VFR into IMC and controlled flight into terrain involving Pilatus Britten-Norman BN2A, VH-OBL, 98 km west-south-west of Hobart Airport, Tasmania, on 8 December 2018

On 8 December 2018, the pilot of a Pilatus Britten-Norman BN2A-20 Islander, registered VH‑OBL and operated by Airlines of Tasmania, was conducting a positioning flight under the visual flight rules^[1] from Cambridge Airport to the Bathurst Harbour aeroplane landing area (ALA), Tasmania. The aircraft departed Cambridge at about 0748 Eastern Daylight‑saving Time ^[2] and was scheduled to arrive at Bathurst Harbour about 0830 to pick up five passengers for the return flight. The passengers were part of a conservation project that flew to south‑west Tasmania regularly, and it was the pilot’s only flight for that day.

Automatic dependent surveillance broadcast (ADS-B) ^[3] position and altitude data (refer to the section titled Recorded information) showed the aircraft tracked to the south-west towards Bathurst Harbour (Figure 1). At about 0816, the aircraft approached a gap in the Arthur Range known as ‘the portals’. The portals are a saddle (lowest area) between the Eastern and Western Arthur Range, and was an optional route that Airlines of Tasmania used between Cambridge and Bathurst Harbour when the cloud base prevented flight over the mountain range. After passing through the portals, the aircraft proceeded to conduct a number of turns below the height of the surrounding highest terrain. The final data point recorded was at about 0828.

Figure 1: Track of VH-OBL from Cambridge Airport towards Bathurst Harbour, showing the accident location

Source: Google earth and Aireon, modified by the ATSB

At about 0829, the Australian Maritime Safety Authority received advice that an emergency locator transmitter allocated to VH-OBL had activated. They subsequently advised the Tasmanian Police and the aircraft operator of the activation, and initiated search and rescue efforts. The rescue efforts included two helicopters and a Challenger 604 search and rescue jet aircraft. The Challenger arrived over the emergency locator transmitter signal location at around 0925, however, due to cloud cover the crew were unable to visually identify the precise location of VH‑OBL. A police rescue helicopter arrived at the search area at about 1030. The pilot of that helicopter reported observing cloud covering the eastern side of the Western Arthur Range, and described a wall of cloud with its base sitting on the bottom of the west portal.

Multiple attempts were made throughout the day to locate the accident site, however, due to low‑level cloud, and fluctuating weather conditions, the search and rescue operation was unable to confirm visual location of the aircraft until about 1900. The aircraft wreckage was found in mountainous terrain of the Western Arthur Range in the Southwest National Park (Figure 2) . The search and rescue crew assessed that the accident was unlikely to have been survivable.

The helicopter crew considered winching personnel to the site, however, due to a number of risks, including potential for cloud reforming, the time of day and lighting, and other hazards associated with the mountainous location, the helicopter departed the area. The aircraft wreckage was accessed the following day, when it was confirmed that the pilot was fatally injured.

Figure 2: Accident location of VH-OBL in the Western Arthur Range

Source: Tasmania Police

__________

1. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.
2. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
3. Automatic dependent surveillance broadcast is a surveillance technology in which an aircraft determines its position via satellite navigation and periodically broadcasts it, enabling it to be tracked. The data was provided by Aireon.

Pilot information

Experience and qualifications

The pilot held a valid Commercial Pilot Licence (Aeroplane) that was issued on 29 May 2017. The licence included the following ratings and endorsements:

• single-engine and multi-engine aeroplane class ratings
• low-level rating
• manual propeller pitch control and retractable undercarriage design feature endorsements.

The pilot had also completed a multi-engine instrument rating on 14 November 2017, however, it was not current at the time of the accident.

The pilot’s logbook, combined with the operator’s records, showed a total flying experience of 540.9 hours to the last recorded flight on 7 December 2018. The pilot’s total flying experience on the Pilatus Britten-Norman BN2A-20 Islander (Islander) aircraft was 80.4 hours. In the previous 90 and 30 days, the pilot had flown 65.5 hours and 26.5 hours respectively on this aircraft.

Training

The pilot underwent training at the Airlines of Tasmania flight school, and upon completion, started working for the operator in the office and then transitioned to flight duties. The records indicated that the pilot:

• started in-command under supervision (ICUS) training on the single-engine Cessna 206 on 2 October 2017 and conducted 22.8 hours before commencing solo commercial flights
• completed ground-based training for the Islander on 26 April 2018 and commenced flight training, which included 1.5 hours with an instructor and 13.4 hours ICUS before a line check on 26 September 2018
• completed the first solo commercial flight to Bathurst Harbour in the Islander on 27 September 2018.

Bathurst Harbour flight experience

The chief pilot stated that the accident pilot was experienced on the route from Cambridge to Bathurst Harbour and had flown it five times in the previous 7 days. It was also reported by the operator that the pilot had completed about 180 return flights on that route in the current and previous seasons.^[4]

Observations of the pilot’s decision making

The accident pilot was described by the chief pilot and other Airlines of Tasmania pilots as being competent and conscientious. The pilot was reported to be a high achiever who liked a challenge and was considered a good decision maker. It was also mentioned several times that the pilot had demonstrated a willingness to turn back when weather conditions were unfavourable.

72-hour history

The pilot was reported to normally wake at around 0600 and go to bed around 2130 most nights. Table 1 summarises the pilot’s flight and duty times in the preceding days. The accident occurred on the pilot’s fifth day of the duty period.

Table 1: Summary of pilot’s duty and flight times

Date	5 December 2018	6 December 2018	7 December 2018
Duty time	1100 – 1500 (4 hours)	0700 – 1730 (10.5 hours)	0600 – 1000 (4 hours)
Flight time	1.6 hours	3.9 hours	1.6 hours

The 1.6-hour flight time on 7 December was a return flight to Bathurst Harbour conducted by the pilot in a Cessna 206. On the morning of the accident, the flight to Bathurst Harbour was the only one scheduled for the pilot that day, as it was reported they had requested the afternoon off to attend a social engagement.

The pilot’s specific personal routine in the 3 days prior to the accident was largely unknown. However, a flatmate reported that, on the night prior to the accident, the pilot went to bed at their usual time of around 2130. One of the company pilots reported receiving the last text from the pilot at about 2000. On the morning of the accident flight, the flatmate reported hearing the pilot in the kitchen at about 0600. Although an entire sleep and wake history was not available, there were no indications to suggest that the pilot was experiencing a level of fatigue known to have an effect on performance.

Aircraft information

General

VH-OBL was a Pilatus Britten-Norman BN2A-20, twin-engine piston-powered aircraft with constant speed variable pitch propellers and a fixed landing gear system. The aircraft was manufactured in 1986 and first registered in Australia on 4 July 1995.

The aircraft’s current maintenance release was issued on 17 August 2018 at a total time‑in‑service of 12,344.8 flight hours. The most recent maintenance, a scheduled 50-hourly service, was carried out on 6 November 2018. The aircraft was approved for operation under both the instrument and visual flight rules during the day and night.

At the time of the accident, the aircraft had accumulated a total of about 12,428 flight hours. From the evidence available, no outstanding defects were identified in the maintenance documentation.

Garmin GNS 430 global positioning system

The aircraft was fitted with a Garmin GNS 430 global positioning system (GPS) that incorporated a non‑certified terrain awareness and warning system to increase pilot situational awareness. The operator’s guidance on the use of this system specifically stated that ‘This particular system is an aid only to help assist in the prevention of controlled flight into terrain [CFIT]’. The operator advised that this statement was predominantly applicable when performing flights under instrument flight rules.

The system’s main pages were divided into four separate page groups (navigation, waypoint, auxiliary and nearest), with each page group having a number of sub‑pages. The navigation page included a terrain sub-page,^[5] which had two selectable display settings; a 360° view of the aircraft from above depicting the surrounding terrain on all sides, and a 120° degree view of the terrain ahead of, and 60° either side of, the aircraft (Figure 3 top). The terrain page display included the following:

• the aircraft’s GPS-derived mean sea level altitude and range marking rings
• aircraft ground track and heading indicator
• terrain range, indicating the terrain elevation in colours relative to the aircraft’s altitude:
  • black: the terrain/obstacle was more than 1,000 ft below
  • yellow: the terrain/obstacle was between 100 ft and 1,000 ft below
  • red: the terrain/obstacle was above or within 100 ft below
• range marking rings for various distances
• obstacles and potential impact points.

Terrain alerts were issued to the pilot when the flight conditions met the parameters set within the system. When the terrain page was selected, a visual annunciation would appear in the left corner of the display. The alerts were either advisory, displayed as constant black text on a yellow background, or cautionary with flashing black text on a yellow background. However, if the terrain page was not selected, a pop-up alert would appear, which required the pilot to action (Figure 3 bottom).

Figure 3: GNS430 alert functions in 360° (left) and 120° (right) views above; alert types below

Source: Garmin, annotated by the ATSB

The forward looking terrain avoidance alert would be issued when the aircraft was above the terrain but projected to come within a certain distance of the terrain/obstacle, or when the aircraft was below the elevation of the terrain/obstacle in the aircraft’s projected flight path.

A number of company pilots reported that they would often select the terrain inhibit mode, which would deactivate the forward looking terrain avoidance alert, as the flights to the south-west were under visual flight rules. They also reported that, if the terrain mode was selected, they would often receive alerts as the aircraft approached the higher ground near Bathurst Harbour , which would make the navigation page disappear, and could potentially be disconcerting to the passengers.

From the evidence available, the ATSB was unable to determine if the pilot was using the GPS during the flight, or if they were, what page was selected or if the terrain alerts were inhibited. If the terrain page was displayed, depending on the range selected, the majority of the display would have been yellow, as the aircraft was generally tracking between 300-700 ft above ground level. Patches of red would also have been visible at various points. It should be noted however, that for at least the last 2 minutes of the flight, the aircraft was manoeuvred within 700 ft of multiple areas of terrain higher than the aircraft’s altitude. If the GPS was on, this would have resulted in terrain alerts throughout this section of the flight.

Meteorological information

Bureau of Meteorology

Forecasts

A Bureau of Meteorology (BoM) graphical area forecast was issued at 0342 and was valid for the period 0400 to 1000, encompassing the accident flight. The forecast was applicable for all of Tasmania. The BoM reported that the forecast included mist (visibility reduced to 2,000 m) and broken^[6] stratus cloud with a base of 200 ft above mean sea level (AMSL) for areas within 20 NM (37 km) of the coast (encompassing the Bathurst Harbour ALA),^[7] associated with the low‑level moist onshore flow. The forecast also included areas of scattered light rain (visibility reduced to 7,000 m) throughout the entire area from a layer of broken altocumulus/altostratus cloud at 9,000 ft, and scattered stratus cloud between 500 ft and 1,000 ft. The forecast indicated that severe turbulence below 8,000 ft and widespread sea fog was expected.

The subsequent graphical area forecast issued at 0348 and valid from 1000 to 1600 was divided into two regions and showed a deterioration in the conditions in the south-west. Broken cumulus and stratocumulus cloud was between 2,000 ft and 8,000 ft, and visibility reduced to 7,000 m in scattered light rain.

The search and rescue helicopter pilot advised that the forecast on the day:

…was quite unusual (I have not seen one like it to date) which had broad brushed the entire state. This made me wonder if there was a technological issue behind it…

As a result, the pilot contacted the BoM who advised that the:

forecast for the South West region was poor, as the weather would be pushing inland from the south west and there was a high probability of low cloud but they could not quantify an accurate cloud base.

The closest aerodrome forecasts^[8] (TAF) were available at Strahan (about 145 km north-west of the accident site) and Hobart (about 100 km east-north-east of the accident site).

The TAF for Hobart, issued at 0405, indicated 8 kt winds from the west and CAVOK ^[9] conditions, with a 30 per cent probability of deteriorations of less than 30 minutes due to thunderstorms and rain until 0900. From this time, the TAF indicated a change to the prevailing weather conditions, with a reduction in visibility, and increasing rain and cloud.  

The Strahan TAF was issued at 1737 (the day before the accident) and indicated that the conditions were deteriorating at 0300 the next day. The cloud base was broken stratus cloud with a base at 500 ft. It was subsequently updated at 0005 showing a deterioration at 0400, with broken stratus cloud with a base of 200 ft. A special report of the meteorological conditions at Strahan, issued at 0800 and 0830 on 8 December 2018, indicated that there was overcast cloud at 1,300 ft above ground level (AGL). At 0900, the cloud had deteriorated to include broken cloud at 600 ft.

Analysis of the conditions

There were no recorded observations of the conditions at the location of the accident. The BoM provided the following analysis based on satellite imagery, forecasts, and observations. Specifically, they noted that:

On the night of 7 December 2018, Tasmania was under a very moist north-easterly airstream, with dew point temperatures in excess of sea surface temperature thus sea fog, coastal mist and very low cloud were expected to develop around the coastal areas of Tasmania. A surface trough moving over the southwest in the morning of 8 December 2018 was expected to extend low cloud over southern Tasmania during the morning.

The satellite images showed that there was an ‘extensive layer of middle and high cloud associated with the passage of the trough’. Similarly, high-resolution images also indicated the presence of low-level cloud in the area, including the accident location (Figure 4).

Figure 4: Visible satellite image at 0800 showing the approximate accident location

Source: Bureau of Meteorology, annotated by the ATSB

The aerological diagram from Hobart indicated ‘a likelihood that cloud would form via orographic ascent^[10] on the windward side of ranges’. Likewise, the relative humidity at other nearby locations was also high during the morning.

The nearest cloud and visibility observation sites to the accident location were at Hobart (100 km to the north-east) and Strahan Airports. However, Strahan Airport was considered to be more representative of the onshore flow at the accident site in the wake of the trough. Between 0345 and 0840, the cloud base at Strahan was between 1,000 ft and 2,000 ft. After this time, the cloud base lowered to below 1,000 ft, before gradually lifting later in the day. In addition, there were several instances where the visibility reduced to below 5,000 m during the night and morning, likely associated with areas of mist. 

In summary, the BoM concluded that:

Conditions on the morning of 8 December 2018 were characterised by coastal sea fog and mist, low orographic cloud developing and the passage of a mid-level cloud band with light rain and virga.^[11]

The relevant forecasts were consistent with the weather conditions in the area of the incident.

Weather observations

Early in the accident flight, the pilot took a photograph as the aircraft passed near Huonville (about 40 NM (74 km) south-west of Cambridge Airport) and sent this to a colleague. Another company pilot viewed the photograph and reported that there was a ‘little bit of low-lying stratus cloud around, but it was blue skies’ (Figure 5).

