ATSB Transport Safety Report: Loss of control and collision with terrain involving Cessna 441, VH-XMJ

contributing to the accident could be analysed. What's been done as a result Following the accident, CASA issued a temporary management instruction to provide higher risk protection around operations involving CASA flying operations inspectors. However, at the time of writing these instructions had not been permanently incorporated into regulation. Safety message Conducting a simulated engine failure after an actual take-off is a high risk exercise with little margin for error. For that reason, Cessna recommended practicing this sequence in the 441 aircraft at a height of 5,000 ft above ground level to allow the opportunity for recovery in the event that control is lost. A review of past accidents indicates that, while accidents associated with engine malfunctions are rare, training to manage one engine inoperative flight (OEI) after take-off is important. The ATSB recommends that such training should follow the manufacturer’s guidance and, if possible, be conducted in an aircraft simulator. If the sequence is conducted in the aircraft close to the ground then effective risk controls need to be in place to prevent a loss of control as recovery at low height will probably not be possible. Such defences include: • defined OEI performance criteria that, if not met, require immediate restoration of normal power • use of the appropriate handling techniques to correctly simulate the engine failure and ensure that aircraft drag is minimised/OEI performance is maximised • ensuring that the involved pilots have the appropriate recency and skill to conduct the exercise and that any detrimental external factors, such as high workload or pressure, are minimised. Contents The occurrence ........................................................................................................................1 Context ......................................................................................................................................4 Pilot information 4 Inductee pilot 4 Chief pilot 4 CASA flying operations inspector 6 Aircraft information 6 General information 6 Aircraft records 7 Aircraft systems information 8 Engine and propeller controls 8 Weight and balance 11 Meteorological information 11 Airport information 11 Circuit operations 12 Asymmetric flight 12 Multi-engine aeroplanes 12 Asymmetric control 14 Asymmetric performance 15 Engine failure simulation 18 Stall speed 22 Flight recorders 22 Recorded flight data 22 Operational information 25 Pilot licencing 25 The flight 28 Check pilot training 33 Skill decay 34 Wreckage and impact information 35 Accident site 35 Aircraft wreckage 36 Medical and pathological information 37 Organisational information 38 Overview of the operator 38 Organisational structure 39 Key personnel 40 Organisational change 43 Manager workloads 45 Regulatory oversight 46 Overview 46 Regulatory services processes 47 Surveillance processes 50 Authorisation Holder Performance Indicator scores for Rossair 52 Surveillance events for Rossair 54 CASA awareness of Rossair workload 55 Additional information 55 Related occurrences 57 Training accidents 2008-2017 57 Engine failure and malfunction occurrences 2008-2017 57 Other related asymmetric training accidents 58 Safety analysis ...................................................................................................................... 60 Introduction 60 Development of the accident 60 Degraded aircraft performance 60 Simulating engine failures after take-off 62 Simulated engine failure after take-off guidance 63 Continuation of the exercise 64 Skill decay 64 Communication within the aircraft 65 Organisational workload and pressure 65 Regulatory oversight of Rossair 66 Recorded data 68 Findings ................................................................................................................................. 69 Contributing factors 69 Other factors that increased risk 69 Other findings 69 Safety issues and actions ................................................................................................... 70 General details ...................................................................................................................... 71 Occurrence details 71 Chief pilot details 71 Inductee pilot details 71 Aircraft details 71 Sources and submissions .................................................................................................. 72 Sources of information 72 References 72 Submissions 72 Australian Transport Safety Bureau .................................................................................. 74 Purpose of safety investigations 74 Developing safety action 74 Terminology used in this report 75 › 1 ‹ ATSB – AO-2017-057 The occurrence What happened On 30 May 2017, a Cessna 441 Conquest II (Cessna 441), registered VH-XMJ (XMJ) and operated by AE Charter, trading as Rossair, departed Adelaide Airport, South Australia for a return flight via Renmark Airport, South Australia. On board the aircraft were: • an inductee pilot undergoing a proficiency check, flying from the front left control seat • the chief pilot conducting the proficiency check, and under assessment for the company training and checking role for Cessna 441 aircraft, seated in the front right control seat • a Civil Aviation Safety Authority flying operations inspector (FOI), observing and assessing the flight from the first passenger seat directly behind the left hand pilot seat. Each pilot was qualified to operate the aircraft. There were two purposes for the flight. The primary purpose was for the FOI to observe the chief pilot conducting an operational proficiency check (OPC), for the purposes of issuing him with a check pilot approval on the company’s Cessna 441 aircraft. The second purpose was for the inductee pilot, who had worked for Rossair previously, to complete an OPC as part of his return to line operations for the company. The three pilots reportedly started their pre-flight briefing at around 1300 Central Standard Time.1 There were two parts of the briefing – the FOI’s briefing to the chief pilot, and the chief pilot’s briefing to the inductee pilot. As the FOI was not occupying a control seat, he was monitoring and assessing the performance of the chief pilot in the conduct of the OPC. There were two distinct exercises listed for the flight (see the section titled Check flight sequences). Flight exercise 1 detailed that the inductee pilot was to conduct an instrument departure from Adelaide Airport, holding pattern and single engine RNAV2 approach, go around and landing at Renmark Airport. Flight exercise 2 included a normal take-off from Renmark Airport, simulated engine failure after take-off, and a two engine instrument approach on return to Adelaide. The aircraft departed from Adelaide at 1524, climbed to an altitude about 17,000 ft above mean sea level, and was cleared by air traffic control (ATC) to track to waypoint RENWB, which was the commencement of the Renmark runway 073 RNAV-Z GNSS approach. The pilot of XMJ was then cleared to descend, and notified ATC that they intended to carry out airwork in the Renmark area. The pilot further advised that they would call ATC again on the completion of the airwork, or at the latest by 1615. No further transmissions from XMJ were recorded on the area frequency and the aircraft left surveillance coverage as it descended towards waypoint RENWB. The common traffic advisory frequency used for air-to-air communications in the vicinity of Renmark Airport recorded several further transmissions from XMJ as the crew conducted practice holding patterns, and a practice runway 07 RNAV GNSS approach. Voice analysis confirmed that the inductee pilot made the radio transmissions, as expected for the check flight. At the completion of the approach, the aircraft circled for the opposite runway and landed on runway 25, before backtracking and lining up for departure. That sequence varied from the planned exercise in that no single-engine go-around was conducted prior to landing at Renmark. 1 Central Standard Time (CST): Coordinated Universal Time (UTC) + 9.5 hours. 2 An RNAV approach is a method of navigation utilising GPS that enables a pilot to guide his aircraft to a landing in low visibility situations. It is often practiced during check flights to ensure proficiency. 3 Runway number: the number represents the magnetic heading of the runway. › 2 ‹ ATSB – AO-2017-057 At 1614, the common traffic advisory frequency recorded a transmission from the pilot of XMJ stating that they would shortly depart Renmark using runway 25 to conduct further airwork in the circuit area of the runway. A witness at the airport reported that, prior to the take-off roll, the aircraft was briefly held stationary in the lined-up position with the engines operating at significant power. The take-off roll was described as normal however, and the witness looked away before the aircraft became airborne. The aircraft maintained the runway heading until reaching a height of between 300-400 ft above the ground (see the section titled Recorded flight data). At that point the aircraft began veering to the right of the extended runway centreline (Figures 1 and 15). The aircraft continued to climb to about 600 ft above the ground (700 ft altitude), and held this height for about 30 seconds, followed by a descent to about 500 ft (Figures 2 and 13). The information ceased 5 seconds later, which was about 60 seconds after take-off. Figure 1: Position information of VH-XMJ as the aircraft circled and landed on runway 25 (depicted in red), before backtracking and departing (depicted in green). Source: Google and OzRunways, annotated by the ATSB Figure 2: Altitude information of VH-XMJ (each vertical line represents 5 seconds) Source: Google and OzRunways, annotated by the ATSB › 3 ‹ ATSB – AO-2017-057 A distress beacon broadcast was received by the Joint Rescue Coordination Centre and passed on to ATC at 1625. Following an air and ground search the aircraft was located by a ground party at 1856 about 4 km west of Renmark Airport. All on board were fatally injured and the aircraft was destroyed. › 4 ‹ ATSB – AO-2017-057 Context Pilot information There were three pilots on board VH-XMJ (XMJ). A summary of the role of each pilot, and their relevant training, qualifications and experience is provided below. The intention of the flight was to allow a Civil Aviation Safety Authority (CASA) flying operations inspector (FOI) to observe the Rossair chief pilot conduct an operator proficiency check (OPC), for the purposes of issuing him with a Conquest II (Cessna 441) check pilot approval (see the section titled Check pilot training). The pilot undertaking the OPC was being inducted into the company. The inductee pilot was seated in the left hand control seat, the chief pilot in the right hand control seat, and the CASA FOI in the first row passenger seat behind the left hand seat pilot. Inductee pilot Flight role The inductee pilot was the planned pilot flying. He was an experienced Cessna 441 pilot who had previously flown for Rossair from May 2010 to August 2014. Undertaking the OPC was part of his induction back into the company. Qualifications and experience The inductee pilot held an Air Transport Pilot (Aeroplane) Licence (ATPL), issued in December 1991, and Commercial Pilot (Aeroplane) Licence (CPL) issued in January 1979. He also held an ATPL from the Netherlands. He held a current class 1 aviation medical certificate (valid