06_境外及港澳台调查报告_part07.md

06_境外及港澳台调查报告 · 整合分片 part07

本片含 183 份报告。

FD06587 ｜ 2017_英国_aaib-investigation-to-airbus-a330-323-n276ay__Airbus_A330-323_N276AY_12-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

3 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 SERIOUS INCIDENT Aircraft Type and Registration: Airbus A330-323, N276AY No & Type of Engines: 2 Pratt & Whitney PW400 turbofan engines Year of Manufacture: 2001 (Serial no: 0375) Date & Time (UTC): 26 June 2016 at 1115 hrs Location: London Heathrow Airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 12 Passengers - 277

Ground staff - 2 Injuries: Crew - None Passengers - 1 (Minor) Nature of Damage: APU failure Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 61 years Commander’s Flying Experience: 31,635 hours (of which 1,912 were on type)

Last 90 days - 200 hours

Last 28 days - 28 hours Information Source: AAIB Field Investigation Synopsis The cabin filled with smoke whilst the aircraft was on stand after boarding. The cabin crew were unsuccessful in making contact with the commander, and one of the flight attendants (FAs) initiated a passenger evacuation. Several passengers exited using the emergency slides from the two aft doors, but most left using the jetbridge at exit 2L. Passengers opened the two emergency exits situated immediately aft of the wings (exit 3L and exit 3R). Exit 3L had not been armed, so the slides did not deploy and the passengers did not use the exit. Exit 3R was armed and opened by a passenger and the slide deployed, but this exit was not used either. The commander attempted to halt the evacuation, (because he believed he had isolated the source of the smoke) which caused some confusion until the FAs encouraged all remaining passengers to exit via the jetbridge. Air Traffic Control (ATC) observed the incident and alerted the emergency services, which reached the scene quickly. Three passengers and several FAs received treatment for the effects of smoke inhalation and one passenger suffered a minor leg injury while using an escape slide. The source of the smoke was traced to a failure of the Auxiliary Power Unit (APU) load compressor carbon seal that allowed hot oil to enter and pyrolyse in the bleed air supply.

4 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Metallic debris in the shared oil system compromised the load compressor bearing, leading to the failure of the load compressor carbon seal. The APU manufacturer has taken action to address this type of event, and the relevant section of the Master Minimum Equipment List (MMEL) has been reviewed and amended. Six Safety Recommendations are made in the areas of interphone design, passenger briefings and the co-ordination of pilot and cabin crew training. A further two Safety Recommendations are made concerning modification to enhance automatic APU shut‑down protection in the event of lubrication system contamination. History of the flight The crew, comprising three pilots1 and nine FAs (designated A-FA to H-FA and K-FA), prepared the aircraft for departure from Stand 307 at Heathrow while ground engineers dealt with defects raised by the crew of the inbound flight. Passenger boarding began later than scheduled, with engineers, caterers and cleaners still working on-board. Some of the FAs felt more pressured than usual as a result of having to supervise the passenger boarding during this other cabin activity. The APU was being used for air conditioning, but external electrical power was connected because the APU generator was unserviceable2. The engineers departed one hour after boarding began and all the exit doors were then closed and armed. In preparation for this, the FAs briefed the passengers seated in four ‘exit seats3’, referring them to their safety instruction cards which contained guidance on opening the adjacent exit. Before the doors were armed passengers occupying these seats were required to agree they were able and willing to open these exits if necessary. The jetbridge was removed at 1057 hrs but two minutes later the commander requested further engineering assistance because there was an indication of a navigation system defect. All the doors were disarmed, the jetbridge was re-attached at exit 2L (Figure 1), and an engineer went to the flight deck, accompanied by the Gate Operational Co‑ordinator (GOC). The In-flight Entertainment system (IFE) was inoperative so the FAs needed to provide a manual passenger safety demonstration using equipment stored in on-board pouches. Before departure, their duty stations were mostly, but not exclusively, in the vicinity of their jump-seats; the K-FA’s duty station for boarding was at 2L. Because there were no pouches stored next to exits 3L and 3R, the F-FA went forward towards exit 2L and the G-FA went aft towards exit 4R, to retrieve pouches stored near these locations. Meanwhile, the K-FA was also looking for a demonstration pouch in the vicinity of the aft galley on the left side of the aircraft. Footnote 1 The flight deck crew comprised the commander, the co-pilot and an International Relief Officer (IRO), who was a qualified co-pilot occupying the cockpit jump seat. 2 See Dispatch with APU generator inoperative. 3 Seats 25A, B, G and H are designated as exit seats because they have direct access to either exit 3L or exit 3R. See Exit seats.

5 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02

Figure 1 Cabin layout of N276AY showing numbered exits and FA jump seat locations

6 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 The engineer was on the flight deck and was talking to the pilots when the commander thought he smelt burning. Assuming it was associated with the engineering activity, the commander asked the engineer what was causing the smell, but the engineer did not know. The commander recalled that, a few seconds later, smoke appeared behind his seat and the smoke lavatory smoke warning4 illuminated on the upper display of the Electronic Centralised Aircraft Monitor (ECAM) in the centre of the main instrument panel, accompanied by an aural chime. Over the sound of this, he believed he heard the words “smoke in the cabin” and possibly “evacuate” spoken. He saw the cabin full of smoke and smoke coming from the windshield vents. Aware that the APU was providing conditioned air, he assumed it was causing the smoke and pressed the APU bleed switch to close off the APU air supply. From the jump seat at the rear of the flight deck, the International Relief Officer (IRO) saw smoke issuing from ventilation ducts. He recalled that the commander and co-pilot actioned the checklist for a smoke lavatory smoke warning, and the co-pilot began to action the ‘Smoke/ Avionics Vent Smoke/Fumes’ checklist, with assistance from the IRO. The co-pilot recalled that the smoke lavatory smoke warning illuminated after they had begun to action the ‘Smoke/ Avionics Vent Smoke/Fumes’ checklist. Both pilots commented that various chimes, alarms and warnings were operating together and were distracting. The IRO remembered one of the FAs coming to the flight deck and reporting that an evacuation was underway. At approximately the same time the commander saw, in a reflection from the terminal building, that a rear escape slide had been deployed, and noticed the apu auto shutdown message displayed. He assumed the APU had caused the smoke and that the situation was under control because the APU had shut down so, while the other two pilots actioned the Quick Reference Handbook (QRH), he made a Passenger Announcement (PA) to stop the evacuation in order to prevent unnecessary injuries. He expected this would stop the use of the slides and that disembarkation would continue via the jetbridge.

The commander noticed the interphone light was on, indicating a call from an FA in the cabin, but he had not heard any associated aural alert call. He assumed the sound of the smoke warning had prevented him from hearing the interphone call alert, and cancelled the master warning before trying to return the interphone call. When there was no response, he made a radio call to the aircraft operator to announce the presence of passengers on the ramp. Later he saw the Rescue and Fire Fighting Service (RFFS) arrive, and assumed there was no need for him to notify ATC himself. Standing towards the back of the flight deck, the GOC heard the evacuation PA and observed the cabin fill with white smoke. She heard the commander first make a PA telling passengers to stop evacuating, then another telling them to continue. She used her portable radio to inform the operator’s ground team that an evacuation was underway, then moved through the cabin and onto the jetbridge, helping to usher passengers off as she did so. Initially she directed them to the nearest lounge area but when smoke drifted along the jetbridge into this area they were re-directed to another lounge further from the Footnote 4 See Smoke in the cabin.

7 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 aircraft. The GOC later stated that all passengers and FAs were clear of the aircraft by 1125 hrs and she then went down to the ramp to meet the passengers who had escaped via the rear slides. The IRO and the co-pilot actioned the evacuation checklist in the QRH because they wanted to “ensure nothing was missed”, but the evacuation alarm5 was not turned on because it was believed passengers were no longer using the slides. They then walked through the cabin as the last passengers were leaving, and with some RFFS personnel already on‑board. All the FAs then disembarked and, after the RFFS had checked the aircraft, the pilots remained on-board until approximately 1200 hrs. During this period they liaised with the aircraft operator but did not ensure that power for the Cockpit Voice Recorder (CVR) was disconnected. Cabin evacuation Mid-cabin The door at exit 2L remained open and the jetbridge was attached throughout the incident. The E-FA was in the galley between exits 2L and 2R, near to the F and H-FAs, when the latter drew their attention to smoke at ceiling level. The E-FA looked down the aisle and observed “smoke fill the cabin in less than three seconds”. She immediately tried to call the commander using the capt button on the interphone6 but received no answer. She smelt what she thought was an electrical fire and made a PA telling passengers to evacuate. Passengers attempting to retrieve belongings from the overhead bins were instructed to leave them behind. The E-FA reported that she had considered arming exit door 2R to assist the evacuation but decided this might create confusion and break the flow. As passengers exited, the E-FA heard the commander make a PA to stop the evacuation. She believed he could not perceive the smoke and fumes as she could, so shouted to the passengers to keep moving. She then heard a further PA from the commander to continue the evacuation. Although the commander’s instructions caused a short interruption, passengers responded to shouts from the FAs and continued exiting onto the jetbridge. Aft cabin There were four FAs in the aft galley area; the G and K-FAs who were collecting demonstration pouches, the B-FA (whose station is at exit 4L) and the C-FA (whose station is at exit 4R). The B-FA heard an “explosive noise”, which seemed to come from above the left side of the galley, before smoke appeared suddenly in the cabin, obscuring her view of the other FAs. Her colleagues did not hear the sound but they were all aware of the sudden appearance of dense white smoke, which some described as having a chemical or electrical smell. The K-FA checked the ovens and looked down the left aisle of the economy cabin to establish the source of the smoke. Passengers were becoming agitated and some were standing up. Footnote 5 See Evacuation signalling system. 6 See Interphone calls to flight deck.

8 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 The G-FA was forward of the aft galley, on the right side, when she saw the smoke. She shouted a warning and tried to contact the commander using the interphone capt button; but heard an engaged/busy tone. The B and C-FAs also stated that they tried to call the commander but their calls were not answered. By now an alarm was sounding and, while the B-FA identified this as a smoke alarm, the C-FA believed it was the secondary evacuation signal7. The B-FA grabbed a fire extinguisher and her Portable Breathing Equipment (PBE), and heard a PA commanding an evacuation. The other three FAs nearby could not hear PAs due to the noise from the alarm and from passengers shouting, but had each decided independently that an evacuation was essential and said afterwards that they responded as trained. The G-FA commanded them to re-arm the doors and the K and C-FAs held back passengers while the B and G-FAs armed and then opened exits 4L and 4R. They confirmed slide deployment and checked it was safe outside before working in pairs to instruct passengers to evacuate, using the command “jump and slide”. The first passengers to evacuate were instructed to help at the bottom of the slide. All but two passengers were prevented from taking cabin bags with them. The B-FA then heard the commander’s PA to stop the evacuation and shouted this instruction to her colleagues at exits 4L and 4R. The B-FA said she spoke to the A-FA, who was the senior cabin crew member (SCCM), on the interphone and received confirmation of this instruction8. Twenty five passengers (including one baby) used the two aft slides. Remaining passengers were directed forward, with no further PAs heard by any of the FAs in the aft cabin. Some of them said later that there was still a lot of smoke in the aft cabin and, because they were unsure of its source, they believed continuing evacuation using emergency escape slides would have been appropriate. Forward cabin The SCCM was in the forward left lavatory (aft of the flight deck) when smoke appeared. She reported that the compartment filled with smoke in approximately four seconds and, as she opened the door, she thought she heard the words “smoke in the cockpit” several times, followed by the sound of “smoke bells”. She grabbed a fire extinguisher and a PBE from under her crew seat and, thinking the source of the smoke was in the flight deck, she tried to pass her extinguisher to the pilots. Nobody took it from her and she realised there was smoke throughout the cabin. She then heard a PA from the E-FA saying “Evacuate, come this way”. In response to the PA, the SCCM and D-FA moved aft through the business cabin ushering passengers towards exit 2L. Approaching this exit, the SCCM heard a PA from the commander telling passengers to stop evacuating. Looking around she saw the commander standing Footnote 7 See Evacuation signalling system. 8 The A-FA did not recall this exchange.

9 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 in the flight deck looking towards her. Realising the cabin still contained thick smoke she told the nearby E and F-FAs to continue evacuating passengers and went forward to tell the commander they should continue the evacuation. He acknowledged this and she heard a further PA to continue evacuating. She estimated that 50 passengers had vacated through exit 2L by this stage and, with some light visible at the aft end of the cabin, believed the doors there were open. The SCCM moved aft, encouraging passengers to leave their belongings and get off. She noticed that exit 3L was open but its slide was not deployed. A passenger with two children was looking out of the door, so she instructed them to go to exit 2L and placed a safety strap across the open doorway. She saw that exit 3R was also open, with its slide deployed. The G-FA was there speaking to a passenger who said he had been seated a few rows aft of the exit and saw passengers seated there having difficulty trying to open it. He knew the slide would be needed and managed to help arm the door and open it, although nobody evacuated through the exit. As the last passengers were leaving, personnel from the RFFS arrived and instructed the FAs to evacuate. Once on the jetbridge one FA, who had a pre-existing respiratory issue, was given portable oxygen. Several of the FAs experienced a burning sensation in their nose, throat and eyes after leaving the aircraft. Aerodrome response The ATC Ground Controller, who had a direct view of the aft section of the aircraft9, spotted some smoke and the start of a passenger evacuation. An Aircraft Ground Incident (AGI) was declared at 1116 hrs and the emergency services were alerted while other aircraft were kept clear. No radio transmissions were made from the evacuating aircraft and ATC tried unsuccessfully to make contact on the Delivery frequency. The first RFFS vehicle reached the scene between 1118 and 1119  hrs and found two evacuation slides deployed on the right side of the aircraft and one on the left. Firefighters reported smoke on the jetbridge and in the aircraft, which they boarded at approximately 1122 hrs, but there were no signs of fire. They were informed by the commander the smoke had come from the APU, and heat detectors were used to ensure there were no residual hot spots. The RFFS log recorded that all passengers and crew, except the pilots, were clear of the aircraft by 1126 hrs. Airport police reached the stand at 1120 hrs, and attended to the 25 passengers who had evacuated onto the ramp, supervising their subsequent transfer to the terminal building. Medical information Crews from the London Ambulance Service responded to the AGI and provided first aid to passengers and crew in the terminal building. Three passengers and several FAs were treated for symptoms of ‘minor smoke inhalation’. One passenger grazed a leg using a Footnote 9 ATC at Heathrow has a direct view of certain stands but many others are not in line of sight.

10 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 slide. All crew members and one passenger were taken to a hospital and, following medical checks, were released later that afternoon. The FAs were exposed to the thickest smoke for the longest time and some reported minor discomfort, such as headaches and ongoing irritation of their eyes and nasal passages, for 24 hours or more. Passenger reports The airport authority distributed AAIB questionnaires inviting passengers to provide details of the incident. Only 26 forms were returned to the AAIB, most handed to the operator by passengers once they reached the USA the following day. It was evident from the responses that some passengers seated near the aft end of the cabin did not hear any PA instructions, but that they considered the shouted instructions given to them by the FAs nearby were clear. However, 65% of the respondents (mostly seated between row 2 and row 34) indicated the instructions they heard were unclear and 46% referred to conflicting, confusing or contradictory instructions. One respondent seated near exits 3L and R, where no FAs were positioned, stated they heard no announcements and that this caused “panic”. Around 23% of the received reports suggested the commands were clear and did not refer to conflicting instructions, but indicated that the commander’s intervention caused a few seconds delay. Passengers in all sections of the cabin reported thick smoke suddenly pouring out of the air vents. The smoke was generally assessed as having a “bad” chemical smell which created a burning sensation in eyes, mouths and throats. Those near the front of the cabin indicated the effect was irritating rather than choking, while those positioned further aft reported the smoke was thicker there but that they were able to see through it. A respondent seated in row 23 (slightly forward of exits 3L and R), commented that it was possible to see through the smoke but believed that passengers adjacent to these exits felt the smoke was so thick they needed to get air into the cabin. A passenger in row 27 watched someone else open the door at 3L and then discover the escape slide had not deployed. On the other side of the cabin, passengers in the exit row were unable to open exit door 3R but a passenger seated a few rows back assisted. He armed the door before opening it but then a PA was heard which instructed everyone to leave via the main door, and exit 3R was not used. Recorded data Flight recorders No data from the event was recorded by the Flight Data Recorder (FDR) because neither of the main engines had been started. The supply of external electrical power to the aircraft meant that the CVR was operating during the event but overwritten because it remained powered for several hours after the event.

11 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 CCTV On CCTV footage recorded by the airport operator a cloud of white smoke appeared immediately behind the aircraft while it was stationary (Figure 2). This smoke began to dissipate after approximately 30 seconds, at which point the door at exit 3R opened, followed five seconds later by the door at exit 4R. Slides deployed at both exits and the first passenger jumped onto the aft slide one minute after the first smoke appeared. The CCTV footage showed 12 more passengers using this slide over a period of 33 seconds but nobody was seen to evacuate via the slide at exit 3R. The first RFFS vehicle shown on the CCTV footage arrived on the stand 3 minutes 20 seconds after smoke appeared, 2  minutes  20 seconds after slide evacuation commenced. Numerous other response vehicles were visible attending the aircraft over the following few minutes. Figure 2 Image from CCTV showing white smoke immediately behind the aircraft Description of Auxiliary Power Unit The aircraft was fitted with a self-contained APU to supply bleed air for starting engines and for the air conditioning system, and to provide electrical power. The APU generator was inoperative and the aircraft was operating under the provisions of the MMEL. The APU consists of a gas generator which is used to power the load compressor for bleed air, and the APU generator for electrical power (Figure 3). The APU bleed valve is used to isolate the air supplied by the load compressor from the aircraft pneumatic system. When the APU is running and the bleed valve is closed, the unused air supply from the load compressor is vented into the gas generator exhaust. The APU is electronically controlled and can be operated from the flight deck. It has several automatic shutdown modes, including low oil pressure, high oil temperature or metallic chips detected in the oil system. The APU has a single oil system that provides lubrication and cooling to relevant components of the APU and its constituent parts, including the load compressor and the generator. This system includes pressure and scavenge pumps and two oil filters, both of which are fitted with a bypass feature to allow oil circulation to continue should the filter become blocked. Activation of the bypass causes a mechanical tell-tale indicator to extend. A magnetic chip detector is also fitted which sends a signal to the electronic control system should a conductive chip be detected.

12 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Figure 3 Schematic diagram of APU Dispatch with APU generator inoperative The MMEL allows an aircraft to be dispatched with certain defects if other provisions are met to assure safe flight. In this case, Section 24-3 option 2 of the A330 MEL (Figure 4) was being used. The task (24-23-00-040-803) to check the APU generator maintenance condition involved interrogating the aircraft’s maintenance computer. This was completed appropriately. Relevant procedures had been carried out and recorded in the aircraft technical records. Examination of the APU An examination of the APU immediately after the event showed signs of oil wetting around the bleed air outlet and from the APU air inlet. The magnetic chip detector in the oil system had collected significant quantities of fine particles of ferrous material but the detector had not been triggered. The mechanical visual differential pressure indicators of both oil filters had activated, indicating the filters had blocked and as a result were bypassing unfiltered oil. Interrogation of the aircraft’s maintenance computer showed the APU had shut down automatically due to high oil temperature. The APU was deactivated and the aircraft was flown back to its maintenance base where the APU was replaced. The APU was sent to its manufacturer in the USA where it was disassembled under supervision of the United States Federal Aviation Administration (FAA) as directed by the National Transportation Safety Board (NTSB). The load compressor and generator were removed and shipped to their original manufacturers in the Netherlands and the UK, where they were inspected under supervision of the Dutch Safety Board and AAIB respectively.

13 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02

Figure 4 Master Minimum Equipment List extract The examination of the APU revealed considerable metallic debris in the shared oil system. The quantity of debris overwhelmed the filtering capacity of the system, causing the bypass to operate and allow debris to move into other areas of the oil system such as other bearings and seals. This debris eventually caused a failure of the load compressor carbon seal, allowing hot oil to enter the bleed air supply to the cabin and causing smoke in the cabin. The initiating source of the debris could not be identified positively due to the distribution of debris throughout the whole oil system.

14 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 The APU control system had initiated an auto-shutdown due to high oil temperature. This caused the bleed air valve to close, shutting-off the air supply to the cabin. Excess air was directed overboard via the gas generator exhaust, causing the plume of smoke seen by ATC. Safety actions APU Manufacturer The APU manufacturer had experience of similar events where a failure occurred and oil then entered the bleed air system via the load compressor carbon seal. It had already implemented changes and features intended to prevent them. In July 2003, the APU manufacturer issued Service Bulletin (SB) GTCP331-49-7704 which modified the design of the APU to include a “shoulder” on the load compressor-to-power section quill shaft, to prevent unseating of the carbon seal due to a failure of the load compressor bearing that could allow smoke into the cabin. In addition, software changes were made to perform an auto-shutdown of the APU in the event of a chip detection. This was done in order to allow more time for the detection of chips and activation of an auto‑shutdown before an unseating or failure of the load compressor carbon seal. In addition, logic was added to the Electronic Control Box (ECB) to initiate an auto-shutdown in the event of a chip detection under certain conditions. This SB had been implemented on this APU. Based on the evidence gathered during the inspection of the APU, the manufacturer believed that this SB could not have prevented the carbon seal fracturing as found in this case. In November 2007, the APU manufacturer issued SB GTCP331-49-793610 to add an optional APU auto-shutdown system for lubricating oil contamination. The system detects lubrication system contamination by sensing differential pressure across each of the two oil filters. If an impending filter bypass is detected an auto-shutdown of the APU is initiated, preventing further damage and reducing the likelihood of smoke entering the cabin. This optional system was not installed on this aircraft. Generator manufacturer The generator manufacturer employs a proactive FRACAS (Failure Reporting and Corrective Action System) process in which a monthly reliability trend review examines product reliability and the associated primary and secondary failure modes. If a trend is detected, internal actions are taken to investigate and resolve the issue. No adverse trends have been identified with the bearings within the generator. Footnote 10 Service Bulletin GTCP331-49-7704 is for the -5 APU and GTCP331-49-7738 is for the -4 APU and the ECB is modified by either GTCP331-49-7701 or GTCP331-49-7705 according to model.

15 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Crew stations The operator is regulated by the FAA and Federal Aviation Regulation (FAR) 121.391 states at paragraph (d): ‘During takeoff and landing, flight attendants required by this section shall be located as near as practicable to required floor level exits and shall be uniformly distributed throughout the airplane in order to provide the most effective egress of passengers in event of an emergency evacuation. During taxi, flight attendants required by this section must remain at their duty stations with safety belts and shoulder harnesses fastened except to perform duties related to the safety of the airplane and its occupants.’ FAR 121.394 states at paragraph (c): ‘If more than one flight attendant is on the airplane during passenger boarding or deplaning, the flight attendants must be evenly distributed throughout the airplane cabin, in the vicinity of the floor-level exits, to provide the most effective assistance in the event of an emergency.’ It does not specify where FAs should be positioned when the aircraft is stationary on the ground with passengers on-board who are not in the process of boarding or deplaning. Exit seats FAR 121.585 designates ‘exit seats’ as seats from which passengers ‘can proceed directly to the exit without entering an aisle or passing around an obstruction’. The Regulation requires that passenger information cards include details of who may occupy these seats and what they are required to do in an emergency should no crew member be available to assist. The card must instruct exit seat passengers to identify themselves for reseating if they believe they cannot or do not wish to perform the functions which may be required to operate the exit. Before the aircraft is pushed back or taxis, a crew member is to determine that the passengers in the exit seats appear capable of performing such functions. In 2003 the FAA issued Advisory Circular (AC) 121-24C regarding oral briefings given by FAs. This guidance material ‘strongly encourages air carriers to require crewmembers to provide a preflight personal briefing to each person seated in an exit seat’. The object of the briefing is to explain clearly what the person should do if the exit has to be used and to refer them to the relevant information provided on an information card. Operator’s procedures In December 2013 the previous operator of this aircraft, with approximately 30,000 employees, had merged with another operator with approximately 70,000 employees. Over the next 16 months the new organisation’s processes and manuals were inspected by the FAA prior to issue of a ‘Single Operating Certificate’. Unification was still underway at the time of this occurrence and a single flight operations system for the entire fleet, which includes 14 different aircraft types and variants, was not adopted until four months later.

16 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 The philosophy during the merger was to integrate, stabilise and improve any apparent issues, and the operator considered it was in the improvement phase by the time of the occurrence. The aircraft operator stated that this improvement phase “was part of senior management’s long-term effort to capitalize on the synergies associated with the merger, to yield a better overall product.” It did not involve changes to safety-related issues but it “was a complicated and lengthy part of the [merger] process, and safe and effective change management was emphasized throughout.” It noted that the crew had extensive experience operating this aircraft type, and all were familiar with the on-board equipment.

Exit seats There were four seats on this A330-323 designated as exit seats, as defined in FAR 121.585; seats 25A and B adjacent to exit 3L, and seats 25G and H adjacent to exit 3R. Figure 5 shows exit 3L and adjacent seats. For a fully laden aircraft the door sill height is a minimum of 5.2 metre above ground level at exits 3L and 3R. Figure 5 Photograph of Exit 3L and surrounds; the Attendant Indication Panel (AIP) is described in Crew stations In accordance with AC 121-24C the aircraft operator’s Flight Service In-flight Manual (FSIM) required that, prior to door closing, the F-FA give individual briefings to the passengers in 25A and B and the G-FA briefs those in 25G and H. Passengers not responding positively that they were willing and able to perform the required functions and obtain a verbal response were to be re-seated before the doors were closed.

17 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Crew stations A station assignment chart in the FSIM assigned work stations to each FA for various activities. During passenger boarding, the A and D-FAs work stations were at exits 1 L/R, the E and H-FAs at 2 L/R, the F and G-FAs at 3 L/R, the B and C-FAs at 4 L/R and the K-FA at 2L. There was no requirement for FAs to remain at or near their work station when the aircraft was stationary on the ground, with passengers on-board. For taxi, takeoff and landing each FA was allocated a jump seat (Figure 1). They were permitted to leave this seat to perform specific safety-related duties while the aircraft was taxiing. An Attendant Indication Panel (AIP) (Figure 5 and Figure 6) is installed in the vicinity of each FA jump seat. The AIP displays messages relating to passenger or interphone calls as well as certain warning messages (e.g. smoke lav a, evacuation alert or emergency call). Each AIP has a two line alphanumeric display screen. A steady green light accompanies a communication message and a flashing red light highlights the display of a warning message. Figure 6 Example of an AIP, indicating a normal interphone call from the commander Adjacent to exit 1L there is a Flight Attendant Panel (FAP) which provides the A-FA with detailed information and controls relating to cabin services. There is a switch on the FAP to allow the A-FA to turn on emergency lighting, which provides illumination to aid cabin evacuation, as well as indications and controls for an evacuation signalling system and for lavatory smoke alarms. Smaller versions of the FAP, known as the Additional Attendant Panels (AAP), are located by exits 2L and 4L, and have controls for the evacuation signalling system and lavatory smoke alarms. Evacuation signalling system The evacuation signalling system can be switched on from the flight deck or from the FAP or the AAPs, to initiate a continuous and rapidly repeated series of short, high-pitched tones throughout the cabin. When the system is activated an evacuation alert message and a flashing red light show on each AIP and a red evac light flashes on the evac control panel situated on the left overhead console in the flight deck. A horn will also sound in the flight deck for three seconds when one of the three cabin switches is used to switch the system on. The flight deck horn can be cancelled using a horn shut off push button. The aircraft operator’s A330 Operating Manual (OM) Volume II stated that two signals were used to initiate an evacuation: the primary method being a PA by the commander, the secondary being use of the evac command switch. The FSIM referred to the ‘emergency signalling system’ and informed FAs they could activate it from the FAP or from certain AAPs by pressing the evac command switch once.

18 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Smoke in the cabin The nine lavatory compartments on the aircraft were each equipped with a smoke detector. When smoke is detected, an aural smoke alarm sounds through all cabin loudspeakers, creating a Hi/Hi/Lo/Lo chime series which repeats continuously. Simultaneously a red light flashes at each AIP, alongside a message indicating smoke in a specific lavatory. There are also indications on the FAP and the AAPs while reset pushbuttons on these panels allow the alarm to be silenced. If detectors in more than one lavatory activate, the same aural alarm sounds and all activated detectors can be reset together from the FAP and/or from an AAP. When any of the detectors are activated, the ECAM presents a smoke lavatory smoke message on the upper of two display units in the centre of the main instrument panel in the flight deck. To assist flight crew awareness, the warning is highlighted by flashing red master warning lights on either side of the main instrument panel, accompanied by continuous repetitive chimes from the flight deck loudspeakers. Both the master warning and the chimes can be cancelled by pressing either of the master warning push buttons, thus acknowledging the warning. The procedures to be followed by the flight crew in response to the smoke lavatory smoke message are also shown on the upper central display panel and appear as ‘ckpt/cab com…. establish’. This is an abbreviated instruction for the flight crew to establish communications between the cockpit (flight deck) and the cabin. Guidance concerning the FAs response to various emergency scenarios was provided in the FSIM. Some drills were detailed in a section of the manual that was not specific to this type of aircraft. In the event of signs of fire or smoke in the cabin, or ‘If an odor is present, but cannot be identified or localized’, it instructed FAs to ‘notify flight deck crew immediately using four chimes’. Elsewhere in the FSIM it was stated that, ‘On all aircraft, four chimes is an Emergency Call’, whereas a routine call was announced by ‘two chimes’. This system had been developed for the internal communication equipment on other aircraft types in which there were no priority or emergency call switches. Interphone calls to the flight deck There is no common standard concerning the keypad layout on interphone handsets for passenger aircraft, therefore neither the equipment manufacturer nor the aircraft operator have any obligation to consider keypad standardisation between aircraft types. On the Airbus A330-300 each FA station has an interphone handset with a number of buttons (Figure 7). When a handset is lifted from its base station and the button marked capt is pressed, a single long buzzer11 sounds through the flight deck loudspeakers and small push buttons, marked att, flash amber on the pilots’ Audio Control Panels (ACPs). When a pilot responds by depressing his att push button, the interphone system connects to the calling station and the light in the push button changes to green. If no pilot responds to the call within 60 seconds, the lights in the att push buttons extinguish. Replacing the handset in its cradle or pressing the reset button returns the handset to its original status. Footnote 11 The aircraft manufacturer advises each buzzer tone lasts for approximately one second.

