On 22 August 2015, a Hawker Hunter T7 (G-BXFI) being operated by private company Cranfield Hunter which had just commenced a flying display routine at Shoreham UK after positioning from its base at North Weald for the purpose, crashed at high speed into traffic on a nearby and very busy public road in day Visual Meteorological Conditions (VMC). The aircraft broke up on impact and its destruction was completed by intense fires in parts of the wreckage. Eleven people on the ground were killed and 11 others on the ground sustained minor injuries. The pilot was seriously injured.
A Field Investigation was carried out by the UK AAIB. It took 18 months to complete and a series of interim reports were issued to report progress and make Safety Recommendations:
- Special Bulletin 3/2015, published on 4 September 2015, 13 days after the accident, reported initial information about the occurrence.
- Special Bulletin 4/2015, published on 21 December 2015, dealt with the safety of first responders to the accident scene, the maintenance of ejection seats in historic ex-military aircraft and issues regarding the maintenance of ex-military aircraft on the UK civil register.
- Safety Bulletin 1/2016, published on 10 March 2016, considered the risk management of flying displays, minimum display heights and separation distances, regulatory oversight and piloting standards. It was published to inform the air display community of important issues identified ahead of the 2016 air display season.
A variety of recorded data was assembled from a range of sources and careful analysis of it provided useful factual information which helped inform the analysis. The aircraft itself was not fitted with a FDR and was not required to be. A small UAV fitted with a gyro-stabilised camera able to take 14 megapixel stills and 1080p resolution video was used to obtain aerial images and video of the accident site. The still images were "processed using photogrammetry software to generate a 3D model and orthomosaic images of the accident site".
The Accident Pilot
The 51 year-old pilot had accumulated 14,249 total flying hours which included 43 hours on type of which 19 hours had been in the course of 14 displays and the transit to and from them. He had gained his initial flying experience in the Royal Air Force where he had flown 1,122 hours on jet trainers and 517 hours on the Hawker Harrier before leaving in 1994 and obtaining his civil flight instructor rating for single-engine light aircraft and later "joining an airline to operate commercial jet transport aircraft which he continued to fly up to the time of the accident". He began flying the Jet Provost, the ex-military type on which he had accumulated the majority of his military pilot experience, in 2003. He subsequently self-assembled a Vans RV-8 aerobatic light aircraft and obtained his first UK CAA Display Authorisation (DA) in 2008 on it. In 2011, he began training to fly the Hawker Hunter and revalidated his DA approval on the accident aircraft with the Chief Pilot of G-BXFIs Operator. The same Chief Pilot renewed the pilot's DA on a Jet Provost in September 2014. His most recent DA renewal was on a Vans RV-8 two months prior to the accident. It was noted that "under the regime that existed at the time, the pilot was able to renew his DA for all of his approved aircraft categories by renewing his DA in any one of them" so that renewal on the RV-8 "also renewed his DA for the Hunter and Jet Provost" despite the fact that they are in different 'aircraft complexity' categories. The Investigation team was able to interview the pilot on seven separate occasions but "he was not able to describe events on the day of the accident".
It was noted that CAA recency requirements to maintain DA validity for a public flying display which itself required an explicit CAA approval were that "a minimum of three full display sequences.....with at least one....flown or practised in the specific type of aircraft to be displayed" must have been flown in the 90 days prior to any such display. In the 90 days prior to the accident, the pilot had flown 33 displays or practice displays, 22 in the RV-8, five in the Jet Provost and six in the Hawker Hunter, thus "exceeding the minimum recency requirements in both total displays and displays on type". For comparison, it was noted that "an RAF display pilot is required to have flown two displays or practice displays in the specific type in the eight days preceding a public display".