to 24 June 2017), which required reading correction to be available when flying, but placed no other restrictions on operation. The pilot’s logbook showed a total flying experience of 14,751.1 hours, with 3,293.7 hours on single engine aircraft and 11,427.4 hours on a range of type-rated and class-rated multi-engine aircraft (see the section titled Pilot licencing). This included 987.7 hours on Cessna 441 aircraft. With the exception of the accident flight and an associated practice flight the week before, all of the inductee pilot’s Cessna 441 experience was gained prior to August 2014. A review of the pilot’s licence and associated documentation identified that he held the relevant endorsements and ratings to fly the Cessna 441. In addition, he held a current grade 1 instructor rating for multi-engine class rating training. In the previous 90 days, the inductee pilot had logged 22.2 hours flying as pilot in command, all on multi-engine class rated aircraft, including 3.5 hours in XMJ the week prior to the accident. Proficiency checks and flight reviews The inductee pilot last completed an instrument rating proficiency check (IPC) during his multi-engine class aircraft flight review in a Beechcraft Baron 95-B55 on 13 February 2017. This check required the pilot to demonstrate conducting a one-engine inoperative instrument departure, which was marked on his proficiency check form as completed satisfactorily. His IPC was valid at the time of the accident. Chief pilot Flight role The pilot in the right hand seat was appointed as the Rossair chief pilot in January 2016. On this flight, the chief pilot was being observed by the CASA FOI in order to assess his competence to perform operational proficiency checks on Rossair Cessna 441 pilots. › 5 ‹ ATSB – AO-2017-057 In accordance with the Rossair operations manual, as this was a checking flight, the chief pilot, in the check captain role, was the pilot in command (PIC) for the flight. Based on the planned exercises for the flight the chief pilot’s role was to observe and monitor the inductee pilot’s proficiency. In addition, he was responsible for setting the power controls to simulate asymmetric flights when required, and recover the aircraft if it deviated from safe flight. Qualifications and experience The chief pilot held an ATPL (Aeroplane), issued in June 2001, a CPL (Aeroplane) issued in August 1998, as well as an ATPL (Helicopter) issued in November 2013, and a CPL (Helicopter) issued in April 2007. He also held an ATPL (Aeroplane) from the United States of America. The pilot held a current class 1 aviation medical certificate, valid until 3 August 2017, which required reading correction to be available while flying, but placed no other restrictions on operation. The chief pilot’s logbook history was sought by the ATSB but the complete record could not be located. A review of available records for the pilot indicated the pilot had around 5,000 hours experience operating aeroplanes, including over 3,200 hours of turbine-powered aeroplane experience. This included over 1,000 hours on a Cessna 441 aircraft, accumulated during the period between September 2001 and September 2004 and since March 2016. The pilot also had around 1,300 hours experience operating helicopters. The pilot’s licence showed that the chief pilot held the ratings and endorsements required for the flight, as well as for operation of the company Embraer EMB 120 (EMB 120) aircraft. Additionally he had previously held a grade 2 instructor rating for aeroplanes with night visual flight rules, design features (for example, retractable undercarriage and manual propeller pitch control), and single engine aircraft class rating endorsements. In the previous 90 days, flight and duty records for the chief pilot recorded 128.1 hours of flight time, including 99.6 hours as a captain on the EMB 120 aircraft, and 16.6 hours in the Cessna 441, including a previous flight with the inductee pilot on 22 May 2017. The pilot’s flight and duty records had not been updated since 12 May 2017, so some of these times are based on planned flight times rather than actual flight times. Proficiency checks and flight reviews The chief pilot was inducted into Rossair Cessna 441 operations in April and May 2016 by the Cessna 441 fleet manager. The chief pilot successfully completed his line check and OPC on the Cessna 441 on 30 May 2016. As part of that flying, the chief pilot also completed training to become a check pilot on the aircraft. Following the flight on 30 May 2016, a recommendation was submitted to CASA that he be assessed as a Cessna 441 check pilot. The chief pilot’s last IPC was completed as part of a type rating flight review in the EMB 120 simulator on 22 October 2016. Under CASA exemption 97/16 current at the time of the accident, this flight review conducted on a type-rated aircraft, also satisfied the requirements of a flight review on the multi-engine class rated Cessna 441 aircraft. The chief pilot had not completed an OPC or line check on the Cessna 441 aircraft since 30 May 2016. However, he had completed an OPC in the EMB 120 simulator on 1 February 2017, which was conducted under CASA observation. That 2017 check, although not conducted in the Cessna 441, met the required regulatory and operator proficiency checking requirements (see the section titled Operational proficiency check). › 6 ‹ ATSB – AO-2017-057 CASA flying operations inspector Flight role The CASA FOI was sitting in a non-control seat behind the inductee pilot, and therefore had no flying role on this flight. The role of the CASA FOI on the flight was to observe and assess the chief pilot’s skills in conducting an OPC on the inductee pilot. Qualifications and experience The CASA FOI held an ATPL (Aeroplane) issued in December 1990 and a CPL (Aeroplane) issued in February 1987. He also held a grade 1 instructor rating, with endorsements, among others, in instructor training, multi-engine class rating, and multi-engine aeroplane class rating instructor training. He held a class 1 aviation medical certificate, valid until 15 December 2017, which required reading correction to be available while flying, but placed no other restrictions on operation. The CASA FOI had been in the role since 2008, and at the time of employment with CASA had 12,725 hours, including over 5,100 hours as a Cessna 441 pilot. The FOI role did not involve significant flying, but in the last 90 days he had completed 2.5 hours aircraft flight time, as well as simulator time. Among a variety of flying and management roles prior to joining CASA, the FOI previously held chief pilot and head of training and checking roles at Rossair, with approval to conduct initial training on the Cessna 441. Proficiency checks and flight reviews The FOI completed a flight review and IPC in the Saab 340 simulator on 18 April 2017, and in the Bombardier Dash 8 simulator on 9 May 2017. He completed a flight proficiency check for his grade 1 instructor rating in a Beechcraft Baron 95-B55 on 24 May 2017. Additionally, the FOI had logged a 2.7 hour flight in the Cessna 441, with the FOI as PIC flying with the previous Rossair check pilot, in August 2016. Aircraft information General information The Cessna 441 Conquest II is a pressurised, low-wing, twin-engine turbopropeller (turboprop) aircraft with seating for up to 2 pilots and 9 passengers. Both pilot seats are equipped with flight controls however single-pilot line operations are flown from the left seat. The right pilot seat would normally only be occupied by a second pilot for training and checking flights. The accident aircraft, serial number 441-0113, was manufactured in the United States by the Cessna Aircraft Company in 1980, and registered in Australia as XMJ in February 1989. The Cessna 441 is certified as a normal category4 aircraft under the United States Federal Aviation Regulations Part 23, and issued with type certificate data sheet number A28CE by the United States Federal Aviation Administration in 1977. At the time of the accident, Textron Aviation Inc. was the Type Certificate holder5 for the aircraft and as of March 2020, there were 39 Cessna 441 aircraft registered in Australia. Notable modifications to the aircraft were the incorporation of supplemental type certificates to replace the three blade propellers with four blade propellers, replace the -8 engines with more 4 Normal category: an airworthiness categorisation that applies to aircraft which are intended for non-acrobatic operation, having a seating configuration (excluding pilot seats) of nine seats or less, and a maximum take-off weight (MTOW) of 5,700 kg or less, or 2,750 kg or less for rotorcraft. 5 The Type Certificate holder is responsible for the design and continued airworthiness support of the aircraft. › 7 ‹ ATSB – AO-2017-057 powerful -10 engines and the installation of vortex generators6 to increase the aircraft’s maximum take-off weight. Other than an associated increase in the aircraft’s maximum take-off weight, these modifications did not require any changes to the procedures and airspeed limitations in the aircraft’s pilot’s operating handbook (POH). Aircraft records XMJ had a current Certificate of Registration, Certificate of Airworthiness and maintenance release, all of which were recovered from the accident site. The maintenance release was due to expire on 10 March 2018 or upon 13,859.0 hours total time-in-service, whichever came first. The maintenance release indicated that XMJ was equipped to be operated under the instrument flight rules and in the charter operational category. The maintenance release indicated that there was no maintenance due on the aircraft or open defects at the time of the accident. Prior to the departure from Adelaide, the aircraft had accumulated a total time in service of 13,845.3 flight hours. Part 1 of the aircraft’s Log Book Statement specified that the aircraft was to be maintained in accordance with the AE Charter Services system of maintenance and all applicable airworthiness directives. The following summarises the maintenance activities conducted on XMJ leading up to the accident. • On 31 August 2016 a number of parts, including both the left and right engines were removed for use on other company aircraft. These engines were reinstalled on 24 November 2016 and had operated for 385.2 hours on XMJ since this time. • On 30 April 2017, the installed fuel control unit (FCU) from the aircraft’s left engine was replaced by an FCU borrowed from a third party maintenance organisation. • On 4 May 2017, the aircraft was erroneously released to service prior to in-flight FCU set-ups having occurred, with an endorsement in the deferred defect list that the left engine had to be operated in manual mode until the FCU set-up had been completed but could continue in service until no later than 14 May 2017 without the set-up being completed. • The Rossair chief pilot raised a concern on 8 May 2017 about the aircraft being released into service without the in-flight set-ups being completed, as the aircraft was more difficult than normal to operate with one engine in manual mode. Further maintenance work was performed on the aircraft, and, on 10 May, the aircraft was released into service, with both engines operating in normal (automatic) mode. • The aircraft subsequently flew 28 flights, totalling 32.6 hours with no reported issues. • On 26 May 2017, the original FCU that was removed on the 30 April 2017 was reinstalled onto the left engine of XMJ following removal, cleaning and reinstallation of the FCU’s manual mode control valve. • A certification regarding a wing de-icing system unserviceability was made on 26 May 2017. It stated ‘No action was carried out at this time. Aircraft unavailable due to flying requirements. Customer notified.’ There was no entry in the defect field of the current maintenance release Part 3. • Between 26 May and 30 May, the aircraft flew 6.9 hours without reported issue, including 4.5 hours across five sectors on the morning of the accident. 6 Small installed tabs that create vortices in the airflow just above the upper wing surface (boundary layer) that in turn keep it attached to the aerofoil for longer, improving aerodynamic performance. › 8 ‹ ATSB – AO-2017-057 Aircraft systems information Flight control overview The Cessna 441 is fitted with conventional flight controls connected to the aircraft’s primary flight control surfaces. The primary flight controls consist of the rudder, elevators, and ailerons, which control the aircraft about the yaw, pitch and roll axes respectively. The pilot controls an aircraft by manipulating the control wheel and rudder pedals, which deflect the ailerons, elevators and rudder. Deflection of an aircraft’s primary flight control surfaces changes the aerodynamic shape and therefore the amount of lift generated by the associated part of each wing, vertical stabiliser or horizontal stabiliser. These local variations in lift result in changes to the aircraft attitude and consequently flight path. Any deflection of the primary flight control surfaces into the adjacent airflow produces aerodynamic forces on the surface and corresponding loads on the control wheel or rudder pedals. The magnitude of the aerodynamic force is principally related to the amount of flight control surface deflection, airspeed and trim tab deflection. On the Cessna 441, adjustable trim tabs are attached to the trailing edge of the primary flight controls. These tabs are used to ‘trim’ or counteract the aerodynamic forces felt by the pilot on the control wheel or rudder pedals. During flight, deflection of an aircraft’s trim tab produces an aerodynamic force on the aft part of the associated primary surface. The tabs have the capacity, when adjusted in the opposite direction to the deflection of the primary control surface, to modify the aerodynamic force on the surface and correspondingly, reduce the load felt by the pilot on the control wheel or rudder pedals. The effectiveness of a trim tab is principally related to the amount of deflection and the aircraft’s airspeed. Flap system description The aircraft has four flaps, one inboard, and one outboard per wing. The flaps are normally in the fully retracted position. They are extended to slow the aircraft and allow it to land at a lower airspeed. They can also be used to improve take-off performance in the ‘T.O.’ position. The flaps are operated using a sliding selector. Flap travel is registered on an indicator adjacent to the selector. There are four detents in the selector assembly as follows: • UP - fully retracted, 0⁰ of travel • T.O. - 10° of flap down travel • APPR - 20⁰ of flap down travel • LAND - full extension, 30⁰ of flap down travel. Engine and propeller controls Each engine is controlled by two levers located in the engine controls section of the centre pedestal (Figure 3). The power levers provide control input to the engine for the power necessary throughout the entire operational envelope. The power lever has the following positions: • MAX • AIR START • FLIGHT IDLE • GROUND IDLE • REVERSE The power levers can be moved freely forward of FLIGHT IDLE. A hard stop is provided at the FLIGHT IDLE position to prevent inadvertent selection of reverse thrust in flight (Figure 4). Finger › 9 ‹ ATSB – AO-2017-057 latches located on each power lever must be pulled up to allow movement of the power levers rearward of the FLIGHT IDLE position. The condition levers are used to set the engine revolutions per minute required for flight as well as acting as the control for propeller feathering and emergency fuel shut-off. The condition lever quadrant has the following positions: • TAKEOFF, CLIMB and LANDING • CRUISE • START AND TAXI • EMER SHUT-OFF The condition levers can be moved freely forward of CRUISE. A hard stop is provided at the CRUISE position to prevent inadvertent selection of START AND TAXI speed in flight (Figure 5). Each condition lever must be pulled up to allow movement rear of the CRUISE stop. Another stop is provided at the START AND TAXI position. Rearward movement past this position allows the respective engine to be shut down and its propeller feathered. Figure 3: Engine control levers Source: ATSB › 10 ‹ ATSB – AO-2017-057 Figure 4: Power lever Source: Textron Aviation Inc. Figure 5: Condition lever Source: Textron Aviation Inc. Negative torque system The aircraft’s engines are equipped with a negative torque sensing (NTS) system that activates under conditions of low propeller pitch (see the section titled Multi-engine aeroplane propellers) when air loads drive the propeller instead of the engine. This can occur during normal operation at high airspeed and low power settings but will also happen following an engine failure. When NTS activates, the propeller blades are automatically driven towards the feathered7 position to reduce both the air load and the significant associated drag. NTS will only activate while negative torque is detected so, unlike an auto-feather system fitted to other aircraft, the blades will only automatically move to a high pitch position rather than fully feathered. Consequently, in the event of an engine failure the pilot is required to move the condition lever to the emergency shut off position to feather the propeller. With regard to functioning of the NTS, the POH noted that: 7 Feathering: the rotation of the propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown. See the section titled Multi-engine aeroplane propellers for further information. › 11 ‹ ATSB – AO-2017-057 NTS operation, as evidenced by a cycling sound of the engine(s) can occur at high airspeed with the power levers at FLIGHT IDLE; this is particularly true when operating in manual mode. NTS operation occurs when the propeller is driving the engine, rather than the engine driving the propeller. During normal mode operation, NTS can indicate the fuel flow is insufficient for existing conditions. There is a POH requirement to confirm operation of the NTS prior to flight. Normal operation of the NTS on the ground is accompanied by illumination of an amber light on the cockpit annunciator panel for the respective engine being checked. The light was for check purposes only and would not illuminate during in-flight activation of the NTS. Activation of the NTS on an operative engine in flight can be overcome by advancing the power levers slightly. Manual mode operation Manual mode refers to the engine power output being directly controlled by the power lever position rather than by a signal sent to the engine by the electronic engine control unit (EEC). The power system is designed so that fuel scheduling is lower in manual mode than it is in normal (automatic) mode. Higher power lever positions are therefore required to maintain engine power when in manual mode compared to normal mode. This means that if a fault is detected in the EEC and the engine operation automatically reverts to manual mode the engine will have a reduction in power for that particular power lever setting. If that occurs the power can be restored by advancing the power lever as required. Weight and balance The ATSB determined the likely fuel on board at the time of the accident and the weight and location of people, baggage and ballast. From this information, it was calculated that the aircraft was within the weight and balance limitations specified in the aircraft’s POH and relevant supplements. The aircraft’s weight at the time of the accident was estimated to be about 3,950 kg. The aircraft’s maximum take-off weight was 4,690 kg.8 Meteorological information The forecast weather conditions at Renmark Airport on the afternoon of the accident were benign with a southerly wind at 14 kt, visibility in excess of 10 km and scattered9 cloud at 4,000 ft above the airport. Weather observations recorded at one-minute intervals by an automatic weather station at the airport were obtained from the Bureau of Meteorology (BoM). Consistent with the forecast, in the 20 minutes preceding the accident the wind strength varied between 8-13 knots, and the direction varied between 188-205° magnetic. The cloud cover was consistently seven oktas at about 6,500 ft above the airport and the ambient temperature was 13°C. The ATSB also sought the assistance of the BoM to assess the likely wind strength and direction at the operating altitude of the aircraft immediately prior to the loss of control. This was done to enable an assessment of the airspeed during the final flight segment using recorded groundspeed data (see the section titled Recorded flight data). Airport information Renmark Airport is at an elevation of 115 ft above mean sea level and has one sealed runway, 07/25, and one gravel runway, 18/36.3 As there is no air traffic control tower at the airport, traffic at the airport broadcast on a common traffic advisory frequency to advise intentions and arrange separation with other traffic. 8 The maximum take-off weight was increased over that of the basic aeroplane due to the fitment of vortex generators. 9 When measuring cloud cover, the sky is broken up into eighths. Scattered cloud equates to 3 to 4 oktas of cloud. › 12 ‹ ATSB – AO-2017-057 The terrain west of the airport, along the extended runway centreline in XMJ’s departure direction, slopes upwards, with an elevation gain of about 60 ft between the runway and the accident site location. Circuit operations In order to assure a safe and orderly traffic flow into and out of an airport, a standard circuit traffic pattern is used. The circuit consists of four legs: crosswind, downwind, base and final as shown in Figure 6, with standardised methods for joining the pattern to avoid traffic conflicts. Figure 6: Standard circuit pattern Source: Airservices Australia Asymmetric flight Multi-engine aeroplanes In a discussion of small10 multi-engine aeroplane operations, the United States Federal Aviation Administration (FAA) Airplane Flying Handbook FAA-H-8083-3B, stated:11 The basic difference between operating a multiengine airplane and a single-engine airplane is the potential problem involving an engine failure. The penalties for loss of an engine are twofold: performance and control. The most obvious problem is the loss of 50 percent of power, which reduces climb performance 80 to 90 percent, sometimes even more. The other is the control problem caused by the remaining thrust, which is now asymmetrical. Attention to both these factors is crucial to safe 10 In this context, ‘small’ referred to a reciprocating or turbopropeller-powered airplane with a maximum certificated take-off weight of 12,500 pounds or less. This included the Cessna 441. 