Investigation number
AO-2018-019
Occurrence date
Location
39 km east south east of Broome Aerodrome, Western Australia
State
Western Australia
Report release date
Report status
Final
Investigation level
Defined
Investigation type
Occurrence Investigation
Investigation status
Completed
Aviation occurrence type
Fuel exhaustion
Occurrence category
Serious Incident
Highest injury level
None

Safety summary

What happened

On 02 March 2018, at 1549 Western Standard Time, a Skippers Aviation Cessna 441 Conquest, registered VH-LBY, departed on a scheduled passenger service from Fitzroy Crossing to Broome, Western Australia with one pilot and nine passengers on board.

During descent, the FUEL LEVEL LOW annunciators illuminated. The pilot observed that both fuel quantity gauges indicated sufficient fuel remaining and continued flying towards Broome. The right engine began surging, followed by similar surging from the left engine. Subsequently, the right engine lost power and the pilot conducted the engine failure checklist.

The pilot declared a MAYDAY and advised air traffic control that, as the left engine was still operating, the aircraft would be able to reach Broome. However, the left engine also lost power and both engines were unable to be restarted. The pilot landed the aircraft safely on the nearby highway. There were no injuries, and the aircraft was undamaged.

What the ATSB found

Due to water contamination in the fuel tanks, the aircraft’s fuel quantity gauges were significantly over reading on the day of the occurrence and on previous days. The water contamination had existed for some time without being detected by multiple pilots’ fuel quality testing.

Although the pilot routinely compared indicated versus calculated fuel quantities, and indicated versus flight-planned fuel quantities, the pilot did not routinely conduct two other methods stated in the operator’s procedures for cross-checking fuel quantity gauge indications.

In addition, although the operator had specified multiple methods of cross-checking fuel quantity gauge indications for its C441 fleet, there were limitations in the design, definition and/or application of these methods. The primary method used (indicated versus calculated fuel) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications. Pilots also did not record (and were not required to record) sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified, and pilots did not routinely cross-check information from fuel quantity gauge indications with information from the independent fuel totaliser.

The FUEL LEVEL LOW annunciators likely illuminated approximately 30 minutes before the fuel was exhausted in each tank, and when the aircraft was still within range of suitable alternative airports. However, the pilot disregarded the annunciations, and relied on the (erroneous) fuel quantity indications and continued to Broome until the engines lost power, at which point a forced landing on a highway was the only remaining option.

What has been done as a result

The operator increased the frequency of a fuel quantity comparison checks to a known quantity to ensure continued quantity measurement accuracy, specified clearer requirements for determining discrepancies when using fuel totaliser figures, implemented additional fuel management record keeping and increased management oversight of its Broome operations. It also increased focus on fuel management procedures during training.

Safety message

Accurate fuel management is a critical aspect of flight operations, and it is important to utilise all available means in order to gain the highest assurance that fuel quantity measurement is accurate. It is essential that a reliable quantity cross-check is adopted, utilising at least two independent methods and a conservative approach. Pilots also should understand the functionality of the low fuel warning system on their aircraft and treat any warning annunciations as being accurate unless there is overwhelming evidence otherwise.

Further reading is available in the ATSB research report, Starved and exhausted: Fuel management aviation accidents (AR-2011-112). This report discusses methods that pilots can use to ensure they will have sufficient fuel to land at their destination.

The occurrence

Previous sectors

On 2 March 2018, Skippers Aviation was operating a twin turboprop Cessna 441 Conquest (C441), registered VH-LBY, on a four-sector scheduled passenger flight from Broome to Fitzroy Crossing, then to Halls Creek, returning via Fitzroy Crossing to Broome, Western Australia. The flight was conducted as a single-pilot operation under instrument flight rules. No significant weather was forecast for Broome and there was a risk of afternoon thunderstorms at the other destinations.

The pilot flew the same aircraft on the previous day. At the end of that day’s flying, the pilot recorded on the aircraft’s flight log that the fuel gauges were indicating a total of 1,300 lb[1] usable fuel.[2] Prior to the first flight on 2 March, 600 L (1,050 lb) of fuel was uploaded, which resulted in a calculated fuel on board of 2,350 lb. This amount was sufficient to conduct all four sectors.

