increased altitude loss. Further, a pilot may not immediately recognise the condition if an aircraft is unintentionally stalled, and an altitude loss of more than 100 ft may result (Transportation Safety Board of Canada, 2011).

A series of flight tests conducted in 1995 by Aeronautical Testing Service Inc. (reported by Transportation Safety Board of Canada, 2018) also found that the stall characteristics of the DHC‑2 were considered acceptable with a forward centre of gravity. However, with an aft centre of gravity, for a power-on stall, the characteristics were considered to be unacceptable by Aeronautical Testing Services. Similarly, the US Federal Aviation Administration also described the stall characteristics with a forward centre of gravity as being docile and predictable. Conversely, for an aft condition it was unstable and unpredictable, and often unrecoverable at low altitude.

The Transportation Safety Board (TSB) of Canada‘s investigation into a loss of control and collision with water involving a DHC-2 in November 2009 (A09P0397) discussed the stall characteristics of the aircraft. Specifically, they mentioned flight tests that had been conducted in 1992 and the results indicated that:

...When a wheel-equipped aircraft was stalled at a 30º bank angle, it pitched nose down and rolled both into and out of the turn. The maximum roll was 50º. The maximum altitude loss was 100 feet before a pilot, using the proper technique, regained controlled flight. The test pilot noted that the Beaver [DHC-2] displayed little or no pre-stall warning buffet.

The fact that the pre-stall buffet may not provide pilots with adequate warning of an impending stall was also highlighted in the TSB’s investigation into a DHC-2 floatplane accident in 2012 (A12O0071).

Stall warning 

A stall warning system is independent of the pilot’s recognition of inherent aerodynamic qualities near the stall, such as buffeting, and provides a clear and distinguishable warning of an impending stall, aurally and/or visually.

During certification of the DHC-2 in the 1940s, a stall warning system was not included as it was considered that the aerodynamic buffeting near the stall was a clear and distinctive warning of an impending stall. As a result, the Canadian regulations (which referenced the British Civil Airworthiness Requirements) did not require an artificial stall warning system to be installed. However, current Canadian regulations, which apply only to newly designed aircraft, now require those aircraft to incorporate a stall warning system.

In relation to the stalling accident of a DHC-2 in British Columbia in 2016, the TSB (Transportation Safety Board of Canada, 2017) highlighted that:

To reduce the risk of losing control of the aircraft, the pilot must have an immediate, clear indication of an impending stall: immediate because it is urgent, and clear to prevent any possibility of mistaking the impending stall for another type of event…

Recommendations for fitment of a stall warning system

In 2008, following a 2007 DHC-2 accident in Alaska, the US Federal Aviation Administration recommended to Transport Canada (the certifying authority) the fitment of stall warning systems to all DHC-2 aircraft. While Transport Canada acknowledged the value of this recommendation, they indicated that these systems ‘were unlikely to be installed on existing DHC-2s without regulatory amendment’.

In mid-2014, Viking Air published a non-mandatory technical bulletin for the fitment of a stall warning system on DHC-2 aircraft. At the same time, Transport Canada issued a civil aviation safety alert (CASA 2014-02) providing information on the safety benefits of these systems. The alert also recommended that all owners and operators install artificial stall warning systems in those aircraft not originally equipped with such. However, in response, the system was installed on only four of the 223 commercially operated Canadian-registered DHC-2 aircraft (Transportation Safety Board of Canada, 2017).

Further, the TSB’s investigation (A15Q0120) into a 2015 DHC-2 accident highlighted the elevated risk of stalling at low altitude and recommended that Transport Canada require all commercially operated DHC-2 aircraft in Canada be equipped with a stall warning system (recommendation A17-01). Transport Canada agreed in principle with the recommendation and recognised that:

…stalls encountered during critical phases of flight often lead to disastrous consequences. Although the historical accident rate does not indicate that there is any particular stall-related problem with the DHC-2 Beaver when it is flown within its certified envelope, the installation of an Artificial Stall Warning System can enhance operational safety.

They further stated that:

Mandating the installation of a stall warning system on all commercially operated DHC-2 aircraft in Canada will require further study, evaluation, and justification by TC. In 2018, the department will initiate an in-depth examination of the issue, particularly to determine how many accidents would have been prevented by a functioning artificial stall warning system. Following this evaluation the department will determine the most effective means of addressing the risks underpinning this recommendation and then outline its plan and consult industry stakeholders.

By March 2019, Transport Canada had reviewed the TSB’s aviation occurrence database and identified 120 DHC-2 accidents between 2001 and 2016. Of these, 13 involved a stall in the accident sequence. In August 2019, a panel of experts in flight operations and flight testing was convened to examine the 13 accidents. From this, they identified only four where an artificial stall warning device may have been helpful in preventing the accident. They also noted that:

…the study demonstrated that in specific configurations, the DHC-2 provides little natural warning of an impending stall. In these configurations, even with a stall warning system installed, a stall occurs and gives the pilot little to no time to react and recover.

However, in the light of the panel's findings, Transport Canada 'determined that there is insufficient justification to proceed with mandating the installation of a stall warning system on all commercially-operated DHC-2 aircraft in Canada'. Although they will continue to recommend the voluntary installation of such systems as per Civil Aviation Safety Alert 2014-02.

At the time of the accident, VH-NOO was not fitted with a stall warning system and was not required to under Australian regulations.

Pre-flight checks – 31 December 2017

The majority of piston-engine aircraft have dual ignition systems, that is, two sets of spark plugs, where each set is supplied with electrical power from an associated magneto (normally designated ‘left’ or ‘right’). During ground testing prior to a flight, each magneto is switched off in turn to ascertain if either magneto is equally capable of sustaining ignition at typical in-flight power settings. For the DHC-2, the magneto drop when the engine operation on a single magneto (either left or right) is checked, should be no more than 100 revolutions per minute (rpm), with a maximum differential between the magnetos of 40 rpm in the case of the DHC-2.

The operator’s chief pilot reported that, when a magneto drop in excess of 100 rpm was experienced, it was common practice to run the engine at a moderate power setting for a few minutes and then re‑checked. If the drop was within limits, the flight could continue. However, if it remained in excess of the limits, maintenance personnel would be contacted. This was consistent with their operations manual, which indicated that pilots were not authorised to conduct maintenance on the magnetos, and was subsequently confirmed with the operator on 13 October 2020.

The operator’s pilots and a subject matter expert all mentioned that it was not uncommon for the DHC-2 to experience ‘wet’ magnetos from moisture such as rain, humidity or washing the aircraft. By running the engine as described by the chief pilot, the moisture would typically burn off and the magnetos would function as normal.

At 0954 on the morning of the accident, the accident pilot sent a text message to one of the dockhands indicating 'NOO left mag dropping 150'.^[13]The chief pilot, who was not at work on that day, also had a missed call from the pilot, but he did not leave a message and there were no additional communications from the pilot regarding the issue. Further, maintenance personnel were not contacted. Therefore, there was no evidence to indicate that the issue had not been rectified by the pilot and operations from then on were considered to be normal. The pilot who flew the aircraft the day before, also recalled experiencing a minor magneto drop in excess of the allowable limit during his engine ground test. This was rectified by running the engine at a moderate power setting as described above.

Meteorological information

Bureau of Meteorology

The nearest Bureau of Meteorology automatic weather station (AWS) was located at Terrey Hills, about 11 km south-south-east of Jerusalem Bay.^[14]Another AWS was located at Gosford about 22 km north-north-east of Jerusalem Bay.^[15]At 1500 on the day of the accident, the Terrey Hills AWS recorded the wind at 13 km/h (about 7 kt) from the north-east and a temperature of 23.2 °C. 

The Gosford station recorded the wind at 20 km/h (about 11 kt) from the east-north-east and a temperature of 23.8 °C. The Bureau of Meteorology analysed the meteorological conditions in the accident area and advised that:

• The forecast low-level winds at 1400 and 1700 showed that the winds near the surface were from the east, north-east at about 15 kt, moving around to the north.
• Weather radar imagery showed there was no rain in the area.
• Based on the height and orientation of the terrain in Jerusalem Bay, and the assumption that the wind flow was from the north-east at about 10-15 kt, the wind would have been flowing over the hills into the bay. Based on the wind strength, it was reasonable to assume that moderate turbulence due to orography would have been unlikely. However, light turbulence could not be discounted.

Bureau of Meteorology tidal recordings at the Ku-ring-gai Yacht Club (near Cottage Point), stated that it was low tide at 1400 indicating that the tide was in-coming (rising) at the time of the accident.

Other pilot observations

The pilot of VH-AAM, who departed Cottage Point shortly before VH-NOO, stated that the conditions were considered standard and estimated the wind was from the north-east at about 15‑20 kt, with an occasional gust. The water conditions were not choppy, and no white caps were visible.

Interpretation of passenger photographs

The ATSB sought the opinion of several experienced floatplane pilots on the meteorological conditions based on the photographs taken by the passenger on board VH-NOO (Figure 1). Those pilots estimated that the conditions were:

• A 15-18 kt breeze on the water and was considered to be a standard day.
• The wind was 12-15 kt from the north, north-north-east. The wind was coming over the hills and onto the water, and you would expect some gusting and very minor windshear. The cloud was at 1,500 ft or higher.
• The wind was 10-15 kt, possibly up to 20 kt. There was overcast cloud,^[16]probably at 3,000‑4,000 ft.

Witness observations

Witnesses in several locations (detailed below) provided varying accounts of the environmental conditions at the time of the accident, in particular, that relating to the wind conditions. It was possible that these differences were related to their position, local terrain-induced turbulence effects, boat wake, or possibly their experience on the water.

Cottage Point

Personnel at Cottage Point reported that the wind was ‘fairly strong’, about 15 kt from the north‑east. Another commented that it was not that windy and the aircraft were sitting comfortably on the pontoon outside the restaurant. A witness also at Cottage Point observed the aircraft take‑off and reported that the wind was ‘suddenly very gusty’.

Cowan Water

Witnesses positioned in more open waters (Cowan Water), reported some variability in the wind and water conditions. They described the wind ranging between gentle to very windy, and from the north-east at 10 kt to 25 kt. A witness positioned at Cottage Rock (Figure 3), reported that the 

wind was from the east and there was a ‘strong blustery breeze’ at an estimated 20 kt gusting to 25 kt. He suggested that the aircraft could have been buffeted by the winds along the take-off path. The overall conditions were described as a sunny, warm day, with some cloud cover and good visibility.

With regard to the water conditions, some witnesses commented that it was reasonably calm while others reported that it was choppy and there were some whitecaps visible.

Jerusalem Bay

Witnesses positioned in Jerusalem Bay and Pinta Bay also indicated that it was a sunny, warm day, with some cloud cover and good visibility. The wind was from the north-east and was funnelling directly into Jerusalem Bay. This would have resulted in the aircraft experiencing a tailwind at the time it entered Jerusalem Bay.

The wind strength reported was variable, ranging from a ‘slight breeze’ to being ‘extremely windy’, and estimated to be between 5 kt and 22 kt. Some witnesses commented that the wind was constant, while others indicated that it was gusting, with one estimate of gusts up to 24-27 kt.

As Jerusalem Bay was more protected, the water conditions in the bay were calmer in comparison to Cowan Water.

Communications and radar data

It was common practice for the operator’s pilots to make radio broadcasts when departing Cottage Point, to alert other aircraft in the immediate vicinity of their presence and intentions.

A review of Airservices Australia audio recordings of the applicable air traffic control frequency between 1430 and the time of the accident did not identify any radio calls, either routine or emergency, broadcast by the pilot of VH-NOO. The first broadcast heard from the pilot of the operator’s other DHC-2 (VH-AAM), which departed Cottage Point about 10 minutes prior to VH‑NOO, was when he was in the Pittwater and northern beaches area. However, given the low altitude of the aircraft, any calls made while on the water, or while below the level of the surrounding terrain, would likely have been shielded by the local terrain and not picked up by the Airservices Australia receivers. Further, by the time VH‑NOO was taking-off, the pilot of VH‑AAM was on a different radio frequency and did not hear any radio calls from VH-NOO.

Within the cabin, all of the occupants wore headsets. The pilot wore a noise-cancelling headset^[17] with a microphone so that he could make radio calls and talk to the passengers. The passenger headsets were not fitted with microphones; they could listen to the pilot, but could not communicate with him or broadcast externally. If the passengers wanted to communicate, they had to talk above the engine noise or tap the pilot on the shoulder to gain his attention.

A review of the Airservices surveillance data did not identify any radar returns in the vicinity, most likely due to terrain shielding. The lowest radar return observed in that area at other times was 700 ft. Airservices advised that there was nil notice to airmen^[18] relevant to the area of operation leading up to, and on the day of the accident.  

Recorded information

On board recording devices

Recording devices on VH-NOO

VH-NOO, which had a maximum take-off weight of 2,309 kg, was not equipped with either a cockpit voice recorder (CVR) or a flight data recorder (FDR), nor was it required to be. Further, there was no video equipment fitted to the aircraft, which may have been used to record the passengers’ experience of the flight.

Regulatory requirements 

International Civil Aviation Organization (ICAO) Annex 6 Operation of aircraft^[19] has recommendations and standards for the fitment of recorders to small aeroplanes (maximum take‑off weight less than 5,700 kg) used for commercial air transport. These, however, apply only to turbine-engine powered aircraft and those certificated after January 2016. Amendments to Annex 6 since 2012 have included additional provisions for the fitment of lightweight flight recorders including airborne image recording systems. Although ICAO has not recommended the fitment of lightweight recorders to commercial small aeroplanes without turbine engines, guidance in Annex 6 is that lightweight recorders can be used to fulfil this purpose.

The CASA requirements^[20] for the fitment of recorders to small aircraft similarly only applies to turbine‑powered aircraft. They did not require the fitment of an FDR to any aircraft with a maximum take-off weight less than 5,700 kg, and required the fitment of a CVR to aircraft below 5,700 kg only if they were:

• pressurised; and
• turbine-powered by more than one engine; and
• of a type certificated in its country of manufacture for operation with more than 11 places (seats); and
• issued with its initial Australian Certificate of Airworthiness after 1 January 1988.

As none of these applied to VH-NOO, the aircraft was not required to be fitted with recording devices.  

Historical perspective

On 10 June 1960, a Fokker F-27 aircraft, registered VH-TFB and operated by Trans Australia Airlines, was on a scheduled passenger service from Brisbane to Mackay in Queensland. When at Mackay, the crew attempted two approaches, but these were aborted due to low visibility conditions. However, on the third attempt to land, air traffic control advised the crew that they were cleared for a visual approach, but no further communications were received from the crew. About 5 hours later, aircraft wreckage was found floating on the ocean about 9 km from the airport. All 29 occupants were fatally injured.

The subsequent board of inquiry was unable to come to any definite conclusions as to what had contributed to the accident. However, they recommended that all aircraft the size of the F-27 and larger be fitted with flight data recorders. The Federal Government implemented this recommendation the following year. Australia was one of the first countries to introduce this requirement.

The benefits of onboard recording devices have long been recognised internationally as an invaluable tool for investigators in identifying the factors behind an accident and assisting with the identification of important safety issues.

Standards, practices and specifications for lightweight recorders

The retrofit of traditional crash protected flight recorders to lighter aircraft (below 5,700 kg) is costly and technically difficult. The Transportation Safety Board (TSB) of Canada noted in its investigation report (A11W0048) into a 2011 accident involving a de Havilland DHC-3 Otter:

Commercially operated aircraft weighing less than 5700 kg are usually not fitted at manufacture with the system infrastructure required to support an FDR, and conventional FDRs would require expensive modifications in order to be installed in this category of aircraft. Several affordable, stand-alone, lightweight flight recording systems that can record combined cockpit image, cockpit audio, aircraft parametric data, and/or data-link messages, and that require minimal modification to the aircraft to install, are currently being manufactured…

To address this, ICAO has developed guidance for lightweight recorders^[21]in Annex 6 as an alternative to traditional FDR and CVR in smaller aircraft. ICAO refers to the specifications applicable to lightweight flight recorders in the European Organisation for Civil Aviation Equipment (or EUROCAE) document, Minimum Operational Performance Specifications for Flight Recording Systems (ED 155). This document defines:

….. the minimum specification to be met for aircraft required to carry lightweight flight recording systems [in Annex 6] which may record aircraft data, cockpit audio, airborne images or data-link messages in a robust recording medium primarily for the purposes of the investigation of an occurrence (accident or incident). It is applicable to robust on-board recording systems, ancillary equipment and their installation in aircraft.

…a combination of audio, data and cockpit image recordings will provide air safety investigators with the necessary information to better define the facts, conditions and circumstances of an occurrence, and to broaden the scope of the vitally important human factor aspects of investigations. Additionally, image recordings can capture other cockpit information that would otherwise be impractical or impossible to record.

Recent technological advancements have meant that airborne image recorders with additional capabilities are available on the market requiring only aircraft power to be connected. Devices with a compact high-resolution camera and microphone can be fitted under the cockpit ceiling. These devices can also contain a GPS receiver, electronic gyroscopes and accelerometers. The audio, video, location, attitude and acceleration information is recorded in a crash resistant memory and replicated on a removable memory card.

In addition to ICAO Annex 6 and EUROCAE ED-155, CASA also allowed operators to fit a lightweight recording device. Advisory circular AC 21-46, Airworthiness approval of avionic equipment, provided guidance and information on the fitment of this type of ‘required’ and ‘non‑required’ equipment, which included the ED-155 specifications.

Relevant ATSB investigations

A number of accident investigations undertaken by the ATSB, including a loss of control, controlled flight into terrain, and impact with water, have resulted in undetermined findings. This is generally the result of no physical evidence indicating a technical problem with the aircraft combined with the lack of witness and recorded data evidence. The availability of recorded data would have likely provided information about the events that led to the development of these accidents, and thereby possibly allowed for timely and appropriate safety action. Summaries of these are provided in Appendix C – On board recording devices. However, more recently, the ATSB’s investigation into a collision with terrain involving a Cessna 441 aircraft, near Renmark, South Australia in 2017 (ATSB investigation AO-2017-057) stated that:

The limited recorded flight information available to the investigation prevented a full analysis of the handling aspects and cockpit communications, this in turn restricted the extent to which the factors contributing to the accident could be analysed and the potential for identification of safety issues and areas for safety improvement.

Similarly, the TSB have also commented that there were ‘numerous [Canadian] examples of accident investigations involving small aircraft that were hampered by the lack of flight recorder data’.^[22]However, there have been recent examples of investigations where the use of recording devices, although not crash protected, have greatly assisted in determining the contributing safety factors and ultimately the identification of safety issues. Examples have included a GoPro, mobile phone and camera. These accidents involved an aircraft structural failure, engine power loss and main rotor speed decay, and are summarised in Appendix C – On board recording devices.

Recommendations for the fitment of lightweight recording devices

On 28 July 2004, a Piper PA-31T Cheyenne aircraft, registered VH-TNP, with one pilot and five passengers, on a private, instrument flight rules flight from Bankstown, NSW to Benalla, Victoria collided with terrain 34 km south-east of Benalla. All occupants were fatally injured, and the aircraft was destroyed (ATSB investigation AO-2008-050).

The experienced pilot was familiar with the aircraft and its navigation and autoflight systems and had flown this route at least once a week. Despite this, the flight did not follow the usual route, but diverted south along the coast before tracking inland.

The ATSB noted that this investigation was severely hampered by the extent of destruction of the aircraft and the lack of recorded or other evidence. In particular, the investigation could not reconcile how a pilot would continue navigation by GPS with the alerts and warnings provided by the GPS receiver and the instrument indications.

The aircraft’s allowable take-off weight was 4,082 kg and it was not required to be fitted with an onboard recording device. However, the investigation noted that:

Australian regulations requiring the carriage of an FDR and/or a CVR have not changed since 1988. During the interim period, advances in technology have resulted in solid-state recorders that are smaller, lighter, use less power and require less maintenance than those manufactured before 1988. In that time there has been considerable change to US and European requirements for the carriage of recording devices and the US National Transportation Safety Board (NTSB) has included improved recorder systems on its ‘Most Wanted’ list for many years. At least one large US general aviation aircraft manufacturer has indicated that it may incorporate recording devices in its aircraft as standard equipment.

The report also cited a number of previous ATSB accident investigations involving multi-engine aircraft that were limited by a lack of factual information that onboard recording devices would have otherwise provided. These investigations involved a Beech 200, VH-FMN (200105769 – although the aircraft was fitted with a CVR); a Beech 200, VH-SKC (200003771); and a Piper Chieftain, VH‑MZK (200002157).

Therefore, on 02 Feb 2006 as a result of the Benalla accident, the ATSB recommended that CASA ‘review the requirements for the carriage of on-board recording devices in Australian registered aircraft as a consequence of technological developments’ (R20060004). The CASA response to the recommendation on 23 November 2008 advised.

As you would be aware, there has been extensive liaison between CASA and the ATSB on this matter over the last twelve months. I can now advise that CASA has completed its cost benefit analysis (CBA). The CBA results confirm CASA's initial view that there is no justification to mandate the carriage of recording devices in smaller aircraft. The analysis considered 7 categories of small aeroplane operations, from Low Capacity RPT and Charter, down to aerial work, business and private operations and did not find fitment justified on safety grounds.

CASA believes that the safety regulator's focus should be on passenger carrying operations and preventing accidents by fitment of new generation technologies such as Airborne Collision Avoidance: Systems, Terrain Avoidance and Warning Systems and Automatic Dependent Surveillance Broadcast equipment, rather than mandating fitment of OBR devices to assist in determining the cause of an accident.

The CBA determined that the industry was unlikely to make this investment on its own accord. The use of quick access recorders by larger airlines provides considerable economic and business benefits which outweigh the costs involved. With the recent emergence of low cost and light weight recorders for small aircraft it is expected that the take up of recorders may gather momentum over the next couple of years once suppliers become more active in the market and prices come down. In the interim, CASA will be monitoring voluntary fitment of OBRs.

The need for onboard recording devices in other than large aircraft has also been recognised by other investigation agencies, who have made various recommendations for these devices to be fitted. These agencies have included the US National Transportation Safety Board, Transportation Safety Board of Canada, United Kingdom (UK) Air Accidents Investigation Branch (AAIB), European Union Aviation Safety Agency and New Zealand Transport Accident Investigation Commission. Appendix C – On board recording devices details the reasoning for, and a summary of these recommendations.

Passenger camera

During the aircraft wreckage examination, a Canon EOS 40D digital single-lens reflex camera (DSLR) containing a compact flash (CF) memory card was found inside the cabin (Figure 13). The camera with an intact strap was found embedded in the mud on the ceiling of the inverted cabin. The camera was identified as belonging to the front right seat passenger.

Figure 13: Passenger camera as found in the aircraft (left) and CF card removal (right)

Source: ATSB

The memory card was cleaned and dried before X‑ray examination. Corrosion was identified and the card was unable to be read. The memory and controller chips were transplanted onto a donor memory card circuit board and successfully downloaded. The memory card contained 412 images.

The images included several taken before leaving Rose Bay but did not include any photographs from the flight from Rose Bay to Cottage Point. Photographs were also taken while the passengers were at Cottage Point and when boarding the aircraft for the return flight.

The last series of photographs on the memory card were consistent with having been taken from the front right passenger seat. This contained 22 photographs taken during the taxi, take-off and initial climb, through either the front windscreen or the front right passenger window. Nine of those photos were taken while airborne over a period of 39 seconds.^[23]

The last three photographs on the memory card were through the front windscreen with the aircraft in a right bank. The final photograph was when the aircraft was over Cowan Water and heading south towards Cowan Bay.

ATSB assessment of passenger photograph locations

The recovered passenger photographs were analysed by the ATSB using commercial camera tracking software^[24] to estimate the position and altitude of the aircraft when each photograph was taken (Figure 14). The timing and location of the images was consistent with the two photographs taken by a witness on the river (Figure 2). The image positions were similar to NSW Police Force (the police) forensic imaging estimates^[25] with the exception of the final photograph (412). The ATSB estimated that this photograph was taken at a more southerly position more towards Cowan Bay.

In addition, the images indicated that the aircraft initially climbed to an altitude of about 135 ft, but by the time of the last photograph, the aircraft had descended to about 98 ft.

Figure 14: Images taken by the front right seat passenger following take-off from Cottage Point during the accident flight, and used in the flightpath estimation

Source: Passenger camera, annotated by the ATSB
 

Table 2 details the timing and respective camera setting for each photograph taken by the passenger, and the estimated location of the aircraft (latitude, longitude and altitude).

Table 2: Camera setting, photograph direction, timing, location and altitude for comparison photographs

#.jpg	Time hhmm:ss[26]	Focal length[27][2]	Photo direction	Estimated latitude	Estimated longitude	Estimated altitude
404	1511:45	17 mm	Forward	33.600098°S	151.216291°E	38 ft
405	1511:45	17 mm	Forward	33.599865°S	151.216371°E	38 ft
406	1511:52	17 mm	Forward	33.598033°S	151.216926°E	67 ft
407	1512:02	17 mm	Right side	33.595773°S	151.220259°E	135 ft
408	1512:08	41 mm	Right side	33.594933°S	151.221451°E	131 ft
409	1512:08	41 mm	Right side	33.594791°S	151.221605°E	134 ft
410	1512:18	41 mm	Forward	33.594835°S	151.224664°E	104 ft
411	1512:18	41 mm	Forward	33.594873°S	151.224782°E	112 ft
412	1512:24	41 mm	Forward	33.597227°S	151.225413°E	98 ft

Source: ATSB

Using the information in Table 2, an approximate flight path was developed for the portion of the flight where camera images were available (Figure 15).

Figure 15: Estimated flight path derived from passenger images

Source: Google earth, annotated by the ATSB

Pilot and passengers’ mobile phones

The pilot’s mobile phone was found in the aircraft cabin, but the information on this phone was unable to be downloaded due to the extent of damage. A mobile phone belonging to a middle row passenger and one belonging to a rear seat passenger were recovered from the riverbed at the initial impact location. Data was able to be extracted from those passenger’s phones. Images

taken at Rose Bay just prior to boarding VH-NOO were correlated with the operator’s closed‑circuit television footage from the Rose Bay terminal and the front seat passenger’s DSLR camera. This established the timings of events from the DSLR camera. Photographs taken of the passengers on board the aircraft at 1502 were used to identify their seating positions. No photographs were taken on the phones during the accident flight.

Images of the pilot’s door ajar while engine operating

Examination of photographs taken by passengers on earlier flights at 1041 and 1202 (Figure 16) showed the aircraft with the pilot’s door ajar and window closed while the engine was operating when the aircraft was just commencing taxi. Closed-circuit television footage that captured the aircraft for a ten second period heading south during the 27-minute taxi along Cowan Creek immediately prior to the accident flight similarly showed the pilot’s window closed and door ajar (Figure 16). There were no images from the accident flight that indicated the position of the pilot’s door during the taxi.

Other company DHC-2 pilots advised that their routine was to open their sliding window rather than having the door ajar when ventilation in the cabin was required before take-off. Sydney Seaplanes indicated that taxiing with the door ajar was common practice in light non-airconditioned aircraft, especially in summer.

Figure 16: Pilot’s door ajar and window closed during previous flights and extended taxi just prior to accident flight

Source: VH-NOO passengers and resident of Cottage Point, annotated by the ATSB

Images of passenger door while engine operating

Examination of photographs taken by the passenger on the accident flight during the taxi and when airborne showed the aircraft with the passenger door and side window closed. Similarly, an 11 second segment of the closed-circuit television footage of the aircraft during the 27-minute taxi north along Cowan Creek immediately prior to the accident flight showed the passenger’s door and window closed.

Wreckage and impact information

Wreckage distribution

Witnesses observed the aircraft impact the water banked to the right in a nose-down attitude. The right-wing tip and both float tips impacted the water first. The left wing and float tips separated from the fuselage and the aircraft became inverted. The left wing, shattered windscreen, mobile phones and float tips were found on the riverbed about 95 m from the northern shoreline of Jerusalem Bay, indicating that this was likely close to the initial impact location. The right-wing tip fuel tank and right front passenger door separated on impact and were recovered from the river surface.

The right wing and remainder of the floats remained with the inverted and partially submerged main fuselage, attached only by the control cables and strut structure. During the period when the main wreckage was floating, it drifted<^[28]about 75 m west into Jerusalem Bay before sinking near the entrance to Pinta Bay.

Figure 17: Location of the initial impact (circled) with the windscreen/left wing (1) and fuselage/tail/right wing floats (2) locations on the riverbed

Source: Google earth, annotated by the ATSB

Aircraft recovery

The aircraft came to rest on the floor of Jerusalem Bay. The main wreckage, comprising the cabin, tail, engine, floats and right wing was located near the entrance to Pinta Bay, 120 m from the northern shoreline at a depth of about 14 m and had been marked with a buoy by first responders. A significant quantity of fuel leaked from the aircraft and was observed in the water (Figure 18).

Figure 18: VH-NOO accident location in Jerusalem Bay (image taken 30 minutes after the accident)

Source: NSW Police Force, annotated by the ATSB

On 4 January 2018, the aircraft was recovered from the river during three ‘secure and lift’ operations under the supervision of the ATSB. These operations, undertaken by the police diving unit and a barge operated crane crew, retrieved:

• the main sections of both aircraft floats and the right wing
• the main fuselage including the engine, propeller, cabin and tail section
• the left wing.

The police conducted further diving operations at the initial impact location to retrieve the remaining aircraft debris and items on‑board.

Aircraft wreckage

The aircraft was transported to secure facilities at Bankstown Airport for further examination by the ATSB. A representative from the aircraft type certificate holder also attended. Examination of the aircraft wreckage indicated that (Figure 19):

• all major sections of the aircraft structures were recovered
• the front of the aircraft and float tips had been significantly damaged by upward and backward impact deformation
• both wings and the floats had separated from the fuselage
• both wing front spars had fractured in overload
• the right wing tip was substantially more damaged than the left wing tip and was consistent with contacting the water first
• the outboard section of the right wing had significant leading edge compression and upward bending deformation 
• flight control continuity^[29] was established, indicating no evidence of flight control disconnection issues prior to impact
• the throw-over control column was positioned on the left (pilot’s) side
• while the engine control quadrant was distorted, the throttle lever was found in the full aft ‘closed’ position, although it could not be discounted that this occurred during the impact sequence
• the fuel was selected to the centre tank and all fuel filler caps were found secured
• the oil filler cap in the cabin was not found in the wreckage,^[31]there was no evidence of oil residue in the immediate vicinity, and the oil pressure gauge needle showed evidence of being in the normal range at impact
• the right front passenger door had separated
• the left front pilot door window snap vent was found in the partially open position
• the aircraft cabin was fitted with a disposable CO chemical spot detector affixed to the instrument panel; there was no ‘date opened’ annotated on the front of the detector
• there was no evidence of a birdstrike or collision with an object prior to take-off or in-flight
• there was no evidence of an in-flight break-up or pre-impact structural damage
• no foreign objects were found obstructing the rudder pedals or the control column.

Figure 19: Wreckage examination

Source: ATSB

Aircraft attitude at impact

The damage to the aircraft suggested that the aircraft entered the water with the aircraft body at a high angle of attack[1] relative to the direction of travel (Figure 20).

Figure 20: Aircraft descending with a high angle of attack

Source: CASA (2016), annotated by the ATSB

This high angle of attack was consistent with an aerodynamic stall and was evident by:

• Deformation of the nose area indicated that the engine and forward fuselage was deformed upward by about 13° (Figure 21). Wrinkling in the fuselage skins around the rear doors and windows also indicated significant upward bending of the forward fuselage (Figure 21).

Figure 21: Engine and forward fuselage deformation post-accident (top) with pre‑accident nose to rear fuselage angle (bottom)

Source: ATSB (upper) and image provided by previous passenger (lower)

• The right-wing tip leading edge impact damage indicated a considerable upward pressure relative to the wing chord on impact. The wing tip indicated deformation of approximately 23° upwards (Figure 22).^[32]

Figure 22: Right wing tip leading edge deformation (view from outboard)

Source: ATSB

• Wrinkles seen in the right-wing skins indicated an upwards force was applied to the outboard wing at impact.
• Deformation of the inboard right wing leading edge and spar failure indicated a large pressure generated at the wing/fuselage intersection consistent with an aircraft sideslip at impact.

Aircraft configuration

The examination found that the flap actuator was extended to 13.375 inches (Figure 23), which was consistent with ‘climb’ flap of 15° (Figure 23 and Table 3) and the amount of flap visible in the witness photographs (Figure 2). The flap setting noted during the initial climb on a previous flight matched the setting observed in the witness photographs.

The rudder trim was selected to the right, indicative of normal operations in this aircraft type.^[33] The elevator trim was in a neutral position, consistent with normal operations for the aircraft near the maximum take-off weight.^[34]

Figure 23: Flap actuator

Source: ATSB

Table 3: Flap actuator measurements and corresponding flap settings

Wing flap setting	Degrees	Measurement (inches)
Cruise	0	12.5
Climb	15	13.45
Take-off	35	15.35
Landing	50	16.5
Full Flap	58	Measurement not provided<[35]

Source: Viking Air

Engine and propeller examinations

The engine and propeller examinations were conducted at separate maintenance facilities under ATSB supervision. The organisation that carried out the repairs/overhaul of the engine (Covington Aircraft) also attended the engine examination. These examinations did not identify any pre‑existing damage or conditions that may have contributed to the accident. Specifically, the examinations identified that:

• damage to the front of the engine casing was consistent with the aircraft impacting the water in a nose-down attitude
• an engine crank case crack (Figure 24) was consistent with impact damage
• some of the supercharger section impeller intermediate drive gear teeth had sheared in overload, which was consistent with the engine producing power at the time of the collision with water
• examination of the magnetos found damage consistent with immersion in salt water, which precluded function tests from being conducted; however, there was no evidence of any pre‑existing defects
• one propeller blade had slight forward bending at the tip, then mid-span rearward bending, which was typically consistent with the engine driving the propeller at impact
• one propeller blade had damage to the leading edge that corresponded with impact damage to the forward portion of one of the engine cylinders (Figure 24) and was rotated in such a manner that suggested a broken pitch link; this indicated that the propeller was being driven by the engine at the time of impact.

Advice received from the propeller manufacturer indicated that the damage observed was consistent with the propeller rotating under power at the time of impact, but at a ‘lower power condition’. They further indicated that this may not necessarily represent the power condition when the aircraft departed controlled flight as it could not be discounted that the throttle had been manipulated after this time. The exact power setting on impact was unable to be quantified.