The Accident Flight
The aircraft departed from its base at North Weald and made an uneventful 15 minute transit to just east of Shoreham in good weather and light winds. After flying "parallel to the coast in a gradual descent during which he flew inverted briefly", the pilot rolled the aircraft upright and wings level and descended to 800 feet before making a right turn to line up with the display line to the west of Shoreham runway 02/20. The aircraft then "remained right wing low with the angle of bank decreasing as it descended to 100 feet and flew along the display line" before manoeuvring to approach the display line at an angle of about 25º and at 185 feet agl ahead to pitch up into the accident manoeuvre - a loop with a partial roll intended to adjust the alignment leaving the base of the loop - at an indicated airspeed of approximately 310 KIAS. The climb was entered with an engine speed of approximately 7,500 rpm but this was inexplicably reduced during the climb and did not return to the normal maximum thrust. As the aircraft approached the vertical, the pilot initiated a roll to the left. As it reached the apex of the loop, the aircraft was almost inverted with wings level at a height of approximately 2,700 feet. As the descent began, the earlier roll input had produced a westerly exit ground track along the A27 Shoreham Bypass which was approximately 60° right of the entry ground track instead of the more modest change in alignment which would have got the aircraft back onto the display line as the pilot intended. During the acceleration in this descent, "the nose was raised but insufficient height was available to recover to level flight before it contacted the westbound carriageway of the A27" at around 225 knots with a nose up attitude subsequently calculated to have been 14° +/-3°.
On impact, the aircraft collided with "a number of occupied vehicles, pedestrians, street furniture". During the impact sequence, "the external fuel tanks, which were made of phenolic resin reinforced with asbestos, fragmented and the right wing detached" which resulted in the release of "fuel and fuel vapour from the internal and external tanks" being released with explosive ignition following immediately. The aircraft broke into four large sections comprising "the forward fuselage and cockpit; the centre fuselage, engine and left wing; the rear fuselage and tail cone; and the right wing which was found inverted close to the centre fuselage". The accident site in relation to the extended runway centreline is shown on the first illustration below as are the two areas where people had informally congregated to watch the display (annotated as the "secondary crowd" areas). The approximate flight path of the aircraft is shown on the second illustration below. Overall, the available evidence "appeared to show that throughout the flight the pilot was conscious and that the aircraft was responding to his control inputs" and engine instruments visible on a camera fitted in the cockpit "did not indicate any engine malfunctions".
Of note is that a short animation of the accident manoeuvre was prepared by the AAIB and made available concurrently with publication of the Official Report. This can be seen in full below:
The accident site showing the aircraft ground track after impact (the base image is not from the day of the accident) [Reproduced from the Official Report]
An approximate reconstruction of the aircraft flight path from radar returns [Reproduced from the Official Report]
It soon became clear that the (loop) accident manoeuvre had not been flown correctly or in accordance with the pilot's recollection of the way he knew it should have been flown. The Investigation arranged for a type-experienced test pilot to examine the difference between the manoeuvre as actually flown and as it should have been flown. It was estimated that prior to the crash the aircraft had entered the accident manoeuvre at a height of 185 ±35 ft before pitching up at 310 ±15 KIAS - significantly less than the minimum entry airspeed of 350 KIAS which was "the speed below which the pilot stated he would normally have abandoned the manoeuvre". In addition, this entry "was also below the minimum height of 500 ft specified in the pilot's DA for aerobatics". It was noted that the CAA had acknowledged in a 1996 Review that "it had become common practice for pilots to descend to their authorised flypast height in the middle of an aerobatic sequence, provided they had completed the aerobatic manoeuvre by the specified base height" whereas the applicable guidance at the time of the accident stated that "all aerobatic manoeuvres....are to be executed above the approved aerobatic display height (with) descent below the approved aerobatic display height to the approved fly-by height permitted once certain of capturing the aerobatic display height". The Investigation found that this guidance was routinely not being followed by display pilots.
Flight trials showed that when entered from 200 feet agl at 300 KIAS using maximum thrust, the accident aircraft would have reached between 2,800 feet and 3,200 ft in the manoeuvre flown - higher than the height actually achieved on the accident flight. It was accepted that the variations of thrust below maximum which had occurred during the climb could have been due to an engine fault and gone unrecognised by the pilot but on the evidence available, it was considered just as likely that "the variation in thrust during the accident manoeuvre was commanded by the pilot".
The available evidence indicated that the maximum height reached at the apex of the loop was approximately 2,700 ft - 800 feet below "the minimum height that the pilot stated was required" and in addition, the speed at that point was slower than normal at around 105 KIAS. It was concluded that this was the consequence of entering the manoeuvre below the target airspeed and then climbing with less than maximum thrust. The flight trials also indicated that the height actually reached had been the absolute minimum required to complete the second half of the manoeuvre safely. In addition, the height reached would have been reduced by any roll which may have been initiated before the aircraft reached a vertical climb attitude.
