DHC2, manoeuvring, Jerusalem Bay north of Sydney Australia, 2017
DHC2, manoeuvring, Jerusalem Bay north of Sydney Australia, 2017
On 31 December 2017, a de Havilland DHC2 floatplane being manoeuvred at low level over Jerusalem Bay shortly after takeoff was observed to enter a steeply banked turn from which it appeared to depart controlled flight and impact the water surface below almost vertically. The Investigation concluded that the aircraft had stalled despite the exemplary proficiency record of the pilot and that in the absence of any other plausible explanation found that the loss of control was likely to have been the effect of an elevated exposure to carbon monoxide found during post mortem toxicology testing.
Description
On 31 December 2017, a de Havilland DHC2 floatplane (VH-NOO) being operated by Sydney Seaplanes on a private charter flight from Cottage Point to Rose Bay was observed to depart controlled flight in day VMC and impact the water below whilst making a steep low level turn shortly after taking off from Cottage Point. The aircraft was destroyed and the six occupants were fatally injured.
Investigation
An Investigation into the Accident was carried out by the Australian Transport Safety Bureau (ATSB). In the absence of any recorded data for which devices were not required to be fitted to aircraft under 5,700 kg, the investigation was obliged to rely on witness statements and CCTV, video and photographic evidence. The latter included 22 pictures which “were consistent with having been taken from the front right passenger seat” and covered the taxi, takeoff and initial climb "through either the front windscreen or the front right passenger window”.
What Happened
Prior to the departure of the accident flight, the pilot had begun his day by flying the accident aircraft from Rose Bay, making two sightseeing flights followed by a 20 minute flight from Rose Bay to Cottage Point with the five passengers who would later board the aircraft to return to Rose Bay on what turned out to be the accident flight. He then flew two return trips from Cottage Point to Rose Bay. On arriving back at Cottage Bay, there was just over an hour until the agreed time for the party of five he had earlier brought from Rose Bay to return there so he shut down the engine and walked to the nearby kiosk to get some food and a drink. Whilst there, he received a call from the operator asking him to move the aircraft off the single birth pontoon to which it was moored to allow the operator’s other DHC-2 to fly in and pick up other passengers.
He therefore returned to the aircraft, started the engine and taxied clear of the pontoon into Cowan Creek (see the illustration below). A few minutes later, the other aircraft arrived and occupied the pontoon for around 25 minutes after which he was able to taxi back to the pontoon ready to board his passengers. The taxiing to, around and back from Cowan Creek meant the engine had been running for “up to 27 minutes” by the time it was again shut down. It was noted that during this taxiing, CCTV footage showed the pilot’s door had been ajar.
The passengers subsequently boarded and the aircraft taxied away from the pontoon back to the designated takeoff area in Cowan Creek. Takeoff was made in a north north-easterly direction and the aircraft became airborne before passing abeam Cowan Point. It climbed straight ahead before making a right hand orbit at an estimated (from passenger photographs) bank angle of 15-20° and at a height of around 100 feet. The aircraft was then observed by several witnesses to head directly towards and into Jerusalem Bay whilst flying level or in a slight descent below the height of the surrounding terrain, an unusual but not prohibited flight path. Witnesses also reported hearing the aircraft engine at this time and considered the sound to be “constant and normal”. The aircraft was seen continuing along the southern shoreline before suddenly entering a steep right turn at low-level. Part-way through this turn, the aircraft nose was seen to suddenly drop before the aircraft hit the water, about 95 metres from the northern shore after which it came to rest inverted and with the cabin submerged. The entire tail section and parts of both floats could initially be seen above the waterline, but within about ten minutes, the wreckage was completely submerged. With an impact speed estimated to have been around twice that considered survivable, all occupants sustained fatal injuries.
The aircraft ground track from the Cottage Point pontoon until entering Jerusalem Bay. [Reproduced from the Official Report]
The aircraft ground track within Jerusalem Bay. [Reproduced from the Official Report]
The aircraft wreckage was subsequently recovered and a detailed examination established that “the angle measured from the deformation of the engine and forward fuselage was consistent with a high angle of attack when the aircraft impacted the water”. It was concluded that, combined with the sudden change to a nose down pitch observed by multiple witnesses, this was consistent with an aerodynamic stall from which at such a low height, recovery would have been impossible.