After arriving at Halls Creek following the second sector on 2 March, the pilot recorded the fuel quantity gauges as indicating a total of 1,430 lb usable fuel. The pilot stated that the indicated fuel quantities after the first two sectors were consistent with the expected (flight-planned) fuel burns for those sectors. The pilot also reported that the first three sectors were conducted without incident and on schedule.

Prior to departure from Fitzroy Crossing

The aircraft arrived at Fitzroy Crossing after the third sector at 1532 Western Standard Time.[3] The pilot recorded the fuel quantity gauges as indicating a total of 1,300 lb. This indicated that the fuel burn for the third sector was 130 lb, although the pilot recorded 230 lb on the flight log. The flight-planned fuel burn for the third sector was 357 lb, and the pilot was expecting a fuel quantity indication of about 1,110 lb rather than 1,300 lb.

The pilot’s flight plan estimated 977 lb was the minimum required for the final sector (included reserves). Noting that the indicated fuel quantity (1,300 lb) was above the minimum required according to the flight plan, the pilot did not consider the difference between the expected fuel quantity and indicated quantity any further.

Departure and cruise

The pilot and nine passengers were on board for the last sector from Fitzroy Crossing to Broome (Figure 1).

The pilot reported that, during the taxi for departure at Fitzroy Crossing, the right fuel transfer pump (R X-FER PUMP FAIL) annunciator illuminated momentarily. The pilot attributed this to fuel moving within the tank during the left turn onto the runway from a downward sloping taxiway. The pilot also noticed an imbalance between the quantity indications (left tank higher than right) and selected the right engine crossfeed (both engines supplied from the left tank). The pilot reported that the quantity indications for both sides were similar prior to take-off.

The aircraft departed Fitzroy Crossing at 1549. The pilot reported that the take-off and climb to flight level 260 (FL 260)[4] were normal.

Figure 1: Aircraft track (just prior to top of climb until landing) and highway

Aircraft track (just prior to top of climb until landing) and highway

Source: Google Earth, modified by the ATSB

The aircraft reached top of climb at 1607. The pilot stated that, shortly after, the left main boost pump (fuel pump) circuit breaker opened, and the left auxiliary boost pump (L AUX BOOST ON) annunciator illuminated (indicating automatic activation in order to maintain fuel supply). After a short delay to allow the fuel pump to cool, the pilot reset the circuit breaker. The pilot recalled that the circuit breaker opened again, so they conducted the main and auxiliary fuel boost pump failure checklist.

At 1613, the pilot contacted air traffic control (ATC) and advised that the aircraft was maintaining FL 260 at about 90 NM from Broome. ATC cleared the pilot to descend when ready to 7,000 ft. About a minute later, the pilot commenced descent. At this point the aircraft was approximately 27 NM south of Curtin Airport and 42 NM south of Derby Airport (Figure 1).

At about this time, the pilot observed a fuel imbalance (right tank higher than left) that was not consistent with the fuel quantity indications on departure and the fuel flow observed during climb. The pilot selected left engine crossfeed (both engines supplied from the right tank), but the right auxiliary boost pump (R AUX BOOST ON) annunciator did not illuminate as it should for this crossfeed selection. The pilot assessed this as an annunciator fault as the left tank quantity showed an expected increase.

The pilot stated that, during the crossfeed, the R X-FER PUMP FAIL annunciator flickered on and then off, prompting the pilot to stop the crossfeed. The R FUEL LEVEL LOW annunciator then illuminated. The pilot observed that both fuel gauges indicated sufficient fuel to continue to Broome. Shortly after, the R X-FER PUMP FAIL and right fuel pressure low (R FUEL PRESS LOW) annunciators also illuminated. A few minutes later, the corresponding left fuel system annunciators also illuminated.

Engine power losses

The pilot recalled that, soon after the annunciators illuminated, the right engine began surging, prompting the pilot to conduct the partial/intermittent engine power checklist. During the checklist actions, the left engine also started to surge. Following completion of checks for the right engine (with no success), the pilot conducted the checks for the left engine. During this activity, the right engine lost power and the pilot then conducted the engine failure checklist.

At 1623, the pilot contacted the Broome tower controller and declared a MAYDAY.[5] The aircraft was approximately 47 NM east of Broome at FL 155. By this time, the aircraft was now a similar distance from Derby and Curtin (Figure 1).