The pilot stated that if the aircraft had failed to reach 3,500 feet, he would normally "perform an escape manoeuvre by reducing the rate of pitch, increasing the airspeed, rolling the aircraft upright and climbing away". However, "he had not practised the escape manoeuvre he described, but (it was considered that) the execution of such a manoeuvre would have been consistent with his background and experience". He did comment that he would not be sure of the outcome of doing so at airspeeds as low as 105 KIAS.
Although it was impossible to establish why the manoeuvre had been continued despite the aircraft being significantly lower than normal at the apex of the loop, a report commissioned for the Investigation from the RAF Centre for Aviation Medicine identified four possible reasons for this as:
- The pilot did not check the altimeter.
- The pilot checked the altimeter but did not or could not read it correctly.
- The pilot read the altimeter correctly but did not accurately recall the minimum height required at the apex of the looping manoeuvre for this aircraft.
- The pilot read the height correctly but decided that an escape manoeuvre was no longer possible.
That said, it was considered in this review that if the pilot had not appreciated his height at the apex and believed that it was sufficient to complete the manoeuvre "he would have had no reason to discontinue it or eject".
It was also noted that there were significant handling differences between straight-wing aircraft types like the Jet Provost (on which the pilot had far more experience than the Hunter) and swept-wing types like the Hunter and that this may lead to "the possibility that techniques may be transferred inappropriately from one type to another". The display experience of the accident pilot was mainly on the Vans RV-8 and the Jet Provost and although the Harrier he had flown was a swept wing type, aerobatics were not a normal part of his experience on it.
It was noted that the flying training syllabus for an aircraft such as the Hunter would be "proposed by the Operator and agreed by the CAA" but that "the exercises were not described in detail and the learning objectives were not specified". Although the purpose of type conversion training is to "transfer skills, knowledge and abilities to the real environment....in this case the pilot was apparently not aware of relevant aircraft performance within a part of the operational envelope that the aircraft could be reasonably expected to encounter, such as the need to recover from a looping manoeuvre at or near its apex at low airspeed". This was considered to be evidence that "initial and recurrent training programs were not an effective control in this case".
Flying Display Regulation & Safety Management
The Investigation found that there was no mention of Safety Management Systems (SMS) in the edition of CAP 403 'Flying displays and special events: A guide to safety and administrative arrangements' current at the time of the accident and there was "no evidence that the available guidance had led to the adoption of SMS or equivalent practices among the operators of display aircraft, nor was there any such requirement". The CAA Unit with responsibility for regulatory oversight of display flying, the General Aviation Unit (GAU), did not have one either.
It was noted that "a culture of safety involves a willingness to communicate safety issues and evaluate safety-related behaviour" yet footage from several flying displays examined by the Investigation "showed low-flying away from the display area and overflight of congested areas that was either not reported or not addressed and was not confined to one pilot, aircraft or venue". A review of the maintenance records for the accident aircraft "indicated shortcomings including non-compliance with mandatory requirements".
It was found that "there was no formalised reporting system related to flying displays and the CAA had not implemented previous relevant AAIB Safety Recommendations that it had accepted". Also, "the CAA GAU did not have mechanisms enabling it to determine the effectiveness of its regulations and how they were applied" with shortcomings including the very small number of displays inspected by regulatory staff in 2014 and 2015, misfiling of some 2014 reports and the absence of any process which could "confirm that display organiser risk assessments were of suitable and sufficient quality to ensure that appropriate controls were in place to protect the public". It was apparent that the GAU "relied on informal feedback concerning compliance with DA limits and safety events such as ‘stop’ calls".
Evidence that there was an appropriate level of training for those GAU personnel responsible for the monitoring of flying display safety standards through attendance was not found and the extent of this activity was found to be minimal relative to the number of displays authorised - 8 out of 281 in 2014 and 18 out of 254 in 2015. Back in 1996, it was noted that 37 display inspections had taken place and a review published that year stated that "it was intended to maintain that level of inspection for the 1997 season". By comparison, "in the USA, regulatory staff of the Federal Aviation Administration (FAA) attend every authorised display".