Figure 24: Damage to the engine and propeller, oriented upside down

Source: ATSB

Examination of engine exhaust system

Following advice from the NSW State Coroner concerning CO exposure of the aircraft occupants in March 2020 (refer to section titled Medical and pathological information), the engine exhaust system was removed from the aircraft and examined at the ATSB’s technical facilities in Canberra. A summary of the main findings from the examination is provided below, for full details refer to Appendix D – Engine exhaust system (manifold) materials examination report.

The scope of the examination included a visual inspection of the exhaust system (manifold) to identify any areas of cracking, fracture or other defects. In addition, selected exhaust sections were sectioned and microscopically examined to determine if any cracking existed prior to the accident.

The visual examination identified that some of the exhaust segments, particularly from cylinders number 3 through to 5, were significantly deformed as a result of the impact. Four cracks or partial fractures were identified on these segments and selected for more detailed examination. There was one partial fracture away from this area, adjacent to the welded flange connection to the number 7 cylinder exhaust port, which was also further examined. The identified fractures are labelled A to E in Figure 25.

Figure 25: VH-NOO exhaust segments and location of exhaust tailpipe on aircraft (inset)

Note: Image includes carburettor heat muff. Cylinders numbered clockwise. Labels A through E shows location of fractures examined.
Source: ATSB and passenger, annotated by the ATSB

The Y-segment (D) had been repaired or re-manufactured, but the extent to which the repairs may have influenced the observed cracking could not be determined. Further, it was worth noting that the extent of the exhaust deformation meant that all of the cracks identified were wider (more ‘open’) than they would have been pre-accident.

The exhaust segments were sectioned and fractured in the ATSB laboratory to allow the identified fracture surfaces to be microscopically examined. Most of the fracture surfaces had two visibly‑distinct regions, where one region exhibited significantly more surface contamination or oxidation. The newer fracture region was considered to have occurred during the impact sequence, while the more contaminated fracture surface represented a crack that existed prior to the accident.

All of the cracks had emanated from corrosion adjacent to welded locations, likely due to sensitisation of the steel during normal operations. At least one of these cracks, at the number 7 cylinder exhaust flange, resulted in exhaust gases leaking into the engine bay. This was evident by the discolouration of the area adjacent to the crack and through chemical analysis of the fracture surface contamination, which was consistent with fuel combustion by-product (Figure 26).

While it was assessed that cracks were present, which pre-dated the accident, the age of the cracks or the speed at which they developed was not able to be determined.

In addition, there did not appear to be any obvious exhaust gas (CO) leakage at the slip joints, however, the examination was limited by the corroded and/or discoloured condition of the exhaust segments.

Figure 26: Cylinder 7 exhaust flange (detail E)

Source: ATSB

Examination of the magneto access panels

The engine main firewall was examined, and the two magneto access panels were identified as a potential pathway for CO to enter the cabin. Both panels were found to be installed in the main firewall. The left panel had minor impact damage, while the right panel had significant distortion and impact damage (Figure 27).

Each panel was found to only have two of their four bolts installed, which resulted in four 3/16-inch (4.76 mm) diameter holes in the main firewall. The number of bolts fitted to the panels was further confirmed with photographs of the main firewall taken in January 2018 during the initial aircraft examination. This showed four bolts were missing from the panels at that time.

The nutplate at the 9 o‘clock position on the right panel was missing but was later found on the cabin floor with the threaded portion of a bolt/screw in situ. The distortion to this panel and adjacent main firewall at this position was indicative of the bolt having been installed at the time of impact. Therefore, it was determined that the right panel had only one bolt missing at the time of the impact.

The number, condition and type of hardware securing the panels to the main firewall is discussed below.

Figure 27: VH-NOO main firewall to aircraft cabin with magneto access panels highlighted

Source: ATSB and Viking Air, annotated by the ATSB

Left (pilot’s) magneto access panel

Two bolts were installed at the 4 and 10 o’clock positions (when viewed from the cabin looking forward) in the left access panel, while the other two bolts were missing. One bolt (10 o’clock) was consistent with an AN3 bolt but fitted with a ‘butterfly’ modification welded to the hex head. The other bolt (4 o’clock) was an unidentified wing-head screw, with a narrowed (necked) shank (Figure 28). The gasket was present and bonded to the panel but was noted to be in a deteriorated condition.

The installed bolts were tested in the missing bolt nutplates. They were able to be screwed all the way down by hand, however, there was little or no friction torque present in the nut. A new AN3 bolt was also tested and was able to be wound in by several threads before the resistance required the use of a spanner to be correctly tightened. Based on this, it was reasonable to conclude that the installed bolts were worn and the nutplates for the missing bolts were functional.

On 28 September 2020, in response to the draft report, Airag Aviation Services advised the ATSB that the left magneto access panel was positioned with the cut-out^[36]in the incorrect orientation (Figure 27). They further stated that the panel ‘would never have been installed in such manner by itself’. However, a LAME from the maintenance organisation reported that a panel installed upside down would still ‘sit flat’.

Right side magneto access panel

Two bolts were installed at the 3 and 6 o’clock positions in the right access panel and two other bolts were missing from the 9 and 12 o’clock positions. As discussed above, it was established that only the bolt in the 12 o’clock position was missing at the time of the impact. The bolt in the 3 o’clock position was consistent with an AN3 bolt, with a ‘butterfly’ modification welded to the head. The other bolt (6 o’clock) was a stainless-steel Phillips-head screw, similar to those used on the aircraft’s instrument panel. The gasket was installed, however, it was in a deteriorated condition.

The installed bolts and a new AN3 bolt were tested in the missing bolt nutplate, with the same result as identified for the left panel.

Figure 28: Magneto access panels, attaching hardware and gaskets

Source: ATSB

Magneto access panel bolt modifications

A LAME from Airag Aviation Services advised that the Phillips-head screw was fitted to the right magneto access panel when the aircraft was at Rose Bay to ‘fill a hole’ and that they had intended to replace this at a later stage. The LAME reported that, when they needed to replace the bolts, they would source them from surplus bolts in their toolbox. They further stated that AN3 bolts were available in stock.

The LAME also advised that the maintenance organisation utilised AN3 bolts but had added the ‘butterfly’ head to assist with the fitment and removal of the bolts in the magneto access panels. Specifically, these bolts were used so they only had one item in their hand at any time, which minimised the possibility of losing the spanner in a confined space. They would then either tighten the bolt by hand or use a spanner for the final ‘nip up’ (torque). This modification was reportedly quite prevalent on aircraft used in the aerial agricultural industry. Viking Air advised they are ‘not aware of a situation where a “Wing Head” [‘butterfly’] bolt may be used in substitution for an AN-3 hex bolt’.

A modified AN3 bolt was tested to determine if a standard 3/8” spanner could be utilised for the final torque. The spanner could be used to tighten the bolt on two of the three sides, but it did not fit onto the third due to the modification (Figure 29).

Figure 29: Spanner accessibility on AN3 modified bolt

Source: ATSB

Magneto access panel bolts on other aircraft

The magneto access panels of three other DHC-2 aircraft currently, or most recently maintained by the same maintenance organisation as VH-NOO, were inspected on an opportunity basis in 2020. Through direct observation and from photographic evidence, the ATSB found that:

• One aircraft had one bolt missing and one loose on the left access panel, while all the bolts were in place on the right panel. The bolts in situ for both panels were unmodified AN3 bolts. At the time the aircraft was observed by the ATSB, it had flown about 36 hours since the last maintenance inspection was conducted. That inspection included replacing the left magneto.
• For the second aircraft, the ATSB only observed the left panel on the aircraft and noted that one bolt was missing. The remaining bolts had all been modified.
• While the third aircraft had been sold and transported to Canada, it was reported that nil maintenance had been performed in the intervening period. Photographic evidence showed that the panels were fitted with a combination of unmodified AN3 bolts and one machine screw. Further, one bolt was missing from each panel and one screw was broken.

Figure 30: Magneto access panel on exemplar DHC-2 aircraft with two 4.76 mm diameter holes (circled) following bolt removal

Source ATSB 

Fuel testing

Fuel samples were collected by the police from the operator’s refuelling point at Rose Bay. The fuel was tested by the ATSB for the presence of water, with nil indications found. A visual inspection did not identify any particulate matter in the fuel. In addition, there were no reports of fuel quality concerns with the operator’s other DHC-2 aircraft utilising the same fuel source.

Witness observations

A number of witnesses were interviewed by the ATSB and the police, including two who were positioned in Cowan Creek, nine in Cowan Water, 11 in Pinta Bay and 13 in Jerusalem Bay. Figure 31 shows the approximate locations of these witnesses, and the following provides a description of those observations. Note that these observations may have been influenced by the physical location of the witness, the environmental conditions, the short time frame within which the accident occurred, and their knowledge of aircraft operations.

Figure 31: Approximate location of witnesses

Note: In some circumstances, multiple witnesses were positioned at each point annotated on the map.

Source: Google earth, annotated by the ATSB

Aircraft stability

Cowan Creek and Cowan Water

Of the nine witnesses located on Cowan Water, two did not observe the turn, but four reported that it was performed smoothly, and the aircraft appeared normal and in control. Similarly, the two witnesses in Cowan Creek also reported that the aircraft appeared to be in a stable condition. Some of these witnesses relied on their previous observations of floatplanes for comparison. However, the three remaining witnesses on Cowan Water described the aircraft as:

• When the witness first saw the aircraft, it was just south of Little Jerusalem Bay, it was a ‘little bit shaky’, which he considered normal as it was very windy. However, when the aircraft went overhead, it was flying smoothly.
• The witness observed the aircraft flying towards him from the direction of Jerusalem Bay and it appeared normal. However, when the aircraft was near Cowan Point, it conducted a near vertical manoeuvre, likened to a stunt aircraft. The aircraft appeared to lose airspeed, rolled right, came down and then levelled off at about 10 m above the water. The aircraft then continued into Jerusalem Bay and appeared normal. In the distance, he observed the aircraft conduct a similar turn, before impacting the water.
• While moving west in a small vessel, the witness observed the aircraft flying up from Cottage Point. Shortly after, he saw the aircraft conduct a ‘sharp’, ‘hasty’ right turn, which he believed was not normal from his previous observations. The turn was described as being aggressive and a bit turbulent rather than smooth or gentle. The witness considered that maybe the winds conditions had affected the aircraft. It then flew into Jerusalem Bay and ‘looked fine’.

Variation between witness reports is common and expected and is affected by several factors (such as the angle of observation, opportunity to observe, focus of attention, familiarity with aviation operations, expectations, and elapsed time before reporting among other reasons). As such, it was likely that the normal turn reported by the majority of witnesses was most accurate.

Jerusalem Bay

In Jerusalem Bay, 6 of the 13 witnesses observed the aircraft flying along the bay while only 2 of the 11 witnesses in Pinta Bay saw the aircraft just prior to the steep turn was commenced. All of these witnesses reported that the aircraft appeared normal and in control. Specifically, the aircraft was described as:

• Being reasonably level and there did not appear to be anything unusual, there were no abrupt movements and it appeared to be in control.
• Flying in a straight line, and there was nothing unusual.
• Appearing normal and in trim.
• Multiple witnesses stated that it was being manoeuvred smoothly and there were no sudden movements.
• There were no indications suggesting that the aircraft was experiencing difficulties.
• Looking normal until it made the turn, it was flying relatively straight.
• Level and did not appear to be landing; it was not all over the place and there were no indications to suggest that there were any issues.

One witness was positioned on the northern side of Jerusalem Bay, but to the east of the accident location. That witness reported that, from his previous floatplane observations, the aircraft appeared normal, and there was nothing untoward. It was in control and was ‘perfectly stable’. He thought that the aircraft was intending to fly over the terrain at the end of the bay, although it did not appear to climb any higher. Several other witnesses had also considered that the aircraft was intending to climb above the terrain at the end of the bay.

Aircraft flight path

After the turn in Cowan Water was conducted, 13 witnesses saw the aircraft entering and flying along Jerusalem Bay, of which eight reported that it was maintaining straight‑and‑level. Two witnesses specifically stated that the aircraft was not climbing, while one witness believed it was either level or slightly descending. Two other witnesses who were travelling north up from the Cottage Point area observed the aircraft tracking to the west from Cowan Point into Jerusalem Bay. They both had an unobstructed side-on view of the aircraft and reported that it was descending at a slow steady angle, as if there was an intention to land.

Of those witnesses who observed the aircraft flying along Jerusalem Bay, 10 were able to comment on where the aircraft was positioned in the bay. From this, seven witnesses indicated that it was positioned on the southern side of the bay. Two witnesses reported that it was in the middle, while one stated it was on the northern side.

Height above the water

There was some disparity in the witness observations regarding the height of the aircraft above the water.^[37] Of all the witnesses interviewed, 22 were able to provide an estimate of the aircraft’s height. Eleven stated that the aircraft was between 10 and 50 m (33-164 ft) above the water, while three indicated it was 100 m or more (above 328 ft). Where witnesses referenced the surrounding 

terrain, six stated that the aircraft was between half-way and up to the top of the terrain, while two mentioned that it was either at, or above the terrain height.^[38]

One witness was positioned on the northern side of Jerusalem Bay, and slightly west of Pinta Bay. Using their knowledge of the height of similar terrain in the area, the witness estimated that the aircraft was 30-50 m above the water. The witness further stated that the aircraft remained level or descended slightly. When it reached Pinta Bay, there was a yacht in the bay with a 15 m mast, and the aircraft was only slightly higher than that, about 25 m off the water.

The two witnesses who had an unobstructed side-on view of the aircraft flying west while they were travelling north from Cottage Point reported that the aircraft was 10-15 m above the water or half-way up Shark Rock Point (Figure 4).

Engine sound

Two witnesses in Cowan Water, and 15 in Jerusalem and Pinta Bays heard the aircraft and indicated that the engine sound was loud, it was revving hard, but it remained constant. It was not misfiring, fluctuating or spluttering and there were no indications to suggest that the aircraft was in trouble. Witnesses who had previously observed floatplanes also indicated that the sound was normal.

An eyewitness on a vessel not hear anything due to the wind. However, a family member on the nearby shore commented that she heard the aircraft and then the engine stopped, and 1‑2 seconds later, she heard the impact. Another witness also mentioned that for a split second before the impact it went quiet.

Steep turn in Jerusalem Bay

Of the 24 witnesses located in Jerusalem and Pinta Bays, nine did not observe the aircraft conduct the steep turn, three did not describe the extent of the turn, but the remaining 12 reported that it was a sudden steep turn, with a bank angle up to 80-90°.^[39] Of those 12 witnesses, seven were in a suitable location to indicate that the aircraft had flown at least half-way through the turn before the nose dropped. Specifically, they described their observations as:

• Could see the underneath of the aircraft and it appeared shaped like a red cross.
• During the turn, the nose of the aircraft 'looked pretty level'. The aircraft then became obscured by the headland, at which time the wing tips were straight up and down, and the aircraft was about halfway through the turn.
• The aircraft banked 'hard', about 90° and could only see the floats and wings.
• The witnesses initially heard an aircraft and then turned to observe the underside of the aircraft; it was horizontal and in a 90° turn.
• When the aircraft was abeam Pinta Bay, it suddenly banked steeply right at an angle of about 80° and commenced a U-turn. When about half-way through the turn, the aircraft began to lose height and the turn appeared to tighten slightly. The aircraft then appeared to ‘slide out of the air’. When about 130-140° through the turn, the right wing impacted the water.
• The wings were initially in a near vertical position and then half-way through the turn, the nose lowered, at which point he realised the aircraft was in trouble.

Medical and pathological information

Pilot-related information

Aviation medical examinations

The pilot’s aviation medical records were provided by Transport Canada for the period 2008 to 2014. Overall, these examinations found that the pilot’s respiratory, cardiovascular and neurological systems were all normal, and that he was fit and healthy. Further, the records indicated that there was no family history of cardiovascular disease or hypertension.

The pilot’s Australian medical records were provided by CASA for the issue of his Class 1 Aviation Medical Certificate in 2012, 2013, 2014 and 2017. This also included a medical assessment from the Republic of Maldives. Similar to the above, the pilot was assessed as being fit and healthy, and there was no family history of heart disease under the age of 60 years. The records further stated that the pilot had:

• never experienced chest pain, palpitations or high blood pressure
• not been diagnosed with ischaemic^[40]or coronary heart disease
• never experienced symptoms of shortness of breath or coughing up blood
• never had frequent severe headaches, head injury, unconsciousness, fits, faints, blackouts, funny turns, dizziness, tremors or weakness of the limbs.

Electrocardiograms

As part of the pilot’s annual medical examinations, he was required to have specialist tests dependent on his age. For example, on initial issue for a Class 1 medical, CASA required the pilot to have audio and eye examinations, an electrocardiogram (ECG),^[41]and serum lipids (cholesterol) and blood glucose testing. Thereafter, an ECG was required at 25, 30, 32, 34, 36 and 38 years of age. Between 40-80 years an ECG was required yearly.

Most of the ECGs performed showed that the pilot had sinus bradycardia, which was a slower than normal heart rate typically resulting from good physical fitness, taking medications, or from a heart blockage. Hafeez et al. (2020) stated that sinus bradycardia was an ‘incidental finding’ in many healthy adults and was commonly found in athletes. Similarly, the Harvard Medical School (2019) also indicated that, bradycardia:

…even as low as 50 beats per minute, can be normal in athletes and other people who are physically active. In these people, regular exercise improves the heart’s ability to pump blood efficiently, so fewer heart contractions are required to supply the body’s needs.

However, it was also noted that bradycardia can also be a form of heart-rate abnormality. Those who do experience symptoms may present with fatigue, exercise intolerance, light headedness, dizziness, syncope (fainting or sudden temporary loss of consciousness) or presyncope (a feeling of light headedness), worsening of anginal symptoms, worsening of heart failure or cognitive slowing. However, the majority of individuals with sinus bradycardia do not experience symptoms (Hafeez et al., 2020).

Several of the pilot’s ECG tracings were reported with a range of abnormalities. This is usually due to the nature of embedded algorithms in ECG recording devices designed to generate automated ECG reports. Subsequent reviews of these reported ‘abnormalities’ by cardiologists deemed these ECG tracings to be within normal limits (and therefore acceptable for medical 

certification to fly). In addition, in 2016, the pilot underwent an echocardiogram,^[42] a stress test^[43] and magnetic resonance imaging (MRI)^[44]of the heart. The results of these were examined by a specialist who determined that the pilot was fit for all types of duties and training.

The ATSB engaged an aviation medical specialist who reviewed the above records and considered them to be unremarkable.[4] He also concluded that there was nothing identifiable in the pilot’s family history that raised any concerns about the pilot’s medical fitness.

General health

A review of some of the pilot’s personal medical records determined there was nothing of significance and there were no indications that he was taking any prescription medications. It was further established that the pilot exercised regularly, attended the gym every 2-3 days, and was considered to be very fit.

With regard to drinking and eating on the day of the accident, the pilot was observed in the morning filling up his water bottle. Further, after returning to Cottage Point at about 1400, the pilot went to the kiosk and purchased a coffee and food. A muesli bar wrapper was also found on the pilot. There was no evidence to indicate any concerns with regard to the pilot’s general health.

Post-mortem and toxicology results

A full post-mortem examination and toxicological analysis was performed on the pilot.^[46] That examination established that he received fatal injuries sustained during the impact sequence. There was no evidence found to indicate that he had suffered from any pre-existing medical condition that would have contributed to the accident. Further, the initial toxicology results did not identify any substance that could have impaired the pilot’s performance (refer to section titled Supplemental toxicological testing for carbon monoxide exposure).

The ATSB’s aviation medical specialist reviewed the post-mortem findings and determined that the neuropathological and histological examinations of the pilot’s vital organs (including the heart and brain) did not identify any natural disease that could have caused or contributed to the accident.

The specialist also noted that there were no fractures to the pilot’s upper and lower extremities such as the hands and feet. However, the specialist could not say with certainty if this suggested that the pilot did not have his hands and feet on the controls at the time of the impact. Further, the nature of the injuries suggested that the pilot was alive at the time of the impact, although it was not possible to determine if he was conscious or unconscious. There were also indications that the pilot was wearing a lap-sash style seatbelt.

The examination further identified that the pilot had a thyroid condition. However, the pilot’s family were not aware of him having had any indicators of such a condition and he had never mentioned displaying any of the symptoms.

The results of the examination also suggested that the pilot possibly had mild dehydration, however, the clinical significance of this was uncertain.

In addition, when compared with the front seat passenger, the aviation medical specialist stated that the pilot’s injuries were more severe, possibly due to his proximity to the control column.

Cardiologist review

After reviewing the pilot’s aviation medical records, post-mortem and initial toxicology results, the ATSB’s aviation medical specialist concluded that there were no indications of a pre‑existing condition that could have caused or contributed to the accident. However, he was of the opinion that sudden cardiac death or cardiac incapacitation remained a possibility. Consequently, the ATSB engaged a specialist cardiologist to examine the pilot’s aviation medical records, ECGs, and post-mortem results.

The cardiologist concluded that, although the pilot’s ECGs showed an incomplete right bundle branch block,^[47] this was quite a common finding in healthy people. Further, a number of cardiac conditions were able to be excluded from the ECG results, and overall, the ECGs and the medical records were considered to be those of a healthy individual. In addition, although the echocardiogram conducted in 2016 suggested mild right ventricular dilatation, the subsequent MRI did not show any abnormalities with the right ventricle. The exercise stress test, echocardiogram and MRI findings were all considered normal.

The cardiologist reviewed the pilot’s post-mortem and found no abnormalities with the heart to suggest a sudden incapacity.

In an attempt to identify any genetic patterns known to be associated with sudden cardiac death, analysis of the pilot’s post-mortem DNA was conducted. The results of that genetic analysis were negative, and the cardiologist indicated that they were not useful in deciding or diagnosing any pathological condition causing sudden cardiac death.

Passenger-related information

Post-mortem and toxicology results

Limited post-mortem examinations were performed on the passengers along with toxicological analysis. The post-mortem examinations of the passengers established that they had succumbed to either the injuries sustained during the impact, or a combination of the injuries and subsequent immersion. The initial toxicology results for all the passengers were insignificant (refer to section titled Supplemental toxicological testing for carbon monoxide exposure).

There were indications that the front seat passenger was wearing a lap-sash seat belt at the time of the impact. As mentioned above, the ATSB’s aviation medical specialist also noted that this passenger had received lesser injuries when compared with the pilot.

There were no visible indications on both the middle row passengers regarding the presence of seatbelts (refer to section titled Seatbelt positions). The middle row left seat passenger had also sustained a significant skull fracture during the impact. The ATSB’s aviation medical specialist indicated that this most likely resulted from being restrained by a lap belt only and subsequent hyperflexion into the pilot’s seat or possibly the pilot during the initial stages of the impact sequence. The right seat passenger did not sustain similar injuries.

The injuries received by the rear seat passengers were consistent with wearing lap-style seat belts.

Medical history

A review of the passengers’ medical histories was conducted based on medical records obtained by the police and information provided by the next-of-kin. The eldest passenger was a diabetic, and was taking medication for this, and for cholesterol and blood pressure. Otherwise, this passenger was considered to be in good health. Overall, there were no apparent pre‑existing conditions that could have been expected to result in an in-flight medical event with the passengers.

In addition, the next-of-kin advised that one of the passengers was a regular smoker. Another passenger was also considered a social smoker, but it was very unlikely that this passenger would have smoked while at the restaurant.

Supplemental toxicological testing for carbon monoxide exposure

Test results

The ATSB was of the understanding that testing for carbon monoxide (CO) exposure was conducted as part of the initial toxicology examinations performed on the aircraft’s occupants. However, during the internal review process of the draft investigation report, the ATSB’s aviation medical specialist recommended that this be confirmed with NSW Health Pathology on behalf of the NSW State Coroner. The ATSB were subsequently advised that CO testing was not part of the standard toxicological testing. As such, testing of the occupants retained blood samples was conducted and the results provided in March 2020. Those results found that the pilot, and the youngest and eldest passengers had 11, 10 and 9 per cent respectively of carboxyhaemoglobin (COHb) in their blood. The other three passengers each had 4 per cent COHb.

The levels of COHb detected in relation to the occupants’ seating position within the aircraft cabin are shown in Figure 32. The significance of these results is discussed further in the section titled Physical symptoms and cognitive performance effects of carbon monoxide exposure.

Figure 32: Occupant seating positions and associated COHb levels

Source: ATSB

Regarding the levels identified in the two passengers, the forensic pathologist assisting the NSW Coroner indicated that children have a higher metabolic rate and breathe at a faster rate. Therefore, the youngest occupant would have likely taken more breaths in the same period of time as the adults. Similarly, the eldest occupant may have also been breathing at a faster rate for medical reasons or was less conditioned. In which case, this passenger would have likely been more affected by CO at lower levels than an otherwise healthy adult.

Reliability and validity of the testing

As the testing was conducted about 2 years after the accident, the reliability and validity of the blood samples and subsequent results were considered. The ATSB engaged a forensic and aviation pathology specialist to review the results of the CO testing, referred to forensic toxicology senior scientists at NSW Health Pathology, and received correspondence from the police who consulted their forensic pharmacologist.

NSW Health Pathology advised that they had used sodium dithionite to treat the post-mortem blood samples prior to the CO testing, to avoid potential methaemoglobin interference.^[48] The police pharmacologist also stated that, given that sodium dithionate was used, and the samples contained preservatives to reduce bacterial contamination effects, any changes to the blood CO levels were likely minimal. The ATSB’s forensic specialist also concluded that the test results were very likely accurate, given the preservation of the samples and the stability of COHb. 

Further, NSW Health Pathology also noted that there has been many international studies on the stability of CO in clinical and post-mortem blood samples. The results of those studies have indicated that there is an insignificant change in CO concentration over 2 years, regardless of the preservation or storage method used (Ghanem et al., 2012; Kunsman et al., 2000).

In addition, NSW Health Pathology conducted an internal validation of their testing equipment and determined a measurement of uncertainty of CO analysis in blood of up to 5 per cent. For a COHb of 10 per cent, this would result in a maximum error of 0.5 per cent COHb. That is, 10 per cent COHb ± 0.5 per cent. The COHb levels detected in the occupants and associated measurement of uncertainty is shown in Table 4. 

Table 4: Occupant COHb levels, error values, and adjusted levels

Occupant COHb level (%)	Error (%)	Adjusted occupant COHb level (%)
11	0.55	10.45-11.55
10	0.5	9.5-10.5
9	0.45	8.55-9.45
4	0.2	3.8-4.2

Source: ATSB

Medical specialist reviews

ATSB’s forensic and aviation pathology specialist

The ATSB’s forensic and aviation pathology specialist reviewed the results of the CO testing and amended post-mortem reports. Taking into account the circumstances of the accident, the specialist concluded that:

• Given the elevated levels of COHb found in the pilot (11 per cent) and two of the passengers (10 and 9 per cent), it was very likely that CO was present in the aircraft cabin.
• The physical symptoms and cognitive effects of CO exposure generally start to occur at COHb levels of around 10 per cent. This includes headaches, nausea, dizziness, confusion, and disorientation. These will become more severe with increasing COHb levels and duration. In this case, the pilot was almost certainly experiencing some, if not all of these.
• The passengers with 9 and 10 per cent COHb saturation levels were are also likely experiencing symptoms, possibly distracting the pilot. 
• While the elevated levels were not fatal, they were certainly capable of resulting in pilot incapacitation^[49] in the form of headaches, nausea, confusion, disorientation, and visual disturbance. 
• There were no other medical factors identified that would have resulted in pilot incapacitation.
• The pathological findings indicated that the pilot was alive at the time of impact, but not necessarily conscious. 
• The passengers with 4 per cent COHb saturation levels were unlikely to have been experiencing any physical symptoms.
• The finding of 4 per cent COHb found in the smoker was of less significance as they may usually have had elevated levels similar to this. However, it was also possible that this was due to CO exposure from within the cabin.
• The observed difference in COHb levels for the six occupants may have been related to their seating positions with regard to the source of CO and airflow patterns within the cabin, as well as their smoking history.

NSW Police forensic pharmacologist

As part of the police investigation into the accident, they consulted their forensic pharmacologist regarding the CO levels detected in the occupants. The pharmacologist concluded that, at a COHb concentration up to about 11 per cent, the potential physical symptoms could include headache, breathlessness, weakness and confusion. However, it was likely that the pilot would not have displayed any obvious symptoms, although it could not be completely discounted that some confusion and impairment of complex psychomotor skills would have been experienced. It was also possible that the pilot may have had adverse effects such as decreased vigilance, impaired visual perception and manual dexterity.

The pharmacologist further noted that the CO levels of the occupants may have differed due to their seating positions in relation to the source of CO and the individual’s susceptibility to CO, which can vary depending on their health.

Observations of previous passengers

The passengers who last flew with the pilot arrived at Cottage Point at about 1353. Those passengers reported that there was no indication that the pilot was experiencing any obvious symptoms or effects of CO exposure. They specifically stated that the pilot was articulate and animated when talking about his flying experiences. In addition, they also indicated that they did not experience any of the common physical symptoms associated with CO exposure such as nausea, dizziness, headaches and shortness of breath.

Observations of pilots who recently flew VH-NOO

A company pilot who flew the aircraft in the days leading up to the accident reported that he did not notice anything out of the ordinary. Similarly, another pilot indicated that he did not believe he experienced any of the typical symptoms or effects associated with CO exposure.

Survivability

The ATSB’s aviation medical specialist concluded that, given the extent of the impact forces and injuries sustained, it was very likely that the pilot and passengers would have been rendered unconscious as a result of the impact. This, combined with the severity of their injuries, meant that an underwater escape would not have been possible.

Survivability aspects

Pre-flight passenger brief

Closed-circuit television footage (video only) showed that, prior to boarding VH-NOO at Rose Bay, the passengers received a pre-flight safety briefing at the aircraft boarding pontoon. The operator stipulated that the following was to be included in the briefing:

• Seatbelts: Instructions on how to fasten, adjust, and release the seat belt, and that they were to be worn at all times throughout the flight while seated.
• Emergency exits: The location of the emergency exits, which in the DHC-2 was the two doors at the front of the aircraft and two in the middle row. The brief would also detail the location and use of the door handles. Specifically, that the middle row exit door handles were located behind the seats. Noting they would have to reach behind and alongside the seat to access the handle, also accessible to the rear seat passengers. Once passengers were seated inside the aircraft, the importance of locating the door handle was emphasised.
• Life jackets: A demonstration on how to correctly wear the life jacket, for it to be fastened around the waist over the seat belt, and to be worn at all times. The brief also discussed how to operate the life jacket in the event of an emergency and not to inflate the jacket until outside the aircraft.
• Single-pilot operations: Detail the requirement of the passenger occupying the front (copilot) seat not to interfere with the controls during the flight.
• Safety briefing cards: Safety briefing cards were located in the seat pockets and described the location and operation of safety equipment.
• Other safety equipment and considerations: The location of motion sickness bags, first aid kits, fire extinguishers and survival equipment. Passengers were to be advised that headsets were provided for noise protection, electronic devices were permitted for use during the flight, the proper stowage of hand luggage under the seats, and smoking was not permitted.

Search and rescue response

The aircraft collided with the water just before 1514,^[50]came to rest inverted and was partially submerged, with the tail and floats remaining visible above the waterline. Witnesses on nearby vessels immediately responded to render assistance. A number of those people dived into the water to access the cabin. However, they indicated that the aircraft was too deep, visibility was poor, and there did not appear to be any movement inside the aircraft.

A number of witnesses contacted the emergency services, who were en route to the accident within 10 minutes. In the meantime, as the aircraft was sinking, witnesses attached a buoy and rope to the tail to mark the accident location. The aircraft became completely submerged at 1526.

At 1532, the water police arrived, followed shortly after by Marine Rescue, and the rescue helicopter at 1541. A police dive team reached the accident site at 1636 and subsequently located the aircraft at a depth of 13.7 m. All occupants were recovered from the aircraft by early evening on the day of the accident.

Seatbelt positions and life jackets

One passenger was located in the front right seat next to the pilot, two passengers were on the bench seat in the middle row and two passengers in the rear bench seat.

The police divers found the pilot in his seat, but he was recovered without having to release his seatbelt. The front passenger, two passengers in the rear seat, and the passenger in the middle row left seat were found with their seatbelt clasps fastened. The police were uncertain if the middle row right passenger had his seatbelt fastened.

The ATSB reviewed the police dive video in an attempt to establish the state of the middle row right passenger’s seatbelt before the removal of the occupants from the cabin. The video showed that, when the divers first arrived at the aircraft, an unfastened seatbelt (buckle end) was observed moving freely in the water near the right cabin door. This seatbelt was associated with the middle row seat. As the left seat passenger’s seatbelt was still fastened, this seatbelt was either from the middle or right seat. However, the ATSB’s wreckage examination established that the seatbelt for the middle seat was not long enough to reach the right cabin door. Therefore, the unfastened seatbelt observed was that from the middle row right seat.

All occupants had their life jackets fitted and none had been inflated.

Crashworthiness

Survival of occupants in an aircraft accident requires tolerable deceleration forces, the continued existence of a liveable space inside the cabin, a restraint system to prevent injuries, and a means of escape and subsequent rescue for the occupants.

Impact severity

Impact severity increases with both impact speed and impact angle. Witnesses reported a steep flight path angle following the nose drop during the steep turn.

The US National Transportation Safety Board’s (NTSB) general aviation crashworthiness project provided guidance on the factors affecting the impact forces and indicated that differences in speed during an impact had a direct effect on the survivability of the impact. The guidance stated that the upper limit speed for survivable accidents was 60‑70 feet per second (fps).

Although it can be difficult to accurately estimate the bank angle of an aircraft by observation only, if the lower limit of the bank angle during the turn was 60° and the aircraft was configured with climb flaps, the aircraft had an airspeed that was at least the stall speed of the aircraft. This would provide a lower limit on the potential impact speed.

The stall speed decreases with the use of flaps. The flight manual did not list the stall speed for the aircraft configured with climb flaps, but did for a 1g stall with landing flaps. The 1g stall speed with landing flaps at maximum gross weight was listed as 45 mph, which was 75 per cent of the flaps up stall speed of 60 mph (52 kt). Using this same proportion for a 60° bank angle stall speed of 105 mph (refer Figure 12), the stalling speed at 60° bank angle when configured with landing flaps was estimated to be 0.75 x 105 = 79 mph (115 fps, 69 kt). Thus, the speed at impact was likely to be at least 115 fps. From Table 3, the climb and landing flap configurations are 15° and 50° flap deflection, respectively. Thus, the stall speed with climb flaps would be closer to the flap up stall speed than the landing flap stall speed, indicating that the speed at impact was likely to be even higher than the landing flap estimate.