Figure 5: Photograph captured by the pilot as the aircraft passed near Huonville

Source: Supplied

After being notified that one of their aircraft was missing, a helicopter pilot from Airlines of Tasmania flew to the site about 1.5-2 hours after the accident. The pilot reported that, on departure from Cambridge, it was looking like a nice day. However, when they arrived at the Arthur Range, the cloud base was initially down to the tree tops (Figure 6) at the portals and there was nil wind. The pilot reported that, it looked like there was light coming through the cloud and they tried to pass through the portals. However, they only got part way through before they encountered a ‘wall of cloud’ and had to turn back (Figure 6). The pilot spent over an hour trying to find a different way to enter the area where the emergency locator transmitter signal was detected, however, in each direction they were stopped by low cloud.

Figure 6: Photograph taken from the company helicopter in the vicinity of the accident location at about 1100

Source: Supplied

Similarly, the search and rescue helicopter pilot advised that, when they arrived on-site near the accident area at 1030, they:

…observed cloud (orographic in nature) engulfing the Eastern side of the Western Arthurs (a wall of cloud with its base sitting on the bottom of the West Portal). The saddle between the West and East Portal (Eastern Arthur Range) is a low point between the Ranges and sits approximately 1500 feet (above mean sea level). The saddle was not visible on our approach.

They also reported that the cloud base continued to fluctuate all afternoon, but was never high enough to locate the aircraft until that evening.  

A passenger who was familiar with the local area, having conducted in excess of 100 flights with the operator, was waiting at Bathurst Harbour for the return flight. They stated that the weather in the morning was overcast, with the occasional blue patch, showers passing to the south, and nil wind. There was cloud to the east of their location, which was reported to be ‘right down in the valleys at the north and east’. The passenger reported that it was not unusual for the aircraft not to turn up as a result of weather, and given the ‘marginal’ conditions that morning, they did not necessarily anticipate the flight to go ahead. However, if it had, they would have expected the aircraft to arrive from the coastal direction.

Accessing meteorological information

The operator’s aircraft operations manual stated that the National Aeronautical Information Processing System^[12] (NAIPS) was to be the only source for weather forecasting and reports used to make operational decisions. Pilots were also ‘encouraged to use other forms of weather information, including alternate weather modelling services and weather camera observations to aid interpretation of authorised weather information’.

It was reported that the company pilots would normally print the meteorological aerodrome report^[13] (METAR) and TAF for Hobart Airport and graphical area forecast and would generally check the weather information at Maatsuyker Island^[14] . The pilots also routinely accessed the web cameras at Bathurst Harbour to check the conditions at the destination as well as checking the online application ‘Windy’.^[15]

The operator advised that the pilot had logged into the NAIPS between 0705 and 0710 on the morning of the accident to submit the flight plan. While it could not be confirmed, it was considered likely that the pilot would have also accessed the relevant weather information at that time.

Bathurst Harbour web cameras

Bathurst Harbour ALA was equipped with web cameras, which were owned and operated by Airlines of Tasmania. There were normally four cameras oriented in different directions, however, on the day of the accident, only two were operational as a result of exposure to severe weather conditions. While neither of the operational cameras were directed towards the north-east, and even if they were, they did not provide a view of the Arthur Range due to several mountains in between Bathurst Harbour and the range. As a result, there were no images available showing the aircraft’s expected approach from the north‑east after passing through the portals, or images of the weather in that direction.

The cameras were able to be accessed by the company pilots prior to departing Cambridge, to obtain an indication of the actual weather conditions at Bathurst Harbour. The flight planning computer used by the pilots was reviewed to determine if the accident pilot had accessed the web camera, however, there was no information available. It was also possible that the pilot may have accessed it from a mobile phone or tablet, which was the normal practice of many company pilots. Therefore, it was not known if the accident pilot had accessed the cameras prior to departing Cambridge.

Following the accident, the chief pilot accessed the cameras and recorded a number of images. The images during the earlier part of the day were not saved by the camera. Figure 7 was taken from the south facing camera at 1020 on 8 December 2018, looking out toward the landing area.

Figure 7: Web camera image from Bathurst Harbour

Source: Airlines of Tasmania

Requirements for visual flight rules

Visual meteorological conditions are the minimum conditions in which a VFR flight is permitted. These conditions ensure pilots have sufficient visibility to control the aircraft and maintain visual separation from terrain and other aircraft.

The Aeronautical Information Publication, En Route, section 1.2 Visual Flight Rules required that pilots operating under the VFR below 10,000 ft AMSL have a minimum of 5,000 m flight visibility, and 1,500 m horizontal and 1,000 ft vertical separation from cloud in non‑controlled airspace. However, when operating at or below 3,000 ft AMSL or 1,000 ft AGL (whichever is the higher), the pilot must have a minimum of 5,000 m flight visibility and be clear of cloud and in sight of the ground or water.

Recorded information

The aircraft was not fitted with a cockpit voice recorder or flight data recorder, nor was it required to be. Airlines of Tasmania used Spidertracks^[16] to monitor aircraft operations, which recorded an aircraft’s position every 2 minutes. As a result, this data provided a general aircraft track, however, it did not provide high fidelity information about the accident flight.

The aircraft was fitted with a Mode S transponder that broadcast automatic dependent surveillance broadcast (ADS-B) data. The ADS-B information included the position and altitude of the aircraft and was received by Airservices Australia. However, due to the lack of ground receivers in the south-west of Tasmania, the Airservices ADS-B coverage in that area was limited. Instead, the ATSB was able to contact a third-party ADS-B provider, Aireon, who provided satellite-based tracking data, including coverage of the accident location, as well as publicly available ADS-B data (Flight Aware).

The ADS-B data recorded data points at a higher frequency^[17] than that recorded by Spidertracks. Analysis of that data showed that (Figure 8):

• The aircraft approached the portals at about 0816 and 2,100 ft AMSL (1,400 AGL). This meant the aircraft was below the height of the east and west portal on either side of the saddle (3,100 ft and 3,800 ft AMSL respectively).
• The aircraft’s altitude continued to decrease as it passed through the portals (from about 0816:30), despite the rising terrain at the saddle. At times, the aircraft came within about 500 ft of the terrain.
• At about 0818, after the aircraft passed through the portals, the pilot made a controlled left turn and continued down the valley in a south-easterly direction.
• Shortly after, at about 0819 (3 minutes after passing through the portals), the pilot initiated a controlled 180° left turn. The aircraft then continued to track north-west back along the valley.
• At about 0824, the pilot initiated a second controlled left turn, after which the aircraft tracked in a south-easterly direction along the valley.
• At about 0827 and 12 minutes after the aircraft had entered through the portals, the pilot made a turn to realign with the saddle and proceeded to track toward the portals.
• At 0828:08, the data showed the aircraft was at 1,875 ft AMSL (about 350 ft AGL).
• The next recorded data point was 08:28:13, and the aircraft was on a slight climb, and had initiated a turn to the left.
• The next data point following this was 16 seconds later, at 08:28:29, and in that time the aircraft had climbed 380 ft (to about 730 ft AGL). Due to the longer time between the data points, the exact flight path was unable to be determined. However, when considering the ground speed of the aircraft and distance travelled, it was unlikely to have deviated substantially from the apparent course.^[18]
• At 0828:29, the aircraft was observed turning toward the ridge of the Western Arthur Range. Over the next 7 seconds, the aircraft climbed about 50 ft at an approximate ground speed of 90 kt.
• In the final 5 seconds of the recording, the aircraft was climbed from 2,425 ft to 2,550 ft AMSL (a climb rate of about 1,500 ft/min) at a ground speed of about 90 kt. The recording stopped at 0828:41.

Figure 8: Aircraft track within the valley (yellow track) and height above ground level (lower graph)

Note: The yellow line on the Google earth images shows the track of the accident flight. The lower graph shows the aircraft’s altitude (green) compared with the elevation of the terrain (red), with the approximate location of the portals shaded blue.

Source: Google earth, Aireon and GeoScience Australia, annotated by the ATSB

Wreckage and impact information

The aircraft wreckage was located on the south-eastern side of the west portal at an elevation of about 855 m (2,805 ft AMSL) (Figure 9). This was about 50 m below the ridgeline. The site was described as steep terrain, almost vertical in nature, and in a densely forested area.

Review of evidence provided by Tasmania Police

Due to the remote location, access difficulties, and other risks associated with the mountainous location of the wreckage, the ATSB did not attend the accident site. Tasmania Police first accessed the site by winching officers from a helicopter at about 1100 on 9 December 2018. At that time, they photographed the site and collected several items from the aircraft. They returned on 22 December 2018 to collect additional information related to the aircraft and engine components, and to perform further examination of the wreckage. All evidence collected by Tasmania Police was provided to the ATSB.

The ATSB’s review of the accident site photographs and statements by Tasmania Police officers, indicated that the aircraft impacted the terrain while heading in a westerly direction. The location of the wings in the photographs and the narrow line of fire damage indicated that the aircraft impacted the terrain in a relatively steep, left angle of bank. The aircraft was destroyed by the impact and a post-impact fuel-fed fire.  

The empennage (tail) section of the aircraft was detached from the main wreckage and came to rest inverted, but appeared mostly intact and not affected by the post-impact fire.

Figure 9: Accident site

Source: Tasmania Police, annotated by the ATSB

Wreckage examination

The wreckage was removed from the accident site on 26 February 2019 and re-located to the National Parks and Wildlife depot at Lake Pedder. The ATSB inspected the wreckage on 8‑10 March 2019. During the 3-month period between the accident and the ATSB’s examination, the wreckage was subjected to the elements with no preservation. This, combined with the post‑impact fire, severely degraded the available evidence as fracture surfaces and components were corroded.

Major components recovered from the site included the left and right engines and propellers, the empennage, about two-thirds of the left wing, the forward section of the fuselage, and a large number of small sections of the aircraft and various components (Figure 10).

Figure 10: Recovered wreckage

Source: ATSB

The following observations were made from the wreckage examination:

• The left wing was mostly intact from the wing root to outboard of the flaps. Some continuity of the flap and aileron system was identified.
• The right wing was severely fragmented and subjected to post-impact fire.
• The fuselage from the aircraft nose, including the cockpit and cabin to the wing box section was severely and uniformly compressed.
• The empennage section was relatively intact, and some continuity of the elevator, trim tabs and rudder was established.
• The position and movement of the flight controls could not be established.
• Overall, continuity of the flight controls in their entirety could not be determined due to the severe disruption and post-impact fire.

From the examination conducted on the wreckage, there were no pre-existing faults identified that may have contributed to the accident. However, a significant portion of the wreckage was fragmented or consumed by post-impact fire.

Medical and pathological information

The pilot had a Class 1 Aviation Medical Certificate issued on 11 February 2018 and valid to 26 February 2019. There were no restrictions indicated on the medical and no indications of any medical issues in the pilot’s aviation medical records. In addition, a number of people described the pilot as having a high level of health and fitness.

Due to the disruption to the aircraft, the accident was not considered survivable.

Operational information

South-west operations

Airlines of Tasmania conducted charter operations to the remote south-west region of Tasmania, which predominantly consisted of sightseeing tours and passenger transport (for bushwalkers and conservation volunteers). During the peak season (from about December to March), the passenger transport operations occurred in the early morning (departing Cambridge around 0800) and late afternoon (departing Cambridge around 1600). The tours operated in the middle of the day (departing Cambridge around 1000) and included a boat tour on Bathurst Harbour and a return flight to Cambridge.

Training and checking requirements

The operator maintained a training and checking program to ensure company pilots remained current and competent in the conduct of the operation. According to the Airlines of Tasmania operations manual, to conduct VFR charter operations to Bathurst Harbour, new pilots were required to complete specific training for that location. In addition, the manual stated that ‘Due to the operational hazard associated with the limited runway length [430 m] at YBHB [Bathurst Harbour] an additional company line check is required before VFR charter operations are conducted into YBHB [Bathurst Harbour]’.

The chief pilot reported that, due to the difficulties of flying in the south-west of Tasmania, which included reduced and changing visibility conditions in an area of mountainous terrain, and the short runway length, the operator did considerable training for pilots commencing flights to the south‑west. This included completing additional ICUS flights beyond the minimum required by the Civil Aviation Safety Authority (CASA).^[19] This was to ensure that pilots were aware of the unique hazards associated with flying to the south-west, and that the operator was comfortable with a pilot’s decision-making prior to being approved for in-command operations.

Route selection

Operations into south-west Tasmania were generally conducted via two standard routes between Cambridge and Bathurst Harbour (Figure 11):

• The ‘direct’ route was approximately on a straight line between Cambridge and Bathurst Harbour. This route was a distance of about 68 NM (126 km) and about 30 minutes in duration. When the weather was fine, with a high cloud base, the route was south of Mount Picton and Federation Peak. However, in lower cloud conditions, the route passed north of Mount Picton and then through ‘the portals’ gap between the Western and Eastern Arthur Range.
• The ‘coastal route’ was about 90 NM (167 km) and about 40 minutes duration. The route tracked south from Cambridge, past Bruny Island and then along the southern coastline to Bathurst Harbour.

Figure 11: Routes commonly used between Cambridge and Bathurst Harbour

Note: The white track is the coastal route, the blue track is the direct route in high cloud conditions and the yellow track is in lower cloud conditions via the portals.

Source: Google earth and Spidertracks, annotated by the ATSB

The route selected was at the pilot’s discretion based on their assessment of the weather and type of flight being performed. For the sightseeing tours, it was reported that, weather permitting, the pilot might fly coastal one way, and direct on the return flight to provide the optimum tour experience for the passengers. However, if it was a charter for transporting passengers and/or freight to Bathurst Harbour, normally the direct route was chosen. The accident pilot had selected the direct route, and the flight track showed that the aircraft had passed through the portals, which indicated that the cloud base was not high enough to pass directly over the mountain range.

Operator guidance

There was no guidance in the Airlines of Tasmania Operations Manual, Volume 3 Aerodrome & Routes on the routes to the south-west, from Cambridge Airport to Bathurst Harbour. However, the manual did include details of the ALA’s used in regular operations, of which the Bathurst Harbour ALA was included.

The operator reported that they provided some informal verbal guidance during ICUS flights to its pilots’ when flying to the south-west, which included information about the different weather conditions that may be encountered, and the implication for route selection. However, there was no record of what information was provided to pilots regarding weather, nor what weather conditions were encountered during these flights. They were also advised of the various tools available to assist in assessing weather conditions. However, the operator’s pilots reported that if the weather was suitable at Hobart, the pilots were generally encouraged to depart Cambridge for flights to the south-west, even if the weather forecast indicated there was a chance of encountering marginal weather. It was mentioned that the weather was always changing, and that sometimes the forecast could be unreliable.

