Engine failure and collision with terrain involving Cessna P210N, N210BA, near Moruya Airport, New South Wales, on 19 December 2019

Precursor events

On the afternoon of 17 December 2019, a Cessna P210N Silver Eagle (P210N) with United States registration N210BA, landed at Bankstown, New South Wales following a flight from Griffith, New South Wales. The aircraft was fully refuelled, without anti-icing additive,^[1] before being stored in a hangar (see the section titled Fuel and anti-icing).

On the morning of 19 December, the pilot prepared the aircraft for flight and checked the fuel quantity and quality (water check). At about 1147 Eastern Daylight‑saving Time,^[2] the aircraft departed Bankstown under the instrument flight rules (IFR)^[3] for a private flight to Cambridge, Tasmania, with the pilot and one passenger on board.

By about 1218, the aircraft was at the planned cruising altitude of flight level (FL) 180.^[4] Shortly after, the pilot noted that rime ice^[5] was accumulating on the leading edge of both wings and the front windscreen. The pilot recalled that the propeller de-ice and all engine (turboprop) ice‑protection systems were activated at the time.

At about 1225, the pilot requested, and received, a clearance from air traffic control (ATC)^[6] to descend to FL 160 due to the ice accumulation. During that descent, the pilot deactivated the propeller de-ice and engine ice-protection systems. Another engine ice-protection system, which functioned automatically when the aircraft was pressurised, continued operating (see the section titled Ice protection). Some 5 minutes later, after reaching FL 160, the pilot recalled that the aircraft was positioned between cloud layers.

Between 1233 and 1238, the pilot made a number of track deviations up to 1.0 NM left and 2.7 NM right of track to avoid entering cloud. At about 1245, the pilot took several photographs, including one which showed ice on the leading edge of the left wing and pitot probe (Figure 1). At that time the aircraft was operating between two cloud layers, relatively close to the upper layer.

Figure 1: Ice accumulation on the left wing and pitot probe

Source: Pilot, annotated by ATSB

Engine failure

At about 1246, approximately 22 km south-south‑east of Moruya Airport, the aircraft’s engine lost all power (Figure 2). The pilot recalled not hearing any grinding, popping, or banging noises from the engine at the time, and that it sounded similar to the engine being shut down normally. About 5 seconds later, the pilot made a right turn towards the coastline and unsuccessfully attempted to restart the engine (see the section titled Unsuccessful engine restarts). Thirty seconds after the engine failure, the pilot called ATC, declared MAYDAY,^[7] and was provided a heading to Moruya Airport. The pilot then tried restarting the engine again, without success.

Figure 2: N210BA flight track

Source: Google Earth, annotated by ATSB

Shortly after, the pilot requested ATC provide the local weather and airport‑related information. The pilot was given the meteorological aerodrome report (METAR),^[8] which indicated an 8 kt south-easterly wind, visibility up to 8,000 m, and scattered^[9] cloud at 2,800 ft above mean sea level (AMSL).^[10] The pilot assessed runway 18^[11] (length 1,523 m) as the most suitable and programmed a radial bearing for the runway into the aircraft’s Garmin GNS 530 GPS ​navigation system. The pilot was also using the synthetic vision feature in the Garmin Pilot application on an iPad to provide a three-dimensional representation of the surrounding terrain and location of the airport runways.

At about 1251, the aircraft arrived south of the airport at 8,000 ft, where the pilot began a clockwise orbit. Shortly after, the pilot broadcast details of the emergency situation and intention to land on runway 18 over the Moruya common traffic advisory frequency (CTAF).^[12] The crew (pilot and observer) of a nearby Robinson R44 helicopter (R44), heard that transmission while conducting aerial shark patrol activities. In response, the R44 pilot advised the P210N pilot that they would notify people on the ground (at the airport) of the emergency (Figure 3 and Table 1), and soon after, notified the chief instructor of a skydiving company at Moruya Airport to organise emergency services. The R44 pilot recalled then flying directly to the airport, intending to be on the ground early to avoid distracting the P210N pilot.

At about 1255, the P210N pilot broadcast being on a ‘…no engine, right base approach to runway one eight’ (Figure 3 and Table 1). Shortly after, the aircraft briefly climbed from 1,400 ft to 1,500 ft while approaching the Moruya River, before turning east and descending to about 1,000 ft (Figure 3). The pilot recalled experiencing windshear and an increased rate of descent at this point, resulting in an assessment that there was insufficient remaining height to conduct a glide approach to runway 18. Consequently, the pilot decided to land on either runway 36 or runway 22.

Figure 3: N210BA flight track in the vicinity of Moruya Airport (see Note)

Note: Labels ‘A’ to ‘F’ are the approximate locations of CTAF radio calls between the pilots of N210BA and the R44. A transcript of these radio calls is included in Table 1. All altitudes are in AMSL.

Source: Google Earth, annotated by ATSB

Table 1: Extracts from relevant radio communications

Label in Figure 2	From	Transcript extract
A (1252)	N210BA	Moruya traffic…November two one zero bravo alpha is a mayday aircraft…circling overhead to land on runway one eight zero bravo alpha
B (1254)	R44	Yeah the aerodrome yeah you do have runway one eight…have you contacted anyone down there do they know what’s happening?
C (1254)	N210BA	…negative we’ve just let Melbourne Centre know what’s happening but that’s it zero bravo alpha
D (1254)	R44	Roger not a problem I’m only about a minute and a half away from landing I might…notify the people on the ground there and let them know your situation
E (1254)	N210BA	OK thanks for that I’m probably about three minutes out zero bravo alpha
F (1255)	N210BA	Zero bravo alpha is on a no engine right base approach to runway one eight…zero bravo

The R44 pilot reported that, at about 1256, they were 1‑2 NM north-east of the airport and saw N210BA heading east over the river. At about the same time, skydive instructors recalled seeing the aircraft with the propeller in feather, the landing gear down, and flap partially extended. The R44 pilot thought landing at the airport would be a distraction to N210BA, so they positioned their aircraft just off the coast, at about 200 ft above the water, abeam the mid-point of runway 18. The skydiving company was holding an event that included two Australian Defence Force (ADF) paramedics. Following notification of the developing emergency, the instructors and ADF paramedics followed the aircraft in vehicles as it descended.

The P210N pilot recalled rejecting both the runway 36 and runway 22 approach options as they wanted to stabilise the aircraft and they could not sight the R44. The pilot reported that at that stage of the approach, they were pre-occupied with sighting the R44 helicopter to avoid a collision.

The aircraft entered the downwind leg for a left circuit to runway 18 at approximately 600 ft and, at about 300 ft, abeam the runway 18 threshold, the aircraft was turned onto a left base. The pilot assessed that the aircraft would not make the runway, or its undershoot, and instructed the passenger to secure their seatbelts. The pilot then tried to reduce the aircraft speed to just above the stall speed to reduce the impact severity, which activated the stall warning system. The pilot reported targeting an airspeed of 44 kt^[13] during the latter stage of the forced landing. At about 1258, the aircraft’s left and right wing clipped a pair of trees, followed by a ground impact about 560 m north of the runway 18 threshold.

Post-accident emergency response

After witnessing the accident, the R44 pilot repositioned the helicopter near the crash site, terminating in a low hover. The observer exited the helicopter and assisted the occupants. The R44 pilot then guided the skydive instructors and ADF paramedics to the accident site from the air before landing nearby.

The skydive instructors and R44 observer attempted to remove the unconscious pilot from the aircraft but they were unable to open the main entry door. One of the ADF paramedics assisted the injured passenger who had exited through the broken front windscreen. As fuel was leaking from the aircraft, the chief skydive instructor reached through the windscreen and switched off some of the electrical systems.

The R44 pilot and two additional paramedics from the Westpac Lifesaver Rescue Helicopter Service (based at Moruya Airport) travelled by car to the accident site. After finding a tyre lever, the aircraft’s emergency exit door was pried open, and the pilot was removed onto a stretcher. Following additional treatment, the pilot and passenger were airlifted to Canberra Hospital. The pilot suffered serious injuries while the passenger received minor injuries.

__________

1. A fuel system anti-icing additive prevents the formation of ice in fuel lines which can block the flow of fuel to the engine.
2. Eastern Daylight saving Time (EDT): Coordinated Universal Time (UTC) +11 hours.
3. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR). Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
4. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 180 equates to 18,000 ft.
5. Rime ice is rough, milky, and opaque. It is formed by the instantaneous or very rapid freezing of supercooled water droplets as they strike the aircraft. The rapid freezing results in the formation of air pockets in the ice, giving it an opaque appearance, and making it porous and brittle.
6. Melbourne Centre frequency.
7. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
8. Meteorological aerodrome report (METAR): a routine aerodrome weather report issued at routine times, hourly or half-hourly.
9. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘few’ indicates that up to a quarter of the sky is covered, ‘scattered’ indicates that cloud is covering between a quarter and a half of the sky, ‘broken’ indicates that more than half to almost all the sky is covered, and ‘overcast’ indicates that all the sky is covered.
10. Above mean sea level (AMSL): all altitudes refer to AMSL unless otherwise stated. Moruya Airport has an elevation of 17 ft AMSL.
11. The number represents the magnetic heading of the runway.
12. Common Traffic Advisory Frequency (CTAF): A designated frequency on which pilots make positional broadcasts when operating in the vicinity of a non-controlled aerodrome or within a Broadcast Area.
13. All speeds are in knots indicated airspeed (KIAS) unless otherwise stated.

Pilot information

The pilot held a Private Pilot Licence (Aeroplane) issued by the Civil Aviation Safety Authority (CASA) in 1997. The pilot also held a single-engine aeroplane class rating and a manual propeller pitch control design feature endorsement. The pilot’s last flight review, conducted in May 2019, was valid at the time of the accident.

In October 2019, the pilot obtained a United States (US) Federal Aviation Administration (FAA) Private Pilot Licence for a single-engine airplane in recognition of the pilot’s previously issued CASA licence. The FAA licence included an instrument rating achieved in the US. At that time, the pilot also completed a flight review in the US, and received endorsements to operate a ‘complex’, and ‘high-performance’^[14] aircraft, such as the P210N.

Type-specific experience and training

The pilot had a total of 430 flight hours, of which 162 were in a P210N. In the 90 days before the accident, the pilot had flown about 74 hours, of which 45 were in a P210N.