Therefore, the accident impact speed was in the order of twice that considered to be a survivable impact, and hence, this accident was not considered to have been survivable.

Occupant restraint system

The pilot and front row passenger seats were both fitted with lap and shoulder restraints (three‑point lap‑sash seatbelts). The remaining six passenger seats were fitted with lap belts only. There was no regulatory requirement for the fitment of upper body restraints to other than the front row of seats for aircraft built before December 1986.^[51]The passenger seats and seat attachment fittings had last been inspected on 6 November 2017 as per the requirements of CASA airworthiness directive AD/DHC-2/26 Amendment 1.

The ATSB’s examination of the occupant restraint system found:

• Front row: Both front row seats had broken away from their floor attachment points and the shoulder harness upper attachment points had failed in overload. The seatbacks were significantly deformed in a forward direction, indicative of contact from both middle row seat occupants.
• Middle row: The lap belts in the middle row were relatively undamaged and remained attached to the seat. The bench seat had separated from the floor as a result of overload of the seat‑to‑floor attachment points. The damage was indicative of a progressive failure from left to right (Figure 33). Damage to the seat indicated that, on the left side, the seat had collapsed vertically then forward, consistent with the seat being occupied. The seat collapse and subsequent twisting would have resulted in the feet separating from all three floor attachment points on the left side. The right seat support structure did not display evidence of collapsing in a vertical direction.
• Rear row: The rear row seat base support tube had broken and the attachment points for the seatbelts being used had failed in overload.

The occupants’ seat attachment and restraint overload failures indicated that the impact forces had exceeded the design limitations. These failures meant that the occupants would not have been sufficiently restrained during the final stages of the impact sequence.

Figure 33: Middle row seats showing structural damage and seatbelts

Source: ATSB

Organisational and management information

Sydney Seaplanes

Sydney Seaplanes had been operating since 2005. Based out of Rose Bay, they conduct scenic flights around the Sydney area, and fly to numerous restaurants and accommodation in the region, with approximately 27,000 passengers travelling per year. At the time of the accident, they had five aircraft: two DHC-2, two Cessna 208’s, and one Cessna 206.

Air operator’s certificate

A CASA air operator’s certificate (AOC) was re-issued to the operator on 25 June 2015, valid until 30 June 2018. The AOC schedule stipulated that the operator was authorised to conduct charter operations in the Cessna 208 and single-engine piston aircraft with a maximum take-off weight less than 5,700 kg, such as the DHC-2. In addition, for operations conducted in the authorised aircraft types above, the operator was permitted to conduct amphibious operations and operate aircraft fitted with float alighting gear.

Subsequent to the accident, the operator’s AOC was re-issued on 19 June 2018, valid until 30 June 2021, with the same provisions stipulated above.

CASA surveillance

On 19 September 2017, CASA had conducted an on-site audit of the operator, which included an examination of both airworthiness and flying operations, and an observation flight on the DHC‑2. The Civil Aviation Safety Authority found the operator to be compliant with the regulations and the activities observed were very efficiently conducted in a professional and confident manner. No safety concerns were raised by CASA as a result of their surveillance.

Airag Aviation Services

Airag Aviation Services (previous known as Aerial Agriculture Pty. Ltd.) has been operating since the 1950s and have been maintaining DHC-2 aircraft since that time. They held a valid CASA Certificate of Approval. Based at Bankstown Airport, their work primarily consisted of maintenance inspections, modifications, repairs, and restorations.

On 18 October 2017, CASA conducted an on-site audit of Airag Aviation Services. While the primary purpose of the audit was to introduce new CASA personnel, no findings were issued at that time.

Civil Aviation Safety Authority post-accident regulatory and safety review

Following the accident, CASA conducted a regulatory and safety review. The review found no evidence to suggest that the operator and maintenance provider were non‑compliant with the provisions of their respective AOC and Certificate of Approval. The review did not identify any immediate action that CASA considered in the interests of aviation safety.

Passenger information

VH-NOO passengers

The passengers were international visitors from the UK. Family members provided the police with a summary of the passengers’ background and character. From this, it was apparent that they were well-educated, highly respected individuals and were a close-knit family. Staff at the restaurant at Cottage Point also reported that there was nothing untoward in the passengers’ behaviour, and they were well-mannered, quiet and happy customers. This was consistent with photographs of the passengers taken while at Cottage Point. Further, a family member who regularly flew gliders reported that the male passengers had not shown any particular interest in flying.

Passenger route deviation requests

The operating pilots reported that any requests from passengers to deviate off their standard flight path were predominately from locals wanting to see their house rather than international passengers. Further, the pilots stated that they would be accommodating if it was along the flight path, but they would not deviate too far off track.

With regard to the accident pilot, the operator indicated that it would have been uncharacteristic for the pilot to deviate off track at the request of a passenger. They specifically noted that, several 

weeks prior to the accident, the pilot had conducted a flight with one of the operator’s owners. The owner had requested that the pilot deviate from the standard flight path, however, he declined and continued with the flight as scheduled.

Pilot-passenger area

The operator’s pilots and other DHC-2 pilots reported that they had never been physically interfered with by a passenger, either intentionally or accidentally, sufficient to affect the operation of the aircraft. They also indicated that there was sufficient room in the cockpit for the pilot to operate the aircraft without issue. While it was noted that a pilot had to reach down in between the seats to manipulate the flap selector and hydraulic hand pump, there was adequate room to do this. A reconstruction flight carried out by the police (refer to section titled Steep turns) also identified that there was sufficient space between the pilot and front seat passenger to operate without interference.

General passenger conduct and medical events

The operator’s pilots indicated that they generally had no issues with the conduct of passengers, particularly from Cottage Point and they had never observed any aggressive behaviour.

Regarding in-flight medical events, if a passenger had motion sickness, they would consider landing. If a passenger experienced a serious medical issue, they would continue to a location such as Palm Beach or even Rose Bay where emergency services were more readily available.

Operational information

Cottage Point departure

Cottage Point is located at the junction of Cowan Creek, and Coal and Candle Creek in the Ku‑ring-gai Chase National Park, about 26 km north of Sydney Harbour. Cottage Point was considered one of the operator’s most popular destinations, which was about a 20 minute flight from Rose Bay.

The operator’s authorised landing area (ALA) register provided their pilots with details on each of the locations they operated to, including Cottage Point. This included information such as the recommended approach, go‑around and departure paths; environmental considerations; passenger facilities; and any limitations or potential hazards such as weather, wires, water depths/channels, tidal effects etc. The purpose of the register was to supplement a thorough inspection and assessment of the alighting area by the pilot prior to landing or departing.

Figure 34 shows the recommended flight paths for Cottage Point from the operator’s ALA register. The blue hatching and crossed‑lines represent the take-off area and departure paths respectively, while the approach paths and landing areas are shown in red. Specifically relating to the accident flight, the recommended take-off area was to the north-east of Cottage Point. After take-off, the initial departure path was to follow the river to the north-east passing Cowan Point.

Figure 34: Cottage Point diagram of the recommended initial departure paths from the ALA register

Source: Sydney Seaplanes, annotated by the ATSB (blue labels)

There was no specified route from Cottage Point to Rose Bay, but operating pilots indicated that there were several common routes used (Figure 35):

• One option was to continue tracking east along Cowan Water to the coast and then head south.
• Another, depending on the aircraft’s climb performance, was to continue east along Cowan Water to Refuge and America Bay, and then track to the south-east over the terrain.
• An alternative was to conduct a reversal turn in Cowan Water and follow the waterway back towards Cottage Point and depart via Coal and Candle Creek.

Company pilots that had conducted the reversal turn indicated that, to ensure that the required terrain clearance was achieved, they only did this when the aircraft’s weight was low or there were no passengers on board. They would also typically conduct the turn when in the vicinity of Fishermans or Hallets Beach. One of the company pilot's also reported previously observing the accident pilot conduct a right reversal turn in Little Jerusalem Bay and a left turn near Hallets Beach.

Another floatplane operator, who was not flying on the day, reported that he had performed this turn to the east of Jerusalem Bay near Little Shark Rock Point. On the day of the accident, Airservices Australia surveillance data showed that the pilot of VH-AAM (once) and the pilot of VH-NOO (twice) had returned via Coal and Candle Creek.^[52] Photographs and video footage taken by passengers on one of these flights earlier in the day showed that the pilot of VH-NOO had conducted a reversal turn over Cowan Creek near Yeomans Bay. The second flight was a positioning flight without passengers from Cottage Point to Rose Bay.

There were no departure routes via Jerusalem Bay.

Figure 35: Cottage Point reported common departure paths to the north-east

Source: Google earth, annotated by the ATSB

The ALA register noted that there was limited VHF (very high frequency) radio communications in the Cottage Point area due to terrain shielding and that a relay of broadcasts may be possible using overflying aircraft. In addition, if the wind conditions exceeded 30 kt, the ALA was considered unusable.

Jerusalem Bay

General description

Jerusalem Bay is part of the Cowan Water, Hawkesbury River waterway (Figure 36). The bay is surrounded by the Ku-ring-gai Chase National Park and is popular with recreational boaters. It is about 2.3 km long, 600 m wide at its entrance, and progressively narrows with the terrain rising steeply to an elevation above 200 m (650 ft). On both the northern and southern banks, the terrain rises steeply with peaks of 200 m (650 ft). The distance from the accident site to the end of Jerusalem Bay at water level was about 1.2 km.

Figure 36: Jerusalem Bay topographic map (top) and image taken from drone footage looking west to the end of Jerusalem Bay (bottom)

Source: NSW Government Spatial Services, annotated by the ATSB (upper) and NSW Police Force (lower)

About 1 km into the bay on the southern shore is Pinta Bay. The elevation along the southern escarpment between Cowan Creek and Pinta Bay ranged from 54 m (177 ft) in the vicinity of Shark Rock Point to 67 m (220 ft) towards Pinta Bay (Figure 37).

Figure 37: Elevation profile of southern escarpment along Jerusalem Bay

Flying in Jerusalem Bay

Sydney Seaplanes personnel indicated that there was no operational need for the aircraft to be in the bay. The bay was not on their standard flight path and the terrain rose faster than the aircraft could climb. In addition, there was nothing in Jerusalem Bay from a sightseeing perspective.

The pilot’s work colleagues stated that the pilot was well aware of the bay and that it was a ‘dead end’ with high terrain. They further indicated that, if for some reason they flew into the bay, even with the tailwind, the conditions were suitable for landing. The chief pilot also advised that the DHC-2 only required about 200 m within which to land.

In terms of activity in the bay, one pilot reported that he had landed in the bay once before on a private flight. He further indicated that the only time he would fly down the bay was when coming from Berowra Waters to Cottage Point, where he would descend from the west into the bay and then land south in the Cottage Point area. He did note having previously seen a private ultralight floatplane in Jerusalem Bay.

Similarly, another floatplane operator indicated that he had landed and taken off in the bay possibly 4‑5 times dropping off/picking up people from a boat. However, he also stated that there was no operational reason to be flying in the bay when operating from Cottage Point.

Multiple witnesses who were familiar with floatplane operations in the area reported they had never observed an aircraft in Jerusalem Bay before. Some specifically stated that they had:

• seen aircraft flying above the terrain
• observed an aircraft drop people off in Pinta Bay
• seen aircraft normally track east toward the ocean
• not seen them flying that low before.

Vessel traffic in Jerusalem Bay

Witness reports and images taken as they approached the aircraft indicated that there were no vessels or obstructions in the main waterway. Vessels in Jerusalem Bay were either anchored on the northern shoreline, at the far end of the bay, or in Pinta Bay.

Weight and balance

Weight and balance for the flight

In accordance with the operator’s booking procedures, the passengers provided their individual weights at the time of booking the flight, about 4 weeks prior to the accident, which totalled 452 kg. The operator’s records showed that these weights were used by the pilot on the day of the flight to determine the pre-flight weight and balance. The pilot’s calculations indicated that the aircraft was below the maximum take-off weight of 2,309 kg when departing Cottage Point. The operator and ATSB independently calculated the aircraft’s take-off weight using the passenger supplied weights, and by estimating the fuel on board and baggage weights. The seating positions were ascertained from a review of the passenger photographs. Both confirmed that the calculated aircraft weight was below the maximum take-off weight and within the centre of gravity limits.

As part of the post-mortem process, the occupants were weighed. These weights were greater than those volunteered by the passengers. The forensic pathologist assisting the NSW State Coroner advised the ATSB that variations such as wet clothing, the life jacket, and the effects of immersion in water could account for no more than 5 kg additional per occupant. Taking this into consideration, the combined passenger weights for the flight (totalling 478 kg) were underestimated by at least 26 kg. It was noted that the difference between the pilot’s weight used for the pre-flight weight and balance calculation, and the post-mortem weight was 3kg. However, for consistency, the 5 kg was taken into account. Based on these revised occupant weights, the aircraft was found to be just below the maximum take-off weight when departing Cottage Point and the centre of gravity was at 283.5 kg.mm/1,000, which was within the forward (72 kg.mm/1,000) and aft (360 kg.mm/1,000) limits.

Volunteered passenger weights

The Civil Aviation Safety Authority’s Civil Aviation Advisory Publication (CAAP) 235-1(1), Standard passenger and baggage weights, provided guidance on the use of standard passenger weights (refer to section titled Standard passenger weights below) or actual weights obtained by weighing all the occupants. Further, the publication advised the use of actual rather than standard passenger weights in aircraft with less than seven seats to avoid overloading.

Other regulatory authorities allowed alternative means regarding the determination of passenger weights. For example, the Civil Aviation Authority of New Zealand (2011) required operators to establish a passenger’s weight by one of three methods: actual weights, standard weights pre-determined by the operator, or by ‘a weight that has been declared by the passenger plus an additional allowance of 4 kg’.

The US Federal Aviation Administration (2019) indicated that an operator may determine actual weights by weighing each passenger on a scale prior to the flight or asking each passenger for their weight and adding at least 10 lbs (4.5 kg) to account for clothing. They further stipulated that this allowance may further be increased dependant on the route or during certain seasons, such as winter.

Similarly, Transport Canada (2019) defined ‘actual weight’ as the weight derived by actually weighing a passenger just prior to boarding the flight. However, under certain circumstances, ‘volunteered’ or ‘estimated’ weights could be used. These were defined as:

(ii) Volunteered Weight: means weight obtained by asking the passenger for their weight, adding 4.5 kg (10 lb) to the disclosed weight then adding the allowances for personal clothing and carry-on baggage and using the resultant value as the passenger’s weight; or

(iii) Estimated Weight: means where actual weight is not available and volunteered weight is either not provided or is deemed to be understated; the operator may make a reasonable estimate of the passenger’s weight, then add the allowances of personal clothing and carry-on baggage and use the resultant value as the passenger’s weight.

As the DHC-2 had a seating capacity of eight, standard weights could have been used based on the Civil Aviation Advisory Publication guidance; however, the operator elected to use a more representative measure of weights, those supplied (volunteered) by the passengers. The operator did not routinely weigh the passengers prior to a flight. However, staff would conduct a visual assessment of a passenger’s weight during check-in and if they had any doubt, they would then weigh them using scales available at their Rose Bay terminal. For the accident flight, the volunteered passenger weights totalled 452 kg. If a minimum allowance of 4‑4.5 kg per passenger was applied, this would have resulted in a total weight of 472-474.5 kg.

The operator reported that they believed the use of volunteered passenger weights was common practice in the charter industry.

Standard passenger weights

When discussing the purpose of standard passenger weights, CASA’s advice stated that:

The use of the standard passenger weights will, in most cases, ensure that the gross weight of the aircraft does not exceed the maximum take-off weight or the maximum landing weight of the aircraft.

‘To keep the probability of overloading within acceptable limits’, CASA provided a sliding scale of standard passenger weights based on the general Australian population (Figure 38). This scale was grouped by an aircraft’s maximum seating capacity (including the crew) and differentiated between men and women. With regard to the most recent population weights, the Australian Bureau of Statistics (2018) National Health Survey found that the Australian adult male and female had average weights of 87 kg and 72 kg respectively. These weights were similar to the standard weights specified by CASA for an aircraft with a capacity of 7-9 seats (highlighted in 

Figure 38). However, as the number of seats increased, the standard weights became more underestimated when compared with the survey.

Figure 38: CASA standard passenger weights

Source: CASA

If the operator had elected to use these standard weights for the accident flight (highlighted weights in Figure 38), the total passenger weight would have been 373 kg. This was 79 kg less than the weights volunteered by the passengers, and 105 kg less than the actual weights from weighing.  

Aircraft performance calculations

Using an indicated airspeed consistent with a normal climb flap configuration, and taking into account the wind conditions, the ATSB estimated the groundspeed from during the turn in Cowan Water, entering Jerusalem Bay, and to the final turn. This was then used to estimate the time interval between these points as the:

• time from when the last passenger photograph was taken to entering Jerusalem Bay was about 23 seconds
• time from entering the bay until the commencement of the steep turn was about 24 seconds.

Therefore, the total time from the last passenger photograph to the commencement of the steep turn in Jerusalem Bay was about 47 seconds.

From the photographs taken by the passenger in the front seat and altitude estimates established by the ATSB and police (refer to section titled ATSB assessment of passenger photograph locations), the ATSB determined that the aircraft’s average rate‑of‑climb was between 200-240 feet per minute (fpm). Using this, and the time estimates above, if the aircraft had continued to climb after the initial turn in Cowan Water, it should have been about 390-430 ft (119-131 m) above the water at the commencement of the steep turn in Jerusalem Bay. This would have been above the highest point along the southern escarpment, which was 220 ft (67 m).

Radius of turn estimates

At the position where the initial turn in Cowan Water was conducted there was a width of about 760 m available in which to turn the aircraft over water (Figure 39). The ATSB estimated that for the 380 m radius turn, at an indicated airspeed of 70-80 kt, the minimum angle of bank required was 20-25°. Witness photographs of the aircraft early in the turn indicated that the angle of bank at that time was about 15-20°.

At the location of the steep turn in Jerusalem Bay, there was a width of about 320 m available in which to manoeuvre over water (Figure 39). This 160 m radius turn would have required a minimum angle of bank of 41-49° to complete the turn at 70-80 kt. If the aircraft’s speed was higher, the angle of bank required would have also increased.

Of note, the ATSB were advised by an experienced pilot that, following the accident involving VH‑NOO, they had completed a turn in a DHC‑2 with two occupants, under controlled conditions^[53] in the vicinity of Pinta Bay without incident.

Figure 39: Radius of turn in Jerusalem Bay (left) and Cowan Water (right)

Source: Google earth, annotated by the ATSB

Steep turns

When an aeroplane is flying straight-and-level, the total lift is directed vertically up and balances the weight of the aeroplane, which is directed towards the Earth (Figure 40 left). However, when an aeroplane is banked in a level turn, lift produced by the wing needs to balance both the weight and provide the force to turn the aeroplane. The lift produced by the wings acts perpendicular to the wing, so when banked, the vertical component needs to balance the weight of the aeroplane and the horizontal component turns the aeroplane, balancing the centrifugal force (Figure 40 right). As the weight of the aeroplane does not change, the vertical component remains constant, requiring the total lift to be greater than the amount for straight‑and‑level flight. If the lift is not increased, the aeroplane will turn due to the horizontal component, but the aeroplane will descend as the vertical component does not balance the weight of the aeroplane. As the angle of bank increases, the lift required to maintain a constant altitude also increases, requiring the pilot to apply back pressure on the elevator control.

Figure 40: Basic loads on an aeroplane during a level turn

Source: Federal Aviation Administration (2016)

When a pilot deflects the ailerons to bank the aeroplane, both lift and drag are increased on the raised wing and decreased on the lower wing. As a result, the aeroplane will yaw opposite to the direction of turn. To counter this, rudder (through manipulating the rudder pedals) and aileron inputs (rotating the control column wheel left or right) are applied simultaneously in the direction of turn, thereby producing a coordinated turn.

Steep turns are typically performed at bank angles between 45° and 60° and require the appropriate application of engine power and increasing elevator back pressure (aft movement of the control column) to maintain altitude and airspeed during the turn. This was consistent with the comments provided by the operator’s pilots regarding steep turns in the DHC-2. They further emphasised the importance of ensuring that the aircraft was coordinated. Some also indicated that they did not believe the DHC-2 could maintain an 80-90° angle of bank turn.

Another experienced DHC-2 pilot reported that steep turns were very docile, and the aircraft was relatively stable. However, it would require a significant amount of aft control pressure to maintain altitude. If aft control pressure was not applied, the aircraft would descend through the turn. Any turn above 45° angle of bank would require an increase in engine power, possibly climb power and above up to maximum continuous power to maintain airspeed and altitude.

Viking Air also indicated that, if aft movement on the control column was released during a turn, the aircraft would lose altitude. This was demonstrated in a reconstruction flight conducted by the police in VH-AAM. In that flight, the chief pilot was flying the aircraft and commenced a 60° angle of bank right turn. The chief pilot then removed his hands from the control column and the aircraft very quickly went into a nose down attitude and descended.

In addition, several experienced DHC-2 pilots specifically mentioned the amount and coordinated use of rudder when banking the DHC-2. One noted that it, in a turn, it was ‘almost impossible to fly the DHC‑2 accurately and safely without using the rudder’. He also stated that it would be possible to fly the aircraft without using the rudder, but the aircraft would become ‘terribly’ uncoordinated and would get close to a stall-spin situation.

Stalling

Stall accident statistics

The US Aircraft Owners and Pilots Association Air Safety Institute (2017) reviewed 2,015 stalling accidents that occurred in the US between 2000 and 2014 and found that ‘unintended stalls continue to be among the most common triggers of fatal accidents in light airplanes’. Specifically, the research found that, while pilots are taught to recognise, avoid and recover from a stall, they accounted for almost 25 per cent of the fatal accidents over the reporting period. An ‘overwhelming majority’ of unintended stalls involved personal flights, while they accounted for only 7 per cent of all commercial accidents. However, the study found that the number of stall accidents had reduced over the 15-year period. 

With regard to survivability, the research found that aircraft altitude was known with reasonable certainty in 545 of the accidents. Of those accidents where the stall occurred at or below 50 ft, about 15 per cent resulted in fatalities. However, between 50 and 100 ft, about 50 per cent resulted in fatalities.

DHC-2 stall related occurrences

A search of the ATSB’s database since 2003 found nil stall-related DHC-2 occurrences similar to the circumstances of the accident flight involving VH-NOO. However, TSB Canada had previously investigated numerous DHC-2 accidents where a stall had been involved in the accident sequence.^[54] A summary of those accidents are contained in Appendix B – Transportation Safety Board of Canada investigated DHC-2 stall occurrences. Two particular accidents with similar characteristics to this accident were identified.

In October 2016, a DHC-2 was being operated on a flight in British Columbia, Canada with a pilot and four passengers on board. About 24 minutes into the flight, the aircraft collided with terrain. The TSB’s investigation (A16P0186) found that the pilot had commenced a turn away from the hillside and as the angle of bank increased, the stall speed also increased, and the aircraft subsequently stalled. The aircraft was not equipped with a stall warning system. That investigation also cited a number of other stall-related DHC-2 accidents between 1998 and 2015 where a stall warning system was not fitted.

In a 2015 accident (A15Q0120) a DHC-2 was on a 20-minute sightseeing flight with the pilot and five passengers. When on the return trip at 110 ft above ground level, the aircraft stalled in a steep turn. The aircraft descended vertically and collided with terrain. A review of the GPS data found that the increase in the aircraft’s angle of bank reduced the turn radius from 400 ft (122 m) to 275 ft (84 m), and the airspeed increased from 73 mph (63 kt) to 85 mph (74 kt) during the turn. When at an angle of bank of about 50° mid-turn, the airspeed reduced to 60 mph (52 kt), the aircraft had climbed to 175 ft and then it stalled.

Control of the aircraft from the front right seat

The aircraft was configured such that the aircraft could be controlled by a copilot from the front right seat. Normally, to operate from the front right seat requires that the upper portion of the control column, including the hand wheel, be placed in front of the right seat using the throw-over mechanism. However, the ATSB examined what level of control a front right seat occupant may have without the control column being moved from in front of the pilot.

The operator’s pilots reported that it was relatively easy for a person in the front right seat to manipulate the pilot’s controls to roll the aircraft left and right. However, it would be more challenging for that person to apply forward and aft movements on the control to change the aircraft’s pitch attitude.

Another experienced floatplane pilot commented that a strong person could manipulate the controls from the front right seat. Similarly, a person in the middle row of seats could reach over and manipulate the controls. That pilot also stated that, if the aircraft was appropriately trimmed, someone could possibly fly the aircraft in a straight-and-level position.

Carbon monoxide information

What is carbon monoxide?

Carbon monoxide is a colourless, odourless and tasteless gas. It is the by-product of the incomplete combustion of carbon containing materials, but is often associated with other gases 

that do have an odour or colour. The Agency for Toxic Substances and Disease Registry (2012) stated that CO is produced from both human-made and natural sources, including from:

• the exhaust gases from vehicles, recreational watercraft and boats
• gas appliances, furnaces, wood burning stoves and fireplaces
• tobacco smoke, whether as a smoker or through passive smoking
• fuel-powered small engines and tools.

When inhaled, CO is absorbed into the bloodstream where it readily binds with the haemoglobin to form carboxyhaemoglobin or COHb. The binding affinity of CO for haemoglobin is 200-300 times more stronger than that for oxygen. Therefore, CO reduces the oxygen carrying capacity of the blood. In turn, this decreases the release of oxygen to the tissues, directly affecting those parts of the human physiology that rely on oxygen to function properly, such as the heart, brain and central nervous system.

An individual’s COHb levels increase as the duration and intensity of the CO exposure increases. Carbon monoxide has a half-life of 5-6 hours when at normal oxygen concentrations and 30-90 minutes when 100 per cent oxygen is administered (Kunsman et al., 2000). Baselt (2014) also indicated that the half-life for a resting adult at sea level was 4-5 hours, but this may be reduced to about 80 minutes with the administration of pure oxygen.

The amount of CO present can be determined by measuring either the CO levels in the ambient air or the COHb concentration in blood. The measuring devices available for aviation use and the significance of the COHb concentrations are discussed below (refer to sections titled Carbon monoxide detectors and Physical symptoms and cognitive performance effects of carbon monoxide exposure respectively).

Carbon monoxide in aircraft

In aviation, the most common source of CO is from the exhaust gases of piston-engine aircraft. While these engines produce the highest concentration of CO, turbine engines also contain CO (European Union Aviation Safety Agency, 2020).

In 2009, the results of a comprehensive study conducted by the Wichita State University on behalf of the US Federal Aviation Administration (FAA) regarding the detection and prevention of CO exposure in general aviation aircraft was published (Hossein Cheraghi et al., 2009). The purpose of the research was to identify protocols to alert users to the presence of elevated levels of CO in an aircraft cabin, and to evaluate the inspection methods and maintenance practices with consideration of CO.

The study interrogated the NTSB’s safety database to identify occurrences related to CO exposure. Of the 71,712 accidents recorded between 1962 and 2007, 62 accidents (0.09 per cent) were directly related. The source of the CO exposure could be determined in 63 per cent of these, which were attributed to the muffler,^[55] exhaust or heater systems, or a combination of these, although the muffler system was the most prevalent. In addition, the data revealed that a similar number of accidents occurred across the seasons throughout the year. While muffler and heater system-related cases were more prevalent in the colder seasons, the source of a large number of cases in summer were undetermined.

Overall, it was recognised that a significant hazard could result when there was a failure in the exhaust system of a piston engine. Similarly, Slusher (1964) as cited in Lacefield (1982), indicated that, ‘although engine exhaust failures in general aviation aircraft were not frequent, in 70 per cent of the failures, a CO hazard was created in the cabin atmosphere’.

Engine exhaust system failures

While the design of piston-engine exhaust systems can differ between aircraft manufacturers and models, there are a large number of connections that are fundamentally common, which can potentially become fatigued or fail. These include welded joints, and bolts or clamps that connect tubes.

The FAA (Hossein Cheraghi et al., 2009) noted that there were several factors that can lead to the deterioration of an exhaust system: piston-engines operate at varying revolutions per minutes, from idle to maximum take-off power, which can result in vibration-type fatigue; and the high temperature and corrosive effect of piston-engine exhaust can result in thermal fatigue or corrosion. In turn, these can result in the fatigue of welded and clamp joints, or failure of exhaust system components. 

Engine exhaust system inspections

A manufacturer’s instructions for continued airworthiness requires routine maintenance inspections of exhaust systems. For general aviation aircraft, this is commonly performed through a visual inspection. However, as highlighted by the Civil Aviation Safety Authority (2020), the useable life of the exhaust system is typically ‘centred on an “on condition” maintenance inspection philosophy and as such requires increased vigilance with ageing exhaust components’.

The NTSB has previously expressed concerns regarding the number of CO-related fatal accidents that occurred soon after routine maintenance inspections had been performed. However, it was recognised that it can be difficult to visually detect cracks or subtle imperfections, particularly at welded joints. The design of an exhaust may also make it challenging to visually inspect the interior for corrosion and cracks, without having to disassemble the system. Further, a crowded engine bay can make it difficult to conduct a thorough inspection without having to remove engine components (Hossein Cheraghi et al., 2009).

The FAA’s research (Hossein Cheraghi et al., 2009) found that inadequate maintenance and inspections of engine exhaust systems (and mufflers) were associated with a considerable number of CO-related accidents. The NTSB also cited a number of service difficulty reports where exhaust system failures were identified after being disassembled and pressure tested, even though they had been recently inspected. This supports the notion that, visual inspections alone may be difficult and may not necessarily detect pre-existing imperfections. However, it is also important to recognise that (Hossein Cheraghi et al., 2009):

Even if the exhaust system is intact without leaks during an inspection, it is possible that a crack or failure simply occurs soon after inspection.

Of note, the FAA (Federal Aviation Administration, 1972) and Transport Canada (2019) have also indicated that it is good practice to supplement these regular inspections with functional testing using a CO detector, both on the ground and in-flight. This was considered a reliable test that could be accomplished without having to disassemble aircraft components, and would provide an indication as to the extent of CO contamination. In particular, this could enhance the effectiveness of maintenance activities by ensuring that any repairs or modifications performed involving the firewall, and/or exhaust or heating systems, has been appropriately actioned and not introduced damage that could increase the risk of CO exposure.

Ingress into the aircraft cabin

The CO produced by a piston engine is dispersed into the atmosphere, away from the aircraft, through the exhaust system. However, cracks, holes or poorly fitted components in this system can result in exhaust gases, including CO, leaking into the engine bay. As most piston-engine aircraft cabins are heated by air that has been circulated around the exhaust system, this can result in CO rich exhaust gases entering the cabin through the heating system. The highest risk is in winter, when the use of the cabin heating system is more frequent, and the windows and vents are closed.

Likewise, inadequately sealed firewalls, and poor sealing of the cabin and other critical areas of the fuselage such as degraded door and window seals, also provide potential pathways for CO to enter the aircraft cabin. Further, it is crucial that any modifications and access panels installed on engine firewalls for maintenance purposes, be re‑sealed and secured correctly following any maintenance activities (Civil Aviation Safety Authority, 2020).

In addition to breaches in the firewall, anecdotal reports suggest that having the door ajar while on the ground is another potential pathway, including:

• In 2019, the ‘FLYER’ magazine (a UK magazine for general aviation pilots) tested four digital CO detectors using a Cessna 182 aircraft, at altitude and on the ground. While ground testing, they noted:

It’s worth noting that while we were doing the exterior exhaust test, while the rest of the units were located on the passenger seat in the cabin with the door ajar, it was evident the CO level increased as slipstream pushed exhaust into the cabin…

• Similarly, in a reply to the US Aircraft Owners and Pilots Association (2014) article on CO, a pilot discussed the digital CO detector fitted to their aircraft and made the following comment:

It’s amazing how sensitive it is, and how much CO I find I’m sucking when taxiing my Bonanza with the door ajar.

As part of the FAA’s study into the detection and prevention of CO exposure (Hossein Cheraghi et al., 2009), the ambient CO levels of several single-engine aircraft used for training purposes were monitored over a 12 month period. The aircraft were fitted with several digital detectors, which were placed in locations based on the potential pathways for CO to enter the cabin. The measurements were downloaded on a weekly basis, at which time the detectors were recalibrated. In addition, the pilots were required to complete a questionnaire for each flight, which captured the nature and duration of the flight, if the heating system and fresh air vents were used, if the windows were open and for what duration, and time taken to complete each ‘flight procedure’ (e.g. taxiing to the run-up area, conducting the run-up checks, taxiing to the runway etc.). The results of those tests indicated that:

Monitoring ambient levels of CO during flights of GA [general aviation] aircraft indicated the presence of CO in the cabin when the aircraft was on the ground as well as in the air. Examining the procedures carried out before aircraft take-off showed that most of the ground CO exposure events happened during taxiing before take-off and after landing, particularly when the windows were open.

Normal levels of carbon monoxide

Hampson et al. (2007) indicated that there were differing views regarding the correlation between COHb levels and a patient's presenting clinical picture, citing various publications. For example, Piantadosi wrote '…the correlation between clinical deficits and measured COHb level is quite weak'. In contrast, Ilano et al. identified that, '…in general, the severity of the observed symptoms correlates roughly with the observed levels of COHb…'. Similarly, The Merck Manual Professional Edition stated that 'Symptoms tend to correlate well with the patient's peak blood carboxyhemoglobin levels'.

Further, when comparing the COHb levels detected in individuals, Rathore & Rein (2016) highlighted that it was important to note that ‘both the concentration and length of time are key distinguishing factors. It is vital to note however that individuals exposed to the same source simultaneously can exhibit differing levels of COHb’. Taking this into consideration, when discussing the normal levels of CO contained in an individual’s blood, the ATSB’s forensic and aviation pathology specialist stated that:

Normal levels of carbon monoxide in non-smokers are less than 2-3%. Smokers may have elevated levels around 3-5% or even as high as 9%, depending on number of cigarettes smoked and time since last cigarette smoked.