11 See www.faa.gov. › 13 ‹ ATSB – AO-2017-057 OEI [one engine inoperative] flight. The performance and systems redundancy of a multiengine airplane is a safety advantage only to a trained and proficient pilot. The importance of maintaining one engine inoperative performance and control was further emphasised in the handbook as follows: In OEI flight at low altitudes and airspeeds such as the initial climb after takeoff, pilots must operate the airplane so as to guard against the three major accident factors: (1) loss of directional control, (2) loss of performance, and (3) loss of flying speed. All have equal potential to be lethal. Loss of flying speed is not a factor, however, when the airplane is operated with due regard for directional control and performance. Multi-engine aeroplane propellers In the event of an engine power loss, the inoperative engine may windmill - continue to rotate due to the airflow acting on the propeller. The FAA handbook described the hazard of a windmilling propeller as follows: The propeller windmilling at high speed in the low range of blade angles can produce an increase in parasite drag, which may be as great as the parasite drag of the basic airplane. In order to minimise this significant source of drag on single engine controllability and climb performance, the propellers of multi-engine aeroplanes are capable of aligning the blades with the airflow (Figure 7). Figure 7: Multiengine aeroplane propeller Source: United States Federal Aviation Administration This ‘feathered’ configuration stops the rotation of the engine and propeller and significantly reduces the parasite drag compared to that associated with a windmilling propeller (Figure 8). › 14 ‹ ATSB – AO-2017-057 Figure 8: Propeller drag Source: United States Federal Aviation Administration Asymmetric control The majority of small, multi-engine aeroplanes like the Cessna 441 have two wing-mounted engines that produce symmetrical propeller thrust during normal operation. One engine inoperative (OEI) flight in these aeroplanes results in asymmetric thrust and drag due to the offset position of the engines from the aeroplane’s centreline. The result is a tendency for the nose of the aeroplane to turn in the direction of the inoperative engine. The extent of the yaw may vary depending on which engine becomes inoperative, with the inoperative engine that produces the greatest degree of asymmetry being termed the ‘critical’ engine.12 The asymmetric yawing tendency may be countered through the application of rudder and aileron control inputs. As the effectiveness of an aircraft’s control surfaces generally decreases with decreasing airspeed, sufficient airspeed must be maintained while operating OEI to ensure that the rudder and aileron retain sufficient control authority to maintain directional control of the aeroplane. The minimum control airspeed with the critical engine inoperative (V MCA) is established by test pilots during aircraft certification under a specific set of conditions, and is marked on the air speed indicators of most multi-engine aeroplanes with a red radial line. VMCA is influenced by a large number of factors, including an aircraft’s configuration/loading, operating altitude and pilot control inputs and is therefore likely to vary from the stated value. The VMCA published in the Cessna 441 pilots operating handbook (POH) was 91 kt indicated airspeed. The POH further stated that: The airplane must reach the air minimum control speed (VMCA) before full control deflections are able to counteract the roll and yaw tendencies associated with one engine inoperative and full power operation on the other engine. VMCA with wing flaps in take-off position is indicated by a red radial on the airspeed indicator. VMCA with wing flaps in the UP position and the airplane in an en-route climb configuration will be buffet limited and occur at a higher speed. In addition to the published VMCA the POH also listed an ‘intentional one engine inoperative’ indicated airspeed of 98 kt with advice that: Although the airplane is controllable at the air minimum control speed, the airplane performance is less than optimum. A more suitable speed with wing flaps positioned in take-off is 98 KIAS [kt indicated airspeed]. This speed is identical to the normal rotation speed, thus the pilot can direct more of this attention to determining and securing the inoperative engine than to achieving a speed not 12 The left engine was the critical engine in this occurrence. › 15 ‹ ATSB – AO-2017-057 normally associated with take-off. This speed also provides additional safety for controllability and allows easier maintenance of altitude during the period of gear retraction and securing the inoperative engine. As detailed in the FAA handbook, maintaining directional control following an engine failure during take-off and initial climb is especially critical: The first consideration following engine failure during takeoff is to maintain control of the airplane. Maintaining directional control with prompt and often aggressive rudder application and STOPPING THE YAW is critical to the safety of flight. Ensure that airspeed stays above VMC [VMCA]. If the yaw cannot be controlled with full rudder applied, reducing thrust on the operative engine is the only alternative. Attempting to correct the roll with aileron without first applying rudder increases drag and adverse yaw and further degrades directional control. Asymmetric performance Optimum single-engine climb performance is obtained by flying the aircraft at the published OEI best rate of climb speed (VYSE), 120 KIAS for the Cessna 441, with maximum available power and minimised drag. Minimum drag is achieved by: • retracting the flaps and landing gear • feathering the propeller of the inoperative engine • minimising sideslip by presenting the smallest aircraft profile to the relative wind. During symmetrical flight in a single-engine airplane, or a multiengine airplane with both engines operating, zero sideslip occurs when the balance ball13 is centred. However, in the case of asymmetric thrust, zero sideslip requires a combination of bank angle and non-centred ball position. That is, a combination of rudder and aileron inputs (Figure 9). As it related to the Cessna 441, the POH provided the following information on the required combination of rudder and aileron inputs to minimise sideslip: Best single-engine climb is attained with the wings banked approximately 3° to 4° and with a ⅔ to ¾ ball slip into the operative engine when the airplane is at low airspeed and heavy weight. As airspeed increases and/or airplane weight is significantly reduced, the ⅔ to ¾ ball slip becomes less important. 13 A cockpit instrument to assist with coordinating flight control inputs, especially rudder application. › 16 ‹ ATSB – AO-2017-057 Figure 9: Zero sideslip Source: United States Federal Aviation Administration While it is possible to counteract asymmetric thrust using only rudder or only aileron, this results in significant performance and controllability penalties. Specifically, countering asymmetry with level wings and the ball centred (large rudder input towards the operative engine) results in moderate sideslip towards the inoperative engine that reduces climb performance (Figure 10). It also significantly increase VMCA as there is no horizontal component of lift to assist the rudder to counter the asymmetric thrust. In discussing this increase in minimum control speed as it related to the Cessna 441, the Civil Aviation Advisory Publication (CAAP) 5.23-1(2) Multi-engine aeroplane operations and training stated: …Flight tests in an instrumented Cessna Conquest showed that with a published VMCA [VMCA] of 91 kts, if the aircraft was flown in asymmetric flight with full power applied and the wings held level with the rudder balancing the aircraft, minimum control speed increased to 115 kts, an increase of 24 kts. › 17 ‹ ATSB – AO-2017-057 Figure 10: Rudder-only input Source: United States Federal Aviation Administration Opposing asymmetric thrust using only aileron input results in a large sideslip towards the operative engine that also significantly reduces climb performance (Figure 11). Figure 11: Aileron-only input Source: United States Federal Aviation Administration › 18 ‹ ATSB – AO-2017-057 OEI rate of climb performance for given operating conditions can be determined using data published in the POH/flight manual. Achieving the published performance relies on use of the zero sideslip technique and configuring the aircraft for minimum drag. Considering the configuration and approximate weight of the aircraft at the time of the accident (see the section titled Weight and balance), the calculated OEI climb rate over a range of indicated airspeeds is shown in Table 1. Table 1: One engine inoperative climb performance for Cessna 441 at 3,950 kg Indicated airspeed (kt) Excess Thrust Horse Power (HP) Calculated climb rate (ft/min) 90 115.7 438 100 185.1 701 110 205.4 778 120 213.4 809 130 211.7 802 Source: ATSB analysis from aircraft certification data The OEI performance data indicated that XMJ was capable of achieving a positive rate of climb following departure from Renmark if sideslip and other sources of drag were minimised. Engine failure simulation Zero thrust Demonstration of OEI flight often involves simulating a failed engine by moving the power lever to a low power level rather than actually shutting down the engine and feathering the propeller. This method of simulation allows rapid normal power restoration. However, as detailed in the section titled Multi-engine aeroplane propellers, at low power settings the propeller will rotate due to the airflow rather than the engine, creating much higher drag than a feathered propeller. For that reason, a zero thrust power level is commonly set to overcome the drag associated with windmilling and more accurately simulate the low drag associated with a feathered propeller. Zero thrust varies depending on the engine type, airspeed, altitude and temperature. In a piston engine aircraft zero thrust is normally achieved by setting a manifold pressure that results in a specific propeller rpm. In a turbine propeller engine zero thrust is expressed as an engine torque, and in some cases rpm, for a particular airspeed (normally VYSE). Aircraft manufacturer’s procedures The Cessna 441 POH detailed two procedures for simulating an engine failure, however neither procedure involved the use of a zero thrust power setting. The first POH procedure was designed to practice management of an engine failure during the cruise phase of flight. The procedure involved retarding the power lever to the AIRSTART position and then shutting the engine down. In discussing the AIRSTART power lever position, the POH stated: The AIRSTART position does provide some forward thrust. This position is recommended as it allows the best exhaust gas temperature stabilization before shutdown and it is the lowest position which will prevent the fuel computer from tripping to manual mode during an airstart. If the power lever is retarded below the AIRSTART position and the fuel computer trips to manual mode, normal mode may be regained by advancing the power lever slightly and cycling the fuel computer switch to OFF then back to ON. The second procedure was designed to train pilots to handle an engine failure in the take-off configuration. This involved using a fuel interruption process to actually shut the engine down. This was achieved by momentary selection of the engine stop button which activated a solenoid › 19 ‹ ATSB – AO-2017-057 within the fuel control unit and cut off the fuel supply to the engine. In order to also simulate representative control forces during the exercise, the set up for the sequence involved: • extending the landing gear • extending the wing flaps to the take-off position • trimming the aircraft for a speed greater than the intentional one engine inoperative speed of 98 kt. This procedure directly referenced related guidance in the POH, applicable to the demonstration of VMCA, which stated: One engine inoperative procedures should be practiced in anticipation of an emergency. This practice should be conducted at a safe altitude (5000 ft AGL), with full power on both engines, and should be started at a safe speed of at least 98 KIAS. As recovery ability is gained with practice, the starting speed may be lowered in small increments until the feel of the airplane in emergency conductions is well known. It should be noted that as the speed is reduced, directional control becomes more difficult. Emphasis should be placed on stopping the initial large yaw angles by the IMMEDIATE application of rudder supplements by banking slightly away from the yaw. Practice should be continued until: (1) an instinctive corrective reaction is developed and the corrective procedure is automatic, and (2) airspeed, altitude and heading can be maintained easily while the airplane is being prepared for a climb. The POH did not contain any procedure relating to simulation of an engine failure during the actual take-off phase. Additionally, for Cessna 441 aircraft with the serial number 0173 onwards (not applicable to VH-XMJ) the POH, in reference to the ‘engine shutdown to simulate engine failure in takeoff configuration’ procedure (second procedure), explicitly stated “This procedure must not be practiced at an altitude below 5,000 ft AGL” Some of Rossair’s other Cessna 441 aircraft operated under this later POH, but the operators manual did not note a difference between the two handbooks. With respect to the change in the POH procedures applicable to serial number 0173 and onwards, the aircraft manufacturer advised that: • there was no material difference between the aircraft from serial numbers 0173 and onwards and the earlier serial numbers (0172 and prior) that necessitated a different method of simulating an engine failure in the take-off configuration • the statements in the earlier POH procedure that referenced the demonstration of VMCA have the same intent as the warning note in the POH for aircraft with serial numbers 0173 and onwards, which states this procedure must not be practiced at an altitude below 5,000 feet above ground level. Operator’s procedures Rossair’s operations manual contained information relating to simulated engine failures in both Part A (general operations) and Part C (training and checking). Part A of the manual stated: Simulated asymmetric flight is not to be carried out unless specifically authorised, and then only when accompanied by an authorised person. Asymmetric flight shall not be carried out when passengers are being carried and shall only be conducted on a designated training flight. Any engine failure simulation shall be conducted by closing the power lever to a position equivalent to zero thrust (Turbine) in accordance with Part C, or moving the mixture lever to the idle cut off position (Piston). For the purpose of training, simulated engine failures and the feathering of aircraft propellers shall only be conducted in VMC conditions. In addition, the aircraft shall be operating above 3000 ft AGL, unless the simulation or feather practice is specifically required during the approach and landing phase. › 20 ‹ ATSB – AO-2017-057 Following any practice engine shut-down in flight, the engine controls must be set for an immediate restart. At no time are stalling or Vmca demonstrations to be made with the aircraft propeller feathered. Part C contained detailed information on the procedure for simulating engine failures in the Cessna 441 (Figure 12). However, the procedure varied from that outlined in Part A with regard to initial power settings and the height at which the simulation could be initiated. Part A detailed that engine failure simulation for training purposes was to occur above 3,000 ft above ground level unless specifically required during the approach and landing phase. Part C permitted the simulation of engine failure ‘After attaining the higher of 400’ or acceleration altitude’. The reference to ‘acceleration altitude’ was not applicable to the Cessna 441. Figure 12: Rossair training and checking manual Source: AE Charter/Rossair The Part C procedure involved retarding power to flight idle (power level to minimum) and then advancing the power to zero thrust (to represent a feathered propeller) on completion of the engine failure drills. This is the normal technique used for simulating the failure of a piston engine aircraft, where the pilot must manually feather the propeller. It is not necessary to select less than a zero thrust setting to simulate failure of a turboprop engine equipped with auto feather or negative torque sensing systems (such as the Cessna 441). More importantly, setting the power lever below the zero thrust setting will increase propeller drag. As detailed previously, selection of less than the AIRSTART power lever position in the Cessna 441 can also affect automatic operation of the fuel computer. An earlier version of the company operations manual detailed simulation of a failed engine on a turboprop engine by only moving the power lever to zero thrust. The ATSB could not determine how the procedure involving moving the power to below zero thrust was introduced into the 2016 version of the manual (in use at the time of the accident). However it may have occurred during the merger of Rossair with another company (see section titled Overview of the operator). Additionally, this section of the operations manual was approved by the Civil Aviation Safety Authority without detection of the error (see section titled Regulatory services processes). › 21 ‹ ATSB – AO-2017-057 Finally, the propeller manufacturer advised that for the four-bladed propellers fitted to XMJ, the required zero thrust setting was about 234 ft.lbs of engine torque, 116 ft.lbs less than stated in Part C of the operations manual. Regulatory guidance CAAP 5.23-1(2) Multi-engine aeroplane operations and training, provided comprehensive guidance on the operation of multiengine aeroplanes. With regard to the simulation of engine failures, it stated: Before simulating engine failures in multi-engine aircraft, instructors must be aware of the implications and be sure of their actions. Consult the aircraft flight manual or POH for the manufacturer’s recommended method of simulating an engine failure. The CAAP also provided guidance on setting power to simulate a failed engine. Specifically, it was recommended to initially close the throttle of a piston engine to replicate a windmilling propeller and then set zero thrust once the trainee had simulated propeller feathering. In the case of a turboprop engine, replication of an engine failure only required selection of zero thrust. Guidance was also provided on a method to establish zero thrust if it was not specified. The CAAP also detailed a number of risks associated with multi-engine training, including: • inappropriate management of complex aircraft systems • conducting flight operations at low level (engine failures after take-off) • conducting operations at or near VMCA or VSO [stall speed with undercarriage and flap selected] with an engine inoperative • asymmetric operations With regard to flight operations at low level, the CAAP further stated: Any flight operation at low altitude has potential dangers. Trainers have debated over the decades on the value of practicing engine failures after an actual take-off, near the ground. The general consensus is that despite the risks, pilots must be trained to manage these situations in multi-engine aircraft. …Instructors should consider not simulating engine failures below 400 ft above ground level (AGL) to provide a reasonable safety margin. Accident flight procedure There was insufficient information and recording devices to determine the specific procedure used to simulate the engine failure after take-off from Renmark Airport. However, the electronic briefing developed by the chief pilot in preparation for the occurrence check flight provided specific guidance on how engine failures were to be simulated as follows: • All failures will be preceded by the phrase “simulated” • Once the memory items have been carried out, zero thrust will be set • The instructor will handle the ‘failed’ engine • Pilot is to use other power lever as required • When landing, pilot may retard both levers as required Any failure not preceded with the phrase “simulated” is real and shall be treated as such. In preparation for the occurrence check flight, a practice flight covering similar sequences was conducted in XMJ the week before with the chief pilot and inductee pilot. That flight also had an observer on board with extensive Cessna 441 check pilot experience. The practice flight was not conducted as a training flight, but rather a private flight with two licenced and experienced pilots on board, preparing for their respective roles during the CASA check flight. The observer advised that during the practice flight, the engine failure was simulated by the chief pilot reducing the power lever but not all the way to the flight idle stop. He further recalled that once the inductee pilot completed the initial response actions, the chief pilot partially advanced the › 22 ‹ ATSB – AO-2017-057 power lever. The observer stated that, based on his experience, zero thrust in the occurrence aircraft was about 150 ft.lbs of torque and lower than other company Cessna 441 aircraft. He also recalled that the chief pilot set a power lever position at or slightly above that torque value during the simulation. Stall speed The calculated stall speed depends on the weight of the aircraft, as well as the gear and flap configurations, and the angle of bank. For XMJ, at the ATSB calculated take-off weight from Renmark Airport (3,950 kg), with: • gear and flap retracted • power at the flight idle, the calculated stall speed with wings level was 85 KIAS. At 20° angle of bank, the stall speed increased to approximately 88 KIAS. Flight recorders XMJ was not equipped with a flight data recorder or cockpit voice recorder. Requirements relating to the fitment of flight recorders is detailed in Civil Aviation Order (CAO) 20.18 as follows: An aircraft of maximum take-off weight: (a) In excess of 5,700 kg and which is: i. turbine powered; or ii. of a type first certificated in its country of manufacture on or after 1 July 1965; shall not be flown (except in agricultural operations) unless it is equipped with an approved flight data recorder and an approved cockpit voice recorder system; (b) Less than or equal to 5,700 kg and which is: i. pressurised; and ii. turbine powered by more than one engine; and iii. of a type certificated in its country of manufacture for operation with more than eleven places; and iv. issued with its initial Australian Certificate of airworthiness after 1 January 1988; shall not be flown unless it is equipped with an approved cockpit voice recorder system. The Cessna 441 has a maximum take-off weight of 4,468 kg so CAO 20.18(a) was not applicable. Additionally, although meeting a number of the criteria detailed in CAO 20.18(b), the Cessna 441 is certified for a maximum of eleven seats (two crew and nine passengers). The aircraft was therefore not required to be fitted with either a flight data recorder or a cockpit voice recorder. Recorded flight data As part of the investigation, data broadcast by the automatic dependent surveillance broadcast (ADS-B) equipment fitted to the aircraft was obtained from various web-based providers. Depending on the provider, this data recorded the following parameters at intervals of either 6 or 15 