At 1627, the tower controller asked the pilot if the aircraft would still be able to reach Broome. The pilot advised that the left engine was still operating, and they would be able to reach Broome. At this time, the aircraft was descending through 10,800 ft and approximately 38 NM from Broome. However, shortly after, the left engine also lost power. The pilot attempted to restart the left engine. It regained power for a brief time before surging and losing power again. Further restart attempts were made on both engines without success.

Diversion and forced landing

With both engines not providing power, the pilot assessed that the aircraft would not reach Broome and they tracked to the south towards the Great Northern Highway in the vicinity of Roebuck Plains.

At 1633, the pilot notified Broome tower of the ‘dual engine failure’ and intentions for the forced landing. The aircraft was approximately 22 NM east of Broome at approximately 4,000 ft. The pilot was unable to extend the landing gear normally and conducted an emergency extension of the gear. Although a passenger brief was conducted, the passengers were not instructed to brace for the emergency landing.

The pilot landed the aircraft safely on the highway approximately 21 NM east-south-east of Broome without injuries or aircraft damage (Figure 1).

After landing, the pilot made radio contact with another aircraft in the area, and the pilot of that aircraft relayed their status and requirements to Broome tower. All passengers were subsequently transferred to Broome via road. The aircraft was towed and secured at a nearby truck stop.

A photo of the fuel quantity gauges taken approximately 1 hour after landing indicated about 1,120 lb fuel on board (Figure 2). Subsequent inspections identified that little or no usable fuel was on board.

Figure 2: Fuel gauges after forced landing

Fuel gauges after forced landing

The image shows the fuel gauges indicating a total of about 1,120 lb of fuel on board, about 1 hour after landing on the highway. With the addition of fuel calibration card corrections, the indicated amount should have represented 1,220 lb.

Source: Pilot of VH-LBY following occurrence flight

__________

  1. The Cessna 441 Pilot’s Operating Handbook and instrumentation refers to fuel quantity as a weight in lb. The operator specified a conversion factor of 1.74 (1 L equals 1.74 lb). A quantity of 1,300 lb equated to 747 L.
  2. Unless otherwise noted, the indicated fuel quantities in this report include the application of fuel calibration card corrections.
  3. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8.0 hours.
  4. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 260 equates to 26,000 ft.
  5. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
Safety analysis

Introduction

The Cessna 441 (C441) aircraft departed on a scheduled passenger flight from Fitzroy Crossing to Broome without sufficient fuel to reach the destination. This was not identified by the pilot and subsequently the fuel tanks were exhausted and both engines lost power.

Although the weather was suitable for visual flight rules and the aircraft was within range of a highway, the pilot was faced with a dual engine failure, a situation that is not usually addressed in multi-engine training and checking. The pilot successfully landed the aircraft on the nearby highway and there were no passenger injuries or aircraft damage.

A fuel exhaustion event on scheduled passenger transport flight is a serious incident. Accordingly, this analysis will discuss the accuracy of the fuel quantity indication system (FQIS), the procedures and practices used to check the fuel quality, the procedures and practices used to check the fuel quantity, and the effectiveness of the fuel low level warning system.

Fuel quantity indication system error

Post-occurrence inspection of the fuel system identified water contamination of the fuel tanks. The presence of water on the probes had a significant effect on probe functionality, resulting in over reading of the fuel quantity in the tanks. The FQIS functioned appropriately after the water was removed.

More specifically, following the engine power losses and forced landing, the fuel quantity gauges indicated 1,120 lb. On return to Broome, having drained all usable fuel on board, the gauges indicated 740 lb. In addition, prior to the occurrence flight, the gauges indicated about 1,310 lb (after applying fuel calibration card corrections) when there was only about 420 lb of usable fuel on board.

The source of the water contamination could not be definitively determined. It is likely to have occurred at some point during the period 13–26 February, when wingtip damage was being repaired. A review of the aircraft’s flight logs identified that recorded fuel burns after this period were consistently lower than fuel burns prior to this period.

Based on the available information, the water was unlikely to have been introducing during refuelling. It is possible that it was associated with the aircraft sitting in a humid environment for a period of time and, because the tanks were close to empty (about 590 lb total fuel on board), condensation forming in the tank.