In 2019, the pilot completed a non-mandatory training course for the P210N at Propjet 210 Aviation^[15] (PropJet) in the US. The course was intended to help pilots transitioning from piston to gas turbine powered P210N aircraft. The training syllabus covered many topics, including:

• slow flight
• stalls
• ice protection and inadvertent icing encounters
• use of fuel system icing inhibitor
• managing engine failures, including restart procedures
• simulated forced landing techniques
• owner responsibility for required maintenance.

The pilot completed engine-out training in a P210N (non-turbine) in May 2019 and, later that year, additional engine-out training for an instrument rating.

Medical information and fatigue

The pilot held a Class 2 aviation medical certificate issued by CASA with no restrictions, which was valid until February 2021.

The pilot was unconscious immediately following the collision but, after neurological examinations, cleared of any impairments two weeks post-accident. The ATSB collected information about the pilot’s 72 hours of activity prior to the accident. A review of that evidence identified that it was unlikely that the pilot was experiencing a level of fatigue known to affect performance.

Aircraft information

The Cessna P210N is a six seat, pressurised aircraft with retractable tricycle landing gear. The aircraft (N210BA) was manufactured in 1979 and was originally fitted with a piston engine. In 1997, the aircraft underwent supplemental type certificate (STC) modifications^[16] that included the fitment of a Rolls-Royce Model 250-B17F/2 turboprop engine^[17] and Hartzell propeller. Cessna 210 aircraft modified in this manner were branded ‘Silver Eagle’.

Fuel system

General description

The fuel system consists of:

• two inner wing tanks
• two wing tip tanks
• an auxiliary transfer tank in the baggage compartment
• two fuel reservoir (header) tanks.

The inner wing tanks gravity feed the header tanks, where the fuel then passes through a fuel selector valve, two electric boost pumps (one a backup), a fuel filter with bypass valve, an engine driven pump, and then into the engine fuel nozzle. The fuel selector valve allows fuel to be delivered to the engine from either the left or right header tank, or from both header tanks simultaneously. The auxiliary and wing tip tanks only resupply the wing tanks. The aircraft Pilot’s Operating Handbook and FAA‑Approved Airplane Flight Manual Supplement (flight manual) identified Jet A1 as the primary fuel.

The engine cockpit instrumentation included a fuel pressure gauge and a fuel flow indicator. The cockpit annunciator panel provided visual indications for the fuel related systems. There were red warning lights for:

• fuel bypass warning (fuel filter blocked to the point where it was being bypassed)
• fuel pressure warning (fuel pressure reduced to below 5 pound per square inch (psi))
• low fuel quantity (either main wing tank was 7 US gallons or less).

The pilot reported that before, and at the time of the engine power loss, there were no annunciator panel warnings illuminated, and there were indications of adequate fuel pressure.

Fuel and anti-icing

Water can exist within aviation turbine fuel in three different forms: dissolved, entrained, or free water. Due to the affinity of turbine fuel to water, some dissolved water will always exist within the fuel but is not considered a contaminant if it remains dissolved. Entrained water can be caused by agitation of the fuel as it passes through system components during refuelling or flight, and from the separation of dissolved water if the fuel temperature cools sufficiently. Free water can be introduced during refuelling, condensation from moist air entering the tanks through the vent system (either on the ground or during flight), or the settling of entrained water. Entrained and free water cooled below the freezing point of water can form ice within the fuel system.

Anti‑icing additive, when used in the correct concentration, can prevent formation of fuel system ice from any entrained or free water at fuel temperatures as low as about ‑40 °C. The additive works by lowering the freezing point of water. The aircraft’s flight manual limitations section contained the following instruction about fuel additive use:

For flight at ambient temperatures of 40° [F] (4° C) and below, the fuel used in this aircraft MUST have an anti-icing additive in compliance with MIL-I-27686D or E or Phillips PF A55MB, incorporated or added into the fuel during refuelling in accordance with the additive manufacturer’s instructions.

The pilot reported that they interpreted the temperature stated in this instruction as being the ambient temperature at the refuelling point (that is, on the ground). Otherwise, the pilot pointed out, additive would be used all the time as ambient temperatures at the usual high operating altitudes were normally below 4 °C. The pilot also stated never having used additive or encountering any issues when operating at low temperatures, and believed fuel system icing was an issue only in temperatures below ‑35 °C.

The forecast ambient temperature at the pilot’s planned cruise altitude was between -9 and -11 °C (see the section titled Area forecasts). The pilot did not request anti-icing additive, which was available at Bankstown Airport when the aircraft was refuelled, and the fuel already in the aircraft also did not contain anti-icing additive.

Fuel documentation showed that the aircraft was refuelled with about 88 gallons of Jet A1 on 17 December 2019. The pilot stated that before departure on 19 December, the auxiliary tank, wing tanks, and tip tanks were dipped and found to be essentially full, with no water present.^[18] The pilot estimated that the aircraft had used approximately 30 gallons of fuel before the engine power loss.

A strong smell of aviation turbine fuel was present at the accident site. Additionally, the fuel filter in the engine bay was full of fuel (about 1 litre) with no water detected in a sample tested using a fuel water detector syringe. The pilot also advised that PropJet’s examination of the fuel filter found no signs of discolouration, which PropJet stated was usually associated with water contamination.

Training

The pilot attributed their understanding of anti-icing additive usage to information they received during the 2019 PropJet training course, adding that other P210N pilots had the same interpretation. The pilot stated that PropJet training flights were conducted between FL 150 to FL 200 without anti-icing additive and recalled an ambient air temperature below -4 °C on one occasion. The pilot also noted that additive was available at the refuellers where those flights were undertaken.

The ATSB requested the PropJet training course material to review its content, but was advised by PropJet that, as the course was delivered face-to-face and verbally one-on-one, there was no documented training material. However, the topics covered were available, and included the use of anti-icing additive. PropJet also advised that the course was delivered using information in the aircraft’s flight manual and was consistent with the engine manufacturer’s (Rolls-Royce) recommendations. Due to the verbal training delivery, it was not possible to review the specific content relating to the usage of anti‑icing additive. More importantly, the information provided to pilots undertaking that training was not available for their later reference.

Recorded data

The aircraft was fitted with a transponder that broadcast ADS-B^[19] data every 5–10 seconds. This data was available up until about 9 seconds before the collision with terrain. During the flight, the pilot used the US-based software program ForeFlight,^[20] which provided GPS position and altitude up to about 5 seconds before the impact. The GPS ground speed was generally consistent with the ADS-B ground speed. The last reliable ground speed was recorded about 14 seconds before the impact, which indicated an approximate ground speed of 78 kt on a 290° track.

In the 5 minutes leading up to the engine power loss, the following ADS-B parameters and range of values were recorded:

• altitude – 16,001‑16,100 ft
• ground speed – 164‑170 kt
• track – 187‑198°.

Engine information

The Rolls-Royce Model 250-B17F/2 (M250-B17F/2) engine is a M250 series turboprop variant with a four-stage axial compressor and centrifugal impeller, driven by a two-stage gas producer turbine. The engine has a reverse flow annular combustor and two-stage power turbine that provides the drive for the reduction gearbox and propeller shaft. The propeller gearbox and power turbine are not mechanically coupled to the gas producer turbine and compressor.

Ice protection

The aircraft’s flight manual prohibited flight into known icing conditions (see the section titled Icing conditions). The aircraft was not fitted with any airframe anti-ice or de-ice protection systems. However, the aircraft was fitted with ice-protection systems in case of an unexpected icing encounter. These consisted of heating for the pitot probe and the windshield, while the propeller blades had electrically heated elements that provided de-ice protection by cycling every 20 seconds. In addition, the engine had the following ice-protection systems (Figure 4 and Figure 5):

• Engine inlet^[21] – mounted to the compressor front support (compressor inlet) with compressor bleed air providing anti-ice protection. A cockpit gauge provided the heated air temperature.
• Compressor inlet – the compressor inlet consists of an outer skin, hollow radial struts, and a hub (bullet nose). Compressor bleed air provides anti-ice protection.
• Continuous engine ignition – the igniter sparks continuously to relight the fuel-air mixture in the event combustion is extinguished due to a momentary change in the fuel-air ratio.

Figure 4: Side view of an exemplar P210N propeller and engine inlet

Aircraft engine, propeller, and engine inlet shown are similar to N210BA.

Source: Mattia De Bon, annotated by ATSB

Figure 5: Front view of N210BA engine inlet and compressor inlet (post-accident)

Source: Rolls-Royce

The STC holder advised that the cockpit switch labelled ‘inlet heat’ activated all three ice protection systems. Although, when the aircraft cabin was pressurised, the engine inlet ice‑protection automatically operated irrespective of the switch position. However, the compressor inlet ice‑protection and continuous ignition required manual activation by using the inlet heat switch. Continuous engine ignition could also be manually activated using another, separate cockpit switch.

When interviewed after the accident, the pilot’s description of the ice-protection systems did not include the compressor inlet ice-protection system. While this indicated a gap in knowledge, the pilot noted that, although the engine inlet fitted operated automatically when the aircraft was pressurised, out of habit they turned the inlet heat switch on in icing conditions (which in turn activated the compressor inlet ice-protection system).

Inadvertent icing encounter checklist

If icing conditions were encountered, the Inadvertent icing encounter emergency checklist in the aircraft’s flight manual instructed the pilot to ensure all the ice-protection equipment was activated and to exit the icing conditions as soon as possible. The introductory note in the checklist stated:

The engine inlet anti-ice lip [engine inlet] and engine anti-ice [compressor inlet], propeller de-ice, and continuous ignition must be activated for flight or ground operation in visible moisture at an OAT [outside air temperature] of 41° F (5° C) and below or while operating in falling or blowing snow regardless of ambient temperature. These systems must be operated in the above-mentioned conditions even if there is no visible sign or airframe ice and/or snow accumulation.

Deactivation of the system shall not be made until the above-mentioned conditions have been left and all accumulated airframe ice and/or snow has dissipated.

The pilot advised that they were not aware of this checklist but stated that ‘…if you get into inadvertent icing, get out of it’, indicating an awareness of the associated risk. The pilot recalled that the engine ice-protection systems were on during the icing encounter at FL 180 but turned them off during the descent to FL 160 since the aircraft was no longer in visible moisture and not accruing any more ice.