seconds: • latitude and longitude • time of the logged position • pressure altitude • groundspeed • track. › 23 ‹ ATSB – AO-2017-057 A review of the data identified that the aircraft descended outside ADS-B coverage as it approached the circuit area at Renmark Airport. Consequently, no ADS-B flight data was available for the departure of XMJ from Renmark. However, GPS data transmitted from an on board mobile device with the OzRunways application installed was able to be sourced. This data was available at 5 second intervals with the GPS altitude truncated to the nearest 100 ft and accurate to about -30/+130 ft of the recorded value. The OzRunways data parameters were compared with ADS-B information from earlier stages of the flight and was found to be consistent. That provided assurance that the OzRunways data was valid and could be relied upon for analysis of the final flight segment. Although the recorded parameters were considered representative of the actual flight profile, it was not possible to determine how they varied between sample points. Using the GPS groundspeed, and wind information obtained from the BoM, the aircraft’s true airspeed (TAS) was calculated. The TAS values were then converted to a calculated indicated airspeed (IAS) using altitude and temperature data. Given the relatively low operating altitude, the IAS varied only slightly from the calculated TAS. The airspeed and height above the ground variation over the final 1 minute of the flight, referenced to the elapsed time from take-off, is shown in Figure 13. Figure 13: Indicated airspeed and altitude variation over the final minute of flight Source: ATSB The data showed a steady increase in airspeed up to about 132 kt, followed by loss of airspeed, brief stabilisation around 110-115 kt, then a further decrease to about 107 kt before the data ended. The maximum recorded airspeed was about 10 kt higher than published OEI best rate of climb speed VYSE (120 kt, see the section titled Asymmetric performance) and occurred at a height of about 300 ft above ground level. That height was derived from the recorded GPS altitude of 400 ft less 100 ft for the approximate runway elevation (see the section titled Airport information). Noting that the GPS altitude was truncated to the nearest 100 ft and had an accuracy of about -30/+130 ft, a height of 300 ft above the ground was indicative of an actual height range between 270-420 ft above the ground. › 24 ‹ ATSB – AO-2017-057 Analysis of the indicated airspeed and height profiles indicated that, on attaining the minimum operator-specified conditions for initiation of a simulated engine failure, the variation in airspeed and altitude was consistent with a reduction in performance associated with OEI flight. The airspeed subsequently decreased below the target airspeed of V YSE and remained below that airspeed for the final 35 seconds of the data. The final airspeed value of 107 kt was above both the calculated stall speed (see the section titled Stall speed) and the published minimum control airspeed VMCA. However, it was below the VMCA range established during flight testing in the Cessna 441 (see the section titled Asymmetric performance). Figure 14 illustrates the difference in the calculated IAS and height (above ground level) profiles between the departure from Renmark Airport and the earlier departure from Adelaide Airport. Figure 14: Departure profile comparison Source: ATSB In addition to the airspeed variation, the aircraft’s rate of climb was derived from the GPS altitude data and is shown, together with the aircraft’s track deviation from the runway heading in Figure 15. The data indicated that the aircraft initially climbed at greater than the expected OEI rate of climb before levelling and maintaining approximately level flight for 30 seconds until the data ended. A review of the airspeed over the same time period identified that it reduced during the peak increase in the rate of climb, suggesting that the aircraft was pitched up to reduce airspeed. Analysis of the track variation identified that the aircraft deviated to the right of the runway centreline during the final minute of the flight. That movement was consistent with both the prevailing left crosswind component during the departure and a reduction in power on the right engine. › 25 ‹ ATSB – AO-2017-057 Figure 15: Rate of climb and track variation over the final minute of flight Source: ATSB Operational information Pilot licencing Each of the three pilots on board held a Civil Aviation Safety Regulations 1998 (CASR) Part 61 licence. CASR Subpart 61E requires that pilots meet a series of ongoing requirements in order to exercise the privileges of their licence. Relevant requirements are discussed below. Pilot recency requirements for carriage of passengers CASR Part 61.395 outlines the recent experience requirements that pilots must have in order to carry passengers. By day, this includes at least three take-offs and three landings within 90 days in the aircraft. A pass in a flight check meets this requirement. The Rossair operations manual (Part A) reflected the Part 61 requirements for landings and included the company recency requirements for conducting instrument approaches. Both of the pilots in the control seats met the recency requirements for the flight they were conducting. Class and type rated aircraft Under the regulations prior to CASR Part 61, particular aircraft required a pilot to be trained, endorsed and checked on that aircraft type in order to operate that specific type. Under Part 61, there are still some aircraft which come under this requirement (‘type rated aircraft’), such as the Embraer EMB 120, but other aircraft are included in a class rating (‘class rated aircraft’). This means that a check on any aircraft in the class rating covers all other aircraft in that class rating. Pilots must complete a flight review for the class rating every two years to continue operating aircraft in that class. The Cessna 441 is in the multi-engine class rating. However, the complexity of the aircraft is recognised by CASA, who requires that pilots that wish to operate the Cessna 441 first complete › 26 ‹ ATSB – AO-2017-057 flight training and a flight review in this aircraft type, before it becomes covered by the class rating in subsequent years. Other complex twin aircraft covered by this legislation include the Beechcraft King Air C90, King Air B200 and the de Havilland DHC-6 Twin Otter. As discussed previously (see the section titled Pilot licencing), the CASA FOI renewed his class rating in a Rossair Cessna 441 with the Cessna 441 fleet manager in late 2016. The inductee pilot completed his multi-engine class rating renewal along with his instrument proficiency check in a Beechcraft Baron 95-B55 in February 2017. The chief pilot had not been checked on a class rated aircraft, since his check pilot training was completed in the Cessna 441 (see the section titled Pilot licencing). In October 2016 he completed his instrument proficiency check (IPC) and type rating renewal in the EMB 120 simulator, which, at that time, under CASA exemption 97/16 satisfied the requirements for the multi-engine class rating renewal. Despite the EMB 120 being a two crew aircraft, and the Cessna 441 being a single pilot operation, the chief pilot was not required to demonstrate on-going competency in the Cessna 441, as long as he continued to be checked in the EMB 120. General competency CASR Part 61.385 ‘Limitations on exercise of privileges of pilots licences – general competency requirement’ states: (1) The holder of a pilot licence is authorised to exercise the privileges of the licence in an aircraft only if the holder is competent in operating the aircraft to the standards mentioned in the Part 61 Manual of standards for the class or type to which the aircraft belongs, including in all of the following areas:  Operating the aircraft’s navigation and operating systems;  Conducting all normal, abnormal and emergency flight procedures for the aircraft;  Applying operating limitations;  Weight and balance requirements;  Applying aircraft performance data, including take-off and landing performance data, for the aircraft. (1A) Subregulation (1B) applies if the holder of a pilot licence also hold an operational rating or endorsement (1B) The holder is authorised to exercise the privileges of his or her pilot licence in an activity in an aircraft under the rating or endorsement only if the holder is competent in operating the aircraft in the activity to the standards mentioned in the Part 61 Manual of standards (if any) for: (a) The class or type to which the aircraft belongs; and (b) The activity In assessing personal competency under this regulation, CASA recommended that ‘pilots should seek advice and consider refresher training or practice before commencing an operation they haven’t carried out for a while’. Although the pilot is already licenced and current on the class of aircraft, training for general competency can only be given by a pilot who holds an instructor rating and appropriate training endorsements. The check flight briefing (see the section titled Check flight sequences) prepared for the flight had a series of questions at the end of the briefing for the inductee pilot to answer, consistent with the areas of competency identified above. Additionally, the practice flight conducted by the two pilots the week prior was an opportunity to practice the handling skills in this aircraft rather than other aircraft flown by each of the pilots. Operational proficiency check A proficiency check is ‘an assessment of your skills and knowledge in a particular operational area. Pilots are required to undertake proficiency checks to ensure they continue to be competent › 27 ‹ ATSB – AO-2017-057 conducting particular kinds of operations’ (CASA Proficiency checks information sheet, 2018). CASA recognises that skill decay occurs over time, and that these checks are an on-going measure to ensure that the licence competencies specified in the CASR Part 61 Manual of Standards continue to be met (see the section titled Skill decay). Operational proficiency checks are carried out by an operator and may also include the elements required for an instrument proficiency check (IPC), provided the check pilot is authorised to conduct both types of check. The chief pilot in this case was being checked only for approval to conduct OPCs. Operational proficiency checks can only be conducted on pilots employed by that company. Operating under Civil Aviation Regulations 1988 (CAR) Regulation 217 (see the section titled Organisational structure) Rossair pilots had to pass two proficiency checks per year (listed in the operations manual as alternating between an IPC and OPC), with at least four months between checks, in order to exercise the associated privilege. As the inductee pilot was re-joining the operator, this was his first OPC in the Cessna 441 in over three years. The chief pilot had completed an: • OPC in the Cessna 441 in April 2016 in the left seat, and in May 2016 from the right seat, as part of his Cessna 441 check pilot training • IPC in the EMB 120 in October 2016, and an OPC in the EMB 120 simulator in February 2017. This met the regulatory and operator requirements for proficiency checking, but did not permit assessment of the chief pilot’s on-going competency in the particular area of single pilot operations. Practice engine failure after take-off check requirements The chief pilot was the pilot primarily being checked during the flight and he had to conduct the