It is reasonable to presume that the influence of the water on the fuel quantity gauge indications increased over time. If there had been a substantial step change in the gauge indications (more than the fuel added), then it is likely that this would have been detected when the aircraft undertook a test flight following the repair. However, there was no indication in the flight logs of a substantial discrepancy.

Nevertheless, it is also unlikely that the amount of over reading increased in a linear manner over time. The limited information available suggested that there may have been larger increases in over reading when the fuel levels were lower, which would be consistent with less water on the probes when the fuel tanks were at higher levels. 

Fuel quality management

Considering the level of water contamination found after the occurrence, and the length of time the water had been in the aircraft, it is unclear why this problem had not been detected through fuel quality testing. Fuel drains were required to be conducted by the operator’s pilots prior to the first sector each day and following each refuel. This should have resulted in at least nine inspections prior to the occurrence flight. However, none of these checks appeared to identify an unusual amount of water.

The pilot reported conducting a fuel drain during prior to the first sector on the day of the occurrence but did not report observing water in the fuel and did not test the sample using the water detection capsule. A final opportunity to detect contamination was available following aircraft refuelling. However, the pilot did not conduct a fuel drain and chemical test following the refuel, which reduced the opportunity to detect contamination.

At the time of the occurrence, fuel in the hopper area of each fuel tank of VH-LBY could not be sampled because the standard fuel drains were located elsewhere (including the low points of the fuel system). Although fuel was able to circulate throughout the tank, the hopper was designed to limit the outflow of fuel. As such, it is possible that some fuel samples were not representative of the fuel in the hopper. Nonetheless, not all of the water contamination was found to be in the hopper tanks.

Fuel quantity management

Overview

The operator had several processes in place to check the functionality of the FQIS on its C441 fleet, including several methods that pilots could use to cross-check the fuel quantity gauge indications with other sources.

One reliable and independent method of cross-checking fuel quantity gauge indications is to use some form of direct reading of the fuel quantity; however, no direct reading mechanisms were available for the C441.

Another reliable and independent method of cross-checking fuel quantity gauge indications is to fill the tanks to capacity or to empty the tanks of usable fuel and add a known quantity of fuel. Due to the nature of the operator’s flights, its C441 aircraft were rarely refuelled to capacity during normal operations. However, the operator required each of its C441’s fuel tanks to be refuelled to a known quantity (500 lb per side) every 150 flight hours. Unfortunately, the last check on VH-LBY was done 66 hours prior to the occurrence (and 53 hours prior to the likely start of the FQIS error).

The operator’s fuel management procedures were also supported by regular maintenance inspections to confirm FQIS accuracy. However, in this instance the error had developed in between maintenance inspections.

Ultimately, detecting the FQIS error in this case relied on the operator’s procedures for cross-checking fuel quantity gauge indications, and its pilots use of those procedures.

Check of indicated versus calculated fuel quantities prior to a flight

The primary cross-check method for the C441 fleet specified in the operator’s manuals was a check of the indicated fuel quantity against the calculated fuel quantity (or residual fuel, indicated at the end of the previous flight, plus the refuel amount). This is a relatively simple and commonly used cross-check method in the aviation industry, which can only be used when fuel is added.

However, this cross-check method is not an independent check of the FQIS. It is simply checking the difference in the fuel quantity gauges after fuel has been added. In other words, the check is self-referencing the same source of information. Although it may detect some types of FQIS error, it is generally not adequate to detect gradually developing errors in gauge indications.

The extent to which the method could have been effective on this occasion was difficult to determine because of limitations in the way the C441 pilots were recording information on the flight logs. The operator required pilots to confirm that the difference between the residual quantity recorded on previous flight log and the indicated quantity prior to flight was within 5 per cent of higher amount. After refuelling, pilots were to confirm the difference between the indicated quantity and calculated quantity (sum of residual/indicated plus added fuel) was within 5 per cent. These comparison checks were not recorded, nor required to be recorded. Consequently, pilots were not able to identify any differences or trends in indicated readings over time, or in the indicated versus calculated readings over time.

On the day of the occurrence, the pilot refuelled the aircraft prior to the first sector. The pilot reported that the fuel quantity gauge indications were verified as required before and after refuelling. The residual fuel figure from the previous day was within comparison check limits and therefore carried forward on the flight log, facilitating the continuity of the FQIS error.