The pilot reported that the decision to descend was mainly based on the passenger’s concern about the observed ice build-up. They further advised being familiar with the performance of the P210N airframe with ice accumulation from previous icing encounters that had not caused any operational problems. The pilot also stated that some of those encounters involved more severe icing than this occurrence, and that other P210N owners/pilots had reported that the aircraft could carry a substantial amount of ice without any problem.

Recorded data

The pilot reported that, since acquiring the aircraft in 2019, the engine had not presented any abnormal indications. Photos captured by the pilot^[22] about 30 seconds before the engine power loss showed some of the engine instrumentation in the cockpit. The position of cockpit controls and instrument readings were obtained from those photographs (Table 2 and Table 3). Where relevant, engine operating limitations for maximum continuous operation have been included.

Table 2: Engine instruments 

Instrument	Reading[1]	Maximum continuous limitation
Turbine outlet temperature (°C)	~750	752
Engine Gas Generator (% RPM)	~98[1]	105[3]
Propeller (RPM)	~2,050[2]	2,030
Engine Oil Pressure (psi)	~130	130
Fuel Pressure (psi)	~20[3]	25
Fuel Flow (gallons per hour)	25.8	STC holder specifications indicates 20 gallons per hour at 23,000 ft
Engine Inlet air temperature (° C)	109	Not applicable
[1]  The symbol (~) indicates the value is approximate and taken from an analogue display. All analogue readings were obtained from gauges that were positioned at an angle in the photograph and are therefore subject to some degree of reading error. [2]  These readings were obtained from gauges that were at a greater angle in the photograph, and the end of the pointers could not be seen on the gauge face. There was also sun glare on the fuel pressure gauge that obscured a more accurate reading. These values were subject to a greater degree of reading error. Therefore, the propeller RPM reading was likely not more than the maximum continuous limitation. [3]  The aircraft’s flight manual stated that 94 % gas generator RPM was the maximum continuous value. However, the P210N STC holder (Griggs Aircraft Refinishing) advised that the engine gas generator RPM could operate at a maximum continuous value of 105 %. The engine gas generator RPM could not exceed 94 % when both the torque and turbine outlet temperature were at their maximum continuous values (92 psi and 752 °C respectively).

Table 3: Cockpit control and instrument information

Cockpit control / instrument	Reading
Continuous ignition switch	OFF
Inlet heat switch	OFF
Outside air temperature (°C)	-4
Altitude (ft)	16,030[1]
Attitude indicator	Approximately wings level bank and zero degree pitch
[1]  This value is approximate and taken from a non-precise digital display.

Post‑accident engine examination

Following an initial assessment at the accident site, the engine was relocated to the ATSB’s technical analysis facilities in Canberra for further inspection, which identified the following:

• A small amount of residual fuel in the fuel nozzle with no blockages.
• The igniter condition appeared normal.
• All three magnetic chip detectors and oil filter had no visible chips, shards, or specks of metal, and both the filter and oil were clean.

The engine was subsequently transported to Asia Pacific Aerospace, a Rolls‑Royce authorised maintenance repair and overhaul centre, where the Rolls-Royce supervised examination found:

• continuity and functionality of control linkages
• fuel system and engine anti-ice components were serviceable
• continuity of gas producer rotor and power turbine rotor
• light rub contact on one third of the compressor shroud face
• soft body impact damage on some of the stage two, three and four compressor blades, but primarily on the fourth stage (Figure 6)^[23]
• significant cracking on the first stage gas producer turbine nozzle shield (P/N 23062750), but no indications that pieces of the shield had liberated (Figure 7)
• a crack on the trailing edge of the inner band face of the first stage turbine nozzle
• light rub contact over a short section of the first stage gas producer turbine blade track located within the second stage turbine nozzle (Figure 8).

Figure 6: Fourth stage compressor blade damage

Source: ATSB

Figure 7: First stage gas producer turbine nozzle shield cracking

Source: ATSB

Figure 8: Rub contact on first stage gas producer turbine blade track

Additional blade rub on the turbine blade track was evident but not shown in this photo.

Source: ATSB

Rolls-Royce stated that there was insufficient evidence to determine the source of the observed compressor blade damage. With respect to the first stage nozzle crack, Rolls-Royce noted that cracks in this area were typical of in-service experience and were unlikely to grow to critical length between maintenance inspections. Rolls-Royce concluded that there were no pre-existing conditions that should have prevented normal engine operation.

First stage turbine nozzle shield inspections

Due to in‑service cracking of first stage turbine nozzle shields in M250 series engines, Rolls-Royce had issued commercial engine bulletins (CEB) in March 2000 recommending initial and recurring inspections of affected turbine nozzle shields for cracking. Recurring inspections were not needed if the nozzle shields were replaced with unaffected shields. For M250-B17F series engines, CEB A‑72-2069 was applicable and outlined that partial, or complete separation of the nozzle shield due to cracking, could result in heat distress and coking of the gas producer turbine bearing, and an oil fire.

The bulletin recommended the following inspections of the nozzle shield P/N 23062750:

• initial inspection – inspect at 1,000 cycles. If the cycles are unknown, or the nozzle has more than 1,000 cycles, inspect within 100 cycles
• recurring inspection – inspect every 1,000 cycles of operation.

A 2015 engine test report indicated that the aircraft’s M250-B17F/2 engine had accumulated 1,386 cycles (since new). Review of the engine maintenance history did not identify any entries relating to completion of CEB A-72-2069 or maintenance on the nozzle shield.

Engine power loss

A review of the captured engine parameters (Table 2) by the ATSB and Rolls-Royce did not identify any operational abnormalities, while the engine examination found no mechanical issues. Further, the pilot described the engine power loss as similar to the engine being shut down normally. On that basis, the ATSB concluded that the engine probably experienced a flameout. The aircraft’s flight manual defined a flameout as an ‘unintentional loss of combustion chamber flame during operation’. As a flameout can occur for various reasons, several potential causes were investigated.

Fuel exhaustion or starvation

Evidence at the accident site indicated there was sufficient fuel on-board the aircraft with fuel continuity evident up to the engine fuel nozzle, and no blockages due to fuel contamination. There was no water detected in fuel from the fuel filter, which indicated there was no potential for hazardous ice formation in the fuel system. Additionally, the pilot reported that there were indications of adequate fuel pressure prior to, and just after the flameout. Further, during the engine examination, the relevant fuel system components were tested and shown to be functioning. All of this evidence supported a conclusion that fuel exhaustion or fuel starvation was not a likely cause.

Compressor stall

A compressor stall occurs when there is a breakdown in airflow through the compressor. This can lead to flow reversal, banging sounds, and flame expulsion. The pilot reported not hearing any popping or banging sounds from the engine at the time of the flameout. Additionally, the recorded engine parameters and manufacturer’s post‑accident examination of the engine did not identify anything that would support a compressor stall event.

Incorrect fuel‑air mixture

If the rich or lean limit of the fuel-air ratio is exceeded in a gas turbine engine’s combustion chamber, the flame will extinguish.^[24] At the time of the flameout, there were no significant changes in the aircraft’s course, speed, or altitude based on flight track data that would have required a change in the engine speed or power level. While there was bushfire activity in the general area along the aircraft’s flight path, photographs taken by the pilot about 30 seconds before the flameout did not indicate that the aircraft was flying in bushfire smoke‑contaminated or polluted air, while the fuel flow and fuel pressure indications appeared normal. Therefore, the evidence did not support a flameout resulting from a rich or lean fuel mixture. Additionally, there was no evidence of any engine fuel‑metering component defects.

Significant weather

At the time of the flameout, the aircraft was not operating in rain or reported turbulence. As such, engine water ingestion or turbulence disrupting airflow into the engine were both ruled out. However, as previously detailed, there was a significant build-up of airframe ice preceding the engine power loss. Consequently, the ATSB considered the likelihood that icing may have affected the operation of the engine.

Intake icing

The M250-B17F/2 engine is certified to operate in icing conditions prescribed by the Federal Aviation Regulations^[25] when all the engine ice-protection systems are activated.^[26] Rolls-Royce stated that if the compressor inlet ice-protection system was deactivated during an icing encounter, ice would begin to accumulate. Depending on the amount of ice build-up, the airflow would be reduced to the engine, degrading performance, and causing a rise in the gas producer turbine temperature – measured as turbine outlet temperature (TOT). Significant ice build‑up at the compressor inlet could affect the airflow sufficiently to cause a flameout.

The pilot reported deactivating the compressor inlet ice-protection system during the descent to FL 160 (supported by the photographs). Therefore, it is possible that sufficient ice accumulated on the compressor inlet to flameout the engine during the descent and subsequent level flight at FL 160. However, the pilot also advised that there were no changes in TOT from the cruise phase at FL 180 until the flameout. Based on that account, and the advice provided by Rolls‑Royce, any ice present on the inlet was of insufficient quantity to produce a noticeable rise in TOT. Additionally, the adjacent engine inlet ice-protection system was operating up to the point of the engine power loss, possibly reducing the potential for ice accumulation in the vicinity of the compressor inlet.

Certification of the M250-B17F/2 engine utilised some of the ice certification test results of another M250 series engine variant with the same compressor design. These tests did not assess the effectiveness of the engine inlet anti‑ice system as that was an airframe‑specific component. One of the certification tests was conducted in icing conditions using a 60‑second delay before turning the electrically heated compressor inlet ice-protection system on. The test was undertaken in a ‑20 °C icing environment, reduced power setting, and with the continuous ignition off. That test found that there was a large build-up of ice on the compressor inlet that subsequently detached and was ingested when the compressor inlet ice-protection was turned on. The ingestion caused a flameout and bending of a first stage compressor blade.

Based on the results of the test, it was considered unlikely that any ice build‑up on the compressor inlet following deselection of the ‘inlet heat’ switch would have been sufficient to cause a flameout unless it detached and entered the engine.

Ice ingestion

The engine’s certification did not include specific requirements for tolerance to foreign object ingestion, such as ice and water. However, tests conducted by Rolls-Royce identified that a minimum of 30 mL of water, ingested within 0.25 seconds, was sufficient to cause a flameout. Based on that result, Rolls-Royce estimated that at least 30 mL of ice could similarly cause a flameout. A related Rolls-Royce study in 1968 confirmed that 30 grams of snow or slush ingested into M250 series engines could result in a flameout.