19 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Figure 7 Interphone communication handset showing keypad If the handset button marked emer call is pressed, the att push buttons on the flight deck ACPs flash amber, three long buzzer tones sound from the flight deck loudspeakers and an amber emer call light flashes on a Cabin Call System Panel (CCSP), situated on the left side of the flight deck ceiling. The aircraft manufacturer states that if a pilot does not respond by depressing an att push button within 60 seconds, the lights in the att push buttons extinguish but the light on the ceiling panel continues to flash until the call is cancelled. In a section specific to the aircraft type the FSIM stated that when the emer call button is pressed the flight deck will be alerted by ‘four buzzers’. The FSIM gave dialling instructions in a tabulated format. For a normal call the capt button was to be pressed twice and for an emergency call the emer call button was to be pressed four times. Interphone calls from flight deck The OM Volume II stated that a routine call from the flight deck to an FA position was announced by a single Hi/Lo chime sounding in the cabin and by a green light and a message on the relevant AIP. An emer call from the flight deck to the cabin was initiated by depressing a guarded pushbutton on the CCSP. This sounded a series of three Hi/Lo chimes on all cabin loudspeakers while all AIPs showed an emergency call message and a flashing red light. After depressing the guarded pushbutton pilots could speak on the interphone to any FA who picked up a handset by depressing the att push button on their ACP. Flight deck door indications The lower of two central display panels on the main instrument panel is termed the System Display (SD). When the aircraft is parked and electrical power is switched on, the SD will, by default, present the door/oxy12 page which depicts the status of each door and its Footnote 12 Doors and oxygen page.

20 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 associated slide on a diagrammatic representation of the aircraft. A locked and armed door is depicted by a green symbol with the message slide next to it in white letters. An open door is depicted by an amber symbol plus an amber caution message, cabin. If a door is not armed the message slide is displayed in amber instead of white. Evacuation procedures The aircraft operator’s OM Volume I stated that the commander normally initiates an evacuation and that pre-planned and unplanned evacuations were to be executed in the same manner. This guidance was reflected in the Flight Manual (FM) Part 1, which stated: ‘In an emergency evacuation, it is likely that certain passengers and crewmembers will suffer injury. The Captain should consider the relative risks of remaining aboard the aircraft against the risks of evacuation.’ However, both these manuals and the FSIM indicated that, when an aircraft is stationary and FAs determine that a life-threatening situation exists, they may initiate an evacuation if they are unable to communicate with the commander. The FSIM noted that fire or smoke may indicate a life-threatening situation, and stated that ‘if contact with the flightdeck is not possible FAs will make an independent decision regarding evacuation and operate all usable exits’. In the event that one FA initiates an evacuation, all FAs were to initiate evacuation procedures immediately by shouting evacuation commands. The FSIM did not differentiate between pre-planned and unplanned evacuations but stated that the commander had the authority to override their decisions. The FSIM contained a list of FA ‘Evacuation Procedures’. FAs were trained to follow these procedures without reference to notes. It offered no guidance regarding the PA which an FA should make to initiate an evacuation. The OM Volume I stated: ‘Depending on the Emergency, A DOORS ECAM may indicate that the evacuation has started. If an evacuation has commenced, it is usually best not to attempt to stop the evacuation already in progress. If an evacuation has not commenced and it is determined that an evacuation is not needed, make an immediate PA commanding, “This is the captain. Remain seated, remain seated, remain seated”.’ The FSIM indicated that the aircraft commander might make additional PAs in an evacuation situation, including ‘Remain seated, remain seated’ to advise that circumstances had changed. It stated that FAs hearing this were to safely stop the evacuation but that: ‘It is critical for FAs to update the captain if cabin conditions warrant an evacuation. The flightdeck may be unaware of life-threatening situation(s) -e.g., excessive smoke, fire.’

21 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 The flight deck evacuation checklist was presented on the back page of the QRH. It included shutting down the engines and APU and using fire extinguishing agent, if appropriate, instructing the commander to make an evacuation PA and to operate the evac command switch. The OM Volume I stated that when the commander and co-pilot had completed their flight deck duties they should proceed to the cabin, assess the conditions and assist with the evacuation. Emergency deplaning The FSIM included a further procedure entitled ‘Emergency Deplaning / Evacuation at the Gate’. It stated that if only a jetbridge was used, the event was considered an ‘Emergency Deplaning’ rather than an evacuation. The first step in this procedure was for FAs to advise the flight deck immediately, if possible, of any emergency. The second step was: ‘Use PA (if possible) to direct passengers to a door equipped with a jetbridge… If PA is used, add the following introduction: “Your attention please, this is your flight attendant, everyone must quickly leave the aircraft”’ Step three instructed all FAs to remain near their assigned exits, if possible, and to direct passengers by repeating the same instructions. It warned that disarmed doors should not be left unattended while passengers were deplaning. Step four stated: ‘If, at any time, an evacuation signal is given (e.g., “This is the captain. Evacuate. Evacuate. Evacuate.” followed by the signalling system), immediately initiate an evacuation using all useable exits and appropriate evacuation commands. Be prepared to arm and open all usable exits, if necessary.’ The Emergency Deplaning procedure was not mentioned in the aircraft operator’s A330 QRH, the FM Part 1 or in the OM Volume I. However, it is a procedure recognised by the International Air Transport Association (IATA) which refers to ‘Rapid Deplaning’ in its Cabin Operations Safety Best Practices Guide, stating: ‘There are situations when passengers and crew need to deplane immediately and quickly (e.g., in serious situations such a fuelling emergency). A rapid deplaning is when passengers and/or crew rapidly exit the aircraft via the boarding doors and via the jetbridge or stairs, for precautionary measure. A rapid deplaning may be initiated by the pilots or, in their absence, the SCCM.’ Some UK aircraft operators refer to such a procedure as ‘Precautionary Rapid Disembarkation’. CVR procedures The aircraft operator’s Safety Policies & Procedures Manual stated that for accidents or incidents that occur outside the United States the Investigator in Charge from the State of Occurrence will have authority over the disposition of the FDR and CVR, and that an ‘NTSB or Foreign Government Investigator may request the DFDR or CVR’.

22 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 The FM, which was not specific to this aircraft type, listed the occasions on which commanders must report immediately to the operator’s ‘Dispatch’ department. Some, including ‘Evacuation of an aircraft in which an emergency egress system is used’, required the circuit breaker for the CVR to be pulled after flight. On this aircraft the CVR circuit breaker was situated in the avionics compartment below the flight deck, and the operator’s A330-300 OM Volume I (‘Non-Normal Operations’) stated that for various occurrences, such as after an evacuation, pilots were to contact ‘maintenance’ to ensure the CVR circuit breaker was pulled. EU requirements Exit seats The term “exit seats” is not used in EU regulations. European aircraft operators are required to ensure that passengers in seats ‘that permit direct access to emergency exits appear to be reasonably fit, strong and able to assist the rapid evacuation of the aircraft in an emergency.’ EU regulations also specify that passengers with direct access to emergency exits that are not staffed by cabin crew members receive a pre-flight briefing on the operation and use of the exit. According to EASA “Such briefing is not a training; the aim is to provide the necessary basic instructions for a fast egress from the aircraft if a situation dictates so”. This briefing is additional to the safety briefing given to all passengers; informing them of the location of emergency exits, where safety briefing cards are stowed and what they contain. Crew stations Commission Regulation (EU) No 965/2012 contains the EU requirements for cabin crew to be at their stations. Its Annexe IV, Commercial Air Transport Operations, paragraph CAT. OP.MPA.210 (b) states: ‘During critical phases of flight, each cabin crew member shall be seated at the assigned station and shall not perform any activities other than those required for the safe operation of the aircraft.’ The phrase ‘critical phases of flight’ is defined as ‘the take-off run, the take-off flight path, the final approach, the missed approach, the landing, including the landing roll, and any other phases of flight as determined by the pilot-in-command or commander’. Further guidance regarding crew stations is offered in the Acceptable Means of Compliance (AMC) to the Regulation, as follows:

23 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 ‘CABIN CREW SEATING POSITIONS (a) When determining cabin crew seating positions, the operator should ensure that they are: (1) close to a floor level door/exit; (2) provided with a good view of the area(s) of the passenger cabin for which the cabin crew member is responsible; and (3) evenly distributed throughout the cabin, in the above order of priority.’ Thus, EU regulations do not require cabin crew to be evenly distributed throughout the cabin or at specific stations while passengers are boarding or deplaning or when passengers are aboard a parked aircraft. Annexe III to EU 965/2012 concerns Organisation Requirements for Air Operations. Paragraph ORO.CC.100 details factors that commercial operators should consider when determining the number of cabin crew required on an aircraft. These include the number and type of aircraft doors or exits, their location relative to cabin crew stations and cabin layout, additional actions to be performed by cabin crew with responsibility for a pair of doors or exits and, in the AMC: ‘The location of cabin crew stations taking into account direct view requirements and cabin crew duties in an emergency evacuation including: (i) opening floor level doors/exits and initiating stair or slide deployment; (ii) assisting passengers to pass through doors/exits; and (iii) directing passengers away from inoperative doors/exits, crowd control and passenger flow management;’ UK operators’ procedures Some UK aircraft operators provide guidance regarding cabin crew presence at doors or exits on a parked aircraft. One Airbus 330 operator stated that at each pair of doors (including the floor-level exits at 3L and 3R), the left door must be manned by cabin crew at all times when passengers are aboard. Another operator, with a large fleet of both narrow-bodied and wide-bodied aircraft, indicated that on some types it would be impossible for cabin crew to assist passengers to board or disembark if a cabin crew member always remained next to each pair of floor-level exits. This operator required at least one cabin crew member to ‘remain in the vicinity of each pair of floor-level exits’ during boarding. The operator stated that the definition of ‘in the vicinity’ was provided because the concept was trained thoroughly. As crew moved further away from an exit they were expected to keep the cabin situation under ever-closer scrutiny and always to be ready to return to the exit area without delay should an emergency arise.

24 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 IATA guidance The IATA Cabin Operations Safety Best Practices Guide (3rd edition) states at paragraph 11.7 that: ‘During passenger boarding, cabin crew should be evenly distributed throughout the cabin, as close to the exits as practicable to help ensure that they are ready to carry out an evacuation if necessary without warning.’ Personnel The crew had rested for more than 24 hours after operating a flight to London the previous day. All the FAs had more than three years’ experience on the A330-300 and five had operated this aircraft type for more than 10 years. Each had completed annual recurrent training for this type within the preceding eight months. This recurrent training required the FAs to prove their knowledge of emergency equipment and procedures using an on-line module before participating in a practical element. This involved type-specific cabin mock-ups in which they had to demonstrate correct operation of the doors while giving appropriate verbal commands to passengers. Sometimes the FAs had simulated calling the flight deck by interphone but each year they were required to demonstrate they could perform an unplanned evacuation of the A330-300 using the cabin mock-up. Their training was intended to ensure they could evacuate aircraft safely in various scenarios, although practise for evacuating a parked aircraft was not required and had not been specifically addressed. There was no evidence of joint evacuation training being undertaken by the FAs and flight deck crew. The IRO had 11,725 hours experience on this type of aircraft. The commander had 1,912 hours on type (31,635 hours total time) and the co-pilot had 305 hours on type (12,700 hours total time). They had all completed licence proficiency training in the preceding 10 months, in addition to the recurrent human factors training required every 9 months. Their training for evacuation procedures had focussed on rejected takeoffs with fires, leading to a cabin evacuation initiated by the commander. The pilots had practised this in a flight simulator but had not experienced evacuation scenarios involving a parked aircraft because there was no requirement for them to do so. The operator stated that it aimed to integrate some aspects of flight crew and FA recurrent training but had not provided joint practice of emergency procedures such as cabin evacuation. It acknowledged that when an aircraft is parked at the gate, certain circumstances might warrant an evacuation using only the jetbridge (emergency deplaning), while others might justify the use of all available exits. The operator stated that “its training program emphasized proper assessment of any evacuation situation and the exercise of sound judgment by the cabin crew in accomplishing safe and orderly evacuation”.

25 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Crew Resource Management (CRM) training requirements FAA requirements The FAA’s AC 120-51E concerning CRM training states, ‘Communication and coordination problems between cockpit crewmembers and flight attendants continue to challenge air carriers and the FAA.’ It notes that while CRM training is required to be included in recurrent training programmes, ‘Joint CRM training for pilots and flight attendants is not required by FAA regulations, but it is encouraged and has been practiced effectively at some air carriers for years’. The AC recommends that recurrent training includes CRM exercises in which entire crews participate. The FAA’s Flight Standards Information Management System13 document states that its pilot operations inspectors and cabin safety inspectors: ‘…should ensure that their assigned certificate holders are aware of the desirability of flightcrew and F/As performing emergency evacuation and ditching drills together. Furthermore, they should ensure that when this is not possible, air carriers are aware of the desirability of training programs that include information addressing the roles of other crewmembers during emergency evacuations and ditchings.’ EU requirements Annexe III to EU 965/2012 requires flight and cabin crew to undertake certain combined recurrent CRM training. This is specified by AMC1 to ORO.FC.115 paragraph (a) (6) (ii) (A), which states that the combined training should address at least, ‘effective communication, co-ordination of tasks and functions of flight crew, cabin crew and technical crew.’ This is repeated in the AMC to ORO.CC.115. Operators are also required by ORO.CC.140 to include evacuation procedures in annual recurrent training for cabin crew (only). There is no EU requirement for flight crew and cabin crew to receive joint training specifically relating to evacuation procedures. However, some UK operators do routinely include this because, under previous UK regulations which are no longer extant, the Civil Aviation Authority (CAA) had stated (in Civil Aviation Publication 789): ‘Particular emphasis should be placed on the provision of joint practice in aircraft evacuations and other emergencies so that all who are involved learn of the duties other crew members should perform before, during and after evacuation, thereby appreciating the necessity for effective two-way communications in such emergencies.’ Footnote 13 FAA Order 8900.1, Volume 3, paragraph 3-1167 and 3-1792 refer.

26 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Canadian requirements The Transportation Safety Board (TSB) of Canada studied evacuations of 21 large passenger-carrying aircraft which occurred between 1978 and 1991. Its report14 found that in three evacuations ineffective crew communications exposed passengers and crew to unnecessary risks. It recommended, among other things, that, ‘The Department of Transport require that air carriers implement an approved joint crew emergency training program with emergency simulations for all air crew operating large passenger-carrying aircraft.’ In 1995 Transport Canada introduced new joint CRM training requirements for pilots and FAs, specified in Canadian Aviation Regulations Standard 725.124 paragraph (39), which states that air operators are to provide CRM training that includes: ‘(b) Annual training in safety and emergency procedures. It shall include, as applicable, joint participation of pilots and flight attendants and cover the following items: (i) relationship of crew members; (ii) review of accidents/incidents of air operators; (iii) presentation and discussion of selected coordinated emergency procedures (practice of CRM skills); and (iv) crew member evacuation drills, including debriefing.’ IATA training guidance The IATA Operational Safety Audit (IOSA) Standards Manual sets out standards and recommended practices against which operators are audited by IOSA15. Paragraphs FLT 2.2.9 and CAB 2.2.10 state: ‘If the Operator conducts passenger flights with cabin crew, the Operator should ensure flight crew members participate in joint training activities or exercises with cabin crew members for the purpose of enhancing onboard coordination and mutual understanding of the human factors involved in addressing emergency situations and security threats.’ IATA acknowledges such joint training may be difficult to organise, especially when cabin crew outnumber flight crew, so joint training in emergency procedures is not mandated but its inclusion in recurrent training is recommended, at least once every 36 months. Previous incidents Evacuation of Boeing 747-436, G-CIVB at Phoenix, Arizona, 11 July 2009 Acrid fumes were noticed when the aircraft was pushed back and the engines started. The engines were shutdown, the doors were disarmed and as the aircraft was towed back on stand several passengers left their seats. Before the door was opened, cabin crew at exits Footnote 14 TSB Aviation Safety Study SA9501. 15 All IATA member airlines are IOSA registered and must remain registered to maintain IATA membership.

27 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 3L and 4L, in the worst affected part of the cabin, observed smoke coming from a sidewall and left their stations to use fire extinguishers. Some passengers became distressed and one person opened the unmanned and un‑armed exit 3L. The slide did not deploy and nobody used the exit, although the evacuation alarm was activated. Shortly afterwards the commander instructed that the other doors be re‑armed and he then ordered an evacuation using exits on the right side of the aircraft (the terminal was in close proximity on the left side). No slide-related injuries were reported. After the event the CVR was not preserved because electrical power was applied during maintenance activity. The AAIB made relevant Safety Recommendations to both the operator and the CAA. These were accepted and action was taken to ensure timely preservation of CVR recordings in the event of future reportable occurrences, in accordance with ICAO Annex 6 Part I, 11.6 and EU-OPS 1.160. The AAIB report was published in Bulletin 6/2010. Evacuation of Boeing 757-28A, G-FCLA at Glasgow Airport, 11 October 2012 Smoke appeared in the cabin and flight deck while passengers were disembarking onto a jetbridge from door 2L. The commander ordered an evacuation, shut down the APU (which he believed was causing the smoke), and alerted ATC. The aft doors 4L and 4R were re‑armed and opened by cabin crew, and passengers escaped down slides from these exits and from 3R. On this aircraft type the exits at 3L and 3R have permanently armed slides and one cabin crew member is stationed adjacent to 3R. The operator of this aircraft requires crew to ‘remain in the vicinity’ of exits when passengers are on-board, even when the doors are permanently armed. Door 3L was not opened due to the close proximity to the jetbridge. The crew observed that all the lavatory smoke alarms were activated and this increased the noise level in the cabin. The AAIB report of this occurrence was published in Bulletin 3/2013. Evacuation of Boeing MD-88, N909DL, at LaGuardia Airport, New York, 5 March 2015 The aircraft was substantially damaged when it departed the runway with five crew members and 127 passengers on-board. The NTSB report of this accident and the subsequent evacuation (NTSB/AAR-16/02) made several Safety Recommendations to the FAA including: ‘A-16-025 - Require 14 Code of Federal Regulations Part 121 operators to provide (1) guidance that instructs flight attendants to remain at their assigned exits and actively monitor exit availability in all non-normal situations in case an evacuation is necessary and (2) flight attendant training programs that include scenarios requiring crew coordination regarding active monitoring of exit availability and evacuating after a significant event that involves a loss of communications.

28 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 A-16-026 - Develop best practices related to evacuation communication, coordination, and decision-making during emergencies through the establishment of an industry working group and then issue guidance for 14 Code of Federal Regulations Part 121 air carriers to use to improve flight and cabin crew performance during evacuations.’ Regarding Recommendation A-16-025, the FAA is considering revising AC 120-48, which provides guidance on communication between flight crew and FAs. In response to Recommendation A-16-026, the FAA is considering establishing an industry-wide working group ‘to examine the issue and make recommendations on additional ways of enhancing communication, coordination and decision-making during emergencies’. Previous occurrence involving Airbus A320-214, G-EZWX During a flight on 28 November 2016, the crew of G-EZWX had difficulty establishing internal emergency communications due to an undocumented feature of the interphone emergency call function. This confused crew members and delayed the flight deck crew in establishing two-way communications with the cabin crew. Following an AAIB investigation16, the aircraft manufacturer advised that it would provide additional information to operators on the operation of the emergency interphone system. The aircraft operator intends to provide its crews with appropriate guidance and training once this information is made available. NTSB Recommendations A NTSB study of 46 aircraft evacuations which occurred between September 1997 and June 199917, found that communication and co-ordination issues continued to exist between flight crew and FAs during evacuations. It noted that joint evacuation exercises had proved effective at resolving these problems and made Recommendation A-00-85 that the FAA should require air carriers to conduct periodic joint evacuation exercises involving flight crews and flight attendants. This Recommendation was rejected by the FAA on the basis that it considered the recommendations in AC-120-51 and in the Air Transportation Operations Inspectors’ Handbook18 to be sufficient. Following the evacuation of an MD-88 at LaGuardia Airport in March 2015 the NTSB made further recommendations concerning flight and cabin crew performance during evacuations (see Previous incidents). CVR overruns CVR overruns are well documented in accident and serious incident reports and have prompted a corresponding number of recommendations for the duration of CVRs to be increased. Initially this resulted in the requirement to fit commercial air transport aircraft with a Maximum Certificated Takeoff Mass (MCTOM) greater than 5,700 kg, issued with Footnote 16 The report of this investigation was published in AAIB Bulletin 9/2017. 17 Safety Study NTSB/SS-00/01 Emergency Evacuation of Commercial Airplanes. 18 Since superseded by the Flight Standards Information Management System document.

29 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 an individual C of A (Certificate of Airworthiness) on or after 1 April  1998, with CVRs with a minimum duration of 2  hours. Further changes have now been adopted by the European Commission (Commission Regulation (EU) 2015/2338 amending Regulation (EU) No 965/2012) requiring commercial air transport aircraft with an MCTOM greater than 27,000 kg and first issued with an individual CofA on or after 1 January 2021 to carry a CVR with a minimum duration of 25 hours. Analysis The aircraft was operating with an APU generator inoperative and had been dispatched in accordance with the MEL, which included a check of the APU generator condition using the aircraft’s maintenance computer. This check did not reveal any anomalies. Examination of the APU after the event revealed considerable metallic debris in the shared oil system. This debris eventually caused the load compressor carbon seal to fail, allowing hot oil to enter the bleed air supply to the cabin and causing smoke in the cabin. The initiating source of the debris could not be identified positively due to the distribution of debris throughout the oil system. A feature was available to detect and shut down the APU automatically in the event of lubrication system contamination causing impending oil filter bypass, but was not installed on this aircraft. Had this feature been fitted, it is likely the APU would have shut down automatically prior to the filter bypass condition, thereby preventing the conditions that led to pyrolysed oil entering the cabin. Accordingly, to prevent a similar occurrence, the following Safety Recommendations are made. Safety Recommendation 2017-022 It is recommended that the Federal Aviation Administration mandate Service Bulletin GTCP331-49-7936 to add a system that shuts down the APU automatically if there is contamination of the lubricating oil. Safety Recommendation 2017-023 It is recommended that the European Aviation Safety Agency mandate Service Bulletin GTCP331-49-7936 to add a system that shuts down the APU automatically if there is contamination of the lubricating oil. This event surprised the crew and developed quickly. The pilots were pre-occupied with resolving an unrelated system defect and the flight deck environment was complicated by the presence of an engineer and the GOC. In the cabin, some FAs had found passenger boarding more pressured than normal and preparations were being made for a manual safety briefing when the smoke appeared. First appearance of smoke Several FAs attempted to contact the commander, in accordance with the operator’s guidance but using the normal interphone call function. None of the pilots noticed the small amber lights on the ACPs or the single buzzer tone which announced a cabin interphone

30 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 call. The commander suggested afterwards that this might have been due to the noise of the master warning. Aural chimes were not cancelled immediately the smoke lavatory smoke warning was noticed. It is possible the interphone call was not noticed because simultaneously the pilots were asking the engineer about the smoke. Flight deck reaction to smoke It took the flight crew a few moments to appreciate that the smoke was not associated with the engineer’s work. The commander then assumed it was being emitted by the air conditioning system, fed by the APU, so he pressed the switch to shut off the APU bleed. The commander’s prompt action indicates that he assimilated the problem quickly, but was accomplished without reference to a checklist. His recollection that the smoke lavatory smoke warning was present before he took this action accorded with the IRO’s report which stated the commander and the co-pilot then actioned the checklist for smoke lavatory smoke. However, the only action on this checklist was to establish communications with the cabin, and none of the flight crew tried to contact the FAs using the interphone at this stage. Although the A-FA apparently tried to pass an extinguisher into the flight deck, her presence only appears to have been acknowledged by the IRO and no discussion concerning the situation in the cabin appears to have ensued. Absence of recorded data The absence of recorded data prevented a more precise understanding of the sequence of events. The co-pilot may have referred to the QRH immediately smoke was seen and, while he was doing this, the commander turned off the APU bleed. If so, the co-pilot and IRO were conducting the ‘Smoke/Avionics Vent Smoke/Fumes’ procedure when the smoke lavatory smoke warning illuminated, accompanied by the chimes of the master warning. With the door to the flight deck open the sound of the lavatory alarm from the cabin speakers would have added to the noise level. The flight crew indicated that they were presented with several simultaneous visual and aural inputs, which might account for conflicting recollections of the event sequence. Emergency call option The aircraft operator’s instructions to FAs for communication with the flight deck in the event of smoke in the cabin was not consistent. Contrary to this guidance, it is necessary to press the emer call button on this aircraft only once to initiate an emergency call. An emergency call may have been more noticeable to the pilots than a normal call, and prompted them to respond to the FAs. No such guidance was provided by the operator. The FAs were trained to operate on several types of aircraft. Handset keypad layouts are not standardised, such that emergency calls are initiated in different ways on different types. This lack of standardisation may have been a factor in the FAs being unable to initiate an emergency call. Therefore the following Safety Recommendations are made:

31 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Safety Recommendation 2017-024 It is recommended that the Federal Aviation Administration regulate the operation of interphone handsets, including during emergency communications, so that it is standardised irrespective of aircraft type. And: Safety Recommendation 2017-025 It is recommended that the European Aviation Safety Agency regulate the operation of interphone handsets, including during emergency communications, so that it is standardised irrespective of aircraft type. When smoke became apparent in the flight deck, the flight crew responded quickly by taking action they considered appropriate but they did not call the FAs to establish the situation in the cabin. The smoke lavatory smoke checklist requires this to be done and, although an emergency interphone call is not specified, this offers the best means of conferring with all the FAs. The lack of such immediate liaison with the FAs indicates that training to respond to smoke events while on the ground could be improved. The aircraft operator has reported the action it intends to take to address this (see Aircraft operator’s response in the Safety action section). Initiation of evacuation When the E-FA received no response to her interphone call, she decided the situation was life-threatening and made a PA to initiate an evacuation. The alternative ‘Emergency Deplaning’ procedure was not mentioned in guidance to flight crew. An appropriate drill has now been introduced (see Aircraft operator’s response in the Safety action section). The inconsistency might have become apparent to the aircraft operator earlier if the two groups had received regular joint training for evacuation scenarios. The FA’s decision to initiate evacuation was consistent with the aircraft operator’s policy that FAs may initiate an evacuation if: the aircraft is stopped, they are unable to communicate with the commander and a threat to life is identified. Having made a PA commanding an evacuation the E-FA did not turn on the evacuation signal, though this is an action the operator expects its FAs to accomplish without reference to notes. Once an evacuation was commanded, all available exits should have been used, but the exits at 1L, 1R and 2R were not opened and the FAs in the forward portion of the cabin executed an ‘Emergency Deplaning’ using only the jetbridge at 2L. Following this event, the aircraft operator’s task force has identified the need to prepare new guidance and improve crew training for ‘Emergency Deplaning / Evacuation at the Gate’ (see Aircraft operator’s response in the Safety action section).