Check of indicated versus computed or planned fuel quantities

The operator’s Flight Operations Manual required pilots to compare the indicated fuel with the computed fuel on board (although the manual mistakenly used the word ‘calculated’ instead of ‘computed’). This meant comparing the indicated fuel quantity at the end of a flight with a value based on the indicated quantity at the beginning of the flight and the computed fuel burn during the flight.

In addition, during cruise, C441 pilots were required to compute the destination fuel using current or average groundspeed and current fuel flow, but there was no requirement for this to be recorded. The pilot of the occurrence flight did not appear to use this method, and the extent to which other pilots were using it was unclear.

The operator’s pilots did report that they regularly compared flight-planned fuel burns with recorded fuel burns (based on fuel quantity gauge indications) after each sector. The pilot of the occurrence flight reported that, following each of the first two sectors that day, there was no notable discrepancy between the recorded fuel burns and the flight-planned fuel burns. However, the recorded fuel burn for the third sector based on fuel quantity gauge indications was substantially lower than the expected fuel burn based on the flight plan. Even so, in the absence of relevant information from other sources, the pilot rationalised that this discrepancy was not significant, given that the indicated fuel quantity was significantly more than the minimum required for the flight.

The ATSB noted that there appeared to be significant variability in recorded fuel burns and the associated fuel burn rates, both before and after the FQIS error started. The exact reasons for the size of this variability are not clear, but its effect would be to make it difficult for a pilot to detect when a discrepancy was meaningful. The fuel quantity indications on the aircraft also needed significant corrections from the fuel calibration card, which complicated any calculations. Nevertheless, in the case of the sector prior to the occurrence flight, the discrepancy was substantial and should have prompted further inquiries by the pilot about the fuel quantity indications.

At that stage, the pilot had limited other options available to verify the amount of fuel on board. However, they could have discussed options with a senior pilot or elected to add more fuel.

Check of indicated quantity versus fuel totaliser reading at end of a flight

The operator’s procedures required that C441 pilots enter the indicated fuel on board into the Garmin GNS 530 system at the beginning of each sector, and then compare the fuel quantity gauge indications with the fuel totaliser indication (of fuel on board) at the end of a sector. In effect, this cross-check method, using an independent source, provided a means of detecting whether there was a change in the reliability of the fuel quantity gauges during a flight (or a longer period).

The operator had not specified a threshold level or ‘acceptable amount’ for this check. Accordingly, if a pilot followed the procedure, it was unclear what level of difference between the gauge indications and the totaliser indications warranted action.

More problematically, the procedure was not always being used. The pilot of the occurrence flight reported that they did not think it was mandatory, based on observing other pilots, and did not use it themselves. A senior pilot also agreed it may not have been used regularly by other pilots.

If the pilot of the occurrence flight had used the procedure, then it would have identified a significant discrepancy after the third sector on the day of the occurrence. It is also likely to have detected discrepancies on the two sectors they conducted the previous day. In addition, if the method was being regularly used, it is likely that it would have identified discrepancies on some sectors conducted by the operator’s pilots on previous days.

Check using the X-FER PUMP FAIL annunciators

The operator’s procedures also required that C441 pilots, prior to engine shutdown after a flight, switch the fuel boost pumps off to check whether either of the X-FER PUMP FAIL annunciators would illuminate. If they did, then this meant there was less than 580 lb in that tank. This check was coarse in nature, and would only detect a problem in some cases, depending on the indicated fuel quantity.

Although the procedure was clearly stated in the operator’s operations manual, the pilot of the occurrence flight reported not being aware of this requirement and so was not conducting these checks. Post-occurrence fuel quantity calculations suggests that this gross error check would likely have identified the indication error on arrival at Fitzroy Crossing after third sector and possibly at Halls Creek after the second sector on the day of the occurrence. It is likely it would also have detected a problem after the last sector the previous day.

Summary

In summary, the operator had specified multiple methods for its C441 pilots to use to cross-check fuel quantity indications. However, there were limitations with the design, definition and/or application of these methods. In particular, the primary method used (indicated versus calculated) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications. In addition, the operator’s pilots did not record sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified, and the pilots did not routinely cross-check fuel gauge indications with the information from the independent fuel totaliser.