Roll-Royce records indicated 10 flameout events due to ice or snow ingestion in M250 series engines since 1996 (helicopter applications). Engine damage caused by ice ingestion was usually in the form of soft body damage (for example, aerofoil bending) on the first stage compressor blades, but if the ingestion was not hard (for example, snow) there may not be visible damage.

Rolls-Royce issued Revision 3 of a commercial service letter in October 2005 that warned owners, operators, and pilots of aircraft with M250 series engines that snow or ice ingestion can cause an engine flameout. The letter reminded customers that the aircraft’s flight manual should be referred to for the operation of ice protection systems.

Unsuccessful engine restarts

Rotor lock

The engine restart emergency procedure in the aircraft’s flight manual contained the following warning:

Due to thermal changes within the turbine, the gas producer section of the engine may lock up after an inflight shutdown. This is a temporary condition which may exist after the engine has been shutdown for approximately one minute and which may continue for up to ten minutes following shutdown. Therefore, if at all possible, air starts should not be attempted during the time period between one minute after shutdown and ten minutes after shutdown.

Rolls-Royce stated that M250 series engines have tight clearances between the first and second stage gas producer turbine wheel blades and their respective blade tracks on the second stage nozzle. These components expand and contract at different rates due to thermal changes during engine operation. After a flameout, the outer rim of the second stage nozzle, which contains the blade tracks, can cool more quickly than the turbine blades. This differential cooling can result in contact between the blades and blade track, temporarily preventing gas producer rotation (compressor and turbine). Once the turbine blades cool sufficiently, and the clearances return, gas producer rotation is restored. This thermally‑induced condition is commonly referred to as ‘rotor lock’ or ‘core lock’.

An engine’s susceptibility to rotor lock, including the amount of time taken before the gas producer section locks, and the duration of its locked state, is dependent on many variables. These variables include outside air temperature, altitude, blade tip clearances, second stage nozzle roundness, and engine health. Rolls-Royce indicated that M250 turboprop engines (used in aeroplanes) are more susceptible to rotor lock than M250 turboshaft engine variants (used in helicopters). This is because turboprop aircraft typically operate at a higher altitude with lower ambient air temperature, and higher speeds, for longer periods of time. These operational conditions produce a rapid cooling effect of the turbine case structure in the event of a flameout, increasing the chance of rotor lock compared to the turboshaft variants.

Rolls-Royce stated that a substantial amount of turbine blade rub along the first or second stage gas producer turbine blade track was usually indicative of rotor lock. Rolls-Royce could not confirm whether or not the blade rub found during the engine examination (Figure 8) was due to rotor lock, but advised expecting to have found more turbine blades rub on the blade track if rotor lock had occurred. Rolls-Royce also pointed out that the starter/generator circuit breaker should activate if a restart was attempted while the engine was in the rotor lock condition.

Restart attempts

The starter/generator is used for engine starting and to provide power to the aircraft’s electrical systems while the engine is operating. The starter/generator is linked by gearing to the shaft that couples the compressor and gas producer turbine. Visual examination of the starter/generator showed no signs of overheating or arcing, and all the terminals were correctly installed. The starter’s drive shaft was intact and rotated freely by hand.

The pilot reported being familiar with the rotor lock warning in the flight manual, specifically the need to perform a quick restart, and had practiced the restart procedure before the accident flight to commit it to memory. The pilot stated that the first restart attempt was within 20 seconds of the flameout and followed the memorised procedure but was not seeing any indication of the expected gas generator rotation. The pilot then reviewed the ForeFlight engine restart checklist and confirmed that the correct procedure was completed.

The pilot stated that the ForeFlight restart checklist was used for the second unsuccessful restart attempt. There had been no problems with the starter/generator or electrical systems during the flight and the starter/generator circuit breaker did not activate during the restart attempts. The pilot recalled an increase in amperes on the aircraft’s cockpit ammeter while the starter button was being pressed but did not hear the engine’s turbine spinning up or see any percentage increase on the gas generator rpm gauge.

Meteorological information

Area forecasts

Bureau of Meteorology

A significant weather (SIGWX) chart is a routine forecast, covering FL 100–250 and FL 250­–630, that provides information on certain weather phenomena, including moderate (see the section below titled Icing conditions) and severe icing.^[27] A SIGMET^[28] is a non-routine weather advisory covering all altitudes that, in relation to icing conditions, only covers advisories on severe icing. An AIRMET^[29] is also a weather advisory on conditions not already included in the Graphical Area Forecast, and includes forecasts for moderate icing up to 10,000 ft.

There was no AIRMET or relevant SIGMET applicable to the planned flight but a SIGWX chart covering FL 100–FL 250 was available (Figure 9). This chart included weather associated with a transiting cold front moving east to north-east at about 45 kt that included broken altostratus and altocumulus clouds with moderate icing from below 10,000 ft to FL 190, and isolated embedded cumulonimbus from below 10,000 ft to above FL 250.

Figure 9: BoM forecast significant weather chart applicable to the planned flight

The orange highlighted area shows the transiting cold front that was not included on the ForeFlight FL 250–FL 630 SIGWX chart. The top half of original chart is not shown.

Source: Bureau of Meteorology, annotated by ATSB

ForeFlight

At 0914 on 19 December, the pilot used ForeFlight to file the flight plan. ForeFlight generated a graphical weather report for the route, including a vertical cross section chart and SIGWX chart. A section titled ‘SIGMETs/AIRMETs’ was also presented and included a single SIGMET for severe turbulence from FL 210–FL 400. The vertical cross section chart showed the planned flight path, which indicated that during cruise the aircraft would pass through forecast areas of light and moderate icing, with ambient air temperatures between -9 °C and -11 °C (Figure 10).

Figure 10: ForeFlight vertical cross section chart for planned flight

Source: Pilot

The SIGWX chart covered FL 250 to 630 (Figure 11). The pilot incorrectly interpreted the chart as showing no significant weather at the planned flight level (FL 180), and expressed an understanding that the chart was a graphical representation of SIGMETs.

Figure 11: ForeFlight significant weather chart for planned flight

Source: Pilot

At the time of the accident, ForeFlight software capabilities were mainly dependent on the user’s geographical region. In the region covering Australia, AIRMETs, and SIGWX charts covering FL 100–FL 250 were not supported. The geographical weather limitations were detailed in an article on the ForeFlight website but there was no indication of those limitations within the software’s graphical weather report.

The pilot assumed all relevant weather information was being provided in the same way as it had been when using the software in the United States and Europe.

In Australia, CASA approves organisations as data service providers (for example, those that offer electronic flight bag software). Approved data service providers are authorised to publish aeronautical data such as weather and charts, which pilots can use as an alternative to data published by Airservices Australia. At the time of the accident, the four approved data service providers for Australian airspace were Jeppesen, Avsoft Australia, OzRunways, and Garmin International. The use of unapproved electronic flight bag software in Australia, such as ForeFlight, increases the risk of missing important weather information.

Icing conditions

Icing severity is generally classified as trace, light, moderate, or severe. The Bureau of Meteorology (BoM) provided the following general advice on moderate icing severity:

…the rate of accumulation is such that even short encounters become potentially hazardous and use of de-icing/anti-icing equipment or diversion is necessary.

The FAA provided the following interpretation of ‘known’ icing conditions.^[30]

…“Known icing conditions” involve…circumstances where a reasonable pilot would expect a substantial likelihood of ice formation on the aircraft based upon all information available to that pilot.

Pilots should also carefully evaluate all of the available meteorological information relevant to a proposed flight including applicable surface observations, temperatures aloft, terminal and area forecasts, AIRMETs, SIGMETs, and pilot reports (PIREPs). As new technology becomes available, pilots should incorporate the use of that technology into their decision-making process. If the composite information indicates to a reasonable and prudent pilot that he or she will be operating the aircraft under conditions that will cause ice to adhere to the aircraft along the proposed route and altitude of flight, then known icing conditions likely exist.

The United States National Transportation Safety Board (NTSB) position on the subject was similar, stating that ‘…known icing conditions exist when a pilot knows or reasonably should know about weather reports in which icing conditions are reported or forecast.’

While the aircraft’s flight manual stated that flight into known icing conditions was prohibited, the pilot interpreted this as applying only when an AIRMET or SIGMET for icing was issued.

Additionally, the pilot stated that the forecast icing was ‘…more of a heads up than anything else’ and that ‘…you adjust accordingly as per the conditions when you’re there’, indicating an interpretation of just needing to be aware of potential icing when in cloud at a particular flight level. The pilot also interpreted the likelihood of encountering the forecast icing conditions as more probable than not but expected that an AIRMET or SIGMET for icing would be issued if those conditions were highly probable. The pilot reported having used the Windy^[31] program to view cloud top information before the flight, recalling that the cloud tops were at FL 140, and hence expected to be above clouds at the planned cruise altitude of FL 180.

Moruya Airport weather

The forecast winds at various altitudes in the Moruya Airport area at the time of the accident were:

• 35 kt from 260° at 7,000 ft
• 24 kt from 270° at 5,000 ft
• 12 kt from 150° at 2,000 ft
• 7 kt from 150° at 1,000 ft.

Additionally, the following automated surface observation for Moruya Airport was available from the routine aerodrome weather report issued shortly after the accident:

• 1300 – winds 140° at 7 kt with greater than 10 km visibility and nil cloud detected.

The pilot of the R44 helicopter stated that there was a ‘…light southerly [wind] blowing but nothing really’ with a considerable amount of haze in the area (based on the helicopter’s flight to Moruya at about 500 ft).

The P210N pilot stated that the wind between 3,000–9,000 ft was more benign than that below 3,000 ft. The pilot also reported experiencing a significant increase in tailwind as well as ‘…getting a lot of sink’ approaching Moruya River between 2,000 ft and 1,500 ft, and strong gusts at lower levels.

Due to the presence of bushfire smoke haze, the pilot recalled not being able to see the airport clearly at 9,000 ft, even when only about 2 NM away. They also reported difficulty seeing the end of runway 18 on the downwind leg late in the glide approach.

Accident site and wreckage information

The pilot reported that there were no control issues with the aircraft during the flight and that it was controllable until ground impact. No pre-existing faults with the aircraft were identified during the wreckage examination.