The Pilot
It was established that the Pilot, who had begun flying in Canada in 1997, had a total of 10,672 hours flying experience with the majority, at least 9,000 hours, being on floatplanes including float equipped version of the Cessna 172,182, 185, 206 and 208 and on de Havilland Canada DHC-2 and DHC-6. The latter had included three years ending in the May of 2017 flying the DHC6 in the Maldives, on return from which he had begun working for Sidney Seaplanes, completing about 112 hours on the operator’s two DHC-2 aircraft and about 269 hours on their amphibious Cessna 208. Prior to his recent three years in the Maldives, he had also been employed by Sydney Seaplanes and in a 2.5 year period had recorded almost 800 hours flying in the operator’s two DHC-2 aircraft.
With this background, he was familiar with both the operation of the aircraft type involved and with its operation from Cottage Point, from where the aircraft operator estimated he had made at least 780 flights, the majority in one of the operator’s DHC-2 aircraft. Earlier on the day of the accident flight, he had completed seven short flights in the accident aircraft totalling around 2 hours in the air and which had included two flights from Cottage Point. During the previous three days, he had flown 8:40 hours all in an amphibious variant of the Cessna 208.
The aircraft operator’s Chief Pilot stated that “the pilot had good aircraft handling skills and was conservative with his decision-making” and a previous Chief Pilot indicated that he had considered him to be "a reliable, steady operator who did not take risks and had a very strong attitude to safety”. The Pilot was described by his work colleagues as being “very diligent and methodical, very meticulous and always correcting small things and overall a safe pilot who had all the experience behind him (and) had no issues with grounding an aircraft” (if its airworthiness was in any way in doubt).
The Aircraft Operator and Pilot Training
Although Sydney Seaplanes held a regulatory approval as a pilot training and checking organisation, this was a not a requirement and had been continued voluntarily after their previous provision of a regular public transport service between Rose Bay and Newcastle, which did require this approval, ceased. This meant that they had continued with a training and checking regime which included annual and biannual checks.
On his return to Australia in May 2017, the accident aircraft pilot had successfully completed all required (comprehensive) training and checks on both the DHC-2 and Cessna 208 amphibious aircraft. An OPC (Operator's Proficiency Check) flight was conducted to a number of locations including Cottage Point and covered emergency actions such as simulated engine failures after which the Pilot was rated highly. A further check to achieve Authorised Landing Area (ALA) status for various locations including Cottage Point assessed his preparation for flight, route knowledge, consideration for wires, water depths/channels, tidal effects and awareness of en route facilities such as communications and emergency services and recorded a high standard of proficiency.
A low-level manoeuvring proficiency check was also completed and assessed as being at a high standard and included:
- level steep turns in cruise configuration
- climbing steep turns in takeoff configuration,
- descending steep turns in landing configuration
- missed approach and go-around
- stall and recovery in approach configuration
- manoeuvring at low-level after takeoff and before landing.
Other training completed included:
- NOTECHS (non-technical) skills training in communication, situational awareness, decision making and workload management, emergency procedures training on both the DHC-2 and Cessna 208
- flight crew dangerous goods and non-dangerous goods course
- engine compressor/turbine water wash course
- fuel barge training
- a regulatory training module on alcohol and other drugs ‘managing risk’ human factors flight operations refresher training in October 2017 which included information acquisition and processing, decision making, health, fatigue and stress and operator incidents
It was noted that the Australian regulatory syllabus and standards for the holder of a professional pilot licence “have long included the requirement for pilots to be aware of the sources, symptoms, effects and treatment of carbon monoxide poisoning” and that as there was a similar Canadian requirement, it was considered “very likely that the Pilot would have been aware of this hazard”.
The Aircraft and Its Airworthiness
The accident aircraft was of predominantly metal high construction, manufactured in 1963 and first registered in Australia in 1964. It was powered by a Pratt & Whitney nine-cylinder, single-row, air-cooled radial engine, which drove a Hartzell HC-B3R30-4B three-bladed propeller. In 1999, the original undercarriage was removed and floats, auxiliary vertical fins and a water rudder steering system were fitted. Ventilation was by circular vents in both front fixed side windows and by opening the cockpit side sliding windows which could be secured in position by a friction lock mechanism. Two roof air vents were installed in the rear part of the six-passenger cabin (the seventh passenger seat was to the right of the pilot) but there were no such vents at the front of the passenger cabin.