The police forensic pharmacologist reported similar levels, where a non-smoker’s maximum COHb level would be around 5 per cent, while smokers could have levels up to 10 per cent and up to 16 per cent for heavy smokers. Multiple medical studies were also cited, including:

• A study of deaths in NSW, which found a CO range of 1-10 per cent, with most cases between 3-6 per cent.
• A study of banked blood reported the average COHb level was 0.78 per cent. Of those samples, 10.3 per cent had COHb levels of 1.5 per cent or more, and the highest level was 12 per cent.
• Another study found that 45 per cent of non-smoking blood donors had COHb levels more than 1.5 per cent, up to 6.9 per cent depending on their location.
• Busch (2015) investigated the extent of CO exposure on Norwegian Sea King rescue pilots who were frequently subjected to engine exhaust. The crew were monitored for exposure to exhaust fumes and clinical symptoms of CO over 2 weeks. The study found that 64 per cent of the crews experienced subjective exposure to engine exhaust. Clinical symptoms of CO was reported in 8.6 per cent of cases, which included exhaustion, headache and nausea.

Although toxic levels of COHb were not reached, about one-third of the post-flight levels were outside the normal range (greater than 4 per cent), with a maximum of 7 per cent. The study also concluded that exposure to engine fumes was more common during open cargo door operations.

Other medical and aviation sources discussed the typical levels of CO expected in individuals. While there was some variability in the levels considered normal, the COHb levels for non‑smokers are generally less than 3 per cent, but up to about 10 per cent for smokers. Specifically, these included:

• The Agency for Toxic Substances and Disease Registry (2012) stated that all individuals are exposed to CO at varying levels through the inhalation of air and the typical COHb level for a non‑smoker is 0.5-1.5 per cent. They also noted that urban locations with high automobile usage tend to have greater atmospheric levels of CO when compared with rural or remote areas.
• Carel (1998), cited by Science Direct, indicated that normal urban dwellers may have up to 0.5 per cent COHb, but smokers may have 5-10 per cent.
• According to Hawkins (1993), as a baseline, a non-smoker has about 1-3 per cent COHb in the blood, while a smoker has about 4‑10 per cent, depending on how much they smoke.
• Ghanem et al. (2012) stated that the 'Measurement of COHb level is necessary as it is believed to be the only established marker for proper diagnosis of CO poisoning. Confirmation is done by reporting elevated COHb level more than 2% for non-smokers and more than 10% in smokers’.
• Safe Work Australia (n.d.) discussed the distribution of CO in the environment and COHb in the general population. They indicated that the typical COHb saturation levels without occupational exposure was 0.4-0.7 per cent for endogenous production;^[56] 5-6 per cent for smokers consuming one packet per day, increasing up 20 per cent for cigar smokers; up to 5 per cent for commuters on urban highways (in the US); and 3‑5 per cent when exposed to a certain amount of methylene chloride.^[57]
• Baselt (2014), citing Stewart et al. (1974), indicated that the COHb average in urban non‑smokers was 1-2 per cent and 5-6 per cent for smokers. It was also noted that atmospheric conditions of 50, 100 and 200 parts per million (ppm) equated to 8, 16 and 30 per cent COHb levels respectively.
• Elevated COHb levels are used to confirm a clinical diagnosis of CO exposure, and in some instances, assess the severity of poisoning. Hampson et al. (2007) stated that elevated levels of COHb, greater than 2 per cent and 9 per cent for non-smokers and smokers respectively, 'strongly suggests exposure to exogenous CO and supports a clinical diagnosis of CO poisoning'.

Carbon monoxide concentrations

The concentration of CO in the air is represented as parts per million (ppm). According to Safe Work Australia (n.d.), the maximum recommended exposure to CO over an 8 hour period is 30 ppm. Short-term excursions above this are permitted to 60 ppm for no more than 60 minutes total exposure, 100 ppm for 30 minutes, and 200 ppm for 15 minutes. However, short-term excursions should never exceed 400 ppm.

There are several graphical representations showing the relationship between COHb levels, exposure time and CO concentration (ppm) (Figure 41). While there is a noticeable disparity between the two graphs, the results indicate that, to attain a COHb level of 11 per cent (as found in the pilot) in about 30 minutes (the minimum exposure time for the pilot accounting for the 27 minute taxi prior to, and the taxi on the accident flight), this required a CO concentration of at least 500 ppm. According to the Occupational Safety and Health Administration as cited in Lacefield et al. (1982), exposure to concentrations between 500‑1,000 ppm could result in ‘the development of headache, tachypnea (rapid breathing), nausea, weakness, dizziness, mental confusion and in some instances, hallucinations, and may result in brain damage’. The ATSB recognised that the pilot may have been exposed to CO on previous flights that day for up to 200 minutes when the engine was running. A cumulative CO exposure time would require lower CO concentration levels to achieve the same COHb.

Figure 41: Relationship between COHb levels, CO exposure time and concentration

Source: Peterson and Stewart (1975) as cited by the Agency for Toxic Substances and Disease Registry (2012) (left) and Thakur (2019) (right), modified by the ATSB to represent possible exposure time for the pilot and passengers and COHb levels detected.

Physical symptoms and cognitive performance effects of carbon monoxide exposure

Typical effects experienced

It is well recognised that ‘the reaction to a given blood level of COHb is extremely variable’ and will result in differing physiological effects (World Health Organization, 1999; Lacefield et al., 1982). These effects may also vary depending on the length of exposure and concentration of CO in the environment; that is, rapid high exposure or prolonged at a lesser amount. Baselt (2014) noted that, if the COHb ‘concentrations are attained rapidly by exposure to high levels of CO, the resulting physiological effects are not as intense as if the concentrations are attained gradually’. Further, the UK Civil Aviation Authority (2020) stated that:

The physiological effects of CO poisoning are cumulative and take a very long time to disperse. Even a low level of CO ingestion, below the level that causes immediate physical symptoms, will cause a progressive reduction in blood oxygen levels which will reduce pilot performance and potentially cause permanent damage to the brain, heart and nervous system. It is therefore a mistake to assume that a cockpit contaminated with very low levels of CO is acceptable.

Irrespective, most researchers are willing to accept that some level of deterioration in psychomotor function will occur at COHb levels from about 3 per cent (Hawkins, 1993).

The police forensic pharmacologist indicated that while there are generally ‘no symptoms of toxicity’ at COHb levels below 10 per cent, studies have shown that COHb concentrations at or below 10 per cent can adversely affect an individual’s ability to perform complex tasks, such as operating an aircraft. Specifically, COHb levels between 5-7.6 per cent can produce significant decrements in vigilance, while levels between 5-17 per cent can impair visual perception, manual dexterity, ability to learn and the performance of complex sensorimotor tasks. The adverse health effects of corresponding COHb levels have been shown simply by the Agency for Toxic Substances and Disease Registry in Figure 42.

Figure 42: Adverse health effects of CO

Source: Agency for Toxic Substances and Disease Registry, annotated by the ATSB

There is a significant amount of literature on CO and the effects at varying COHb levels. The following references indicate that the occupants of VH-NOO with the most elevated levels (11, 10 and 9 per cent) would have experienced physical symptoms and cognitive performance effects with adverse consequences, these include:  

• Numerous studies have shown the adverse effects of CO exposure on the functioning of the central nervous system. Referring to multiple sources, Hawkins (1993) noted that a decrease in vigilance task performance can occur at COHb levels of 2‑4 per cent, and it has been shown experimentally that there are reductions in visual discrimination and the judgement of time intervals with 4-5 per cent.
• Safe Work Australia (n.d.) mentioned that the World Health Organization, US National Institute for Occupational Safety and Health, and the Swedish National Board of Occupational Safety 
• and Health all agreed that at COHb levels between 5-10 per cent, behavioural effects have been found on the performance of tasks requiring vigilance, and on reaction time.
• The World Health Organization (1999) indicated that COHb levels below 10 per cent were not usually associated with symptoms. However, between a broad range of 10-30 per cent, neurological symptoms may be experienced, such as headaches, dizziness, weakness, nausea, confusion, disorientation and visual disturbances.
• Research reported by Lacefield et al. (1982) has shown that COHb levels less than 12 per cent had no effect on psychomotor performance, but detrimental effects on visual perception were observed. Further, behavioural testing suggested that time discrimination, visual vigilance, choice response tests, visual evoked responses, and visual discrimination thresholds may be altered at COHb levels below 5 per cent.
• Citing previous research, Baselt (2014) stated that a number of studies have shown that COHb levels less than 10 per cent can adversely affect a person's ability to perform complex tasks. Levels between 15-25 per cent often result in dizziness and nausea.

According to the Federal Aviation Administration (n.d.) and Safe Work Australia (n.d.), the physical symptoms for the COHb levels observed in the pilot and passengers (9-11 per cent) may typically include tightness across the forehead and a slight headache. However, given that these are relatively mild in nature, occupants may disregard these symptoms and not necessarily associate them with CO exposure.

The terms ‘symptom’ and ‘effects’ are often used interchangeably to describe the consequences of CO exposure. However, the authoritative literature considers these to be two distinct categories: observable physical symptoms and cognitive functions (Table 5).

Table 5: Adverse cognitive effects and observable physical symptoms from CO exposure

Cognitive effects
ability to learn	performance of complex sensorimotor tasks
confusion	reaction times
disorientation	time discrimination
judgement	vigilance
manual dexterity	visual disturbances
neurological impairment
Observable physical symptoms
decreased exercise stamina	nausea
dizziness	weakness
headaches

Comparison with altitude hypoxia

Hawkins (1993) compared the effects of oxygen deprivation from smoking-induced CO exposure (anaemic hypoxia) to that of altitude hypoxia. By definition, anaemic hypoxia is the result of a decrease in the oxygen-carrying capacity of the blood, while altitude hypoxia is a reduction in the oxygen tension (partial pressure) in the arterial blood. While it is noted that there are slight variations in these two types of hypoxia, hypoxia can be generally defined as decreased amounts of oxygen in organs and tissues, less than the physiologically ‘normal’ amount (International Civil Aviation Organization, 2012).

Based on Figure 43 (McFarlane (1953) as cited in Hawkins (1993)), a COHb of 11 per cent at sea level is the equivalent of a physiological altitude of about 12,000 ft. To put this into context, the effects typically experienced at 10,000 ft and 12,000 ft as a result of altitude hypoxia are (International Civil Aviation Organization, 2012):

10 000 ft: The atmosphere provides a blood oxygen saturation of approximately 89 per cent. After a period of time at this level, the more complex cerebral functions such as making mathematical computations begin to suffer. Flight crew members must use oxygen when the cabin pressure altitudes exceed this level.

12 000 ft: The blood oxygen saturation falls to approximately 87 per cent and in addition to some arithmetical computation difficulties, short-term memory begins to be impaired and errors of omission increase with extended exposure.

Figure 43: Effects of CO on altitude tolerance

Source: McFarland (1953) as cited in Hawkins (1993), modified by the ATSB

Tests and research

Following notification to ATSB in March 2020 that the occupants had elevated levels of CO, a further inspection of the stored aircraft was conducted to determine the likely source and ingress of CO into the cabin. This included a detailed examination of the engine exhaust system (collector ring assembly) and firewall, including the two magneto access panels. In addition, the CO detector fitted to the aircraft was also examined for serviceability and specific CO testing was carried out using an exemplar DHC-2 aircraft.

Examination of VH-NOO carbon monoxide detector

On the type of disposable CO chemical spot detector fitted to VH-NOO, the chemical spot sensor of a serviceable detector is the same colour as the outer ring, in this case, orange (Figure 44 – middle right). When exposed to CO, the sensor darkens to grey/black (Figure 44 – lower right). A lighter-coloured sensor relative to the outer ring indicates that the sensor is sun bleached (refer to section titled Limitations of disposable chemical spot detectors.

The detector fitted to VH-NOO was examined after the accident and was found to be a light beige colour; lighter than the comparative orange outer ring (Figure 44 ‑ top right). It was noted that the detector had been immersed in fuel‑contaminated saltwater for 4 days following the accident, which may have influenced its condition.

However, photographs taken by passengers earlier in the day (at 1116, 1202 and 1330) showed that the detector was the same colour as that observed post-accident, with the spot a lighter colour than the outer ring (Figure 44). The last image of the detector taken at 1330, although not of a high quality, showed the same. A darkened spot to indicate the presence of CO was not evident at that time.

In addition, both the ATSB’s examination and the review of the passenger photographs noted that the ‘date opened’ was not annotated on the front of the detector. In order to establish when the detector was fitted to the aircraft, the operator examined photographs previously taken by their company pilots. From this, it was estimated that the detector was fitted in April 2017.

The operator advised that, although the CO detector had been fitted to the aircraft for 8 months, it had been inside a hangar for half this time (July – November 2017) and reportedly not subjected to sunlight. In addition, the operator indicated they were following the manufacturer’s instructions for use and did not expose the detector to any cleaning chemicals They were also aware that it could be used for 12 months after opening.

Figure 44: VH-NOO CO detector during the earlier flights on the accident day (time 1116, 1202 and 1330) and post‑accident (top right), compared with a new detector (middle right) and a detector exposed to CO (lower right)

Source: ATSB and passengers, annotated by the ATSB

Carbon monoxide testing on an exemplar DHC-2

In May 2020, the operator offered the ATSB the use of a DHC-2 aircraft at Moruya Airport, NSW to conduct testing of CO levels in the cabin. The key purpose of the test was to establish if an exhaust leak combined with a breach in the main firewall could result in CO entering the aircraft cabin, and if variations in ventilation conditions could exacerbate this. The intent was not to replicate the exact conditions of the accident flight. A summary of that testing is provided below and for full details refer to Appendix E – Report on carbon monoxide testing on an exemplar DHC-2.

A number of scenarios were performed to progressively and safely introduce deviations from the normal baseline CO levels. These included a combination of removing bolts from the magneto access panels in the main firewall; introducing smoke (using a smoke generator), followed by exhaust gases into the engine and accessory bays;^[58]and configuring the pilot’s door, snap vent^[59] and window. The front passenger door and window remained closed during the tests.

The aircraft was towed to an open grass area on the airport and orientated to provide a right quartering headwind,^[60] similar to the prevailing wind conditions during the taxi  of the accident flight. The aircraft remained stationary on a trailer during the testing, with the engine generally being run at idle power and the propeller at 500-700 rpm.

The CO levels were measured from within the cabin using several calibrated electronic CO detectors. To ensure a safe working environment for participants with regard to CO exposure during the tests, detector alarms were set to the occupational exposure limits stipulated by Safe Work Australia (n.d.). When the CO levels approached the 15 minute exposure limit of 200 ppm, the testing was discontinued.

Baseline

A baseline CO level in the cabin was determined with all magneto access bolts in place, no breaches in the firewalls, and the pilot’s door, window and vent closed. As there was evidence to indicate that the pilot would tend to have the door ajar rather than the window open when the engine was running prior to take-off, the window open CO readings are not discussed.

The engine was initially run at 500 rpm (idle) and the detector alarmed soon after the engine start (at 30 ppm), but the CO level then stabilised at 10 ppm. When the pilot’s window, vent or door was opened, or the engine speed was increased, there was a minimal change in the CO levels, which remained below the alarm level (Table 6 first column).

In preparation for a simulated exhaust leak, a smoke test was conducted using the baseline conditions described above to provide a visual indication of airflow in the cabin. A smoke generator^[61] was held inside the gap in the engine cowling and the CO level in the cabin peaked at 55 ppm. Some smoke was visible in the cabin when the smoke generator was held on the left side of the engine. The highest CO readings were in the front seats, with decreasing levels toward the rear of the cabin.

Table 6: Results of the CO testing

Primary condition  Engine at idle speed	Position of pilot’s door, window vent	CO concentration (ppm)	CO levels at pilot’s seat
Baseline Access panel bolts in place	Door and vent closed	10	Steady state ppm
Door closed with vent open	18
Door ajar	8
Access panel bolts removed Nil exhaust leak	Door and vent closed	30	Maximum ppm
Door closed with vent open	34
Door ajar	15
Access panel bolts removed Exhaust leak into engine bay	Door closed	60
Door ajar	>100
Access panel bolts removed Exhaust leak into accessory bay	Door closed	144
Door ajar	<144
Access panel bolts in place Exhaust leak into accessory bay	Door closed	28
Door ajar	<28

Source: ATSB

Access panel bolts removed

After establishing a baseline, the next test involved assessing how much CO would enter the cabin if two bolts on each magneto access panel were removed. When removed, the CO readings with the door and vent closed, and then the door closed but the vent open, increased above the baseline levels reaching a maximum value of 34 ppm. However, with only the door ajar, the level was similar to the baseline (Table 6).

A second smoke generator test was then carried out with the door closed and vent open. The amount of smoke in the cabin was noticeably higher than the first test. Having the pilot’s door ajar drew even more smoke into the cabin through the bolt holes in the access panel.

Exhaust leak simulation

An engine exhaust leak was then simulated by feeding a small diameter hose from the exhaust tailpipe, initially into the engine bay and then into the accessory bay (Figure 45). The CO concentration level measured at the outlet of the simulated exhaust leak exceeded 500 ppm.

With the magneto access panel bolts removed and the simulated exhaust leak in the engine bay, the detector reached the second alarm level (60 ppm) with the door closed. This then increased quickly above 100 ppm when the pilot’s door was ajar (Table 6). The levels were highest in the pilot’s footwell adjacent to the holes in the firewall and were less in the middle and rear rows. With the simulated exhaust leak in the accessory bay, the CO level quickly increased to 144 ppm, again highest in the pilot’s footwell. The CO levels reduced slightly with the pilot’s door ajar (Table 6). When the magneto access panel bolts were reinstalled with the simulated exhaust leak remaining in the accessory bay, the CO concentration level dropped considerably to 28 ppm with the pilot’s door closed. With the door ajar the CO levels reduced slightly (Table 6).

Figure 45: Simulated exhaust leak into the engine bay (left) and the accessory bay (right)

Source: ATSB

This testing demonstrated that either the simulated exhaust leak or missing magneto access panel bolts did not result in high levels of CO in the cabin in isolation. However, the simulated exhaust leak in combination with missing magneto access panel bolts resulted in elevated CO levels in the cabin. The CO was more evident at the pilot’s position and was exacerbated when the pilot’s door was ajar with a simulated exhaust leak source in the engine bay. The CO levels reduced markedly in the cabin (by more than 80 per cent) when the access panel bolts were reinstalled with the exhaust leak remaining. The door position in this configuration did not adversely affect the CO levels.

Carbon monoxide detectors

Due to the characteristics of CO, it has no inherent warning properties and is therefore, generally very difficult to detect. Aircraft occupants are often unaware that they have been exposed, and that their physical and mental functions have been degraded (Transport Canada, 2019). While the initial aircraft design and continuing airworthiness requirements are the foundations for preventing CO exposure, they are not always effective, so a third barrier is needed to alert pilots to the presence of CO in cabin (Air Accidents Investigation Branch, 2020).

Types of detectors available for aviation use

The FAA (Hossein Cheraghi et al., 2009) conducted an extensive literature review and assessment of CO detector technology available for aviation use. This research identified that CO detectors generally fall into five categories based on the sensor type. These are:

• Disposable chemical spot detectors: The most common detector used in general aviation is the disposable CO chemical spot detector. These devices are small, widely available, and are inexpensive. They are normally mounted on a card that can be attached to the instrument panel without the need to be professionally installed or can be worn by the pilot on an identification badge or neck-lanyard (Civil Aviation Authority, 2013). The sensor mimics the effect of CO on haemoglobin and changes colour to black in the presence of CO by (Downunder Pilotshop, n.d.):

These simple detectors are pieces of cardboard with a small orange-coloured circle in the middle. If there is a high-level of carbon monoxide in the vicinity, the circle changes colour from orange to black. This happens as a direct result of chemistry. The detector circle is gritty and sand-like; it is silica gel impregnated with a catalyst made from chemicals that include palladium and molybdenum salts…

When carbon monoxide touches the detector, it's oxidized by the chemical salts on the strip and turns into carbon dioxide. The chemicals on the strip are simultaneously reduced and change colour to black. The strip also contains a chemical salt made from a transition metal such as iron, nickel or copper. Once the carbon monoxide is removed, this metal salt steals some oxygen from the air and changes the catalyst back to its original chemical form—so the detector spot changes colour back to orange again...

Spot detectors have a number of limitations (refer to section titled Limitations of disposable chemical spot detectors below). Further, spot detectors merely provide a qualitative warning and have no mechanism for actively alerting the pilot to the presence of the CO in the aircraft cabin. As such, they offer the lowest level of protection against CO exposure.

• Electrochemical detectors: Electrochemical detectors use the principles of a fuel cell. When CO is present, a chemical reaction is measured within the sensor, which creates an electrical output that is directly related to the amount of CO in the immediate environment. This will trigger an alarm at certain CO concentrations and time periods. These types of detectors are considered the most accurate and reliable devices for detecting elevated levels of CO. They are generally small and portable, have a low power consumption, are single‑gas units, and can be used over a wide range of temperatures. However, cross-sensitivity with other gases may occur and potentially result in inaccurate readings of CO exposure.
• Biomimetic detectors: Similar to the chemical spot detector, the biomimetic sensor mimics the effects of CO on haemoglobin. If CO is present, the gel-coated disc changes colour (darkens). When the light sensor detects this change in colour, an alarm activates. Again, comparable to the spot detector, they are simple to use, are cost effective and are portable due to their low power consumption. However, they can be easily contaminated by the ambient conditions, and the time between obtaining data from the sensor to displaying it on the detector is generally slow. In reverse, this means that the sensor takes a reasonable amount of time to re-set, even up to 48 hours.
• Infrared detectors: Infrared sensors measure the specific wavelength of CO. When CO is present, resistance in the circuit is increased, which triggers an alarm. These detectors are generally manufactured for portable and fixed use, require less frequent calibration compared with other sensors, may operate in environments where no oxygen is present, and provide high levels of sensitivity and accuracy. However, the sensor units are typically made to detect several types of gases and single-gas units are uncommon.
• Semiconductor detectors: Semiconductor sensors use an electrically powered sensing element and a thin layer of tin oxide placed over a ceramic base. The presence of CO reduces the electrical resistance and the circuit closes. An integrated circuit monitors this change and will trigger an alarm. While they have a long useful life, they also have a number of limitations that reduces the reliability, accuracy and portability of this type of detector. They can be adversely affected by the ambient conditions, they require sufficient oxygen to operate, power consumption is high reducing portability, and stability and repeatability is poor.

To be most effective, an appropriate CO detector should provide reliable, early warning of elevated levels of CO in the cabin. The purpose of an alerting system is to direct the pilot’s attention to a non‑normal operating condition that requires their awareness. This allows a pilot to respond appropriately and in a timely manner (Federal Aviation Administration, 2010). According to Parasuraman, (1987) as cited in Tsang et al. (2003):

Alarms and alerts are pervasive and, if not heeded appropriately, can lead to adverse situations. Such alarms have been installed in aircraft because humans are not very good at monitoring infrequently occurring events because of declines in vigilance…

The disposable CO chemical spot detector, as fitted to VH-NOO on the accident flight, was a passive device that relied on the pilot regularly monitoring the changing colour of the detector to show elevated levels of CO. In contrast, electronic active CO detectors are designed to attract the pilot’s attention through auditory and/or visual alerts when CO levels are elevated, so pilots are more likely to notice an elevated CO level. These are now inexpensive and readily available. This was recently recognised by the Civil Aviation Safety Authority and highlighted in Coronial proceedings for a mid-air collision between Cessna 152 aircraft and Guimbal Cabri G2 helicopter in the UK in 2017 (refer to section titled Civil Aviation Authority of New Zealand occurrences (2018).

Finally, the fitment of placards designed to change colour when exposed to CO may not necessarily provide adequate warning to the pilot and passengers of the elevated levels of CO within the cabin. More modern devices which include audible and improved visual warnings are more suited to detect and warn cabin occupants of the elevated levels of CO….small electronic personal devices are available at relatively affordable prices, these devices allow for continual monitoring of CO levels with audible and visual warnings when escalated CO levels are detected…(Civil Aviation Safety Authority, 2020).

There are a range of active CO detectors available that use audible, visible or vibration warnings when pre-determined CO levels are exceeded. These have the notable advantage of actively engaging the pilot’s attention and are accordingly more likely to be more effective than the ‘spot-type indicators (Buckinghamshire Council Coroner’s Service, 2019).

Limitations of disposable chemical spot detectors

The manufacturers of disposable chemical spot detectors are openly transparent about the limitations of these types of devices. For example, the ATSB purchased the same detector that was fitted to VH‑NOO at the time of the accident and noted that the back of the detector and the associated packaging detailed the limitations as (Figure 46):

• the shelf life for the unopened package is 3 years; a use by date is also provided on the packaging
• do not remove the detector from the packaging until ready for use and replace after 12 months
• the reaction time is slightly faster when damp and slightly slower when dry
• if the spot gradually turns darker or bleaches out over time, the detector should be replaced; harsh direct sunlight will tend to bleach out the indicator spot and shorten the useful life
• the detector will be damaged by the presence of halogens, ammoniac, chlorine, cleansers, solvents, sewer gas, cat litter boxes, and diesel engines
• not intended as a life-saving device
• recommended as a supplemental detector in combination with an electronic alarm for household use.

Aside from highlighting the useful life of the detector, none of the above limitations were specified on the front of the detector for pilot awareness when the detector has been attached to the aircraft cabin.

Figure 46: Exemplar disposable CO chemical spot detector

Source: ATSB

The Civil Aviation Safety Authority, Federal Aviation Administration, and pilot shops that sell the detectors also publicly recognised the limitations of disposable chemical spot detectors as: 

… Spot detector manufacturers indicate the useful life of a spot detector to range between 30 and 60 days, and thus necessitate replacement on a frequent basis…spot detectors merely change colour in the presence of CO and are not capable of actively alerting the pilot of the presence of CO in the cabin. Manual visual inspection is necessary to determine if the sensor indicates the presence of CO; however, CO exposure determination is subject to pilot interpretation (Hossein Cheraghi et al., 2009).

…If the aircraft is only fitted with the placard type CO indicator, the operator should ensure the placard is placed in the field of view of the pilot, is regularly checked to ensure that the placard is not time expired, and that the indicator is not faded from ultraviolet exposure or contamination (Civil Aviation Safety Authority, 2020).

It appears that many pilots of GA [general aviation] aircraft use spot detectors due to their low absolute cost on an individual sensor basis...However, spot detectors provide slow reaction (i.e., slow, gradual change in colour) when exposed to CO and are easily contaminated by aromatic cleaners, solvents, and other chemicals that are routinely used in aircraft maintenance. Once contaminated, it is difficult to distinguish whether the change in colour is due to contamination or to actual CO exposure. Also, spot detectors cannot distinguish between acute and chronic exposures to CO, as a change in colour simply signifies that CO is present, with no regard to dose…Different dose levels may warrant different actions (e.g., high acute exposure levels may require immediate attention, while low-level chronic exposure may allow more time to react)…spot detectors are also susceptible to discoloration over time, thus providing the potential for false positive readings (Hossein Cheraghi et al., 2009).

There are available, in general aviation, paper discs, impregnated with a chemical that reacts and changes colour in relation to the concentration of carbon monoxide. The colour may be compared to a printed scale. Under strict laboratory conditions this system is capable of detecting hazardous levels of carbon monoxide but when used to monitor cabin air it has proven unreliable because of interference from sunlight, varying humidity, other gases and cigarette smoke (Federal Aviation Administration, 1972).

The disadvantage is that these detectors don't sound an alarm: you have to keep looking at them to notice that the colour has changed. These strip detectors have to be replaced every 3-6 months depending on the environment you’re using them in; an expiration date is on every package (Downunder Pilotshop, n.d.).

Similarly, the Civil Aviation Authority of New Zealand, Avweb, the (US) Aircraft Owners and Pilots Association and Guardian Avionics have all published articles exploring the advantages and limitations of the varying types of CO detectors available for aviation use. Specifically, they made the following comments when discussing the disposable chemical spot detector:

…Though they are better than nothing, most pilots don’t realize that these have a useful life of only 30 to 60 days – so whether you fly the aircraft or not, you have to change these cards 6-12 times a year! (Guardian Avionics, 2018).

These cards do have a downside, in that all of the currently available products have a limited life in service. While the chemical reaction that causes the spot to darken is nominally reversible, in practice most units discolour over time. The instructions that come with the unit will state the in-service life of the particular product. They typically range from one to 18 months, depending on the cost of the unit… towards the end of the stated in-service life, most of these detectors start to show significant darkening or discoloration. This could pose a dilemma to the pilot who isn’t sure whether the colour observed is due to the age of the detector, or is a result of the presence of CO. It therefore pays to replace the units whenever discoloration is apparent, or the stated life, whichever comes first (Civil Aviation Authority of New Zealand, 2004).

…chemical spots are extremely vulnerable to contamination from all sorts of aromatic cleaners, solvents, and other chemicals that are routinely used in aircraft maintenance. Read the fine print on these things, and you’ll learn that the detectors will be inactivated and damaged by the presence of ammonia, chlorine, iodine, bromine, and nitrous gases. It doesn’t take much, either. One brand of spot detector actually warns that the ammonia produced by the presence of a cat litter box in the home may render the detector unusable! What’s worse, there’s not necessarily any warning that the detector has been contaminated. The bottom line is that you might easily be flying around with an inoperative detector (because it’s too old or contaminated) and not know it. In some ways, that’s worse than not having a detector at all (Busch, 2003 (Avweb)).  

These things often remain stuck on the instrument panel for years, providing a dangerous false sense of security. What’s worse, there’s no warning that the detector is outdated or has been contaminated—in some ways, that’s worse than not having a detector at all (Aircraft Owners and Pilots Association, 2014).

Another advantage these units [electronic detectors] have over the spot type is that they generally have a shorter reaction time, and they can indicate the presence of CO much more quickly than the spot type. They can also show when the ambient CO level has decreased (eg, from turning off the heater), while the spot type take some time to return to the original colour (Civil Aviation Authority of New Zealand, 2004).

…Even when fresh, chemical spot detectors are incapable of detecting low levels of CO. They’ll start turning colour at 100ppm, but so slowly and subtly that you’ll never notice it. For all practical purposes, you’ll get no warning until concentrations rise to the 200 to 400 ppm range, by which time you’re likely to be too impaired to notice the colour change (Aircraft Owners and Pilots Association, 2014).

But even more dangerous, these chemical detectors are incapable of detecting low levels of CO, which when exposed to for longer durations, can cause major symptoms (Guardian Avionics, 2018).

These units are also passive, which means they won’t explicitly warn you about CO – you have to look at them. This means that they have to be part of your regular cycle of instrument scan or airmanship checks. The unit should also be located in the cockpit in an easily seen, prominent location. The expiry date of the unit should be clearly marked on it (Civil Aviation Authority of New Zealand, 2004).

In consideration of the popularity of disposable CO chemical spot detectors in general aviation and the above limitations, the ATSB issued a safety advisory notice (AO-2017-118-SAN-002) on 3 July 2020. The purpose of the notice was to strongly encourage operators and owners of piston‑engine aircraft to install a CO monoxide detector with an active warning to alert pilots to the presence of elevated levels of CO in the cabin. If not provided, pilots were encouraged to carry a personal CO detection and alerting device.

Location of detectors in the aircraft cabin

The UK AAIB investigation into a fatal accident in January 2019 involving a Piper Malibu aircraft registered N264DB concluded that the pilot was probably affected by CO poisoning (refer to section titled Aircraft Owners and Pilots Association (2020). While it established that the aircraft was not fitted with an active CO detector, it was possible that a spot detector was being carried,^[62] although it would have been out-of-date. Despite this, the investigation determined that the position of the detector in front of the right (copilot) seat would have been of little use in alerting the pilot in the left seat to the presence of elevated levels of CO in the cabin, particularly when flying at night. This was also emphasised by Hossein Cheraghi et al. (2009), who not only indicated that it was essential to place the detector in a position that allowed for the early and consistent detection of CO, but also in the pilot’s field of view so that they could be alerted to the presence of CO.

Regulatory requirements for carbon monoxide detectors

Civil Aviation Safety Authority Civil Aviation Order 20.18 details the minimum instrumentation and equipment requirements for aircraft, in this case, for charter aircraft being operated under visual flight rules. In addition to other instruments and indicators specified in the aircraft flight manual, this included instruments such as airspeed, altimeter, direct reading magnetic compass or remote indicating compass and a standby, accurate timepiece, turn and slip, and outside air temperature indicators. The Civil Aviation Order also mentioned other instruments such as recording equipment, automatic dependent surveillance broadcast systems and mode-S transponders. However, there was no requirement to carry a CO detector.

This was also recognised by CASA in the issue of airworthiness bulletin 02-064 Issue 1, on 3 July 2020, and 02-064 Issue 2 on 19 October 2020. The purpose of this bulletin was to advise owners, operators and aircraft engineers of the dangers of potential CO poisoning via leaking exhaust systems and breaches in engine firewalls. Specifically, it was noted that:

CASA strongly recommends pilots wear personal CO detectors. As not all aircraft are required to have CO detectors fitted, small electronic personal devices are readily available at affordable prices. These devices allow for continual monitoring of CO levels with audible and visual warnings when escalated CO levels are detected.

The absence of a regulatory requirement for the carriage of CO detectors was also highlighted by the UK AAIB investigation into a fatal accident in January 2019 involving a Piper Malibu aircraft registered N264DB (refer to section titled Aircraft Owners and Pilots Association (2020). The investigation report stated that:

…there is no requirement for GA [general aviation] aircraft to be fitted with a CO detector. Instead, it is the owner’s/pilot’s discretion as to whether they fit or carry a detector in the aircraft.

…many manufacturers have chosen to fit detectors to new aircraft. However, this is not a mandatory requirement and will not address the large fleet of ageing piston engine aircraft.

The CAA [UK Civil Aviation Authority], EASA [European Union Aviation Safety Agency] and the FAA have all produced a specification for CO detectors and EASA has introduced a standard modification to make it easier for pilots to fit them to their aircraft; however, there is no requirement for pilots to do so.

As a result of this accident, the AAIB made safety recommendations to the UK, US and European Union aviation regulators mandating the carriage of active CO detectors. Likewise, the French Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (BEA) and US NTSB have previously made similar recommendations to their respective regulators. However, to-­date, these recommendations have not been accepted. A summary of these recommendations and the regulators response is detailed in Table 7.