In the case of the occurrence flight, the pilot had not been applying two of the operator’s cross-check methods (that is, the use of the fuel totaliser and the use of the X-FER PUMP FAIL annunciators). Using either or both of these methods would have identified discrepancies, which should have resulted in the pilot concluding that the FQIS was not functioning correctly.

Low fuel level warning

Illumination of the L/R FUEL LEVEL LOW annunciators on the C441 indicated that 150 to 250 lb remained in the associated tank. This would be approximately 30 to 50 minutes flight time for each engine. The annunciators on VH-LBY were found to be serviceable during post-occurrence inspections and were illuminating at approximately 160 lb remaining in each tank, or roughly 30 minutes flight time.

The fuel level low annunciators are independent of the FQIS and of each other (left and right). Landing as soon as possible would be the most conservative response to a fuel level low annunciation.

Although the pilot reported that the annunciators illuminated in the 10 to 15 minutes prior to the first engine failure, analysis suggests it likely that the annunciators had been illuminated well prior, sometime during the climb. In that timeframe, the aircraft was within range of suitable airports to which a diversion could have been effected.

The pilot considered the FQIS to be reliable but based on experience did not trust the annunciators. As such, the pilot believed there was sufficient fuel on board and continued to Broome and disregarded the fuel level low annunciations. Overall, the pilot’s response to the various fuel system annunciations was consistent with confirmation bias, or a tendency for a person to seek information that confirms or supports their hypotheses or beliefs, and discounting or not seeking information that contradicts those hypotheses or beliefs (Wickens and others 2013). This was likely influenced by not completing all the required fuel quantity cross-checks during previous sectors, resulting in the pilot having little information available (other than the annunciators) to doubt the fuel quantity indications.

Briefing prior to an emergency landing

During the emergency landing, the pilot did not instruct the passengers to adopt the brace-for-impact position.

In a recent cabin safety bulletin, the Civil Aviation Safety Authority (2020) advised:

Passenger survival rates are improved when they are informed about the correct use of equipment and the actions they should take in the event of an emergency, such as how to assume an appropriate brace for impact position.

The brace position has been determined to be the most effective protective position for passengers and crew to adopt to mitigate the potential for injury during impact.

The “brace for impact” position is an action where a person pre-positions his/her body against whatever he/she is most likely to be thrown against, and which may significantly reduce injuries sustained.

The brace position serves two purposes:

1. it reduces flailing by having the forward-facing occupant flex, bend, or lean forward over his/her legs in some manner

2. it reduces secondary-impact injuries by pre-positioning the body, predominantly the head, against the surface that it would otherwise strike during that secondary impact, thus reducing the momentum of the head and other parts of the body.

In summary, because the passengers did not adopt the brace-for-impact position, this increased the risk of injury during the emergency landing. It is likely that the pilot was experiencing a high workload during the approach and emergency landing, but pilots in such situations should ensure, when time is available, that passengers are appropriately briefed for any emergency landing and instructed to brace for impact.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the fuel exhaustion and forced landing involving Cessna 441, VH-LBY, 39 km east‑south‑east of Broome Airport, Western Australia on 2 March 2018.

Contributing factors

  • Due to water contamination in the fuel tanks, the aircraft’s fuel quantity gauges were significantly over reading on the day of the occurrence and on previous days. This ultimately resulted in the aircraft departing for a flight without sufficient fuel to reach its destination.
  • Although the operator had specified multiple methods of cross-checking fuel quantity gauge indications for its C441 fleet, there were limitations in the design, definition and/or application of these methods. These included:
    • The primary method used (indicated versus calculated fuel) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications.
    • Pilots did not record (and were not required to record) sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified.
    • Pilots did not routinely cross-check information from fuel quantity gauge indications with information from the independent fuel totaliser. (Safety issue)
  • Although the pilot routinely compared indicated versus calculated fuel quantities, and indicated versus flight-planned fuel quantities, the pilot did not routinely conduct two other methods stated in the operator’s procedures for cross-checking fuel quantity gauge indications.
  • The recorded fuel burn for the previous (third) sector based on fuel quantity gauge indications was substantially lower than the expected fuel burn based on the flight plan. However, in the absence of relevant information from other sources, the pilot did not regard this as being an indication of a fuel quantity indicating system problem.
  • The pilot disregarded the L/R FUEL LEVEL LOW annunciators, which likely illuminated approximately 30 minutes before the fuel was exhausted in each tank, and when the aircraft was still within range of suitable alternative airports. The pilot relied on the (erroneous) fuel quantity indications and continued to Broome until the engines lost power, at which point a forced landing on a highway was the only remaining option.