32 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Exit seat passengers The two FAs who might have been in the vicinity of exit 3L or 3R when the evacuation PA was made had both moved away to obtain demonstration pouches. If pouches had been located close to these exits, or if only one of the FAs had gone to obtain one, then a crew member trained to operate the exits would have remained nearby. However, there was no requirement for an FA to remain in the vicinity of these floor-level emergency exits or for the FAs to be evenly distributed throughout the cabin when boarding or deplaning is not taking place and an aircraft is parked. Passengers in the adjacent seats had received an ‘exit seats’ briefing, which effectively placed responsibility on them to operate the exit in an emergency if no crew member was nearby. The safety information card to which they had been referred provided detailed instructions on ‘Exit Seat Responsibilities’ as well as diagrams indicating how the exit should be operated. After hearing the evacuation PA and perceiving the smoke, passengers in the seats adjacent to 3L and 3R opened both exits. Apparently those at 3R decided they needed to do something more than lift the door operating handle and sought help from a passenger seated further aft, who was able to arm the slide before opening the door. CCTV imagery showed that door 3R began to open approximately 30 seconds after smoke was emitted by the APU, and before door 4R opened. It is not known if the passengers checked outside for dangers or hazards before opening door 3R and deploying the slide. The door at exit 3L was apparently opened in accordance with the safety information card, without the slide being armed. However, the guidance on the card which then shows the manual slide deployment handle being pulled, was not followed and the slide did not deploy. The fall of 5.2m metres from the sill of this door to the ramp below represented a significant hazard to anyone using it. It is possible that by verbally agreeing to adopt the role of ‘exit seat’ passenger, and by accepting detailed instructions, they felt responsible for opening the exits because no FAs were present. Under EU regulations, passengers seated adjacent to unsupervised exits do not receive detailed instructions on ‘Exit Seat Responsibilities’ but are given a more basic briefing aimed at allowing them to make a fast egress from the aircraft if necessary. Therefore the following Safety Recommendation is made: Safety Recommendation 2017-026 It is recommended that the Federal Aviation Administration reconsider the requirements for briefings given to passengers seated at exits, to ensure they offer appropriate guidance on exiting the aircraft rapidly in an emergency without implying undue responsibility for opening the exits. A review of previous similar events suggests that this scenario is not unique and indicates it is desirable for trained crew members to be available to operate floor-level emergency exits whenever an aircraft is on the ground with passengers on-board. The practice of

33 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 some UK operators to do so has proved effective, for example during the evacuation of a Boeing 757 at Glasgow in 2012. IATA advocates cabin crew being evenly distributed throughout the cabin during passenger boarding. This is reflected in FAA regulations which require, when an aircraft has more than one FA, that the FAs be evenly distributed throughout the cabin and in the vicinity of floor‑level exits during both boarding and deplaning, to provide the most effective assistance in the event of an emergency. However, the FARs do not require the FAs to be evenly distributed at other times when passengers are on-board a parked aircraft and the EU regulations do not include such a provision. Therefore the following Safety Recommendations are made: Safety Recommendation 2017-027 It is recommended that the Federal Aviation Administration require cabin crew on aircraft that are parked, and with passengers on-board who are neither boarding nor deplaning, to be evenly distributed throughout the cabin and in the vicinity of floor-level exits in order to provide the most effective assistance in the event of an emergency. And: Safety Recommendation 2017-028 It is recommended that the European Aviation Safety Agency require cabin crew on aircraft that are parked and with passengers on-board to be evenly distributed throughout the cabin and in the vicinity of floor-level exits, in order to provide the most effective assistance in the event of an emergency. Evacuation from 4L and 4R Having been unsuccessful contacting the flight crew by interphone, the four FAs in the aft galley area assessed that the situation merited an emergency evacuation. The lavatory smoke alarm was sounding in the cabin but the C-FA misidentified this as the secondary evacuation signal. The sounds of the two alarms are different and AIP provides a further indication, so this misinterpretation suggests inadequate training or knowledge of the systems. However, even if the alarm had been correctly identified, it is likely that the dense and noxious smoke was sufficient for the FAs in the aft galley to initiate evacuation, with or without a PA instruction being heard. The FAs reported that they worked in a well-coordinated manner to arm the doors and begin an orderly evacuation, with the first passengers seen using the 4R slide one minute after smoke was first emitted from the APU exhaust. Commander’s instruction to cease evacuation The occupants of the flight deck did not report noticing amber door indicators presented on the flight deck SD. The pilots’ attention may have been focussed on the smoke warning on the display above. Consequently the commander only realised that a slide evacuation was

34 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 underway when he saw a reflection of the deployed slide from the terminal building. He thought the source of the smoke had been removed, because he had taken action to close off the APU air supply. He knew the APU had shut down, so did not seek assistance from outside the aircraft. He was concerned passengers might be put at more risk by using the slides than by staying on-board. Had the commander initiated an emer call to speak to the FAs it would have been in accordance with the actions required for the smoke lavatory smoke warning displayed at the time. This would have enabled the commander to agree a course of action with the FAs. Instead he made a PA to stop the evacuation, despite the OM’s guidance that it is ‘usually best’ not to attempt to halt an evacuation that is underway. The commander’s PA briefly caused confusion in the cabin and although he subsequently reversed this instruction, passenger egress was delayed by a few seconds. However, the commander reported that as soon as he realised slides had been deployed he made his PA to prevent injury; this stopped passengers from using the slide at 3R and ended the controlled slide evacuation from 4L and 4R. Aerodrome assistance The rapid response of the emergency services was due to ATC noticing an evacuation was underway and declaring an AGI. A delay could have occurred if the aircraft had been on a stand out of ATC’s line of sight, because no appropriate radio call was made. The only radio call the commander made was to alert the aircraft operator to the presence of passengers on the ramp. He did not call ATC because he assessed they already knew what was happening when he saw the RFFS arrive. Almost two minutes elapsed between the commander’s PA to end the evacuation and the arrival of the first RFFS vehicle. Subsequent flight deck actions The evacuation commenced without the flight crew’s knowledge and the evacuation checklist was not actioned immediately. Following the commander’s intervention and the subsequent decision to continue evacuating passengers via the jetbridge, the co-pilot and the IRO actioned the evacuation checklist to ensure “nothing was missed”. However, the second checklist item, to call ATC, was not carried out. ATC had tried to call the aircraft without response and a direct line of communication between the two parties might have enabled important information to be exchanged. The evacuation checklist also instructs the evacuation signalling system to be switched on but this was not deemed necessary with passengers now leaving by the jetbridge. A flight crew drill for ‘Emergency Deplaning’ might have been more appropriate but did not exist at the time (see Aircraft operator’s response in Safety action). The pilots remained aboard after the passengers and FAs had deplaned and the RFFS had declared the aircraft to be safe. The commander and the operator’s ‘Dispatch’ department communicated but no action was taken to remove power from the CVR in accordance with the FM.

35 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Crew training The aircraft operator’s guidance lacked clarity in places and there were differences between that provided to the flight crew and to the FAs. For example, the OM Volume 1, referred to by the flight crew, divided evacuations into planned and pre-planned events but no such differentiation was made in the FSIM, to which the FAs referred. The crew experienced communication and co-ordination difficulties, and some recommended procedures were not followed. This suggests that training for this scenario could be improved and reflects findings in Safety Study NTSB/SS-00/01 and also in Canada’s TSB Aviation Safety Study SA9501. The EU requires joint recurrent training that must address ‘effective communication and co‑ordination of tasks and functions’. IATA recommends that flight and cabin crew participate in joint training to enhance their co-ordination and a mutual understanding of human factors when dealing with emergencies. Whilst the operator involved in this occurrence has proposed action to improve its processes, improvements more generally may require action by the regulator. Accordingly, the following Safety Recommendation is made: Safety Recommendation 2017-029 It is recommended that the Federal Aviation Administration require that flight and cabin crew participate in joint training to enhance their co-ordination when dealing with emergencies. Safety action Aircraft operator’s response The aircraft operator recognised several aspects of this evacuation which it considered well handled by its personnel, allowing the aircraft occupants to move to a place of safety with minimal injury. However, the operator also found its guidance and training for cabin evacuations was orientated towards incidents during takeoff or landing, and its internal Safety Management System (SMS) dictated that certain processes be changed.

Rather than delaying any changes while a detailed internal report was prepared, the operator immediately established an Emergency Deplaning and Evacuation Task Force. Its role was to improve co-ordination and communication between the workforce in the flight deck, the cabin and on the ramp, to mitigate risks to passengers and employees during emergencies. This resulted in several internal safety actions: ● ● All pilots were informed that an evacuation should only be halted by the commander if he ‘has clear information that continuation of the evacuation would cause greater injury’. ● ● Studies of the interphone equipment on different aircraft types confirmed a need to refine the communication process on certain types. On the Airbus A319, A320, A321 or A330-300, FAs should now press the emer call button once to contact the flight deck in an emergency. On the Airbus

36 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 A330-200 they should press the prio capt button and on the Embraer E190 the emer pilot button. ● ● A video was produced with the co-operation of the crew involved in this occurrence, to highlight the issues they experienced. This video is being used as an educational tool for all pilots during their recurrent Human Factors (HF) training, for the nine month cycle commencing 1 February 2017. It may also become possible to use this video during FA training. ● ● A type-specific ’Emergency Deplaning’ drill has been developed for use by pilots on each of the operator’s aircraft types and incorporated into the OM and the appropriate QRH. This drill is relevant to parked aircraft that are using a jetbridge or steps. Details were promulgated to all crews and pilots received relevant simulator training. ● ● As there is no commonality between the cabin interphone handsets on different aircraft types, a physical training aid is being developed for use during initial and recurrent FA training. This is intended to give FAs a better understanding of the differences they will encounter and to help them adapt to any of the 14 aircraft types or variants on which they can be qualified. ● ● Recurrent HF training for the aircraft operator’s 12,000 pilots takes place on a 9 month cycle. The 27,000 FAs are on a 12 month cycle. This makes it difficult to conduct joint evacuation training with entire crews, so the operator is considering having pilot representatives participate in FA training and vice-versa. Future recurrent training for both pilots and FAs will focus on unplanned cabin evacuations when the aircraft is not on the runway. ● ● The Continuing Qualification training given to all FAs between April 2017 and March 2018 includes a review of an ‘Emergency Deplaning’ and it is likely attendees will hear the specific aural alert signals for each aircraft type. ● ● The operator expects a company safety investigator to contact the commander by telephone as soon as its ‘Dispatch’ department has been advised of a serious incident or accident. The safety investigator is now required to remind the commander during this contact that action be taken to ensure the circuit breaker for the CVR is pulled without delay. ● ● Training procedures were developed for the aircraft operator’s ramp personnel, to ensure they know how best to react if a slide evacuation occurs while an aircraft is parked. Twice a year, US operators, along with some foreign airlines that operate to the US, share experiences at a safety forum. The operator intends to discuss issues raised by this event at such a forum; to raise the industry’s awareness of the challenges that can be created by a cabin evacuation from a parked aircraft.

37 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 Aircraft manufacturer The aircraft manufacturer has reviewed and amended the MMEL section 24-23-01, for the dispatch of an aircraft with APU AC auxiliary generation unserviceable and a summary of these changes is as follows: MMEL item 24-23-01A ‘APU not used’: No change, as not relevant to the event. MMEL item 24-23-01B ‘Electrical failure’: To insure a more robust detection of a mechanical failure, a review has been conducted with the APU Generator supplier and the following 4 failure messages will be added to the list from the AMM task 24-23-00-040-803. GEN APU (8XS) GEN APU (8XS) EX FLD / GAPCU (40XG) GAPCU (40XG) EX FLD / GEN APU (8XS) GEN APU (8XS) EX FLD / GAPCU (40XG) If any of these messages is present in the PFR when doing the interactive APU test, then the MMEL 24-23-01C must be applied. MMEL item 24-23-01C ‘AC auxiliary generation deactivated or removed (mechanical failure)’: An update of the related AMM tasks (e.g. 24-23-00-040-801 and -802) has been decided, to prevent oil cross-contamination from the APU Gen to the APU. The AMM TASK 49-91-41-210-802-A “Check of the APU Oil System for APU Generator Debris” has been added at the end of those tasks, and must be carried out prior to aircraft dispatch. This AMM task includes a physical check of the APU oil system (inlet screens of the scavenge-oil, inspection of the magnetic chip detectors and the mechanical differential pressure indicator, check of the lubrication oil supply and generator scavenge filters). Conclusion Smoke entered the cabin after the APU load compressor oil seal became compromised, allowing hot oil to enter and pyrolyse in the bleed air supply to the cabin. Examination of the APU after the event revealed considerable metallic debris in its shared oil system. This debris eventually caused the load compressor carbon seal to fail, allowing hot oil to enter the bleed air supply to the cabin and causing smoke in the cabin. The initiating source of the debris could not be identified positively due to the distribution of debris throughout the oil system. Modifications exist to mitigate these conditions and two Safety Recommendations have been made that an optional SB, to add enhanced APU automatic shut-down protection for lubrication system contamination, be mandated.

38 © Crown copyright 2017 AAIB Bulletin: 12/2017 N276AY EW/C2016/06/02 The aircraft manufacturer has reviewed and amended the MMEL to provide enhanced mitigation when operating with unserviceable APU AC auxiliary electrical generation. This emergency situation, involving an evacuation from an aircraft parked at the gate with the jetbridge in place, was unusual for the FAs, who had not practised it as part of the aircraft operator’s training programme. Prompt and effective communication between the cabin and the flight deck might have avoided an evacuation, but the pilots and the IRO were distracted by the presence of an engineer, who was attending to a defect. The normal interphone call function used by the cabin crew did not attract their attention. The emergency call function may have been more conspicuous but guidance provided by the aircraft operator concerning its use may have been confusing. An evacuation was initiated because FAs did not receive specific instructions from the flight crew and the FAs perceived that the situation was life-threatening. Exits at the front of the aircraft were not used, indicating that the FAs in this part of the aircraft were trying to achieve an ‘Emergency Deplaning’ via the jetbridge, even though an evacuation was commanded. This may have been the most appropriate procedure in this situation but it was not a drill familiar to the flight crew and better crew communication was required before using it. Passengers near exits 3L and 3R had accepted responsibility for exit operation and, with no FAs in the vicinity when the emergency began, opened the doors but did not deploy one of the slides. This created the hazard of an unprotected five metre drop from the doorway to the ground and, even though an FA subsequently placed a security strap across the opening, it was fortunate that nobody used the affected door. Once the commander had realised an evacuation was underway he instructed it to cease because he believed he had removed the source of the smoke and wanted to prevent injury, but he did not discuss the cabin situation with the FAs before making his PA. This indicated a breakdown in communication and co-operation between flight crew and cabin crew members; an issue which is being addressed by the operator through enhanced guidance and training. Other operators may be susceptible to similar shortcomings in these circumstances until regulations for cabin evacuation training are amended to minimise them.

FD06588 ｜ 2017_英国_aaib-investigation-to-atr-42-500-g-lmsa__ATR_42-500_G-LMSA_07-25.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 Serious Incident

Aircraft Type and Registration: ATR 42-500 (600 version), G-LMSA No & Type of Engines: 2 Pratt & Whitney Canada PW127M turboprop engines Year of Manufacture: 2017 (Serial no: 1213) Date & Time (UTC): 23 July 2024 at 1230 hrs Location: Aberdeen International Airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 3 Passengers - 30

Injuries: Crew - None Passengers - None Nature of Damage: Significant damage to No 1 engine turbine assemblies and fire and heat damage to No 1 engine inside cowlings Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 40 years Commander’s Flying Experience: 2,700 hours (of which 210 were on type)

Last 90 days - 181 hours

Last 28 days - 62 hours Information Source: AAIB Field Investigation Synopsis Whilst in the cruise, the aircraft suffered a contained failure of the No 1 engine and a subsequent fire inside its cowlings due to a leak from the fuel return line which had become sufficiently loose following the engine failure to result in fuel leakage. The flight crew correctly followed the checklist procedures to shut down the engine, and the fire was extinguished. The aircraft landed without further incident. Although this is the only known instance of this fuel line becoming loose, the aircraft manufacturer has commenced a safety review to identify any possible safety actions which would further reduce the likelihood of leakage from the fuel return line. History of the flight The crew were operating their fourth sector of the day on a return flight to Glasgow Airport from Sumburgh Airport in Shetland. The aircraft took off from Runway 27 at 1129 hrs, then turned onto a southerly track, climbing to FL180 in the Y905 airway to the Aberdeen VOR. The commander was the pilot flying while the co-pilot was the pilot monitoring.

2 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 At approximately 1201 hrs, approaching RISDU, a reporting point 28 nm north-east of Aberdeen Airport, the commander described hearing a “big thump”, or a “muffled bang”. The aircraft immediately yawed to the left, which was corrected by the rudder trim under the control of the autopilot. The commander noticed an amber hbv1 label had replaced the digital counter on the No 1 engine torque indicator and that the torque had reduced to nearly zero. At the same time, the No 1 engine Interstage Turbine Temperature2 (ITT) was increasing rapidly. The co-pilot announced that there was an eng 1 over limit caution. They cancelled the Master Caution attention getter3 and started the relevant abnormal checklist procedure displayed on the Engine and Warning Display (EWD). However, the checklist was interrupted by an eng 1 fire warning. The crew completed the emergency checklist procedure for an engine fire in flight (Figure 1). Both fire bottles had to be discharged before the eng 1 fire warning extinguished. Figure 1 Engine fire or severe mechanical damage in flight checklist Footnote 1 Handling Bleed Valve: ensures correct operation of the low-pressure turbine stage. The amber HBV label indicates that the electronic engine control cannot control the valve. 2 ITT is the gas path temperature between the high pressure and the low-pressure turbines. 3 There is a Master Warning/Master Caution panel located above each PFD. Each panel has a Master Warning Light and Master Caution Light (the ‘attention getters’) that provide a visual indication to alert the pilot that a warning or caution has been generated. When pressed, the light will turn off and associated aural warnings will be cancelled.

3 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 Figure 2 Reporting points near Aberdeen Airport (Map data: Google, Jeppesen) The co-pilot declared a MAYDAY to Scottish Control while the commander initiated a descent and called the cabin crew to stations. The commander indicated to ATC that they intended to divert to Aberdeen, now approximately 24 nm to the south-west (Figure 2). Scottish Control instructed a descent to FL130 and transferred control to Aberdeen Radar. Concurrently, the co-pilot carried out the Single Engine Operations checklist (Figure 3).

4 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 Figure 3 Single engine operation checklist Given the proximity of the aircraft to Aberdeen at the time of the engine malfunction there was no requirement to cross-feed fuel. On contact with Aberdeen, the commander downgraded the emergency to a PAN and the aircraft was vectored to an approach on Runway 34. While being vectored, the crew noticed a fuel feed lo pr master caution, accompanied by a feed lo pr light4 on the fuel panel for the No 2 engine. The engine was running normally so the crew decided to prioritise the One Engine Inoperative (OEI) landing, which was accomplished at 1228 hrs without further incident. After shutting down the aircraft, the crew were informed by a ground engineer that fuel was leaking from the area of the No 1 engine. Footnote 4 Fuel feed low pressure: in case of fuel delivery pressure below 4 psi, the light illuminates amber. This indicates a fuel pump failure or fuel starvation.

5 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 Recorded information Following the event, the aircraft’s FDR and CVR were removed from the aircraft to be downloaded at the AAIB. A copy of the quick access recorder (QAR) data (containing the same data recorded by the FDR) for the event flight was also provided by the operator. Data for the event is plotted in Figure 4. Figure 4 Recorded data for the event The key points from Figure 4 are: [A] 12:01:02 (t0) – The torque on No 1 engine reduced from 90 to 0% within one second, with corresponding drops in fuel flow and NL, a rise in No 1 engine ITT, and aircraft sideslip to the left. This was followed by a master warning and eng 1 over limit message just over one second later. [B] 12:01:13 (t0+11) – Master warning and eng 1 fire in flight message.

6 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 [C] 1201:21 (t0+19) – Master warning and eng 1 shutdown message. [D] 1201:43 (t0+41) – (From CVR) crew stated fire handle 1 pulled. [E] 1202:08 (t0+66) – (From CVR) crew stated engine fire bottle 1 discharged. [F] 1202:41 (t0+99) – (From CVR) crew stated engine fire bottle 2 discharged. [G] 1202:53 (t0+111) – (From CVR) crew declare a MAYDAY. Also, from the CVR, the crew are heard actioning the Single Engine Operation checklist about four minutes after the first (No 1 engine) fire bottle was discharged. 20 seconds later, the co-pilot confirmed the No 1 engine fuel pump was off. Aircraft information The ATR 42-500 (600 version) is a twin-engine turboprop, short-haul regional airliner seating up to 48 passengers. Engine The Pratt & Whitney Canada PW127M turboprop engine is a two-spool gas turbine engine with two stage centrifugal compressors (also known as impellers) each driven by a separate turbine. A separate two stage power turbine powers the propeller via a reduction gearbox (Figure 5). Each of the rotating assemblies is supported and located by sets of roller and ball bearings. The No 1 engine was installed in the aircraft in February 2024. The fuel return line was installed at this time and had not been disturbed since. Figure 5 Cut away view of general engine arrangement (used with permission)

7 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 Engine fire detection and extinguishing The fire detection controls and indications are located in the flight deck. Each engine has a fire detection system which consists of two continuous loops in parallel connected to an electronic control unit. Each loop consists of five sensing elements connected in series. The elements are made of coaxial cable whose properties are sensitive to temperature. The fire detection control unit processes signals from the sensing elements and, if required, triggers corresponding indications in the flight deck. A fire extinguishing system is installed on each engine and the extinguishant5 is stored in two sealed bottles, one in each wing fairing. Each bottle’s contents can be directed to either engine depending on selections made by the flight crew. Fuel system Fuel is contained in a main tank and a feeder compartment in each wing. Each main tank is vented to atmosphere through a vent surge tank. Fuel is supplied to the engine from the feeder compartment which is continually replenished with fuel from the main tank either by the feeder tank jet pump6 or through flap valves in the tank wall. An electric fuel pump is used for engine starting but the engine feed jet pump takes over once a motive flow of fuel is established at sufficient pressure from the hydro-mechanical unit7 (HMU) via the motive flow valve. The electric fuel pump is then automatically shut down and the engine feed jet pump supplies fuel to the engine. If required, a Low Pressure (LP) fuel valve can be closed, by operating the fire handle in the cockpit, to shut off the fuel supply to the engine. For engine starting the electric fuel pump push-switch is pressed in, causing the electric fuel pump to operate and supply fuel to the engine. The run caption of the push switch is illuminated, and the motive flow valve is de-energised (Figure 6). Footnote 5 Mono-bromo-triflouromethane (CF3 Br). 6 A jet pump has no moving parts and consists of a venturi into which a jet of fuel under pressure is directed. This jet causes a pressure drop in the venturi which is used to draw a larger flow of fuel into the venturi and on to the outlet. 7 The aircraft manufacturer uses the term HMU in its manuals, but the engine manufacturer refers to the unit as the manual fuel control unit (MFCU). It notes the term HMU is used on the smaller PW100 series engines and the term MFCU is used on the larger PW100 series engines such as the PW127 fitted to this aircraft; both units perform a similar function. For consistency with the aircraft manufacturers diagrams shown in this report, the term HMU is used.

8 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 Figure 6 Schematic of No 1 engine fuel system, engine starting (used with permission) As the engine starts, fuel from the HMU is fed to the de-energised motive flow valve causing it to fully open and supply fuel to operate the engine feed jet pump. Once the feed from the fuel feed jet pump has sufficient pressure, the electric fuel pump is automatically switched off and the run caption is extinguished as the electric pump is no longer operating; the switch remains in the in position. In normal operation, fuel is fed to the respective engine by the engine feed jet pump which is powered by a motive flow of fuel via the motive flow valve (Figure 7). If the fuel pressure from the engine feed jet pump reduces, the electric pump will automatically restart to provide fuel flow, and its run caption will illuminate.

9 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 Figure 7 Schematic of No 1 engine fuel system, engine normal operation (used with permission) The motive flow valve The motive flow valve is used to control the motive flow of fuel from the HMU to the engine feed jet pump. The inlet is connected to the fuel return line from the HMU on the engine, and the outlet is connected to the engine feed jet pump in the header tank. The valve is controlled by an electrical solenoid and motive flow fuel pressure (Figure 8). Figure 8 Schematic of the motive flow valve (used with permission)

10 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 The solenoid is de-energised when the electric fuel pump press switch is selected in; this is the normal flight condition.  In this de-energised condition, the needle valve (1) opens and allows the fuel pressure in the valve chambers to equalise.  Fuel pressure from the HMU can then push up piston (2) which allows fuel to flow to the engine feed jet pump in the header tank. In this condition when there is no fuel flow from the HMU, a small flow of fuel from outlet to inlet is expected due to the valve design. If the electric fuel pump is selected out (off), the solenoid is energised, and the needle valve (1) closes causing the motive flow valve to fully close. Aircraft examination There was evidence of fire around the No 1 engine cowlings and an inspection of the area inside the cowling revealed additional fire damage and sooting. The fuel return line was found loose and leaking at the HMU outlet. With the motive flow valve de-energised, the flow of fuel leaking from the motive flow pipe when disconnected was measured at 165 ml/min. It was not possible to determine the flow rate at the time of the fire as the connection had been re-tightened to stem the leak whilst the aircraft was parked. The end fitting had been marked with indicator material. When the fitting was re-tightened, the marks aligned, and the leak stopped. Due to the routing of the fuel return line away from the end fitting, a 90° elbow, it was possible to use the line as a lever to manually loosen the fitting (Figure 9). Figure 9 Fuel return line connection to HMU after engine removed from aircraft (line temporarily fitted to show routing)

11 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 The aircraft manufacturer reported that they had no recorded in-service instances of this fuel return line fitting becoming loose. Engine examination Initial inspection of the engine identified that the second stage power turbine had suffered significant damage, and further damage was visible to the other turbine stages (Figure 10). Figure 10 Damage to No 1 engine second stage power turbine, looking from exhaust outlet The engine was removed from the aircraft and sent to the engine manufacturer’s facility where it was disassembled for detailed inspection under supervision of the Transport Safety Board (TSB) Canada. The elastomer material in the engine vibration isolation system showed signs of cracking indicating large forces had been exerted on them. The disassembly inspection identified that the No 6 main bearing, located aft of the low-pressure turbine, had suffered significant degradation resulting in the loss of location of the turbine assembly which then contacted the surrounding parts causing the damage seen to the turbines and their casings. This bearing has been sent to the engine manufacturer’s laboratories for detailed failure analysis under supervision of TSB Canada. Fuel system indications The crew reported that a No 2 engine feed lo press warning and that an amber box was displayed around the No 2 engine feeder tank. This was a parameter recorded by the FDR, but the recording from the event showed no change in status which would have indicated that a warning was displayed.

12 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 The amber box around the feeder tank means there was more than 160 kg in the No 2 tank, but that the No 2 feeder tank was not full. The feeder tank is normally kept topped up by a separate jet pump and, if this fails, the feeder tank is kept topped up via flap valves from the main tank when the feeder tank level falls below the main tank level to ensure fuel supply to the engine is maintained. The crew checklist action for a feed lo press is to ensure the electrical fuel pump is on which they did, and no issues were experienced with this engine. The indication was not displayed on the ground, no work was done on the No 2 fuel system, and no issues were reported on return to service. The cause of the fuel indications for the No 2 engine was not determined. Certification of engine shutoff The aircraft manufacturer advised for the ATR 42, the applicable certification basis is JAR 25 change 13, paragraph 25.1189, Shut-off means. Paragraph (a) requires, ‘Each engine installation and each fire zone specified in JAR 25.1181(a) (5) must have a means to shut off or otherwise prevent hazardous quantities of fuel, oil, de-icer, and other flammable fluids, from flowing into, within, or through any designated fire zone….’.​ The manufacturer was able to demonstrate compliance for the primary fuel supply line to the engine with the fuel shutoff valve. This valve can be used to cut off the primary fuel supply to the engine and therefore isolate it from further risk of fire. ​ ​The motive flow valve allows a small fuel leakage, when it is not energized (normal condition during flight), to the fuel return line which, when properly connected, is sealed.  Compliance for this line was provided by the line being made of fire-resistant material and its integrity is guaranteed by the installation and the associated maintenance procedures to install it. Analysis Engine The disassembly of the engine identified that the No 6 bearing had suffered significant degradation resulting in the loss of location of the high-pressure turbine assembly and the damage seen to the turbines and their casings.

The No 6 bearing has been sent for more detailed examination and the results of this work will be used to inform the established airworthiness and reliability processes of the engine manufacturer. If the findings of this work require it, an addendum to this report will be issued. Motive flow valve Testing of the motive flow valve confirmed it was operating normally and that, with the valve de-energised, a small flow from outlet to inlet is expected due to the valve design. The leak from the loose fuel return line connector to the HMU was consistent with this flow rate. In

13 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 normal conditions this connector would be secure, and the fuel would remain contained in the line. In this event as the connector was loose, the fuel leaked into the cowling area and then ignited. During this event and following the engine failure, the crew followed the relevant procedure, ‘Engine Fire or Severe Mechanical Damage’, to shut down the engine. Operating the fire handle closed the LP fuel valve and thereby shutoff the main fuel supply to the engine.  Once the engine was shut down, there was no motive flow from the HMU, and the motive flow valve piston would drop closing off the valve.  However, in this de-energised condition, fuel would still flow from the outlet to the inlet of the valve and leak through the loose fuel return line connection due to gravity as the fuel tank is higher than the loose connection. It was only later in the crew procedures, and after the fire had been extinguished, the crew moved on to the Single Engine Operation checklist. This checklist requires the crew to select the fuel pump push switch off.  This selection energised the motive flow valve solenoid causing it to fully close the motive flow valve and stop the flow of fuel from the loosened fuel return line.  The fuel flow would be stopped for the remainder of the flight providing the fuel pump switch remained off.  If the crew had subsequently needed to cross-feed fuel to maintain lateral balance, the fuel pump for the failed engine would need to be selected on to feed fuel from that tank. This selection would de-energise the motive flow valve and allow the leak to recommence. It would stop again when the electrical fuel pump press switch was selected off after the completion of fuel transfer. The time taken from the fire warning until the electrical fuel pump being selected off was approximately five minutes. The crew completed the required checklists in a timely and accurate manner and successfully extinguished the fire using both fire bottles at the required intervals. The crew remained unaware of the leaking fuel until after the aircraft was parked. Their prompt completion of the Single Engine Operation checklist ensured the fuel leak in flight was stemmed and prevented a potential escalation of the emergency. Due to the proximity of the diversion airport, fuel transfer was not required. Later, when the aircraft was parked and electrical power removed, the motive flow valve solenoid became de-energised, and the leak recommenced. Maintenance staff were able to stem the leak by re-tightening the connection. The motive flow valve will only be fully closed when it is energised following flight crew selection of the electric fuel pump to off. Should the crew need to cross-feed to maintain lateral balance the electric fuel pump would need to be selected on again and then motive flow valve would be no longer shut-off.