Inspection of the engine exhaust system noted that the exhaust from each of the nine cylinders was collected in two manifold assemblies in which the individual sections were joined by sleeves which it was informally suggested were “generally not completely sealed”. The manifold assemblies from each half of the engine were joined just prior to the tailpipe which was located on the lower right side of the engine bay.
Apart from Daily Inspections, the required maintenance schedule involved ‘A’ Checks of the engine, airframe and floats every 50 hours and more comprehensive ‘B’ Checks of the engine and airframe every 100 hours or 6 months. There were also “numerous other specialised inspections” as well as a requirement to comply with the appropriate ADs and regulatory Orders. A routine ‘A’ Check had been carried out three weeks prior to the accident and the most recent ‘B’ Check had been completed just over 7 weeks prior to the accident. The latter had incorporated a scheduled engine change which required certification that the engine exhaust system had been thoroughly inspected and both the exhaust flange gaskets and the exhaust ‘ring’ and heater gaskets had been replaced. It also required that an inspection of the main firewall for cracks or structural damage must be performed. It was noted that removable panels in the firewall were used to access the magnetos, but that as the magnetos had already been installed on the replacement engine, they had not been accessed via the firewall panels. It was found that these panels were in any case not always inspected during a ‘B’ Check unless an apparent issue with their function had been reported. It was noted by the assigned MRO ((maintenance, repair and overhaul company) that there were other much smaller access panels in the firewall including those for mechanical engine controls.
Following the finding of abnormally high Carbon Monoxide (CO) levels during post mortem toxicology tests on the accident flight occupants (see the next section), a detailed testing programme using another DHC-2 was conducted. This demonstrated that either a simulated exhaust leak or a missing magneto access panel bolt did not result in elevated high levels of CO in the cabin on their own but the simulated exhaust combined with missing magneto access panel bolts did do so. In this case it was demonstrated that the CO “was more evident at the pilot’s position and was exacerbated when the pilot’s door was ajar with a simulated exhaust leak source in the engine bay”. These cabin CO levels were reduced by more than 80 percent when the access panel bolts were reinstalled with the exhaust leak remaining. It was noted that a gasket was bonded to each magneto access panel and that the panel was to be secured to the main firewall using four bolts of a type specified by the OEM inserted into a self-locking metal nut plate. It was also noted that there was no requirement for the bolts to be torqued to a specific value and they were therefore to be used in accordance with standard practice using proper judgment to avoid a collapsed fitting and ensure a tight joint. It was demonstrated that air containing CO would have been able to enter the cabin through the bolt holes and noted that the normal pressure differential between the engine/accessory bay and the cabin would have accelerated this flow. It was also accepted that additional CO ingress could have occurred because of the deteriorated gaskets and noted that because of damage caused by the accident, the possibility that there were other breaches in the firewall could not be eliminated.
Examination of the wreckage revealed that both magneto access panels were not properly secured and based on recently recorded maintenance it appeared that they had probably not been removed and refitted for some considerable time. The left (pilot’s side) panel had only two of the required four securing bolts fitted in diagonally opposite positions, both of which had ‘butterfly’ head modifications to permit tightening by hand, one of which was “an unidentified wing-head screw with a narrowed (necked) shank”. The gasket “was present and bonded to the panel but was noted to be in a deteriorated condition” and tests led to the conclusion that both the securing bolt and screw had been subject to excessive shank wear in service. The right side panel was found to have had three of the required four bolts installed at the time of the accident but one of these was not recovered. One of the two recovered bolts was consistent with the required bolt but with a ‘butterfly’ modification welded to the head but the other was a stainless steel cross-head screw, similar to those used on the aircraft instrument panel. The installed gasket on this panel was also in a deteriorated condition.
The two magneto access panels, gaskets and bolts with a sample of the specified AN3 bolt. [Reproduced from the Official Report]
It was found that the butterfly-modified bolts prevented the use of a spanner to tighten them as intended. It was also found by examination of the magneto access panels on three other DHC-2 aircraft which had also been maintained by the same MRO as the accident aircraft that both missing bolts and butterfly head bolt modification were not uncommon.