Table 7: Investigation recommendations for the carriage of CO detectors

Agency	Year	Safety recommendation	Regulator response
AAIB	2020	That the FAA, the European Union Aviation Safety Agency, and CAA [Civil Aviation Authority] require piston-engine aircraft, which may have a risk of CO poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of CO.	The safety recommendation remains open awaiting further work by the authorities.
NTSB	2004	To the FAA: Require the installation of CO detectors meeting the standards developed as a result of Safety Recommendation A‑04‑27 in all single-engine reciprocating‑powered aircraft with forward-mounted engines and enclosed cockpits that are already equipped with any aircraft system needed for the operation of such a CO detector.	The FAA responded that, as the proper inspection and maintenance of mufflers and exhaust system components is the primary method of preventing CO contamination, they considered that installing a CO detector was not necessary to correct an unsafe condition…
BEA	2002	The BEA recommended that the DGAC [Direction générale de l'aviation civile] require the presence of a CO on general aviation aircraft.	This recommendation was addressed through the European Union Aviation Safety Agency, who indicated that, although the safety risk from CO ingress into the cabin of general aviation aircraft existed, the number of accidents where CO poisoning was determined as the root cause remained low compared to other root causes categories. CO detectors were also available on the market and as such many operators already make use of them, even though there was no rule requiring the installation of CO detectors. The Agency considered that this issue may be treated by other means than by the creation of a new rule…
AAIB	2002	In the absence of it being mandatory for all piston-engine aircraft to carry a CO detector, the Civil Aviation Authority [CAA] should vigorously promote that all such aircraft should have a current CO detector fitted to facilitate an early warning of the presence of the gas.	This recommendation was accepted by the CAA.
AAIB	2002	The Civil Aviation Authority [CAA] should develop an appropriate recognised performance specification against which CO detectors can be assessed and approved, with the eventual aim of mandating their use on all piston engine aircraft.	The CAA undertook a feasibility study to determine whether an appropriate airworthiness specification could be developed that would allow for a practicable and cost-effective CO detector for aviation use. The study proposed an update to the standard that addressed the use of CO detectors.

Of note, the Civil Aviation Authority of New Zealand Civil Aviation Rules (section 91.509) stated that a powered aircraft with an airworthiness certificate (other than a powered glider), must be equipped with a means for 'indicating the presence of carbon monoxide in the cabin if the aircraft is fitted with an exhaust manifold cabin heater or a combustion cabin heater'. While this was only related to aircraft fitted with cabin heating systems, it is recognition of the significant risk that CO exposure can have on aircraft occupants.

The marine experience

In addition to the aircraft cabin, the potential dangers of CO exposure have also been recognised in other enclosed spaces such as caravans, boat cabins and even tents. Of particular note, in 2016, two people onboard a yacht in Sydney were exposed to CO from a stove that was used to keep them warm. One of the occupants received fatal injuries, with a COHb level of 60 per cent. The subsequent NSW State Coroner's inquest recognised the challenges with establishing the prevalence of CO-related events but noted that 'it is clear that there is a large potential risk in the leisure industry'. A such, the Coroner made the following recommendation to the Minister for Roads, Maritime and Freight:

It became clear during the course of the inquest that the potential danger of carbon monoxide poisoning is somewhat unknown or under-estimated in the recreational boating field. There is no requirement for carbon monoxide alarms in cabins and clear warning stickers attached to appliances are not mandatory.

Urgent consideration of the introduction of legislation to mandate carbon monoxide alarms in all recreational and leisure craft and vehicles with sealable cabins, including sailing and motor vessels, caravans and motor homes, that have potential carbon monoxide sources such as fuel burning heating and cooking appliances. These alarms should conform to an appropriately developed minimum standard…

Interestingly, the inquest noted legislative changes in Minnesota (US) in 2016 in response to the fatality of a child on a family boat. The state introduced mandatory hard-wired, marine-certified CO detectors in boats with enclosed cabins.

Similar occurrences

Exposure to elevated levels of CO has been identified as a contributing factor in numerous aviation accidents involving piston-engine aircraft. The FAA Civil Aeromedical Institute (Lacefield et al., 1982) conducted a toxicological study of samples from 4,072 pilots that were fatally injured in a general aviation accident. The results of that study found that only 0.5 per cent of the accidents were the result of pilot incapacitation from CO exposure. Similarly, as previously mentioned, an FAA study into the detection and prevention of CO exposure in general aviation aircraft found that only 62 of the 71,712 accidents (about 0.09 per cent) in the NTSB’s safety database, between 1962 and 2007, were directly related to CO exposure.

While these statistics show that a fatal accident involving CO is rare, the AAIB (2020) highlighted that it was possible there may be more occurrences, but these have gone undetected for several reasons. These include: toxicological testing was not conducted, evidence of CO exposure was masked by a post-impact fire, or mechanical evidence was destroyed during the accident sequence.

Further, as noted by Lacefield et al. (1982), ‘not all in-flight exposures to CO result in accidents’. Pilots may overlook or dismiss the onset of symptoms and not even consider an association to CO exposure, a hazard that is very difficult to detect (NTSB, 2017a). Likewise, Hampson et al. (2007) indicated that, as the signs and symptoms of CO exposure were non-specific, it was likely that many more cases were unsuspected or attributed to other causes, and therefore, have gone undiagnosed. It is also challenging to establish how often exhaust systems are repaired or replaced, or breaches in firewalls are detected. While the prevalence of these types of occurrences will never be accurately known, the following summaries provide insight into the nature of these types of events. It is acknowledged that, although the aircraft involved in the events below may be fitted with varying heating and ventilation systems, the potential for CO exposure in any piston-engine aircraft still exists. Of note, a search of the ATSB’s safety occurrence database did not identify any reports involving DHC-2 aircraft.

Australian occurrences

ATSB investigation (AO-2020-055)

On 23 September 2020, the pilot of a Piper PA-28 aircraft departed Moree, NSW for a private ferry flight to Tamworth. Shortly after take-off, the pilot started to experience dizziness, breathlessness and a warm feeling in the chest. The pilot conducted a visual scan and observed that the CO chemical spot detector was gradually getting darker.

The pilot opened the air vents and storm window and returned to Moree. A subsequent medical examination determined that the pilot had a COHb level of 1 per cent. The investigation is ongoing.

CASA defect report (Piper PA-28)

On 01 September 2020, during the taxi and run-ups in a Piper PA-28 aircraft, the smell of exhaust fumes were observed in the cockpit and the CO detector was darker than usual. An examination of the aircraft's exhaust system and firewall was conducted, with nil defects founds. In addition, it was determined that the CO detector fitted to the aircraft was in a 'poor condition' and was subsequently replaced.

Post-flight testing using an electronic CO detector during engine run-ups confirmed the presence of 'excessive CO' in the cabin. Interestingly, when the aircraft was stationary and positioned into wind, less than 10 ppm was observed on the detector. However, when the wind was at 90° to the aircraft, the CO levels within the cabin increased to 40 ppm. The wing and fuselage lower air vents were subsequently sealed, and another CO test performed, with nil detection observed at various power settings and wind directions.

CASA defect report (Victa Airtourer 115)

On 26 August 2020, the owner of a Victa Airtourer 115 had asked their maintenance organisation to install a CO detector. Subsequent to this, on departure, the pilot reported that the CO detector alarmed. A post-flight inspection using a handheld CO detector established an 'unacceptable' CO level of 125 ppm in the cabin. The engine muffler, and boots/seals fitted to the throttle push pull rod in the firewall, and flaperon and centre flap were all replaced. After this, the CO level was deemed acceptable.

ATSB investigation (AO-2020-026)

On 22 December 2019, while carrying out aerial work in the region of Sellicks Beach, South Australia, the pilot and two crew members of the Cessna 172 aircraft became ill, with symptoms including vomiting, light-headedness, dizziness, and loss of feeling in limbs. At that time, the flight had been conducted for about 4 hours through smoke from bushfires in the region.

The pilot observed that the aircraft’s disposable CO chemical spot detector was displaying two black dots, indicating exposure to CO. The pilot subsequently landed the aircraft safely at Parafield. The crew underwent a medical examination and blood samples were taken about 3 hours after the initial symptoms were experienced. The results of those tests showed two crew members having 1.2 per cent COHb levels and the third with 1 per cent. This was reported to be mildly elevated, above the normal expected range of 0.4-0.7 per cent. The investigation is ongoing.

ATSB occurrence (201600006)

During the cruise, the pilot of a Cessna 210 aircraft, reported feeling ‘a bit disorientated’. This continued for the remainder of the flight, although the pilot was aware of the aircraft’s location with reference to the GPS. After landing, the pilot opened the window and door, after which the pilot’s head started to clear and became ‘less brain foggy’. The pilot reported still feeling unwell in the stomach. At the suggestion of the aircraft owner and engineer, the pilot was checked for CO exposure. The tests revealed that the pilot had a ‘small amount of CO poisoning’. It was reported 

that the potential source of CO was a loose exhaust manifold. The aircraft was not fitted with a CO detector.

ATSB occurrence (200001850)

During the climb after take-off, the pilot in command of a Mooney M20J aircraft, smelt a trace of exhaust fumes in the cabin. The aircraft heater was confirmed off and full cabin fresh air was selected. The pilot in command and pilot under training felt nauseous and developed a headache. The crew elected to return to Bankstown and landed without further incident.

The source of the crew discomfort was moderate CO poisoning. The aircraft's CO detector had indicated the presence of CO and the pilot in command had undertaken a blood test after the flight, which confirmed the presence of CO in the pilot's bloodstream. Company engineers could not establish how the engine exhaust fumes entered the cabin. Furthermore, company engineers were unable to find any faults with the aircraft. The aircraft was re-equipped with multiple CO detectors and the problem had not re-occurred since the engineering examination.

ATSB investigation (199601955)

The pilot of a Cessna 172 aircraft departed Orange, NSW at 0620 for a flight to Charleville, Queensland, and climbed to 6,500 ft. The weather was fine and sunny, but very cold so the pilot pulled the heater control to full on. After passing Bollon, 120 NM (222 km) south-east of Charleville, the pilot tuned to the Charleville non-directional beacon^[63] and noted that the needle rotated to indicate straight ahead.

The pilot recalled passing a strip about 25-30 NM (46-56 km) from Charleville and made a mental note that they could land there if the weather deteriorated. The pilot then started to think about the descent and turning the heater down. It appeared that the pilot then lost consciousness. The pilot regained consciousness and observed the aircraft descending through 1,000 ft, at a rate of about 1,000 ft per minute.

The pilot reported pulling back on the control yoke and saw the horizon come into view. The pilot banked the aircraft hard left, and the engine coughed. The pilot then noticed what looked like a very long airstrip ahead and landed. After landing, the pilot noticed the time was 1230 and realised that the estimated time of arrival for Charleville had been about 1100. The pilot reported feeling cold and nauseous, and having an aching head.

The pilot eventually fixed his position about 150 NM (278 km) north-west of Charleville. After repairing the aircraft radio, the pilot was able make contact with an overflying jet aircraft late the next day and was rescued.

Examination of the aircraft’s cabin heating system revealed a large amount of exhaust build-up in the scat hose leading to the cabin heat selector valve. The muffler was badly cracked around the outlet port and had a white soot stain around it. It was concluded that the pilot may have been affected by CO, which entered the cabin via the cracked outlet port of the muffler.

ATSB occurrence (199101931)

While returning to Bankstown from a training flight in a Piper PA-28-181 aircraft, the pilot’s vision became blurred and started feeling nauseous. The pilot was unable to comply with air traffic control instructions, but landed safely. It was determined that the pilot had experienced CO poisoning. The aircraft was examined and a tear was found in an air vent hose.

ATSB occurrence (198803648)

The pilot of a Cessna 172 aircraft reported experiencing severe headaches and nausea during the flight. The aircraft had recently been painted and the 100-hourly maintenance inspection 

conducted. However, a sealing boot on the nose wheel steering rod had failed, allowing CO gases to enter the aircraft cabin.

ATSB occurrence (198404934)

The pilot of a Piper PA-32 aircraft reported feeling discomfort and sickness. It was determined that an unauthorised modification to the aircraft’s ventilation/heating system allowed CO to enter the aircraft cabin.

International occurrences

Aircraft Owners and Pilots Association (2020)

In June 2020, an article was published by an instructor recalling his experience with CO exposure during an instrument training flight. During the flight, the instructor reported that the strong and gusty winds were occasionally pushing exhaust fumes into the cabin and he noticed a 'breeze' in the cabin despite the doors and vents being closed.

The training included turns, which the instructor reported students would often become dizzy and be exacerbated by turbulence. While conducting the exercises, the student mentioned that he was feeling a 'little dizzy' and asked to take a break. The instructor had considered CO, even though the chemical spot detector positioned on the instrument panel in plain view was normal. Despite this, they opened the window and overhead vent. As the instructor also felt a little dizzy, they elected to return to the airport.

On the return flight, the student mentioned that he was 'feeling off and was struggling to find the runway'. The CO detector, which was new, still showed no change. The instructor landed the aircraft and taxied off the runway; the student then taxied to the hangar. The instructor reported feeling more dizzy. After shutting down the aircraft, the student stumbled while exiting and was wobbling. The instructor placed the student onto his back, who started to shake lightly. The instructor also reported that his own feet were numb from the ankles down, and his hands and lips felt the same. He also developed a headache, which lasted all night. The student later told the instructor that he was struggling to understand the instruments on the return flight and could not recall taxiing back to the hangar or shutting down.

Testing established that the instructor and student had 19 and 26 per cent COHb levels respectively. The source of the CO was a hole in the muffler. The instructor specifically stated that:

This wasn't easy to recognize, especially with a brand-new carbon monoxide detector saying we were safe…If you smell fumes and you are dizzy, get back to the airport. It took 15 minutes from the time the dizziness started to the point where one of us couldn’t function. Another 10 minutes, and we both would have been unconscious on our way back to the airport.

AAIB investigation (AAR 1/2020)

On 21 January 2019, the pilot and passenger departed Nantes Airport, France in a Piper PA-46 Malibu aircraft, for a commercial flight to Cardiff Airport, UK. The flight was conducted under visual flight rules and the planned route would fly overhead Guernsey.

When about 13 NM (24 km) south of Guernsey, the pilot asked air traffic control for a clearance to descend to remain in visual meteorological conditions. About 10 minutes later, the pilot asked for a further clearance to descend. The aircraft’s last secondary radar return was observed about 4 minutes after this call. No further radio calls were made by the pilot. A subsequent search for the aircraft was commenced and the main wreckage was located in the water at a depth of 68 m, about 22 NM (41 km) north-north-west of Guernsey.

The passenger was recovered from the wreckage, but the pilot could not be located. The post‑mortem results of the passenger showed a COHb level of 58 per cent. However, as the passenger and pilot were sitting in the same cabin, it was considered likely that the pilot would have also been exposed to similar levels of CO. This would have likely impaired the pilot’s ability to control the aircraft during the later stages of flight. 

The AAIB’s investigation report also referred to another fatal accident involving a Piper PA-28 aircraft, where the toxicology results of the four occupants ‘showed that individual levels of COHb can vary between individuals occupying a compartment contaminated with CO’.

It was reported by the person who managed the aircraft that it was fitted with a ‘strip detector’ located on the right side of the instrument panel in front of the right seat. However, the investigation noted that there were no aircraft records to substantiate this.

Barriers for reducing carbon monoxide exposure

When discussing the measures for reducing the risk to CO poisoning, the AIIB noted that regulators mandate two barriers for preventing CO exposure: ‘initial design’ and ‘regular in‑service inspections’. While many aircraft manufacturers are installing CO detectors in new aircraft, it was not mandatory. The AAIB recognised that:

There is considerable evidence that the second barrier, regular inspections, is not entirely effective. Not only is it difficult to carry out a thorough inspection of all the exhaust components in the crowded engine compartment, it is possible that a mechanic will miss a small crack or subtle signs of a leak. This was noted in Service Difficulty Reports where exhaust systems passed a visual inspection but then failed a pressure test. Moreover, corrosion and erosion occur from the inside of the exhaust system and can be difficult to detect without first dismantling the system.

…It would be difficult for regulators to mandate detailed inspections for the wide range of GA [general aviation] aircraft and exhaust systems currently in service. Moreover, it has been seen from other events that cracks and faults can initiate at any time. While periodic inspections can help reduce the risk, they will not catch every event.

As the existing two barriers to prevent CO poisoning (design and inspections) are not always effective, there is a need for a third barrier to alert pilots to the presence of CO in the cabin in time to take effective action. Low cost warning devices are readily available, and their carriage is actively encouraged by the regulators.

NTSB investigation (WPR19FA022)

On 9 November 2018, a private pilot, student pilot and two passengers of a Piper PA-28-236 aircraft, departed Le Mars, Iowa, US on a cross-country flight to Osceola. The purpose of the flight was for the private pilot to transport the other occupants for a hunting trip.

When about 40 NM (74 km) west of Des Moines International Airport, air traffic control observed the aircraft squawking the emergency transponder code of ‘7700’. Air traffic control established contact with the student pilot on board the aircraft, who reported that they were diverting as the pilot was having a ‘heart attack’. Other pilots in the vicinity were also in contact with the student pilot who indicated that they were intending to land at Guthrie Regional Airport. However, the aircraft did not land as expected and an alert notice was issued. The wreckage was located the following morning, south of the airport. The four occupants received fatal injuries and the aircraft was destroyed. 

Examination of the wreckage identified a 2 inch-long crack in the engines aft exhaust muffler. Further, the inner surface of the muffler heat shroud was coated in sooty tan and grey coloured deposits. Similar deposits were also detected on the inner surface of the cabin heat hose that ducted air from the shroud to the cabin heat distributor box assembly.

Toxicology testing of the occupants revealed elevated levels of COHb.

Civil Aviation Authority of New Zealand occurrences (2018)

While conducting an instrument flight rules flight, the instructor and student pilot of a Diamond DA 40 aircraft, observed the CO detector illuminate four times. This was cross-checked with the standby detector, which had not discoloured. Both crew reported experiencing light headedness, and a reduction in cognition and coordination. In accordance with the Quick Reference Handbook, the crew turned the cabin heat off, and opened the air vents and emergency windows. The 

indication continued to occur multiple times during the flight. With the assistance of air traffic control, the aircraft was landed safely.

The subsequent maintenance inspection identified a hole in the scat ducting, linking the exhaust shroud to the heater valve box. While not confirmed, this was considered the possible source of the CO exposure.

AAIB investigation: EW/C2017/11/02

On 17 November 2017, while conducting training flights near Waddesdon, Buckinghamshire, UK, a Cessna 152 aircraft and Guimbal Cabri G2 helicopter collided mid-air. All four occupants received fatal injuries. The post-mortem results noted that the instructor of the Cessna 152 had an elevated level of COHb of 24 per cent, while the student had less than 5 per cent COHb. The investigation concluded that:

Exposure prior to flight is considered unlikely given the probable elapse of at least several hours since exposure, together with the rate of half-life decay of 4 to 5 hours. These factors would require the COHb to have been at a level considered to be incapacitating and clearly discernible to self or others in the period leading up to the accident flight. Also, there is no evidence to suggest an incapacitating exposure to CO in the one hour before the accident flight as the effects would have been apparent prior to commencement of that flight. It is more likely therefore that the exposure was as a result of a short survival period post-accident, as concluded in the toxicological report.

The subsequent Coronial proceedings (Buckinghamshire Council Coroner’s Service, 2019) into the accident not only raised concerns with the see-and-avoid procedure, but also considered the requirement for carrying CO detectors:

Although it could not be demonstrated that exposure to Carbon Monoxide prior to or during flight played a part in the implementation of “See and Avoid” or the collision, evidence demonstrated that it is not mandatory for light aircraft such as were involved in this collision to carry any Carbon Monoxide monitors or warning devices, notwithstanding their potential availability.

Given the regular service requirements for such craft and the possible limitations in identifying hairline cracks or hidden defects in aircraft exhaust and heating systems, there remains a risk that pilots and passengers may be exposed to Carbon Monoxide in such craft which might directly put them at risk of death or might put the craft at risk of collision or accident carrying with that the inherent risk of death.

In response to the Coroner’s concern, the Civil Aviation Authority (n.d.) (CAA) indicated that the potential for CO contamination in small aircraft was addressed through the regulations that related to aircraft design, manufacture and operation. Specifically:

• Aircraft design: The European Union Aviation Safety Agency promulgated design requirements specific to cockpit contamination measures. These also addressed the required levels for ventilation, the maximum acceptable CO concentration allowed in the cabin, and the design of heating systems with a view to preventing CO contamination. The code did not require CO detectors to be fitted.
• Maintenance: The continuing airworthiness requirements and recommendations require exhaust systems to be inspected in accordance with the manufacturer’s instructions. These inspections varied from a physical inspection, to a physical inspection with partial disassembly, internal inspection and pressure testing. The CAA noted that they have released publications that provide guidance on this topic.
• Operation: The CAA also noted that the CO detectors could be fitted to UK-registered aircraft as ‘standard’ changes’, which removed the need for ‘direct authority involvement’, and allowed detectors to be fitted without the associated time and cost. Essentially, CO detectors were not mandatory, but could be used at the pilot/owner’s discretion. However, the CAA noted that, while aircraft certification requirements should minimise the likelihood of CO contamination, the maintenance of sometimes notably high-utilised aircraft means that contamination may occur.

Notwithstanding the above, the CAA indicated to the Coroner that this was an opportunity for them to review the available guidance material for the prevention of CO contamination.

NTSB investigation (CEN17LA101)

On 2 February 2017, the pilot of a Mooney M20C, reported using the aircraft’s heater throughout the day, and having experienced a headache and stomach ‘butterflies’ at the end of the first flight. The headache subsided for the second flight, but returned after landing. Before the third flight, the pilot expedited his time on the ground, started the engine and sat in the aircraft while completing pre-flight preparations. While taxiing to the runway, the pilot still had a headache and experienced another episode of ‘butterflies’. The symptoms were more intense than previously experienced, but subsided. By the time they reached the runway, the pilot felt ‘good’ and ‘hyper focussed’. The pilot performed the engine run-up and take-off checklist three to four times, before air traffic control ‘snapped’ the pilot out of repeating the checklist.

The flight departed and the pilot experienced more ‘butterflies’ during the climb out. The last action the pilot remembered was receiving a clearance from air traffic control to climb to 6,000 ft on a heading of 240°. The pilot attempted to contact air traffic control twice after this, but on the wrong frequency. Radar data showed the aircraft climbing above 12,000 ft and off course. The aircraft continued to fly until it ran out of fuel and collided with terrain. The pilot survived the accident and regained consciousness afterwards. After exiting the aircraft, the pilot reported feeling very weak and had difficulties walking.

The examination of the aircraft found that the cabin heat was on. Further, the exhaust muffler had several cracks, one of which contained soot/exhaust deposits on the fracture surface, indicating it was pre-existing. This crack allowed exhaust gases to enter the cabin.

The morning following the accident, the pilot’s blood was drawn for CO testing. The results indicated, at that time the pilot had a COHb level of 13.8 per cent. Taking into account the half-life of CO of about 4‑5 hours, with a patient breathing ambient air at sea level, the pilot’s level at the time of the accident was at least 28 per cent.

Civil Aviation Authority of New Zealand (2007)

A New Zealand Civil Aviation Authority article detailed an incident involving an instructor and student pilot on a cross-country flight in winter. During the flight, the instructor elected to turn back to the north due to adverse weather conditions ahead. After completing the turn, the instructor performed a routine check, which involved scanning the instrument panel. When doing so, the instructor noticed that the 'dot' on the CO detector had turned grey since the last check was performed about 15 minutes prior, when it was the normal 'yellowish hue'. In response, the cabin air and heat controls were shut off and upper vents opened.

As the surrounding area was covered in snow, an immediate landing could not be conducted. The instructor monitored his and the student's condition for symptoms of CO exposure, with none apparent. The aircraft was subsequently landed without incident. A post-flight inspection found that the exhaust shroud had come loose and chafed through the exhaust pipe. This resulted in exhaust gases entering the cabin through the heating system. The article specifically noted that:

The cockpit CO detector had worked as intended, but it was the instructor’s vigilance that saved the day. By including the CO detector in his scan (it was positioned close to the ammeter), he noticed the problem within 15 minutes, and his prompt corrective actions and subsequent monitoring of both crew for symptoms quite possibly averted a major accident.

New Zealand Transport Accident Investigation Commission (97-012)

On 11 June 1997, a Beechcraft BE58 Baron twin-engine aircraft, registered ZK-KVL, was being operated on a night freight flight from Palmerston North, New Zealand to Christchurch. The aircraft disappeared from air traffic services radar and the wreckage was located in the Tararua Ranges. The pilot, who was the sole occupant, was fatally injured.

During the cruise and while maintaining 10,000 ft, the radar data showed the aircraft initially remained on track for a short period, before veering to the left. This amended track was maintained for about 1 minute, before the aircraft veered further left. Again, this track was maintained briefly before turning sharply to the right. The aircraft's altitude and ground speed began to decrease and the turn steepened. Shortly after, the aircraft spiralled toward the ground at a high rate of descent before the radar return was lost. The investigation determined that the aircraft had probably encountered severe in-flight icing at 10,000 ft, in the area of a convective cell, resulting in a loss of control.

Toxicology testing during the post-mortem examination found:

…an unexpected level of a carboxy haemoglobin (carbon monoxide) of 14%...The expected level for a person not exposed to carbon monoxide is significantly less than 1%.

The pilot was a non-smoker, and no evidence of exposure to carbon monoxide prior to the flight could be established, such as fumes from the exhaust system of his car. A blood carboxy haemoglobin level of 14% is consistent with an inspired air carbon monoxide concentration of at least 3000 parts per million, whereas under normal circumstances the carbon monoxide concentration in inspired air is infinitesimal.

Based on the established sequence of events and toxicology results, the investigation concluded that:

Another explanation for the aircraft drifting off track, considered likely given the results of the post‑mortem toxicological tests, was the impaired cognitive functioning of the pilot due to the presence and narcotic effects of carbon monoxide. The pilot probably experienced significant mental impairment in the last five to ten minutes of the flight, due to inhalation of carbon monoxide which had entered the cabin of the aircraft and caused a significant rise in the carbon monoxide concentration. This may have caused drowsiness, confusion and loss of situational awareness, of variable but progressive intensity. The pilot was unlikely to have suffered total incapacitation or been rendered unconscious by the carbon monoxide, during the early stages of its onset, and it is probable that he remained conscious at least until the aircraft departed from normal flight. The presence of carbon monoxide, and its symptoms, would probably have been unrecognised by the pilot.

Having eliminated other possible causes it was most likely that the source of inspired carbon monoxide was cabin air contaminated by fumes from a defective combustion type cabin heater. Such a defect could have included combustion tube failure (of the type covered by the AD) or exhaust erosion.

…The potential carbon monoxide affects may have contributed to mistakes of: flying outside the design requirements of the aircraft; continuing in conditions conducive to icing; electing not to use escape options available.

As a result of this accident, the Commission recommended that the Director of Civil Aviation (of the Civil Aviation Authority):

Review the likely safety benefits of the installation of suitable carbon monoxide detection devices in the cabins of aircraft which have potential for an ingress of carbon monoxide, with a view to making the installation of such devices mandatory in appropriate circumstances.

In response, the Civil Aviation Authority accepted the recommendation and indicated that this would be included in the rule making process for the next amendment to the relevant rule.

Historical occurrences

A carbon monoxide experience

The New Zealand Civil Aviation Authority (1997) cited an incident that was published by the UK CAA in 1996. The article recounted the experience of a pilot who was on a private flight with his wife in their Mooney aircraft, when they experienced CO exposure. Prior to this flight, the pilot had reported that the cabin air ducts were not delivering fresh air and, although turned off, the heater was providing warmth. This was to be fixed at a later stage.

On the evening of the incident, the occupants were conducting a test flight after having some maintenance performed on the engine. During the flight, they felt 'much greater heat than before, with a smell of engine'. The pilot elected to return to Shobdon airfield, but soon realised that he was having 'serious difficulties' and his wife was 'clearly in trouble'.

While the pilot was aware of the effects of CO exposure, he indicated that experiencing them first hand was 'another matter'. The pilot was a psychologist, and following the incident, documented his mental processes during the event as follows:

Firstly, I felt distant to operations, and nauseous, and I began to have doubts whether I was really in the plane or was only dreaming. Part of me just wanted to sleep more than anything else in the world, but at the same time a little voice inside told me we were dying of CO poisoning, but I could not quite remember why.

But all I wanted to do was sleep and carry on dreaming. I began to try to determine whether it really was a dream or was this real — and frankly got more and more confused — and I became obsessed with this problem… I gave up on this and decided that I would carry on with the scenario whether it was real or not — nothing worried me by then, my thoughts came from a long way off.

So Shobdon [airport] was in sight, tried the radio but it was after closing, and somehow I prepared for a direct join on long final. Here routine took over and the right things got done without thinking — which was now almost impossible.

There was a 15 knot crosswind and somehow I knew things did not look right... Without thinking I went around, did a circuit on automatic, fighting extreme nausea, and this time made a good touchdown. I do not remember the taxi back and can only pick up the thread when we were fully stopped, neatly parked at engineering. My wife could not stand and looked awful, and I was unable to exit the plane for some time. We recovered enough to get home three hours later.

A subsequent engineering inspection found that the source of CO was from two cracks in the aircraft's engine exhaust system, 'which were not able to be seen with the naked eye'. The pilot also reflected on his experience and concluded that:

Its effect removes urgency, and one just is unable to assimilate reality. One experiences what could be described as an altered state of conscious awareness, rapidly moving to coma.

… Original thinking and problem solving is impossible.

So we all read about human performance, but words in books cannot ever have the impact of experience. This is a problem that can happen to most aircraft at any time. I guess that quite a few unexplained accidents could be put down to this. Be prepared.

By the detector [CO detector], place a check list of procedure should this deadly gas be detected. If you are overcome, you will not be able to remember what to do.

While the CO saturation levels of the occupants was unknown, the pilot's recollection of events provided invaluable insight regarding the adverse effects of CO exposure on cognitive functions.

Carbon monoxide, silent killer

In 2014, the Aircraft Owners and Pilots Association (US) published an article titled ‘Carbon monoxide, silent killer’. The article listed a number of fatal accidents and close calls, where CO was either a known contributing factor or was suspect. Some of these included:

• January 1999: A Cessna 206, operated by the US Customs Service, collided with water on a night training flight. The pilot survived, but had no recollection of what occurred. There was sufficient COHb found in the pilot’s blood that Customs considered CO poisoning as a contributing factor. As a result, Customs purchased industrial electronic CO detectors for their single‑engine Cessna fleet. They subsequently discovered that many of the aircraft had issues with CO in the cabin.
• Mid-December 1997: The pilot of a new Cessna 182 was ferrying the aircraft from the factory to a buyer in Germany. During the flight, the pilot fell ill and suspected CO poisoning. The pilot successfully landed and an examination of the aircraft found that the exhaust muffler had been manufactured with defective welds. Subsequent pressure testing by Cessna identified that 20 per cent of the new 172 and 182 mufflers in inventory had leaky welds.
• 6 December 1997: The pilot of a Piper Comanche 400 fell asleep at the controls. The aircraft continued for another 250 NM (463 km), before running out of fuel. The aircraft glided for a soft wings‑level collision with terrain. The pilot survived the accident. Toxicological testing identified that the pilot had a COHb level of 27 per cent. It was considered almost certain that this level was higher at the time of the accident.
• 17 January 1997: The experienced pilot and mother, who was a low-time private pilot, departed on a 2 hour flight in a Piper Dakota. While en route, the mother contacted air traffic control to advise that the pilot had passed out. Air traffic control attempted to provide assistance, however, the mother also lost consciousness. The aircraft subsequently collided with terrain and both occupants received fatal injuries. Toxicological tests revealed that the pilot and mother had 43 per cent and 69 per cent COHb levels respectively.
• October 1994: The student pilot of a Cessna 150 returned from a solo cross-country flight complaining of headache, nausea and difficulties walking. The pilot was hospitalised and testing revealed elevated levels of CO, which required 5 1/2 hours of oxygen therapy. An inspection of the aircraft identified a crack in an improperly repaired muffler.
• April 1994: About 15 minutes after take-off, the Cessna 182 was observed deviating from headings, altitudes and air traffic control instructions. The pilot reported blurred vision, headaches, nausea, laboured breathing, and difficulties staying awake. The aircraft subsequently collided with terrain, but the pilot survived. The aircraft examination found numerous small leaks in the exhaust system. The pilot also tested positive to CO after 11 hours of oxygen therapy.
• July 1991: The student pilot and passenger were conducting a pleasure flight when the aircraft was observed to turn into a valley, into an area of mountainous terrain. The aircraft collided with the terrain and both occupants were fatally injured. The pilot had a COHb level of 20 per cent.
• August 1990: About 15 minutes into the flight, a Cessna 150 collided with water. Toxicological tests established that the pilot had a COHb level of 21 per cent.
• February 1984: The pilot of a Beech Musketeer aircraft reported to air traffic control that they were unsure of their position. Air traffic control attempted to assist, but a passenger reported that the pilot was unconscious. The aircraft subsequently collided with terrain and all four occupants were fatally injured. Toxicological testing identified that they had COHb levels of 24, 22, 35 and 44 per cent.
• March 1983: After levelling off at 9,600 ft, the right front seat passenger of a Piper PA-220-150 aircraft became nauseous, vomited and fell asleep. The pilot also began to feel sleepy and lost consciousness. A passenger in the back seat attempted to take control of the aircraft. During the emergency landing, the aircraft hit a fence, but none of the occupants were injured. Multiple cracks and leaks were found in the exhaust muffler. The NTSB concluded that the pilot had become incapacitated due to CO poisoning.
   