As discussed above, the portal route was used in lower cloud conditions. The operator advised, that, while a diversion or turn back could be made at any point in the flight, it was noted by the ATSB that the portals were considered to be a critical location on the route, due to the surrounding mountainous terrain. In discussion with the chief pilot, and a number of other company pilots who regularly flew to the south-west, the general procedure was to approach the portals at a safe altitude no lower than 500 ft AGL. The pilots were directed to pass to the west of Mt Picton (Figure 11) to allow sufficient room to manoeuvre for a turnback if required. If the pilot could maintain visual contact with Bathurst Harbour (the water) the flight could proceed through the portals. If visual contact was unable to be established or maintained, the pilot was to divert to Bathurst Harbour via the coastal route. It was also reported that there was an emphasis on always having an ‘escape’ route.

However, during interviews, there appeared to be differences between the company pilots’ perceptions on how far to continue with the direct route through the portals. Some of the pilots reported that the portals was their decision point, and if they were unable to see through to Bathurst Harbour due to weather, they would not continue and instead try the coastal route. However, one pilot mentioned passing through the portals to ‘take a look’, and another pilot reported passing through the portals and having to turn around and come back out. Some of the pilots also mentioned a number of routes, including a number of river valleys that led out to the coast.

In addition, there was no written guidance or procedure for VFR flights that encountered deteriorating weather conditions or inadvertent instrument meteorological conditions (IMC) during the flight. The chief pilot reported that there were some discussions about using other river valleys as escape routes if pilots got into trouble and slowing the aircraft down to increase decision‑making time. However, there was a reluctance to be too prescriptive or detailed, as each situation might require a different course of action, and it was also felt this may have suggested entering through the portals in marginal weather was an option.

Spidertracks data

The ATSB conducted a review of the operator’s Spidertracks data for flights performed to the south-west from December 2017 to December 2018. The altitudes of these aircraft at similar locations^[20] were analysed for comparison with the accident flight. The data showed that:

• Over the year prior to the accident, the operator conducted about 690 flights from Cambridge to Bathurst Harbour. Of these:
  • About 430 (62 per cent) flights went via the coastal route.
  • About 128 (19 per cent) flights tracked via the direct route, straight over the top of the mountains.
  • About 80 (12 per cent) flights used the direct route through the portals.
  • Four flights approached the portals, but then backtracked to around Huonville and the coast and followed that route to Bathurst Harbour.^[21]
  • An additional 13 flights deviated as they approached the portals to track over Federation Peak.
  • There were about 36 flights that did a round trip, where the aircraft arrived at Bathurst Harbour, but did not land and returned to Cambridge.
• Of the 80 fights that used the direct route through the portals, the accident flight descended lower than all other flights after it entered the portals:
• the accident flight crossed the portals (saddle) at about 2,100 ft AMSL and descended to about 1,500 ft over the next 2 minutes, with the next closest flight descending from about 2,000 ft to about 1,700 ft
  • a total of 63 flights went through the portals between 2,000 and 3,500 ft
  • a further 16 flights tracked through the portals over 3,500 ft.
  • While four other flights were lower than the accident flight at the comparison points prior to reaching the portals, these flights appeared to have a relatively stable altitude as they approached the mountains. Two of the flights were on 29 November 2018, one on 15 May 2018 and the other on 28 March 2018. From a review of the pilot’s logbook, the accident pilot did not conduct any of those flights.
  • Five flights in the dataset showed the aircraft taking non-standard routes through the portals area (Figure 12). On one occasion, when two aircraft were in convoy, the aircraft appeared to track on a similar route to the accident flight (shown in green and orange in Figure 12), in that they turned left after passing through the portals. However, they were about 1,000 ft higher when at the same position as the accident flight. In this instance, the aircraft tracked all the way to the coast along a valley. This flight occurred 1 month prior to the accident, and the accident pilot was in the lead aircraft (green).

Figure 12: Comparison of aircraft tracks through the valley, including about 1 month prior to the accident (green – lead aircraft; orange – second aircraft) and the accident track (pale yellow)

Source: Google Earth and Spidertracks, annotated by the ATSB

Influences on in-flight weather-related decision-making

VFR into instrument meteorological conditions

Weather-related general aviation accidents remain one of the most significant causes for concern in aviation safety (ATSB, 2005; ATSB, 2019). Between 1 July 2009 and 30 June 2019, 101 VFR into instrument meteorological conditions (IMC) occurrences were reported to the ATSB. Of these, nine were accidents resulting in 21 fatalities. That is, about one in 10 VFR into IMC events resulted in a fatal outcome. While flying into IMC can occur in any phase of flight, the ATSB’s 2005 study into General Aviation Pilot Behaviours in the Face of Adverse Weather concluded that the chances of a VFR into IMC encounter increased as the flight progressed until they reached a maximum chance occurring during the final 20 per cent of the flight distance. This result highlighted the danger of pilots ‘pressing on’ to reach their destination. The research also noted:

A VFR pilot may exhibit a range of behaviours when faced with adverse weather. For example, at the first hint that conditions are deteriorating, a pilot may decide that discretion is the better part of valour and immediately return to their point of departure…At the other extreme, a pilot may ‘press on’ into deteriorating weather, either unable or unwilling to see the increasing danger of their actions, until the aircraft suddenly enters IMC...A more typical scenario might involve a pilot who, in response to deteriorating conditions, initially continues the flight as planned, but subsequently decides to return, divert, or perhaps even carry out a precautionary landing.

A study by Wiegmann and Goh (2000) suggested a number of possible factors that contribute to instances of VFR flight into adverse weather conditions. These included situation assessment (an inaccurate assessment by a pilot of the conditions), risk perception (a pilot may not appreciate the risks involved with continuing the flight) and motivational factors (‘get-home-itis’ or personal/social pressures to complete the flight). The study also found that, during the conduct of a simulated cross-country flight, a significant proportion of participants overestimated the visibility and cloud base. That is, they perceived the conditions to be better than what they actually were.

A United States National Transportation Safety Board (NTSB) study (2005) also stated that one class of decision making in weather-related occurrences was the presence of plan continuation error. This was defined by Orasanu and others (2001) as the continuation of the original flight plan in the face of cues that suggested changing the course of action.

Rather than revisiting the intended route by making a decision such as returning to the departure airport, pilots ‘may opt to press on in deteriorating weather’. Wiegmann and Goh (2000) explained that ‘pilots may diagnose and perceive the risks accurately, but other motivational factors bias their decisions’.

Pilot experience

Pilots’ in-flight weather decision-making relies on past experience and similar circumstances. This type of decision-making is based on the naturalistic decision-making process, which focuses on how people with domain expertise use their knowledge to make decisions, typically in safety‑critical environments (Cannon-Bowers and others, 1996; Zsambok & Klein, 1997, cited in Orasanu, 2010). Part of this type of decision-making involves situation assessment, which is developing an adequate solution to manage the perceived risks. In addition, Oritz and others (2017) stated that:

…a pilots’ ability to choose an optimal course of action out of a variety of potential responses is thought to be naturally developed through experience (Campbell & Bagshaw, 2002). However, “experts do not merely possess more knowledge, they are better at using it” (Tsang & Vidulich, 2006, p. 261).

Achieving an effective situation assessment involves the ‘recognition and response to a familiar pattern of environmental features’, which is seen to be the basis of weather-related expertise. This enables ‘accurate and rapid responses’ even in situations of high workload (Wiggins and others, 2014). Developing some useful cues can help shortcut the decision-making process, but these cues only come with increasing expertise. Therefore, as pilots have differing experiences, and subsequently, understandings of weather conditions, there will be differences in their situation assessment and decision‑making.

Risk perception

Pilots who appear to be intentionally engaging in what could be considered ‘risky behaviour’ may actually be making choices they believe to be safe (NTSB, 2005). Wiegmann and Goh (2000) explained why pilots may fly into deteriorating weather conditions, outlining that:

…decision-making under uncertainty also involves the perception of risk…In the case of VFR flight into IMC, pilots may assess the situation accurately…but they may not realize the risks involved in continuing with the flight.

Hunter (2006) outlined that, in some cases, a person will not perceive the risk inherent in a situation, and therefore does not mitigate the risk adequately. In other circumstances, the risk is simply not considered sufficiently threatening, demonstrating a greater risk tolerance in that individual.

Risk assessment can also vary with factors such as experience and prior exposure to a similar event. Research by McMurtie and Molesworth (2017) indicated that more experienced and older pilots were more conservative in their risk estimates. Schuch (1992) showed that a pilot’s repeated exposure without an incident may make them more likely to perceive a lower risk.

Perceived pressure to complete flights

When making weather-related flight decisions, it is possible that, in some situations pilots may perceive that there are pressures to continue a flight, as opposed to returning or diverting. In small commercial operations, there can be a risk that ‘balancing the competing demands of safety and productivity [becomes] difficult for many small operators, which places a heavy reliance on the decision making of individuals’ (Bearman, et al., 2009). The paper also stated that, as well as managers discouraging pilots to take, or continue with flights in marginal conditions, operators can mitigate the pressures with organisational practices. This included paying pilots regardless of whether they were able to complete a flight and educating customers so that they develop realistic expectations. The operator reported that, pilots were paid regardless of whether they flew or not. They also stated that they reduced perceived pressures on the pilots by managing customer expectations. This included cancelling flights as early as possible, offering alternative tours or refunds, and clearly stating in advertising material that flights and tours were subject to weather.  The operator’s pilots were asked about whether they had felt pressure to proceed with a flight. Some commented that they had never perceived any pressure from the company to either depart, or to continue on a specific route, one said that it was always their decision as the pilot, and another cited examples of where they had cancelled flights. The chief pilot stated that a lack of detailed localised weather information for the Bathurst Harbour ALA, meant that it was not always practical to make a decision from Cambridge. It was further reported that the philosophy was generally to encourage pilots to depart, and if the weather was not conducive to completing the flight, then to just turn around and come back. The majority of pilots who operated to the south-west confirmed that it was their understanding that if conditions at Cambridge Airport were suitable, they were strongly encouraged to at least take-off to assess if the conditions were suitable if there was uncertainty about the weather.

Overall, although many pilots reported that they perceived some organisational pressure to depart and assess the weather conditions en route, there was not necessarily any pressure to take a particular route or continue the flight if they did encounter marginal conditions. Further, as stated above, the operator advised that they had strategies in place to mitigate the risk of perceived company pressure, including paying pilots regardless of whether or not they flew, and managing customer expectations. However, ultimately, it was the pilot’s decision to select an appropriate course of action, with no repercussions for deciding to turn back.

Organisational information

Airlines of Tasmania

Airlines of Tasmania, operating as Par Avion, commenced operation in 1978. They operated regular public transport services, charter, and scenic flights across a number of locations in Tasmania and conducted aerial work and flight training. At the time of the accident, they operated single-engine and multi-engine aircraft, including the Cessna 206, Cessna 404, Piper Navajo, Beechcraft Duchess and the Islander.

Air operator’s certificate

A CASA air operator’s certificate (AOC) was re-issued to the operator on 9 November 2018, valid until 30 November 2021. The AOC included authorisations for regular public transport operations using other than high-capacity aircraft. The operator was approved to conduct flight training, training and checking, aircraft maintenance activities, and provide continuing airworthiness services.

Safety management system

The operator’s AOC included authorisations for regular public transport operations using aircraft other than high capacity. Therefore, under the requirements of Civil Aviation Order 82.3 - Conditions on Air Operators’ Certificates authorising regular public transport operations in other than high-capacity aircraft, they were required to have a safety management system (SMS). While only needed for the regular public transport services, the operator’s SMS was designed to be implemented across the various operations, including charter. The International Civil Aviation Organization (2018) and CASA (2007) defined an SMS as:

A systematic approach to managing safety, including the necessary organizational structures, accountability, responsibilities, policies and procedures.

A Safety Management System is an integrated set of work practices, beliefs and procedures for monitoring and improving the safety and health of all aspects of your operation. It recognises the potential for errors and establishes robust defences to ensure that errors do not result in incidents or accidents.

A safety management system comprised of 12 elements within four components (Table 2).

Table 2: Elements of a safety management system

Component	Element
Safety policy and objectives: a safety policy outlines what the organisation will do to manage safety and safety objectives state an intended outcome.	Management commitment
Safety accountability and responsibilities
Appointment of key personnel
SMS documentation
Safety risk management: the identification, analysis, and elimination (and/or mitigation to an acceptable or tolerable level) of the hazards, as well as the subsequent risks, that threaten the viability of an organisation.	Hazard identification
Safety risk assessment and mitigation
Internal safety investigations
Safety assurance: the systematic and ongoing monitoring and recording of safety performance, and evaluation of the safety management processes and practices.	Safety performance monitoring and measurement
.

Source: ICAO and CASA, modified by the ATSB

The operator was required to demonstrate their safety management capability in relation to each of the SMS elements. This was to be demonstrated through the:

• operating effectiveness of the SMS
• competence of each of the operator’s relevant personnel with respect to the SMS elements
• comprehensive nature of the information, procedures and other material contained in the SMS manual that is relevant to the SMS elements.

Continuous improvement of the SMS

The operator’s SMS manual stated that the organisation should continually seek to improve their safety performance. Continuous improvement can be achieved by (Civil Aviation Authority, 2014):

• proactive evaluation of day to day operations, facilities, equipment, documentation and procedures through safety audits and surveys
• reactive evaluations in order to verify the effectiveness of the system for control and mitigation of risk e.g. incidents, accidents and investigations
• tracking organisational changes to ensure that they are effective
• regular review of the organisation’s safety performance and safety action plans.

Safety risk management process

At the core of an SMS is a formal risk safety management process (Civil Aviation Authority, 2014), which is used specifically to:

• identify hazards associated with an organisation’s operations
• analyse and assess the risks associated with those hazards
• implement controls, to prevent future accidents, incidents or occurrences (Civil Aviation Safety Authority, 2018).

The operator’s SMS manual provided an overview of the risk management process to be applied based on the Australian risk management standard (AS/NZS ISO 31000:2009) (Figure 13). The SMS process started with identifying the hazards affecting the safety of the organisation and then assessing the risks associated with the hazards in terms of likelihood and severity. Once the level of risk was identified, appropriate remedial action or mitigation measures could be implemented to reduce the level of risk to as low as reasonably practical.

A risk assessment form was developed and included in the manual, where the risk, its assessed rating, mitigations, and an action plan would be recorded. The risk management process was to be conducted for safety occurrence reports, change management, and other activities as required.