Other factors that increased risk

  • Although the pilot stated that they conducted a fuel quality check prior to the first flight of the day, they did not conduct another check after refuelling (as required by the operator’s procedures), increasing the risk of undetected fuel contamination.
  • The pilot did not instruct the passengers to brace for impact prior to the emergency landing.

Other findings

  • Following the complete engine power loss, the pilot assessed the aircraft would not reach Broome Airport, identified a suitable landing area, and conducted a forced landing without injury to the passengers or damage to the aircraft.
Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.

Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are provided separately on the ATSB website, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website as further information about safety action comes to hand.

Fuel quantity assessment methods

Safety issue number: AO-2018-019-SI-01

Safety issue description: Although the operator had specified multiple methods of cross-checking fuel quantity gauge indications for its C441 fleet, there were limitations in the design, definition and/or application of these methods. These included:

  • The primary method used (indicated versus calculated fuel) was self-referencing in nature, and not able to detect gradual changes in the reliability of fuel quantity gauge indications.
  • Pilots did not record (and were not required to record) sufficient information on flight logs to enable trends or patterns in fuel quantity gauge indications to be effectively identified.
  • Pilots did not routinely cross-check information from fuel quantity gauge indications with information from the independent fuel totaliser.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Safety action by Skippers Aviation

In April 2021, during the directly involved party process, Skippers Aviation advised that:

  • There was a strong focus on Broome as an operating base, with the chief pilot now visiting multiple times per year, and regular audits being carried out.
  • Communication between Broome and Perth had been enhanced.
  • Emergency procedure training now emphasised brace commands.

Safety action by the Civil Aviation Safety Authority

In the 18 months following the occurrence, the Civil Aviation Safety Authority (CASA) conducted additional surveillance of Skippers Aviation through a series of visits, interviews and observation flights. Surveillance encompassed Airworthiness, Flight Operations, Cabin Safety, Ground Operations and Safety Systems. CASA noted that the operator had demonstrated improvements in the operations of its Broome base and recommended returning to a normal oversight level. No findings were issued on completion of the surveillance.

Sources and submissions

The sources of information during the investigation included:

  • the pilot of the occurrence flight
  • the operator (Skippers Aviation Pty Ltd)
  • the Civil Aviation Safety Authority
  • Airservices Australia.

References

Civil Aviation Safety Authority 2020, Cabin Safety Bulletin No.6 – Brace positions, available from www.casa.gov.au.

Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

  • the pilot of the occurrence flight
  • the operator (Skippers Aviation Pty Ltd)
  • the Civil Aviation Safety Authority
  • Textron Aviation (Cessna).

Submissions were received from:

  • the pilot of the occurrence flight
  • the operator (Skippers Aviation Pty Ltd)
  • the Civil Aviation Safety Authority
  • Textron Aviation (Cessna).

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Fuel system schematics

Fuel system schematics

Source: C441 Pilot’s Operating Handbook

 

Fuel system schematics

Source: C441 Pilot’s Operating Handbook

 

Appendix B – Fuel system testing procedures

 

Fuel system testing procedures

Source: Skippers Aviation Flight Operations Manual

Purpose of safety investigations & publishing information

Purpose of safety investigations

The objective of a safety investigation is to enhance transport safety. This is done through:

  • identifying safety issues and facilitating safety action to address those issues
  • providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.

It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.

Terminology

An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.

Publishing information 

Released in accordance with section 25 of the Transport Safety Investigation Act 2003

Published by: Australian Transport Safety Bureau

© Commonwealth of Australia 2021

Ownership of intellectual property rights in this publication

Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.

Creative Commons licence

With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.

Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.

The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau

Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Aircraft Details
Manufacturer
Cessna Aircraft Company
Model
441
Registration
VH-LBY
Aircraft Operator
Skippers Aviation
Serial number
4410023
Operation type
Air Transport Low Capacity
Sector
Turboprop
Departure point
Fitzroy Crossing, Western Australia
Destination
Broome, Western Australia
Damage
Nil