14 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 Fuel return line The engine failure was violent as witnessed by the rapid reduction in torque and tears in the elastomer anti-vibration mounts and it is considered possible that the reaction to this sudden reduction in torque could have caused the fuel return line to ‘whip’ and loosen the connection and for consequent engine vibrations to have loosened it further. There is no secondary locking on the connection and the line leaves the HMU via a 90° elbow which would add leverage to any loosening forces. It is also possible that the connection was not correctly torqued during installation, but maintenance records indicated it had been and there were no reports of leakage before the event. The operator had also conducted a check of its fleet of similar aircraft and found all the fuel return lines had been correctly installed. The design of the fuel return line installation complied with the certification standards in place at the time of certification. However, as was seen in this event, loosening of the fuel return line was not identified as a risk as the integrity of the line was assured by the use of fire-resistant materials, the installation and associated maintenance procedures. The aircraft manufacturer confirmed that they were not aware of any events where the motive flow fuel line had become loose and leaked. Interviews with maintenance staff, checks of maintenance documentation and inspection of the connection, confirmed that it was likely this connection had been correctly installed and tightened when the engine was installed in the aircraft in February 2024. Conclusion The No 1 engine suffered a contained failure. This was due to significant degradation of its No 6 main bearing which resulted in the rotating high-pressure turbine being no longer correctly located. This allowed the rotating parts to contact adjacent parts causing significant damage to the turbine stages. There was an under-cowling fire which was due to leaking fuel igniting on hot engine parts. It was detected and extinguished by the crew using onboard systems; both fire bottles were discharged. The fuel leak was from the connection between the HMU and the fuel return line which had become loose. The reason for this could have been either that the connection had not been tightened correctly when it was installed or that it had become loose due to the forces of the engine failure ‘whipping’ the fuel return line. Maintenance records, interviews with the maintenance staff and indicator markings appeared to confirm that it had been tightened correctly, and the aircraft manufacturer was not aware of any other cases where this connection had become loose. Due to the fuel system design, specifically that of the motive flow valve, fuel continued to leak from the loosened fuel return line after the crew, as part of the Engine fire or Severe Mechanical Damage checklist, operated the fire handle to shut down the engine. It continued

15 All times are UTC © Crown copyright 2025 AAIB Bulletin: G-LMSA AAIB-30223 to leak until the crew selected the No 1 engine electrical fuel pump off as part of the Single Engine Operation checklist, as it was this selection to off that fully closed the motive flow valve. The fuel leak would have recommenced if the crew had needed to cross feed fuel to maintain the lateral balance of the aircraft as this process requires the electrical fuel pump to be selected on, thereby allowing the motive flow valve solenoid operated needle valve to open which would then allow fuel to leak through it from the feeder tank and out of the loose connection. Safety action The aircraft met certification requirements in place at the time of certification, and there have been no other similar events in the history of the aircraft. However, the aircraft manufacturer has initiated the following safety action: The aircraft manufacturer has commenced a safety review to identify any possible safety actions which would further reduce the likelihood of leakage from the fuel return line. This review will be completed by the end of 2025. Published: 19 June 2025.

FD06589 ｜ 2017_英国_aaib-investigation-to-beech-a36-bonanza-g-jlhs__Beech_A36_Bonanza_G-JLHS_12-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

95 © Crown copyright 2017 AAIB Bulletin: 12/2017 G-JLHS EW/G2017/07/29 SERIOUS INCIDENT Aircraft Type and Registration: Beech A36 Bonanza, G-JLHS No & Type of Engines: 1 Continental Motors Corp IO-550-B piston engine Year of Manufacture: 1990 (Serial no: E-2571) Date & Time (UTC): 20 July 2017 at 1110 hrs Location: Alderney Airport Type of Flight: Private

Persons on Board: Crew - 2 Passengers - 1 Injuries: Crew - None Passengers - None Nature of Damage: None Commander’s Licence: Private Pilot’s Licence Commander’s Age: 78 years Commander’s Flying Experience: 3,337 hours (of which 3,207 were on type)

Last 90 days - 38 hours

Last 28 days - 24 hours Information Source: Aircraft Accident Report Form submitted by the pilot As a result of a hard landing at Alderney, a momentary short circuit of the master avionics power at a stub terminal on the firewall caused the avionics to turn off and remain off. Following a number of bounces, the aircraft became airborne again and departed initially to the south. Without radio, the pilot was unable to communicate with Alderney TWR and to advise of his intention to divert to Guernsey. However, on the approach to Guernsey, he made contact with Guernsey TWR via mobile phone before making a successful landing. The electrical problem was investigated by a Guernsey maintenance organisation and identified that the rubber boot to cover the stub terminal on the firewall was missing. This had allowed arcing between the engine and the exposed stud.

FD06590 ｜ 2017_英国_aaib-investigation-to-bn2a-mk-iii-2-trislander-g-rlon__BN2A_Mk_III-2_Trislander_G-RLON_03.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

11 © Crown copyright 2017 AAIB Bulletin: 3/2017 G-RLON EW/G2016/11/08 SERIOUS INCIDENT Aircraft Type and Registration: BN2A Mk III-2 Trislander, G-RLON No & Type of Engines: 3 Lycoming O-540-E4C5 piston engines Year of Manufacture: 1975 (Serial no: 1008) Date & Time (UTC): 10 November 2016 at 0800 hrs Location: Alderney Airport, Channel Islands Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 1 Passengers - 9 Injuries: Crew - None Passengers - None Nature of Damage: None Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 50 years Commander’s Flying Experience: 6,340 hours (of which 3,100 were on type)

Last 90 days - 48 hours

Last 28 days - 15 hours Information Source: Aircraft Accident Report Form submitted by the pilot While vacating Runway 26 at Alderney Airport following a rejected takeoff, G-RLON trampled a runway edge light. The pilot reported that he was made aware of the damage to the light but, because he could see no corresponding damage to his aircraft, particularly to the tyres, he decided to continue with the flight. After the aircraft took off, the Airport Fire Service found a “gouge” on the grass which, it was thought, might have been caused by a flat tyre. ATC relayed this information to the pilot who decided to fly past the ATC tower at Guernsey Airport for a visual inspection. No damage was seen during this inspection and the pilot landed without further incident. The pilot reported that, following the flight, engineers inspected the aircraft and found nothing which they considered to have been caused by the incident before departure.

FD06591 ｜ 2017_英国_aaib-investigation-to-boeing-737-36e-freighter-tf-bbf__Boeing_737-36E_Freighter_TF-BBF_12.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

50 © Crown copyright 2017 AAIB Bulletin: 12/2017 TF-BBF EW/C2017/02/03 SERIOUS INCIDENT Aircraft Type and Registration: Boeing 737-36E Freighter, TF-BBF No & Type of Engines: 2 CFM International CFM56-3B2 turbofan engines Year of Manufacture: 1992 (Serial no: 25264) Date & Time (UTC): 3 February 2017 at 0015 hrs Location: East Midlands Airport, Leicestershire Type of Flight: Commercial Air Transport (Cargo) Persons on Board: Crew - 2 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Overheating of rear equipment bay Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 50 years Commander’s Flying Experience: 9,889 hours (of which 8,087 were on type)

Last 90 days - 94 hours

Last 28 days - 26 hours Information Source: AAIB Field Investigation Synopsis Shortly prior to engine start the aircraft suffered an APU bleed air duct leak in the rear equipment bay. The leaking bleed air heated corrosion-inhibitor material in the rear equipment bay, resulting in scorching and the release of smoke within the main cargo deck. The flight crew shut the APU down. The cause of the bleed air leak was a failed V-band clamp that had fractured due to stress corrosion cracking. The operator is currently replacing V-band clamps at the failure location on its fleet of 737-300 and 737‑400 freighter aircraft. History of the flight The aircraft was conducting a scheduled cargo flight from East Midlands Airport to Edinburgh Airport, with the co-pilot as Pilot Flying. At approximately 0015 hrs the flight crew completed their pre-departure checklist and requested pushback, which ATC approved. The crew reported that the aircraft was configured for engine start, with the APU running, both air conditioning packs switches in the off position1, the engine bleed air switches both set to on and the APU bleed air valve switch in the on position. The aircraft’s exterior doors were closed. Footnote 1 Boeing’s FCOM procedure puts both pack switches to auto.  Boeing later commented that some operators perform one pack takeoff or pack off takeoff to gain higher thrust.

51 © Crown copyright 2017 AAIB Bulletin: 12/2017 TF-BBF EW/C2017/02/03 Shortly before the pushback was due to commence, the fire warning bell sounded. The crew looked at the indications on the fire warning panels, both on the centre console and the P5 overhead panel, but did not see any fire warning lights on either panel. The co-pilot cancelled the fire warning bell and then pressed the master caution recall button, and later stated that he could not recall if any fire warning lights were illuminated. The commander also stated that he did not see any fire or overheat warning lights. Approximately 10 seconds after the first fire warning bell, the fire bell sounded for a second time, again without the crew recalling observing any smoke or fire warning indications on the fire warning panels. The commander asked the ground crew, via the pushback headset, whether they could see any smoke or fire coming from the aircraft; the ground crew reported that smoke was emanating from the rear of the aircraft. Whilst this message was being received, the crew observed and smelt smoke entering the cockpit, despite the cockpit door being closed. The commander shut down the APU. The co-pilot walked to the forward galley and found that the smoke was thickening rapidly and was getting hotter, with the source of the smoke beneath the cargo deck floor. He returned to the flight deck and informed the commander, whereupon the commander called ATC requesting the immediate response of the airport fire and rescue service (AFRS). The co-pilot opened the forward left cabin door and signalled to the ground crew to bring steps to the aircraft. He then went to the forward galley and opened the forward right cabin door in order to further expel the smoke. The commander signalled to the ground crew to reconnect the ground power unit and the pilots then departed the aircraft via the steps. The AFRS arrived at the aircraft at 0023 hrs and began investigating the source of the smoke. Aircraft information The Boeing 737-300 is equipped with a wing-body overheat detection system, consisting of a number of heat detector elements located in close proximity to the aircraft’s bleed air ducts and a monitoring system that detects a drop in electrical resistance of a detector element when that element is subjected to excessive heating. When triggered, the system activates a wing-body overheat light on the air conditioning overhead panel2 and the master caution warning and air cond annunciator lights on the cockpit glareshield, Figure 1. No audio warning is associated with the system. Tests performed by the operator’s maintenance personnel following the incident showed that the wing-body overheat detection system was serviceable. During the flight crew operations manual (FCOM) pre-flight procedures, the co-pilot is required to set the aircraft’s bleed air valves and air conditioning packs. The procedure requires that one air conditioning pack switch should be switched from off to auto or high, whilst the other should be set to off. The isolation valve switch should be set to auto and the engine bleed air switches set to on, Figure 2. Footnote 2 An overheat detection of the APU bleed air duct will cause the left wing-body overheat caption to illuminate.

52 © Crown copyright 2017 AAIB Bulletin: 12/2017 TF-BBF EW/C2017/02/03 Figure 1 Boeing 737-300 cockpit glareshield fire warning buttons, master caution buttons and system annunciator captions Figure 2 Boeing 737-300 air conditioning control panel, showing positions of the dual bleed and left wing-body overheat captions

53 © Crown copyright 2017 AAIB Bulletin: 12/2017 TF-BBF EW/C2017/02/03 Once this has been completed, the APU bleed air switch should be set to on; this causes the dual bleed warning light to illuminate on the air conditioning overhead panel, accompanied by illumination of the cockpit glareshield master caution warning lights and air cond annunciator light, Figure 2. This is a normal part of the pre-flight procedure, as the APU bleed air valve is open at the same time as the left engine bleed air valve, allowing possible back-pressure of the APU if the left engine is operated above idle power whilst the bleed air valves are in this configuration, Figure 3. Figure 3 Boeing 737-300 bleed air pneumatic system The aircraft is equipped with independent smoke detection systems on both the main cargo deck and lower cargo hold. Both systems are integrated with the aircraft’s master caution and fire warning systems to alert the crew. The presence of smoke in the main cargo deck will cause the fire bell to sound, the smoke warning light to illuminate on the main deck smoke detection system panel, located on the aft overhead P5 panel, and the glareshield master caution and fire buttons to illuminate. The presence of smoke in the lower cargo hold will cause the fire bell to sound, the fire warning light to illuminate on the lower hold fire warning system panel, located on the co‑pilot’s P5 overhead panel, and the glareshield master caution and fire buttons to illuminate. Tests on both main cargo hold and lower cargo hold smoke detection systems carried out after the event showed that both systems operated normally and were serviceable.

54 © Crown copyright 2017 AAIB Bulletin: 12/2017 TF-BBF EW/C2017/02/03 The aircraft’s lower cargo hold is classified as a ‘Class D’3 hold that is fully sealed in order to passively suppress fires within the compartment through oxygen starvation. The aircraft’s rear equipment bay is immediately to the rear of the lower cargo hold, behind a bulkhead, and is immediately beneath the main cargo deck floor. A floor grating in the main cargo deck floor permits the passage of air from the rear equipment bay into the main cargo deck. As neither of the aircraft’s engines were running during the smoke event, neither the FDR nor quick access recorder (QAR) were recording data when the event occurred. Aircraft examination Investigation by the operator’s engineering personnel revealed that a V-band clamp4 had separated from a joint on the APU bleed air duct in the rear equipment bay, immediately forward of the aft pressure bulkhead, beneath the main deck cargo floor in the vicinity of fuselage station (STA) 1016, Figure 4. Figure 4 Location of the APU bleed air duct leak and failed V-band clamp The aft pressure bulkhead adjacent to the leaking APU bleed air duct joint showed evidence of overheating and scorching due to ignition of the Ardrox AV8 corrosion-inhibitor coating on the aircraft’s internal structure in this location, Figure 5. Footnote 3 Federal Aviation Regulation 25.857, Cargo Compartment Classification. 4 A V-band clamp consists of a series of profiled segments welded within a tensioned outer strap. They are commonly used to connect the flanged ends of pipe segments together.

55 © Crown copyright 2017 AAIB Bulletin: 12/2017 TF-BBF EW/C2017/02/03 Leaking APU bleed air duct joint, note missing clamp Figure 5 Overheating damage to the aircraft’s structure adjacent to the APU bleed air duct leak The aircraft manufacturer stated that, when the aircraft’s APU is running, the air within the APU bleed air duct, at the point of rupture, can reach a maximum temperature of 376°C. The material safety data sheet for Ardrox AV8 states that the material has an auto-ignition temperature of 200°C. The failed V-band clamp was marked with part number BACC10DU400AB Rev. T and a date of manufacture of March 1989. The aircraft manufacturer confirmed that it was the correct part number clamp for the application. The clamp is not marked with a serial number and is considered an on-condition part, with its service life not tracked in the aircraft’s maintenance programme (AMP). It was unclear how long the clamp had been installed on TF-BBF. The only maintenance inspection for the clamp defined within the AMP, and Boeing documentation, was a zonal inspection5, performed at 1C and 2C check intervals. This zonal inspection had last been carried out on TF-BBF in July 2015; the inspection contained the following requirement: ‘Visually check all systems and installations in the aft cargo equipment bay area (Zone 220) for defects/damage, cleanliness, loose and missing fasteners, cracks, corrosion, degradation of protective coatings, condition and security.’ The aircraft’s maintenance planning document defines a visual examination as: ‘Visual examination of defined internal or external structural areas from a distance considered necessary to carry out an adequate check… Internal applies to obscured structure requiring removal of fillets, fairings, access panels and doors etc. for visibility. Adequate lighting is required and where necessary aids such as mirrors etc., surface cleaning and access procedures may be required to gain proximity.’ Footnote 5 Task Card 53-420-21-01.

56 © Crown copyright 2017 AAIB Bulletin: 12/2017 TF-BBF EW/C2017/02/03 Metallurgical analysis The broken clamp was recovered from the rear equipment bay, Figure 6 and subjected to detailed examination. The clamp’s tension band had fractured at the point where the upper folded part of the band is attached to the main lower part of the band by two staggered rows of spot welds, Figure 7. Figure 6 Broken V-band clamp Figure 7 V-band clamp fracture location at spot welds In addition to the main fracture, three further cracks in the clamp’s band were identified, Figure 8. These additional cracks were located at points on the band between where the inner profiled segments were attached, at points where the band bending loads were highest.

57 © Crown copyright 2017 AAIB Bulletin: 12/2017 TF-BBF EW/C2017/02/03 Figure 8 Other cracks identified in the V-band clamp band The clamp band material was specified by the manufacturer as 21-6-9 CRES steel6, to specification BMS 7-191. The material composition of the clamp was checked by a specialist laboratory and found to be within specification, apart from trace levels of additional sulphur, aluminium and vanadium. The additional sulphur was deemed most likely to be present due to the products of combustion generated during the overheating event. The fracture surface was heavily corroded, indicating that the crack had been present for a considerable period of time and that the clamp had been exposed to a corrosive environment. After cleaning, scanning electron microscopy analysis of the fracture surface revealed small areas of ductile overload at the outer edges of the crack, and large areas of intergranular cracking, which is consistent with stress corrosion cracking (SCC). SCC is a progressive crack growth mechanism that occurs in certain metals that are subjected to tensile loading in a corrosive environment. The presence of intergranular cracking was further confirmed by a metallographic section of the fracture face, Figure 9, which showed a branching crack path that is typical of SCC. It was not possible to determine exactly when the cracks had formed, and whether they would have been large enough to detect visually when the 1C maintenance inspection was performed in July 2015. Footnote 6 A corrosion resistant (CRES) stainless steel with major alloying elements chromium, nickel and manganese.

58 © Crown copyright 2017 AAIB Bulletin: 12/2017 TF-BBF EW/C2017/02/03 Figure 9 Metallographic section of band fracture face, showing branching crack paths Analysis The available evidence suggests that shortly after the APU bleed air valve was opened as part of the engine start procedures, the V-band clamp joining two sections of APU bleed air duct in the rear equipment bay failed, releasing hot bleed air into the rear equipment bay. The bleed air was of sufficiently high temperature to cause auto-ignition of the Ardrox AV8 corrosion inhibitor present on the aircraft’s structure in the rear equipment bay. This in turn caused scorching, possibly a localised fire and generation of a significant quantity of smoke. Once the crew was aware of the presence of the smoke emanating from the rear of the aircraft, the action of shutting the APU down removed the source of leaking bleed air. Human factors Following the event the crew did not recall observing a wing-body overheat warning light on the air conditioning overhead panel, however when later tested the wing-body overheat detection system was found to be serviceable. One possibility is that the master caution and air cond annunciator light remained lit after the APU bleed air valve was opened, as normal, but when the V-band clamp failed the only indication of an overheat condition was the additional wing-body overheat warning light on the overhead panel. As no aural warning accompanies the wing-body overheat light, and the warning light is in the co-pilot’s peripheral vision during engine start, it may not have been observed. A second possibility is that the first master caution was cancelled but when it recurred, together with the air cond annunciator, the co-pilot looked at the overhead panel and observed the dual bleed warning light, which is what he expected to see, and did not notice the wing-body overheat warning light. The cause of the fire warning bell to sound was probably due to the presence of smoke in the main cargo deck, entering the cargo deck via the floor grating above the rear equipment bay. As the main cargo deck smoke detection system was found to be serviceable after the event, it is probable that the glareshield fire warning buttons and the main cargo deck

59 © Crown copyright 2017 AAIB Bulletin: 12/2017 TF-BBF EW/C2017/02/03 SMOKE caption were illuminated, but by this time the crew was aware of the smoke in the rear of the aircraft and were already taking mitigating actions. Clamp failure The metallurgical evidence shows that the V-band clamp failed as a result of stress corrosion cracking, and that the crack propagation had taken place over a considerable period of time. The tensile loading in the clamp’s outer band, necessary for securing the duct joint, is applied by tightening the clamp’s locking nut. Whilst the projection of the clamp’s bolt beyond the locking nut as found after the incident did not indicate over-tightening of the clamp, it was not possible to eliminate previous over-tightening of the clamp as a contributory factor in the clamp’s eventual failure. The position of the clamp in the rear of the rear equipment bay, in close proximity to the aft pressure bulkhead, renders visual examination for cracking difficult. Furthermore it was not possible to determine exactly when the cracks had formed in the clamp’s outer band and it is possible that they were below the size detectable by visual inspection when the aircraft underwent its most recent 1C maintenance inspection. Safety action The operator is replacing the V-band clamps at the failure location on TF-BBF across its fleet of 737-300 and 737-400 aircraft. This is being carried out on a rolling programme, as the aircraft undergo scheduled C-check maintenance inspections. The operator is also considering replacement of other V-band clamps on their aircraft where the release of bleed air may create a hazard. Conclusion Shortly prior to engine start, a V-band clamp failed on the APU bleed air duct in the rear equipment bay. This led to a leak of hot bleed air which heated corrosion-inhibitor material in the rear equipment bay, resulting in scorching and the release of smoke into the main cargo deck. The flight crew were made aware of the presence of the smoke and shut the APU down. The V-band clamp failed due to stress corrosion cracking and the operator is currently replacing this clamp on its fleet of 737 aircraft during scheduled C-check maintenance inspections.

FD06592 ｜ 2017_英国_aaib-investigation-to-boeing-737-8k5-g-fdzy__Boeing_737-8K5_G-FDZY_03-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

12 © Crown copyright 2017 AAIB Bulletin: 3/2017 G-FDZY EW/G2017/01/05 SERIOUS INCIDENT Aircraft Type and Registration: Boeing 737-8K5, G-FDZY No & Type of Engines: 2 CFM56-7B27E turbofan engines Year of Manufacture: 2011 (Serial no: 37261) Date & Time (UTC): 10 January 2017 at 0821 hrs Location: Bournemouth Airport, Dorset Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 7 Passengers - 177 Injuries: Crew - None Passengers - None Nature of Damage: Three fan blades damaged Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 42 years Commander’s Flying Experience: 11,672 hours (of which 7,868 were on type)

Last 90 days - 168 hours

Last 28 days - 54 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis The left engine ingested a bird as the aircraft took off and the crew diverted to London Gatwick for an uneventful, overweight precautionary landing. History of the flight As the aircraft was rotated for takeoff the left engine ingested a bird, which was later identified as a seagull. A change to the engine sound was heard and the indicated engine vibration increased, accompanied by light airframe vibration. Takeoff thrust was maintained without engine limits being exceeded. The crew levelled the aircraft at 4,000 ft amsl to assess the situation and requested a return to Bournemouth to hold. They informed ATC of the birdstrike and asked for the runway to be inspected. With the aircraft in level flight, the vibration reduced and the engine was operating within allowable parameters. The crew liaised with the aircraft operator by radio and decided to divert to London Gatwick, which has a longer runway than Bournemouth. The time in the hold was used to brief the crew and passengers, burn fuel to reduce the landing weight and consult the Quick Reference Handbook; the ‘High Engine Vibration’ checklist was reviewed to pre-empt an increase in vibration in the event of a go-around. It was apparent that engine vibration worsened if power was increased, so the crew decided to perform a precautionary

13 © Crown copyright 2017 AAIB Bulletin: 3/2017 G-FDZY EW/G2017/01/05 overweight landing using flap 15. Landing performance was confirmed satisfactory and the crew briefed on flare technique, stopping and selecting non-standard flap 1 in the event of a go-around. A PAN call was made when the diversion was initiated and the crew briefed Gatwick ATC that they intended to vacate the runway and stop to allow the fire service to examine the engine and brakes. The crew informed the cabin crew and passengers that they were diverting to Gatwick and explained the expected order of events on the ground. The landing was uneventful and, after the fire service had completed an external check of the aircraft, it was taxied to a parking stand with the left engine shut down. Three fan blades were damaged by the birdstrike. The engine was subsequently repaired on-wing.

FD06593 ｜ 2017_英国_aaib-investigation-to-cessna-750-citation-x-g-cedk__Cessna_750_Citation_X_G-CEDK_01-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

48 © Crown copyright 2017 AAIB Bulletin: 1/2017 G-CEDK EW/G2016/08/05 INCIDENT Aircraft Type and Registration: Cessna 750 Citation X, G-CEDK No & Type of Engines: 2 Rolls-Royce AE 3007C1 turbofan engines Year of Manufacture: 2006 (Serial no: 750-0252) Date & Time (UTC): 12 August 2016 at 0902 hrs Location: Inverness Airport, Scotland Type of Flight: Private Persons on Board: Crew - 2 Passengers - 3 Injuries: Crew - None Passengers - None Nature of Damage: None Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 50 years Commander’s Flying Experience: 6,960 hours (of which 1,850 were on type)

Last 90 days - 60 hours

Last 28 days - 40 hours Information Source: Aircraft Accident Report Form submitted by the pilot Shortly after starting the left engine, the flight crew noticed a transient smell of burning rubber, which they described as being identical to that of tyre smoke from a landing aircraft. There were no visible indications of anything abnormal and, as the smell then disappeared, the aircraft was taxied for departure with the crew monitoring for any recurrence. Just after completing the turn onto Runway 11, the commander noticed a small amount of pale grey smoke, below the level of the instrument coaming, which was confirmed by the co-pilot. The aircraft was brought to a halt and the crew reviewed the situation, before deciding to carry out the Emergency Evacuation Drill. Air Traffic Control was informed and an evacuation was carried out through the aircraft main door, with the passengers being led upwind of the aircraft as the Airport Fire Service arrived. A post-incident inspection by the operator’s maintenance engineer identified that the cabin air cycle machine had failed, causing smoke to enter the cabin.

FD06594 ｜ 2017_英国_aaib-investigation-to-cessna-a152-aerobat-g-boso__Cessna_A152_Aerobat_G-BOSO_09-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

90 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BOSO EW/G2017/04/12 ACCIDENT Aircraft Type and Registration: Cessna A152 Aerobat, G-BOSO No & Type of Engines: 1 Lycoming O-235-L2C piston engine Year of Manufacture: 1981 (Serial no: A152-0975) Date & Time (UTC): 19 April 2017 at 1447 hrs Location: Redhill Aerodrome, Surrey Type of Flight: Training Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Firewall, propeller and right wing damaged, nosewheel collapsed Commander’s Licence: Student Commander’s Age: 57 years Commander’s Flying Experience: 20 hours (of which 20 were on type)

Last 90 days - 6 hours

Last 28 days - 2 hours Information Source: Aircraft Accident Report Form submitted by the pilot Following several successful landings with an instructor, the student pilot flew solo circuits to grass Runway 08L. He reported the weather to be fine with nil wind, good visibility and a temperature of 12°C. During the final landing, G-BOSO bounced and then landed in a level or nose-down attitude. The nosewheel leg collapsed, and the aircraft came to a stop on its nose and starboard wingtip. The pilot believed that it may have been preferable to initiate a go-around after the initial bounce.

FD06595 ｜ 2017_英国_aaib-investigation-to-dhc-8-402-dash-8-g-ecof__DHC-8-402_Dash_8_G-ECOF_03-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

66 © Crown copyright 2017 AAIB Bulletin: 4/2017 G-ECOF EW/G2016/10/15 SERIOUS INCIDENT Aircraft Type and Registration: DHC-8-402 Dash 8, G-ECOF No & Type of Engines: 2 Pratt & Whitney Canada PW150A turboprop engines Year of Manufacture: 2008 (Serial no: 4216) Date & Time (UTC): 30 October 2016 at 1340 hrs Location: Belfast City Airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 4 Passengers - 77 Injuries: Crew - None Passengers - None Nature of Damage: Heat damage to tail cone Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 35 years Commander’s Flying Experience: 6,370 hours (of which 6,190 were on type)

Last 90 days - 211 hours

Last 28 days - 68 hours Information Source: Aircraft Accident Report Form submitted by the pilot and additional AAIB inquiries Synopsis During preparations for takeoff the flight crew were made aware that smoke could be seen emanating from the rear of the aircraft around the APU. The commander initiated a precautionary disembarkation and the APU, which had been running, shut itself down. It was apparent that the tail cone of the aircraft had become very hot, resulting in discolouration of the external surfaces. It was subsequently found that the APU exhaust duct liner had partially disintegrated, resulting in hot exhaust gases being directed outside the liner. Two days prior to this event, a piece of the liner had been ejected from the APU exhaust whilst the aircraft was on stand at Birmingham. However it was incorrectly identified as originating from an airport vehicle and the aircraft was allowed to continue in service. History of the flight The aircraft was boarded, the passenger doors were closed and the crew was preparing for departure. The APU was running, with the intention of using it for engine start during pushback. One of the ground handlers informed the crew that smoke was emanating from the rear of the aircraft around the APU. The absence of flight deck indications of an APU fault and the calm demeanour of the ground handler led to the commander not being overly concerned at this stage. He asked the No 1 cabin attendant to open the forward door, with the intention of investigating the problem himself. Meanwhile the co-pilot contacted ATC and asked if they could see anything unusual. After a short delay a reply was received stating that

67 © Crown copyright 2017 AAIB Bulletin: 4/2017 G-ECOF EW/G2016/10/15 smoke could be seen around the rear of the aircraft. At this point the commander decided to initiate a precautionary disembarkation and briefed the cabin crew over the intercom. Only the forward main passenger door was used as the rear airstairs were unserviceable. He also asked the co-pilot to put out a PAN call to ATC, informing them of the situation. At around this time the APU shut down, generating a fail caption. At no time were any fire or smoke warnings received on the flight deck, nor were any fumes or smoke observed inside the aircraft, although a burning odour became apparent as the incident progressed. All the passengers had disembarked by the time the airfield fire service had reached the aircraft and, after consultation with the fire chief, the crew pulled the FDR and CVR circuit breakers, shut down the electrical systems and vacated the aircraft. The fire crew used thermal imaging equipment to determine that the temperature in the APU area was around 158°C, which reduced to 40°C at the rear pressure bulkhead. The heat had resulted in discolouration of the external surfaces of the tail cone. Earlier incident Two days before the APU incident, on 28 October 2016, the same aircraft, with a different crew, was on stand at Birmingham and had received pushback clearance with the APU running. The pushback tug driver then noticed a piece of debris lying approximately 10 m behind the aircraft; it was hot when he picked it up. The commander examined the object and conducted a walk-round inspection of the aircraft. There was no obvious aircraft damage and the object bore no markings, such as a part or serial number. He discussed the matter with the co-pilot, who confirmed that nothing abnormal was observed during his walk-round some 30 minutes earlier. Photographs were taken of the debris item (Figure 1), which was then disposed of in a FOD (foreign object damage) bin. The engines were started on stand and were noted to operate normally. In the absence of any evidence to indicate that the object was associated with the aircraft the pilots assumed that it had come from a passing truck on the roadway behind the aircraft. The aircraft had been parked at the stand for approximately 50 minutes, during which time a ground power unit had been used until the doors were closed. The object was found after the walk-round had been conducted; the APU had been running for about five minutes. Following the incident two days later, attempts were made to locate the debris item, but without success.