Figure 13: Risk management process

Source: Airlines of Tasmania

As recognised by the International Civil Aviation Organization (2018), the safety risk management process is continuous, as systems are constantly changing new hazards can be introduced, and some hazards and associated risks may change over time. Further, ‘the effectiveness of implemented safety risk mitigation strategies must be monitored to determine if further action is required’.

The operator’s SMS manual stated that the safety manager would review the SMS every 12 months. This process involved reviewing the hazard identification and hazard register,^[22] any risk assessments conducted, and investigations completed (refer to sections titled Hazard identification and Hazard register).

Hazard identification

A hazard can be considered a dormant potential for harm, which is present in one form or another within the system or its environment (International Civil Aviation Organization, 2018). Hazards exist at all levels in the organisation and are detectable through many sources including safety occurrence reporting systems, inspections, audits, brainstorming sessions, and expert judgment. Hazard identification may also consider hazards that are generated outside of the organisation and those that are beyond their control, such as weather. The three main methods for identifying hazards are:

• Reactive: involves analysis of past outcomes or events, and through the investigation of safety occurrences.
• Proactive: involves the assessment of normal operations and objectively determining possible outcomes.
• Predictive: involves collecting safety data for trends to try and identify, and mitigates risks before they become evident.

The operator’s SMS manual identified potential internal sources of safety information in the hazard identification process. These included safety occurrence reports, change management, internal investigations, audits, analyses of safety data, safety culture surveys, safety committee meetings, and brainstorming. Any identified hazards were to be recorded in the hazard register and assigned actions as appropriate.

Hazard register

The operator kept a hazard register in a spreadsheet, which was transitioned into a system called Air Maestro,^[23] by mid-2018. The SMS manual outlined that all hazards must be documented in the hazard register and would contain information relating to:

• hazard details and associated safety reports
• risk rating attributed to the hazard
• existing controls to mitigate the hazard.

The safety manager’s annual review of the hazard register was to determine whether there had been any changes to the nature and extent of each recorded hazard and its associated risk. The review was also to identify hazards that appeared systemic in nature and warranted further investigation or consideration by the operator’s safety review committee. The annual review of the 2018 risk register was completed in 2019.

The ATSB reviewed the operator’s hazard register for the period 2013 to 2018 and found that:

• The register was mostly populated by safety occurrence reports sourced internally or from Airservices Australia, with very little other sources of safety information included.
• In 2018, none of the hazards identified included risk mitigators or action plans, and there was no content related to weather-related hazards.
• Over the period, there were only two reports related to weather, both of which occurred during training flights:
  • On 19 October 2016, a ‘pilot divert due weather and penetrated controlled airspace’.
  • On 8 September 2015, there was a ‘diversion to maintain VMC [visual meteorological conditions]^[24] on training flight’.

Both included a risk rating, a recommendation action date and date completed, however, there was no detail on what these actions included.

Safety reporting culture

The effectiveness of a safety reporting system partly relies on the promotion of a positive reporting culture and proactive identification of safety deficiencies. One way of achieving this is by clearly stating that reported information will be used solely to support the enhancement of safety (International Civil Aviation Organization, 2018). This also included a culture where people can report without fear of punishment (Reason, 1998).

The operator’s pilots reported that, generally the organisation had a good reporting culture. However, there appeared to be some different opinions on when to report turn-backs due to weather when conducting operations to the south-west. It was mentioned that some pilots would submit a safety report for any turn back or believed that one should be submitted. However, a number of other pilots felt that it did not constitute a safety report as it was a routine decision made by pilots and the safety of flight was never compromised.

In addition, one of the company pilots recalled a previous situation where they had inadvertently entered IMC during a VFR flight in the mountainous area near the portals. The pilot mentioned that this incident had not been entered into the safety reporting system, as it had happened prior to the implementation of Air Maestro, but it had been mentioned to the pilot’s supervisor.

Safety committee meetings

Safety committee meetings were held quarterly and were chaired by the managing director and attended by the chief pilot, safety manager, chief flying instructor, and other managers. These meetings would review safety occurrence reports, discuss new hazards, review management of change requirements, review training requirements, discuss aviation security, and address other SMS‑related business.

An ATSB review of the safety committee meeting minutes found that various aspects of the south‑west operations had been discussed during the years prior to the accident. The minutes for the December 2016 committee meeting stated that a review meeting with all south‑west pilots raised at the September committee meeting had been held in October. It was noted that nothing new had been raised, but the chief pilot had added weather to the hazard register. It was also mentioned that more work was required on weather and risk for south‑west operations, This was subsequently added to the action items for the meeting. The chief pilot was to develop a weather risk model and to conduct a further review, to be completed by 31 March 2017.

The south-west operations were further discussed in a committee meeting in March 2017. It was noted that the planned review by the chief pilot had been put on hold until the end of the season due to possible changes in personnel. There was no further mention of south-west operations in subsequent meetings.

Existing weather-related risk mitigation strategies

Airlines of Tasmania have operated in the south-west area of Tasmania for more than 30 years. While a number of hazards had been identified during that time, they were of the belief that these hazards had not changed in many years.

The operator reported that they had introduced a number of weather-related risk mitigation strategies in the previous years. These included fitment a GPS unit with terrain alerting in all aircraft, the installation of internet facilities and web cameras to assist in understanding the weather situation at Bathurst Harbour, and the use of Spidertracks. There was no accompanying guidance in the operations manual to support the pilots in the use of these tools.

This equipment was introduced to address the risks associated with the changing weather and mountainous terrain during operations in the south-west. The safety manager at the time noted that, while no new risks had been identified in the past 15 years, these measures would provide pilots with more information about their environment. The introduction of this equipment was noted in a CASA surveillance event in 2016, but there were no further details about its ongoing effectiveness.

Previous ATSB investigation (AO-2014-192)

On 29 December 2014, a Cessna 172 operated by Airlines of Tasmania, collided with water during a low‑level aerial photography flight, resulting in the pilot and photographer sustaining fatal injuries. While not contributory to the accident, the ATSB’s investigation found that:

…the operator’s safety risk management processes and practices were not sufficient to facilitate the identification of all key operational risks associated with low-level flying that was being conducted on Sydney Hobart race yachts.

In reviewing components of the operator’s SMS, it was evident that the ability to identify operational risks associated with this type of flight was affected by the following factors:

• The main source of safety risk information were safety reports submitted by crew, in an environment where the reporting culture had only recently improved amongst the small flight crew workforce.
• The risk management process was only utilised for managing operational or organisational changes, which precluded the proactive identification of risks in existing operational activities such as low-level flying.
• The ability for managers to be aware of existing operational risks was reduced due to the narrow application of documented risk management processes and tools (including the risk register).

Quality assurance

Internal audit

As stated above, the Airlines of Tasmania operations manual stated that safety performance monitoring and measurement activities, such as quality and safety audits, were to be undertaken to determine the organisations safety performance and to effectively manage risks. The objectives of these audits are detailed in Table 3.

Table 3: Objectives of internal audits

Quality audits	Safety audits
assess regulatory compliance	the SMS has a sound structure and adequate staffing levels
assess conformance with organisational manuals	approved procedures and instructions are complied with
identify deficiencies which may affect compliance, quality or safety	the required level of competency and training to operate equipment and facilities, and to maintain their levels of performance, is achieved
recommend remedial, corrective and preventative actions where necessary	equipment performance is adequate for the safety levels of the service provided
identify systemic or administrative vulnerabilities or deficiencies that may impact on operational quality or safety	effective arrangements exist for promoting safety, monitoring safety performance and processing safety issues
	adequate arrangements exist to handle foreseeable emergencies

The operator contracted an external auditor to perform a ‘full-scale’ audit, which occurred over a 5‑day period in April 2018. That audit identified that:

• A formalised risk assessment for all operations had not been performed or reviewed in the last 6 months.
• The risk register was not updated when there were changes to circumstances and/or during periodical reviews.
• Reported risks were not rectified in accordance with the risk analysis.
• An annual review of the SMS had not been conducted in the previous 12 months.
• The Air Maestro system was being used for reporting hazards and occurrences, and reports were being regularly reviewed to identify potential hazards.

Civil Aviation Safety Authority

Overview

The Civil Aviation Safety Authority (CASA) had two primary means of oversighting a specific operator’s aviation activities: regulatory services and conducting surveillance of its activities. They also used a scale of prioritisation, based on risk, to determine where to focus resources. This prioritisation was based on several factors, such as the sector of operation, organisational changes and challenges.

To maintain oversight across Australian operators (authorisation holders), CASA had a number of certificate management teams in different locations, made up of CASA officers, including flying operations inspectors, safety systems inspectors, and airworthiness inspectors. Each of these teams oversighted multiple authorisation holders. At the time of the accident, the team responsible for the oversight of Airlines of Tasmania comprised of one certificate team manager, three flying operations inspectors, four airworthiness inspectors and one safety system inspector. The team had oversight of 58 AOC holders, 50 aviation maintenance organisations and four delegates.^[25]

Regulatory services processes

Regulatory services included assessing applications for the issue or variation to an operator’s AOC and associated approvals, key personnel approvals, maintenance personnel approvals, and check pilot approvals and renewals. Regulatory services provided by CASA for Airlines of Tasmania in 2014–2018 included:

• a review of changes to the SMS manual (2014, 2017–2018)
• approval of the chief pilot (2016)
• approval of the safety manager (2016 and 2018).

Surveillance processes

The Civil Aviation Safety Authority developed a surveillance program to oversight authorisation holders and monitor adherence to the regulatory requirements. The surveillance policies, processes, and procedures were detailed in the CASA surveillance manual (CSM).^[26] The CSM stated:

Surveillance is the mechanism by which CASA monitors the ongoing safety health and maturity of authorisation holders. Surveillance comprises audits and operational checks involving the examination and testing of systems, sampling of products, and gathering evidence, data, information and intelligence. Surveillance assesses an authorisation holder’s ability to manage its safety risks and willingness to comply with applicable legislative obligations.

The principal obligation of conducting surveillance activities is to ‘detect and mitigate threats to aviation safety as they manifest themselves in an authorisation holder’. To achieve this, CASA applied a systems and risk-based approach, which:

…aims to encourage the development of authorisation holders’ systems and to encourage and guide the aviation industry to fully understand their responsibility for safety. This is achieved by highlighting the following to industry management:

- management’s responsibility for safety as specified in the civil aviation legislation

- deficiencies in existing safety systems with regard to applicable civil aviation legislation

- areas where the authorisation holder should be doing more to reduce the potential for deficiencies.

Risk-based surveillance adopts a structured process and is used by CASA in its oversight of authorisation holders and prioritisation of its surveillance activities based on authorisation holders’ risk profiles. It focuses on an authorisation holder’s effectiveness in managing its systems risks and enables targeted surveillance of high-risk areas of an authorisation holder’s systems. It is also a method by which CASA can evaluate that all activities conducted by an authorisation holder are as safe as reasonably practicable.

Along with the CSM, CASA used Sky Sentinel, an information technology tool designed to assist in the management of surveillance activities. Specifically, surveillance events:

…are recorded and tracked in the supporting IT system and the results analysed, which allows CASA to evaluate the authorisation holder’s safety performance. The surveillance program is dynamic, regularly reviewed and updated, taking the following issues into consideration:

- significant changes that could affect an authorisation holder, including changes to management or organisational structure, policy, technology; special projects; changes to authorisation holder’s service providers; global and/or local threats and regulatory requirements

- application of the authorisation holder’s Safety Management System (SMS) where applicable

- results of previously conducted surveillance and/or investigations

- surveillance resource requirements

- the authorisation holder’s willingness and ability to identify and control its aviation safety-related risks.

In July 2018, CASA made changes to the oversight surveillance program with the introduction of the national surveillance selection process (NSSP). The NSSP formed part of the national oversight plan, which was an overarching operating model incorporating four pillars of safety oversight, being:

• planned surveillance (NSSP)
• response activities
• regulatory services
• national sector campaigns.

CASA stated that the NSSP was an objective, evidence-driven approach to creating a national schedule that prioritised planned surveillance activities across CASA. It included:

• a system for prioritising the planned surveillance of authorisation holders
• a CASA-wide annual planned surveillance schedule
• a process that facilitated prioritisation, scheduling, and monitoring of planned surveillance.

Using a classification and ranking approach, a prioritised list of authorisation holders was created and used as the basis for the annual development of a CASA-wide annual planned surveillance schedule.

Types of surveillance

The CSM outlined two levels of surveillance events and the associated activities. A level 1 surveillance event was a structured, forward-planned, larger-type, surveillance event, which examined an authorisation holder’s systems, safety risk controls, and processes, and covered:

• Systems audits: an audit based on a defined scope taking into account the specific activities conducted by the authorisation holder and their associated systems.
• Health checks: similar to a systems audit, but usually shorter in scope and duration.
• Post-authorisation reviews: conducted within 6-15 months following the initial issue of an authorisation.

Level 2 surveillance events were less formal interactions with authorisation holders and were more compliance-based to verify the process in place. These events were significantly shorter in duration than level 1 surveillance events and included:

• Operational checks: the inspection of an aircraft, documentation, and preparation for flight (ramp inspection); site inspections; observation (en route) flights; a review of operating manuals; key personnel interviews; and safety meetings with the operator.
• Unscheduled checks: occurrence investigations and events requested by the CASA Executive.

Surveillance findings

In accordance with the CSM, once a surveillance event was completed, the surveillance team members ‘review the evidence obtained for each assessed system risk to determine the level of effectiveness of the associated controls’. Depending on the nature of the deficiencies identified in these controls, written notices in the form of a safety observation or safety finding are issued to the authorisation holder to highlight potential and/or actual breaches.

Safety observations advise an authorisation holder of latent conditions resulting in system deficiencies that have the potential to result in a breach if not addressed. They also identify potential areas of improvement in safety performance. Safety observations do not require a response from the authorisation holder.

Safety findings (previously known as a notice of non-compliance or NCN), were issued for the ‘purposes of identifying a breach of a legislative provision or a provision of the authorisation holder’s written procedures’. These findings will generally be issued when CASA is satisfied that the authorisation holder has the willingness and ability to take remedial and corrective actions to address this.

When a safety finding was issued, the authorisation holder was required to respond to CASA within a specified period of time, providing evidence of any remedial action, root cause analysis, and corrective action taken. The response and associated evidence would be reviewed to determine whether the authorisation holder ‘has returned to a compliant state’ and ‘is actively working towards implementing the corrective action to mitigate the potential of recurrence of the identified deficiency’. If CASA rejected the response, the authorisation holder would be provided another opportunity to respond. If the response was accepted by CASA, the safety finding was acquitted and the authorisation holder notified accordingly.