inductee pilot’s operational proficiency check in line with the company procedure to be approved as a check pilot. When a proficiency check is conducted under a CAR 217 approval, the exercises conducted are set by the CAR 217 holder rather than CASA. The Rossair operations manual Part C stated that proficiency checks were to be conducted in accordance with their own check assessment form and the CASA instrument proficiency check form. The company guidance was for check pilots to reference the section of the CASR Part 61 manual of standards for the instrument rating flight test. When an operator proficiency check is conducted without an instrument proficiency check, there is no CASA requirement for the candidate to demonstrate management of a simulated engine failure after take-off. The Rossair check assessment form however, had a required flight component to ’deal with a simulated engine emergency after take-off requiring an immediate re-landing’. There are a number of CASA checks which require demonstration of an engine failure after take-off in a multi-engine aircraft, both for initial issue of a licence or endorsement and during specific types of proficiency checks. The wording of the specified activity varies slightly between checks, for example ’conduct instrument departure (one engine inoperative)’ for the multi-engine class rating; or ’manage an engine failure after take-off (simulated)’ in the multi-engine class rating. While the wording varied, the competencies are all similar in intent: requiring the pilot to manage the simulated failure while maintaining the aircraft within specified tolerances; and configuring and flying the aircraft to achieve the best performance. While the manual of standards does not specify a height at which these activities should be conducted, CAAP guidance stated that they should not be conducted below 400 ft above ground level. The requirement of managing an engine failure during an instrument departure or after take-off, could be interpreted as meaning that these activities should to be conducted at low altitude. However, there was no direct comment in any CASA guidance that this is required. › 28 ‹ ATSB – AO-2017-057 The flight Background The chief pilot’s approval instrument had a conditional requirement that an additional pilot had to be either employed or contracted to Rossair as a fleet manager on the Cessna 441 (see the section titled Organisational structure). Due to an unexpected temporary loss of his medical approval, the fleet manager became unable to conduct flying duties for Rossair, and was therefore unable to fulfil the full fleet manager role, which included check flight responsibilities. To resolve this issue, the chief pilot wrote to CASA to request a variation to his chief pilot instrument of approval, to remove the requirement for a Cessna 441 fleet manager. It was intended that the fleet manager would continue in an administrative fleet manager role, and a contract Cessna 441 pilot would be used for on-going check and training responsibilities, with the chief pilot maintaining oversight responsibilities only. The proposed contract pilot was known to CASA, and had been given permission to carry out two OPC checks for Rossair in April 2017 while there was no company check pilot. In response to this request, CASA proposed that the chief pilot should be checked in the aircraft conducting an OPC on a company pilot. This check would give the chief pilot approval to conduct OPCs and line checks. The approval would then allow him to undertake the Rossair induction process with the contract Cessna 441 pilot, before the contract pilot began all checks on company pilots. Check flight sequences The chief pilot developed an electronic briefing, in preparation for the occurrence check flight, which included specific detail of the ground and flight components to be conducted. The briefing detailed the following two flight exercises: Flight exercise #1 • Normal departure via SID [standard instrument departure from Adelaide Airport] • Fly to • Holding pattern, engine failure - Conduct memory items then checklist - Radio calls, passenger brief • RNAV approach - Single engine • Visual then go around on final - Single engine • Single engine circuit and landing Flight exercise #2 • Normal take-off [from Renmark Airport] - Engine failure above 400’ o Conduct memory items and checklists o On base,14 engine will be restored - Climb to 8000’ - Steep turns - Partial panel - Stall o Clean o Approach configuration - Two engine instrument approach at Adelaide. 14 See the section titled Circuit operations. › 29 ‹ ATSB – AO-2017-057 While the pre-check briefing was not witnessed by anyone other than the participants, surveillance data and radio transmissions indicated the accident flight was conducted as per the briefed flight exercises, except that no single-engine go around was performed on arrival at Renmark. An observer on board the aircraft during the preparatory practice flight the week before reported that the briefed sequences, including a practice engine failure after take-off from Renmark Airport, were undertaken. With regard to that sequence, the second flight exercise detailed that following a normal take-off and simulated engine failure above 400 ft above ground level, ‘memory items and checklists’ were to be conducted. These memory items, also known as ‘phase one’ checks, were detailed in the company operations manual for the Cessna 441 as follows: 1. Engine power ADJUST as required 2. Inoperative engine DETERMINE a. Condition lever EMERGENCY SHUT OFF b. Firewall shut off PUSH to close 3. Landing gear UP 4. Flaps UP above 115 knots The memory checks duplicated the initial response actions detailed in the POH checklist for an engine failure above the minimum control airspeed, VMCA (see the section titled Asymmetric flight) (Figure 16). Figure 16: POH engine failure checklist Source: Cessna 441 Pilot’s operating handbook In the event of an actual engine failure, the briefing detailed that the ‘[inductee] Pilot is to continue operating the aircraft unless the instructor [check pilot] elects to take over with the phrase “Taking Over”.’ and that the check would then be terminated and the aircraft landed at an appropriate airport. › 30 ‹ ATSB – AO-2017-057 The briefing also outlined the following process for transitioning control of the aircraft between the chief pilot and inductee pilot: • Control over aircraft is to be conducted with the “handing over, taking over” phrase. • If at any time, the instructor announces “taking over”, the pilot shall: o Remove hands and feet from all controls’ o Respond “handing over”. • To pass control of aircraft to pilot, instructor shall announce “handing over”. The pilot shall: o Place hands and feet on the controls, o Respond “taking over”, o Be responsible for operation of the aircraft. The briefing also specified the required test flight tolerances from the Civil Aviation Safety Regulations 1998 Part 61 Manual of Standards, including for asymmetric flight (Figure 17). In detailing the objectives of the proficiency check, with regard to flight tolerances the briefing also stated: “a sustained deviation outside of the applicable flight tolerance is not permitted”. Figure 17: Required flight accuracy tolerances Source: Rossair Carriage of passengers during practice emergency procedures Regulation 249 of the Civil Aviation Regulations 1988 prohibited the carriage of passengers on board an aircraft during the practice of emergency procedures, such as simulated engine failures. CASA issued exemption EX74/15 which, under certain circumstances, permitted a passenger to be carried if the pilot in command - being either a check pilot, approved testing officer of flight examiner - carried out a proficiency check or flight test on another pilot. This exemption permitted the chief pilot to be carried as an observer on three check flights during his Cessna 441 check pilot training (see the section titled Check pilot training). The exemption at the time did not explicitly refer to carriage of CASA FOIs, outside permitting them to be carried during their training in connection to become a flight examiner or inspector. Following this accident, CASA issued exemption EX58/19 – Carriage of passengers on proficiency check and flight test flight instrument 2019 - which clarified the previous exemption, clearly stating that a CASA officer could be carried as a passenger for duties directly relating to the conduct of the flight test or proficiency check. The explanatory statement for this exemption stated ’the pilot in command must ensure that the passenger does not interfere with the conduct of the proficiency check of flight test. The passenger must not occupy a control seat’. Flying operations inspector seated in non-control seat During the accident flight, two checks were being conducted simultaneously – the OPC on the inductee pilot, and the check pilot approval on the chief pilot. Therefore, the CASA FOI was not occupying a control seat for the flight. The CASA flying qualification and training handbook (2016) stated the conditions with which a CASA FOI may sit in an observation seat: › 31 ‹ ATSB – AO-2017-057 A CASA inspector may conduct an assessment from an observation seat where that seat is in the immediate vicinity of the operating crew (e.g. a jump seat). The observation seat must have a reasonably unrestricted view of the flight crew and instrumentation. Where an assessment from an observation seat occurs, suitable communication facilities must exist to permit the inspector to both monitor and communicate with the flight crew. Where an inspector has a general exposure level of capability and is conducting an assessment from an observation seat, the inspector must have sufficient general exposure to ascertain that the operational activity is being planned and conducted safely and within the performance capabilities of the aircraft; and the competency of the person(s) being observed. When making an assessment from an observation seat, the inspector must ensure (prior to flight) that the person acting as pilot in command is qualified and meets recency requirements (i.e. is qualified and proficient to conduct the activity required) When conducting an inflight assessment a CASA inspector must wear a seatbelt where required by the regulations to do so. A CASA inspector conducting an assessment from an observation seat shall conduct a pre-flight brief. There is no jump seat15 in a Cessna 441 aircraft, so the CASA FOI sat in the first row passenger seat, on the left side of the aircraft, behind the inductee pilot (Figure 18). From the seated position, he should have had some visibility of the chief pilot, and the controls and instruments, but was not likely to be able to read the instruments precisely. Figure 18: Exemplar Cessna 441 in a similar configuration to the accident aircraft Source: Rossair, annotated by ATSB The aircraft intercommunication system did not allow the FOI to share communications or monitor exchanges between the pilots via headset. A briefing sheet found in the FOI’s documents indicated that if he had a safety concern he would tap the chief pilot on the shoulder, with the chief pilot responding when ready. While the noise within the aircraft is relatively high, it was reportedly not prohibitive to communication. However, as both of the other pilots were using headsets, this may have affected their ability to hear any verbal intervention by the FOI. Additionally, the volume of any spoken communication between the inductee and chief pilot would not have taken account of the ambient cabin noise and that may have increased the difficulty for the FOI to monitor communication between them. Reports from other Cessna 441 pilots indicated that it was not unusual to have an FOI or other check pilot sitting in the front row passenger seat. This was the same seating positions as the 15 Extra seat in cockpit or on flight deck not required by flight crew, but possibly occupied by an authorised crewmember. › 32 ‹ ATSB – AO-2017-057 practice flight conducted by the inductee pilot and chief pilot, along with the former Cessna 441 company check pilot, the week prior. The FOI likely knew that the two pilots had conducted a practice flight the week before the test flight, and therefore considered that they were prepared for the planned flight. The practice flight and the planned flight were relatively similar, with the main difference between the flights being the presence of the FOI rather than the former Rossair Cessna 441 check pilot. Of the three occupants, the CASA FOI had the most experience on the Cessna 441 overall, both in flying and in a check pilot role. He was the pilot on board with the most recent operational proficiency check in the aircraft type, albeit not with the most recent operational experience. In the investigation into the in-flight uncontained engine failure of QF32 in 2010 (ATSB report AO-2010-089), it was stated ’the additional flight crew that were present on the flight deck during the accident flight were resources available to provide support to the primary flight crew of the captain and the first officer...’