68 © Crown copyright 2017 AAIB Bulletin: 4/2017 G-ECOF EW/G2016/10/15 Figure 1 Debris item photographed by crew after discovery Aircraft examination The APU is located within a bay in the tail cone on this aircraft type. An exhaust duct, fabricated from titanium, is installed within the aft section of the tail cone. Within this is a duct liner made from a fibre-metal acoustic material; it is elliptical in section, supported on frames within the duct and bolted to it at its forward end (Figure 2).

Figure 2 APU exhaust duct and liner

69 © Crown copyright 2017 AAIB Bulletin: 4/2017 G-ECOF EW/G2016/10/15 It was apparent that the front half of the liner had partially disintegrated and that the item discovered on the ground at Birmingham was a circumferential section from the front end, having separated both at the junction with the bolted ring and several inches aft. The portion of the liner that remained within the duct was removed, possibly causing some additional distortion (Figure 3). Figure 3 Recovered part of the exhaust duct liner The operator commented that they had observed instances of the liner cracking close to the first frame (furthest forward). Although the ejected piece of liner was not available for examination, Figure 1 shows what appears to be fretting or abrasion damage on the outer surface. The internal surfaces of the tail cone were discoloured as a result of high temperatures causing the paint to blister, and electrical cables in the area had sustained visible heat damage. A subsequent download of the APU data memory module by the operator confirmed that the APU had shut down as a result of an open circuit condition and that this was probably associated with the cable damage. Other information An examination of the recent maintenance history revealed that the APU had been changed by a contracted company on 13 October, approximately two weeks prior to the incident. This followed a fail caption followed by an auto shut-down. Removal and installation of the APU does not in itself involve disturbing the exhaust duct liner, although the Aircraft Maintenance Manual calls for an ‘Opportunity Inspection’ of it, using Maintenance Task 49‑80-04-210‑801. The company stated they had a contract with G-ECOF’s operator to deliver 250 man hours per 24 hour period spread over three aircraft. Their hangar

70 © Crown copyright 2017 AAIB Bulletin: 4/2017 G-ECOF EW/G2016/10/15 is modern and well lit, and they were familiar with conducting APU changes on Q400 aircraft. A general visual inspection was duly carried out and the appropriate worksheet signed off. There is no scheduled inspection of this component. The subject duct liner had been installed in the aircraft at initial build. On 18 October the APU failed to start and this was logged as a deferred defect until it was cleared on 26 October after replacing a thermocouple. This was only two days prior to the piece of exhaust duct liner being ejected whilst on the stand at Birmingham. The aircraft manufacturer disclosed that, in addition to the subject event, they were aware of 17 reported events of duct liner cracks since September 2003. Most of the failures were cracks or separation along the weld lines and occurred on aircraft that had achieved between 2,355 and 25,063 flight hours. G-ECOF had achieved 16,703 flight hours. Two of these incidents involved pieces that were missing from the liner and a third suffered a ‘collapsed’ liner, causing exhaust gas to enter the tail come in a similar manner to the subject event. Smoke, but no fire, was also reported and there was heat damage to electrical wiring and paint blistering on the tail cone structure. Many of the incidents were associated with the APU either failing to start or shutting down unexpectedly. It should be noted that the APU on this aircraft type is certificated for ground use only and, in the event it is not shut down by the crew prior to takeoff, it is turned off by a weight‑off‑wheels signal. Discussion It was concluded that the disintegration of the APU exhaust duct liner allowed hot exhaust gases into the exhaust duct volume outside the liner and into the tail cone itself. The duct liner is located within a jet efflux and as such is exposed to a severe thermal and acoustic environment. Whilst no calendar or flight hours limit, or regular inspection period, is specified, it is reasonable to expect the liner to deteriorate in service. However, the 17 prior events logged by the aircraft manufacturer covered a wide range of time in service. The duct’s location in the airframe means it is difficult to inspect effectively unless the APU is removed. Such removals, and consequent ‘opportunity’ inspections, seem to occur at relatively frequent, although necessarily irregular, intervals. Indeed, the subject duct had been inspected only two weeks prior to ejecting a substantial piece of the liner; it was also found that the APU itself had been unserviceable for eight days out of the two weeks. It is therefore likely that some aspect of the failure was present at the time of the last inspection, despite the good working environment of the hangar in which the APU change had been carried out. The nature of the failure was not determined, although chances of obtaining more information may have been improved had the ejected piece of the duct liner been correctly identified and retained. There were some marks visible in photographs taken of this item, although it could not be concluded if they were the result of in-service fretting or abrasion during installation.

71 © Crown copyright 2017 AAIB Bulletin: 4/2017 G-ECOF EW/G2016/10/15 No flames were observed during the incident although the temperature clearly was sufficiently high to cause blistering and charring of the paint, thus generating smoke. The electrical harnesses in the area were also damaged, leading to the APU shutting down, thus removing the heat source. Had this not occurred, it is possible that an actual fire may have developed, although this might have been accompanied by flight deck warnings or indications from the ground handlers, which should have prompted the flight deck crew to shut down the APU. It was found however that none of the previously reported incidents had resulted in a fire. In addition, it is considered that there is little likelihood of a duct liner failure resulting in an airborne fire as the APU is not capable of being used in the air.

FD06596 ｜ 2017_英国_aaib-investigation-to-europa-g-bzth__Europa_G-BZTH_11-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

79 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-BZTH EW/G2017/08/04 ACCIDENT Aircraft Type and Registration: Europa, G-BZTH No & Type of Engines: 1 Rotax 912-UL piston engine Year of Manufacture: 2002 (Serial no: PFA 247-12494) Date & Time (UTC): 4 August 2017 at 1106 hrs Location: Near Parsons Barn, Long Compton, Warwickshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 (Minor) Passengers - N/A Nature of Damage: Forward fuselage distorted and fractured aft of firewall Commander’s Licence: Private Pilot’s Licence Commander’s Age: 72 years Commander’s Flying Experience: 802 hours (of which 661 were on type)

Last 90 days - 45 hours

Last 28 days - 4 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis While on a cross-country flight the engine failed due to an oil leak and the pilot made a forced landing in a field. There were ridges in the field that were not visible from the air and the aircraft was severely damaged when it hit one of these ridges. History of the flight The pilot was flying from Enstone to an airstrip near Gloucester in conditions of good visibility and with a westerly breeze. Approximately eight miles northwest of Enstone, at an estimated altitude of 1,900 feet agl, the engine failed and would not restart. The pilot selected a suitable field and managed to touch down at the point he aimed for. After running along the ground a short distance, the aircraft decelerated violently and came to a halt. The pilot exited through his door and then noticed there were ground ridges which were not visible from the air. He had landed across the ridges and it was one of these that caused the deceleration and the damage to the aircraft (Figure 1). Following recovery of the aircraft, the pilot discovered that the oil drain plug for the engine was missing and the engine had seized due to lack of lubrication.

80 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-BZTH EW/G2017/08/04 Figure 1 The engine and forward fuselage of G-BZTH seen resting on a ridge with the rear fuselage in a broad furrow Prior to the flight the pilot had changed the engine oil, with assistance from a friend. The oil had been drained and the aircraft left unattended before the engine was refilled with oil, and an engine run was carried out to check the oil pressure. No oil leak was seen after the engine run, but it appears the oil plug was not refitted correctly, possibly due to some miscommunication, and it became detached during the flight, allowing the oil to escape.

FD06597 ｜ 2017_英国_aaib-investigation-to-ev-97-teameurostar-uk-eurostar-g-cggm__EV-97_Teameurostar_UK_Eurosta.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

60 © Crown copyright 2017 AAIB Bulletin: 6/2017 G-CGGM EW/G2017/04/05 ACCIDENT Aircraft Type and Registration: EV-97 Teameurostar UK Eurostar, G-CGGM No & Type of Engines: 1 Rotax 912-UL piston engine Year of Manufacture: 2009 (Serial no: 3401) Date & Time (UTC): 8 April 2017 at 1155 hrs Location: Wycombe Air Park, Buckinghamshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Floor pan, firewall, nose leg, steering rods and engine frame Commander’s Licence: National Private Pilot’s Licence Commander’s Age: 54 years Commander’s Flying Experience: 121 hours (of which 121 were on type)

Last 90 days - 4 hours

Last 28 days - 4 hours Information Source: Aircraft Accident Report Form submitted by the pilot The pilot reported that he had been flying in the local area and, on return to Wycombe, landed on the grass Runway 24. He normally used the parallel hard runway but it was closed as a result of an incident. The visibility was good and the wind was light. The pilot considered that he landed too fast and consequently the aircraft bounced a couple of times, damaging the nose leg. Although the steering seemed not to be functioning correctly and there was excessive vibration, he was able to taxi to his normal parking spot on the north side of the airfield. Examination revealed extensive damage to the nose leg and surrounding structural components.

FD06598 ｜ 2017_英国_aaib-investigation-to-flight-design-ctsw-g-omsa__Flight_Design_CTSW_G-OMSA_02-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

56 © Crown copyright 2017 AAIB Bulletin: 2/2017 G-OMSA EW/G2016/09/01 ACCIDENT Aircraft Type and Registration: Flight Design CTSW, G-OMSA No & Type of Engines: 1 Rotax 912ULS piston engine Year of Manufacture: 2009 (Serial no: 8501) Date & Time (UTC): 1 September 2016 at 1400 hrs Location: Damyns Hall Aerodrome, Essex Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Damage to landing gear, tail, propeller, fuselage, and right wing; windscreens broken Commander’s Licence: National Private Pilot’s Licence Commander’s Age: 70 years Commander’s Flying Experience: 134 hours (of which 134 were on type)

Last 90 days - 5 hours

Last 28 days - 2 hours Information Source: Aircraft Accident Report Form submitted by the pilot The weather was CAVOK with 5 kt of wind along Runway 21, which has a grass surface. The pilot had 134 hours flying time, all on the accident type, of which 33 hours were in command. The pilot’s report stated that he crossed the threshold at 60 KIAS and that at the flare the aircraft struck the runway hard and the nose dug in, causing it to pitch over onto its back. He exited the aircraft unaided and uninjured, and there was no fire. The pilot commented that he later noticed a deep rut in the runway, but did not know whether it had been made during the accident or was there previously. He was unsure of the cause of the crash.

FD06599 ｜ 2017_英国_aaib-investigation-to-hawker-sea-fury-t-mk-20-g-rnhf__Hawker_Sea_Fury_T_Mk_20_G-RNHF_09-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

137 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-RNHF EW/C2014/07/02 ACCIDENT REPORT ADDENDUM Aircraft Type and Registration: Hawker Sea Fury T Mk 20, G-RNHF No and Type of Engines: 1 Bristol Centaurus XVIII piston engine Year of Manufacture: 1949 (Serial no: ES3615) Date and Time: 31 July 2014 at 1601 hrs Location: RNAS Culdrose, Cornwall Synopsis The aircraft was performing in a public air display at Culdrose when the pilot became aware of a significant engine vibration and then a corresponding loss of thrust. Despite the loss of engine power the pilot was able to land the aircraft on the runway but the landing gear collapsed on touchdown, causing it to veer off the runway. The aircraft came to a stop on the grass approximately 1,500 ft from the initial touchdown point. The pilot vacated the aircraft unaided and without injury. The accident was a result of the loss of engine power caused by severe mechanical disruption within the ‘front row’ crankcase of the engine. Introduction The accident report, EW/G2014/07/32, was published in AAIB Bulletin 7/2015 and at the time evidence suggested the breakup was as a result of an overheated articulated connecting rod (con-rod) wrist pin bearing. After this report was published, forensic work continued to try to establish the exact cause of the engine failure and the AAIB undertook to publish the relevant findings when available. Despite the extensive destruction of most of the components within the front section of the engine, forensic analysis has been able to determine that severe overheating had occurred in the crankpin sleeve bearing in the front bank of cylinders. This led to a chain of events within the engine which became increasingly destructive to the wrist pin bearings, connecting rods, pistons and sleeve valve gear. This destruction was exacerbated by the rear bank of cylinders continuing to run until the accumulated damage within the front bank of the engine stopped the engine producing useable power, although it continued rotating as the aircraft landed until its landing gear collapsed. The extreme damage to the components of the front bank of cylinders left insufficient evidence to determine conclusively the initial cause of the engine failure. System description The Bristol Centaurus engine is an eighteen-cylinder double-row sleeve valve supercharged radial, with a 53 litre capacity, capable of producing 2,500 horsepower. Figure 1 and Figure  2 show the arrangement of the master con-rod, articulated rods, crankpin and floating retainer assembly.

138 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-RNHF EW/C2014/07/02 Figure 1 Master and articulated connecting rods with the floating oil retainer Lubrication system In this engine, oil pressure is generated by the main oil pump at a nominal 100 psi and distributed into four separate sub-sections around the engine. A main oil feed passes through a tube inside the supercharger into the rear end of the crankshaft. It then travels forward along the crankshaft, finally exiting through feedlines to lubricate the reduction gearbox. Along the way, oil is forced through various ports and jets to lubricate bearings, pistons and cylinders. High-pressure oil also feeds the ‘centrifugers’, which remove any sludge and aeration before it is used to operate the supercharger control valve and drive system. Another high-pressure feed is supplied to the governor before entering

139 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-RNHF EW/C2014/07/02 the propeller constant-speed unit. Oil pressure is then reduced by a reduction valve to lubricate the sleeve valve drive system and a small supply of low-pressure oil lubricates the magnetos. Return oil from the spray jets and oil that has passed through the bearing, collects at the bottom of the engine where it is scavenged by front and rear pumps. Oil is trapped in some locations and used as splash lubrication for start-up. The oil system in G-RNHF contained a sufficient quantity of lubricating oil and samples taken at the time showed that the oil had suffered some adulteration during the engine failure, but this is not considered causal or contributory to the engine failure. Figure 2 Crankpin sleeve and wrist pin assembly Crankpin assembly The crankpin carries all of the loads into the crankshaft from the master and articulated connecting rods via a white metal crankpin sleeve bearing. This bearing is pressure lubricated via ports within the crankshaft. From there oil is collected by an oil retainer, known as the floating oil retainer, which distributes oil to the centre of the wrist pins to lubricate the phosphor bronze wrist pin bearing surfaces. Oil pressure is maintained within the wrist pin by a spring loaded plunger which seals the gap between the wrist pin and floating oil retainer.

140 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-RNHF EW/C2014/07/02 Sequence of events Forensic analysis was carried out in the materials laboratories of 1710 Naval Air Squadron (1710 NAS) within the Royal Navy. The following sequence of events have been identified and are summarised from their report: ‘a. For reasons unclear the forward crankpin sleeve bearing overheated, cracked up and liberated flakes of white metal. b. Breakup of the bearing resulted in greater overheating, melting the white metal bearing surface. c. Liquid tin from the bearing penetrated along the grain boundaries of the forward master rod, causing embrittlement at the grain boundaries. d. The embrittled grain boundaries cracked and some fragments of the master rod around the bore become separated. This process continued as the liquid tin penetrated more deeply. e. Loose fragments of master rod material from around the bore gouged the bore surface and the sleeve, overcoming the interference fit and causing it to spin with the master rod, finally cutting off any possible oil flow to the connecting rod assembly. f. Continued embrittlement, high temperature and high stress caused the master rod to burst locally at its thinnest and highest temperature points, behind the wrist pins #16 and #18. g. Erupted material interfered with articulating rods #16 and #18 and frictionally heated them, causing them to overheat, soften and fail. h. The unrestrained piston and articulating rod #16 came out of their cylinder into the engine core and were impacted by the counterweight. i. Continued impacts fractured and propelled the piston, gudgeon pin and articulating rod around the engine core, impacting and damaging other components. j. At some point the gudgeon pin became momentarily trapped and was impacted, shattering it. k. Debris fragments became trapped in the sleeve driving mechanism, jamming them and causing them to fail. l. Throughout the above, the heat generated around the forward crank pin propagated back into the rear bank crankpin, overheating the crank pin sleeve bearing causing it to start breaking up.’ This sequence was arrested when the landing gear collapsed and the propeller struck the ground and stopped as the aircraft slid along the grass alongside the runway.

141 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-RNHF EW/C2014/07/02 Possible contributory factors Although the exact feature which caused the crankpin sleeve bearing to overheat is unknown, there are a number of areas of interest which may have been contributory factors. These factors have been extracted from the 1710 NAS laboratory report and are set out below: ‘a. Pieces of a fibrous cellulose material were found within the engine from an unknown source. One was causing a partial blockage of the rear crankweb oil jet, which could not have caused the failure, but in combination with the piece found loose in the crankcase indicates that there was debris in the system. The source could not be confirmed. The material may have come from a degraded fibre gasket somewhere in the system, or possibly from an original gasket that was replaced during earlier maintenance. Alternatively it could have come from a source outside the engine and entered at some point during its life. It is possible that some of this debris may have entered the forward crankpin bearing and disrupted the lubricating oil film, leading to overheating. Cellulose debris may have passed through that bearing and blocked the oil supply to a wrist pin, heating the pin and transmitting heat into the master rod, overheating the crankpin bearing. Whichever specific mechanism, overheating of the crankpin bearing resulting from contamination of the system with fibrous cellulose debris is considered a possibility. b. The crankshaft oil retainer gland was found to be severely embrittled. This may have been due to heat transmitted along the crankshaft or may have been due to its extreme1 age. If it was embrittled prior to the accident it may have stopped working as an effective seal and caused a pressure loss inside the crankshaft. This pressure loss may have disrupted the oil film in the crankpin bearing and allowed it to overheat. The pressure distribution around the engine is not understood in enough detail to determine if a leak of this type would have been detectable to the pilot. This scenario is considered to be a possibility. c. It is possible that hard debris, from an external source or a part of the engine or oil system not found, was able to enter the forward crankpin bearing and either cause abrasive wear and overheat it or block local oilways, allowing a wrist pin to overheat. If this was the case then the debris was displaced during the failure sequence and not subsequently recovered. This scenario cannot be conclusively ruled out. d. It is possible that an out of balance loading on the forward connecting rod assembly transmitted an excessive loading to the forward crankpin bearing, causing it to overheat. No evidence was observed to indicate that the assembly was intrinsically out of balance.’ Footnote 1 It is possible that this seal was originally fitted to the engine when it was built prior to delivery to Iraq in the late 1940s. There is no evidence to suggest this seal was replaced when the engine was brought back into service in 2010.

142 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-RNHF EW/C2014/07/02 Discussion The Centaurus engine is fitted with roller main bearings and conventional close tolerance white metal bearings on the crankpins. White metal, in this case known as Babbitt metal, is an alloy of copper, tin, lead and antinomy alloyed to give a low-friction but hard-wearing surface. The low friction and heat conduction properties of the material is further enhanced by the oil lubrication system whereby a hydrodynamic oil film forms under pressure on the bearing surface. Although the bearing will operate without too much difficulty during momentary reduced lubrication, sustained loss or constant reduced lubrication will result in bearing damage. The damage will initially manifest itself in scuffing and scoring in the bearing surface and is often referred to as ‘running’ a bearing. Heat is generated in this process and in most circumstances will degrade any oil present, reducing lubrication further. Eventually the heat generated will be so great that bearing damage occurs, as observed in this engine. Unlike in-line engines, where the big end bearing only carries a single piston load with an impulse once per revolution, a radial engine crankpin bearing carries multiple impulse loads per revolution from the articulated con-rods via wrist pins into the master con-rod. Should a crankpin bearing become distressed, the multiple impulse effect can accelerate the situation and therefore degrade more rapidly than with an in-line engine. If the crankpin bearing is overheated and starts to fail, the wrist pins by their design and location, will also be susceptible to any excess heat from the nearby crankpin bearing. The evidence, in this case, shows an overheated crankpin bearing and this may be as a result of a seriously degraded or complete loss of lubrication. The condition of the other major engine components, such as the rear bank and supercharger, suggests a localised problem. It is possible that unidentified debris interrupted oil to the bearing. Of interest was the embrittlement of the crankshaft oil retainer gland. Loss of the sealing capabilities of this gland could result in a sustained weakening of the hydrodynamic oil film which may lead to the ‘running’ of the bearing over a very short period. In either case the temperature generated would eventually cause any remaining oil present to boil or burn off the vital surfaces in an ever-worsening cycle. Conclusion The evidence suggests a localised lubrication problem led to a severe overheating of the crankpin bearing. An extensive forensic examination of the engine has been carried out and it has not been possible to identify the exact initiator that led to this situation. However, it has been possible to identify the precise sequence of metallurgical effects on key components as the bearing overheated and failed, which resulted in the highly destructive chain of events within the front crankcase. Safety action Various marks of the Centaurus engine are still in use in a small number of aircraft but findings in this case could equally apply to other radial and in- line aero-engine types. Based on this, the CAA has undertaken to publish a

143 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-RNHF EW/C2014/07/02 Safety Notice aimed at the historic aircraft community, to draw attention to the issues and difficulties of maintaining airworthiness of aging aircraft engines and their associated components.

FD06600 ｜ 2017_英国_aaib-investigation-to-hph-glasflugel-304-es-g-gsgs__G-GSGS_Safety_Recommendation_Document.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1

HPH Glasflugel 304 eS, G-GSGS Parham Airfield, West Sussex 10 August 2017 Accident

Safety Recommendation 2017-018 It is recommended that the European Aviation Safety Agency (EASA) requires that all powered sailplanes, operating under either an EASA Restricted Type Certificate, or an EASA Permit to Fly, and fitted with a Front Electric Sustainer (FES) system, are equipped with a warning system to alert the pilot to the presence of a fire or other hazardous condition in the FES battery compartment.

Date Safety Recommendation made:

25 September 2017

LATEST RESPONSE

Response received:

12 February 2018

The Agency agrees with intent of the Safety Recommendation.

As immediate action the Emergency Airworthiness Directive (EAD)2017-0167-E has been published on September 6th, 2017. This EAD required removal of the Front Electrical Sustainer (FES) battery pack, or an EASA approved modification of the FES batteries, before the next flight.

The three affected manufacturers have taken the following corrective action addressed by the EAD:

Major change approvals: HPH Sailplanes: 10064072 Schempp-Hirth: 10063863 Sportine Aviacija: 10064174

These corrective actions address the introduction of a mandatory warning system, Aircraft Flight Manual (AFM) improvements, a Flight Control Unit (FCU) software update with regard to the warnings presented to the pilot, and modifications to the FES battery design itself.

The same corrective action has also been applied to aircraft under Permit to Fly.

Moreover, EASA will ensure that the same approach is applied to ongoing and future certification projects.

AAIB Assessment – Adequate – Closed

RESPONSE HISTORY

Response received:

23 November 2017

The Agency agrees with the intent of the Safety Recommendation. As first action, the Emergency Airworthiness Directive (EAD) 2017-0167-E was published on September 6th,

1. This EAD requires removal of the Front Electrical Sustainer (FES} battery pack or an EASA approved

modification of the FES batteries before the next flight. The three affected manufacturers are currently in the process of developing the corrective action addressed by the EAD and the Air Accidents Investigation Branch (AAIB} Special Bulletin. EASA concurs with the recommendation and will require a warning system as part of the corrective action. Design details of such warning systems are not available yet, since the systems are still under development. Moreover, the Agency will look into further items such as, Aircraft Flight Manual (AFM} improvement, Flight Control Unit (FCU) software update with regard to the warnings presented to the pilot and modifications to the FES battery design itself.

2

EASA will ensure that the same corrective action is applied to aircraft under Permit to Fly as well. AAIB Assessment – Partially Adequate - Open

(SRIS Reference: GB.SIA-2017-0018)

3

HPH Glasflugel 304 eS, G-GSGS Parham Airfield, West Sussex 10 August 2017 Accident

Safety Recommendation 2017-019 It is recommended that Alisport Srl modifies the Silent 2 Electro microlight to incorporate a warning system to alert the pilot to the presence of a fire or other hazardous condition in the Front Electric Sustainer (FES) battery compartment.

Date Safety Recommendation made:

25 September 2017

LATEST RESPONSE Response received:

30 November 2017

Alisport Srl have been working in close cooperation with LZ Design, and others, to find a solution to fulfil the airworthiness and safety issues. They have designed an appropriate fire warning system to be installed on their gliders. Alisport Srl will now work to update their aircraft with the fire warning system and the new battery cases. As soon as modifications guidelines and installation manual are updated, they will inform their customers and provide all necessary documentation and components to perform the upgrade. AAIB Assessment – Adequate - Closed

RESPONSE HISTORY

N/A

(SRIS Reference: GB.SIA-2017-0019)

4

HPH Glasflugel 304 eS, G-GSGS Parham Airfield, West Sussex 10 August 2017 Accident

Safety Recommendation 2017-020 It is recommended that Albastar d.o.o. modifies the AS13.5m Front Electric Sustainer (FES) microlight to incorporate a warning system to alert the pilot to the presence of a fire or other hazardous condition in the FES battery compartment.

Date Safety Recommendation made:

25 September 2017

LATEST RESPONSE Response received:

1 February 2018

This applies to two A13,5m FES gliders built by one individual under Slovenian CAA experimental regulation and UL certification standard. This individual received AAIB Special Bulletin S3/2017, ceased operation and contacted LZ Design, manufacturer of the FES propulsion system, for advice on further actions.

As of February 2018 both gliders are currently grounded waiting modification documentation and hardware from the FES manufacturer LZ Design.

AAIB Assessment – Partially Adequate - Open

RESPONSE HISTORY

N/A

(SRIS Reference: GB.SIA-2017-0020)

FD06601 ｜ 2017_英国_aaib-investigation-to-ikarus-c42-fb100-g-cdnr__Ikarus_C42_FB100_G-CDNR_05-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

18 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 ACCIDENT Aircraft Type and Registration: Ikarus C42 FB100, G-CDNR No & Type of Engines: 1 Rotax 912 ULS piston engine Year of Manufacture: 2005 (Serial no: 0507-6696) Date & Time (UTC): 20 March 2016 at 1600 hrs Location: Stoke Airfield, near Burrows Lane, Middle Stoke, Kent Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 (Fatal) Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: National Private Pilot’s Licence (Aeroplanes) Commander’s Age: 61 Commander’s Flying Experience: 117 hours (of which 17 were on type)

Last 90 days - 2.5 hours

Last 28 days - 1.5 hours Information Source: AAIB Field Investigation Synopsis The pilot, who was converting to three-axis microlights, was flying solo following three training flights that morning. The aircraft was seen to become airborne and then climb very steeply, achieving an extreme nose-up attitude. The left wing dropped and the aircraft descended, colliding with high tension power cables adjacent to the runway. It then struck the ground and an intense post-crash fire broke out. The pilot was fatally injured. History of the flight The pilot had qualified as a weight shift microlight pilot in August 2013 and decided to convert to three-axis microlights in 2015. His first solo flight in a three-axis aircraft was in the Ikarus on 12 February 2015, after 13.75 hours of training. He had made an appointment to take up three-axis flying again on 20 March 2016. The instructor arrived at the airfield at approximately 1000 hrs and checked the weather. The forecast was for a 1,400 ft cloud base with a light wind down Runway 06, which was suitable for training and solo flights. He moved the aircraft out of the hangar, carried out the daily inspection and then washed it. The pilot arrived at about 1130 hrs and discussed with the instructor the plan for the day, which was to make a number of 30-minute flights to continue his three-axis training. They

19 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 conducted two training flights in the morning, covering takeoffs, climbing, emergencies in the circuit and use of flaps. As expected, after a year since his last three-axis flight, the pilot was a “little rusty” on the first couple of landings. Following a demonstration by the instructor and some further practice, the pilot improved measurably to a competent solo standard. Following a debrief in the cockpit, the instructor took the pilot into the training room and gave him a presentation on the use and effects of different flap settings. He also talked about the importance of aircraft attitude during a go-around. They carried out a third dual flight during which the instructor simulated an engine failure after takeoff, followed by a simulated engine failure downwind, from which the pilot landed. He flew competently on his second circuit and seemed calm and ready to go solo. The engine was shut down and the instructor briefed the pilot to fly out to the Isle of Sheppy, an area that he was familiar with, and practise some climbing and descending turns. The pilot seemed happy to be flying solo again and, after restarting the engine, taxied back to the threshold of Runway 06. The instructor observed the takeoff. He heard the pilot apply full power and saw the aircraft become airborne. It climbed very quickly and reached a very high nose-up attitude, which the instructor described as the aircraft “hanging on its prop”. The aircraft drifted left over the railway line that runs alongside the runway before dropping the left wing, descending and striking a set of high tension power cables. There was a bright flash and the aircraft fell to the ground. The instructor and club members ran to the accident site and attempted to extinguish the post-crash fire with handheld fire extinguishers. The pilot had sustained fatal injuries. Accident site The aircraft had come to rest in a field adjacent to the northern edge of the airfield, beneath power cables carried on pylons running in a southwest-northeast direction (Figure 1). The airstrip is slightly curved and is bordered by marshy ground to the south and a railway line to the north. A line of pylons runs north of and roughly parallel to the railway and carries 400kV electricity cables. Each pylon has three arms, with the power supply cables attached to the end of each arm. A separate phase is carried on each arm, with four cables in each phase. The aircraft had struck the southern array of cables (ie the ones on the airfield side of the pylons), causing an electrical discharge across two phases.

20 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 Figure 1 View of accident site, looking along Runway 06 The aircraft had come to rest in an inverted attitude, with the nose pointing roughly parallel to the runway heading, ie 060°. The wreckage had burnt out, with the fire in the forward fuselage having been particularly intense. It was apparent that the right wing had separated close to the root as a result of striking the cable group mounted on the centre arm on the south side, approximately 100 ft above the ground. The right wing was found approximately 13 m from the main wreckage. The cables had not been severed, but had sustained damage in the form of broken cable strands (Figure 2).