However, if CASA could not be satisfied that the authorisation holder was willing or able to do so, the finding would be issued and the CASA coordinated enforcement process would be initiated.

A repeat safety finding was issued when the same breach was identified during subsequent audits. To issue a repeat finding, the criteria of the breach had to be exactly the same, that is, the same section of the regulations was not being complied with. The CSM provided limited details about assessing and acquitting repeat safety findings aside from referring the operator to coordinated enforcement. The CSM and CASA Enforcement Manual stated that:

When conducting the post-surveillance review and analysis, if the authorisation management team identify repeated breaches of a similar nature from the review of previous surveillance events, the authorisation management team, in conjunction with the Controlling Office Manager, must initiate the Coordinated Enforcement Process (CEP)...The CEP will provide a forum for better informed decision making and for discussing alternative options. [CSM]

This [process] may identify which particular enforcement tool or combination of tools that would be most likely to achieve the optimal safety outcome…However, the most appropriate response may ultimately involve a combination of: enforcement and compliance tools, compliance tools alone, or voluntary action initiated by the industry participant. [Enforcement Manual]

Periodic assessment tool

The authorisation holder performance indicator (AHPI) was a questionnaire-based tool used by CASA to assess ‘the apparent risk to safety presented by an authorisation holder’. According to the CSM, an AHPI assessment was to be conducted:

• at least every 6 months
• where a significant operational change had occurred or an area of concern had arisen
• after completing a surveillance event or after surveillance findings had been finalised or acquitted.

Specifically, the tool assessed the authorisation holder against 19 parameters using word pictures with a one to five scoring system, where one indicated a lower apparent risk to safety and five indicated a higher risk to safety. These parameters focussed on a number of behavioural factors that were commonly recognised as affecting or relating to safety performance. While the score itself did not have a particular meaning in terms of further action required, it was reported that the entry in the Sky Sentinel system will change colour if the score is above about 150, which indicated a heightened risk.

The score was used to assist the certificate management team to assess whether any risk-based surveillance of an organisation was required, and to scope the areas for that assessment. The results would then be discussed either monthly, or 6-monthly, depending on the category of the operator.

A summary of the overall scores and comments made during AHPI assessments for Airlines of Tasmania in 2017 (AOC only)^[27] are shown in Table 5. In these assessments, high scores were given for the parameters under ‘safety outcomes’, which included regulatory history breaches and enforcement. This related to repeat safety findings and the associated unsatisfactory responses (refer to the section titled Surveillance events for Airlines of Tasmania). There were also several comments in the assessments that noted the SMS was not operating effectively. There were no AHPI assessments conducted in 2018.

Table 4: AHPI assessments on Airlines of Tasmania AOC in 2017

Date	Score[28]	Selected comments
3 February 2017	138	Enforcement underway re safety management recurring NCNs and unsatisfactory responses.
18 July 2017	133	Safety-related decision-making (SMS having various issues) Regulatory history - breaches (Breaches in relation to the SMS). Regulatory history - enforcement (safety management) Other safety issues or concerns (weaknesses in SMS and limited training and checking capacity). Improvements in the management of South West operation[s] noted.
19 December 2017	164	Control - SMS capability not effective Safety occurrences - repeat findings; lack of management commitment with recruitment of safety manager and ensuring SMS is effective.

Source: CASA, modified by the ATSB

Frequency of surveillance activities

It was reported by CASA that, while a level 1 surveillance event required approval by the controlling office manager, a certificate management team was able to carry out as many level 2 surveillance events as they deemed required. The recommended frequency of surveillance activities in the CSM for regular public transport and small charter (aircraft with a maximum take‑off weight less than 5,700 kg), and when these were conducted for Airlines of Tasmania is detailed in Table 5.

Table 5: Flight operations surveillance frequency guide

Type of operation	Type of surveillance	Recommended frequency	Last conducted for Airlines of Tasmania
Regular public transport	Level 1 - systems audit	1 per year	July 2017
	Level 2 - operational check	1 per year	December 2017
Small charter	Level 1 - health check	1 per year	September 2016
	Level 2 - operational check	1 per year	December 2017
Training and checking	Level 2 - operational check	1 per year	October 2018

Source: CASA, modified by the ATSB

Surveillance events for Airlines of Tasmania

Overview

In reference to the scheduling of surveillance activities, and taking into account current enforcement action and organisational changes, the CSM stated:

CASA’s surveillance program scheduling is driven by the risk to safety posed by authorisation holders and is based on an assessment of a number of factors. These factors include the assessment of an authorisation holder’s safety performance, taking into account assessment factors indicated by the Authorisation Holder Performance Indicator (AHPI) assessment results and time since the last assessment, outstanding Safety Findings and findings history, time since the last surveillance event and safety-related risks specific to each authorisation holder. Based on this consolidated information, CASA has the ability to prioritise surveillance activities commensurate with resources available.

In the 4 years prior to the accident (2014-2018), CASA conducted a number of surveillance events of Airlines of Tasmania. These included two level 1 system audits, one level 1 health check and 14 level 2 operational checks. Of these events, four included a review of the SMS. A summary of all the surveillance events are shown in Appendix A – Summary of CASA surveillance activities for Airlines of Tasmania between 2014-2018. Relevant details from each of these events for each year is presented below.

Surveillance events in 2014

In February 2014, CASA conducted a level 2 - operational check, which reviewed the elements of the SMS. Several non-conformances were found and safety findings were issued relating to:

• Safety assurance: safety committee meetings, change management, and overdue audit findings.
• Safety risk management: occurrence investigation and the occurrence/hazard reporting system and risk register. The latter included a mismatch between the risk matrix used in the organisation’s occurrence/hazard reporting system database and risk register compared to the approved Airlines of Tasmania matrix (NCN 708925).
• Safety promotion: safety management system training.
• Safety policy and objectives: safety management system manual and the emergency response plan. The audit report also mentioned that the safety findings ‘indicate broader issues associated with the continuous improvement of the organisation’s management systems’. Airlines of Tasmania subsequently conducted a significant rewrite of their SMS manual and all of the safety findings were acquitted by CASA in July 2014.

In August 2014, Airlines of Tasmania, who were the operators of Cambridge Airport, changed the designation of one of its three runways without advising stakeholders in advance. In response, CASA conducted a level 2 - operational check, which included a desktop review of the operator’s assessment of the runway change through the SMS, followed by a site assessment. As part of that review, CASA requested the operator’s risk and change management records, and associated materials to support the change. The review noted that the operator’s SMS did not proactively address this matter and it was recommended that the performance of the SMS be reviewed closely through a separate surveillance event.

In October 2014, CASA conducted a level 1 - systems audit (AOC). The safety systems aspects was assessed through an interview with the safety manager, and a review of safety reports and internal audit records. There were 20 safety/hazard reports raised in 2013 and 22 safety/hazard reports raised in 2014. A review of the safety reports suggested an appropriate level of reporting for the size and complexity of the operations. The content of the reports also suggested that there was a relatively open reporting culture. Based on the sampling of the safety meetings, safety survey and newsletters, the safety activities carried out by Airlines of Tasmania was thought to be appropriate for their operations at the time.

Surveillance events in 2015

In 2015, CASA conducted several surveillance activities, such as site and ramp inspections, but none included audits of the SMS.

Surveillance events in 2016

In September 2016, CASA conducted a level 1 – health check. Overall, it was found that the operator’s SMS was not operating effectively across all four SMS elements. The audits stated that Airlines of Tasmania ‘should focus on identifying and addressed the root cause rather than the active failure and any mitigating action should take a systems approach and be accompanied by relevant supporting evidence’.

The audit identified repeat findings related to widespread non-conformance of the SMS, with eight safety findings and two observations issued relating to:

• Safety assurance: the effectiveness and continuous improvement of the SMS. The latter was a repeat finding from February 2014.
• Safety policy and objectives: emergency response plan (a repeat finding), and control of SMS documentation and processes.
• Safety risk management: limited scope and effectiveness of the risk register (NCN 715369), management of safety decisions and actions, and risk assessments not embedded into safety risk management processes (all were repeat findings from February 2014). For the finding relating to the scope and effectiveness of the risk register (NCN 715369: repeat finding, refer to NCN 708925) it was identified that the risk register was only used for change management, rather than all operational risks. Furthermore, all operational safety hazards had not been added to the risk register and mitigations not included in the hazard and occurrence list. This led to difficulties in tracking what actions had been implemented to prevent re‑occurrence, and disagreement between personnel about the consequences for occurrences listed in the system.
• Safety promotion: deficiencies found in the SMS training documentation (a repeat finding).
• There was also a safety observation issued under safety policy and objectives relating potential disconnects between ‘SMS channels of information’.

Surveillance events in 2017

In early 2017, based on continued unsatisfactory responses to safety findings about ‘management of safety decisions and actions’, ‘safety management system - continuous improvement’, ‘safety management system training’, and ‘safety management system - risk register’, CASA coordinated enforcement was initiated.

In March 2017, CASA informed the operator that the responses received for the safety findings were unsatisfactory. The operator subsequently provided CASA with additional evidence and the safety findings ‘safety management system – continuous improvement’ and ‘management of safety decisions and actions’ were acquitted.

To address the outstanding safety findings, the CASA safety system inspector recommended that surveillance be scheduled to follow-up on the evidence for these findings, assess the new safety manager, and assess the capability of the SMS. The certificate management team manager indicated that before additional surveillance would be completed, the operator would be subject to the CASA enforcement meeting process as they were under enforcement, and the plan would be for a level 1 surveillance audit.

In July 2017, as part of a level 2 systems audit, it was identified that the operator had implemented various changes to the management of VFR charter flights into Bathurst Harbour. This included upgrading the airstrip facility and equipment to enhance the remote surveillance and communication capability, and the introduction of Spidertracks real-time aircraft tracking. The audit identified a safety management - risk management deficiency related to fatigue risk management.

In December 2017, a level 2 - operational check was conducted. In preparation for that audit, the inspector completed a surveillance checklist. Part of this checklist required that the inspector review the following:

• authorisation holder assessment
• previous surveillance history
• findings
• any follow-up items from previous audits, including findings with status of ‘Verification Required by CASA’

An additional document, ‘surveillance scoping and planning’ was also completed prior to this audit. This document contained a list of the previous NCNs, including the number and details. There were five NCNs on the list, including NCN 715369 - ‘Safety Risk Management Risk Register’. The document had a hand-written cross next to this entry, however, as there were no further details, the ATSB was unable to determine the meaning of this.

The post-surveillance event report stated that the operator’s SMS was not operating effectively as they had only demonstrated partial effectiveness. Specifically, the report issued four safety findings and one safety observation:

• Issues relating to the incomplete transfer of the risk register into Air Maestro, and the previous ‘action hazard register’ spreadsheet contents being used within the quarterly safety committee minutes (instead of Air Maestro). The risk register also had items but no associated actions (SF 718040). This was a repeat finding from the audit conducted in 2016, titled ‘risk register’ (NCN 715369).
• Outdated references in the SMS manual and the additional role of document controller not added to the safety manager role. This was a repeat finding from the audit conducted in 2016.
• There were two safety findings issued regarding assurance of the SMS effectiveness and emergency response plan exercises.
• An observation was raised relating to the safety manager role. The report stated that the safety manager did not feel empowered or authorised in fulfilling their role.

Surveillance events in 2018

Only one surveillance event was completed in 2018, a level 2 - operational check (site inspection). The scope of that event did not include items related to the operator’s SMS or hazard and risk identification. A second site inspection was scheduled for November 2018, however, it was cancelled.

The operator’s new safety manager, who commenced in 2018, had several interactions with the certificate management team throughout the year. The inspector who conducted the last surveillance activity believed that the SMS was functioning well. This was based on interactions with the new safety manager and the continuing work relating to re-writing the SMS. The safety manager resigned from the position in October 2018, and at the time raised a number of issues with CASA, relating to the safety manager role, the flying training school and maintenance.

Acquittal of outstanding safety findings

In February 2018, the operator submitted their responses to the safety findings from the audit in December 2017. In response, the CASA inspector who issued the findings requested further evidence. After receiving that evidence, all these findings were acquitted by March 2018. This included the repeat findings of SF 718040 (issued in 2017) and NCN 715369 (issued in 2016).

The information supplied to address the repeat finding (SF 718040) was directly related to the incomplete transfer of the risk register into Air Maestro, the previous ‘action hazard register’ contents being used within the quarterly safety committee minutes, and the risk register having items but no associated actions. However, despite the previous finding (NCN 715369) also being acquitted, from the records supplied to the ATSB by CASA, it did not appear that any information had been submitted by the operator to address the deficiencies identified in this finding. This finding related to:

• The occurrence/hazard reporting system database and risk register was only used for change management. The intent of the risk register was to capture all operational safety risks including occurrences, audit findings and any proactive hazard capture.
• All operational safety hazards have not been added to the risk register.

The Civil Aviation Safety Authority reported that, for repeat findings, only the most recent one will be directly acquitted, as once a repeat finding was issued, it effectively replaced any earlier findings. The planning and scoping forms were to ensure that any outstanding items from previous surveillance events would be reviewed and assessed at the upcoming surveillance event. In this case, once SF 718040 had been issued and then acquitted, this meant that the previous finding (NCN 715369) was also acquitted, potentially without being fully assessed.

As a result of the outstanding safety finding being acquitted, the coordinated enforcement case was closed in August 2018.

Civil Aviation Safety Authority comments

On 6 August 2021, in response to the draft report, CASA stated that the four safety findings identified in the December 2017 audit were regarding items of a more administrative nature related to the continuous improvement of the operator’s development of their SMS. Therefore, CASA did not consider these findings to be of an operational nature. Also, CASA indicated that their engagement with the operator to acquit the findings in February 2018 was considered formal surveillance activity. Consequently, they did not agree with the ATSB’s statement that no formal surveillance activities were conducted in the year prior to the accident.

In addition, regarding the operator’s surveillance history, CASA indicated they had conducted seven level 1 and 17 level 2 surveillance events from March 2012 up until the accident. They stated that this level of oversight was considered ‘suitable’ for the nature of operations conducted by Par Avion and that it reflected their continued positive engagement with CASA to improve the SMS.

Further, the regulatory service activities also demonstrated CASA’s ongoing oversight and provided valuable insight into the operator’s safety health. CASA stated that, this, combined with the surveillance activities, demonstrated a ‘completely appropriate oversight posture for an operator conducting flight training, charter and low capacity RPT [regular public transport] flight operations’.