Impact sequence

Examination of the accident site indicated that the left and right wing each clipped a tree immediately before the aircraft impacted the ground in a left-wing low attitude about 560 m north of the runway 18 threshold (Figure 12). The wreckage trail was about 30 m long and orientated 212°. Based on the tree and ground impact marks, the aircraft struck the trees at a left bank angle of about 16° with a subsequent descent angle of approximately 14°.

The left wing struck the ground first followed by a single, feathered propeller blade, and subsequent heavy impact on the left engine exhaust and lower engine cowling. The aircraft then yawed left through 180° before impacting several trees, causing the tail assembly to separate. The aircraft came to rest facing the opposite direction to its flight path.

Examination of the wreckage indicated that the aircraft entered the vegetation with approximately 10° of flaps and the landing gear extended.

Figure 12: N210BA main ground impact mark and wreckage

Source: ATSB

Occupant restraints

Both front seats were fitted with a lap belt and single shoulder harness that provided a three-point restraint system. The pilot briefed the passenger on emergency procedures before impact, including fastening the seatbelt. Accounts from the passenger and a first responder confirmed that both occupants had fastened their seat belts and shoulder harnesses before impact.

Emergency egress

The aircraft’s main entry door was at the front on the pilot’s side (left side of aircraft) and included several pin-type lock devices spaced around the edges. An emergency exit door was located on the front passenger’s side (right side of aircraft) and could only be opened and closed from inside the aircraft. The aircraft’s emergency landing without power checklist included the check: ‘Door ‑ UNLATCH PRIOR TO TOUCHDOWN’.

First responders found the main entry door in the latched and locked position after the accident with all pressurisation lock pins still engaged in the airframe and no evidence of failure of the door latching and locking mechanism. The pilot stated that they intentionally did not open the main entry door before impact in order to ‘retain cabin strength’ during the ground contact. However, they advised asking the passenger to open the emergency exit door before impact, but there was no time to do so.

The pilot also advised that they did not complete the emergency landing without power checklist before the impact, but indicated following the ‘C-GUMPS’ checklist^[32] while on the downwind leg for runway 18.

Operational information

Checklists

While the aircraft’s flight manual was stored in the aircraft, the pilot used a set of electronic checklists within the ForeFlight program on the accident flight, which were read out electronically through the headset using a feature called ‘Checklist Speak’. The ForeFlight program contained pre-built checklist templates for various aircraft based on their flight manuals. However, it also allowed users to edit these templates or create their own checklists. At the time of the accident, ForeFlight did not include a pre-built template for a P210N aircraft. The pilot used checklists that were obtained from another P210N owner, and had not made any changes to the emergency procedures within those checklists.

As part of the investigation, the ATSB compared three emergency procedures from the ForeFlight electronic checklists with their equivalent in the aircraft’s flight manual. Of these, the engine restart checklist was the only emergency checklist used by the pilot during the accident flight. Some of the inconsistencies found in the electronic checklists are listed below.

• Engine failure during flight
  • items from the Engine failure during flight and Engine restart procedures checklists in the flight manual were combined into a single checklist
  • the rotor lock warning in the flight manual was omitted (see the section titled Rotor lock)
  • checklist item ‘Fuel Pumps ‑ OFF’ in the flight manual was omitted
  • order of items in the flight manual were different
  • additional items absent from the flight manual were included
• Emergency landing without engine power
  • checklist item ‘Seats, Seat Belts, Shoulder Harnesses ‑ SECURE’ in the flight manual was omitted
  • checklist item ‘Fuel Pumps ‑ OFF’ in the flight manual was omitted
  • checklist item ‘Mixture ‑ IDLE CUT-OFF’ not applicable to the engine type was included.
• Inadvertent icing encounter
  • introductory note regarding activation and deactivation of engine ice-protection systems in the flight manual was omitted (see the section titled Inadvertent icing encounter)
  • Two other notes in the flight manual were omitted.

A review of the Engine failure during flight electronic checklist by Rolls-Royce concluded that following the checklist would not prevent a successful restart. A review of the ‘Checklist Speak’ feature by the ATSB found that only the checklist item was read out to the user. Any additional text attached to the item including notes, warnings, and cautions, were not read out. As such, there was the potential to miss important checklist information (although it was not contributory to this accident).

The FAA issued a safety alert for operators (SAFO) in 2017 to warn pilot’s and operators about the risks of using commercial off-the-shelf (COTS) checklists, or developing their own checklists, instead of using those in the aircraft’s flight manual. The SAFO was released after an investigation into an accident where a pilot landed with partially extended landing gear. The pilot used a COTS checklist that did not match the aircraft’s flight manual with respect to landing gear failure and manual gear extension, which significantly contributed to the pilot’s inability to fully extend the landing gear.

The SAFO recommended that pilot’s and operators that choose to use COTS checklists, or develop their own, should thoroughly compare these to the aircraft’s flight manual to ensure all the manufacturer’s pertinent information is available during flight.

Aircraft weight and balance

The aircraft’s maximum take-off weight and landing weight was 4,000 lbs (1,814 kg) and 3,800 lbs (1,724 kg) respectively, and the take-off and landing centre of gravity envelopes were different shapes (Figure 13). The pilot used a ForeFlight program feature to conduct the pre-flight weight and balance assessment. Program documentation outlined that the feature, which required user information input, could only be used if the aircraft met certain requirements. One requirement was identical take-off and landing centre of gravity limit envelopes. The software provided a warning to the user if the aircraft’s weight or balance exceeded any user-input limitations.

The pilot provided the ATSB with a ForeFlight document, created about 25 minutes before take-off on 19 December that showed the aircraft’s planned take-off weight was 4,111 lbs (1,864 kg). The pilot advised that there were no related software warnings before the accident flight.

The pilot also provided the ATSB with another ForeFlight document (created after the accident flight) that contained the centre of gravity envelope from the pilot’s N210BA weight and balance profile. The maximum take-off and landing weight values mirrored the aircraft’s flight manual, but the shape of the envelope was different, and included an offset area with boundaries beyond the maximum take-off weight (Figure 13). Program documentation indicated that the offset area was probably due to data entry errors.

Figure 13: Centre of gravity envelope comparison

Take-off and landing limits have been highlighted.

Source: Pilot, modified by ATSB

The ATSB assessed that, based on cargo weights, estimated fuel, and occupant weights, the aircraft’s take-off weight was similar to the value on the ForeFlight document prepared by the pilot before the accident flight. Considering the likely fuel burn rate, the aircraft’s weight at impact was estimated to be about 3,910 lbs (1,774 kg). The aircraft’s centre of gravity was within the take-off and landing limits.

Glide performance

Information detailed in the flight manual supplement associated with the installed turbine engine indicated a glide ratio of approximately 19:1 with the propeller feathered,^[33] no wind, flaps and landing gear up, and the best glide speed flown (93 kt at 4,000 lb). Extending the landing gear and flaps both significantly reduced the glide ratio.

The aircraft’s average glide ratio from about 6,000 ft until impact was approximately 11.2:1 (based on the distance travelled from the GPS data). The pilot reported extending the landing gear, and at least 10° of flap, at about 6,000 ft, to lose altitude and while sufficient battery power was available. This was due to concern that there would not be enough electrical power to operate those systems at a later point during the glide approach. The landing gear could be manually extended without electrical power, although this process was much slower than normal gear extension. The aircraft could also be safely landed without the flaps extended.

The pilot also reported that, before extending the landing gear and flaps, the aircraft had much better glide performance than experienced during the PropJet training. That training was undertaken with low engine power intended to simulate a feathered propeller. After being notified by the pilot that the simulated drag was higher than experienced during the accident flight, PropJet adjusted the engine power used during training to be more representative of the aircraft’s actual glide performance.

Stall speeds and warning

The published stall speed at the maximum take-off weight varied depending on the flap setting, angle of bank, and centre of gravity (with bank angle and flap deflection having the greatest effect). The lowest stall speed was 59 kt (0° bank, 30° flap), and for a 16° degree bank angle and 10° of flap, the stall speed was about 72 kt.

The aircraft had a vane-type stall warning system in the leading edge of the left wing. The vane sensed changes in airflow over the wing and produced a continuous tone and aural message through the cockpit speaker between 5 –10 kt above the stall in all configurations.

The pilot reported that the aural stall warning sounded through the headset and recalled that it activated after the aircraft turned onto the base leg for runway 18. The pilot further advised that the activation was expected since they were deliberately trying to slow the aircraft down to just above a stall. The pilot stated that the aircraft had a ‘…very distinctive stall buffet’ and a ‘…very docile stall’.

The pilot initially advised targeting an indicated airspeed of 44 kt during the forced landing after realising the aircraft would not make the runway, as they recalled the aircraft stalled at this speed with full flaps during slow speed training in the P210N. As detailed in the aircraft’s flight manual, it was not possible to attain an airspeed of 44 kt during the glide approach without stalling the aircraft.

The pilot subsequently advised that they were targeting 44 kt ground speed in the latter stages of the approach to reduce the collision energy. As aircraft control is dependent on airspeed, targeting a groundspeed increases the risk of losing control. Additionally, given the wind conditions on the day, it was not possible to attain a groundspeed of 44 kt without stalling the aircraft.

Forced landing

The CASA Flight Instructor Manual (Aeroplane) provided guidance on the initial stages of managing a forced landing following an engine failure:

Having selected the field and landing direction a plan must be formulated. This depends principally on the height available and distance to the field. If the aeroplane is say, 5,000FT above the field it will probably be advantageous to fly around the field.

Remaining above the landing area improves a pilot’s ability to continually assess their altitude, positioning, wind, and manage any misjudgements or changes in these factors. Once the aircraft arrived above the landing area, the CASA manual further stated:

…the aeroplane must be flown to a position some 1,000FT above ground level which is, in effect, on the base leg relative to the chosen field and from which a comfortable glide into the field can be made.

The CASA Visual Flight Rules Guide also provided a visual representation of the forced landing procedure (Figure 14). This procedure recommended a flight path including key positions (high key / low key) to assist pilots in judging the glide approach and evaluating the situation. Pilots should use any combination of gliding manoeuvres to arrive at the key positions, at which point a power-off approach^[34] can be conducted by following the regular landing circuit.