Photo: National Grid Figure 2 Damage to power cables

21 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 The cable group below the damaged ones exhibited some slight scuffing, possibly as a result of a brushing contact with the underside of the left wing; this showed evidence of light scuff marks on the wing struts, with several holes resulting from severe electrical discharges that had caused localised vaporising of the aluminium alloy. Similar features were observed on the structural members of both wings and on flying control components, with some of the flying control tubes having melted. The positions of the discharge damage on the wing struts was consistent with the spacing of the cables within the group (Figure 3). Figure 3 Underside of right wing showing electrical discharge damage and possible cable contact positions The fabric covering of the left wing, which had remained attached to the fuselage, had burnt away, although there was little evidence of significant heat on the ground, leading to the conclusion that the fabric may have been ignited by the electrical discharge. The fuel tank, located behind the cockpit, had burst on impact and the burning fuel had consumed most of the forward fuselage. There was a shallow crater beneath the engine, but no other ground marks. The propeller blades had all broken at the approximately mid-span point, suggesting power at impact, although it was not possible to quantify this. The right wing leading edge spar had been broken just inboard of its mid-span point, as a result of contacting the cables. A foam fillet had been bonded to the front face of the tube, giving an aerodynamic shape to the leading edge. An indentation was apparent in the foam, close to the spar fracture, which was consistent with being made by one of the cables (Figure 4). As can be seen, the cable would have been approximately vertical relative to the wing leading edge, suggesting the aircraft was in a near vertical nose-down attitude at the time.

22 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 Figure 4 Likely cable contact on the right wing leading edge spar It was concluded, from the available evidence, that the right wing had struck the middle set of cables on the south side of the pylons whilst the aircraft was in a steep, probably vertical, nose-down attitude. It is likely that this caused a yaw to the right, bringing the left wing into light contact with the lowest set of cables, resulting in the phase-to-phase discharge that in turn produced the bright flash and explosion reported by witnesses. Following an inspection of the site, the wreckage was recovered to the AAIB’s facility for a detailed examination. Aircraft information General The Ikarus C42 is a two-seat high-wing aircraft with a tricycle landing gear. It is manufactured in kit form or as a complete aircraft. Factory-built examples are dealt with by the British Microlight Aircraft Association (BMAA), and are approved as microlights. The Light Aircraft Association (LAA) deals with the kit versions, which can be either a microlight or Group A aircraft. G-CDNR was a factory-built aircraft and was classed as a microlight. The airframe primary structure is of bolted and riveted aluminium tube construction, the main structural member being a tubular boom that carries the empennage at the rear and the engine and nose landing gear at the front. The fuselage is given a conventional external shape by virtue of non-structural composite mouldings. The flying surfaces are covered with pre-stitched reinforced polyester envelopes. The engines approved for use in the Ikarus are the Rotax 912 UL (80 hp) and 912 ULS (100 hp).

23 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 The flight controls are operated by a ‘side stick’ mounted on a console between the front seats. The top of the stick incorporates two buttons that respectively apply nose-up and nose-down elevator trim, the electric trim actuator being mounted within the left tailplane and operating a trim tab attached to the trailing edge. The flaps are operated by control rods, with the position being controlled by a lever in centre of the cockpit roof; squeezing a calliper attached to the lever allows the flaps to be placed in one of three detented positions. Engine power is controlled by means of a throttle lever mounted between the pilot’s legs. Additional information In-service structural problems Two structural issues with the aircraft type were identified by the manufacturer subsequent to the accident; one related to cracking of the fuselage tube and the other to cracking of the A-strut, which links the fuselage tube to the wing leading edge. The cracking of the fuselage tube resulted in an Owner’s Service Bulletin (OSB) 29, which was issued on 16 June 2016. The Bulletin became the subject of a Civil Aviation Authority (CAA) Emergency Mandatory Permit Directive (MPD), issued on 28 June 2016. It required an inspection for cracking of the front of the fuselage tube; the affected area is shown in Figure 5a. The engine is supported, via a pylon, on the front of the tube. In addition, there are two square cut-outs in the tube; the front one carries the nose landing gear and the rear forms the attachment of the A-strut. Cracks have been found emanating from the corners of the upper cut-outs which, if allowed to propagate, would compromise the structural integrity of the engine mountings, the nose landing gear leg and the A-strut. An extreme example is shown in Figure 5b. As far as is known, no crack has progressed to complete failure. The LAA covered the topic in an article in the August 2016 issue of their ‘Light Aviation’ magazine. The fuselage cracking appeared to primarily affect high flight hour, early examples of the aircraft, although the MPD applied to all C42 models, with inspections being required prior to the next flight on aircraft with over 2,000 hours of operation. G-CDNR had achieved over 2,420 flight hours at the time of the accident but had never been inspected in accordance with the MPD, as the accident occurred prior to the discovery of the fuselage tube cracking problem. Two other C42 aircraft based at the same airfield, with slightly fewer flight hours, were inspected and found to have no cracks.

24 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 A-strut Engine mount Area of interest Figure 5a View of fuselage structure Figure 5b Example of crack emanating from rear cut-out, as shown in OSB 29 In November 2016, cracking of the A-strut was identified on the same airframe that had suffered the fuselage tube cracking that led to the issue of OSB 29 and the subsequent MPD. It was found that the A-strut was cracked around its entire circumference within

25 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 the outer collar at the connection between the strut and the upper surface of the main fuselage tube (Figures 6a and 6b). The failure was concealed by the collar and the upper part of the strut had been retained in position only by a single locating rivet (ie a manufacturing aid) that located the collar on the strut. The crack had emanated from the bolt hole in the strut. A-strut lower attachment

Photo: Red Aviation Figure 6a A-strut attachment to forward fuselage tube

Photo: Red Aviation Figure 6b Failed A-strut after removal of collar, showing rivet hole

26 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 The UK agent for the aircraft, in conjunction with the German manufacturer, issued OSB 31 on 30 November 2016, applicable to all C42 A and B model aircraft, although later B models featuring a different design were exempted. The Bulletin stated that it was believed that the failure was the result of excessive loads placed on the A-strut due to near failure of the main fuselage tube. One other similar case was known to have occurred on an aircraft known to have sustained landing gear damage. However, it was also considered that the failure may have been related to fatigue due to flexing of the A-strut, thus introducing the requirement for an inspection of potentially vulnerable aircraft. The OSB requires any aircraft which have previously suffered damage that could have affected the A-strut, such as nose gear or accident damage, to be inspected by means of a borescope inserted into the strut from its lower end. However there was no requirement to inspect aircraft with no history of damage and which had flown less than 2,000 hours. Aircraft with more than 2,000 flying hours were recommended to be inspected at the next Annual or 100-hour Inspection, whichever occurred first. Subsequent to the accident, the manufacturer’s design/certification engineer stated that his calculations indicated that, in the event of an A-strut failure, the rivet would withstand flight loads of 2 to 3g before failing. It was pointed out that the A-strut is also attached to the engine firewall structure, thus providing some additional strength. Aircraft examination The intense fire that developed after the aircraft came to rest had resulted in much of the structure being reduced to ash or solidified molten alloy. It was thus not possible to conduct a complete continuity check on some of the flying controls in the cockpit area. However, those parts of the system that remained bore no evidence of disconnect or failure prior to striking the ground. A bell crank assembly, in the right wing aileron circuit, had become disconnected as a result of being melted in the electrical discharge after the aircraft struck the power cables. It was established that the flap operating lever, in the roof of the cockpit, had been in the flaps retracted detent and that the elevator trim electrical actuator was in the middle of its operating range, thus indicating that the elevator trim was approximately neutral. The engine was dismantled and no evidence of failure or malfunction was found, with all the internal components being in good condition. However the carburettors, together with most other engine accessories, were burnt and could not be tested. The fuselage boom was examined with particular regard to OSB 29. However, very little of the front end had survived the fire. An exception was the nose landing gear leg, which had remained attached to the lower half of a short length of the fuselage tube, including the cut-outs for the leg and the A-strut. The latter was severely fire affected, but contained a few centimetres of the lower end of the A-strut. It was not possible to draw any conclusions from the fracture surfaces due to the fire damage.

27 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 The A-strut upper and lower attachments to the fuselage tube were made with steel brackets. These had survived the post-impact fire, whereas much of the surrounding aluminium material had not. Figures 7 and 8 show the remains of the lower and upper attachments. The lower attachment was similar to the upper in that both used collars and locating rivets (the rivet is not visible in the image of the lower attachment). Collar Bolt Remains of A-strut Figure 7 Lower attachment The remains of the collar on the upper attachment were fragile and part of it was peeled aside to reveal the locating rivet; this appeared intact. However there was no evidence of any part of the A-strut, unlike the lower attachment, where a section of the strut, together with the rivet was found positioned concentrically within the collar.

28 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 Rivet Figure 8 Remains of A-strut upper attachment and (lower view) rivet Recorded information Security video recording A video camera located on the clubhouse recorded both the takeoff with the instructor and the takeoff for the accident flight. Figure 9 shows three snapshots from each takeoff which illustrate differences in the respective flightpaths. The takeoff with the instructor was at a higher weight, but the aircraft tracked along the runway in a normal climb. On the accident takeoff the aircraft became airborne and climbed steeply, whilst drifting to the left (prior to dropping the left wing, descending and contacting the power lines).

29 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 Figure 9 Comparison of normal and accident takeoffs Weight and balance The instructor estimated that the fuel on board at the commencement of the accident flight was 30 litres and the pilot’s weight was 75 kg. Total weight at takeoff was calculated as 362 kg, with a maximum permitted takeoff weight of 450 kg. The Centre of Gravity (CG) range for the aircraft was 350 mm to 560 mm aft of the zero datum, which is defined as the wing leading edge root. The calculated CG at the time of the accident was 397.8 mm aft of the CG datum. The aircraft was therefore being operated within the maximum permitted takeoff weight and CG envelope. Airfield information Stoke Airfield has a single grass runway orientated 06/24, 400 m long by 20 m wide. Running along the west side of the runway is a railway line and to the west of that are a set of 200 ft high power cables. The active runway at the time of the accident was Runway 06, with a right hand circuit.

30 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 Personnel Pilot’s background and experience The pilot had commenced his microlight flying on 28 March 2012, although his instructor thought he had undertaken some light aircraft training previously. He successfully passed his weight shift microlight General Skills Test (GST) on 2 August 2013. Thereafter, he mainly flew his Blade 912, which is a weight shift microlight, but also carried out three‑axis microlight training on the Ikarus C42. His first three-axis solo flight was in G-CDNR on 12 February 2015. He continued to fly his Blade 912. On 20 February 2016, he recommenced his three-axis conversion. Tests and research Flight test On 7 September 2016 flight testing, commissioned by the AAIB, was carried out at Old Sarum Airfield using an Ikarus C42 aircraft (registration G-CDOK) which closely matched the accident aircraft. The purpose of the flight test was to assess the aircraft’s handling qualities, particularly with respect to takeoff profiles with full power applied. The weather conditions were good, with a surface wind of 160° at 8 kt, visibility in excess of 20 km, OAT +24° and light turbulence. The instructor from Stoke Airfield who had witnessed the accident was present for the test and was able to compare the accident flight profile with that of the test aircraft. The testing was carried out by a qualified Experimental Test Pilot using standard CS-231 test techniques. The test aircraft was configured with the same weight, CG and elevator trim position as the accident aircraft. Flights were carried out with the test pilot flying the aircraft ‘hands-on’ (Closed Loop) and then ‘hands-off’ (Open Loop), to establish the forces needed to control the aircraft and its behaviour if not controlled, as would have been the case had the pilot become incapacitated. The circuits were flown to Runway 06 at Old Sarum which has an 800 m grass (over chalk) runway. The following is quoted from the Flight Test Report: ‘Take-off: “Closed Loop” and “Open Loop” take-offs were conducted with take-off flap. Closed Loop the stick was held aft to reduce loads on the nose- wheel. The aircraft flew itself off in this attitude and was allowed to accelerate to 60 KIAS to climb away. Directional control was easy with full power applied indicating an effective rudder. Open Loop the aircraft was trimmed as above and full power applied smoothly with subtle inputs to the rudder to ensure it ran straight along the ground. Without any joystick input the aircraft lifted off to approx. 5 ft, sank slightly as it continued to accelerate then pitched smartly nose up to approx. 30° at 55 KIAS before pitching back down to a stable climb attitude of approx. 25° nose-up. Without rudder input there was a subtle tendency for the aircraft to yaw and then roll to the left. Footnote 1 EASA Certification Specification 23.

31 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 Full Power caused the nose to pitch up – idle power caused it to pitch down. Application of full power caused the aircraft to yaw very slightly left which created sufficient sideslip to cause the aircraft to subsequently roll left. With full power applied during the take-off condition assessments the aircraft had a subtle tendency to yaw to the left followed by a roll to the left. If the yaw was not prevented the aircraft continued to roll with the nose starting to drop as the AOB [angle of bank] exceeded 30°. If not corrected the AOB increased and the nose dropped below the horizon with the aircraft entering into a spiral dive.

Conclusions and Recommendations The 100 hp C42 aircraft was a very benign aircraft with good handling qualities and stall characteristics. Take-offs and landings were easy to perform. The application of full power with neutral pitch trim created a nose up pitching moment but in all tested cases the aircraft eventually stabilised into a climb. The more flap that was applied the greater the nose up pitch (initial and stable) attitude and the slower the subsequent airspeed but even with full flap the aircraft did not slow down to the stall speed. It was possible to conduct Open Loop take-offs with one stage of flap with the aircraft eventually ending up in a 55 KIAS climb. Without small rudder inputs to prevent yaw to the left the aircraft with full power applied would roll to the left and subsequently enter a spiral dive.’ The instructor who had witnessed the accident observed the test flight takeoffs, but none had the extreme climb rate and nose-up attitude of the accident flight. Medical and pathology A post-mortem examination did not reveal the presence of any pre-existing disease or medical condition which might have contributed to the accident. The pilot was reported to have been in good health and toxicology showed no presence of drugs or alcohol. Analysis General The investigation concluded that the accident resulted from an in-flight loss of control followed by a collision with the high tension power cables adjacent to the airstrip. The instructor described the aircraft as “hanging on the prop”, which suggests a high angle of attack. It is probable that the aircraft entered a stall, with the left wing dropping such that the aircraft was pointing at the ground. This is supported by the angle of the cable impact mark on the right wing leading edge. None of the cables broke, although it is probable that they had the effect of reducing the aircraft’s vertical speed. The shallow crater made by the engine and the lack of significant compression foreshortening of the fuselage suggested a relatively low ground impact speed.

32 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 Engineering aspects While it was not possible to conduct a complete check of the flying controls due to the fire having consumed some components, there was limited scope for a disconnect or a malfunction in such a simple system. Regarding the secondary flying controls, the flaps were found to be retracted. The elevator trim, being in a central position, is unlikely to have resulted in control forces that were higher than the pilot was used to. The engine components were found to be in good condition, although some of the accessories had been severely damaged by the fire. The aircraft had been climbing prior to the loss of control and the damage to the propeller blades indicated that at least a degree of power was applied at the time of the ground impact. The witness and video evidence additionally indicated that the aircraft had climbed more steeply after takeoff than on the previous flight. Whilst this could be expected due to the reduced all-up weight of the aircraft after the instructor had disembarked, it appeared to happen immediately after the aircraft became airborne. The possibility of cracking of the fuselage tube and A-strut was identified on C42 aircraft subsequent to the accident to G-CDNR. Neither had previously resulted in an accident but, of the two, the A-strut issue is considered more relevant to this accident, as the likely consequences of a failure would allow the wing leading edge to lift, thus increasing the angle of attack. This in turn would cause an uncommanded climb, which accords with the observed behaviour of the aircraft after takeoff. Had a failure of the A-strut occurred, the upper section would have been held mostly by the locating rivet, which could have failed in shear under the action of flight loads. The rivet was found to be intact and undistorted, similar in appearance to the rivet in the lower attachment, which still retained the bottom of the A-strut. This suggested that there had not been an airborne failure, and this is supported by the statement from the manufacturer’s design/certification engineer that the rivet would withstand flight loads of 2 to 3g. However, given the degree of damage sustained by the aircraft in the post-crash fire, the possibility of some other failure could not be discounted. Operational aspects The pilot was properly licensed to conduct the flight and had carried out three flights with the instructor that day to prepare him for the solo flight. During those flights he had demonstrated a satisfactory standard of ability in the operation of three-axis aircraft, sufficient to be allowed to fly solo. It appeared that either no attempt was made to correct the aircraft’s extreme nose-up attitude or drift to the left prior to the accident, or the pilot had been unable to take corrective action. The post-mortem examination did not identify any medical reason for a lack of intervention by the pilot.

33 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CDNR EW/C2016/03/01 The flight testing demonstrated that: ‘with full power applied during the take-off condition assessments, the aircraft had a subtle tendency to yaw to the left followed by a roll to the left. If the yaw was not prevented the aircraft continued to roll with the nose starting to drop as the AOB exceeded 30°. If not corrected the AOB increased and the nose dropped below the horizon with the aircraft entering into a spiral dive.’ The witnesses’ description of the final manoeuvre was more indicative of a wing drop at the stall resulting from the excessively nose-high pitch attitude. The instructor had observed the flight tests at Old Sarum and in none of those takeoffs did the test aircraft climb as steeply as the accident aircraft. This suggests that either the pilot had applied an aft side stick control input, or the aircraft suffered a failure leading to a loss of control. If the pilot did not correct the yaw to the left, his ground track would have taken him towards the power cables, the location and height of which were known to him. With the high nose-up pitch attitude, the visibility forward would have been restricted by the nose of the aircraft. It is possible that, in trying to achieve the maximum angle of climb to avoid the power cables, the pilot may have made a large aft side stick control input and, with limited forward visibility, may not have been fully aware of his extreme nose-up pitch attitude. Conclusion The pilot had demonstrated that he was competent to fly the aircraft before undertaking the solo flight and yet the aircraft was seen to climb very steeply before control was lost. The extreme angle of climb and wing drop were not reproduced in the ‘Open Loop’ (hands‑off) takeoffs during flight testing and this suggests that either the accident pilot had made a deliberate and sustained aft side stick control input, or a failure of the aircraft occurred, resulting in the steep climb and a reduction in airspeed. The continued reduction in airspeed led to a stall, left wing drop and departure from controlled flight, with insufficient height to recover before striking the cables. There was insufficient evidence available to determine which possibility was more likely.

FD06602 ｜ 2017_英国_aaib-investigation-to-ikarus-c42-fb80-g-ceak__Ikarus_C42_FB80_G-CEAK_11-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

95 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-CEAK EW/G2017/07/17 ACCIDENT Aircraft Type and Registration: Ikarus C42 FB80, G-CEAK No & Type of Engines: 1 Rotax 912-UL piston engine Year of Manufacture: 2006 (Serial no: 0606-6826) Date & Time (UTC): 8 July 2017 at 1130 hrs Location: Ince Airfield, Merseyside Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - None Passengers - None Nature of Damage: Damage to left landing gear, left wing strut and underside of elevator skin Commander’s Licence: Private Pilot’s Licence Commander’s Age: 71 years Commander’s Flying Experience: 280 hours (of which 145 were on type)

Last 90 days - 2 hours

Last 28 days - 0 hours Information Source: Aircraft Accident Report Form submitted by the pilot The aircraft was flown from Manchester Barton Airfield to Ince Airfield, Merseyside. The pilot was familiar with Ince and made an approach to Runway 29 which is 440 m in length and 20 m in width. The final approach is across an open arable field and at the time of the accident it was growing a crop of potatoes. The pilot noticed that an irrigation sprinkler was operating in the field to the north of the approach path but considered that it was not in the way. When the aircraft was on short final, the windscreen was suddenly sprayed with water, removing the view ahead, and the aircraft sank down short of the runway. The left main wheel caught in the crop and the left wing support strut detached. The aircraft continued rolling towards Runway 29, across a ditch, whereupon the left landing gear leg detached. The aircraft ran onto the runway surface, before coming to a stop. There were no injuries to either occupant. The airfield operator reported that the sprinkler system had not previously been used near the airfield. They considered that it did not represent a hazard unless an aircraft was low on the approach.

FD06603 ｜ 2017_英国_aaib-investigation-to-letov-lk-2m-sluka-g-mznz__Letov_LK-2M_Sluka_G-MZNZ_09-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

124 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-MZNZ EW/G2017/05/34 ACCIDENT Aircraft Type and Registration: Letov LK-2M Sluka, G-MZNZ No & Type of Engines: 1 Rotax 447 1-V piston engine Year of Manufacture: 2000 (Serial no: PFA 263-13274) Date & Time (UTC): 31 May 2017 at 1435 hrs Location: College Farm Airstrip, Oakley, Bedfordshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 Passengers - N/A Nature of Damage: Destroyed Commander’s Licence: Light Aircraft Pilot’s Licence Commander’s Age: 65 years Commander’s Flying Experience: 704 hours (of which 9 were on type)

Last 90 days - 9 hours

Last 28 days - 9 hours Information Source: Aircraft Accident Report Form submitted by the pilot The pilot reported that he was on a local flight from College Farm Airstrip, where the aircraft was based. At the time the weather was good and the wind calm. Soon after becoming airborne the aircraft’s engine failed, and the pilot lowered the aircraft’s nose with the intention of landing straight ahead. The aircraft flew over one set of power lines before colliding with a second, higher set. At the point of contact the aircraft’s engine caught fire. The power line broke and the aircraft fell to the ground coming to rest inverted. The pilot released his harness and rolled out of the aircraft. He then ran to the other end of the strip to get a fire extinguisher but on his return the aircraft had been consumed by the fire. The local RFFS and ambulance service then arrived on scene. The pilot suffered a minor head injury. Subsequent examination of the aircraft’s engine indicated to the pilot that its failure was probably due to the front cylinder head gasket failing at full power.

FD06604 ｜ 2017_英国_aaib-investigation-to-luscombe-8e-silvaire-deluxe-g-brgf__Luscombe_8E_Silvaire_Deluxe_G-BR.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

100 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BRGF EW/G2017/06/04 ACCIDENT Aircraft Type and Registration: Luscombe 8E Silvaire Deluxe, G-BRGF No & Type of Engines: 1 Continental Motors Corp O-200-A piston engine Year of Manufacture: 1947 (Serial no: 5475) Date & Time (UTC): 11 June 2017 at 1144 hrs Location: Old Buckenham Airfield, Norfolk Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Propeller bent, windscreen cracked, canopy damaged, dent in the aft firewall and the tailfin bent Commander’s Licence: Private Pilot’s Licence Commander’s Age: 75 years Commander’s Flying Experience: 1,212 hours (of which 888 were on type)

Last 90 days - 5 hours

Last 28 days - 4 hours Information Source: Aircraft Accident Report Form submitted by the pilot The aircraft was on final approach to land and descended over a rapeseed crop close to the end of the runway. The pilot states that he was attempting to land the aircraft “as short as possible on the short runway” but “misjudged” the approach and the landing gear made contact with the crop, causing the aircraft to nose over. The aircraft came to a stop on its back sustaining damage to the engine bay, propeller, windscreen, canopy and tailfin. The pilot was uninjured.

FD06605 ｜ 2017_英国_aaib-investigation-to-magni-m24c-orion-gyrocopter-g-msgi__Magn_M24C_Orion_gyrocopter_G-MSG.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

96 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-MSGI EW/G2017/08/11 ACCIDENT Aircraft Type and Registration: Magni M24C Orion gyrocopter, G-MSGI No & Type of Engines: 1 Rotax 914-UL piston engine Year of Manufacture: 2017 (Serial no: 24-16-0384) Date & Time (UTC): 6 August 2017 at 1145 hrs Location: Oakley Airfield, Buckinghamshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew – 1 (Minor) Passengers - N/A Nature of Damage: Rotor, propeller and tail Commander’s Licence: Private Pilot’s Licence Commander’s Age: 67 years Commander’s Flying Experience: 300 hours (of which 59 were on type)

Last 90 days - 12 hours

Last 28 days - 12 hours Information Source: Aircraft Accident Report Form submitted by the pilot At 50 ft above the ground, just after takeoff, the gyrocopter’s engine stopped. With no further useable runway available, the pilot elected to turn slightly to the right into wind and land on a taxiway. On landing, the gyrocopter bounced before rolling onto its left side, causing damage to the rotor, propeller blades and tail. The pilot, wearing a full harness, suffered bruising and minor injuries to his legs. Prior to the flight, the pilot had purchased some unleaded fuel which he put in a metal jerry can that he had used for a number of years. When refuelling the aircraft, he had concerns about the colour of the fuel, but convinced himself it was good after checking the flammability of a small sample. On reflection, he suspects the fuel was probably contaminated causing the engine to stop and that, during the subsequent landing, he let the airspeed drop below the recommended landing speed.

FD06606 ｜ 2017_英国_aaib-investigation-to-north-american-p-51d-mustang-g-mstg__North_American_P-51D_Mustang_G.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

15 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 ACCIDENT Aircraft Type and Registration: North American P-51D Mustang, G-MSTG No & Type of Engines: 1 Packard Motor Car Co Merlin V1650-7 piston engine Year of Manufacture: 1945 (Serial no: 124-48271) Date & Time (UTC): 2 October 2016 at 1434 hrs Location: Topcroft Farm Airstrip, near Hardwick Airfield, Norfolk Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - 1 (Serious) Passengers - 1 (Fatal) Nature of Damage: Aircraft destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 58 years Commander’s Flying Experience: 1,965 hours (of which 760 were on type)

Last 90 days - 21 hours

Last 28 days - 6 hours Information Source: AAIB Field Investigation Synopsis The aircraft was returning to a private airstrip and, on landing, bounced twice before attempting to go around. The aircraft had been subjected to a crosswind from the right during its approach and on go-around flew a flight path increasingly diverging to the left, away from the airstrip. It remained at low level until it struck a tree close to the airstrip. The passenger was fatally injured and the pilot survived with serious injuries. There was no evidence of any aircraft system failure or malfunction which could have contributed to the accident. The accident was most likely a result of loss of directional control due to a combination of crosswind and effects of applying go-around power whilst the aircraft was at low speed. The investigation identified other aspects concerning the safety clothing to be worn in ex‑military aircraft. History of the flight The pilot had flown on the morning of the accident in G-MSTG with a passenger, with no problems being reported. Later on the same day a different passenger arrived at Topcroft Farm Airstrip with members of his family for a flight to overfly a number of World War II (WWII) United States Army Air

16 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 Force (USAAF) airfields around Norfolk. The pilot briefed the passenger who was then assisted to climb into the aircraft and strap in. The aircraft took off from Runway 28 at approximately 1348 hrs and flew north-west towards The Wash. It then flew inland to turn onto a south-easterly track near March, turning west of Eye towards Bungay and then back towards Hardwick (Figure 1).

Figure 1 Radar track of G-MSTG The aircraft neared Hardwick at approximately 1433 hrs and entered a holding pattern north-west of the airfield before joining downwind for a right hand circuit to Runway 28. The pilot then flew a continuous descending turn onto approximately a 1 km final approach. The wind at the time was reported as being from north-west/north-north-west at about 13 kt with a maximum recorded gust from north-west at 22 kt. A witness on the airfield, standing approximately halfway along and slightly to the south of the runway, videoed the final approach and initial part of the landing. From a visual assessment of the video, the aircraft approached with its landing gear extended and flaps appearing to be fully down. The final approach seemed stable however there appeared little, if any, attempt to compensate for the crosswind by either side-slipping into wind or flying with the into-wind wing (the right wing) slightly down. The video showed the aircraft achieve a three-point touch down and bounce back into the air. The aircraft appeared to be approximately aligned with the runway and to drift left

17 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 towards the runway edge. At the same time there was a small amount of left roll which was corrected with ailerons. The aircraft then touched down again and bounced a second time; an engine rpm increase being heard on the video shortly after this touchdown. Again, the aircraft appeared to remain approximately aligned with the runway when touching down but, when airborne again, continued to drift towards the runway edge and also yawed to the left. Figure 2 Topcroft Farm Airstrip It was not possible to establish the rudder position from the video. The camera tracked the aircraft until it started to drift over the side of the grassed strip at which point the aircraft was no longer in frame, although it could still be heard in the recording. The aircraft was seen to fly increasingly to the left of the runway, narrowly missing a tree standing in the adjacent field to the south of the airstrip. It remained at low level until it collided with a tree at the boundary of the field causing the aircraft to impact the ground. The emergency services were called and arrived on site shortly afterwards. The pilot was seriously injured and the passenger received fatal injuries.

18 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 Accident site Figure 3 Accident site The aircraft had struck a mature oak tree on the boundary between two fields with marks showing that one of the propeller blades had been the first point of impact. This had been rotating with sufficient power to slice upwards through the trunk and into a bough of the tree which detached and fell away. The tip of this blade was left deeply imbedded in the remainder of the trunk. After the propeller had hit the tree, the aircraft continued onward with the tree passing along the left side of the fuselage. The inner section of the left wing was struck by the tree causing the wing to detach, before the left tailplane then detached as it was also hit by the tree. Figure 4 Tree strike in direction of aircraft travel

19 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 There was a 57 m debris trail on a bearing of 225° leading from the tree to the main wreckage. The aircraft had come to rest upright in the field beyond the tree, resting on its right mainwheel and tail wheel, with the trailing edges of the wing and tailplane tips dug into the soil. The right wing fuel cap was in place and the tank contained approximately 25 Imp gal of fuel. Lubricating oil had seeped into the ground around the front of the aircraft and there was evidence of coolant seeping out from the underside of the fuselage. Other than small amounts of soil residue on some of the equipment on the right side of the cockpit, all the instrument switches and controls were undamaged. The significant controls and switches were set as follows: the flap lever was set at 30 and the carburettor air control levers were set at unrammed filtered air and normal. The landing gear lever was set at dn and the flying control trim settings were: neutral roll, 5 units th (tail heavy) and 2 units right rudder. Both the throttle and rpm levers were in the fully forward position. The mixture control was set at the emerg.f.rich position. The supercharger switch was set to low, the booster pump was set to on and the ignition (magneto) switch was set to both. The fuel shut off lever was set to on and the fuel tank selector was set to main tank lh. The radiator air control switches for coolant and oil were in the neutral off position. The altimeter subscale was set to 1010 hPa. The engine was partially detached from the fuselage but bent downwards resting on the ground on the remains of the reduction gearbox. The engine bearers were broken and distorted and the engine control cables and rods were still connected but had been pulled forward and were under tension. Various oil and coolant flexible pipes had been split or had parted from their rigid pipe connections. Figure 7 shows the partial detachment of the engine and the effect on the engine control linkages. The propeller had detached from the engine along with its drive gear and was lying in the wreckage trail close to the aircraft. All but one of the blades were complete but all were heavily distorted. Figure 5 (right) Propeller damage

20 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 The left tailplane was lying in a ditch near the base of the tree and the left flap and elevator was lying a short distance further on. The left wing was lying upside down in the field 65 m from the tree away from the main wreckage. The left main landing gear was still attached to the wing but was in the retracted position. Figure 6 Left wing The canopy had also detached and was approximately two thirds the way along the wreckage trail. Although its frame was in one piece there were signs of breakage and melting of the canopy Perspex. Although the fuselage and engine showed little or no signs of fire, the remains of the left self-sealing fuel tank and a large portion of the tree had evidence of a brief but intense fire.