Post-accident safety assurance review

After the accident, CASA conducted a safety assurance review. This type of review was undertaken after an incident or accident as part of CASA’s continuous improvement activities. It was not a function of the review to investigate the incident or accident. The CASA terms of reference for the review were to examine:

• CASA’s oversight of the operator at the time of the accident, including recent surveillance, regulatory services, and recent audit activity.
• Any immediate action CASA might consider necessary in the interests of aviation safety.
• Any significant learnings for CASA from the accident.
• Any further matters that might be considered relevant by the Regulatory Services and Surveillance Division given the circumstances of the accident.

The review noted that all findings from the surveillance report in December 2017 had been acquitted. Although concerns regarding the operator’s SMS were identified, the review noted that:

Audit scoping to test the ongoing effectiveness of the operator’s SMS, including qualifications and experience of key personnel was not evident in planned surveillance events. As an effective Safety Management System is a key safety mitigator for small air transport operations, it is imperative that CASA utilises a robust and consistent approach to surveillance.

There is an opportunity for CASA to review the apparent disconnect between the AHPI process and its relationship to the surveillance planning and scoping for this operator.

As a result of this accident and another ATSB investigation, the CSM was amended in July 2019 to include a detailed description of the surveillance technical officer role, which has an important part in the planning and scoping of audits. In addition, given the repeat findings related to the operator’s SMS, CASA considered reviewing the process around audit team composition to include inspector disciplines in relation to identified areas of risk.

Overall, the report concluded that there were no immediate actions or significant learnings from the review. It noted that the oversighting certificate management team was regularly engaging in surveillance and regulatory service activities with the operator, however, it was noted that ‘opportunities to focus surveillance on the SMS outputs of the operator were not fully realised’.

Previous investigations with surveillance and hazard identification findings

Previous ATSB investigations have identified findings relating to CASA surveillance events, activities and/or processes. These included two collision with terrain accidents in 2017 involving a Cessna 441 and another involving a Cessna 172M, and the ditching of an Israel Aircraft Industries Westwind 1124A in 2009. Specifically, the findings were:

In the 5 years leading up to the accident, the Civil Aviation Safety Authority had conducted numerous regulatory service tasks for the air transport operator and had regular communication with the operator’s chief pilots and other personnel. However, it had not conducted a systemic or detailed audit during that period, and its focus on a largely informal and often undocumented approach to oversight increased the risk that organisational or systemic issues associated with the operator would not be effectively identified and addressed. [ATSB investigation AO-2017-057]

The Civil Aviation Safety Authority’s procedures and guidance for scoping a surveillance event included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards. [ATSB investigation AO-2017-005]

Although the Civil Aviation Safety Authority (CASA) collected or had access to many types of information about a charter and/or aerial work operator, the information was not integrated to form a useful operations or safety profile of that operator. In addition, CASA’s process for obtaining information in the nature and extent of an operator’s operations were limited and informal. These limitations reduced its ability to effectively prioritise surveillance activities. [ATSB investigation AO‑2009-072]

The Civil Aviation Safety Authority’s procedures and guidance for scoping an audit included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards. [ATSB investigation AO-2009-072]

In addition to the above findings:

Although the operator’s safety management processes were improving, its processes for identifying hazards extensively relied on hazard and incident reporting, and it did not have adequate proactive and predictive processes in place. In addition, although the operator commenced air ambulance operations in 2002, and the extent of these operations had significantly increased since 2007, the operator had not conducted a formal or structured review of its risk controls for these operations. [ATSB investigation AO-2009-072]

Flying in mountainous terrain

A Civil Aviation Authority of New Zealand booklet titled Mountain Flying (2012) discussed operations in mountainous terrain. The booklet described those operations as challenging and cautioned that the weather conditions in that terrain can be severe and change rapidly. Specifically, a small change in the outside air temperature towards the dewpoint temperature can produce cloud almost instantaneously and an increase in wind strength can increase the intensity and extent of downdrafts and turbulence, often found in the lee of the mountain ranges.

The booklet further emphasised the need for a greater level of navigational accuracy when flying in the mountains. This, combined with poor weather conditions, can significantly increase pilot workload and result in a reduced mental capacity to make decisions and manage new tasks or problems. Additionally, in low visibility conditions, navigation will be complicated by difficulty in identifying features and normal waypoints along the route. Therefore, weather is a very important consideration for pilots when operating in the mountains.

To reduce the risk of inadvertent VFR flight into IMC, there are a number of strategies that pilots can use to avoid weather, and a framework of actions to assist recovery if they inadvertently fly into IMC (SKYbrary, 2020);  

• Effective pre-flight planning, including gathering all available weather information to determine most suitable route options.
• Calculating the ‘minimum VFR altitude to continue’, which is typically at least 500 ft above the expected terrain/obstructions. Once airborne, this can act as a trigger for the pilot if required to descend to this level due to a lowering cloud base.
• Ensuring that sufficient fuel is carried to allow for holding and/or diversions.

Further, the Mountain Flying booklet (2012) highlighted the importance of always having an escape route, specifically:

The golden rule of mountain flying is to always have an escape route regardless of whether you are flying a fixed-wing aircraft or a helicopter. The aircraft must never be placed in a situation where there is insufficient room to turn back safely, or to recover from an encounter with turbulence or downdraught, or to make a successful forced landing in the event of an engine failure.

When flying in mountainous terrain, the risks associated with encountering IMC are significant. While no advice in any manual can cover all scenarios, the general advice is for pilots to consider how they might handle such a situation should it arise. Consideration should be given to:

• The use of aircraft instruments and terrain displays (including EGPWS) to retain situational awareness and assist in avoiding terrain.
• Obtaining appropriate external assistance where available (e.g. air traffic services).

Controlled flight into terrain

The aviation community has invested a considerable amount of time and resources to reduce the risk of CFIT, particularly in the commercial sector. The preventative strategies have focused on three key areas: technological advancements, education and training, and research and recommendations. While these measures have substantially reduced these types of accidents, CFIT continues to occur. The ATSB’s research report titled CFIT: Australia in context 1996 to 2005  defined a CFIT as one where:

• the aircraft was under the control of the pilot(s)
• there was no defect or unserviceability that would have prevented normal operation of the aircraft
• there was an in-flight collision with terrain, water or obstacles
• the pilot(s) had little or no awareness of the impending collision.

Overall, the research found that the likelihood of a CFIT accident occurring was rare, with CFIT accidents accounting for only 1.5 per cent of all accidents recorded during the 10-year reporting period. However, 60 per cent of CFITs resulted in fatal injuries to the aircraft occupants, underscoring the severity of this type of occurrence. In summary, while infrequent, CFIT accidents have a high risk of fatal injuries.

Carriage of lightweight recorders

The benefits of onboard recording devices have long been recognised as an invaluable tool for investigators in identifying the factors behind an occurrence and assisting with the identification of important safety issues. However, in many cases, investigations involving light aircraft are hampered by a lack of definite information about the circumstances that lead to the occurrence. This contrasts with the case for large commercial aircraft that are required to be fitted with a flight data recorder and cockpit voice recorder.

Retrofitting traditional crash protected flight recorders to lighter aircraft is expensive and technically difficult. However, recent technological advancements have meant that cost-effective lightweight recorders are available and require only aircraft power to be connected. These recorders typically record cockpit audio and video. As such, they can provide additional information about the state and operation of the aircraft, the operating environment, and the actions of the crew, potentially allowing for timely and appropriate safety action.

The absence of an onboard recording device has resulted in undetermined findings for a number of ATSB investigations. Recent accidents where a lightweight recorder would have benefitted the investigation included a:

• Collision with water involving a de Havilland Canada DHC-2 aircraft, VH‑NOO, at Jerusalem Bay, Hawkesbury River, New South Wales, on 31 December 2017 (AO‑2017‑118).
• Loss of control and collision with terrain involving a Cessna 441, VH-XMJ, 4 km west of Renmark Airport, South Australia, on 30 May 2017 (AO-2017-057).

In contrast, there have been investigations where the availability of recording devices, although not crash protected, have greatly assisted in determining the contributing safety factors and ultimately the identification of safety issues. These included a:

• Rotor revolutions per minute decay and hard landing involving a Robinson R44, VH‑HGX, 5 km south of Ayers Rock Airport, Northern Territory, on 17 January 2018 (AO‑2018‑006). A rear seat passenger captured a portion of the flight on video.
• Collision with terrain following an engine power loss involving a Cessna 172M, VH‑WTQ, 22 km north-west of Agnes Water, Queensland, on 10 January 2017 (AO‑2017‑005). The front right seat passenger recorded a video of the entire flight on a mobile phone.
• Collision with terrain involving a Cessna U206, VH-UYB, Willowbank, Queensland, on 2 January 2006 (200600001). Two digital video camera recorders were found in the aircraft wreckage and provided footage of a previous flight, pre-flight briefings, and elements of the accident flight.
• Collision with terrain involving a de Havilland Canada DHC-6-300, P2-KSF, 12 km north‑north-east of Port Moresby, Papua New Guinea, on 20 September 2014 (14‑1005). The aircraft was fitted with an Appareo Vision 1000 video camera/data logger, which recorded visual and aural data.

Recommendations for the fitment of lightweight recording devices

The need for onboard recording devices in other than large aircraft has been recognised by other investigation agencies, who have made various recommendations for these devices to be fitted. These agencies have included the United States National Transportation Safety Board (NTSB), Transportation Safety Board of Canada, United Kingdom Air Accidents Investigation Branch, European Union Aviation Safety Agency and New Zealand Transport Accident Investigation Commission.

In 2017, the European Aviation Safety Agency issued a Notice of Proposed Amendment (NPA 2017-03) for ‘In-flight recording for light aircraft’. The proposal was for the mandated carriage of lightweight recorders for light aircraft (maximum take-off weight less than 5,700 kg) involved in commercial operations. Although not mandated yet, following consultation, an updated proposal (Opinion 2019/02) recommended new requirements for aeroplanes and helicopters that;

• are used for commercial operations
• are manufactured on or after the date of entry into force + 3 years
• are not specified by the current flight data recorder carriage requirements and
• have a maximum operational passenger seating configuration of more than nine (for aeroplanes).

On 29 January 2021, as part of the investigations into the collision with water involving a de Havilland Canada DHC-2 aircraft (AO‑2017‑118), the ATSB released the following safety recommendation to CASA (AO‑2017‑118-SR-049) regarding the carriage of lightweight recorders:

The Australian Transport Safety Bureau recommends that the Civil Aviation Safety Authority consider mandating the fitment of onboard recording devices for passenger-carrying aircraft with a maximum take-off weight less than 5,700 kg.

Similarly, on 9 February 2021, as a result of its investigation (AAR-21-01) into the fatal accident involving a Sikorsky S-76B helicopter at Calabasas, California, on 26 January 2020, the NTSB reiterated a previously issued recommendation to the United States Federal Aviation Administration:

Require all existing turbine-powered, nonexperimental, nonrestricted-category aircraft that are not equipped with a flight data recorder or cockpit voice recorder and are operating under 14 Code of Federal Regulations Parts 91, 121, or 135 to be retrofitted with a crash-resistant flight recorder system. The crash-resistant flight recorder system should record cockpit audio and images with a view of the cockpit environment to include as much of the outside view as possible, and parametric data per aircraft and system installation, all as specified in Technical Standard Order C197, “Information Collection and Monitoring Systems.” (A-13-13) Classified “Open—Unacceptable Response”

Similar occurrences

A search of the ATSB’s database showed there had been 48 CFIT occurrences in the previous 10 years (26 November 2010 to 2020), some of which involved collisions with obstacles during visual flight. However, throughout this period, there were six fatal accidents, five of which were categorised as private operations and the other as charter. Three of the fatal accidents were the result of VFR flight into IMC in mountainous terrain. The ATSB also identified two international investigation reports, which had similarities to the accident involving VH-OBL and are summarised below.

ATSB investigation (AO-2019-018)

On 8 April 2019, at 0650 Eastern Standard Time, a Cessna 182 aircraft, registered VH-DJN, departed Cloncurry Airport on a private VFR flight to Mount Garnet aerodrome, Queensland. On board were the pilot and one passenger. The aircraft landed in Mount Garnet at 0920, where the passenger disembarked and left the aerodrome. The passenger planned to return to the aerodrome at about 1500 for an onward flight in VH-DJN to Charters Towers.

At about 0934, the aircraft departed Mount Garnet for a 62 km flight to Atherton Airport, where the pilot intended to refuel the aircraft before returning to collect the passenger. However, 15 minutes after departing, the aircraft impacted trees and terrain on the Herberton Range. The impact fatally injured the pilot and the aircraft was destroyed.

The ATSB found that the pilot, who was qualified only to operate in visual meteorological conditions, flew toward and entered an area of low cloud and reduced visibility, which obscured rising terrain. This almost certainly resulted in the pilot losing visual reference with the ground and a CFIT.

National Transportation Safety Board investigation (NTSB/AAR-17/02)

On 25 June 2015, about 1215 local time, a single-engine turbine-powered, de Havilland DHC-3 floatplane, registered N270PA, collided with mountainous, tree‑covered terrain about 24 miles east‑north‑east of Ketchikan, Alaska. The pilot and eight passengers sustained fatal injuries and the aircraft was destroyed.

The investigation determined that the flight encountered deteriorating weather conditions, with the terrain at the accident site likely obscured by overcast cloud and visibility restricted due to rain and mist. The pilot had climbed the aircraft to an altitude that would have provided safe terrain clearance. However, the pilot deviated from the typical short route, which required the flight to pass two nearly identical mountains before turning west. This deviation placed the aircraft on a collision course with a 1,900 ft mountain, which it impacted at an elevation of about 1,600 ft.

In the final 2 seconds of the flight, the aircraft pitched up rapidly before colliding with terrain. This strongly supported the scenario that the pilot continued the flight into near-zero visibility conditions. However, as soon as the pilot realised that the flight was on a collision course, the pilot attempted to avoid the terrain.

ATSB investigation (AO-2013-186)

On 23 October 2013, the pilot of a Cessna 182Q aircraft, registered VH-KKM, departed Moruya Airport, New South Wales on a private VFR flight to Mangalore Airport, Victoria. The flight route encompassed the Alpine National Park, where the forecast and actual weather included extensive thick cloud and severe turbulence. Shortly after passing Mount Hotham Airport, Victoria, the aircraft collided with terrain on the eastern side of Mount Blue Rag, at about 5,000 ft AMSL. The pilot sustained fatal injuries and the aircraft was destroyed.

The investigation found that the pilot had departed Moruya with less than visual meteorological conditions forecast along the planned route. It was very likely that these conditions were encountered while flying over the Alpine National Park, where the pilot likely experienced reduced visibility to the extent that terrain avoidance could not be assured. This accident highlighted the risks associated with operating VFR in adverse weather, particularly when flying in a challenging environment such as mountainous terrain.