Although it did not have any direct causal effect on the accident, the Investigation did find that under a CAA exemption from SERA, the UK had continued to allow "an aircraft taking part in a flying display, air race or contest to fly below 500 feet above the ground or water or closer than 500 feet to any person, vessel, vehicle or structure if it is within a horizontal distance of 1,000 metres of the gathering of persons assembled to witness the event" as previously permitted under the prevailing UK Rules of the Air. Although the EASA AMC "requires the competent authority to ensure that the resulting level of safety is acceptable", it was noted that "the CAA has not provided any risk assessments or other relevant documentation to support its decision to issue the exemption" but stated instead that this exemption "had been in place since at least 1996 and there was no evidence to suggest that these rules were inherently unsafe".
In respect of the environment within which flying displays take place, it was observed that whilst "every display site has constraints and limitations...the area surrounding Shoreham (Airport) is particularly congested" with almost half the surface area within 2000 metres of the ARP which consisted of major roads, housing, industrial or recreational areas. There were also areas where 'secondary spectators' were known to gather "despite the display organiser’s efforts to reduce numbers to address the hazard of road traffic to these crowds (and) a large bulk fuel storage area 500 metres from the north-east end of the display line". It was clear that "the risk assessment for the Shoreham Airshow had not considered how individual display aircraft would operate within the constraints of the surrounding area" despite the fact that most UK flying display accidents "occur underneath the volume of airspace in which the aircraft is manoeuvring and, in more than half of cases, in areas outside the control of the display organiser". No evidence was found that "the suitability of the specific display sequences intended for the 2015 Airshow" had been considered in relation to either "the environment surrounding Shoreham or their effect on uninvolved third parties". It was concluded that both at Shoreham and at similar displays elsewhere at the time of the accident, "there was no specific requirement to separate the displaying aircraft from uninvolved third parties". The CAA "considered that separation from third parties would be managed via the risk assessment process" yet at the time, they did not routinely review display risk assessments. The Investigation also found that "the display separation distances required at the time would not have protected the 'on-airport' crowd from predictable scenarios" either.
Continued Airworthiness Issues
The Investigation identified a range of issues relating to the continued airworthiness of the 60 year-old ex-military aircraft which in various respects had not been properly addressed by either the Maintenance and Repair Organisation or the Regulator. These issues were not central to the causation of the accident but nevertheless considered indicative of an unsatisfactory context for the operation of aircraft such as the Hawker Hunter. There was one particular concern in respect of the risk to accident site first responders arising from the partially 'live' status of the ejection seat which were indirectly related to its condition (unused) in the wreckage. Overall, the Investigation found that the accident aircraft had not been "in compliance with relevant airworthiness requirements" in a number of respects including limitations exceeded and not reported and defects not recorded yet "despite CAA oversight during the relevant period, a Permit to Fly - Certificate of Validity had been issued (for the aircraft) on more than one occasion".
Flying Display Safety Improvement - an unfinished task
During the Investigation, it was found that there were conflicting views about the ownership of flying display safety. The Shoreham Flying Display Director (FDD) and the organisers of the Shoreham Airshow "believed that the CAA held the risk" and the CAA considered that the risk was held by the organisers and the FDD. The Investigation considered that although the CAA had completed a comprehensive review of UK civil air displays after the accident which listed 29 actions taken or to be taken in respect of the governance of UK flying display activity, "shortcomings in the conduct and oversight of flying displays in the UK in the areas of operation, risk management and maintenance" remained and that there were "areas of flying display activity in which a culture of safety is not well established and a lack of clarity about who owns the associated risks". It was concluded that "the extent of these shortcomings indicates that a more fundamental review of the governance of flying display activity is required" and recognised that "the CAA GAU is unlikely to have sufficient resources to conduct such a review itself while meeting its ongoing regulatory responsibilities" and that in any case it may be conflicted if it attempted it.
A comparison between the apparent rate of fatal accidents at flying displays in the USA and the UK showed the 2008-2015 rate in the USA was about half the 1996-2015 rate in the UK.