5. Estimated from the operator’s planned itinerary and runsheets for 31 December 2017.
6. Aerodynamic stall: occurs when airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack, typically 16˚ to 18˚, and results in reduced lift
7. AN3-3A refers to an Army Navy specification, the first ‘3’ specifies a thread diameter of 3/16 inch. The number 3 after the dash refers to the grip length and is equivalent to about 1/16th inch and the ‘A’ specifies there is no drilled hole in the shank (threaded portion).
8. That accident was investigated by the Bureau of Air Safety Investigation, the predecessor to the ATSB. A report on the accident is available on the ATSB website at https://www.atsb.gov.au/publications/investigation_reports/1996/aair/aair199603735/
9. The load factor is the ratio of the normal acceleration to the acceleration due to gravity. All else being equal, this is equivalent to the ratio of the lift to the weight.
10. Refer to section titled Steep turns
11. Transportation Safety Board of Canada (2019), Transportation Safety Board of Canada (2018), Transportation Safety Board of Canada (2017), Transportation Safety Board of Canada (2013), Transportation Safety Board of Canada (2011).
12. Yaw: the motion of an aircraft about its vertical or normal axis.
13. For awareness, it was common for the pilots to advise ground staff if they experienced a magneto drop in excess of the manufacturer’s limits.
14. The Terrey Hills AWS was located on a plateau 195 m above sea level.
15. The Gosford AWS was located at a height of 7 m above sea level, and in a small river valley.
16. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘overcast’ indicates that all the sky is covered.
17. According to the headset manufacturer, ‘typical aircraft sounds (such as engine, propellers, and stall or gear up warnings) will not sound familiar on your first few flights. Such important sounds may be quieter than you are used to. You are responsible for making sure that you can hear, notice and recognize these sounds when using the headset while operating any aircraft’.
18. A notice distributed by means of telecommunication containing information concerning the establishment, condition or change in any aeronautical facility, service, procedure or hazard, the timely knowledge of which is essential to personnel concerned with flight operations.
19. Part 1, 11th Edition July 2018.
20. Civil Aviation Order 20.18: Recording equipment.
21. Lightweight flight recorders comprise of one or more of the following systems: an aircraft data recording system and cockpit audio recording system, which can also record image and data link information; an airborne image recording system; and/or a data link recording system.
22. TSB investigation A11W0048.
23. The camera was not set to the local time, but the relative times were considered to be accurate.
24. SynthEyes is a program for 3D camera tracking, also known as match-moving.
25. ATSB AO-2017-118 interim factual report – December 2018.
26. The timing of the images was derived from the precise timing of iPhone images taken by other passengers on this flight at the Rose Bay seaplane terminal and the operator’s closed-circuit television footage.
27. The focal length of the lens determines the angle of view of the image and therefore the magnification of items in the image. The longer the focal length, the narrower the angle of view and the greater the magnification (zoom).
28. As would be anticipated with a rising tide and prevailing wind direction
29. Flight controls inside the aircraft were connected to flight control surfaces on the aircraft structure.
30. The engine oil filler cap was photographed locked and in situ during the flight preceding the accident flight. The cap was considered to be forced off due to compression of the oil tank during the impact sequence.
31. Angle of attack is the relative angle of the wing section to the oncoming airflow.
32. The wing flexibility in comparison to the fuselage meant the wing deformation angle was greater than that of the fuselage and therefore higher than the stalling angle of attack.
33. Viking Air advised that this right rudder trim setting was normal for this phase of flight due to the clockwise rotation of the propeller. Examination of video taken by passengers on VH-NOO during previous flights also showed that this position was the standard rudder trim setting for this aircraft.
34. Viking Air advised that the elevator trim setting of neutral to slightly nose-down was normal for a ‘heavy’ load.
35. Full flap was only required for emergency landing in very restricted areas.
36. The purpose of the magneto access panel cut-out is to prevent interference or overlap with the adjacent well cover plate on the firewall.
37. Research has shown that it can be difficult to accurately estimate heights unless the observer has been specifically trained or there are adequate cues available for comparison. One source of information for size perception is to use familiar objects to judge the height of other objects (Goldstein, 2009). The aircraft’s height estimates provided by witnesses without using visual references were highly variable and less accurate than witnesses who provided a height estimate using a visual reference
38. Estimation of the height with reference to the surrounding terrain can be difficult due to the variation in the terrain around the sides of Jerusalem Bay. The height estimate will depend on their location and what features in the terrain the person was referencing (refer to the section titled Operational information – Jerusalem Bay for a comparison with the surrounding terrain height).
39. While the witness observations were consistent, the angle of bank should be treated with some level of caution due to general limitations associated with estimating angles particularly in a short time frame.
40. Ischaemia is a restriction in blood supply to tissues, causing a shortage of oxygen that is needed for cellular metabolism (to keep tissue alive).
41. An ECG detects heart problems by measuring the electrical activity generated by the heart as it contracts. ECGs from healthy hearts have a characteristic shape. If the ECG shows a different shape it could suggest a heart problem.
42. An echocardiogram (or ‘echo’) is an ultrasound of the heart, which is performed by a cardiac sonographer. It provides essential information about the structure and function of the heart chambers, valves and related vessels.
43. A stress test or exercise test is used to help diagnose coronary heart disease. The test measures the heart's ability to respond to external stress in a controlled clinical environment. The stress response is induced by exercise or by intravenous pharmacological stimulation.
44. Magnetic resonance imaging uses a magnetic field and radio waves to take pictures inside the body. It is especially helpful to collect pictures of soft tissue such as organs and muscles that do not show up on x-ray examinations.
45. Unremarkable is a medical term used to describe the results as being normal or that there were no abnormalities of significance identified.
46. A full post-mortem involves an external and internal examination, taking samples for later testing, and the possible retention of some organs and tissues for more detailed analysis. A limited post-mortem involves an external examination, but may also include some testing on small samples or an internal examination limited to certain areas of the body (https://www.health.nsw.gov.au/humantissue/Pages/post-mortem.aspx).
47. A right bundle branch block is a condition where a delay or blockage can occur along the pathway that sends electrical impulses to the right ventricles of the heart.
48. The oxidation of haemoglobin to methaemoglobin can result from post-mortem deterioration of the blood sample. Elevated levels of methaemoglobin in a sample will result in a loss of CO binding capacity and will produce an erroneously high COHb saturation level. A reducing agent, such as sodium dithionite, is used to reduce any potential methaemoglobin present in post mortem blood
49. Pilot incapacitation is operationally defined as ‘any physiological or psychological state or situation that adversely affects performance’ (International Civil Aviation Organization, 2012).
50. The last photograph taken by the passenger on board VH-NOO was at 1512:34 during the turn over Cowan Water. The collision with water was estimated to have occurred about 1 minute later.
51. Refer to ATSB investigation report AO-2017-005.
52. The Airservices Australia surveillance data was considered unverified as the aircraft were operating outside controlled airspace and were not required to have a discrete transponder code. However, the timings and flight paths taken were consistent with the operator’s scheduled flights.
53. A 60°angle of bank turn was conducted from 300 ft with landing flap and full power selected.
54. This data was reviewed as the aircraft was commonly used in that country, and as the state of design, would be involved in a lot more DHC-2 accident investigations. Other investigation agencies may also have investigated stall related accidents involving the DHC-2.
55. The muffler is generally considered a component of the exhaust system. However, the report distinguished between the muffler, separately from the exhaust system.
56. Produced within the organism or system.
57. Primarily used as an industrial solvent and as paint stripper/thinner.
58. As explained above, the aircraft was fitted with a main firewall between the accessory bay and cabin, and then an accessory firewall between the accessory and engine bays.
59. Pilot’s snap vent was found partially open.
60. The wind at the time of the testing was at 14 kt with gusts up 25 kt.
61. The smoke generator was primarily used to provide an initial visual indication of airflow in the cabin from the engine and accessory bays. A by-product of the smoke generator was low level CO.
62. The investigation determined that there were no records indicating that a CO detector had been fitted to the aircraft. However, the individual who managed the aircraft believed that a spot detector had been fitted, although that individual did not fit the device.
63. The non-directional beacon and its associated automatic direction finding equipment is primarily a short distance navigational aid.

Introduction

Shortly after take-off from Cottage Point, New South Wales, VH-NOO was observed by witnesses to conduct a 270° right turn in Cowan Water and then enter Jerusalem Bay. The aircraft stopped climbing, continued along the bay for about 1.1 km, and then made a very steep right turn. During the turn, the nose dropped, the aircraft descended and collided with the water. The six occupants were fatally injured, and the aircraft was destroyed.

After boarding the aircraft, the front right seat passenger had taken 22 photographs during an 8-minute period through the side window and front windscreen. In particular, nine were taken after the aircraft became airborne until the photographs stopped part way through the right turn in Cowan Water. Due to a lack of recorded information, it could not be established if the passenger had decided not to take any more photographs or if they had stopped due to a situation in the cabin.

This analysis will examine the occupant’s supplemental toxicology test results with regard to their exposure to carbon monoxide (CO), how this likely affected the pilot, and influenced the development of the accident. In particular, why the aircraft did not continue to climb, entered Jerusalem Bay, and stalled during a steep turn. The likely source of CO exposure and ingress into the aircraft’s cabin will also be discussed. The varying types of CO detectors available for aviation use and their limitations will also be reviewed, along with the regulatory requirements regarding the carriage of these, and the effectiveness of the detector fitted to VH-NOO.

Further, it will examine the varying methods used for determining passenger weights, survivability aspects, and the state of a passenger’s seatbelt. It will also consider the benefits of recorded flight data as an invaluable tool in identifying the factors behind an accident.

Entry into Jerusalem Bay

The aircraft was flown into Jerusalem Bay, a known ‘dead-end’, at a height below the surrounding terrain. Further, the wreckage examination found that the aircraft was in the climb configuration and the engine was operating. However, according to witnesses, it appeared that the aircraft did not climb after the turn in Cowan Water, but rather, it was either level or had descended. The ATSB’s analysis of the passenger photographs also indicated that the aircraft had slightly descended during the turn in Cowan Creek. If the aircraft had continued to climb, it should have been above the height of the immediate terrain when the steep turn was conducted, rather than below.

According to the operator’s pilots and the authorised landing area register, Jerusalem Bay was not one of the departure routes from Cottage Point. Further, examination of the route from Cottage Point to Rose Bay found that there was no apparent operational advantage by using Jerusalem Bay as a departure route. Using such a route would increase the flight distance and time and limit the amount of time and space available to climb the aircraft above the surrounding terrain. There were no known sightseeing opportunities in the bay and there were no reasons identified for the passengers to request that route. As such, there was no operational reason for the aircraft to have entered Jerusalem Bay during the flight.

Stall at low altitude

The pilot was significantly experienced and completed steep turns and stalling exercises in the DHC-2, 7 months prior to the accident. Steeps turns are generally conducted at bank angles no more than 60°, but witnesses reported that the turn in Jerusalem Bay was at an estimated angle of bank of 80-90°. Comments from the operator’s pilots indicated that it was unlikely that the aircraft would have been able to maintain this bank angle. Despite this, and noting the limitations associated with witness observations, the turn was greater than the estimated bank angle required of less than 50° to conduct the turn.

The ATSB’s wreckage examination established that the angle measured from the deformation of the engine and forward fuselage was consistent with a high angle of attack when the aircraft impacted the water. This, combined with the sudden change in aircraft state observed by witnesses, where the nose of the aircraft suddenly pitched down, was consistent with the aircraft aerodynamically stalling. Given the altitude of the aircraft when it stalled during the steep turn, there would have been insufficient height to effect a recovery.

Elevated levels of carbon monoxide in the aircraft cabin

The supplementary toxicology results indicated that the pilot and two of the passengers (the youngest and eldest) had 11, 10 and 9 per cent carboxyhaemoglobin (COHb) in their blood, while the remaining passengers had 4 per cent. Of note, in consideration of the duration from when the blood samples were collected and the CO testing was undertaken, advice from forensic specialists indicated that the samples were reliable and the subsequent test results were valid.

There is a considerable amount of literature available, and studies that have been conducted, examining CO exposure. While the research shows some variability in what was considered to be the normal endogenous production of CO without occupational exposure, generally less than 3 per cent COHb saturation was considered normal for non‑smokers. For smokers, levels up to 10 per cent, or even more were expected. Therefore, from this, and advice received from both the ATSB’s and NSW Police Force (the police) forensic specialists, the occupants COHb levels were considered higher than normal. In particular, the pilot and two of the passengers had more elevated levels.

After becoming aware that the occupants had elevated levels of COHb concentrations in their blood, the ATSB assessed the potential sources of CO that both the pilot and passengers would have been collectively exposed to. The following common sources were considered, but were discounted:

• The temperature on the day did not necessitate heating inside the restaurant and the doors to the outside area were open. In addition to this, the pilot was only momentarily inside the restaurant and would not have been exposed to any heating sources.
• While it was noted that one of the passengers was a regular smoker, photographic evidence showed that the pilot, who was a non-smoker, had returned to the aircraft before the passengers had left the restaurant. Consequently, there were no opportunities for the pilot to be exposed to passive smoking.

Having excluded the above sources, the only other common source was the aircraft, in particular, the aircraft cabin. It was conceivable that, when the passengers boarded the aircraft, the cabin was already contaminated with CO from the 27-minute taxi immediately prior. Although it was possible that some CO would have dispersed from within the cabin when the right rear door was opened for boarding. As only one door was opened, there would not have been a complete flushing of the existing air inside the cabin during the boarding.

Aircraft occupants exposed to the same source of CO may have different levels of COHb concentrations due to their seating position in relation to the CO source, airflow patterns in the cabin, and the individual’s susceptibility or smoking history. Further, as the duration and intensity of the CO exposure increases, COHb levels will increase.

The pilot had the highest level of COHb at 11 per cent, consistent with a longer and/or higher exposure. In this case, the pilot was seated in close proximity to a breach in the firewall (refer to section titled Engine firewall and inspection). In addition, shortly before the accident flight, the pilot had been taxiing alone with the engine running and his door ajar for up to 27 minutes. This, combined with the taxi time on the accident flight, would have very likely exacerbated the pilot’s exposure. It was also likely that the pilot had been exposed to CO during previous flights that day, although there was insufficient information available to determine the extent to which this would have occurred.

For the two passengers with 10 and 9 per cent COHb, advice from the forensic pathologist indicated that their faster breathing rate would account for their higher levels of COHb when compared with the other passengers. Also, one of the passengers was a known smoker and the COHb level of 4 per cent may have been normal. However, given that the other occupants had all been subjected to CO, it was reasonable to deduce that this passenger had also been exposed from CO within the aircraft cabin. Therefore, for all the occupants to have been exposed, it was almost certain that there was elevated levels of CO in the aircraft cabin.

Pilot affected by carbon monoxide exposure

Based on no adverse witness comments regarding the pilot's behaviour, it was conceivable that the pilot was not displaying any obvious physical symptoms of CO exposure prior to the accident flight. However, authoritative research has shown, that at the pilot’s COHb saturation level of 11 per cent, adverse neurobehavioral and cognitive effects were likely present. This was consistent with the advice received from the ATSB’s forensic specialist, who concluded that the pilot would have almost certainly experienced effects such as confusion, visual disturbance and disorientation. Similarly, the police forensic specialist indicated that the pilot may not have had any observable physical symptoms, but may have been experiencing some decreased vigilance, impaired visual perception and manual dexterity. These cognitive effects may have been subtle, and therefore, not obvious to the pilot as being associated with CO exposure.

According to the International Civil Aviation Organization (2012), ‘To pilot an aircraft requires the utilization of a complex set of physical and cognitive skills. Interference with any aspect of these skills and their coordination may have serious personal and public safety consequences’. Specifically, these skills may include effects on perceptual-motor skills, spatial abilities, working memory, attentional performance, processing flexibility, planning/sequencing abilities, alertness, reaction time, coordination, decision making/reasoning, and situational awareness (Front, 2017).

Entering Jerusalem Bay

During the flight, the front seat passenger was regularly taking photographs, but stopped halfway through the turn in Cowan Water. This was coincident with the climb ceasing, although the aircraft was in the climb configuration. The aircraft was then turned towards and entered Jerusalem Bay.

The pilot was very experienced operating from Cottage Point, having reportedly flown at least 780 flights to/from this location. As such, he very likely had a detailed knowledge of the area and would have been aware of the risks of flying in Jerusalem Bay. Therefore, it was very unlikely that the pilot would have intentionally flown into the bay without significant reason. Despite this, the aircraft was flown into, and some distance along the bay. There were no indications that the pilot was attempting to out climb the terrain or land, although there was sufficient distance remaining to land at the position of the steep turn.

The above series of established events were unusual given the nature of operations and were consistent with the pilot having a degradation in performance. These could be plausibly explained by the pilot experiencing adverse effects from CO exposure. Specifically, it was likely that a combination of the effects of confusion, disorientation, impaired situational awareness and visual perception significantly degraded the pilot’s ability to safely navigate the aircraft over Cowan Water, particularly at low-level.

Alternative scenarios for entering Jerusalem Bay

In further support of the likely influence of CO exposure, the ATSB had considered and discounted a number of other possible scenarios to explain why the aircraft entered Jerusalem Bay. These are discussed below and include whether there was an engine or structural issue with the aircraft, if the passengers had requested a deviation into the bay, if the meteorological conditions were 

adverse, if the pilot had a pre-existing medical condition (not related to CO exposure), or if the pilot became distracted during the turn in Cowan Creek.

Issue with the aircraft

Witness observations and photographs of the aircraft shortly before the accident indicated there were no apparent issues with the structural integrity of the aircraft, nor were there any indications of mechanical issues with the engine. This was confirmed by the ATSB’s wreckage examination, where no pre-existing issues were identified with the aircraft that would have precluded normal operation and would explain the apparent lack of climb performance.

Operationally, if a mechanical issue had affected the aircraft’s performance, there was sufficient opportunities for the pilot land in Cowan Creek, or even near the entrance to Jerusalem Bay. Despite this, there were no indications that the pilot had configured, or descended the aircraft in a way consistent with an intention to land.

Route deviation request

The ATSB had considered if the passengers had requested a route deviation into Jerusalem Bay. However, this was deemed very unlikely and was discounted due to the following reasons:

• There were no known points of interest in the bay from a sightseeing perspective.
• It would be uncharacteristic for the pilot to deviate from the normal routes.
• The passengers had not taken any photographs after the turn in Cowan Water, which would seem inconsistent if they had specifically requested to go into the bay.
• While no immediate time pressure was identified, the pilot was scheduled to conduct another return flight to Cottage Point and the passengers had to return for a pre-booked water-taxi.
• The operator’s other pilots indicated that any route deviation requests from passengers were predominantly from local residents and that they would not significantly deviate off track.
   

Meteorological conditions

Witnesses in different locations provided varying descriptions of the environmental conditions at the time of the accident. However, the Bureau of Meteorology observations and analysis of the conditions, the observations of the other pilot who had departed shortly before VH-NOO, and the interpretation of the passenger’s photographs all indicated that the conditions were suitable for floatplane operations and were not considered adverse. Therefore, there was no evidence to indicate that the weather conditions contributed to the development of the accident.

Pilot’s medical information

The pilot had a valid aviation medical certificate with an extensive medical history. While abnormalities were identified in some of the pilot’s electrocardiograms, including sinus bradycardia, this was attributed to his high level of physical fitness rather than from a heart irregularity or taking medication. Further, the pilot's medical records indicated that he had not reported displaying any of the typical symptoms associated with sinus bradycardia. This was consistent with medical literature, which stated that symptoms would not typically be experienced by most individuals with sinus bradycardia. Despite this, consideration of the ECG results by the authorities and relevant specialists indicated they were within normal limits and no issues were identified. A specialist cardiologist consulted by the ATSB also noted evidence of an incomplete right bundle branch block in the pilot’s heart, however, this was commonly found in healthy people. Otherwise, no medical conditions were identified in the pilot’s medical records, in his family history, or through genetic testing post‑accident.

On the day of the accident, the pilot had spoken with a close friend in the morning and conversed with work colleagues and persons at Cottage Point during the day and immediately prior to the flight. They all reported that there was nothing out of the ordinary and he appeared normal, suggesting he was well. Similarly, passenger observations from an earlier flight and photographs of the pilot throughout the day, including in the minutes before departure, suggested the same. 

While the pilot’s post-mortem indicated a mild level of dehydration, the outside air temperature was not excessive, and he was observed throughout the day with drinks. He was also eating and drinking just prior to the 27-minute taxiing flight. Therefore, there was no evidence to suggest that the pilot's general health on the accident day was degraded. 

Passenger physical interference

The ATSB considered if a passenger had interfered with the pilot during the right turn in Cowan Water sufficient to adversely affect his operation of the aircraft. However, there was nothing untoward with regard to the passengers’ behaviour prior to the flight and it would have been uncharacteristic for them to interfere with the operation of the aircraft without reason.

If the pilot had to operate the flap lever in between the two front seats, it may be possible for the front seat passenger to inadvertently knock the pilot. However, the witness photograph of the aircraft flying near the Hole in the Wall showed that the flaps had already been placed into the climb setting, which was earlier in the turn. Generally, there was sufficient space for the pilot to operate the aircraft without interference and none of the DHC-2 pilot’s interviewed had experienced physical interference from a passenger sufficient to prevent them from flying.

Additionally, there were no findings in the post-mortem examination to indicate that the pilot’s injuries were from a source other than the impact. Therefore, there was no evidence to indicate that the pilot was incapacitated, either intentionally or inadvertently, by a passenger.

Aircraft stability

Of the seven witnesses who observed the turn conducted in Cowan Water, five reported that the aircraft appeared normal and in control. Two witnesses had commented that the turn was ‘sharp’ or was similar to a vertical manoeuvre. However, witnesses who observed the aircraft flying along Jerusalem Bay reported that the aircraft seemed normal and in control, and there were no indications to suggest that they were experiencing difficulties.

While the single throw-over control column was found to be still in the pilot position, comments provided by experienced DHC-2 pilots indicated that it would be easy to manipulate the control left and right (for turning) from the front right seat, but it would be challenging to move it forward and aft (for lowering/raising the nose). However, another pilot also indicated that, if the aircraft was trimmed, a passenger could possibly fly the aircraft in a straight-and-level situation. This may make it difficult to differentiate if the pilot or a passenger was in control. Despite this, there was evidence to indicate that someone with aircraft knowledge (the pilot) was in control of the aircraft during the final turn.

Passenger seatbelt

The police were uncertain if the middle row right passenger had his seatbelt fastened prior to his removal from the aircraft. However, the ATSB established that his seatbelt was unfastened at the time of impact based on the following:

• An unfastened seatbelt was observed on the right side of the aircraft prior to the removal of the occupants. The location of that seatbelt was consistent with being that for the middle row right seat passenger.
• The middle row left seat displayed substantially more damage than the right seat. In particular, the left seat had collapsed vertically, which was consistent with the left seat passenger being restrained to the seat at the time of the impact. However, the same damage was not observed on the right seat, which suggested that the right seat passenger had not been restrained at the time of impact.
• Although the post-mortem examinations for both middle row passengers showed no evidence to indicate the presence of seatbelts, the left seat passenger was found with his seatbelt fastened. Both passengers had a similar degree of injuries. However, the left seat passenger had sustained a significant head injury most likely from hyperflexion during the initial stages of the impact sequence while being restrained by a lap belt. No such injury was observed on the right seat passenger.

The passengers had received a pre-flight safety brief prior to departing Rose Bay and would have been aware of the requirement to keep their seatbelt fastened at all times throughout the flight. Further, given the pilot’s diligence, it was very unlikely that he would have taken off without ensuring that all the occupants were restrained. Therefore, it was very unlikely that the right seat passenger was not wearing a seatbelt from the start of the flight, but rather, unfastened it sometime during the flight.

However, this passenger had a COHb saturation level of 9 per cent. As the pilot was likely experiencing adverse effects from CO exposure, it was reasonable to conclude that this passenger was also experiencing the same. As the passenger was very likely not restrained at the time of the impact, this may suggest that he was either responding to his own adverse effects or was rendering assistance to the other passenger or pilot. Despite this, without recorded information from within the cabin, this could not be determined.

Pilot distraction

Distractions can occur unexpectedly, during any phase of flight, but when they have contributed to a safety occurrence they have most often resulted in an incident rather than an accident (ATSB, 2006). The ATSB examined whether a major distraction had temporarily diverted the pilot’s attention away from the task of flying, resulting in the aircraft inadvertently entering Jerusalem Bay. While not a definitive list, the following potential sources of distraction were considered:

• Passengers conversing with the pilot: It would have been challenging for the passengers to communicate with the pilot during the flight as he was wearing a noise cancelling headset and the passengers did not have microphones. While they could attract his attention by either yelling or tapping him on the shoulder, this would unlikely create a distraction of sufficient duration to result in the pilot losing awareness of his location and flightpath.
• Passenger behaviour: A general understanding of the passengers’ characters and witness observations prior to the flight indicated that there were no concerns with their behaviour. There was no evidence from the flight to indicate otherwise.
• Passenger medical event from a pre-existing condition: From their medical history, there did not appear to be any pre-existing conditions with the passengers that would have resulted in an in‑flight medical event. However, if this had occurred, it was considered unlikely that it would have distracted the pilot to such an extent that he temporarily lost awareness of their location and flightpath. Additionally, it would seem more plausible that if there was a medical emergency, the pilot would immediately land or fly to a location where access to medical services were readily available.
• Avoidance of another aircraft: There were no other aircraft operating in the immediate area to distract the pilot.
• An issue with the aircraft: As discussed above, there was no evidence of any issues with the aircraft. Had there been an issue that distracted the pilot, there was opportunity, even once in Jerusalem Bay, to land on the water.

In addition, the ATSB estimated that the time between when the last photograph was taken to entering Jerusalem Bay was about 23 seconds, and a further 24 seconds until the steep turn was commenced. Therefore, if the pilot had been distracted for any of the above reasons during the initial turn, there should have been sufficient time for him to respond to the distraction and react appropriately, such as landing or turning earlier.

Nevertheless, the supplementary toxicology results indicated that two of the passengers had more elevated levels of COHb, similar to that confirmed for the pilot. The ATSB’s forensic and aviation pathology specialist indicated that these passengers were likely experiencing effects from the CO exposure, and as such could have distracted the pilot. However, without recorded evidence from within the cabin, it was not possible to determine if the aircraft entered Jerusalem Bay as a result of the pilot experiencing effects from CO exposure only, or a combination of this and the passenger’s distracting the pilot.

Steep turn and subsequent stall

The principles of flight dictate that it is necessary to increase the angle of attack of the wing when banking into a turn by increasing aft back pressure on the control column, and to increase engine power to maintain altitude and airspeed during the turn. This was supported by the operator’s pilots and the police reconstruction flight where it was demonstrated that, if back pressure was not applied for a steep turn, the aircraft very quickly went into a nose down situation. In addition, the application of rudder is required to ensure the turn is coordinated. According to several DHC-2 pilot’s, this was a crucial aspect for the DHC-2 aircraft. One pilot even noted that the aircraft would almost be impossible to fly accurately and safely in the turn without the use of rudder. 

Over half of the witnesses in Jerusalem Bay who saw the steep turn reported that the aircraft was at least halfway through the turn before the nose suddenly dropped. As the aircraft likely made it part-way through the steep turn rather than rapidly descend into the water earlier, this likely indicated that there was some level of aft back pressure and rudder input being applied by the pilot. However, in contrast, there were no notable indications of an increase in engine power during the turn, which would be expected.

In addition, according to the propeller manufacturer, the damage observed to the propeller was consistent with a ‘lower power condition’. While the exact power setting could not be quantified, this, combined with the possibility that the throttle may have been in the closed (low power) position suggests that someone with aircraft knowledge was attempting to respond to this situation. This would also be consistent with two witnesses who reported that the engine sound went quiet immediately before the aircraft impacted the water. However, these reports were contradictory with the remainder of the witnesses who indicated that the sound was loud and constant until the impact.

The pilot had significant experience operating the DHC-2 and had the skill to safely conduct a 60° angle of bank turn. Despite this, the low-level steep turn was conducted in excess of what was required, and what the aircraft was capable of performing. It would seem very unlikely that an experienced and diligent pilot would knowingly conduct such a manoeuvre and significantly increase the risk of stalling. These actions were consistent with a pilot controlling the aircraft, but with a deterioration in performance. Specifically, this would have included a level of confusion, and degradation in coordination, manual dexterity, alertness, reaction time, and visual disturbance. Therefore, it was likely that the CO exposure had a detrimental effect on the pilot’s ability to accurately and safely operate the aircraft.

Source of carbon monoxide

Research has shown that the most common sources of CO exposure in aircraft are attributed to the engine exhaust systems (including the muffler). The ATSB’s wreckage examination found that some of the exhaust manifold segments were significantly deformed as a result of the accident. A number of cracks or partial fractures were identified on these segments and selected for further examination. The detailed materials examination found that the manifold was cracked in several locations prior to the accident. The cracks had allowed exhaust gases to leak into the engine and accessory bays. The largest crack, in an exhaust flange, showed discolouration adjacent to, and matching the length of the observed crack. This discolouration was considered to be the result of exhaust gases escaping through the crack during engine operation, supporting that the crack was pre‑existing.

The exhaust system was last inspected visually in November during the 100-hourly ‘B’ check, about 2 months prior to the accident. At that time, the aircraft’s maintenance records did not specifically mention any repairs being conducted on the exhaust system. However, research has 

shown that visual inspections may not always be effective and that it can be difficult to detect cracks or subtle imperfections. The design of an exhaust system and densely-packed engine/accessory bay potentially make this task even more so challenging. However, it should be recognised that cracks may occur soon after the inspection. While the ATSB’s material examination identified pre-existing cracking on the exhaust, the age of the cracks or the speed at which they developed was not able to be determined. Therefore, it was not possible to establish if the cracks would have been visible at the last routine maintenance inspection.

While the ATSB noted the potential for leakage of exhaust gases from the slip joints, the joints should not leak when at operating temperatures. In addition, the ATSB's examination of the exhaust segments was unable to identify any obvious leakage, although the deteriorated condition of the joints was noted. Therefore, there was no evidence to indicate that there was exhaust (CO) leakage from these joints, in addition to that from the pre-existing cracks on the exhaust collector ring.

Despite this, irrespective of how frequently a CO-related event occurs, there is an increased risk of exposure whenever there is an exhaust system failure. In this case, it was very likely that the several pre-existing cracks in the exhaust collector ring were the source of the elevated CO level in the aircraft cabin.

Ingress of carbon monoxide into the aircraft cabin

Exhaust cracks and firewall breach

While exhaust cracks can result in exhaust gases leaking into the engine and accessory bays, previous occurrences have shown that cabin heating systems and inadequately sealed firewalls are potential pathways for CO to enter the aircraft cabin. As the aircraft was not fitted with a heating system, the ATSB focused on the firewall. The ATSB found a breach in the firewall; three bolts in total were missing from the two magneto access panels. The combined area of the missing three bolts (each with 4.76 mm diameter) was 53 mm². Photographs from the initial wreckage examination shortly after the accident also showed the same three bolts were missing at that time. Testing conducted by the ATSB on an exemplar DHC-2 aircraft using a smoke generator and simulated exhaust leak placed in both the engine and accessory bays showed smoke and CO entering the cabin through the bolt holes.

The rapid flow of air (and exhaust gases) through the bolt holes was considered to be a consequence of the pressure differential between the engine/accessory bay and the cabin through available ingress paths. During engine operation, the propeller forces air into the engine and accessory bays increasing the pressure relative to the aircraft cabin. Therefore, if there is a breach in the main firewall between the accessory bay and the cabin, then air will flow from the accessory bay into the cabin. If the air contains exhaust gases (CO) this will flow into the cabin.

It was possible some CO ingress could also have been via a combination of the panel being incorrectly orientated and the deteriorated condition of the gasket. The ATSB did not identify any other breaches in the firewall. However, due to damage sustained in the accident it could not be determined with absolute certainty that other breaches existed.

Extended taxi and door ajar

Photographs from an earlier flight and closed‑circuit television footage during the 27-minute taxi shortly before the accident, showed the pilot’s door ajar. This taxi was considerably longer than normal. During testing, the ATSB found that, with the exhaust leak into the engine bay, having the pilot’s door ajar increased the flow of exhaust gases into the cabin through the bolt holes.

Therefore in summary, it was likely that the pre-existing cracks in the exhaust combined with the breach in the firewall from the missing bolts allowed elevated levels of CO to enter the cabin. The amount of CO in the cabin would have likely been exacerbated by the pilot’s door being ajar on the prolonged taxi, and likely from the accident flight.

Reliability of disposable carbon monoxide chemical spot detectors

Disposable CO chemical spot detectors are commonly used in general aviation, most likely due to their cost, size and availability. While spot detectors provide some level of protection against CO exposure, the benefits are far outweighed by the limitations. As previously discussed, detector manufacturers, aviation regulators and industry groups have all recognised the shortcomings of these types of detectors. However, more importantly, these devices are passive and do not actively alert the pilot to the presence of elevated levels of CO in the cabin. Rather, they rely on the pilot regularly monitoring the detector for a change in colour. This, in combination with the commonly known limitations, reduces the effectiveness of the detector as an alerting device.

For the accident flight, while the chemical spot detector was positioned on the instrument panel within the pilot’s field of view, the effectiveness of the detector was likely reduced due to sun bleaching. However, the pilot would not have been actively alerted to the presence of elevated levels of CO in the cabin. Therefore, given the subtlety of some of the physical symptoms and cognitive effects of CO exposure, there was no trigger for the pilot to take immediate action to reduce the risk of further CO exposure to those on board, before adversely affecting the pilot’s ability to safety operate the aircraft.

Of note, there may have been additional opportunities for CO to be detected prior to the accident flight. Such as the 27-minute taxi flight conducted by the pilot shortly beforehand or flights earlier in the day. Even flights undertaken by other pilots in the days leading up to the accident may have provided other occasions for CO exposure to be detected early if an active alerting device had been carried. 

No regulatory requirement for carbon monoxide detectors

As recognised by the United Kingdom Air Accidents Investigation Branch (2020), the two existing barriers for preventing CO exposure, aircraft design and maintenance, may not always be effective. Therefore, a third barrier that actively alerted pilots to the presence of elevated levels of CO in the cabin to allow for an early response is required.

As a result of this investigation, the Civil Aviation Safety Authority now strongly recommends pilots wear personal CO detectors, which are now widely available and inexpensive (refer to airworthiness bulletin AWB 02-064 Issue 2). However, at the time of writing, there was no regulatory requirement for any type of detector to be carried. Consequently, it was up to the operator and/or pilot’s discretion to carry such a device.

This was particularly important when operating piston-engine aircraft that have higher concentrations of CO in the exhaust gases. In this case, VH-NOO was fitted with a passive disposable chemical spot detector. As previously discussed, this type of detector is commonly used in general aviation for a number of reasons, but has a number of known limitations and relies on the pilot regularly monitoring the changing colour of the sensor to show elevated levels of CO.

Several overseas investigation agencies have made safety recommendations to their respective aviation regulators to mandate the carriage of active CO detectors. However, despite the ongoing threat CO exposure poses to aircraft occupants and the potential fatal consequences, these recommendations have not been accepted to-date.

If there had been a requirement for VH-NOO to be fitted with a CO detector that actively engaged the pilot’s attention, it was likely the pilot would have been alerted to the presence of CO. This would have provided the pilot time to take mitigating action.