Papua New Guinea Accident Investigation Commission investigation (AE‑2009-050)

On 11 August 2009, a de Havilland Canada DHC-6 Twin Otter aircraft, registered P2-MCB, with two pilots and 11 passengers, was being operated on a scheduled regular public transport service from Port Moresby to the Kokoda airstrip, Papua New Guinea. At about 1113 local time, the aircraft impacted terrain on the eastern slope of the Kokoda Gap at about 5,780 ft AMSL in heavily-timbered jungle about 11 km south-east of the Kokoda airstrip. The flight was planned under the instrument flight rules but was flown using visual procedures.

The investigation determined that, when the crew commenced the descent through the Kokoda Gap in the reported rapidly changing weather conditions, they committed themselves to a course of action that they could not be assured of completing safely. Further, the surrounding mountainous terrain and evident cloud in the Kokoda Gap had the potential to severely limit the crew’s escape options, increase their workload, and test their situational awareness. A reduction in situational awareness and the presence of mountainous terrain during an approach are known risk factors in instances of CFIT.

In addition, the investigation concluded that the operator did not have a published emergency recovery procedure for application in the case of inadvertent flight into IMC. In response, the operator provided additional guidance to pilots in respect of the risk of inadvertent flight into IMC. Specifically, it was noted that:

A key to safely recovering to VFR [visual flight rules] conditions, should you inadvertently find yourself in IFR [instrument flight rules] conditions, is prior planning as to how you would handle this for different conditions. No advice in any manual can cover all the scenarios...

4. Peak season for flights to the south-west was from December through to March, but could vary year to year depending on demand and weather conditions.
5. The terrain database used terrain and obstacle information supplied by Government sources, but the accuracy and completeness of this could not be guaranteed.
6. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘few’ indicates that up to a quarter of the sky is covered, ‘scattered’ indicates that cloud is covering between a quarter and a half of the sky, ‘broken’ indicates that more than half to almost all the sky is covered, and ‘overcast’ indicates that all the sky is covered.
7. The accident site was about 40 km from the south coast, 46 km from the west coast, and about 35 km from the coast to the south-south-west.
8. An aerodrome forecast is a coded statement of meteorological conditions expected at an aerodrome and within a radius of 5 NM of the aerodrome reference point.
9. Ceiling and visibility okay (CAVOK): visibility, cloud and present weather are better than prescribed conditions. For an aerodrome weather report, those conditions are visibility 10 km or more, no significant cloud below 5,000 ft, no cumulonimbus cloud and no other significant weather.
10. Orographic ascent or lifting: occurs where the flow of air is forced up and over physical barriers such as mountains.
11. Virga: precipitation that falls from clouds, but evaporates before reaching the ground.
12. A The National Aeronautical Information Processing System is a multi-function, computerised, aeronautical information system that allows users, such as pilots, to obtain weather information and submit flight plans into the air traffic system.
13. A routine aerodrome weather report issued at routine times, hourly or half-hourly.
14. There was no dew point reading available from the Maatsuyker Island weather station on the day of the accident.
15. Windy is an online application, which uses various data sources, including Global Forecast System models produced by the National Centers for Environmental Prediction and European Centre for Medium-Range Weather Forecasts, to provide detailed weather forecasting.
16. Spidertracks enables real-time flight tracking, automated flight watch, two-way communication, and flight data monitoring for aircraft.
17. ADS-B data is nominally transmitted every 0.5 seconds, however, not all transmission were available, with gaps of up to 20 seconds during the accident flight.
18. As aircraft attitude, power settings and wind direction was not known at any point, this analysis was limited to using the groundspeed, distance and altitude from the ADS-B data..
19. There was no CASA requirement for ICUS training for the single-engine Cessna 206. However, Civil Aviation Order 82.1.4.1 stated that a minimum of 5 hours experience in-command on the aircraft type was required for a person to act as pilot in command of a VFR charter flight in a multi-engine aircraft (< 5,700kg), such as the Islander.
20. Due to the 2-minute data interval for Spidertracks, there were slight differences in the locations of the comparison points used for each flight.
21. Due to the 2-minute data interval, these figures may not be exact as it was difficult to determine exactly when the aircraft turned around/changed direction.
22. A register of hazards and the level of risk that each pose to operations.
23. Air Maestro is an online safety and operational tool that includes features for incident/accident reporting, a hazard/risk register, and audit management.
24. Visual meteorological conditions (VMC): an aviation flight category in which VFR flight is permitted – that is, conditions in which pilots have sufficient visibility to fly the aircraft while maintaining visual separation from terrain and other aircraft.
25. The CASA Director may delegate CASA’s powers and functions under the Civil Aviation Act 1988 to any person, including a person who is not employed by CASA.
26. Version 3.2 of the CSM was current at the time of the accident.
27. The Civil Aviation Safety Authority provided the ATSB with the AHPI assessment for both the AOC and approved maintenance organisation. Only the AOC assessment was examined as this directly related to flight operations.
28. Higher scores indicated higher risk.

Introduction

While en route from Cambridge Airport to Bathurst Harbour, Tasmania, the aircraft entered through a gap in the Arthur Range known as the portals. The aircraft was manoeuvred below the height of the surrounding terrain and shortly after, collided with Western Arthur Range during a turn, under power and pilot control.

Due to the extent of impact damage, the ATSB was unable to verify the operation of every aircraft system. However, there were no known defects with the aircraft, and examination of the accident site photographs and recovered wreckage indicated that it was highly unlikely that a mechanical problem contributed to the accident.

The weather at Cambridge Airport and earlier in the flight suggested the conditions were initially suitable for departure, but deteriorated as the flight progressed, consistent with the graphical area forecast. While several of the operator’s pilots reported some expectation to at least take-off to examine the weather conditions, there was no evidence to suggest that they felt pressured to continue these flights if the conditions were unfavourable. Further, the pilot had no other flights for the day, and the passengers waiting at Bathurst Harbour were regulars who knew that flights might not always get through.

A number of people interviewed mentioned that the Bureau of Meteorology forecast for that morning was unusual, in that it covered the whole of Tasmania without any sub-divisions. In addition, there was no dew point reading from the closest Bureau of Meteorology weather station (Maatsuyker Island) to the destination. However, the forecast provided sufficient information that there was some adverse weather in the coastal regions, which included Bathurst Harbour, and in close proximity to the accident site. This may have influenced the pilot’s decision to choose the direct route instead of the coastal route. The forecasts were also consistent with information supplied by the operator’s pilots, who reported that adverse weather was not unusual for the south-west region.

This analysis will examine the conditions under which the accident developed, and the guidance provided by the operator to their pilot’s operating to the south-west, particularly relating to deteriorating weather conditions. The operator’s safety management system including hazard identification, and the Civil Aviation Safety Authority’s oversight will also be discussed.

Encountered reduced visibility

The aircraft’s track indicated that the pilot had selected the direct route to Bathurst Harbour. Passing through the portals in the Arthur Range, suggested altitude‑limiting cloud conditions for visual flight were present at that time. The Bureau of Meteorology’s forecast and subsequent analysis of the actual weather conditions, which were consistent, showed the presence of extensive low cloud in the accident area.

Similarly, the observations of the passenger waiting at Bathurst Harbour also indicated that the conditions were marginal and that they were expecting the aircraft to arrive from the coastal direction, if at all. Further, although almost 2 hours later, the pilots searching for the aircraft also reported low cloud and reduced visibility. While there was no onboard recording device to definitively show what the pilot encountered, given the above, it was likely that reduced visibility conditions were present when passing through the Arthur Range.

After passing through the portals, flight data showed the aircraft being manoeuvred in the valleys, before tracking back towards the portals. That aircraft movement was consistent with the pilot assessing different options for possible routes through to Bathurst Harbour before deciding that the best, or only available, course of action was to backtrack. With limited visibility, the pilot would have had reduced positional awareness of the surrounding terrain. The data also indicated that the pilot appeared to be in control, and there were no indications of a mechanical problem with the aircraft. The wreckage examination noted that the aircraft collided with terrain with a relatively steep angle of bank, which may suggest that the pilot became aware of the mountain just prior to the collision. This was consistent with controlled flight into terrain.

Entered portals at a lower altitude

When compared with other company aircraft that had been flown on the direct route in the year prior, VH-OBL passed through the portals at the lowest altitude and with a descending altitude. Given the actual weather conditions in the accident area discussed above, and without any other reasons for this, it was likely that the pilot was flying lower due to the presence of cloud. Further, about 12 minutes later, as the aircraft was exiting back through the portals, it impacted terrain. This indicated that the weather conditions had likely deteriorated in the time that the pilot spent assessing possible routes through to Bathurst Harbour.

The flight data showed that the pilot conducted two controlled 180° turns in the valleys, rather than continuing directly to Bathurst Harbour. For comparison, about 1 month prior, the accident pilot had flown the same route, but after entering through the portals, diverted down a valley to the coast and then continued to Bathurst Harbour. While the weather conditions on that flight were unknown, it was possible that this influenced the pilot’s decision to continue into the valley on the accident flight. According to ATSB research, this was considered the more typical scenario, where a pilot would continue the flight as planned, rather than return, divert or land when faced with adverse weather.

In practice, much pilot decision-making relies on accurate situation assessment that typically comes from past experience in similar circumstances. Achieving an effective situation assessment involves the ‘recognition and response to a familiar pattern of environmental features’, which is seen to be the basis of weather-related expertise. This enables ‘accurate and rapid responses’ even in situations of high workload. According to Ortiz and others (2017):

…a pilots’ ability to choose an optimal course of action out of a variety of potential responses is thought to be naturally developed through experience (Campbell & Bagshaw, 2002). However, “experts do not merely possess more knowledge, they are better at using it” (Tsang & Vidulich, 2006, p. 261).

The accident pilot was experienced in the type of operation and had flown to Bathurst Harbour many times, including recently, although it was unknown how many flights were via the portals. The pilot was also aware of the changing weather conditions that could be experienced in the south-west.

Further, although there were some observations that the pilot liked a challenge, there was no suggestion that pilot engaged in what was considered to be risky behaviour. More so, the pilot was considered a good decision maker who was willing to turn back when the weather conditions were adverse and had done so in the past.

While the actual conditions perceived by the pilot were unknown, based on the above, it was reasonable to conclude that the pilot would not have deliberately chosen to fly in adverse weather conditions. As noted by Hunter, et al. (2003), ‘meteorological conditions may change rapidly and generally require a continuous reappraisal and reinterpretation of the information available’. This not only highlights the dynamic nature of the aviation environment, but the challenges faced by pilots with in-flight weather-related decision-making. Despite this, given the surrounding mountainous terrain, the cloud evident in the area around the time of the accident would have limited the options available for the pilot to exit the valley.

South-west operations guidance

At the time of the accident, Airlines of Tasmania did not have formal procedures for their south‑west operations. Rather, most of the guidance was being provided informally during in‑command under supervision flights. According to the International Civil Aviation Organization (2015), standard operating procedures ‘are universally recognized as being basic to safe aviation operations’. They are designed to help reduce variation within a given process and ensure operations are performed correctly. Without formal procedures, pilots are required to exercise judgement to the best of their abilities, based on their experience, skills and knowledge.

In this case, if the weather was suitable at Cambridge, the operator’s pilots were strongly encouraged to depart to assess the weather in-flight, even if the forecast indicated they might not be able to get through. However, the pilots reported having a different understanding of how far to continue with the direct route through the portals when deteriorating weather conditions were encountered and what the decision points were.

This was evident from the pilot interviews and the ATSB’s analysis of the Spidertracks data for the south-west flights, where approaching the portals, some flights diverted down the valleys and tracked to the coast (including the accident pilot 1 month earlier), while others tracked over Federation Peak. There was also mention of passing through the portals to have a look. As previously highlighted by the Civil Aviation Authority of New Zealand, pilots should ensure they have an escape route when flying in mountainous terrain. However, noting that this route was typically chosen when lower cloud was present, some of these flights potentially limited the pilot’s escape options if the conditions had deteriorated.

In addition, despite encouraging their pilots to commence a flight, even when the forecasts indicated they may likely encounter adverse weather conditions en route, the operator did not provide any formal guidance on recovery options in the case of inadvertent entry into instrument meteorological conditions. This, combined with the changing weather conditions in the mountainous terrain in the south-west, lack of accurate localised forecasts, and the operator’s option of a low-cloud base route through the Arthur Range might suggest that an effective recovery procedure should be considered.

Such a procedure should not be seen as routinely applicable to such operations, nor as a replacement for sound pre-flight planning and in-flight decision-making. However, while the investigation into a controlled flight into terrain (CFIT) in Kokoda, Papua New Guinea noted that it was not practical to capture all possible scenarios in a procedure, in the south-west context, it could offer a final safety defence against CFIT. Having documented guidance for pre-flight assessment of weather, consideration of minimum continuation VFR altitudes and en route decision points would assist pilots with in-flight weather‑related decision-making. However, while it was unlikely that the pilot would have chosen to fly in adverse weather, without an appreciation of the pilot’s decision-making process at the time based on the actual conditions they encountered, the ATSB was unable to determine if having such documented guidance would have prevented this accident.

Hazard identification

As part of their safety management system (SMS), Airlines of Tasmania had some risk management practices in place, including regular safety committee meetings and the use of the hazard register. While the ATSB’s review noted that new hazards were discussed in these meetings, this, along with the register, predominately relied on safety occurrence reports for hazard identification. That practice was generally consistent with the operator’s SMS manual where the risk management process appeared to focus more on safety occurrence reports.

It was noted that other potential sources of safety information for hazard identification were also mentioned in the manual. However, the Civil Aviation Safety Authority (CASA) had also identified repeat findings relating to the limited scope and effectiveness of the register. As safety reports are one method (reactive) for identifying hazards, this may not reflect the likely risks of all their operational activities.

While adverse weather conditions were a known hazard in their south-west operations, there were very few safety occurrence reports relating to this in the register. For example, analysis of the Spidertrack data and pilots’ reports identified a number of occurrences of diverting, turning back or conducting a round trip due to the prevailing weather conditions. However, there were only two weather-related reports in the register over a 5-year period. In part, this may have been due to the differing understandings among the pilots about when to report such events. Irrespective, this emphasises the importance of utilising multiple methods of hazard identification.

Furthermore, there was limited records of the operator utilising proactive or predictive methods for assessing the risks of current operations, including flights to the south-west. The internal audit conducted in early 2018 also noted that a formalised risk assessment for all operations had not been recently performed.