Figure 14: Forced landing procedure

Source: Civil Aviation Safety Authority

Pilots should glide to the downwind (low) key position, located abeam the intended landing spot, before making any configuration changes. The United States’ FAA Airplane Flying Handbook, Chapter 8 – Approaches and Landings provided the following specific guidance.

At or just beyond the [low] key position, the landing gear is extended if the airplane is equipped with retractable gear... After reaching that point, the turn is continued to arrive at a base-leg key position… Flaps may be used at this position, as necessary, but full flaps are not used until established on the final approach. The angle of bank is varied as needed throughout the pattern to correct for wind conditions and to align the airplane with the final approach. The turn-to-final should be completed at a minimum altitude of 300 feet above the terrain [AGL].

Pilots should maintain the aircraft in the optimal glide configuration until arriving at a position within the landing circuit where there is more assurance of a successful landing (for example, the low key position). If pilots want to alter the glide approach before this point, adjustments can be made via manoeuvring (for example, slips or altering turn radius).

Although not explicitly stated, the CASA and FAA guidance implied a left circuit approach as fixed‑wing aircraft are usually piloted from the left seat. Hence, a left circuit approach improves the pilot’s visibility of the intended runway or landing area and enables a constant assessment of the aircraft’s position and glide performance.

The FAA handbook further included the following guidance with regard to aircraft speed when an off‑airport landing on terrain becomes necessary.

The overall severity of a deceleration process is governed by speed (groundspeed) and stopping distance. The most critical of these is speed; doubling the groundspeed means quadrupling the total destructive energy and vice versa. Even a small change in groundspeed at touchdown—be it as a result of wind or pilot technique—affects the outcome of a controlled crash. It is important that the actual touchdown during an emergency landing be made at the lowest possible controllable airspeed, using all available aerodynamic devices.

Similar occurrences

In-flight engine and airframe icing have been factors in many aviation incidents and accidents, especially in general aviation. Significant guidance material has been published on the hazardous effects of ice on aircraft (see the references list within the section titled Sources and submissions). An FAA SAFO was issued in November 2006 to increase pilot awareness of the dangers of flight in icing conditions and advised the following:

Pilots should use all available meteorological information where forecasts indicate that structural icing may occur and should plan flight to avoid these areas if possible. If flight weather conditions are such that icing may occur, pilots should know how to recognize the early signs of ice accumulation on their airplane, e.g., ice on the windshield wipers, propeller spinners, and ice behind the boots. Other cues such as airspeed degradation, higher power settings, and unanticipated trim changes may also indicate icing accumulation. Finally, if icing conditions are encountered, pilots should follow the guidance in their flight and operating manuals for operating in icing conditions and exit the icing conditions as soon as practicable.

The ATSB identified the following two previous occurrences involving P210N aircraft that experienced engine flameouts due to operation in icing conditions.

NTSB investigation 1996 (N450T)

On 6 May 1996, the pilot of a P210N aircraft, registered N450T, was conducting a private flight at 7,000 ft in the United States. About 30 minutes after take-off, the aircraft’s M250-B17F/2 engine experienced a total loss of power. The aircraft descended for a forced landing and collided with trees resulting in fatal injuries to the pilot and passenger.

Examination of the wreckage identified no pre-impact failure of the engine, airframe, fuel system, or propeller. The NTSB investigation found that N450T was not certified for flight into known icing conditions, and that some of the anti-ice and de-icing equipment specified in the aircraft’s flight manual was not used. The pilot had received weather information before the flight indicating forecast icing conditions above 5,000 ft in the destination area.

The investigation determined the probable causes of the accident to be:

…improper planning/decision by the pilot, which led to flight into icing conditions; and his failure to use all anti-ice and de-icing equipment, as specified by the airplane operator's manual for inadvertent flight into icing conditions. This resulted in loss of engine power due to ice, a forced landing, and subsequent collision with trees during the forced landing.

ATSB investigation 1999 (N62J)

On 27 October 1999, the pilot of a P210N aircraft, registered N62J, was conducting a private flight in Australia, cruising at FL 160. While en route, the pilot reported an engine failure to air traffic control before colliding with steep mountainous terrain resulting in fatal injuries to the pilot.

Examination of the wreckage identified that there was an in-flight breakup before impact from the airframe being stressed beyond its design limits. An inspection determined that the M250-B17F/2 engine was producing significant power at impact. No evidence was found to suggest that anti‑icing additive had been added to the fuel. Conditions in the area at the time of the reported engine failure were conducive to engine intake icing.

The ATSB investigation concluded that the engine power likely reduced significantly because the aircraft was operating in conditions for which it was not designed or certified. As the aircraft descended into warmer air below the freezing level, the engine probably regained normal operation.

__________

14. A complex aircraft is an aircraft that has a retractable landing gear, flaps, and a controllable pitch propeller, including those equipped with an engine control system consisting of a digital computer and associated accessories for controlling the engine and propeller. A high-performance aircraft is an aircraft fitted with an engine capable of producing more than 200 horsepower.
15. A maintenance and training organisation based in the US.
16. STC SA1003NE currently held by Griggs Aircraft Refinishing. Previously held by O&N Aircraft Modifications until 2016.
17. The Rolls-Royce Model 250 (M250) series of engines were originally developed by the Allison Engine Company in the 1960s and known as the ‘250 series’. The Allison Engine Company became a subsidiary of Rolls Royce North America in 1995.
18. Seven other aircraft utilised the same batch of fuel on the same day, with no difficulties reported to the ATSB.
19. ADS-B: Automatic Dependent Surveillance–Broadcast is a means by which aircraft, aerodrome vehicles and other objects can automatically transmit or receive data such as identification, position and additional data, as appropriate, in a broadcast mode via a data link.
20. ForeFlight is an electronic flight bag. An electronic flight bag is a portable information system for pilot’s which allows storing, updating, delivering, displaying and/or computing digital data to support flight operations or duties.
21. In March 2018, the aircraft’s electrically heated engine inlet was replaced with an engine inlet heated using compressor bleed air.
22. The pilot advised that they usually took photographs during the cruise phase of flights to capture engine instrument readings as a method of engine trend monitoring.
23. For unknown reasons, the compressor blade deformation was not identified during the engine examination at Asia Pacific Aerospace. A post-examination review by Rolls-Royce of examination photographs identified the damage.
24. A rich flameout generally results from very fast engine acceleration, where an overly rich mixture causes the fuel temperature to drop below the combustion temperature. It also may be caused by insufficient airflow to support combustion, which may occur because of a blocked engine inlet, inlet filter or changes to the air composition entering the engine (for example, intense ground fires, power station exhausts, gas flares on oil rigs, or industrial chimneys). A lean flameout occurs if the fuel quantity is reduced proportionally below the air quantity.
25. The certification conditions are based on atmospheric icing data and intended to address 99 per cent of supercooled droplet icing conditions. The term ‘icing conditions’ typically refers to weather conditions where supercooled liquid droplets form ice on cold surfaces. However, the icing environment can present icing environments outside those certification conditions such as supercooled large droplets (SLD), and ice crystals. SLD can have drop diameters up to 100 times larger than regular supercooled droplets and strike behind protected regions. Ice crystal clouds occur near deep convective thunderstorms where liquid water particles freeze and flow out of the cloud top. Ice crystals can accumulate on hot engine components (for example, within a compressor) as ice/water on the surfaces are able to cool down the surface down to the point where ice can accrete.
26. Compliance with engine certification requirements are at the engine level, and do not account for the integration of that engine with an aircraft and propeller combination. Such integration is usually a consideration as part of aircraft level certification. It is likely that N210BA was prohibited from flight into icing conditions as the aircraft was not equipped with any certified airframe ice-protection equipment.
27. Significant weather is depicted by symbols on the chart and includes the prognosis for moderate or severe turbulence (including clear air turbulence), moderate or severe icing, surface fronts, cumulonimbus cloud associated with thunderstorms, and other weather phenomena.
28. A significant meteorological information (SIGMET) is a weather advisory that provides the location, extent, expected movement and change in intensity of potentially hazardous (significant) or extreme meteorological conditions that are dangerous to most aircraft, such as severe icing, thunderstorms or severe turbulence. SIGMETs cover all altitudes.
29. An AIRMET provides advice on deteriorating conditions, such as moderate icing, between the surface and 10,000 ft above mean sea level, not already included in the relevant Graphical Area Forecast. AIRMETs are complimentary to the routine issue and correction of Graphical Area Forecasts. Compared to SIGMETs, AIRMETs cover less severe weather phenomena.
30. FAA (Federal Aviation Administration) (2009) Legal Interpretation, Bell, January 2009, United States. Available from the FAA Regulations Division.
31. The Windy software program provides forecast and observed weather information such as rain, wind, temperature, and clouds.
32. C-GUMPS is an acronym used mostly by pilots of retractable gear aircraft with piston engines as a mental checklist to ensure nothing critical has been forgotten before landing. C – carburettor heat, G – gas (fuel), U – undercarriage, M – mixture, P – propeller(s), S – switches and seatbelts.
33. Feathering: the rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in flight engine failure or shutdown.
34. Power-off approaches are made by gliding an airplane with the engine(s) idling to a selected point on the runway. The objective is to develop the skills required to execute a gliding approach from traffic pattern altitude and land safely on a specified touchdown point. Although a power-off approach is not an emergency procedure, the glide pattern and key point concepts can be used during an emergency landing without power.

Just after midday on 19 December 2019, while en route from Bankstown, New South Wales, to Cambridge, Tasmania, a Cessna P210N Silver Eagle (P210N), registered N210BA, experienced a total power loss at Flight Level (FL) 160, about 22 km south‑south‑east of Moruya Airport, New South Wales. Following a glide approach to the airport, the aircraft impacted terrain 560 m north of the runway 18 threshold, injuring the two occupants.

In the context that there were no aircraft defects or anomalies that contributed to the accident, the following analysis will discuss the reason for the power loss and other significant operational factors.

Pre-flight planning

An effective pre-flight risk assessment requires, among other things, an adequate knowledge of:

• weather reports and forecasts
• the capabilities and limitations of the aircraft and its systems.

The aircraft’s flight manual prohibited flight into ‘known’ icing conditions as the aircraft was not appropriately equipped to operate safely in such conditions. Specifically, while the engine had systems to counter ice-formation and its effects, the airframe did not.