Figure 7 Engine control linkages under tension

21 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 Ground marks The initial touchdown point of the main wheels on the airstrip could not be accurately located, however, there was a faint mark, probably from the tailwheel, 104 m in from the threshold of Runway 28 and 11 m from the left edge. There was another mark from the tailwheel 200  m further on, and 1.4 m from the runway edge at its start, running approximately 15º off the runway heading towards the left edge. There were more wheel marks on the ploughed surface of the field next to the runway. These marks started with a tail wheel imprint and then the left mainwheel, the mainwheel mark being curved slightly to the left and approximately 100 m in length. About 29 m along the mark there was a parallel mark made by the right mainwheel. Both marks ceased as they approached the concrete track which ran across the field. There was another left mainwheel mark 100 m further on in the field on the other side of the concrete track. This mark was approximately 30 m long and was very distinctive as if the tyre had been running at an angle to the direction of travel, gouging the soil. There were no more ground marks up to the impact point with the tree. Figure 8 shows the final ground mark and the position of the tree hit by the aircraft. Tree struck by aircraft Left mainwheel ground mark Figure 8 Final tyre mark and impact tree Aircraft background information G-MSTG was a Mustang P51D single-engine, long-range escort fighter which was built at the end WWII in 1945 by North American Aviation. It was powered by a Packard-built Rolls Royce Merlin V1650-7 engine. It was originally delivered to the Royal New Zealand Air Force on 24 August 1945 where it remained in service to 1955. In 1958 it passed into private ownership and remained in New Zealand where it changed hands twice but was

22 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 not in flying condition. In 1997, it was purchased by the pilot and entered on the CAA register as G-MSTG. The pilot oversaw a comprehensive four and a half year restoration and the aircraft had its first flight since 1958 in July 2001. The aircraft had an ANO exemption to display authentic USAAF markings ‘414419 LH-F’ rather than G-MSTG. As is common with other privately owned Mustangs, the fuselage fuel tank behind the pilot had been removed and replaced with an approved passenger seat, harness and intercom connection; there were no flying controls or instruments fitted in this position. G-MSTG was classified as an Annex II aircraft and certified in its current configuration on a CAA permit to fly, valid to 19 August 2017. Aircraft description The P51D is an all-metal, low-wing monoplane with conventional mechanical flying controls. The landing gear is of a tail drag design and all three gear wheels are retractable.

One of the engine types used to power the P51D was the Packard Merlin V12 supercharged engine, which is rated at 1600 HP. The engine controls consist of three levers - throttle, mixture and propeller pitch (rpm) - fitted on the left side of the cockpit. The engine drives a Hamilton Standard hydromatic four-bladed 11 feet 6 inch diameter constant-speed metal propeller through a reduction gearbox. The propeller rotates in a clockwise direction when viewed from the cockpit. The flying controls consist of pushrods, cables and pulleys actuating conventional ailerons, rudder and elevator. The aircraft is also fitted with a mechanical trim system for all three axes. Control inputs are made using a joystick and reach-adjustable rudder pedals. The aircraft has inboard trailing edge flaps, controlled by a six-position flap handle on the left side of the cockpit. The full down position is marked 50° with other markings at 10° increments until the full up position is reached. The 20° setting is marked take off. The pilot’s seat is of metal construction and can be adjusted vertically to suit the occupant. The seat is designed to accommodate a parachute as the seat cushion and a kapok filled seat back cushion may be used as a life preserver. Shoulder straps and lap belt are attached to the seat and secured in a quick release safety fastener. The type of passenger seat fitted to G-MSTG is of a very simple design with a leather covered seat and back rest fitted with a four-point harness. The seat position is not adjustable. The cockpit is enclosed and covered by a clear Perspex sliding tear-drop canopy which extends over both the pilot and passenger. The aircraft can be flown with the canopy partially open. Fuel is carried in integral self-sealing tanks within the inboard section of each wing. There is the facility to carry additional tanks on the underwing pylons. These tanks were not fitted on G-MSTG. The integral tank useable fuel capacity is 90 US (76.5 imp) gallons.

23 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 The cockpit instruments and controls were in their original configuration although the owner had fitted a modern transponder and GPS navigation system. Aircraft examination The aircraft wreckage was recovered to the AAIB for detailed examination. The cockpit instruments and switches were undamaged and, except for the battery and generator switches which had been switched to the off position at the accident site, were in the same configuration as they were at the time of the accident. All the instruments had decayed to their null or neutral readings when power had been switched off and produced no useful information to the investigation. Switches and levers controlling fuel, engine and landing gear were also as they had been during the accident. The damage to the left wing, tailplane, engine bay and underside of the fuselage around the radiator scoop resulting from the impact with the tree and subsequent collision with the ground was severe, but localised. The left aileron control cables were severed at the wing root but the pulleys, levers and bellcranks up and downstream of the damage were intact. Despite this, the trim and control systems for all three axes (pitch, roll and yaw) could be examined and full range and control continuity could be demonstrated in all cases. The fuel supply system was also badly damaged, particularly in the engine bay and the left wing tank. However, with the fuel valve and selectors as they were found, unrestricted fuel flow to the carburettor could be demonstrated. No fuel was present in the system as it had drained away through various breaches in the pipework. The right main landing gear was down and locked but the left main gear was fully retracted within the separated wing. However, the left gear hydraulic extend and retract ram assembly had completely detached during impact with the tree and was found at the base of the tree. This allowed the left main gear to pivot freely into its retracted position in the upside down wing due to gravity. The engine had to be removed at the accident site in order to stabilise the wreckage. Closer examination found severe distortion and fracture of the engine bearers and large cracks in the supercharger casing. The carburettor air box had parted and the throttle and mixture control linkages were severely disrupted. The air intake duct and carburettor were free from foreign objects or blockage. The reduction gearbox casing had split open and the propeller had detached along with its drive gear and main bearing. Both magnetos were in intact and all 24 high tension leads were in place and connected, although there was minor damage to the leads in the vicinity of some of the spark plug heads. There was no evidence to suggest an engine malfunction and an examination of the plugs and exhaust stubs showed the engine to be in a good state with no evidence of excessive carbon, misfire or oil leakage from any of the cylinders.

24 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 Meteorology The Met Office provided an aftercast of conditions at the time of the accident. It stated that visibility was good and there was no low cloud. At the AAIB’s request, the report particularly focused on the wind: ‘At 1420Z the Norwich METAR reported 330 degrees at 11KT with a variation between 290 degrees and 020 degrees in the previous 10 minutes, while the Lowestoft METAR reported 320 degrees at 12KT with a variation between 290  degrees and 010 degrees in the previous 10 minutes; both within the bounds set by their respective TAFs. However the 1450Z METARs at both sites reported gusts within the previous ten minutes, of 20KT at Norwich and 21KT at Lowestoft. ‘[this data] suggests the wider area was exposed to some gust effects at the time of the accident. These observations also show that the wind direction was varying between west to north-westerly and northerly through the time of the accident. Through the rest of the afternoon, this variation continues with a westerly extreme of 270 degrees and a north to north-easterly extreme of 020 degrees. ‘…while the prevailing winds were north-westerly at the time of the accident, there was sufficient variation between west to north-westerly and northerly winds for it to be reported in the METARs/AutoMETARs from the surrounding stations, and that there were gusts in the general area, reaching the low 20KTs at Lowestoft on the coast and Norwich, approximately 12 miles inland. Furthermore, the variation in the wind remained through the rest of the afternoon.’ Additionally, the airfield has a small weather station which recorded data, including the average and maximum wind speed and their directions for each half-hour period. Between 1430 hrs and 1500 hrs, the average direction was north-north-westerly and the average speed, 13 kt; the maximum wind was 22 kt from the north-west which equated to a maximum crosswind component at the landing strip of approximately 18 kt. In discussion with the pilot of G-MSTG, and other pilots familiar with the Mustang, the crosswind experienced on the day of the accident was not considered excessive for a pilot of his experience on type. Airfield information The private farm strip used by the aircraft owner consisted of a grass runway, orientated 10/28, 825 m long and which varied in width between 37 m at its middle and 45 m at either end. There was a low hedge running across either end of the strip. On the day of the accident the runway was firm, dry and in good condition with grass cut to approximately 6 cm in length. For noise abatement, all circuits to the airstrip are flown to the north.

25 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 There was a windsock situated on the northern side of the strip next to some farm buildings and an aircraft hangar. The field to the south of the strip had been ploughed up to a concrete track which ran perpendicular to the runway about 500 m from the threshold of Runway 28. Beyond the track the field had been cultivated presenting a soil surface with small regular grooves approximately two to three cm in depth. Figure 9 shows an aerial view of the airfield and the surrounding area.

825 m Figure 9 Topcroft Farm Airstrip Recorded information Aspects of the accident flight were recorded by radar systems, an on-board GPS unit and the witness video camera. Radar coverage in the area did not extend to ground level in the area of the airstrip, however, radar recordings provided an overview of the flight (Figure 1). The GPS unit recovered from the aircraft was set to log position, track and heading at 30 second intervals which was insufficient to allow analysis of dynamic events. The last recorded GPS point was recorded just before the aircraft’s initial touchdown point and indicated the aircraft touched down to the left of the centre line at a speed of 99 mph.

The video was recorded from a position to the south of the runway in the vicinity of the path that crosses the runway. Audio analysis of the video recording enabled an assessment of the engine rpm (Figure 10). The analysis had to take into account the Doppler shift, due

26 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 to the aircraft moving relative to the position of the video camera, to derive an accurate assessment of the propeller rotational speed1. The Doppler shift itself, assuming steady ground speed and engine speed, indicated that the aircraft passed the camera position with a speed of between 74 and 83 mph. The audio signatures from the propeller were analysed and calculations indicated an engine speed of approximately 2,300 rpm just prior to initial touchdown. The audio signatures at this point were not prominent, indicating the engine was at low power. Just after the second touchdown, the signatures became prominent again indicating increased engine power and increasing engine speed. The engine speed was calculated to be approximately 2,800 rpm as the aircraft passed the camera, assuming the engine speed and ground speed were approximately constant as it passed. Six seconds before impact with the tree, the propeller speed rose again reaching a maximum after 1.5 seconds and then steadily reducing until the point of impact. Figure 10 Spectrum Analysis of video audio Footnote 1 Doppler shift is the apparent shift in frequency of a sound if the source is moving towards or away from the listener. An example of this is the apparent drop in tone of sirens on emergency vehicles as they change from coming towards you to going away from you when they pass.

27 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 Pilot information The pilot obtained a PPL (A) in May 1989, which was current with a valid single engine piston (SEP) endorsement and a Class II medical certificate at the time of the accident. He had been flying historic aircraft for a number of years, including flying at air displays. The pilot owned G-MSTG and ran a small private ‘living’ aircraft museum based at Topcroft Farm Airstrip, near to the old WWII Hardwick Airfield. The museum consisted of several other historic aircraft including, until recently, another P51D Mustang which the pilot had also owned. Both Mustangs had been restored and maintained through an engineering company owned by the pilot. The company was approved by the CAA in accordance with BCAR Section A, Sub-section A8. The pilot had no recollection of the accident. He was however able to describe his usual technique for landing the aircraft and going around. He would normally land with full flap selected and would not consider it necessary to reduce the degree of flap selected if landing in a strong crosswind. He would also open the canopy during the approach to facilitate evacuation from the aircraft in case an emergency egress was required. Survival information Both the pilot and passenger had remained securely strapped in their seats during the accident. Pilot The pilot survived the impact but suffered a number of serious injuries, particularly to his neck and burns to his face and neck. He had been wearing cotton overalls over a polyester cotton shirt. He had also been wearing a composite flying helmet with integrated headphones, microphone and visor. A small amount of soil had become trapped under the helmet visor, which was found in the up position, and there were signs of light sooting on the outer surface of the helmet. The pilot has no recollection of the flight. Passenger The passenger was fatally injured with significant injuries to his head and neck. He had been wearing normal clothing and although he was wearing a headset, he had not been wearing a helmet or any other form of head protection. Medical assessment of the injuries sustained was that it was unlikely that the wearing of a helmet would have changed the outcome.

28 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 CAA guidance The CAA offers guidance regarding clothing suitable and recommended for flying high performance ex-military aircraft in CAP 632, Flying Clothing, Chapter 7 Paragraph 17, 18 and 19, and Appendix E. The salient points are: ‘7.17 The CAA requires that all occupants flying jet aircraft shall wear protective helmets equipped with suitable visors. For occupants of other aircraft, such helmets are considered to be highly desirable. 7.18 The pilots, crew and any passengers flying in ex-military aircraft should, in addition to wearing a suitable helmet equipped with visor, wear a fire-retardant flying suit, leather gloves and suitable boots. When flying in coastal areas a life jacket capable of withstanding aircraft abandonment should be worn. This should be capable of being inflated during a parachute descent. The wearing of an immersion suit and carriage of a life-raft is recommended in the appropriate circumstances. 7.19 Further guidance regarding appropriate flying clothing is given at Appendix E. Appendix E Guidance on appropriate flying clothing and safety equipment (dress to survive) Flying clothing E1 Use of the correct flying clothing is an important factor in the safe operation of ex-military aircraft. This class of aircraft, even the older piston engine types, are capable of operating at speeds and heights well in excess of the average light aircraft and in-service experience has led to the development of specifically designed flying clothing. Military aircrew are equipped and trained to survive accidents and incidents: civilian operators of ex-military aircraft are strongly encouraged, and in certain circumstances, required, to follow the survival best practice developed by the services. Flying suits E2 Flying suits are the only practical garment for flying in ex-military aircraft. In addition to protection, they also assist with the storage of maps and documents and prevent loose articles falling into the cockpit, particularly important in aircraft without cockpit floors or storage areas, such as the Spitfire, the Corsair or even the Harvard. E3 Flying suits offer protection in the case of abandonment or ejection and, if properly fireproofed, in the case of fire. Given the possible close proximity between fuel and the pilot, particularly in piston engine ex-military aircraft, wearing of a fire resistant flying suit such as those made of Nomex is very desirable and highly recommended.

29 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 Flying boots E4 The use of correctly sized boots specifically designed to give good ankle support is particularly important in the abandonment or ejection scenario. Good ankle support is very beneficial in a parachute landing and it is important that, in the case of an ejection, the boots are not lost on ejection. Flying helmets E5 Flying helmets are required for flying in all jet aircraft and highly recommended for all other ex-military aircraft. E6 The helmet clearly offers protection during abandonment, ejection and the subsequent parachute landing. However, it also has an important head protection role during a forced landing and, with an adequate visor in the down position, in the event of a bird strike. Given the speeds of ex-military aircraft, even when limited to 250 knots, a bird strike in the cockpit area can, and has in the past, caused pilot incapacitation. Flying gloves E7 Cape leather or USAF style flying gloves offer considerable protection against cockpit fires and should be worn for all flights.’ Passenger flying regulations The CAA has in place a number of regulations and issued guidance as to the conduct of passengers flying in historic Annex II aircraft which are being flown under a permit to fly. It sets out the airworthiness compromises made in order to enable historic aircraft to fly and requires these to be brought to the attention of passenger(s). Information provided by the passenger’s family suggest that the flight was being conducted on a cost-sharing basis. Factors potentially affecting directional control Torque roll The P51D has a fast responding engine mounted on the aircraft centreline giving large torque in relation to the aircraft weight. This makes the aircraft liable to torque roll, an effect where should the throttle be opened quickly it causes the aircraft to roll in the opposite direction to the propeller rotation. On G-MSTG, this would result in a roll to the left. An aircraft is particularly susceptible to this during a go-around from an approach when power is increased from, or close to, flight idle and the aircraft is less controllable due to its low speed.

The USAAF P51D Flight Handbook warns not to ‘jam’ the throttle forward as ‘torque will cause loss of control.’ The handbook reiterates this in the go-around advice stating that the throttle should be opened smoothly.

30 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 Corkscrew effect This is the name given to the effect of the propeller slipstream which spirals around the aircraft fuselage. At low airspeeds and high propeller rpm this produces compact spirals which can exert a strong sideways force on the aircraft’s vertical tail surface. On G-MSTG, due to the direction of its propeller’s rotation, this causes a yawing moment around the vertical axis to the left. Gyroscopic action The rotating propeller has properties similar to that of a gyro. When a force is applied to a gyro, the resultant force acts at 90º ahead of, and in the direction of, rotation. Any action on the aircraft causing the propeller to change its plane of rotation also results in a force creating a pitching moment, a yawing moment, or a combination of both depending on the point at which the force was applied. This action is more prominent in tailwheel aircraft and most often occurs when the tail is being raised during takeoff, or a go-around. This change in pitch attitude has the same effect as applying a force to the top of the propeller’s plane of rotation, creating on G-MSTG a yawing effect to the left. Asymmetric blade effect When an aircraft is flying at a high angle of attack, the downward moving propeller blade is more effective than the upward moving blade. On G-MSTG, this moves the centre of thrust to the right side of the propeller disc, causing a yawing moment to the left. Landing performance The approximate aircraft takeoff and landing weights were calculated as 8,213 lb and 7,893 lb respectively. The weight calculations relied on estimated fuel quantities (as no fuel records were kept) based on the quantity of remaining fuel found in the undamaged right wing tank. A table in the Flight Handbook for the P51D details the landing performance figures. At a landing weight of 7,893 lb the landing distance required to clear a 50 feet obstacle is stated as 1,650 feet (503 m). With the application of the CAA Safety Sense Leaflet 7c on performance the landing distance required is increased by a factor of 1.15 due to the grass surface and an additional safety factor of 1.43. This gives a total landing distance required of 828 m. Go-around The USAAF P51D Flight Handbook provides the following instruction for a go-around.

1. Open throttle smoothly; do not exceed 61 in. Hg 3,000 RPM.
2. Maintain wings level and nose straight.
3. Landing gear handle up.
4. Raise flaps slowly when at least 200 feet above ground.

31 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 The Handbook also gives instructions for a go-around from a missed approach.

1. Open throttle smoothly to 45 in. Hg.
2. Maintain wings level, nose straight.
3. Landing gear up.
4. Raise flaps when at least 200 feet above ground and sufficient airspeed is

reached. The pilot reported he had carried out a number of go-arounds in the past. This included go‑arounds from Topcroft Farm Airstrip, although it had been two of three years since he had last done so. He described his technique as applying about 40 inHG, keeping the aircraft close to the ground and reducing the flap by 10° to reduce drag. As speed increased he would then continue to raise the flaps one stage at a time until at a suitable speed to climb away, at which time he would raise the gear. Analysis Approach and go-around During the approach the aircraft was subject to a crosswind from the right for which the pilot did not adequately compensate. The situation was compounded by the direction of the circuit, for noise abatement, which resulted in the aircraft being on the upwind side and therefore ‘blown out’ of the circuit as it joined the approach. This culminated in the aircraft landing to the left of the centreline. The landing performance stated in the Flight Handbook when factored by the safety factors prescribed in the CAA Safety Sense Leaflet 7c giving 828 m made the landing distance available at Topcroft, of 825 m, marginal. The aircraft touched down at the appropriate speed and attitude but bounced, which further subjected the aircraft to the effects of the crosswind. This was exacerbated by the small roll to the left, despite the pilot quickly applying corrective aileron. As a result, the aircraft moved closer to the left edge of the airstrip before bouncing again. It is highly likely that the continued left sideslip would have meant that a subsequent touchdown would have been off the grass surface, something which would have been evident to the pilot. This, together with the length of the airstrip, would have provided good cause to go around. The application of power and associated torque, corkscrew, gyroscopic and asymmetric effects, would have further increased the tendency for the aircraft to travel to the left. The ability to compensate with roll would have been limited, as the aircraft was close to the ground and over a cultivated surface. The direction of the wind would have led to the fuselage partially blocking the wind affecting the left wing, reducing its lift. The wheel contact marks demonstrated that the aircraft was not climbing. The go-around procedure calls for a compromise between power application and controllability. The pilot’s described technique differed from that in the aircraft manual. By leaving the gear down

32 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 there would be an increase in drag, however the aircraft was too close to the ground to raise it safely. Equally, there is evidence that the pilot raised the flaps during the attempted go‑around by 20° in an effort to reduce drag, but this would have resulted in a reduction of lift. The situation was compounded by the gear coming into contact with the cultivated ground which would have had a significant decelerating effect. The combined result was that the aircraft struggled to accelerate and remain airborne, and it veered approximately 30º to the left of the runway direction. Final accident sequence The magnitude and nature of the damage to the tree shows the engine was producing high power at the point of impact. The nature and location of the damage show that the left wing root then hit the tree causing the left wing and flap to detach. The bending and distortion to the aircraft structure around the wing root and tailplane attachment suggest the aircraft was left wing low with a roll angle of approximately 60°. As the aircraft continued forward, the remaining right wing would have produced rapid left rolling moment at which point the nose of the aircraft dipped and continued towards the ground. The rate of pitch and roll was substantial and close proximity of the ground meant the aircraft hit the ground on the upper left side of the fuselage. The canopy detached during this impact and landed nearby along with the remains of the left self-sealing fuel tank. The aircraft then bounced on to its nose; the damage to the propeller spinner suggest the aircraft was at a near vertical attitude whilst rotating. The propeller was still under significant power at this point but detached during this impact. The aircraft inertia and rotation then caused the aircraft to carry on tail first to finally hit the ground pointing in the opposite direction to travel. The right wing and tailplane tips dug into the ground at this point bringing the aircraft to a stop. The damage to the engine bearers is likely to have occurred as a result of the torque shock as the propeller sliced through the tree. The impact at the left wing root released the self-sealing fuel tank from its bay rupturing its structure and fuel lines. The fuel in this tank was released and ignited. The majority of fire damage occurred in the remains of the tree bough and the ruptured tank. However, burning fuel appears only to have flashed over the front position of the cockpit just before or as the canopy detached. Survivability Although both occupants were strapped in and the cockpit remained largely intact, they were subject to considerable forces, sufficient to result in serious neck injuries. The passenger was not wearing the appropriate clothing or helmet recommended by the CAA. The passenger’s head injuries were consistent with contact with a flat surface and is likely to have been caused by hitting the inside of the canopy in the first ground impact, prior to the canopy detaching. The injuries sustained were severe but it is unlikely that the outcome would have been different had he been wearing a helmet.

33 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-MSTG EW/C2016/10/01 Some of the flashover fire injured the pilot, although the melting damage to the outside of the canopy indicates the canopy prevented most of the fire entering the rear of the cockpit. The pilot’s burns were consistent with his flying suit being open and loose around his neck whilst wearing a non-fire retardant shirt underneath. Conclusions The aircraft appeared to have been well maintained and in a good condition at the time of the flight. There was no evidence of any aircraft system failure or malfunction which might have contributed to the accident. The pilot was experienced on the type and would have normally been capable of flying under the prevailing conditions. However, in this case directional control was lost during the go-around due to the handling effects of increased engine power at low speed and the crosswind from the right. This, and the inability to accelerate and climb away in the space available led to a collision with a tree during the go-around. The crosswind during the approach and landing and the requirement to fly the circuit from the upwind side due to noise restrictions affected the positioning of the aircraft on the approach. The decision to go around, after the bounces, seemed logical and it is likely that had the aircraft been able to maintain directional control during the go-around, the pilot should have been able to accelerate and climb away. The flight appears to have complied with the requirements for operating on a cost-sharing basis laid down in CAP 632. It is clear, however, that the suggested clothing standards, particularly for the passenger, had not been adhered to. Whilst the lack of a head protection is unlikely to have affected the outcome in this accident, it might well have made a considerable difference in a similar accident at a lower speed.

FD06607 ｜ 2017_英国_aaib-investigation-to-pegasus-quantum-15-912-g-mzdh__Pegasus_Quantum_15-912_G-MZDH_12-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

104 © Crown copyright 2017 AAIB Bulletin: 12/2017 G-MZDH EW/G2016/08/10 ACCIDENT Aircraft Type and Registration: Pegasus Quantum 15-912, G-MZDH No & Type of Engines: 1 Rotax 912 piston engine Year of Manufacture: 1996 (Serial no: 7248) Date & Time (UTC): 15 August 2016 at 1843 hrs Location: Holy Cross Green, Clent, West Midlands Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 (Serious) Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: National Private Pilot’s Licence Commander’s Age: 43 years Commander’s Flying Experience: 702 hours (of which 172 were on type)

Last 90 days - 5.0 hours

Last 28 days - 3.5 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis The weight shift microlight was returning from Otherton to Halfpenny Green when the accident occurred. The pilot was seriously injured in the accident and had little memory of the accident flight. There were various witness descriptions of the final descent, including the wing collapsing and the microlight spiralling down but the initiating event was not identified. The pilot was not able to recover from a tight spiral or tumbling condition which continued to the ground. History of the flight The pilot had flown from Halfpenny Green to Otherton in order to carry out his annual flight test. The weather was good with visibility in excess of 10 km, high cloud and light winds. During the flight, he noticed that the ‘Flydata’ instrument indicated an abnormally high value for the engine’s cylinder head temperature (CHT). When he arrived at Otherton, he spoke to the examiner and they tried to establish the cause of the high CHT but were unable to do so. The examiner offered to use his aircraft but the pilot decided to abandon the test and return his aircraft to Halfpenny Green. Before departure the CHT was normal and the pilot did not recall any abnormal indications during the return flight. The pilot thought that he had climbed to 2,000 or 3,000 feet for his return flight but witnesses who saw the microlight immediately prior to the accident thought it was at about 200 to 500 feet.

105 © Crown copyright 2017 AAIB Bulletin: 12/2017 G-MZDH EW/G2016/08/10 There were various descriptions by the witnesses of the aircraft’s descent but, generally, it was seen to spiral to the ground. Some witnesses thought the engine noise changed or had stopped and saw smoke with the aircraft believed to be on fire. The change in engine noise may have been the pilot closing and opening the throttle. The most graphic description was from a witness who reported that the pilot: ‘powered up and climbed steeply. A minute later and the engine cut out. He then seemed to go into a controlled stall. The engine restarted and he climbed again very steeply. It was in the steep climb that I saw the wings fold in half and the microlight went spinning to the ground and disappeared behind some trees. I did not see any flames or smoke.’ Due to his injuries, the pilot was unable to recall details of the accident flight other than that: ‘the ‘A’ frame came back abruptly at some point and the aircraft adopted a spinning motion.’ It is not known what caused the accident but it appears that, following an event, the pilot lost control of the aircraft and was unable to recover it to normal flight before impacting the ground. A witness who saw the aircraft in the final moments reported that it had come down on top of a large farm bale which had absorbed a lot of the impact energy. Accident site The pilot’s injuries, although serious, were not life threatening. The wreckage was removed with the approval of the AAIB but was not viewed by AAIB inspectors and has since been disposed of. The engineer who recovered the wreckage described it as “heavily broken up”. Aircraft information The Pegasus Quantum 15-912 is a weightshift microlight consisting of a wing, suspended under which is a tandem two-seat ‘trike’ on the rear of which is mounted an engine with a three bladed ‘pusher’ propeller. Attached to the ‘trike’ is a tricycle landing gear comprising a nose and two main wheels. An ‘A frame’ is attached to the wing and is used to control the aircraft. Aerobatic manoeuvres are not permitted and nose-up or nose-down attitudes must not exceed 45° with maximum bank angles not to exceed 60°. The normal acceleration limits are +3.8/-0g. The ‘A frame’ is used to manoeuvre the microlight in pitch and roll. Moving the base bar at the bottom of the ‘A frame’ forward causes the wing leading edge to move up which results in the nose pitching up and the microlight climbing. Moving the base bar aft has the opposite effect and causes the microlight to descend. Moving the base bar to the left causes the microlight to bank and turn to the right whilst moving the base bar to the right will cause the microlight to turn to the left. The microlight is responsive to control inputs

106 © Crown copyright 2017 AAIB Bulletin: 12/2017 G-MZDH EW/G2016/08/10 with large and rapid movements of the base bar resulting in equally large and rapid attitude changes. The stall speed recorded on the BMAA Check Flight Schedule was 36 mph. Microlight ‘tumbling’ The microlight ‘tumble’ is a rapid uncontrolled rotation about the pitch axis from which there is no known recovery technique. It usually results following rapid movement from a large nose-up attitude to a large nose-down attitude such as at a ‘whip stall’1. This is accompanied by the pilot pulling back on the base bar to adopt a nose-down, stall recovery attitude, which when combined with the natural pitching forward of the wing, causes the microlight to tumble. The tumbling achieves very high rates of rotation up to, and possibly exceeding, 360° per second. This induces transient accelerations in the region of 8g. The ‘tumble’ can result in the failure of the wing and publically available recorded images show that, once the wing has failed, the microlight can assume a spinning motion akin to a falling sycamore leaf. A comprehensive explanation of the microlight tumble is set out in a paper, ‘Towards the Tumble Resistant Microlight’, by Dr Guy Gratton and Dr Simon Newman2. Survivability The pilot was properly dressed for the flight with a weatherproof flying suit, boots, gloves and protective helmet. During the impact with the ground he received serous leg injuries but no life threatening other injuries. The arrival on the large agricultural bale with its energy absorbing qualities was probably the main element that made this a survivable accident. Information from the pilot The pilot did not recall performing a manoeuvre which might have resulted in overstressing and folding of the wing structure as was observed. He commented that he always respects the limitations contained within an aircraft’s Pilot’s Operating Handbook. Analysis Given the evidence of those who saw the final moments of the aircraft, it appeared that it either entered a whip stall or carried out a rapid turn. After this, the aircraft possibly tumbled or the wings were overstressed in the manoeuvre. Whatever the initiating event, the wings folded and this caused the microlight to adopt a spinning motion akin to a sycamore leaf. No explanation of the entry manoeuvre was positively identified – and the pilot’s comments suggested that extreme manoeuvring would have been out of character – but, at some point, wing loading was clearly excessive. Footnote 1 The whip stall is caused by an aggressive entry at a high deceleration rate to the aerodynamic stall, followed by an equally aggressive recovery initiation by the pilot, pulling back the control bar rapidly. 2 Available: https://eprints.soton.ac.uk/43858/1/GrattonNewman_TumbleResistance.pdf

107 © Crown copyright 2017 AAIB Bulletin: 12/2017 G-MZDH EW/G2016/08/10 Conclusion The microlight entered an irrecoverable spinning flightpath probably due to some manoeuvre that induced overstressing and failure of the wing structure.