The Investigation concluded that the Cause of the Accident was that:
- The aircraft did not achieve sufficient height at the apex of the accident manoeuvre to complete it before impacting the ground, because the combination of low entry speed and low engine thrust in the upward half of the manoeuvre was insufficient.
- An escape manoeuvre was not carried out, despite the aircraft not achieving the required minimum apex height.
Six Contributory factors were also identified as follows:
- The pilot either did not perceive that an escape manoeuvre was necessary, or did not realise that one was possible at the speed achieved at the apex of the manoeuvre.
- The pilot had not received formal training to escape from the accident manoeuvre in a Hunter and had not had his competence to do so assessed.
- The pilot had not practised the technique for escaping from the accident manoeuvre in a Hunter, and did not know the minimum speed from which an escape manoeuvre could be carried out successfully.
- A change of ground track during the manoeuvre positioned the aircraft further east than planned producing an exit track along the A27 dual carriageway.
- The manoeuvre took place above an area occupied by the public over which the organisers of the flying display had no control.
- The severity of the outcome was due to the absence of provisions to mitigate the effects of an aircraft crashing in an area outside the control of the organisers of the flying display.
A total of 32 Safety Recommendations were made as a result of the Investigation. 21 of them were made whilst it was in progress and the response of recipients to all of these has been received and categorised by the Branch as 'Adequate - closed' unless remarks to the contrary follow specific Recommendations below. A further 11 Recommendations were made upon the completion of the Investigation. These Recommendations were as follows:
In the interim Special Bulletin 4/2015 published on 21 December 2015:
- that the Civil Aviation Authority require operators of ex-military aircraft fitted with ejection seats or other pyrotechnic devices operating in the United Kingdom, to ensure that hazard information is readily available which includes contact details of a competent organisation or person able to make the devices safe following an accident.
- that the Civil Aviation Authority review the guidance in CAP 632 with respect to ejection seats and the means by which operators of ex-military aircraft equipped with them comply with this guidance. This review should include:
- The benefits and hazards of aircrew escape systems in civilian-operated aircraft
- The use of time-expired components
- The availability of approved spares
- The seat manufacturer’s guidance on deactivating its historic products
- Adoption of a dedicated Maintenance Approval for persons or organisations competent to perform ejection seat maintenance.
- that the Civil Aviation Authority establish a process for the effective dissemination of ex-military jet aircraft experience and type-specific knowledge to individual maintenance organisations.
- that the Civil Aviation Authority define a minimum amendment standard for the technical publications for each ex-military jet aircraft type operated on the United Kingdom civil register.
- that the Civil Aviation Authority require that an ex-military jet aircraft’s maintenance programme be transferred with the aircraft when it moves to another maintenance organisation to ensure continuity of the aircraft’s maintenance.
- that the Civil Aviation Authority review the effectiveness of all approved Alternative Means of Compliance to Mandatory Permit Directive 2001-001.
- that the Civil Aviation Authority review its procedures to ensure that a ‘Permit to Fly-Certificate of Validity’ is valid when it is issued.
In the interim Special Bulletin 1/2016 published on 10 March 2016:
- that the Civil Aviation Authority review and publish guidance that is suitable and sufficient to enable the organisers of flying displays to manage the associated risks, including the conduct of risk assessments.
- that the Civil Aviation Authority specify the safety management and other competencies that the organiser of a flying display must demonstrate before obtaining a Permission under Article 162 of the Air Navigation Order.
- that the Civil Aviation Authority introduces a process to ensure that the organisers of flying displays have conducted suitable and sufficient risk assessments before a Permission to hold such a display is granted under Article 162 of the Air Navigation Order.
- that the Civil Aviation Authority specify the information that the commander of an aircraft intending to participate in a flying display must provide the organiser, including the sequence of manoeuvres and the ground area over which the pilot intends to perform them, and require that this is done in sufficient time to enable the organiser to conduct and document an effective risk assessment.
[2016-034] - This Recommendation was not accepted as stated because it was considered that alternative ways of achieving a similar effect were preferable. This response was categorised by the Branch as 'Partially adequate - closed
- that the Civil Aviation Authority require operators of Permit to Fly aircraft participating in a flying display to confirm to the organiser of that flying display that the intended sequence of manoeuvres complies with the conditions placed on their aircraft’s Permit to Fly.