The Bureau of Meteorology (BoM) forecast valid for the proposed flight predicted moderate icing at the intended flight altitude. In practice, that meant ‘…the rate of accumulation is such that even short encounters become potentially hazardous and use of de-icing/anti-icing equipment or diversion is necessary.’ Additionally, such a forecast met the definition of ‘known’ icing conditions used by both the United States Federal Aviation Authority (FAA) and the National Transportation Safety Board.

While the pilot did not use the BoM forecast during their pre‑flight preparation, the electronic flight bag software (ForeFlight) used by the pilot generated a pre-flight weather report that also forecast light to moderate icing conditions along the planned flight path. As such, information was available to identify that known icing conditions would probably be encountered.

However, the pilot believed the ForeFlight icing forecast, while providing an indication of possible icing, did not prevent the planned flight from proceeding. Additionally, the pilot incorrectly believed that icing forecasts were relevant only when an associated AIRMET or SIGMET had been issued. While the BoM‑produced SIGWX chart (a routine forecast) indicated moderate icing above 10,000 ft, the pilot did not view the chart, nor was it displayed in the ForeFlight report (see the section titled Electronic flight bag).

The aircraft’s flight manual required use of fuel system anti-icing additive for flight in ambient air temperatures less than 40 °F (4 °C). The pilot incorrectly believed this limit applied to the ambient air temperature on the ground. This interpretation was the result of the pilot’s assessment that, as flights were usually conducted at high altitude, and therefore below 4 °C, the reference in the manual was to temperature on the ground because, otherwise, additive would be routinely required. This belief was probably reinforced by the experience of not encountering any problems during flights at low temperatures without additive use, and the similar experiences of other pilots. The pilot also stated that fuel system icing was only a problem if air temperatures below -35 °C were expected, indicating a limited understanding of icing in aviation turbine fuels.

Consequently, although air temperatures in flight were forecast to be significantly below 4 °C (-9 to -11 °C), the pilot never considered the use of anti-icing additive. While the evidence, including the examination of the fuel system, indicated that it was unlikely the absence of additive contributed to the engine power loss, its omission increased the risk of ice formation in the fuel system and potential engine fuel starvation.

In summary, the pilot did not have adequate knowledge of the aircraft’s systems limitations or weather reports and forecasts with respect to icing. Consequently, the flight was planned and conducted through forecast icing conditions for which the aircraft was not certified or equipped.

Operation in icing conditions

The aircraft’s flight manual emergency checklist for an inadvertent icing encounter stated that icing conditions must be exited as soon as possible, and engine ice protection systems left operating while ice was visible on the airframe. Therefore, when the forecast icing conditions were encountered at FL 180, an immediate descent was the safest option.

The pilot’s in‑flight photographs showed substantial airframe ice build‑up. However, the pilot was not aware of the checklist requirement and reported that they were not concerned about operating in icing conditions for an extended period. That perspective was due to an inadequate understanding of the risks involved, reinforced by the pilot’s own experience and that of others. The pilot’s decision to descend was made after the passenger expressed concern about visible ice accumulation on the aircraft.

In addition to the photographed airframe ice, continued flight in icing conditions probably resulted in ice accumulation on other unprotected areas on the airframe, propeller, and engine. The descent to avoid further ice build-up coincided with the pilot deactivating available ice-protection systems, contrary to the flight manual. That action increased the risk of further ice formation, any accumulated ice remaining, and the risk of an icing‑related engine flameout.

Engine flameout

Based on the pilot’s description of the engine power loss being similar to a normal engine shut down, and the absence of any identified mechanical issue with the engine or its systems, the ATSB concluded that the engine probably experienced a flameout. Several potential causes of engine flameout were considered. The evidence indicated that:

• fuel exhaustion/starvation
• compressor stall
• a rich or lean fuel mixture
• turbulence
• water ingestion

were all unlikely to have occurred. However, given the presence of airframe ice at the time of the power loss, an icing‑related flameout was considered further.

The Rolls-Royce M250 series engines are certified to operate in icing conditions when all the associated protection systems are functioning. Based on the pilot’s account that the engine anti‑ice systems were operating up until the commencement of the descent from FL 180, it was therefore considered unlikely that any significant engine ice accumulated prior to that descent. Once the protections of continuous ignition and compressor inlet heat were removed, ice could form at the compressor inlet.

Based on the described constant turbine outlet temperature leading up to the engine failure, it was probable that if any such ice build‑up occurred, it would have been insufficient to have produced a flameout from blocking the flow of air into the compressor. Additionally, the pilot reported that the compressor inlet heat was only switched off as it was assessed that the aircraft had exited icing conditions.

Despite the pilot’s assessment, given the extent of the forecast icing and recorded aircraft manoeuvring on reaching FL 160, icing conditions may have persisted after the commencement of the descent. In that case, and as indicated in Rolls‑Royce certification testing, that would have permitted ice accumulation at the compressor inlet during at least part of the aircraft’s descent to  FL 160, and subsequent level flight up until the engine power loss.

Testing conducted by Rolls‑Royce also identified that only a relatively small quantity of ingested ice is required to produce an engine flameout. In addition, deactivation of continuous ignition increased the engine’s susceptibility to such a flameout.

During certification testing, compressor inlet heat was required to dislodge the built‑up ice. Noting the compressor inlet heat was not reinstated on this occasion, the engine inlet heat was on continuously before the engine failure. Given the vicinity of that heat source to the compressor inlet, a potential mechanism existed to dislodge ice capable of entering the engine. Additionally, aerodynamic effects and/or vibration were equally feasible mechanisms to dislodge accumulated ice.

In summary, given the:

• known icing conditions, operation of the engine without full anti‑ice protection at the time of the power loss, and susceptibility of the engine to flameout from small amounts of ingested ice
• described nature of the engine power loss
• absence of other likely causes

the ATSB concluded that the engine flameout was probably due to ice ingestion.

Rotor lock

Rotor lock is a temporary condition where differential changes in thermal contraction of gas producer turbine components after an engine flameout results in contact between rotating and fixed components sufficient to prevent engine rotation. Due to relatively small internal clearances between components, the M250 series engines are known to experience rotor lock.

Given the:

• prior functionality of the engine starter
• examined condition of the starter components after the accident
• absence of any other reported electrical issues/related warnings during the flight
• reported amperage increase when the starter was being engaged

the starter and related circuit was most probably serviceable at the time of the engine failure.

Based on the pilot’s account, it’s likely that the engine restart procedure was performed correctly with the first attempt completed before the 60 seconds indicated in the flight manual for rotor lock. However, due to its variable nature, rotor lock can occur in less than 1 minute. At the time of the power loss, the engine had probably been operating close to the maximum continuous temperature limit of the gas producer turbine for approximately 1 hour. At the same time, the aircraft was operating at relatively low ambient air temperature and high speed. In combination, that produced a significant thermal gradient and high potential for differential component cooling. Consequently, though the engine examination was not conclusive about rotor lock and the starter circuit breaker did not reportedly activate, the ATSB concluded that it probably occurred and prevented the engine restarts.

While the variable nature of rotor lock provides no certainty of a successful restart, the gas producer turbine may have been free to rotate when the aircraft reached Moruya River at 1,500 ft, about 10 minutes after the engine flameout. However, it is not reasonable to expect that the pilot would have attempted another engine restart so late in the approach as their focus was on conducting the forced landing.

Forced landing

Initial glide approach

Due to concern that electrical power would not be available late in the glide approach, the pilot elected to extend the landing gear, and at least 10° of flap, at an altitude of about 6,000 ft. In the event of electrical power loss, it was still possible to manually lower the landing gear. However, that method was significantly slower than normal extension and would have added to the pilot’s workload during the glide approach. While the early reconfiguration for landing significantly reduced the available glide performance and was contrary to advice provided in the FAA’s Airplane Flying Handbook, the aircraft arrived above the intended runway threshold at an altitude of 4,500 ft – sufficient height for a successful landing.

From that position, the pilot elected to fly south-east, away from the airport, which at the furthest point was about 3 NM from the runway threshold (at an altitude of 2,800 ft). Although the pilot was using navigation equipment to assist orientating the aircraft for the glide approach, tracking away from the airport in that manner reduced visibility of the intended runway, and the ability to continually assess the situation. By contrast, had the pilot elected to lose the required height in the vicinity of the runway threshold by remaining over the runway, visual assessment of the glide profile in the hazy conditions would have been significantly easier.

Following the manoeuvring to the south‑east, the aircraft was then tracked back towards the airport, arriving south of the Moruya River at 1,400 ft about 1.8 NM from the intended downwind (low key) position. At that point the aircraft was now too low to conduct a glide approach to runway 18. That was recognised by the pilot and the decision made to approach an alternative runway.

Manoeuvring in the vicinity of the airport

The pilot’s account of the accident strongly supports that, after deciding to abandon the approach to runway 18 and track east along Moruya River for an alternative runway, the pilot’s attention became primarily focused on visually sighting the R44 helicopter. This preoccupation distracted the pilot from managing the remaining approach and forced landing.

Attention is a focusing response to a stimulus or task that reflects a state of arousal or concentration.^[35] Studies indicate that attention paid to a particular stimulus or task generally occurs in the context of competition among multiple stimuli or tasks for limited processing capacity.^[36] Multiple stimuli or tasks that make simultaneous demands on an individual’s central processing mechanism will tend to interfere with each other. Should one or more of these competing stimuli or tasks be sufficient to interfere with, or divert attention, from the original focus of attention, then the individual becomes distracted.^[37] It is within the context of attention that the process of distraction occurs.

Distractions ultimately influence and change our decisions. Decision making is regarded as the cognitive process resulting in the selection of a belief or a course of action among several possible alternative options. It is a reasoning process based on assumptions of values, preferences, and beliefs of the decision-maker.^[38]

The focus on the helicopter’s position probably occurred because of the pilot’s prioritisation of risks. The pilot appeared more concerned about the risk of colliding with the helicopter than the risk of missing the runway and colliding with terrain.

By focussing on the helicopter, the pilot became distracted from managing the aircraft’s speed, position, and altitude, causing them to misjudge an approach to the remaining viable runways (runway 36 and 22). This misjudgement resulted in the aircraft arriving at a position where an off‑airport landing was the only option, leading to the collision with terrain. While the prioritisation of ‘aviate, navigate, communicate’ is well known to pilots, on this occasion additional radio communication during the glide approach to ascertain the position of the R44 may have reduced distraction for the accident pilot during a period of high workload.