Magneto access panels bolts

The bolts fitted to the magneto access panels, as specified by Viking Air, were to be AN3-3A type bolts with a hex head. However, the ATSB's examination established that the bolts in situ were a combination of modified AN3 bolts or non-specified bolts. The maintenance provider indicated that these bolts were used for ease of installation or fitted on an opportune basis. Further, the in-situ bolts could be wound all the way into the missing bolt nutplates by hand. This was in contrast to a new AN3-3A bolt, which required the use of a spanner to install. This indicated that the in-situ bolts were worn.

In addition, it was possible that the modified AN3 bolts could not be completely tightened in some cases using an appropriate tool. This was dependant on the location and orientation of the bolt in the panel when fitted to the aircraft.

It was unknown if the missing bolts were installed when the magnetos were last replaced in late 2016 and early 2017. However, it was conceivable that these bolts could have come loose during operations and created a pathway for CO to enter the cabin. Since the missing bolts were not available for examination, it could not be established if these bolts were also worn, modified, or non-specified.

Carbon monoxide detector not effective

As previously discussed, it is widely accepted that disposable CO chemical spot detectors have limitations, one of which includes bleaching from harsh direct sunlight. The manufacturer of the same detector fitted to the aircraft explicitly stated that it should be replaced if such damage occurs. Photographic evidence from earlier flights showed that the spot sensor was light in colour, distinct from the surrounding orange ring. This indicated that the sensor was sun bleached. In addition, the ATSB’s wreckage examination also found the spot sensor was light in colour, consistent with the photographic observations. Although it was recognised that the detector had been immersed in salt water, it was considered likely that the effectiveness of the detector was reduced on the accident flight.

If the pilot had referenced the detector during the extended taxi or accident flight, it likely would have provided a false reading. This removed an opportunity for the pilot to respond to the non‑normal operating condition in a timely manner, thereby reducing the risk of CO exposure to those on board. However, it was unknown if the pilot routinely monitored the detector during a flight. Further, given that the aircraft was in a ‘critical’ phase of flight (take-off flight path), it was not unreasonable to consider that the pilot would have been focused on flying the aircraft within the confines of the terrain rather than checking the detector. Therefore, it could not be established if this ineffective risk control contributed to the pilot’s performance being significantly degraded due to CO exposure.

Monitoring the serviceability of carbon monoxide detectors

Although there was no regulatory requirement for the use of CO detectors, the operator proactively fitted disposable chemical spot detectors to their aircraft. However, the ATSB’s wreckage examination and photographic evidence from earlier flights, showed that the 'date opened' had not been annotated on the detector. Upon enquires from the ATSB regarding the fitment date of the detector installed in VH-NOO, the operator relied on photographic evidence from company pilots to establish an approximate time of fitment. As such, the operator had no mechanism to routinely monitor the useful life and condition of the detectors. This was a missed opportunity to identify and replace the detector fitted to VH-NOO, which was found to be sun bleached within the useful life of 12 months stipulated by the manufacturer.

If there was a monitoring schedule in-place, it was plausible that an effective detector would have been fitted for the accident flight.

Use of volunteered passenger weights

The operator did not generally weigh passengers prior to a flight, but rather, relied on weights volunteered at the time of booking. The operator did not apply allowances to these weights to account for variability since the measurements were taken, and if used, the accuracy of the scales used by the passengers. However, staff would reportedly conduct a visual assessment during check-in and if they had any doubt, they would then weigh them. Research has found that people tend to underestimate the weights of themselves and others. Further, people are less accurate at estimating the weight of others than they are of themselves.^[64] This can make it challenging for staff to detect a discrepancy between a passenger’s volunteered weight and their actual weight on the day of the flight.

For the accident flight, the weights were volunteered about 4 weeks prior. Those weights, when compared with the post-mortem derived weights, were underestimated by at least 26 kg. While the operator was attempting to use a more representative measure, by not applying an allowance to the volunteered weight, or weighing passengers prior to the flight, this increased the risk of overloading. While not contributory, in this case, the aircraft was marginally underweight, but closer to the aircraft maximum take-off weight than realised at the time.

Regulatory advice for establishing passenger weights

The Civil Aviation Safety Authority (CASA) guidance advised that passenger weights could be determined by either using the suggested standard weights or actual weights obtained prior to a flight. However, CASA’s advice did not provide any guidance on the use of volunteered passenger weights. This method was also recognised internationally, with other regulatory agencies allowing the use of volunteered passenger weights, and they were reportedly in common use in the aviation industry, particularly for charter operations. However, in those countries where guidance was provided on the use of volunteered weights, they stipulated the inclusion of an allowance to account for weight variations. For the accident flight, if a volunteered weight with an allowance had been used, the individual passenger weights would have been similar to the factored post-mortem (actual) weights.

The CASA guidance provided a sliding scale for standard passenger weights based on aircraft seating capacity, gender and age. At the smallest seating capacity (7-9 seats), the standard adult passenger weights were closely aligned with the average weights for the Australian population (in 2018). However, as the seating capacity increased, the passenger weight decreased and deviated from the Australian average. At the extreme of the scale (more than 500 seats), the standard weights underestimated the population weights by 7 per cent for males and 9 per cent for females. Therefore, the CASA suggested passenger weights did not accurately reflect the average weights of the current population.

In the case of the accident flight, if the operator had elected to use the standard passenger weights, the pre-flight weight and balance calculation would have underestimated the actual total passenger weight by 105 kg. This would have indicated that the aircraft was even more so under the maximum take‑off weight but would have had no effect as no other passengers, fuel or baggage were required for the flight. However, in other situations, underestimating passenger weights could increase the risk of unknowingly overloading an aircraft by the loading of additional passengers, fuel and/or baggage up to the maximum take-off weight.

Lack of recorded flight data

While there was no regulatory requirement for the aircraft to be fitted with a cockpit voice recorder or flight data recorder, this investigation, and other past investigations, have shown that the absence of such devices has hampered the determination of the factors that contributed to the accident. This has potentially resulted in the non-identification of important safety issues, which will then continue to present a hazard to current and future passenger carrying operations. In addition, investigations necessarily take considerable more time in an attempt to reach a conclusion when there is a lack of recorded data, and also a lack of physical and/or witness evidence to help determine the contributing factors.

In contrast, other investigations where there has incidentally been some form of recording device on board (such as a GPS device, mobile phone or video camera) have included valuable information in determining the factors involved in the accident. Although they have undoubtedly shown the benefits of having a recording device in any form, they are not designed to withstand the impacts and potential fires associated with aircraft accidents and any benefit is often by chance. Even in this investigation, the recovery of photos from the passenger’s camera and phones provided the little evidence that was available.

Mandatory flight data recording devices have long been recognised as an invaluable tool for investigators in identifying the factors behind an accident and their contribution to aviation safety is irrefutable. Traditionally, such systems were generally only fitted on larger aircraft and retrofitting crash protected flight recorders to lighter aircraft was costly and technically difficult. However, advancements in technology have led the way for more cost-effective, self-contained flight data recording systems and airborne image recorders to be accessible to all aircraft. As a result, the International Civil Aviation Organization has developed standards for lightweight recorders and airborne image recorders, and the Civil Aviation Safety Authority has included guidance in an advisory circular. However, neither organisation has mandated their fitment in commercial passenger-carrying operations using aircraft with a maximum take-off weight less than 5,700 kg.

There are a large number of commercial passenger-carrying operations conducted in aircraft that do not require the fitment of flight recorders, such as this one. This means that there is a reasonable potential for further unresolved accident investigations for these type of operations, which poses a significant limitation to the improvement of safety in this sector of commercial aviation.

Survival aspects

The post-mortem examinations identified that the occupants died as a result of their injuries and immersion in water. There were a number of factors identified that limited the survivability of this accident. The estimated speed during the impact was in the order of twice that considered survivable. The forces generated during the impact sequence were sufficient for the seats and restraints to become detached from the aircraft structure, which effectively reduced the liveable space within the cabin. Additionally, the ATSB’s aviation medical specialist determined that it was very likely that the impact rendered the passengers unconscious, affecting their ability to escape from the aircraft, which was rapidly filling with water.

Although members of the public who witnessed the accident were on site within minutes of the impact, the rate at which the aircraft sank prevented them from rendering assistance. This also meant that emergency services, who had to travel to an area with limited accessibility, were unable to provide life-saving services.

Due to the combination of all of these factors, the accident was not considered to have been survivable.

64. Ramos et al. (2009), Reed & Price (1998), Sahyoun et al. (2008), Shapiro & Anderson (2003).

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation. The initial public version of these safety issues and actions are provided separately on the ATSB website, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website as further information about safety action comes to hand.

From the evidence available, the following findings are made with respect to the collision with water involving de Havilland Canada, DHC-2 aircraft, registered VH-NOO that occurred in Jerusalem Bay (Hawkesbury River), New South Wales on 31 December 2017.

Contributing factors

• The aircraft entered Jerusalem Bay, a known confined area, below terrain height with a level or slightly descending flight path. There was no known operational need for the aircraft to be operating in the bay.
• While conducting a steep turn in Jerusalem Bay, it was likely that the aircraft aerodynamically stalled at an altitude too low to effect a recovery before colliding with the water.
• It was almost certain that there was elevated levels of carbon monoxide in the aircraft cabin, which resulted in the pilot and passengers having higher than normal levels of carboxyhaemoglobin in their blood.
• Several pre-existing cracks in the exhaust collector ring, very likely released exhaust gas into the engine/accessory bay, which then very likely entered the cabin through holes in the main firewall where three bolts were missing.
• A 27 minute taxi before the passengers boarded, with the pilot’s door ajar likely exacerbated the pilot’s elevated carboxyhaemoglobin level.
• It was likely that the pilot's ability to safely operate the aircraft was significantly degraded by carbon monoxide exposure.
• Disposable chemical spot detectors, commonly used in general aviation, can be unreliable at detecting carbon monoxide in the aircraft cabin. Further, they do not draw a pilot's attention to a hazardous condition, instead they rely on the pilot noticing the changing colour of the sensor.
• There was no regulatory requirement from the Civil Aviation Safety Authority for piston‑engine aircraft to carry a carbon monoxide detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide in the cabin. (Safety issue)

Other factors that increased risk

• It was likely that the effectiveness of the disposable carbon monoxide chemical spot detector fitted to the aircraft was reduced due to sun bleaching.
• Although detectors were not required to be fitted to their aircraft, Sydney Seaplanes had no mechanism for monitoring the serviceability of the carbon monoxide detectors. (Safety issue)
• The in situ bolts used by the maintenance organisation to secure the magneto access panels on the main firewall were worn, and were a combination of modified AN3-3A bolts and non‑specific bolts. This increased the risk of the bolts either not tightening securely on installation and/or coming loose during operations.
• The operator relied on volunteered passenger weights without allowances for variability, rather than actual passenger weights obtained just prior to a flight. This increased the risk of underestimating passenger weights and potentially overloading an aircraft.
• The standard passenger weights specified in Civil Aviation Advisory Publication (CAAP) 235‑1(1) Standard passenger and baggage weights did not accurately reflect the average weights of the current Australian population. Further, the CAAP did not provide guidance on the use of volunteered passenger weights as an alternative to weights derived just prior to a flight.
• Australian civil aviation regulations did not mandate the fitment of flight recorders for passenger-carrying aircraft under 5,700 kg. Consequently, the determination of factors that influenced this accident, and other accidents, have been hampered by a lack of recorded data pertaining to the flight. This has likely resulted in the non‑identification of safety issues, which continue to present a hazard to current and future passenger-carrying operations. (Safety issue)
• Annex 6 to the Convention of International Civil Aviation did not mandate the fitment of flight recorders for passenger-carrying aircraft under 5,700 kg. Consequently, the determination of factors that influenced this accident, and numerous other accidents have been hampered by a lack of recorded data pertaining to the flight. This has likely resulted in important safety issues not being identified, which may remain a hazard to current and future passenger carrying operations. (Safety issue)

Other findings

• It was very likely that the middle row right passenger did not have his seatbelt fastened at the time of impact, however, the reason for this could not be determined.
• The accident was not survivable due to the combination of the impact forces and the submersion of the aircraft.
• The pilot had no known pre-existing medical conditions that could explain the accident.

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation. Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

No regulatory requirement for carbon monoxide detectors

Safety issue number: AO-2017-118-SI-01
Safety issue description: There was no regulatory requirement from the Civil Aviation Safety Authority for piston‑engine aircraft to carry a carbon monoxide detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide in the cabin.

No monitoring for carbon monoxide detector serviceability

Safety issue number:AO-2017-118-SI-02

Safety issue description: Although detectors were not required to be fitted to their aircraft, Sydney Seaplanes had no mechanism for monitoring the serviceability of the carbon monoxide detectors.

Fitment of recording devices in light aircraft – Civil Aviation Safety Authority 

Safety issue number: AO-2017-118-SI-03

Safety issue description: Australian civil aviation regulations did not mandate the fitment of flight recorders for passenger-carrying aircraft under 5,700 kg. Consequently, the determination of factors that influenced this accident, and other accidents have been hampered by a lack of recorded data pertaining to the flight. This has likely resulted in the non‑identification of safety issues, which continue to present a hazard to current and future passenger-carrying operations.

Fitment of recording devices in light aircraft - International Civil Aviation Organization 

Safety issue number: AO-2017-118-SI-04

Safety issue description: Annex 6 to the Convention of International Civil Aviation did not mandate the fitment of flight recorders for passenger-carrying aircraft under 5,700 kg. Consequently, the determination of factors that influenced this accident, and numerous other accidents have been hampered by a lack of recorded data pertaining to the flight. This has likely resulted in important safety issues not being identified, which may remain a hazard to current and future passenger carrying operations.

Sources of information

The sources of information during the investigation included:

• Sydney Seaplanes
• the NSW Police Force
• Viking Air
• Airag Aviation Services
• aircraft insurer
• a number of witnesses
• a number of floatplane subject matter experts
• other DHC-2 aircraft owners
• aviation medical specialist
• cardiology specialist
• the Department of Forensic Medicine, Sydney
• NSW Health Pathology, Sydney
• forensic and aviation pathology specialist
• the Civil Aviation Safety Authority
• the Bureau of Meteorology
• Airservices Australia
• Transportation Safety Board of Canada
• next-of-kin.

References

Agency for Toxic Substances and Disease Registry. (2012). Toxicological profile for carbon monoxide. Retrieved from https://www.atsdr.cdc.gov/toxprofiles/tp201.pdf

Air Accidents Investigation Branch. (2020). Report on the accident to Piper PA-46-310P Malibu, N264DB, 22 nm north-north-west of Guernsey on 21 January 2019 (AAR 1/2020). Retrieved from https://www.gov.uk/aaib-reports/aircraft-accident-report-aar-1-2020-piper-pa-46-310p-malibu-n264db-21-january-2019

Air Accidents Investigation Branch. (2018). AAIB Bulletin 11/2018: G-WACG and G-JAMM (EW/C2017/11/02). Retrieved from https://assets.publishing.service.gov.uk/media/5bc733dae5274a361ac03dd4/Cessna_152_G-WACG_Guimbal_Cabri_G2_G-JAMM_11-18.pdf

Aircraft Owners and Pilots Association Air Safety Institute. (2017). Stall and spin accidents: Keep the wings flying. Retrieved from https://www.aopa.org/training-and-safety/air-safety-institute/accident-analysis

Aircraft Owners and Pilots Association. (2014). Carbon monoxide, silent killer. Retrieved from https://blog.aopa.org/aopa/2014/10/20/carbon-monoxide-silent-killer/

Australian Bureau of Statistics. (2018). How healthy is the typical Australian? Retrieved from https://bit.ly/3a8SzAC 

Australian Transport Safety Bureau. (2016). Pilot incapacitation occurrences 2010-2014 (AR‑2015-096). Retrieved from https://www.atsb.gov.au/publications/2015/ar-2015-096/

Australian Transport Safety Bureau. (2006). Dangerous distraction: An examination of accidents and incidents involving pilot distraction in Australia between 1997 and 2004 (B2005/0324). Retrieved from https://www.atsb.gov.au/publications/2005/distraction_report/

Baselt, R.C. (2014). Disposition of Toxic Drugs and Chemicals in Man (10th ed) Seal Beach: Biomedical Publications.

Buckinghamshire Council Coroner’s Service. (2019). Regulation 28 report to prevent future deaths. Retrieved from https://www.judiciary.uk/wp-content/uploads/2019/08/Jaspal-Singh-Bahra-2019-0160.pdf

Busch, M. (2015). Carbon Monoxide Exposure in Norwegian Rescue Helicopters. Air Medical Journal, 34(6), 328-332. Retrieved from https://www.airmedicaljournal.com/article/S1067-991X(15)00178-9/pdf

Busch, M. (2003). Carbon Monoxide Detectors. Avweb. Retrieved from https://www.avweb.com/ownership/carbon-monoxide-detectors/

Campman, S.C. & Luzi, S.A. (2007). The sensitivity and specificity of control surface injuries in aircraft accident fatalities. The American Journal of Forensic Medicine and Pathology, 28(2), 111‑115.

Carel, R. S. (1998). Handbook of Air Pollution From Internal Combustion Engines. Retrieved from https://www.sciencedirect.com/topics/earth-and-planetary-sciences/carboxyhemoglobin

Civil Aviation Authority. (2020). Carbon Monoxide Contamination Minimisation & Detection in General Aviation Aircraft. Retrieved from https://bit.ly/3aaVjxk 

Civil Aviation Authority. (n.d.). Civil Aviation Authority response to a report on action to prevent other deaths pursuant to regulation 29 of the Coroners (investigations) regulations. Retrieved from https://www.judiciary.uk/wp-content/uploads/2019/08/2019-0160-Response-by-Civil-Aviation-Authority.pdf

Civil Aviation Authority. (2013). Safety sense leaflet: Winter flying. Retrieved from https://publicapps.caa.co.uk/docs/33/20130121SSL03.pdf

Civil Aviation Authority of New Zealand. (2019). Part 91 - General Operating and Flight Rules. Retrieved from https://www.caa.govt.nz/assets/rules/consolidations/Part_091_Consolidation.pdf

Civil Aviation Authority of New Zealand. (2011). Advisory Circular AC119-3: Air operator certification – Part 135 operations (Revision 6). Retrieved from https://www.aviation.govt.nz/rules/advisory-circulars/show/AC119-3

Civil Aviation Authority of New Zealand. (2008). Magneto check basics. Vector – Point to safer aviation, Issue 2. Retrieved from https://www.caa.govt.nz/assets/legacy/Publications/Vector/Vector_2008_Issue-2_Mar-Apr.pdf

Civil Aviation Authority of New Zealand. (2004, September/October). Carbon Monoxide. Vector. Retrieved from https://www.aviation.govt.nz/assets/publications/vector/Vector_2004_Issue-5_Sept-Oct.pdf

Civil Aviation Safety Authority. (2020). Preventing Carbon Monoxide Poisoning in Piston Engine Aircraft (airworthiness bulletin 02-064 Issue 1). 

Civil Aviation Safety Authority. (2014). Advisory Circular AC 21-46 v3.0: Airworthiness approval of avionics equipment. Retrieved from https://www.atsb.gov.au/sites/default/files/2024-03/advisory-circular-21-46-airworthiness-approval-of-avionics-equipment.pdf

Civil Aviation Safety Authority. (2014). Civil Aviation Order 20.18: Aircraft equipment — basic operational requirements. Retrieved from https://www.legislation.gov.au/Details/F2016C01077

Civil Aviation Safety Authority. (1990). Civil Aviation Advisory Publication 235-1(1): Standard passenger and baggage weights. Retrieved from https://www.casa.gov.au/sites/default/files/2021-08/caap-235-1-standard-passenger-and-baggage-weights.pdf 

Civil Aviation Authority of New Zealand. (2018, September/October). Accident Briefs. Vector. Retrieved from https://www.aviation.govt.nz/assets/publications/vector/Vector-2018-5.pdf

Civil Aviation Authority of New Zealand. (1997). A CO Experience. Vector (Issue 2). Retrieved from https://www.aviation.govt.nz/assets/publications/vector/Vector_1997_Issue-2.pdf

Downunder Pilotshop. (n.d.). ASA Carbon Monoxide Detector. Retrieved from https://downunderpilotshop.com.au/products/asa-carbon-monoxide-detector?_pos=1&_sid=9ddaf735d&_ss=r

European Union Aviation Safety Agency. (2020). Carbon Monoxide (CO) Risk in Small Aeroplanes and Helicopters (safety information bulletin 2020-01). Retrieved from https://ad.easa.europa.eu/ad/2020-01

Federal Aviation Administration. (n.d.). Carbon Monoxide: A Deadly Menace. Retrieved from https://www.faa.gov/pilots/safety/pilotsafetybrochures/media/cobroforweb.pdf

Federal Aviation Administration. (2019). Advisory circular: Aircraft weight and balance control (120-27F). Retrieved from https://www.faa.gov/regulations_policies/advisory_circulars/

Federal Aviation Administration. (2016). Airplane Flying Handbook (FAA-H-8083-3B). Retrieved from https://www.faa.gov/regulations_policies/handbooks_manuals/aviation/airplane_handbook/

Federal Aviation Administration. (2010). Flightcrew alerting (advisory circular 25.1322-1). Retrieved from https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_25.1322-1.pdf

Federal Aviation Administration. (1972). Carbon monoxide (CO) contamination in aircraft – detection and prevention (advisory circular 20-32B). Retrieved from https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_20-32B.pdf

Front, C.M. (2017). Neurocognitive Assessment of Pilots: The FAA Perspective. CASMA Sunday, AsMA Annual Scientific Meeting. Retrieved from https://www.pilotsofamerica.com/community/attachments/neurocognitive-assessment-the-faa-perspective_cama-sunday-at-asma-2017-pdf.84176/

Ghanem, A. A. E., Rahman, R. H. A., & Shabka, O. A. (2012). Stability of Carboxyhaemoglobin in Blood Samples at Different Periods and Temperatures: A Forensic and Toxicological Tool for Diagnosis. Journal of Clinical Toxicology, 2, 144. doi:10.4172/2161-0495.1000144.

Goldstein, E.B. (2009). Sensation and perception (8th ed.), California: Wadsworth Cengage Learning.

Gradwell, D. & Rainford, D.J. (Eds.). (2016). Ernsting’s Aviation and Space Medicine (5th ed). Boca Raton, FL: CRC Press.

Guardian Avionics. (2018). Carbon Monoxide: The Silent Danger in the Cockpit…Protect Yourself This Winter with CO Detectors for Aviation from Guardian Avionics. Retrieved from https://www.guardianavionics.com/carbon-monoxide-silent-killer-in-aviation-cockpit-pilot

Hafeez, Y. & Grossman, S.A. (2020). Sinus Bradycardia. Retrieved from https://www.ncbi.nlm.nih.gov/books/NBK493201/

Hampson, N.B. & Hauff, N.M. (2007). Carboxyhemoglobin levels in carbon monoxide poisoning: do they correlate with the clinical picture?. The American Journal of Emergency Medicine, 2008(26), 665-669.

Harvard Medical School. (2019). Bradycardia. Retrieved from https://www.health.harvard.edu/a_to_z/bradycardia-a-to-z

Hawkins, F. H. (1993). Human Factors in Flight (2nd ed.). Aldershot, England: Ashgate Publishing.

Hossein Cheraghi, S., Jorgensen, M. J. & Myose, R. Y. (2009). Detection and prevention of carbon monoxide exposure in general aviation aircraft (DOT/FAA/AR-09/49).

International Civil Aviation Organization. (2018). Annex 6 to the Convention on International Civil Aviation. Operation of Aircraft – Part I – International Commercial Air Transport (10th ed.). Montreal, Canada: International Civil Aviation Organization.

International Civil Aviation Organization. (2018). Annex 6 to the Convention on International Civil Aviation. Operation of Aircraft – Part II – International General Aviation – Aeroplanes (9th ed.). Montreal, Canada: International Civil Aviation Organization.  

International Civil Aviation Organization. (2012). Doc 8984 Manual of Civil Aviation Medicine (3rd ed.). Retrieved from https://www.skybrary.aero/bookshelf/books/2242.pdf

Kunsman, G. W., Presses, C. L., & Rodriguez, P. (2000). Carbon Monoxide Stability in Stored Postmortem Blood Samples. Journal of Analytical Toxicology, 24, 572-578.

Lacefield, D. J., Roberts, P. A., & Grape, P. M. (1982). Carbon monoxide in-flight incapacitation: An occasional toxic problem in aviation (FAA-AM-82-15). Oklahoma City, Oklahoma: Federal Aviation Administration.

National Transportation Safety Board. (2020). Install Flight Data, Audio, and Image Recorder Systems on all Turbine-Powered Helicopters (ASR-20-04). Retrieved from https://www.ntsb.gov/investigations/AccidentReports/Reports/ASR2004.pdf

National Transportation Safety Board. (2017a). Pilots: Prevent Carbon Monoxide Poisoning (safety alert 069). Retrieved from https://ntsb.gov/safety/safety-alerts/Documents/SA-069.pdf

National Transportation Safety Board. (2017b). Mechanics: Prevent Carbon Monoxide Poisoning (safety alert 070). Retrieved from https://ntsb.gov/safety/safety-alerts/Documents/SA-070.pdf

National Transportation Safety Board. (n.d.). National Transportation Safety Board Preliminary Report (WPR19FA022). Retrieved from https://app.ntsb.gov/pdfgenerator/ReportGeneratorFile.ashx?EventID=20181110X83525&AKey=1&RType=Prelim&IType=FA

National Transportation Safety Board. (n.d.). National Transportation Safety Board full narrative (CEN17LA101). Retrieved from https://www.ntsb.gov/_layouts/ntsb.aviation/brief2.aspx?ev_id=20170207X10221&ntsbno=CEN17LA101&akey=1https://www.ntsb.gov/_layouts/ntsb.aviation/brief.aspx?ev_id=20170207X10221&key=1

National Transportation Safety Board. (2009). Safety Recommendation A-09-010. Retrieved from: https://www.ntsb.gov/safety/safety-recs/_layouts/ntsb.recsearch/Recommendation.aspx?Rec=A-09-010

National Transportation Safety Board. (1985). Safety Report – General aviation crashworthiness project: Phase two – Impact severity and potential injury prevention in general aviation accidents. Retrieved from https://www.ntsb.gov/safety/safety-studies/Documents/SR8501.pdf

National Transportation Safety Board. (1985). Safety Report – General aviation crashworthiness project: Phase III – Acceleration loads and velocity changes of survivable general aviation accidents. Retrieved from https://www.ntsb.gov/safety/safety-studies/Documents/SR8502.pdf

Newman, D.G. (2007). Pilot incapacitation: Analysis of medical conditions affecting pilots involved in accidents and incidents – 1 January 1975 to 31 March 2006 (B20060170). Retrieved from https://www.atsb.gov.au/publications/2007/b20060170/

Ramos, E., Lopes, C., Oliveira, A., & Barros, H. (2009). Unawareness of weight and height – the effect on self-reported prevalence of overweight in a population-based study. The Journal of Nutrition, Health & Aging, 13 (4), 310-314.

Rathore, O. & Rein, G. (2016). Carbon Monoxide Toxicology: Overview of Altitude Effects on the Uptake and Dissociation of COHb and Oxygen in Human Blood. Retrieved from https://nfpa.org/-/media/Files/News-and-Research/Fire-statistics-and-reports/Detection and-signaling/RFImpactAltitudeCOToxicology.ashx

Reed, D. & Price, R. (1998). Estimates of the heights and weights of family members: accuracy of informant reports. International Journal of Obesity, 22, 827-835.

Safe Work Australia. (n.d.). Hazardous Chemical Information System – Carbon monoxide. Retrieved from http://hcis.safeworkaustralia.gov.au/ExposureStandards/Document?exposureStandardID=111

Sahyoun, N. R., Maynard, L. M., Zhang, X. L. & Serdula, M. K. (2008). Factors associated with errors in self-reported height and weight in older adults. The Journal of Nutrition, Health & Aging, 12(2), 108-115.

Shapiro, J. R. & Anderson, D. A. (2003). The effects of restraint, gender, and body mass index on the accuracy of self-reported weight. International Journal of Eating Disorders, 34, 177-180.

Standley, J. (2020). Flight lesson: another 10 minutes - Carbon monoxide poisoning happens quickly. Retrieved from https://www.aopa.org/news-and-media/all-news/2020/june/flight-training-magazine/flight-lesson-carbon-monoxide-poisoning

Taneja, N. & Wiegmann, D.A. (2002). An analysis of in-flight impairment and incapacitation in fatal general aviation accidents (1990-1998). Retrieved from http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.568.2884&rep=rep1&type=pdf

Thakur, P. (2019). Advanced Mine Ventilation. Retrieved from https://www.sciencedirect.com/topics/earth-and-planetary-sciences/carboxyhemoglobin

The European Organisation for Civil Aviation Equipment. (2009). Document ED-155: Minimal operational performance specifications for lightweight flight recording systems. Malakoff, France: EUROCAE.

Transport Accident Investigation Commission. (1998). Report 97-012, Beechcraft BE58 Baron, ZK-KVL in-flight loss of control, Tararua Ranges, 21 km south-east of Paraparaumu, 11 June 1997. Retrieved from https://www.taic.org.nz/sites/default/files/inquiry/documents/97-012.pdf

Transport Canada. (2019). Reducing the risk of carbon monoxide poisoning in general aviation aircraft (civil aviation safety alert 2019-07). Retrieved from https://tc.canada.ca/en/aviation/reference-centre/civil-aviation-safety-alerts/reducing-risk-carbon-monoxide-poisoning-general-aviation-aircraft-civil-aviation-safety-alerts-casa-no-2019-07

Transport Canada. (2019). Use of segmented passenger weights by commercial air operators under subpart 703 of the Canadian Aviation Regulations (advisory circular 703-004). Retrieved from https://www.tc.gc.ca/en/services/aviation/reference-centre/advisory-circulars/ac-703-004.html

Transportation Safety Board of Canada (2019). Assessments of the response to TSB recommendation A17-01. Retrieved from http://www.bst-tsb.gc.ca/eng/recommandations-recommendations/aviation/2017/rec-a1701.html

Transportation Safety Board of Canada. (2018). Air transportation safety recommendation A18-01. Mandatory installation of lightweight flight recording systems. Retrieved from http://www.bst-tsb.gc.ca/eng/recommandations-recommendations/aviation/2018/rec-a1801.pdf

Transportation Safety Board of Canada (2018). Loss of control and collision with terrain: de Havilland DHC-2 (Beaver), C-GEWG, Laidman Lake, British Columbia, 11 nm E (A16P0180). Retrieved from http://www.tsb.gc.ca/eng/rapports-reports/aviation/

Transportation Safety Board of Canada (2017). Loss of control and collision with terrain: Air Saguenay (1980) inc., de Havilland DHC-2 Mk. 1 (Beaver), C-FKRJ, Tadoussac, Quebec, 7 nm N (A15Q0120). Retrieved from http://www.tsb.gc.ca/eng/rapports-reports/aviation/

Transportation Safety Board of Canada. (2013). Air transportation safety recommendation A13-01. Requirement for lightweight flight recorder system in commercially operated aircraft not governed by CARs 605.33. Retrieved from http://www.bst-tsb.gc.ca/eng/recommandations-recommendations/aviation/2013/rec-a1301.pdf

Transportation Safety Board of Canada (2013). Loss of control and collision with water: Cochrane Air Service, de Havilland DHC-2 Mk.1, C-FGBF, Lillabelle Lake, Ontario (A12O0071). Retrieved from http://www.tsb.gc.ca/eng/rapports-reports/aviation/ 

Transportation Safety Board of Canada (2011). Loss of control - collision with water: Seair Seaplanes Ltd., de Havilland DHC-2 MK 1(Beaver) C-GTMC, Lyall Harbour, Saturna Island, British Columbia (A09P0397). Retrieved from http://www.tsb.gc.ca/eng/rapports-reports/aviation/

Tsang, P. S. & Vidulich, M. A. (2003). Principles and practice of aviation psychology. Mahwah, New Jersey: Lawrence Erlbaum Associates, Inc.

Turner, T. (2016). Angle & attitude: stall/spin crashes, and how to avoid them. Flight Safety Australia. Retrieved from https://www.flightsafetyaustralia.com/2016/03/angle-attitude-stallspin-crashes-and-how-to-avoid-them/

White, J. J. (1932). Carbon monoxide and its relation to aircraft. United States Naval Medical Bulletin, XXX(2), 151‑165.

World Health Organization. (1999). Environmental health criteria 213: Carbon monoxide. Retrieved from http://www.inchem.org/documents/ehc/ehc/ehc213.htm

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Airag Aviation Services
• Sydney Seaplanes
• Civil Aviation Safety Authority
• Viking Air
• Transportation Safety Board of Canada
• Covington Aircraft
• United States National Transportation Safety Board
• United Kingdom Air Accidents Investigation Branch
• ATSB aviation medical specialists
• NSW State Coroner
• NSW Police forensic pharmacologist.

Submissions were received from:

• Airag Aviation Services
• Sydney Seaplanes
• Civil Aviation Safety Authority
• United Kingdom Air Accidents Investigation Branch
• ATSB aviation medical specialists.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A - Summary of the pilot’s medical records and electrocardiogram examinations 

Year	Country	Summary of records and electrocardiogram examinations
2007	Canada	Some abnormality of heart rhythm, but an exercise electrocardiogram (ECG) was normal (declared by the pilot in his 2008 and 2012 medical examinations).
April 2008	Canada	The ECG showed sinus bradycardia. The pilot was assessed as ‘safe to fly’.
April 2009	Canada	No ECG was performed. It was noted that the pilot ran three times per week and attended the gym. The pilot was assessed as being ‘fit’.
April 2010	Canada	It was noted that the pilot ran three times per week. The ECG was ‘within normal limits’, with sinus bradycardia observed. The pilot was assessed as being a ‘healthy pilot’ and ‘fit’.
April 2011	Canada	No ECG was performed; the pilot was assessed as being a ‘healthy pilot’.
March 2012	Australia	The ECG showed sinus bradycardia without other abnormalities. After descending and ascending three storeys by stairs, twice over, the pilot’s pulse increased and was regular. It was concluded that the slow pulse rate probably reflected the pilot’s high level of physical fitness.
March 2013	Australia	No ECG was performed. There was no irregularity in the character of the pilot’s pulse or any abnormality in his cardiovascular system.
July 2013	Canada	It was noted that the pilot ran twice weekly and attended the gym. The pilot’s ECG was found to be ‘abnormal’, with sinus bradycardia and right axis-consider right ventricular hypertrophy[65] reported. The pilot was assessed as being ‘fit’.
March 2014	Australia	There was no irregularity in the character of the pilot’s pulse or any abnormality in his cardiovascular system. The ECG reported a septal infarct,[66] but it was concluded the pilot was fit and healthy, and exercised four times per week and that the ECG tracing was an automated reporting artifact and not indicative of any pathology of the heart. The ECG was also assessed by a cardiologist and deemed to be within normal limits.
September 2014	Canada	It was noted that the pilot ran for 30 minutes, three times per week. An ECG was performed and the pilot was found to have a ‘borderline rhythm’ and marked sinus bradycardia. The pilot was assessed as being ‘fit’.
September 2016	Maldives	An echocardiogram, a stress test and magnetic resonance imaging (MRI) of the heart were undertaken. The echocardiogram reported a mildly dilated right ventricle, but was otherwise considered normal. An MRI was performed and was reported as being unremarkable, with an atrial septal defect[67] excluded. The stress test showed the pilot had good effort tolerance and was negative for any inducible ischaemia. The overall results were examined by a specialist who determined that the pilot was fit for all types of duties and training.
March 2017	Australia	The physical examination found there were no overt signs of neurological disease, and no abnormalities in the pilot’s cardiovascular and respiratory systems. There were no significant abnormalities detected on the ECG and it was assessed by the Civil Aviation Safety Authority’s consultant cardiologist to be within normal limits.