- that the Civil Aviation Authority remove the general exemptions to flight at minimum heights issued for Flying Displays, Air Races and Contests outlined in Official Record Series 4-1124 and specify the boundaries of a flying display within which any Permission applies.
- that the Civil Aviation Authority require that displaying aircraft are separated from the public by a sufficient distance to minimise the risk of injury to the public in the event of an accident to the displaying aircraft.
- that the Civil Aviation Authority specify the minimum separation distances between secondary crowd areas and displaying aircraft before issuing a Permission under Article 162 of the Air Navigation Order.
- that the Civil Aviation Authority require the organisers of flying displays to designate a volume of airspace for aerobatics and ensure that there are no non-essential personnel, or occupied structures, vehicles or vessels beneath it.
[2016-039] - This Recommendation was categorised by the Branch as 'Superseded - closed
- that the Civil Aviation Authority require Display Authorisation Evaluators to have no conflicts of interest in relation to the candidates they evaluate.
[2016-040] - This Recommendation was not accepted because it was considered that it would be "impractical to achieve in the relatively small air display community and maintain a working display evaluation system" and that the only practicable response was to introduce measure(s) which would a least reduce the risks of conflicts of interest. This response was categorised by the Branch as 'Partially adequate - closed
- that the Civil Aviation Authority require a Display Authorisation to be renewed for each class or type of aircraft the holder intends to operate during the validity of that renewal.
- that the Civil Aviation Authority publish a list of occurrences at flying displays, such as ‘stop calls’, that should be reported to it, and seek to have this list included in documentation relevant to Regulation (EU) No 376/2014.
[2016-042] - This Recommendation was not accepted because it was considered that the best way to foster a Just Culture in the air display community was to develop a positive reporting culture as a means to address potential safety issues before they lead to accidents. This response was categorised by the Branch as 'Partially adequate - closed
- that the Civil Aviation Authority introduce a process to immediately suspend the Display Authorisation of a pilot whose competence is in doubt, pending investigation of the occurrence and if appropriate re-evaluation by a Display Authorisation Evaluator who was not involved in its issue or renewal.
- that the Civil Aviation Authority establish and publish target safety indicators for United Kingdom civil display flying.
Upon completion of the Investigation and published on 3 March 2017 in the Final Report:
- that the Civil Aviation Authority amend CAP 403 to clarify the point at which an aerobatic manoeuvre is considered to have been entered and the minimum height at which any part of it may be flown.
- that the Civil Aviation Authority require pilots intending to conduct aerobatics at flying displays to be trained in performing relevant escape manoeuvres and require that their knowledge and ability to perform such manoeuvres should be assessed as part of the display authorisation process.
- that the Civil Aviation Authority review the grouping of aircraft types in display authorisations to account for handling and performance differences it considers significant.
- that the Civil Aviation Authority remind operators, whose activities are subject to the guidance published in Civil Aviation Publication (CAP) 632, of the need to maintain detailed training records for pilots and check their compliance during inspections it carries out.
- that the Civil Aviation Authority specify that the flight demonstration requirement of a display authorisation evaluation, other than to assess formation following, cannot be satisfied by the pilot following another aircraft during the evaluation.
- that the Civil Aviation Authority undertake a study of error paths that lead to flying display accidents and integrate its findings into the human factors training it requires the holders of display authorisations to undertake.
- that the Civil Aviation Authority review the arrangements for safety regulation and oversight of intermediate and complex ex-military aircraft operated in accordance with Civil Aviation Publication (CAP) 632, to ensure that they are consistent and appropriate.
- that the Civil Aviation Authority consider implementing the changes outlined in Health and Safety Laboratory report MSU/2016/13 ‘Review of the risk assessment sections of CAP 403’.
- that the Civil Aviation Authority require operators of aircraft used for flying displays to identify, and where practicable remove, any hazardous materials.
- that the Civil Aviation Authority prohibit the use of phenolic asbestos drop tanks on civil registered aircraft.
- that the Department for Transport commission and report the findings of an independent review of the governance of flying display activity in the United Kingdom, to determine the form of governance that will achieve the level of safety it requires.
The 452 page Final Report of the Investigation was published on 3 March 2017.