Distraction has contributed to many aviation safety accidents and incidents. Data from the ATSB showed that between 1997 and 2004 there were over 500 occurrences attributed to distraction, with the majority involving pilot distraction.

After realising an off-airport landing was imminent, the pilot reported targeting a speed of 44 kt based on a belief that it was the aircraft’s stall speed. However, the aircraft’s lowest published stall speed was 59 kt. Therefore, the pilot was probably targeting an airspeed well below the stall speed for the aircraft’s configuration at the time, increasing the risk of loss of control close to the ground. From the available evidence (recorded data, tree and ground impact marks, and the pilot’s recall) it was not possible to determine if the aircraft was in a stalled condition before impact. More generally however, maintaining control of the aircraft all the way to ground contact increases the likelihood of survival during a forced landing.

Survivability

A substantial amount of research has shown that seat belts in small aircraft that include an upper torso restraint (UTR), such as a shoulder harness, significantly reduce the risk of injury compared to lap belts only. A UTR can minimise the flailing of the upper body and reduce the risk of impacts involving the head and upper body.

The pilot’s and the passenger’s seatbelt and shoulder harness were secured upon impact and probably reduced the extent of their injuries. In addition, the close proximity of first responder paramedics resulted in the rapid provision of first aid, which further reduced risk to them.

The aircraft’s emergency checklist for forced landings included unlatching the main door to avoid its opening mechanism jamming during impact, preventing egress or access. However, the pilot kept the door locked to retain cabin strength. While it was not possible to determine if this objective was achieved (due to the variables involved), the locked door delayed the first responders accessing the cockpit. While this did not affect the outcome severity on this occasion, under different circumstances such as a post‑impact fire or ditching, it could have proved fatal.

Electronic flight bag

The pilot used the ForeFlight electronic flight bag (EFB) software, which was not a Civil Aviation Safety Authority‑approved operational data source. As detailed earlier, the use of this EFB software resulted in the pilot missing important weather products as they were regionally unsupported.

The ATSB determined that the aircraft’s maximum take-off weight was exceeded by about 50 kg. Based on the estimated fuel burn, the aircraft was above the maximum landing weight by a similar amount when it impacted terrain. Although not a contributing factor to this accident, operating above the specified weight limits can significantly affect aircraft performance and structural integrity.

The ForeFlight software reflected the flight manual weight limitations, however, the pilot reported that it did not generate any weight‑related warnings during pre‑flight preparation. It was also identified that the ForeFlight weight and balance function was not compatible with the P210N, and the centre of gravity envelope used by the pilot was different to that in the aircraft’s flight manual. These differences can result in the aircraft being beyond the allowable weight and centre of gravity limits, but not generate an alert. Therefore, if relying on an EFB, it must be compatible with the aircraft manufacturer’s source data.

Finally, a review of the electronic emergency checklists on the pilot’s ForeFlight EFB identified several important differences to the aircraft’s flight manual checklists. For example, a key omission from the Engine failure during flight electronic checklist was the requirement to isolate the engine from the fuel, an important step in the event of a catastrophic engine failure or fire. In addition, the checklist omitted a warning about rotor lock, which specified the importance of time in engine restart success. Additionally, the Emergency landing with no engine power electronic checklist was missing the requirement to secure the seat belts and shoulder harnesses and another item intended to prevent a potential source of fire, both important checks for a forced landing.

Nozzle shield cracking

The aircraft’s M250-B17F/2 engine was the subject of a Rolls-Royce engine service bulletin for crack inspections of the first stage nozzle shield. The engine's total cycles at the time of the accident indicated that if the bulletin had been complied with, the engine should already have been inspected. However, as significant cracking of the nozzle shield was identified during the ATSB engine examination, it was likely that the engine had not been inspected as required by the bulletin. Further, a review of the engine maintenance history did not show any record of compliance with the bulletin.

While there was no associated Airworthiness Directive mandating compliance, cracking of the nozzle shield increased the risk of coking of the gas producer turbine bearing and the potential for an oil fire.

__________

35. Berlyne, 1993
36. Broadbent, 1953; Kahneman, 1973
37. Nelson, Duncan, & Kiecker, 1993.
38. Herbert, 1977.

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.  These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the engine failure and collision with terrain involving a Cessna P210N, registered N210BA, which occurred near Moruya Airport, New South Wales, on 19 December 2019.

Contributing factors

• The accident flight was planned and conducted through forecast icing conditions for which the aircraft was not certified or equipped.
• Flight in icing conditions for an extended period resulted in significant accumulation of ice on the airframe. The subsequent descent to avoid further icing coincided with the pilot deactivating available engine ice-protection systems, which in turn led to a flameout from ice ingestion.
• The engine restarts were unsuccessful, most probably because of a temporary thermal rotor lock condition where rapid and differential cooling of the engine’s gas producer turbine prevented it from rotating.
• Although sufficient height was available to conduct a forced landing at Moruya Airport, the pilot’s initial manoeuvring resulted in the aircraft being too low to conduct a glide approach to the most appropriate runway.
• Due to distraction in the latter stage of the approach, the pilot misjudged the approach to the remaining runway options that preceded the subsequent collision with terrain.

Other factors that increased risk

• The electronic emergency checklists used by the pilot were contrary to the aircraft’s flight manual, omitting safety critical checks.
• The aircraft was about 50 kg above the maximum take-off weight on departure from Bankstown Airport and about the same amount above the maximum landing weight at the time of the collision.
• The aircraft was operated in temperatures conducive to fuel system icing without the protection of fuel anti-icing additive.
• The premature configuration of the aircraft, due to concern over electrical power depletion, significantly decreased the aircraft’s glide performance before the landing was assured.
• The pilot targeted an airspeed below the manufacturer-specified stall speed during the forced landing, increasing the risk of control loss.
• The engine’s first stage gas producer turbine nozzle shield showed significant cracking, which increased the risk of an oil fire. There was no evidence that the manufacturer’s service bulletin for initial and ongoing inspections for cracking had been completed.

Other findings

• The seatbelts and shoulder harnesses worn by the pilot and passenger probably reduced the extent of their injuries, and the prompt attendance of paramedics further reduced their risk.

ADF	Australian Defence Force
ADS-B	Automatic Dependent Surveillance–Broadcast
AGL	Above ground level
AIRMET	Advice on deteriorating conditions not already included in the relevant area forecast
AMSL	Above mean sea level
ATC	Air traffic control
BoM	Bureau of Meteorology
CASA	Civil Aviation Safety Authority
CEB	Commercial engine bulletin
C-GUMPS	Mental checklist used mostly by pilots of retractable gear aircraft with piston engines – Carburettor heat, Gas (fuel), Undercarriage, Mixture, Propeller(s), Switches and seatbelts
COTS	Commercial off-the-shelf
CTAF	Common traffic advisory frequency
EFB	Electronic flight bag
FAA	Federal Aviation Administration
FL	Flight level
GPS	Global positioning system
IFR	Instrument flight rules
METAR	Meteorological aerodrome report
NTSB	National Transportation Safety Board
psi	Pound per square inch
RPM	Revolution per minute
SAFO	Safety alert for operators
SIGMET	Significant meteorological information weather advisory
SIGWX	Significant weather chart
STC	Supplemental type certificate
TOT	Turbine outlet temperature
US	United States
UTR	Upper torso restraint

Sources of information

The sources of information during the investigation included the:

• Bureau of Meteorology
• Civil Aviation Safety Authority
• United States National Transportation Safety Board
• pilot and passenger of accident flight
• PropJet 210 Aviation
• R44 helicopter pilot
• recorded data (GPS, ADS-B, photographs)
• Rolls-Royce
• P210N STC holder (Griggs Aircraft Refinishing)
• skydive instructor

References

AOPA (Aircraft Owners and Pilots Association) (2008), Safety Advisor: Aircraft Icing, United States

AOPA (Aircraft Owners and Pilots Association) (2021) Icing and Cold Weather Ops [online document], accessed 10 May 2021.

ATSB aviation research investigation report AR-2008-044(1), A pilot’s guide to staying safe in the vicinity of non-towered aerodromes, Australia.

ATSB aviation occurrence investigation 199905037, Cessna Aircraft Company P210N, N62J, 14 km W Hernani, NSW, 27 October 1999, Australia.

ATSB aviation research investigation report B2004/0324, Dangerous Distraction: An examination of accidents and incidents involving pilot distraction in Australia between 1997 and 2004, Australia.

Berlyne, D. E. (1993). Conflict, arousal and curiosity. New York: McGraw-Hill.

BoM (Bureau of Meteorology) (2021) Knowledge Centre [online document], accessed 10 May 2021.

Broadbent, D. E. (1953). Perception and communication. New York: Pergamon Press.

CASA (Civil Aviation Safety Authority) (2006), Flight Instructor Manual (Aeroplane), Issue 2, Australia

CASA (Civil Aviation Safety Authority) (2021) Icing [online document], accessed 10 May 2021.

CASA (Civil Aviation Safety Authority) (2021), Visual Flight Rules Guide, version 6.3, Australia

EGAST (European General Aviation Safety Team) (2015), In Flight Icing, GA 10, Germany

FAA (Federal Aviation Administration) (2015), Pilot Guide: Flight in Icing Conditions, AC 91-74B, United States.

FAA (Federal Aviation Administration) (2016), Airplane Flying Handbook, FAA-H-8083-3B, United States.

Herbert Alexander Simon (1977). The New Science of Management Decision. Prentice-Hall.

Kahneman, D. (1973). Attention and Effort. New Jersey: Prentice-Hall.

NASA (National Aeronautics and Space Administration) (2019) Aircraft Icing Training [online document], accessed 10 May 2021.

Nelson, J. E., Duncan, C. P., & Kiecker, P. L. (1993). ‘Toward an understanding of the distraction construct in marketing’. Journal of business research, 26, 201-221.

NTSB (National Transportation Safety Board) 1997, aviation accident final report NYC96FA101

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the pilot
• Civil Aviation Safety Authority
• PropJet 210 Aviation
• Griggs Aircraft Refinishing
• ForeFlight
• Rolls-Royce
• National Transportation Safety Board.

Submissions were received from:

• the pilot
• Civil Aviation Safety Authority
• Griggs Aircraft Refinishing
• National Transportation Safety Board.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.