It was noted that whilst there was no associated regulatory requirement, the aircraft instrument panel just to the left of the pilot was fitted with a single use Carbon Monoxide (CO) chemical spot detector which had a 12 month life once installed. This had a use-by date of 1 April 2018 on the back.
Post Mortem Toxicology Tests
Tests on all the deceased deemed reliable showed that they had, to varying degrees, elevated levels of Carbon Monoxide (CO) in their blood, the Pilot having the highest at 11% and two of the passengers having concentrations which were almost as high. Whilst smoking was known to be a cause of concentrations of CO in the blood well above the typical endogenous levels of up to 3%, the Pilot was a non-smoker and could be confirmed to have had no recent exposure to passive smoking. However, given that examination of the wreckage had found a breach in the firewall close to the pilots seated position and he had flown six earlier flights in the same aircraft that day, an increased level of CO could be expected. What might have then increased it was the fact that just prior to the accident flight nearly half an hour taxiing with his door open. The fact that all occupants had, at least to some extent, abnormally high levels of CO in their blood was considered as indicating an aircraft source, with the variation between passengers attributable to the pattern of air circulation within the cabin and variation in individual physiology such as breathing rate.
An indicative scale of the potential human performance consequences of elevated levels of blood CO was presented by the Investigation to illustrate the scale of impairment relative to the levels found in the three most affected occupants.
A generalised depiction of the adverse health effects of elevated CO levels. [Reproduced from the Official Report]
A review of the CO test results by a forensic and aviation pathology specialist in the context of the other post mortem findings and the circumstances of the accident concluded that “it was very likely that CO was present in the aircraft cabin”. They noted that “the physical symptoms and cognitive effects of CO exposure generally start to occur at a level of around 10% and will become more severe as the level of CO increases and/or the duration of exposure increases". The view was taken that in this case, the Pilot would have almost certainly been experiencing some associated symptoms and that the two passengers with CO levels which were almost as high as the Pilot’s would also have been experiencing symptoms, possibly to the extent of creating a distraction. While accepting that the Pilot’s elevated CO level was not fatal, the specialist considered that it was “certainly capable of resulting in pilot incapacitation in the form of headaches, nausea, confusion, disorientation, and visual disturbance”.
Eight Contributory Factors which had led to the accident were formally identified as follows, one of which was classified as a ‘Safety Issue’:
- The aircraft entered Jerusalem Bay, a known confined area, below terrain height with a level or slightly descending flight path. There was no known operational need for the aircraft to be operating in the bay.
- While conducting a steep turn in Jerusalem Bay, it was likely that the aircraft aerodynamically stalled at an altitude too low to effect a recovery before colliding with the water.
- It was almost certain that there were elevated levels of Carbon Monoxide in the aircraft cabin, which resulted in the pilot and passengers having higher than normal levels of Carbon Monoxide in their blood.
- Several pre-existing cracks in the exhaust collector ring, very likely released exhaust gas into the engine/accessory bay, which then very likely entered the cabin through holes in the main firewall where three bolts were missing.
- A 27 minute taxi before the passengers boarded with the pilot’s door ajar likely exacerbated the pilot’s elevated blood Carbon Monoxide level.
- It was likely that the pilot's ability to safely operate the aircraft was significantly degraded by Carbon Monoxide exposure.
- Disposable chemical spot detectors, commonly used in general aviation, can be unreliable at detecting carbon monoxide in the aircraft cabin. Further, they do not draw a pilot's attention to a hazardous condition, instead they rely on the pilot noticing the changing colour of the sensor.
- There was no regulatory requirement from the Civil Aviation Safety Authority for piston-engine aircraft to carry a Carbon Monoxide detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide in the cabin. [Safety Issue: AO-2017-118-SI-01]
Seven ‘Other Factors that increased risk’ were also identified, three of which were classified as ‘Safety Issues’:
- It was likely that the effectiveness of the disposable Carbon Monoxide chemical spot detector fitted to the aircraft was reduced due to sun bleaching.
- Although detectors were not required to be fitted to their aircraft, Sydney Seaplanes had no mechanism for monitoring the serviceability of the carbon monoxide detectors. [Safety Issue: AO2017-118-SI-02]]
- The in-situ bolts used by the maintenance organisation to secure the magneto access panels on the main firewall were worn, and were a combination of modified versions of the specified bolts and non-specific bolts. This increased the risk of the bolts either not tightening securely on installation and/or coming loose during operations.