. While the set-up of this flight was different from that on QF32, the FOI was an available resource knowledgeable about the aircraft type, had a problem arisen with the aircraft. Following this accident, CASA issued an exemption instrument EX83/18 – Occupation of flight control seat (certain flight instruction and examination activities) Exemption 2018 - which permitted the FOI to conduct the flight examination activity while not occupying a control seat, as each of the pilots in the control seats were licenced to fly the Cessna 441. Some points in this exemption were: • In relation to a flight in an aircraft that is not a single-place aircraft, an authorisation holder conducting a relevant flight examiner activity, when occupying a seat that is not a flight control seat: o Must be located at a place on the aircraft that enables the authorisation holder to observe all the matters to be demonstrated by each flight crew member occupying a flight control seat; and o Must not manipulate any aircraft control or system accessible from a flight control seat • An authorisation holder conducting a relevant simulator instructor activity or a relevant flight examiner activity, when not occupying a flight control seat must ensure that at all times during the activity they can: o Monitor flight crew member use of radiocommunications systems; and o Maintain 2-way communications with the flight crew members. Cessna 441 simulator At the time of writing, there was no Cessna 441 simulator in Australia, or any foreign Cessna 441 simulator approved by CASA for use by Australian pilots. In assessing the availability of simulators in Australia, the only CASA-approved simulator which fell into the same multi-engine class rating as the Cessna 441 was the King Air B200 simulator. However, as the B200 is another aircraft like the Cessna 441 which requires an initial type rating (under Part 61 Schedule 13) before it becomes covered by the multi-engine aircraft class rating, it cannot be used directly without training. Additionally, there are significant differences with the B200 aircraft such as auto-feathering (compared to the Cessna 441 negative torque sensing system) and rudder boost. Those differences may affect the training effectiveness between the aircraft types and introduce an adverse response to an emergency situation. In February 2020, CASA identified the absence of an available simulator as a factor which increased risk in this accident. › 33 ‹ ATSB – AO-2017-057 Check pilot training Role of a check pilot A check pilot is defined by Civil Aviation Orders 82.0 as ‘a person approved by CASA to conduct flight training and proficiency checks’. A check pilot approval is the company equivalent of a flight examiner operating under the CASR Part 61 regulations. Part C of the Rossair operations manual required company check pilots to meet the same standards as flight examiners. Under CASR Part 61 flight examiners must hold a flight instructor rating, whereas under CAR 217 (see the section titled Organisational structure) – ‘a pilot may conduct tests or checks for the purposes of an approved training and checking organisation without being the holder of a flight instructor rating’. This means that a company check pilot is not required to demonstrate the same skills in instructing as a flight examiner, but they are expected to have similar competencies. The reason for this difference is that ‘the primary role of the CAR 217 organisation is the maintenance of competency for flight crew members’ (CASA CAAP 217, 2015), rather than the initial issue of a rating or endorsement for flight crew. In this case, all pilots on board held, or had held, some level of instructor rating. The chief pilot’s check pilot training The Rossair manual stated the phases required in the training of a check pilot: 1. Flight training in the handling of engine failures and other emergencies while operating from the right hand seat. The training/check pilot undergoing training shall reach a standard whereby he/she can safely handle engine and propeller malfunctions while in the right hand seat 2. A minimum of 6 line flights (sectors) under the supervision of the check pilot. 2 sectors shall be operated with the training/check pilot under training in the left hand seat and 4 sectors with him/her in the right hand seat. The training/check pilot under training shall reach a standard whereby he/she can adequately demonstrate normal line flying techniques from either seat/ 3. Receipt of a thorough briefing from the nominated check pilot or the chief pilot on all aspects of training and checking on the particular aircraft type 4. Ground and flight training in the methods of simulating engine failures including the assessment of a student’s performance following a simulate engine failure and control of student errors. The training / check pilot under training shall be able to satisfactorily demonstrate from the right hand seat, the following: • Rejected take-off • Engine failure after take-off • Single engine circuit and landing • Singe engine circling approach • Singe engine missed approach 5. Pass a type specific proficiency check from the right hand seat. The chief pilot underwent training as a check pilot on the Cessna 441 during April and May 2016. Training records confirmed that he completed all training in accordance with the operations manual procedure. Comment made on the training records indicated the chief pilot achieved a ‘high standard with simulated engine failures’. At the time, the intention of this training was not for the chief pilot to become a main Cessna 441 check pilot, but rather to be a secondary check pilot available to check the primary Cessna 441 check pilot. This is a recommended practice, included in the CASA Air Operator’s Certificate handbook (Volume 2 – Flying operations) as it is the minimum number which allows each pilot to maintain competency checks. › 34 ‹ ATSB – AO-2017-057 CASA recognised the training the pilot undertook as sufficient for undertaking an assessment to conduct OPCs. As confirmed by CASA to the chief pilot via email prior to the flight, approval to conduct IPCs would require a separate approval under CASR Part 61.040, which would need to be applied for and assessed separately. The chief pilot submitted his self-recommendation for CASA assessment as a Cessna 441 check pilot, on 30 May 2016. This recommendation was not formally assessed at the time of submission (see the section titled Regulatory services processes). CASA observations of the chief pilot’s flying In June 2016, the same CASA FOI was on board the aircraft with the chief pilot and the Cessna 441 fleet manager, for the fleet manager’s OPC. This was listed in the CASA regulatory services records for Rossair. The proficiency check paperwork for the fleet manager was completed by the chief pilot, listing himself as check captain. The CASA FOI also made observational comments and signed the document. Flight and duty records indicate that the chief pilot and the fleet manager were in the two control seats for the flight. However, there is no indication that the FOI reviewed or assessed the chief pilots check pilot skills at this time. The chief pilot was also recommended by the EMB 120 fleet manager as competent in the check pilot role in January 2017. Unlike the Cessna 441 recommendation in May 2016, this recommendation accompanied an official request for regulatory approval from CASA. While not being an official assessment by CASA, a CASA FOI observed the chief pilot completing an OPC in the EMB 120 simulator in February 2017. The chief pilot passed the OPC, however the CASA FOI raised a concern with another CASA staff member and the chief pilot about his performance, which was considered below his previous observed performance, and not of a suitable standard to monitor and assess a trainee candidate. The FOI expressed the opinion that the known high workload of the chief pilot was affecting his personal flying skills and potentially his ability in the assessor role. The accident assessment flight was reported by CASA to also be a follow up observation of the chief pilot’s performance. Time period between training and assessment In Australia there is no limit on the elapsed time between a pilot being trained in an activity, and testing for licencing in that activity. For the chief pilot, there was a year between his assessment by the fleet manager as ready for assessment, and when the assessment with CASA occurred. He had not completed any more Cessna 441 check pilot specific training in this time. The chief pilot completed two flights as a check pilot in the year since being judged ready for assessment (Cessna 441 fleet manager’s OPC and a line check) and the practice test flight the week prior. All other flying he conducted in the Cessna 441 was in the role of line pilot, and conducted as single pilot operations. By contrast, in the United Kingdom, pilots being assessed for class, type, instrument rating, or proficiency checks in single pilot aircraft must complete their skills test ’within a period of 6 months preceding the application for the issue of the class or type rating training course and with a period of 6 months preceding the application for the issue of the class or type rating’ (CAA, 2014). As part of the temporary management instruction issued after the accident (see the section titled Safety issues and actions) CASA implemented a 28 day maximum between the recommendation for checking post training and checking. Skill decay The CASA CAAP 5.23-1(2) (see the section titled Regulatory information) stated: Any pilot qualified to operate a multi-engine aircraft may shutdown an engine in flight. However, CASA strongly recommends that this only be done with a qualified flight instructor present, as there is a › 35 ‹ ATSB – AO-2017-057 likelihood for errors and engine mismanagement. Flight instructors regularly practice this procedure and are less likely to cause problems Furthermore, the CAA