Appendix B - Transportation Safety Board of Canada investigated DHC-2 stall occurrences

Appendix C - On board recording devices

ATSB investigations with undetermined findings

The below is a selection of aircraft accident investigations with undetermined findings. These involved aircraft commonly used for passenger-carrying operations predominantly with a maximum take-off weight less than 5,700 kg, which the investigation would have benefited greatly from access to data from a recording device.

ATSB investigation 200501977

This accident involved an aircraft with a maximum take-off weight greater than 5,700 kg and was fitted with a flight data recorder, but an unserviceable cockpit voice recorder. However, it showed how a lack of recorded and/or physical evidence can hinder the investigation progress and findings.

On 7 May 2005, a Fairchild Aircraft Inc. SA227-DC Metro 23 aircraft with two pilots and 13 passengers, was being operated on a regular public transport service from Bamaga to Cairns, Queensland, with an intermediate stop at Lockhart River. The aircraft impacted terrain on a heavily timbered ridge, about 11 km north‑west of the Lockhart River aerodrome. At the time of the accident, the crew was conducting a non-precision approach to runway 12. The aircraft was destroyed and there were no survivors. The investigation concluded that the accident was almost certainly the result of controlled flight into terrain, that is, an airworthy aircraft under the control of the crew was flown unintentionally into terrain, probably with no prior awareness by the crew of the aircraft's proximity to terrain.

While the flight data recorder provided tracking and altitude information for the aircraft, the cockpit voice recorder had malfunctioned. The investigation report stated that:

Some factors will never be known due to the absence of cockpit voice recorder information and witnesses, as well as the destruction of the aircraft.

The lack of CVR data significantly hindered the investigation’s ability to conclusively determine the precise sequence of events leading up to the collision with terrain. 

ATSB investigation AO-2006-004

On 19 January 2006, a Beech Aircraft Corp 58 Baron aircraft, departed Darwin Airport, Northern Territory, on a charter flight to McArthur River Mine aerodrome. On board were the pilot and one passenger. During the flight, the pilot advised air traffic control of his expected arrival time at McArthur River Mine. The aircraft was observed to fly overhead the aerodrome at a normal circuit height, and it appeared to be tracking to a mid to late downwind position for a landing. The aircraft did not land at the aerodrome at the expected arrival time and a search was commenced.

The wreckage was located about 4 km east of the aerodrome. The aircraft impacted the ground inverted in a steep nose-down attitude. The wreckage was consistent with a loss of control situation, but the reason for the loss of control could not be determined.

ATSB investigations involving incidental recorders

ATSB investigation AO-2013-226

On 16 December 2013, the pilot and passenger of a de Havilland DH82A (Tiger Moth) aircraft were conducting a commercial joy flight (including aerobatics) in the Gold Coast area, Queensland. While conducting the aerobatics, the left wings failed and the aircraft descended steeply, impacting the water about 300 m from the eastern shoreline of South Stradbroke Island. As a result of this investigation, seven safety issues were identified.

The aircraft was fitted with two video cameras to record the flight. One camera was not recovered, but the other camera, which was mounted in the front cockpit position facing rearwards, was located and recovered from the accident site. The video started before take-off and stopped about 10 seconds prior to the impact with the water. The investigation report stated that:

The recovery of the video recording device and successful download of the data was pivotal in the ATSB’s understanding of the left lower wing failure in this accident. Interpretation of the data informed the ATSB’s understanding of the:

• weather conditions at the time
• duration of the flight and aerobatic manoeuvres preceding the failure
• nature of those aerobatic manoeuvres
• failure sequence.

The increasing prevalence of all manner of aircraft, engine and other systems and personal recording devices is well known. The availability and utility of the on-board video equipment in this case reaffirms the need for investigators to be open to the presence to these types of equipment, and to recover them for possible later download and analysis of the recorded data.

ATSB investigation AO-2017-005

On 10 January 2017, the pilot and three passengers of a Cessna 172, registered VH-WTQ, were on a charter flight to a beach aeroplane landing area in Queensland. The pilot was conducting an airborne inspection of the landing area when, at about 60 ft above mean sea level, the aircraft’s engine had a sudden power loss. After performing initial checks, the pilot elected to conduct a significant left turn towards the beach. During the turn, the aircraft impacted the beach with little or no control and a significant descent rate. As a result of this investigation, eight safety issues were identified.

The passenger in the front right seat recorded a video of the entire flight on a mobile phone. The footage provided continuous video and audio information throughout the entire flight. The footage primarily included views outside the aircraft, but also included some footage of inside the aircraft, including occasional footage of the cockpit instruments. Specifically, the footage provided data on the aircraft’s indicated airspeed, vertical speed indications, engine rpm, altitude, attitude, and some of the cockpit control settings. The footage was also used to conduct an audio analysis of engine and propeller speeds throughout the flight.

ATSB investigation AO-2018-006

On 17 January 2018, a Robinson R44 helicopter, registered VH-HGX, departed from the Yulara Town helipad, Northern Territory for a 15-minute scenic flight with one pilot and three passengers on board. Shortly after take-off, and while flying over trees, the helicopter’s engine speed and main rotor speed began to decay. The low rotor speed warning horn activated. In response, the pilot advanced the throttle, but was unable to recover the rotor speed, which continued to decay. About 30 seconds after departing, the pilot broadcast a mayday call and conducted an emergency landing.

A rear seat passenger provided video footage for the first 17 seconds of the flight. This allowed the ATSB to establish the sequence of events with regard to the helicopter’s performance during the take-off and the activation of the warning horn. It further allowed the ATSB to analyse specific parameters such as the airspeed, engine power settings and rotor speed in an attempt to identify what led to the decay.

Recommendations for the fitment of lightweight recording devices

United States National Transportation Safety Board

On 27 July 2007, two news helicopters collided mid-air while manoeuvring in Phoenix, Arizona (AAR0902). The investigation determined that both pilots’ failed to see-and-avoid the other helicopter. While some air traffic control data and audio/video streams were available, the amount of useful information from these was limited. The investigation recognised that:

If recorder systems that captured cockpit audio, images, and parametric data had been installed on the accident helicopters, the recorders would have enabled Safety Board investigators to determine additional information about the accident scenario, including the helicopters‟ precise locations altitudes, headings, airspeeds, engine performance, and other systems information. It is also possible that recorded images could have shown the proximity of one helicopter to another and any obstruction that might have prevented a pilot from seeing another helicopter. The Safety Board concludes that recorder systems that captured cockpit audio, images, and parametric data would have significantly aided investigators in determining the circumstances that led to this accident.

It was further noted that, at the time of the investigation, the EUROCAE ED-155 specification was being progressed and several helicopter manufacturers were developing digital imaging recorders. These ‘developments in incorporating data recording, as well as audio and image recording, into more affordable flight recorder systems for smaller aircraft are significant’. As a result of this investigation, the following recommendations to the Federal Aviation Administration (FAA) were made:

The Safety Board believes that the FAA should require the installation of a crash-resistant flight recorder system on all newly manufactured turbine-powered, nonexperimental, nonrestricted-category aircraft that are not equipped with an FDR and are operating under 14 CFR Parts 91, 121, or 135.

The Safety Board also believes that the FAA should require all existing turbine-powered, nonexperimental, nonrestricted-category aircraft that are not equipped with a CVR [cockpit voice recorder] and are operating under 14 CFR Parts 91, 121, or 135 to be retrofitted with a crash-resistant flight recorder system. The crash-resistant flight recorder system should record cockpit audio, a view of the cockpit environment to include as much of the outside view as possible, and parametric data per aircraft and system installation, all to be specified in EUROCAE [European Organisation for Civil Aviation Equipment] document ED-155…

In addition to the above accident, the National Transportation Safety Board (NTSB) have had a number of other investigations involving turbine-powered helicopters where a lack of crash‑resistant or crash-protected flight recording systems have hindered their understanding of the circumstances of the accident. Unfortunately, this meant that potential safety issues were left unaddressed. On 2 June 2020, the NTSB recommended (ASR-20-04) that major helicopter manufacturers install crash-resistant flight recorder systems that capture cockpit audio and images with a view of the cockpit environment on new turbine-powered helicopters. Further, the NTSB also recommended that manufacturers provide a means for installing the same equipment on existing turbine-powered helicopters. Specifically, the NTSB stated that:

The NTSB is concerned that the persistent lack of requirement for TSO [technical standards order]-compliant crash-resistant recorders and the FAA’s ineffective actions to encourage voluntary compliance for such equipage continue to hinder fully developed analyses of causal and contributing factors in investigation of accident and incidents involving helicopters not equipped with a crash-resistant recorder system. Further, the accidents that we have investigated in which the helicopter had a recorder on board have allowed us to identify critical safety issues.

The NTSB concludes that the routine installation of crash-resistant flight recorder systems on newly manufactured and existing helicopters is necessary to identify and mitigate risks to public safety. The NTSB also concluded that the routine installation of crash-protected cockpit image recorders on newly manufactured and existing helicopters is necessary to identify and understand flight crew actions within the cockpit. The NTSB further concludes that, given the FAA’s inability for more than 20 years to require the installation of TSO-compliant recorders and its sole reliance on voluntary programs proven to be ineffective to encourage such installations, manufacturers should voluntarily install this equipment.

Transportation Safety Board of Canada

On 31 March 2011, the pilot of a de Havilland DHC-3 Otter departed on a daytime flight to the Rackla airstrip, Yukon. About 19 minutes after take-off, the aircraft emergency locator transmitter beacon activated. The aircraft was subsequently located on a hillside. The investigation (A11W0048) determined that the aircraft had experienced a catastrophic loss of control and in‑flight breakup. However, as there was insufficient factual information available, the reason for the loss of control could not be established.

While the aircraft was not fitted with or required to be fitted with a cockpit voice recorder or flight data recorder, if such recordings were available, the identification and communication of safety deficiencies to advance transportation safety may have been possible. The investigation highlighted that:

The benefits of recorded flight data in aircraft accident investigations are well known and documented. Flight recorders have been considered primary tools in large aircraft accident investigations for decades. Currently, CVRs and FDRs [flight data recorder] are considered the most comprehensive methods of capturing large amounts of flight data for accident investigation purposes. Investigation reports involving aircraft not equipped with flight recorders occasionally contain data downloaded from GPS, engine monitors, or other non-crash–protected non-volatile memory sources in lieu of flight recorder data, and radar data. Investigation reports that are able to use data from flight recorders as well as from non-flight–recorder sources that contain non-volatile memory are higher quality and more likely to identify safety deficiencies than reports that do not.

Commercially operated aircraft weighing less than 5700 kg are usually not fitted at manufacture with the system infrastructure required to support an FDR, and conventional FDRs would require expensive modifications in order to be installed in this category of aircraft. Several affordable, stand-alone, lightweight flight recording systems that can record combined cockpit image, cockpit audio, aircraft parametric data, and/or data-link messages, and that require minimal modification to the aircraft to install, are currently being manufactured…

The investigation also commented that there were ‘numerous examples of accident investigations involving small aircraft that were hampered by the lack of flight recorder data’. As a result of this accident, the following recommendation was made:

The Department of Transport work with industry to remove obstacles to and develop recommended practices for the implementation of flight data monitoring and the installation of lightweight flight recording systems by commercial operators not currently required to carry these systems.

In addition to the above accident, on 13 October 2016, a Cessna Citation 500 aircraft departed on a private night flight to Calgary/Springbank Airport, Alberta. While on climb, passing through 8,600 ft above mean sea level, the aircraft made a tight right turn and then entered a steep descending turn to the right until it collided with terrain. The investigation (A16P0186) determined that the aircraft departed controlled flight for undetermined reasons. As per the above accident, the aircraft was not equipped with, or required to be fitted with a flight data recorder, a cockpit voice recorder, or any other lightweight recording device. The investigation reinforced that:

Following a fatal accident with no survivors or witnesses, an investigation may never be able to determine the exact causes and contributing factors unless the aircraft is equipped with an on-board recording device. The benefits of recorded flight data in aircraft accident investigations are well known and documented.

Currently, flight data recorders (FDRs) and cockpit voice recorders (CVRs) are considered the most comprehensive methods of capturing large amounts of flight data and can assist investigators in determining the reasons for an accident. FDRs record information such as altitude, airspeed, heading, and other aircraft parameters, many times per second. CVRs record radio transmissions and ambient cockpit sounds, such as pilot voices, alarms, and engine noises.

As seen in the previous accidents, critical flight and voice data was not available, which limited the opportunity to identify safety issues. Consequently, another recommendation was made to the Department of Transport to require the mandatory fitment of lightweight flight recording devices for commercially and privately operated aircraft that are not currently required to carry these systems.

United Kingdom Air Accidents Investigation Branch

On 30 March 2008, a Cessna Citation 500 aircraft departed Biggin Hill, Kent, in the United Kingdom, on a private flight to Pau, France. Shortly after take-off, the crew initiated a return to Biggin Hill after reporting an engine vibration. While returning, the aircraft descended, and the crew reported a major power problem just prior to impacting the side of a house. The two flight crew and three passengers were fatally injured.

The aircraft was not equipped with either a flight data recorder (FDR) or cockpit voice recorder (CVR) and nor was it required by regulations. However, the accident investigation (AAR 3/2010) concluded that the lack of recorded data meant that they were ‘short of critical information which could have provided further insight and a clearer understanding of the factors leading to the loss of the aircraft’. It was further noted that the International Civil Aviation Organization (ICAO) Flight Recorder Panel had provided proposals to the ICAO Air Navigation Commission to consider mandating or recommending the fitment of recorders in this category of aircraft. As a result, the Air Accidents Investigation Branch issued a safety recommendation (2010-016) for ICAO to adopt the Flight Recorder Panel’s proposals for the installation of flight recorders on turbine engine-powered aircraft with a maximum take-off weight of 5,700 kg or less.

European Union Aviation Safety Agency

While related to small helicopters, the European Union Aviation Safety Agency published a safety information bulletin (2019-15) in November 2019 highlighting the ‘potential safety enhancement that can be achieved through this equipment’. They recommend that all owners and operators consider installing a flight data recorder (either crash-protected or lightweight) and that type certificate holders provide the equipment as part of a helicopter’s basic configuration or have an option for in-service retrofit.

New Zealand Transport Accident Investigation Commission

On 19 February 2015, a Robinson R44 helicopter was returning to Queenstown, New Zealand from a training flight when it broke-up in-inflight. The two occupants were fatally injured. The New Zealand Transport Accident Investigation Commission’s investigation (AO-2015-002) into the accident determined that the helicopter broke up in-flight when one of the main rotor blades struck the cabin, which was caused by a phenomenon known as mast bumping. However, they were unable to conclusively determine what initiated or contributed to the mast bump event. They further highlighted that the causes and circumstances of these type of accidents are ‘unlikely to be fully understood until a means of recording cockpit imagery and/or other data is made available’. The investigation report further stated that:

There have been many other fatal mast bump accidents involving Robinson helicopters in New Zealand and around the world that have gone largely unexplained.  It is difficult to identify the lessons from an accident and make meaningful recommendations to prevent similar accidents if the underlying causes cannot be determined.  This is a serious safety issue that the industry will need to address.

A remedy for the lack of reliable data concerning specific accidents is to record flight data and cockpit video.  At present ICAO standards do not require flight data recorders to be installed in small and medium helicopters.  However, lightweight and affordable recorders are available and are installed as standard equipment in some helicopters.  In addition, technical means are available for detecting, and therefore recording, the positions of flight and engine controls on helicopter types that have previously been unsuited for the collection of digital data.

As a result of this investigation, the Commission recommended that the Ministry of Transport promote, through ICAO, ‘the need for cockpit video recorders and/or other forms of data capture in the cockpits of certain classes of helicopter’.

Appendix D - Engine exhaust system (manifold) materials examination report

Introduction

Following the results of the supplementary toxicology reports, which identified that the occupants had been exposed to carbon monoxide (CO), a further examination of the aircraft wreckage was conducted. From this, and a review of other evidence, the ATSB determined that the aircraft’s engine was the only source of CO common to both the pilot and passengers. Therefore, the aircraft’s accident-damaged exhaust system was examined for evidence of pre-existing fractures, cracks or holes that may have contributed to the elevated levels of CO.

Scope

The scope of the examination was to conduct a visual inspection of the exhaust system (manifold) to identify areas of cracking, fracture or other defects. In addition, selected exhaust sections were sectioned and microscopically examined to determine if any of the cracking existed prior to the accident.

Examination

Visual examination

The exhaust segments and carburettor heat muff were laid out as they were removed from the engine (Figure 47). The outside section of the number 6 cylinder heat muff was not present for examination.

Some of the exhaust segments, especially from cylinders number 3 through 5, were significantly deformed as a result of accident damage. Four cracks or partial fractures were identified on these segments and selected for more detailed examination. There was one partial fracture away from this area, adjacent to the flanged connection to the cylinder exhaust port. The identified fractures are labelled A to E in Figure 47 and detailed in Figure 48.

Figure 47: Exhaust segments from VH-NOO, including carburettor heat muff.

Note: Cylinders numbered clockwise. Labels A through E shows location of fractures examined. Source ATSB

Figure 48: Detailed images of fractures identified in Figure 47 (scale approximate)

Source: ATSB

The identified fractures were associated with localised deformation from impact forces during the aircraft’s collision with water. The most significant deformation was to the Y-segment (Figure 48 detail C and D) and the number 3 cylinder segment. To the extent that could be determined,^[68]the fracture surfaces matched, indicating there was no significant material missing or holing of the exhaust.

Three of the exhaust segments were sectioned and lab-fractured to allow fractures B, D and E to be examined in detail.

Fracture E

The as-examined fracture at the number 7 cylinder exhaust flange extended approximately one-third of the way around the pipe circumference. Notably, the crack extended past the bolt hole (Figure 49 inset, top right), and after sectioning it was noted that there were two visibly-distinct fracture regions. The largest region exhibited a significant amount of surface contamination, whereas the small region adjacent to the bolt hole was significantly cleaner (or ‘newer’) in appearance.

There were also differences in the fracture morphology between the two regions. The newer region showed considerable necking (or narrowing) of the material thickness, and dimpled rupture on the fracture surface, which was evidence of ductile overstress (Figure 50). The existing crack surface showed intergranular fracture and no evidence of ductility. The marked difference fracture 

morphology and surface contamination build-up indicated that the cleaner fracture likely occurred during the accident sequence, whereas the more contaminated fracture surface represented a crack that existed prior to the accident.

The newer fracture region was only visible on the right side (as pictured) of the existing crack. The left side of the crack deviated as it approached the seam weld adjacent to the bolt hole (shown as a localised bulge in the wall thickness), and progressed towards the flange, along the weld line. This allowed the crack to open up without any additional fracture on the existing crack plane.

The existing crack was adjacent to and aligned with the position of the flange-to-pipe fillet weld. The outer surface of the flange in this region was discoloured, which was not observed on any of the other exhaust flanges.

Figure 49: Cylinder number 7 exhaust flange crack (detail E)

Source: ATSB

Figure 50: Scanning electron microscope images of cylinder number 7 exhaust flange crack fracture surfaces

Note: Accident fracture (ductile rupture, top) and existing crack (intergranular, bottom).

Source: ATSB

Fractures B and D

The fracture at B similarly showed significant variation in the level of contamination of the fracture surface (Figure 51). As above, there was also significant variation in the fracture morphology between the two regions. The contaminated region experiencing an intergranular failure, and the areas outside of this showing ductile rupture. Following the same logic as above, this indicated that the area of fracture following the weld line existed prior to the accident.

Fracture D in the Y-segment was predominantly ductile overstress, comprising only localised areas of through-thickness corrosion. This suggested there was no significant pre-existing cracking in this area.

Figure 51: Crack B fracture surface showing the extent of pre-existing cracking

Source: ATSB

Chemical analysis

Several samples of the collector ring material were subjected to semi-quantitative chemical analysis by energy dispersive spectroscopy (EDS). Results showed that the base material was consistent with AISI type 321 stainless steel, which is commonly used for aircraft exhaust manifolds.

Analysis was also conducted on the fracture surface E contamination. Among the elements identified was a significant concentration of lead. Lead was not normally attributed with manufacture of the exhaust manifold, but is a by-product of the combustion of lead-containing fuels used in general aviation.

Corrosion

All of the fractures were located adjacent to welds and the components had significant surface corrosion, especially around fractures C and D in the Y-segment. Thickness measurements, using a point micrometer, found the material adjacent to these fractures was up to 30 per cent thinner than the parent metal, measured away from the fractures.

Cross sections of material were taken from fracture B, one with pre-existing cracking and a second with the newer fracture surface. The sections were mounted, ground and polished for metallographic examination. The specimen was examined in the as-polished state. The fracture surfaces considered to be pre-existing showed evidence of intergranular corrosion and cracking (Figure 52). These features were not present in the corresponding microstructure at the newer fractured edge.

Previous exhaust repair

The Y-segment had been repaired or re-manufactured, as it contained additional seam welds, and excess material remained internally at the juncture between the #4 exhaust riser and the collector ring. The Y-segment was replaced with that from a different engine in June 2015. The history prior to that was not examined.

Figure 52: Fracture B as-polished metallographic sections through the fracture surface of the existing crack (top) and accident fracture (bottom) - note difference in intergranular features

Source: ATSB

Discussion

While at least one of the fractures was predominantly ductile overstress, occurring almost entirely as a result of impact forces, a number of the crack surfaces exhibited distinct differences in the fracture surface morphology. This indicated that the fractures occurred by different mechanisms. The different levels of surface contamination indicated the fractures also occurred at different times. Combining these features indicated that the cracks with the greater level of contamination pre-dated the accident, while the fractures newer in appearance likely occurred as a result of impact forces. Additionally, the detection of lead in the fracture surface contamination of the number 7 exhaust flange was consistent with fuel combustion by-product. This was also the most likely reason for the discolouration of the flange and therefore indicative of exhaust gases passing through the crack.

The 321 stainless steel used in the exhaust construction was suitable for the intended purpose. The elevated temperatures experienced by the exhaust manifold under normal operation, over an extended period of time, likely resulted in sensitisation^[69] of the steel. Sensitisation tends to primarily affect the weld heat-affected zone, which was consistent with the location of the existing cracking, as well as the surface corrosion and localised thinning of the material. The sensitisation allowed for preferential corrosion and weakening of the material at the grain boundaries, which then made them susceptible to intergranular cracking.

While it was determined that cracks were present that pre-dated the accident, the age of the cracks or the speed at which they developed was not determined. Additionally, the two-stage fractures and extent of the exhaust deformation meant that all of the cracks identified were significantly wider (more ‘open’) than they would have been pre-accident, which would have affected the extent to which exhaust gases were able to pass through.

Conclusion

The following is a summary of the findings made during examination of the engine exhaust manifold from the DHC-2 Beaver, VH-NOO:  

• Cracks existed in the exhaust manifold prior to the accident. At least one of these allowed exhaust gases to leak into the engine bay.
• The exhaust manifold cracking was likely due to sensitisation of the steel during normal operation.
• The material used in the construction of the exhaust manifold was appropriate for the purpose.

Appendix E - Report on carbon monoxide testing on an exemplar DHC-2

Introduction

Following the receipt of the occupants’ carbon monoxide (CO) toxicology results in March 2020, the ATSB’s re-examination of the aircraft identified a likely source and method of ingress into the cabin. In order to test this hypothesis, the operator offered the ATSB the use of their DHC-2 aircraft and a pilot for CO testing purposes. The testing was undertaken in Moruya, New South Wales, on 20 May 2020, where the aircraft was stored due to the COVID-19 lockdown.

Scope

While maintaining a high level of safety for participants, the purpose of the test was:

• to ascertain if an exhaust leak could result in CO entering the aircraft cabin
• establishing a baseline CO level in the cabin
• compare the CO levels under varying conditions to the baseline levels - these comprised an exhaust leak, magneto access panel bolts (each 4.826 mm diameter) missing from the main firewall, and the pilot’s door ajar with the passenger door closed

The intent of the testing was not to replicate the exact conditions of the accident flight.

Participants

There were seven participants present at the testing:

• two ATSB senior transport safety investigators who coordinated and directed the testing
• a DHC-2 pilot provided by the operator
• an experienced DHC-2 licensed aircraft maintenance engineer and apprentice from an independent maintenance facility
• a representative from the operator and a local floatplane facility who provided additional logistical assistance.

Pre-testing briefing

The ATSB investigators provided the participants with background information on the accident and the proposed test schedule under the provisions of the Transport Safety Investigation Act 2003.

The participants discussed the most appropriate method for conducting the tests. This included the use of smoke generators to simulate a visible ‘exhaust leak’. In addition, the licensed aircraft maintenance engineer indicated that removing a connecting sleeve from the exhaust would not likely create a sufficient leak. Rather, it would be more appropriate to have an extension hose from the exhaust tailpipe into the engine and accessory bay cowlings.

The ATSB also provided a safety briefing with respect to the relative toxicity of CO levels, based on published data. It was agreed that if the readings reached the maximum recommended exposure levels and continued to rise, the testing would cease and the occupants would immediately exit the aircraft.

Testing

Test conditions

The testing was to be performed with the aircraft stationary and engine running at idle (approximating taxi engine speed).The aircraft was towed to a section of grass on the airport (Figure 53), with its nose oriented to provide a quartering headwind, similar to the wind direction on the day of the accident. The aircraft had not been started for 3 months and was therefore started and run for several minutes to warm it up prior to the commencement of the test.

Figure 53: Exemplar DHC-2 used for testing

Source ATSB

Prior to the commencement of testing, it was noted that the aircraft was missing one bolt from the left access panel and another was loose. A new AN3-3A bolt was sourced and fitted before testing began.

Three calibrated multi-gas detectors were used, one in each of the front, middle and rear rows. Each test was performed until the participants were satisfied that the CO levels on the detectors had reached a steady state – with no further fluctuations.

Test schedule

The test schedule measured the CO levels in the cabin under a combination of the following conditions:

• a baseline aircraft
• bolts removed from the magneto access panels in the main firewall
• simulated exhaust leak in the engine and accessory bays
• the pilot’s door closed/ajar and all other doors closed
• pilot snap vent and window open/closed.

Results

Baseline

For the baseline condition, the engine was run at idle power (~500 rpm) with all doors, windows, and window ventilation snap vents closed. The CO detector alarmed in the front row, soon after the engine start, but then dissipated shortly after. The CO levels in parts per million (ppm) for the baseline condition is presented in Table 8.

Table 8: Carbon monoxide levels for baseline aircraft

Cabin location	Steady state CO (ppm)	Maximum value CO (ppm)
Front row	10	35
Middle row	5	10
Rear row	2	7

Source: ATSB

The following test examined variations in the position of the pilot’s door and window snap vents with all the passenger doors and windows closed. The highest reading occurred in the front row with the pilot’s door closed and snap vent open. The results are shown in Table 9.

No significant change in the CO level was observed when the pilot’s window was opened. In addition, the engine speed was increased to 1,500 rpm, with an increase in the CO level of about 2 ppm.

Table 9: Carbon monoxide levels for baseline aircraft with variations in ventilation

Cabin location	Door open, snap vent closed Steady state CO (ppm)	Door closed, snap vent open Steady state CO (ppm)
Front row	8	18
Middle row	2	7-13
Rear row	0	6-12

Source: ATSB

A smoke generator was then attached to an extendable pole and held inside the engine bay cowling on both sides of the engine (Source: ATSB Figure 54). A smoke test was conducted in the baseline condition with the pilot door closed and window snap vent open (Table 10). The highest reading was achieved in the front row and decreased towards the rear of the cabin.

Table 10: Smoke test conducted with door closed and snap vent open

Smoke generator location	Maximum CO (ppm)
Engine bay right side	10
Engine bay left side	55

Source: ATSB

Figure 54: Application of smoke into the engine bay through the cowling

Source: ATSB

Magneto access panel bolts removed

Two bolts from each access panel were then removed (Source: ATSB Figure 55) to represent the condition known at the time of the accident. At the time of the CO testing, it was considered that four bolts were not in place at the time of the accident. This was later assessed to be three bolts, with two not in place on the pilot’s side panel.

The remaining baseline conditions were re-tested. In this case, having the snap vent open produced a slightly higher result than having the pilot’s door and vent closed. Having the door open reduced the CO levels (Table 11).

Table 11: Carbon monoxide levels with bolts removed

Cabin location	Door and vent closed  Maximum CO (ppm)	Door closed, vents open Maximum CO (ppm)	Door open  Maximum CO (ppm)
Front row	30	34	15
Middle row	14	18	12
Rear row	7	12	8

Source ATSB

Figure 55: Magneto access panel during testing with bolts removed

Source: ATSB

A second smoke test was then conducted with the bolts removed and the snap vent open. The amount of smoke in the cabin was observed to be noticeably greater than the first test (Figure 56). With the pilot’s door slightly ajar, more smoke was drawn into the cabin.

Figure 56: Cockpit during smoke test with bolts removed

Source: ATSB

Exhaust leak

An exhaust leak was then simulated by extending a small diameter hose from the exhaust tailpipe  into the engine bay in front of the accessory firewall (Figure 57). The CO concentration level was measured at the outlet of the simulated exhaust ‘leak’ and was found to be greater than 500 ppm.

The amount of CO detected with the pilot’s door closed was highest at the pilot’s position (maximum of 60 ppm). This increased to over 80 ppm when the door was ajar. This was likely due to differences in air pressure between the cabin (low pressure) and the engine bay (high pressure), which increased the flow of exhaust gases through the holes into the cabin (Table 12).

Table 12: Carbon monoxide levels for simulated exhaust leak in engine bay, bolts removed

Cabin location	Door closed  Steady state CO (ppm)	Door ajar CO (ppm)
Left seat	55 – 60 (footwell)	80 (steady) >100 (max)
Right seat	32	-

Source: ATSB

The simulated exhaust leak was then moved to the accessory bay, in between the accessory and main firewalls (Figure 57). Even higher CO levels were detected in the pilot’s side footwell with the door closed (144 ppm), compared with the right side at chest height (48 ppm). However, when the pilot’s door was ajar the CO concentration levels reduced slightly.

Figure 57: Simulated exhaust leak into the engine bay (left) and the accessory bay (right)

Source: ATSB

Table 13: Carbon monoxide levels for simulated exhaust leak in accessory bay, bolts removed

Cabin location	Door closed Maximum CO (ppm)	Door ajar  Maximum CO (ppm)
Left seat	144 (footwell)	< 144
Right seat	48 (chest height)	< 48

Source: ATSB

The magneto access panel bolts were then reinstalled with the simulated exhaust leak remaining in the accessory bay. The CO concentration level was considerably lower at 28 ppm with the pilot’s door closed. With the door ajar the CO levels reduced slightly.

Table 14: Carbon monoxide levels for simulated exhaust leak in accessory bay, bolts reinstalled

Cabin location	Door closed Maximum CO (ppm)	Door ajar Maximum CO  (ppm)
Left seat	28	<28

Source: ATSB

Conclusion

This testing demonstrated that either the simulated exhaust leak or magneto access panel bolts not being in place did not result in high levels of CO in the cabin in isolation. However, in combination these resulted in elevated CO levels in the cabin. The CO was more evident at the pilot’s position and was exacerbated when the pilot’s door was ajar and the simulated exhaust leak source was in the engine bay. The CO levels reduced markedly in the cabin (by more than  80 per cent) when the access panel bolts were reinstalled with the exhaust leak remaining. The door position in this configuration did not adversely affect the CO levels.

Airag Aviation Services comments

On 28 September 2020, in response to the draft report, Airag Aviation Services advised the ATSB that they had concerns regarding the validity of the testing. Largely, these were related to:

• The test was not representative of the operational and environmental conditions of the accident flight.
• There was no comparison with other piston-engine aircraft.
• The testing should have compared the CO levels before and after engine start.
• The simulated exhaust leak would not have been representative of the size of the leak in VH‑NOO.
• The testing was not representative of the ventilation effects of the engine and accessory bay cowlings.
• The flow of air and exhaust gases in the accessory bay were not considered.
• The difference in air pressure between the cabin and accessory bay at higher power settings than that experienced during taxiing.

While the ATSB noted these concerns, as detailed above, the purpose of the testing was to establish if CO from an exhaust leak could enter the aircraft cabin under varying conditions, rather than replicate the exact accident flight. Of note, Airag Aviation Services did not conduct independent testing to verify the above.

65. Right ventricular hypertrophy is a condition defined by an abnormal enlargement of the cardiac muscle surrounding the right ventricle. Essentially, it is the thickening of the walls in the right ventricle.
66. A septal infarct is a patch of dead, dying or decaying tissue on the septum. It is usually caused by an inadequate blood supply during a heart attack.
67. An atrial septal defect is a hole in the wall between the two upper chambers of the heart (atria).
68. The extensive deformation at fracture C precluded a complete assessment
69. Sensitisation refers to grain boundary precipitation of a chromium carbide, nitrides, or intermetallic phase, in response to thermal cycles, without providing sufficient time for chromium to diffuse to the locally-depleted region. The region depleted of chromium is then susceptible to corrosion.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.