- The operator relied on volunteered passenger weights without allowances for variability, rather than actual passenger weights obtained just prior to a flight. This increased the risk of underestimating passenger weights and potentially overloading an aircraft.
- The standard passenger weights specified in Civil Aviation Advisory Publication (CAAP) 235-1(1) ‘Standard passenger and baggage weights’ did not accurately reflect the average weights of the current Australian population. Further, the CAAP did not provide guidance on the use of volunteered passenger weights as an alternative to weights derived just prior to a flight.
- Australian civil aviation regulations did not mandate the fitment of flight recorders for passenger-carrying aircraft under 5,700 kg. Consequently, the determination of factors that influenced this accident and other accidents has been hampered by a lack of recorded data pertaining to the flight. This has likely resulted in the non-identification of safety issues, which continue to present a hazard to current and future passenger carrying operations. [Safety Issue: AO-2017-118-SI-03]
- Annex 6 to the Convention of International Civil Aviation did not mandate the fitment of flight recorders for passenger-carrying aircraft under 5,700 kg. Consequently, the determination of factors that influenced this accident and numerous other accidents has been hampered by a lack of recorded data pertaining to the flight. This has likely resulted in important safety issues not being identified, which may remain a hazard to current and future passenger carrying operations. [Safety Issue: AO-2017-118-SI-04]
Three ‘Other Findings’ were also formally documented as follows:
- It was very likely that the middle row right passenger did not have his seatbelt fastened at the time of impact but the reason for this could not be determined.
- The accident was not survivable due to the combination of the impact forces and the submersion of the aircraft.
- The pilot had no known pre-existing medical conditions that could explain the accident.
Safety Action taken in relation to the identified ‘Safety Issues’ whilst the Investigation was being conducted was noted as having included the following:
- The Civil Aviation Safety Authority issued an Airworthiness Bulletin recommending the use of electronic personal CO detectors in aircraft.
- Sydney Seaplanes added a serviceability check of the carbon monoxide detectors fitted to their aircraft into their monthly emergency equipment checklist.
Safety Action taken by the ATSB during the course of and related to the Investigation which was not associated with an identified Safety Issue included the issue of two ‘Safety Advisory Notices’. The first (AO-2017-118-SAN-001) reminded aircraft maintainers that thorough inspection of piston-engine exhaust systems and the timely repair or replacement of deteriorated components is the primary mechanism for preventing Carbon Monoxide exposure and, in combination with the assured integrity of the firewall, decreases the possibility of carbon monoxide entering the cabin. It also explicitly reminded maintainers of the importance of conducting detailed inspections of exhaust systems and firewalls, with consideration for potential Carbon Monoxide exposure. The second (AO-2017-118-SAN-002) reminded aircraft operators, owners and pilots that the use of an attention-attracting carbon monoxide detector in the cockpit provides pilots with the best opportunity to detect carbon monoxide exposure before it adversely affects their ability to control the aircraft or (they) become incapacitated. It therefore “strongly encouraged” operators and owners of piston-engine aircraft to install a carbon monoxide detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide in the cabin. In the event that these are not provided, pilots are encouraged to carry a personal Carbon Monoxide detection and alerting device.
Three Safety Recommendations were issued to address Findings made during the Investigation as follows:
- that the Civil Aviation Safety Authority takes further safety action to enable it to consider mandating the carriage of carbon monoxide detectors in piston-engine aircraft, particularly passenger-carrying operations. [AO-2017-118-SR-050]
- that the Civil Aviation Safety Authority considers mandating the fitment of onboard recording devices for passenger-carrying aircraft with a maximum take-off weight less than 5,700 kg. [AO-2017-118-SE-049]
- that since the International Civil Aviation Organisation, has not, given that it has developed technical standards for lightweight recorders and airborne image recorders and is aware of their known benefits for the identification of safety issues, required the fitment of such devices to passenger-carrying aircraft with a maximum take-off weight less than 5,700 kg, it takes safety action to consider (extending) the safety enhancement provided by these devices to passenger-carrying operations (in this category). [AO-2017-118-SR-048]
The 153 page Final Report was released on 29 January 2021.