While related to low flying operations, a previous ATSB investigation of an accident involving the same operator (AO-2014-192) also identified areas for improvement regarding risk identification. However, the ATSB also recognises that the operator had made a number of enhancements to their SMS since that accident.

Another ATSB investigation (AO-2009-072) similarly found that another operator extensively relied on hazard and incident reporting, and, while improving, they did not have adequate proactive and predictive SMS processes in place.

It was acknowledged that the operator of VH-OBL had introduced equipment to improve pilot awareness of the weather conditions in the south-west and allowed flights to be monitored. However, there was no record of any continuous monitoring to evaluate whether these controls were working as intended. Monitoring the effectiveness of the risk controls in place, as part of continuous improvement, is another key component of an SMS (safety assurance).

Although the SMS processes and practices were not considered to have contributed to the accident, primarily using one method of hazard identification limited the operator’s ability to identify and address associated risks across all operational activities. This was also a missed opportunity for the operator to evaluate the ongoing effectiveness of existing risk controls.

Regulatory management of repeat safety findings

In the 4 years prior to the accident, CASA had issued a number of safety findings to the operator about their SMS, including the risk register. As some of these findings were applicable to the same regulation and were identified across different surveillance events, these had become repeat findings. As a result, the operator had been referred to CASA coordinated enforcement.

For example, there were repeat findings identified in 2016 and 2017 regarding the risk register (NCN 715369 and SF 718040 respectively). When the operator provided evidence to CASA indicating action had been taken against the 2017 finding, both findings were acquitted in early 2018, 9 months prior to the accident. However, the ATSB’s review established that the specific details of the deficiencies identified in each finding differed. Further, CASA did not appear to have all the required evidence to assess the earlier finding. Therefore, some of the deficiencies identified in this finding had not been fully addressed when acquitted. This was supported by the subsequent results of the 2018 internal audit and the ATSB’s post-accident SMS review, where similar deficiencies were still present.

The CASA surveillance manual provided comprehensive material on the acquittal process for individual safety findings. However, aside from referring the authorisation holder to coordinated enforcement, there was limited guidance to CASA staff on how to manage and acquit repeat findings. This was consistent with comments received from CASA personnel who also mentioned that only the most recent finding would be acquitted for repeat findings.

While it was noted that there were some controls in place to address this shortcoming, such as the surveillance team oversight, and the surveillance planning and scoping worksheets used in preparation for a surveillance event, these were not fully effective. Therefore, without providing specific guidance, CASA’s acquittal process was not effective in ensuring that all previous findings of a similar nature were appropriately assessed before being acquitted.

No recent safety systems surveillance

In 2017 and 2018, the operator was under CASA coordinated enforcement due to repeat safety findings relating to the SMS. Despite this, CASA conducted only one formal surveillance event in 2018. In addition, records provided to the ATSB indicated that the SMS was not assessed as part of that event. Although it was noted that there were ongoing communications between CASA and the operator, which included two regulatory services for the approval of the safety manager, and review of changes to the SMS manual, an event scheduled for late 2018 had been cancelled. As there were no surveillance planning and scoping worksheets available for these events, the ATSB was unable to establish if either would have considered the SMS. Similarly, the CASA post‑accident safety assurance review mentioned that there was regular contact with the operator, however, ‘opportunities to focus surveillance on the SMS outputs of the operator were not fully realised’.

In addition, the CASA surveillance manual stated than an authorisation holder performance indicator assessment should be conducted every 6 months or if there was a significant change in the organisation, such as the acquittal of safety findings. However, despite this, and the fact that the operator’s last assessment had a high score, key personnel had changed, and there had been a revision of the SMS, no assessment was conducted on the air operator’s certificate in 2018.

Previous ATSB investigations have identified deficiencies with CASA surveillance activities, including not conducting systemic or detailed audits, or not considering the nature of the operator’s activities. For VH-OBL, no formal surveillance events relating to the SMS had been conducted in the year prior to the accident, nor had an authorisation holder performance indicator assessment been undertaken. These were missed opportunities for CASA to prioritise surveillance activities, to monitor the ongoing safety health of the operator, assess the effectiveness of the SMS in the time since the repeat safety findings had been acquitted, and identify additional potential areas for improvement.

Lack of recorded data

There was no regulatory requirement for the aircraft to be fitted with a cockpit voice recorder or flight data recorder. However, this, and previous investigations, have shown that a lack of such devices has hampered the determination of factors that contributed to the accident. In turn, important safety issues that present a hazard to current and future operations were potentially not identified. Conversely, other investigations where some form of recording device was on board, provided valuable information regarding the accident.

In this investigation, the ADS-B data provided important information about the aircraft’s flight track. However, ultimately, the ATSB was unable to determine the exact circumstances of the accident. This included what the weather conditions were as the aircraft approached the portals and how this influenced the pilot’s decision to continue, or what occurred in the cockpit.

The use of lightweight recorders on smaller aircraft conducting commercial operations has the potential to provide a relatively simple and cost-effective way of achieving many of the benefits that are provided by traditional recorders fitted to large aircraft.

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.  Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual

From the evidence available, the following findings are made with respect to the controlled flight into terrain involving Pilatus Britten-Norman BN2A, VH-OBL, 101 km west-south-west of Hobart, Tasmania, on 8 December 2018.

Contributing factors

• The pilot continued descending over the Arthur Range saddle to a lower altitude than previous flights, likely due to marginal weather. This limited the options for exiting the valley surrounded by high terrain.
• While using a route through the Arthur Range due to low cloud conditions, the pilot likely encountered reduced visual cues in close proximity to the ground, as per the forecast conditions. This led to controlled flight into terrain while attempting to exit the range.

Other factors that increased risk

• Airlines of Tasmania did not provide any documented guidance for the south-west operations, despite encouraging pilots to commence the flight, even when forecasts indicated they may be likely to encounter adverse weather en route. This resulted in the pilots having varied understanding of the expectations regarding in‑flight weather‑related decision making at the Arthur Range saddle, and increased the risk that some pilots continued into an area of high terrain in marginal conditions, where options to escape were limited. (Safety issue)
• Airlines of Tasmania's safety management processes for identifying hazards extensively relied on safety reports. This limited the opportunity to proactively identify the risks in all operational activities and assess the effectiveness of existing risk controls. (Safety issue)
• The Civil Aviation Safety Authority’s acquittal process for repeat safety findings was not effective in ensuring that all previous findings of a similar nature were also appropriately assessed prior to being acquitted. (Safety issue)
• The Civil Aviation Safety Authority did not conduct any formal surveillance activities related to the operator's safety management system, including an authorisation holder performance indicator (AHPI) assessment for the year before the accident. This was despite a history of repeat findings related to the safety management system and the previous AHPI assessments indicating increased risk. This was a missed opportunity to monitor the ongoing effectiveness of the system and identify additional areas for improvement.

General finding

• While flight tracking data was available, the aircraft was not fitted with an onboard recording device. This would have provided valuable information to better understand the pilot’s in-flight weather-related decision-making.

ADS-B              Automatic dependent surveillance broadcast

AGL                 Above ground level

AHPI                Authorisation holder performance indicator

ALA                  Aeroplane landing area

AMSL               Above mean sea level

AOC                 Air operator's certificate

BoM                 Bureau of Meteorology

CASA               Civil Aviation Safety Authority

CEP                 Coordinated enforcement process

CFIT                Controlled flight into terrain

CSM                CASA surveillance manual

EDT                 Eastern Daylight-saving Time

GPS                 Global positioning system

ICUS                In-command under supervision

IMC                  Instrument meteorological conditions

METAR            Meteorological aerodrome report

NAIPS              National Aeronautical Information Processing System

NSSP               National surveillance selection process

NTSB               National Transportation Safety Board

SMS                 Safety management system

TAF                  Terminal aerodrome forecast

UTC                 Coordinated Universal Time

VFR                 Visual flight rules

Sources of information

The sources of information during the investigation included:

• Airlines of Tasmania
• Civil Aviation Safety Authority
• Tasmania Police
• Airservices Australia
• Bureau of Meteorology
• Spidertracks
• Aireon
• Flight Aware.

References

Alabaster, C. B., 2000. Golden Rules for Operations in Mountainous Areas. In: D. o. F. S. -. A. D. Force, ed. Operations in Tropical Mountainous Areas. Fourth ed. Laverton: Defence Publishing Service, p. 55.

ATSB, 2005. General aviation pilot behaviours in the face of adverse weather, Canberra: Australian Transport Safety Bureau.

ATSB, 2007. CFIT: Australia in context 1996 to 2005, Canberra: Australian Transport Safety Bureau.

ATSB, 2019. Avoidable accidents No. 4, VFR into IMC. [Online]
Available at: https://www.atsb.gov.au/media/5776635/avoidable-accident-no4-vfr-into-imc_2019.pdf
[Accessed 2021].

Bearman, C., Paletz, S., Orasanu, J. & Brooks, B., 2009. Organizational Pressures and Mitigating Strategies in Small Commercial Aviation: Findings from Alaska. Aviation Space and Environmental Medicine, pp. 1055-1058.

Civil Aviation Authority of New Zealand, 2012. Civil Aviation Authority of New Zealand. [Online]
Available at: https://www.aviation.govt.nz/assets/publications/gaps/mountain-flying.pdf
[Accessed 2020].

Civil Aviation Authority of New Zealand, 2012. Mountain Flying. [Online]
Available at: https://www.aviation.govt.nz/assets/publications/gaps/mountain-flying.pdf
[Accessed December 2019].

Civil Aviation Authority, 2014. CAP 795 Safety Management Systems (SMS) guidance for organisations , London: CAA.

Civil Aviation Safety Authority, 2007. Safety Management Systems: An Aviation Business Guide, Australia: CASA.

Civil Aviation Safety Authority, 2018. CAAP SMS-01 v1.1 Safety Management Systems for Regular Public Transport Operations , Canberra: CASA.

Hunter, D., 2006. Risk Perception Among General Aviation Pilots. The International Journal of Aviation Psychology, pp. 135-144.

International Civil Aviation Organization, 2015. Model advisory circular for air operator's: Standard Operating Procedures for Flight Deck Crewmembers, Montreal: ICAO.

International Civil Aviation Organization, 2018. Safety Management Manual, fourth edition, Montréal: International Civil Aviation Organization.

McMurtie, K. & Molesworth, B., 2017. The Variability in Risk Assessment Between Flight Crew. The International Journal of Aerospace Psychology, pp. 65-78.

National Transportation Safety Board, 2005. Risk factors associated with weather-related general aviation accidents (Safety Study: NTSB/SS-05/01), Washington: National Transportation Safety Board.

Orasanu, J. M., 2010. Flight Crew Decision-Making. In: Crew Resource Management. s.l.:s.n., pp. 147-179.

Orasanu, J., Martin, L. & Davison, J., 2001. Cognitive and contextual factors in aviation accidents: decision errors. In: E. Salas & G. Klein, eds. Linking Expertise and Naturalistic Decision-Making. New York: Psychology Press.

Ortiz, Y., Blickensderfer, B. & King, J., 2017. Assessement of General Aviation Cognitive Weather Tasks: Recommendations for Autonomous Learning and Training in Aviation Weather. s.l., s.n., pp. 1861-1865.

Reason, J., 1998. Achieving a safe culture: theory and practice. Work & Stress, 12(3), pp. 293-306.

Shuch, P., 1992. The Influence of Flight Experience on Midair Collision Risk Perception. Accident Analysis and Prevention, pp. 655-660.

SKYbrary, 2020. Inadvertent VFR Flight Into IMC. [Online]
Available at: https://www.skybrary.aero/index.php/Inadvertent_VFR_Flight_Into_IMC
[Accessed May 2021].

Wiegmann, D. & Goh, J., 2000. Visual Flight Rules (VFR) Flight into Adverse Weather: An Empirical Investigation of Factors Affecting Pilot Decision Making, Savoy: Aviation Research Lab Institute of Aviation.

Wiggins, M. et al., 2014. Cue-utilisation typologies and pilot's pre-flight adn in-flight weather decision-making. Safety Science, pp. 118-124.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Airlines of Tasmania
• Civil Aviation Safety Authority
• Bureau of Meteorology
• United States National Transportation Safety Board
• United Kingdom Air Accidents Investigation Branch.

Submissions were received from:

• Airlines of Tasmania
• Civil Aviation Safety Authority
• Bureau of Meteorology
• United Kingdom Air Accidents Investigation Branch.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Appendix A – Summary of CASA surveillance activities for Airlines of Tasmania between 2014-2018

Date	Activity	Notes
20-21 February 2014	Level 2 - Operational check (other)	Scope of audit included safety policy, objectives and planning, safety risk management, safety assurance, and safety training and promotion.
7 May 2014	Level 2 - Operational check (manual review)	Review of documents and training in relation to the transition into the new Civil Aviation Order 48.1 duty and flight time limitations for regular public transport and charter.
1 August 2014	Level 2 - Operational check (site inspection)	Reviewing change to runway designation. Recommendation to review the SMS at next available opportunity.
6 August 2014	Level 2 - Operational check (site inspection)	On-site surveillance of the operator’s regular public transport port.
20-23 October 2014	Level 1 - Systems audit	Four safety systems of the safety system were reviewed: safety policy and objectives, safety promotion, safety assurance, and safety risk management.
3 December 2014	Level 2 - Operational check (manual review)	Review of operations manual amendment.
1-2 April 2015	Level 2 - Operational check (other)	Inspections related to the accident involving VH-PFT on 29 December 2014.
2 June 2015	Level 2 - Operational check (site inspection)	Dangerous goods inspection.
30 June-1 July 2015	Level 2 - Operational check (site inspection)	Ground operations inspection.
30 July 2015	Level 2 - Operational check (ramp check)	Aircraft ramp inspection.
30 October 2015	Level 2 - Operational check (site inspection)	Aircraft and dangerous goods inspection.
28 April 2016	Level 2 - Operational check (en route check)	Route check from Cambridge - Wynyard.
13-15 September 2016	Level 1 - Health check	Scope included AOC operations, flight system, crew scheduling, operational standards, safety policy, objectives and planning; safety risk management; safety assurance and safety training and promotion.
1 August 2017	Level 2 - Operational check (en route check)	Surveillance of the Launceston - Cape Barren Island RPT service.
11-13 July 2017	Level 1 - Systems audit	(including CASR Part 42 Continuing Airworthiness Management Organisation and Part 145 Approved Maintenance Organisation). SMS not reviewed due to resource constraints.
11-12 December 2017	Level 2 - Operational check (key personnel interview)	To interview safety manager. Included audit of SMS.
16 October 2018	Level 2 - Operational check	Sector surveillance – aeromedical, transport training and checking organisation.