FD06608 ｜ 2017_英国_aaib-investigation-to-pioneer-300-hawk-g-cfue__Pioneer_300_Hawk_G-CFUE_05-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

39 © Crown copyright 2017 AAIB Bulletin: 5/2017 G-CFUE EW/G2017/01/02 ACCIDENT Aircraft Type and Registration: Pioneer 300 Hawk, G-CFUE No & Type of Engines: 1 Rotax 912 ULS piston engine Year of Manufacture: 2009 (Serial no: LAA 330A-14867) Date & Time (UTC): 8 January 2017 at 1300 hrs Location: Westonzoyland Airfield, Somerset Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Nosewheel detached, damage to propeller and aircraft structure Commander’s Licence: Private Pilot’s Licence Commander’s Age: 51 years Commander’s Flying Experience: 568 hours (of which 156 were on type)

Last 90 days - 4 hours

Last 28 days - 1 hour Information Source: Aircraft Accident Report Form submitted by the pilot and information from the Light Aircraft Association On returning to the airfield after a short local flight, the aircraft floated before settling onto the main landing gear. Upon lowering the nose, the pilot reported that there was a “bang and the aircraft felt unstable”. The aircraft dropped onto its nose and the propeller broke when it struck the ground. The aircraft slid to a halt and the pilot, who was uninjured, exited normally. Examination by the Light Aircraft Association (LAA) established that the nosewheel and fork assembly had separated due to overload. The nose landing gear overcentre mechanism was found to be locked and the firewall had been distorted rearwards by the forces imparted during the accident. The nature of the damage indicated that the nose gear had experienced heavy loads during the landing, possibly associated with ‘wheelbarrowing’. The LAA have undertaken a review of recent Pioneer 300 landing gear incidents and a precis of their findings is presented in a ‘Safety Spot’ article within their March 2017 ‘Light Aviation’ publication.

FD06609 ｜ 2017_英国_aaib-investigation-to-piper-pa-28-161-cherokee-warrior-ii-g-bnsz__Piper_PA-28-161_Cherokee.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Experience: 56 hours (of which 42 were on type)

Last 90 days - 5 hours

Last 28 days - 3 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis Whilst the pilot was turning the propeller by hand, it suddenly spun over approximately five revolutions, striking him on his right elbow and causing a small injury. History of the flight The pilot and passengers boarded the aircraft with the intention of carrying out a local flight. After following the checklist to start the engine, including priming the fuel system, the engine did not turn over when the key was rotated to the start position. Two further attempts were made, with the same result. The pilot secured the aircraft by closing the throttle, turning the fuel and electrics off and removing the keys. He then exited the aircraft and attempted to turn the propeller by hand in order check if the engine had seized. He noticed that it was indeed stiff; he applied more force and the propeller suddenly started to spin, with the engine turning over a maximum of five revolutions. He jumped backwards, instinctively raising his arm above his head, but the propeller struck his right elbow, causing a small (5 mm) puncture wound, with associated swelling and bruising. There was no long term damage. Comment The pilot subsequently stated that the engine had already been primed with fuel from a previously failed start attempt and that he considered that fuel in the cylinders may have detonated when he turned the propeller, causing the engine to ‘run’ for a few revolutions.

ropeller - see the report on G-MYUB in this issue.

FD06610 ｜ 2017_英国_aaib-investigation-to-silence-twister-g-twss__Silence_Twister_G-TWSS_06-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

56 © Crown copyright 2017 AAIB Bulletin: 6/2017 G-TWSS EW/G2016/06/27 ACCIDENT Aircraft Type and Registration: Silence Twister, G-TWSS No & Type of Engines: 1 Jabiru 2200A piston engine Year of Manufacture: 2008 (Serial no: PFA 329-14608) Date & Time (UTC): 5 June 2016 at 1800 hrs Location: Wing Farm Airstrip, Warminster, Wiltshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Fire damage to engine and engine bay Commander’s Licence: Private Pilot’s Licence Commander’s Age: 53 years Commander’s Flying Experience: 2,250 hours (of which 42 were on type)

Last 90 days - 43 hours

Last 28 days - 14 hours Information Source: Aircraft Accident Report Form submitted by the pilot During an attempt to start the engine, and after about 5 seconds of cranking, smoke appeared above the engine cowling. The pilot turned off the fuel and fuel pump while continuing to crank. He then turned off the electrics and ran to a hangar to get a fire extinguisher. He returned to the aircraft about 20 seconds later and was able to extinguish the fire (Figure 1). The fault was traced to a sticking float inside the carburettor. Figure 1 G-TWSS after the fire was extinguished

FD06611 ｜ 2017_英国_aaib-investigation-to-slingsby-t67m-mkii-firefly-g-bnsp__Slingsby_T67M_MkII_Firefly_G-BNSP.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

114 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BNSP EW/G2017/04/07 ACCIDENT Aircraft Type and Registration: Slingsby T67M MkII Firefly, G-BNSP No & Type of Engines: 1 Lycoming AEIO-320-D1B piston engine Year of Manufacture: 1987 (Serial no: 2044) Date & Time (UTC): 17 April 2017 at 1225 hrs Location: Turweston Aerodrome, Northamptonshire Type of Flight: Private

Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Axle, nosewheel and fittings fell apart, nose landing gear fork bent Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 53 years Commander’s Flying Experience: 9,745 hours (of which 186 were on type)

Last 90 days - 126 hours

Last 28 days - 47 hours Information Source: Aircraft Accident Report Form submitted by the pilot and inquiries made by the AAIB Synopsis The aircraft had landed at Turweston Aerodrome and had slowed to a walking pace on the runway. The pilot was given permission to backtrack and commenced a 180° turn. Halfway through the turn the pilot suddenly felt the nose drop and the aircraft came to an abrupt stop. He made the aircraft safe, vacated the cockpit and found that the nosewheel axle had migrated out, allowing the wheel to be released from the nose landing gear fork. The retaining nut, meant to hold the axle in place, could not be found. It is not known exactly when or why the nut had detached. History of the flight The pilot planned to carry out a local flight with aerobatics and circuits to test, and capture footage on a head-mounted action video camera. He carried out a pre-flight check and noticed nothing unusual with the aircraft or its landing gear. The taxi and takeoff were normal and the pilot carried out his flight as planned. He returned to the airfield, joined the circuit and landed. Just after touchdown he gently applied the brakes and noted a small amount of left and right movement. This he considered normal and put it down to uneven pedal foot pressure during initial application. Otherwise the rollout was unremarkable. The pilot had slowed the aircraft to a walking pace, was given permission to backtrack and started a slow 180° turn. Halfway through the turn, without warning, the nose dropped and

115 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BNSP EW/G2017/04/07 the aircraft came to an abrupt halt. He made the aircraft safe and vacated the cockpit. He then examined the aircraft and found the nosewheel had detached from its fork and was lying close by on the runway. Engineering investigation Examination of the nosewheel and fork assembly found that the axle had migrated out and allowed the wheel to be released from its fork. The ‘K-nut1’ meant to secure the axle was not found. The aircraft had recently undergone its annual service which was when the nosewheel was last disturbed. The aircraft had accrued 16 flying hours since that check. Analysis The AMM (Aircraft Maintenance Manual) is not specific regarding the fitting of the nosewheel. It merely states the wheel should be offered up to the nosewheel fork, aligned with the bolt holes, the greased bolt and spacers inserted and then secured with a washer and lock nut. It is possible that the orientation of the axle and the condition of the K-nut may have been contributory factors. In this case the evidence suggests the axle was fitted from the left side of the fork resulting in a tendency, with nosewheel rotation, to apply a slight undoing torque. In addition, if the K-nut is worn, with a reduced run-down torque, its locking ability will be compromised. The presence of grease on the axle bolt may also have been a factor. In combination these factors can lead to an unsafe condition. Anecdotal evidence suggests that there have been a problems in the past on other T67 aircraft, whereby, for no apparent reason, the K-nut has loosened and detached. However, there is no mandatory occurrence report (MOR) data to support this. In addition, there are no reports to the Type Certificate holder that would indicate any tendency for the nut to detach. However, during this investigation it became apparent that other operators and maintenance organisations had taken action to address this problem and had introduced a safety split pin outboard of the K-nut. An example is shown in Figure 1. Footnote 1 K-nut is a hexagonal threaded nut made using the minimum material. It has a flange on its lower face and is purposely distorted on its upper face to create a tightness in the thread in order to self-lock the nut when fitted to a threaded fastener. The locking ability of the nut is assessed by its run-down torque, however this can be affected by thread condition or the presence of a contaminant.

116 © Crown copyright 2017 AAIB Bulletin: 9/2017 G-BNSP EW/G2017/04/07 Figure 1 Safety split pin outboard of the K-nut Research carried out by the Type Certificate holder has found that T67 Firefly aircraft were originally fitted with SAB nose landing gear but later, during production, this was changed to a Fairey Hydraulics landing gear assembly under Slingsby modification (mod) 468. The Fairey landing gear axle was later improved by the introduction of a tab washer to lock the axle nut under an additional modification (mod 646). Conclusion Although it is not known exactly why the nut loosened and fell off, the recency of the maintenance activity on the nosewheel and fork assembly, along with the presence of grease or possibly a worn K-nut, are possible causal factors of this incident. Safety action The Type Certificate holder has carried out its own assessment of this incident and is considering an additional modification to introduce improved positive locking of the axle assembly. Their intention is to issue a Service Bulletin (SB) and will discuss with the CAA whether it should be mandated by an Airworthiness Directive (AD).

FD06612 ｜ 2017_英国_aaib-investigation-to-socata-tb10-tobago-g-mrtn__Socata_TB10_Tobago_G-MRTN_03-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

26 © Crown copyright 2017 AAIB Bulletin: 3/2017 G-MRTN EW/G2016/08/26 ACCIDENT Aircraft Type and Registration: Socata TB10 Tobago, G-MRTN No & Type of Engines: 1 Lycoming O-360-A1AD piston engine Year of Manufacture: 1980 (Serial no: 62) Date & Time (UTC): 27 August 2016 at 1500 hrs Location: Approximately 1 km east of Henstridge Airfield, Somerset Type of Flight: Private Persons on Board: Crew - 1 Passengers - 3 Injuries: Crew - None Passengers - None Nature of Damage: Fire damage to the engine bay and lower fuselage Commander’s Licence: Private Pilot’s Licence Commander’s Age: 44 years Commander’s Flying Experience: 1,147 hours (of which 50 were on type)

Last 90 days - 71 hours

Last 28 days - 24 hours Information Source: Aircraft Accident Report Form submitted by the pilot The pilot reported that the power checks were normal; however the takeoff roll was a little longer than expected and the rate of climb was less than 400 ft/min, so the decision was made to return to the airfield. A smell of burning was then noticed in the cockpit, with white smoke emanating from the cowling. At around 500 ft agl, the engine started to lose power and the smoke increased in intensity. The pilot made a MAYDAY call, switched the fuel off and completed a successful forced landing in a field. The occupants exited through the two doors, and the pilot returned to the aircraft and used a fire extinguisher to fight the flames in the engine bay. The pilot believes that the exhaust had become detached and the hot gases had started a fire in the engine bay, which also caused damage to the lower fuselage. The pilot had an instructor rating and hence had good recency in practice forced landings. This, and the fairly low height when the fire started, were probably factors that resulted in a successful forced landing.

FD06613 ｜ 2017_英国_aaib-investigation-to-taylor-monoplane-g-beyw__Taylor_Monoplane_G-BEYW_10-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

90 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-BEYW EW/G2016/08/09 ACCIDENT Aircraft Type and Registration: Taylor Monoplane, G-BEYW No & Type of Engines: 1 Volkswagen 1834 piston engine Year of Manufacture: 1984 (Serial no: PFA 055-10279) Date & Time (UTC): 15 August 2016 at 1201 hrs Location: Manchester Barton Airport Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 (Serious) Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: Not established Commander’s Age: Not established Commander’s Flying Experience: Not established

Information Source: AAIB enquiries Synopsis The aircraft collided with trees while the pilot was attempting to execute a forced landing in a field outside the airport boundary, following a loss of engine power during takeoff. The pilot suffered serious injuries in the accident. The reason for the loss of power was not established. History of the flight Witnesses reported that the aircraft engine seemed to lose power at about 100 ft while taking off from Runway 08R at Manchester Barton Airport. The pilot attempted to execute a forced landing, turning slightly left from the runway heading to avoid a built-up area. However, the aircraft collided with trees during the final stages of the approach to a field and crashed in a wooded area, just outside the airport perimeter fence. The aircraft became lodged in the trees, trapping the pilot who required assistance from firefighters to exit the wreckage. The pilot sustained serious but not life-threatening injuries in the accident, but his health subsequently deteriorated after suffering post-operative complications. The aircraft was destroyed in the impact. A video recording of the takeoff showed the aircraft initially climb and then descend and level off, before continuing a shallow climb and turning left towards trees as it reached the end of the runway. The video ended as the aircraft was turning left from the runway heading, at which point the engine tone was still audible on the recording. At the time of the accident the aircraft was undergoing an annual test flight for the renewal of the Certificate of Validity for its Permit to Fly. The flight had been logged with Air Traffic

91 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-BEYW EW/G2016/08/09 Control as a test flight. As the previous Certificate of Validity had expired, the aircraft was being flown under a Permit Flight Release Certificate which had been ‘signed off’ by an LAA Inspector. The LAA Inspector reported that pilot was in good spirits prior to the flight. Prior to the test flight the pilot had undertaken some maintenance on the aircraft’s engine. This included removal of the four cylinder heads in order to re-seal the pushrod tubes. This work had been inspected by the LAA Inspector and engine ground runs had been conducted, before authorising the test flight.  The pilot had originally planned to conduct the test flight a few days prior to the accident flight. However, he had instead spent that day carrying out maintenance on the aircraft and conducting multiple ground runs and fast taxi tests. Personnel at the airfield were aware that the pilot had been experiencing engine problems with the aircraft. The pilot had not informed, nor sought assistance from, his LAA Inspector when it became apparent that the engine was not performing well. Aircraft and engine examination The engine and firewall had detached from the aircraft during the impact. The fibreglass fuel tank had also detached from the airframe and been ruptured. The engine and fuel system were subsequently moved to a workshop for examination by the LAA Inspector. During this examination it was noted that both wooden propeller blades had broken off at the hub, indicating that the engine had been developing at least some power at impact. After removing some components that had been damaged during the impact, the engine rotated freely, exhibiting good compression on all cylinders and valve operation was observed to be normal. No anomalies were noted with the spark plugs, ignition timing or operation of the magnetos, when tested. The carburettor float chamber was clean and free from contamination, but contained no trace of fuel. The float valve operated normally, no inlet restrictions were noted and the carburettor jets were free from blockage. The LAA Inspector considered that the locking wire on the carburettor fuel inlet may have been altered. During the recent inspection for issue of the Permit to Fly the wire locking on the carburettor had been replaced by a professional, and its appearance post-accident was not consistent with this. When the engine had been moved to the workshop, a large amount of oil was released from the crankcase breather, which suggested that the engine may have lain upside down at some point following the accident, possibly accounting for the lack of fuel in the carburettor. There was no fuel remaining in the fuel tank, any fuel having likely leaked out due to the damage sustained in the accident. There were no other anomalies observed with the various components of the fuel system and the fuel pump operated satisfactorily when tested. Discussion Witness evidence indicated that the aircraft’s engine had not been performing well in the days prior to the accident flight; however, the pilot did not discuss these issues with his LAA

92 © Crown copyright 2017 AAIB Bulletin: 10/2017 G-BEYW EW/G2016/08/09 Inspector prior to conducting the test flight. It was not established what maintenance activity had recently been performed on the engine by the pilot, however there was some evidence that the maintenance activity may have involved accessing the carburettor fuel inlet. The pilot was not able to assist the AAIB with its enquiries. A post-accident examination of the engine and fuel system by an LAA Inspector did not reveal any anomalies which could have accounted for the loss of power during takeoff. Carburettor icing or fuel vaporisation, which can occur when using MoGAS, could not be ruled out.

FD06614 ｜ 2017_英国_aaib-investigation-to-vans-rv-8-g-chpk__Vans_RV-8_G-CHPK_06-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

57 © Crown copyright 2017 AAIB Bulletin: 6/2017 G-CHPK EW/G2017/02/09 ACCIDENT Aircraft Type and Registration: Vans RV-8, G-CHPK No & Type of Engines: 1 Lycoming YIO-360-M1B piston engine Year of Manufacture: 2014 (Serial no: PFA 303-14535) Date & Time (UTC): 24 February 2017 at 1400 hrs Location: On approach to Bidford Airfield, Warwickshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Engine shock-loaded, propeller, spats and firewall damaged Commander’s Licence: Private Pilot’s Licence Commander’s Age: 65 years Commander’s Flying Experience: 4,000 hours (of which 20 were on type)

Last 90 days - 18 hours

Last 28 days - 2 hours Information Source: Aircraft Accident Report Form submitted by the pilot The pilot reported that the takeoff was normal but at a height of approximately 1,500 ft he detected some mild vibration from the engine and decided to return to the airfield. During the downwind leg for a landing on Runway 24 he noted that the exhaust gas temperature (EGT) for the number 4 cylinder was very low at 150ºF. This was lower than the EGT on the other three cylinders, which all read 1,500ºF. The pilot conducted a glide approach using sideslip to control his height. However, during the flare and landing the sun was in his eyes and he lost his visual references, with the result that the aircraft ran off the side of the runway into a ploughed field and tipped onto its nose. Both occupants were uninjured, but the aircraft sustained damage to the propeller, firewall, and wheel spats.

FD06615 ｜ 2017_英国_aaib-investigation-to-yak-52-g-yakb__Yak-52_G-YAKB_11-17.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

38 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 ACCIDENT Aircraft Type and Registration: Yak-52, G-YAKB No & Type of Engines: 1 Ivchenko Vedeneyev M-14P radial piston engine Year of Manufacture: 1992 (Serial no: 9211517) Date & Time (UTC): 8 July 2016 at 0934 hrs Location: 1 nm north of Dinton, Wiltshire Type of Flight: Aerial work Persons on Board: Crew - 2 Passengers - None Injuries: Crew - 1 (Fatal) Passengers - N/A

1 (Serious) Nature of Damage: Aircraft destroyed Commander’s Licence: Commercial Pilot’s Licence Commander’s Age: 60 years Commander’s Flying Experience: 2,953 hours (of which 446 were on type)

Last 90 days - 18 hours

Last 28 days - 15 hours Information Source: AAIB Field Investigation Synopsis The aircraft was conducting a flight for a test pilots’ school. The commander, a civilian flight instructor, was in the rear seat and a tutor from the school occupied the front seat. Shortly after completing a series of aerobatic manoeuvres, the engine lost power without warning. Attempts to restore power were unsuccessful and, at about 1,100 ft agl, the commander committed to a forced landing in a field. Evidence showed that the pilots probably became aware of a farm strip late in the approach to the intended field and made an attempt to land on the strip. The forced landing was unsuccessful and the aircraft struck the ground in a steeply left banked attitude at the southern edge of the strip. The tutor was fatally injured and the commander sustained serious injuries. The cause of the loss of engine power was not determined, but the reported symptoms were indicative of a fuel system problem. One Safety Recommendation is made concerning the maintenance of seat belts and harnesses.

39 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 Background information The aircraft was operating under a contract with a test pilots’ school at Boscombe Down (BD), Wiltshire. The work was sub-contracted to a Flying Training Organisation (FTO). The FTO had further sub-contracted the work to the aircraft’s commander, a civilian flight instructor, who was experienced on the Yak-52. The aircraft was being employed for a Qualitative Evaluation (QE). This is part of the Test Pilots’ course where different aircraft types are brought to BD, under contract, for short‑term use. This gives the test pilot students and flight test engineer students experience of multiple aircraft types and the opportunity to fly a test scenario with a ‘safety pilot’ (the aircraft’s commander). The Yak-52 was used to expose the students to an Eastern European aircraft. There was also a requirement for ‘tutors’1 from the school to experience flying the aircraft type. The Yak-52’s commander had participated in QEs, with a Yak-52, annually since 2010. He occupied the rear seat when flying with test pilot students and the front seat when flying with flight test engineer students. On Sunday 3 July 2016, G-YAKB was flown from its base to BD by the commander with the exercise tutor who had organised the QE. The following day the commander and exercise tutor flew a flight profile similar to a QE, prior to the commander flying with the students. This was to demonstrate to the commander BD’s local procedures and a QE sortie profile. The flight did not include any simulated emergencies. Later that day the commander also gave a 90-minute Technical and Safety Briefing on operating the aircraft, which included a cockpit familiarisation, to all the students and the exercise tutor. This briefing was deemed mandatory for any tutor intending to fly the Yak-52. The front seat pilot (FSP) on the accident flight, who was a tutor and a Royal Air Force (RAF) pilot, was not present at the briefing. The AAIB investigation into this accident was conducted in parallel to, but independently of, a military Service Inquiry (SI) investigation. The SI investigation was launched because of the death in service of an RAF pilot. The SI investigation focussed more on the organisational and operational aspects of the test pilots’ school and its oversight by the Ministry of Defence. The SI investigation report was published by the Defence Safety Authority on 15 June 20172. Footnote 1 Test Pilot instructors at the school are called tutors. 2 https://www.gov.uk/government/publications/service-inquiry-into-the-aircraft-accident-involving-yak52-g- yakb-on-8-july-2016

40 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 History of the flight This section was compiled using a combination of radar data, BD ATC radio recordings, witness statements and the commander’s own recollection. Prior to the flight The FSP had originally been scheduled to fly in the Yak-52 late in the morning of the accident, after a student. However, the student was unfit to fly and so the FSP’s flight was rescheduled to be the first flight of the day. On the day of the accident the commander and FSP were described as being “bright and breezy” when they arrived at the school, with the FSP looking forward to the flight, not having flown the aircraft type before. The pilots were seen briefly in discussion before a meteorological brief and again afterwards, for about 15 minutes, prior to being “out-briefed” by the supervisor for the flight. The aircraft had been kept overnight in a hangar; upon arrival, the pilots helped push the aircraft out onto the apron. The assisting engineer commented that they appeared rushed. The aircraft was then refuelled to about 1 cm below the brim, with a fuel uplift of 53 litres being recorded in the fuel bowser logbook. The accident flight After an uneventful start up and taxi out, the aircraft took off from Runway 23 at 0915 hrs3, departing to the west of BD and climbing initially to about 5,200 ft amsl. It completed some aerobatic manoeuvres, between 3,400 ft and 5,200 ft amsl, some of which involved inverted flight, which the commander believed4 were flown by the FSP. The pilots remained on the BD ATC Approach frequency throughout the flight. The commander stated that after completing these manoeuvres, when the aircraft was at about 4,000 ft amsl and in a slow descent, the engine lost power without warning. The propeller continued to windmill. During this time the commander exercised the throttle, but this had no effect. He then returned the throttle to approximately its original position, which he believed was about 70% rpm. On checking the engine instruments he noted that the fuel pressure indication was zero. Believing that there may be a stuck “flapper valve” in the fuel lines, the commander took control and flew some high g turns to try to release the valves, but to no avail. On the assumption that the engine-driven fuel pump had failed, the commander instructed the FSP to turn the fuel primer handle5 to the left position and pump it in a bid to restart the engine6. He initially observed him doing so and recalled that the FSP was pumping at a rate of about once every 3 to 4 seconds. With each pump the engine started and Footnote 3 All times in this report are UTC. 4 The commander had an incomplete recollection of events during the flight. 5 See Fuel system description for a detailed description of the fuel system. 6 See Yak-52 emergency procedures below for the engine failure in flight checklist.

41 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 accelerated momentarily, with associated power, before stopping again. The commander observed the fuel pressure increasing with each pump of the primer. During each restart attempt the engine sounded normal, with no additional noises that might have indicated a mechanical problem. The commander continued to fly the aircraft while the FSP pumped the fuel primer handle and made radio transmissions to BD ATC when required. At 0930:32 hrs the FSP transmitted a MAYDAY stating “we have a major major malfunction”, before requesting radar vectors to return to the airfield. ATC acknowledged this and advised the aircraft to turn onto a heading of 090° M. Shortly thereafter, ATC asked the aircraft to squawk the transponder emergency code of 7700, to which the FSP replied “unable”. At 0931:30 hrs, the FSP asked ATC for a range from BD; they replied 12 nm. At 0932:06 hrs, the FSP radioed that they were visual with the ground and “…probably going to be er pfl’ing [practice forced landing] to a field er west of Boscombe”. At this point the aircraft was at 3,100 ft amsl (about 2,650 ft agl) and 10.5 nm from BD. ATC then transmitted the surface wind at BD, which was from 230° at 14 kt; this was acknowledged by the FSP. The commander stated that at this point he had elected to continue towards BD, in case the engine recovered, while the FSP continued to pump the primer handle. The aircraft continued to descend throughout this time. Shortly thereafter, ATC informed the crew that the aircraft’s range was 9 nm. Realising that the aircraft would not be able to reach BD, at 0933:29 hrs, at an altitude of 1,475 ft amsl (approximately 1,100 ft agl), the FSP transmitted “golf kilo bravo is may [sic] pfl’ing to a field just to the west of Boscombe [slight pause] er will phone you on the ground.” This was the last transmission received by ATC. Figure 1 shows the radar track of the flight. Figure 1 Radar plot of the flight (Clee Hill radar data) Having decided to perform a forced landing, a large wheat field was identified and an approach to it established. During the approach a farm strip came into view and the commander had an “incomplete memory” that one of them had declared “there is an airstrip there”, which was ahead and to the left. He stated that it would have been his

42 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 decision to try to land on the strip as opposed to the chosen field. Figure 2 shows the relative positions of the final radar points and the accident site. Figure 2 Final radar points (Clee Hill radar data) The commander could not recall in which direction the aircraft turned after the last radar position, nor whether it was positioned to the north or south of the strip. The attempt to land on the strip was unsuccessful and the aircraft struck the ground on the southern edge of the farm strip with its left wingtip, in a steeply banked attitude. The front of the fuselage broke up during the ground impact and the FSP was thrown clear of the aircraft. A BD-based helicopter was operating in the vicinity around the time of the accident. On hearing the FSP’s last transmission, the helicopter commander informed ATC that they were able to offer assistance and the helicopter was directed towards the aircraft’s last radar position. Once visual with the Yak-52 on the ground, the helicopter landed close by and one of its pilots went to offer assistance to the Yak pilots. The FSP was lying unresponsive, close to the aircraft, and the commander, who was seriously injured, was in the rear seat. The helicopter pilot stated that the Yak-52 commander said to him “there was a landing strip wasn’t there?” and that they came in steeply and he had to level off. Another BD helicopter subsequently arrived, followed by two air ambulances and a Search and Rescue helicopter. Soon after, two local police officers (who attempted to resuscitate the FSP), the Rescue and Fire Fighting Services (RFFS) from BD and the local authority

43 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 arrived at the accident site, as did an ambulance. The FSP was subsequently pronounced deceased at the scene. The commander was flown to hospital by air ambulance. Eyewitness account At about 0930 hrs, an eyewitness about 3 nm west of the accident site saw an aircraft just to the north, travelling in an easterly direction, on a constant heading. He stated that the aircraft was about 1,000 to 1,500 ft agl, above some low cloud. The engine sounded as though it was faltering; it then died completely before restarting again for a period of 4 to 5 seconds at high power. It then faltered again and stopped. The witness did not hear the engine start again. He was visual with the aircraft throughout this time. It then disappeared from his view because of cloud cover and some large trees. Accident site The aircraft wreckage was located in a wheat field on the southern edge of a private farm strip, 1 nm north of Dinton, at an elevation of 436 ft amsl (Figure 3). The private strip was not shown on any aeronautical chart or in any airfield guide and, according to its owner, was not easily visible from the air. The strip was 473 m long, 20 m wide and orientated in the direction 080°(M). Figure 3 Aerial view of accident site (looking north) and private farm strip (Photograph courtesy QinetiQ) The ground impact marks showed that the aircraft had struck the ground left wingtip first, in a steep left bank; this was followed by a heavy nose impact (Figure 4). The aircraft had then bounced backwards, probably striking its tail, before bouncing again into the location where it was found, resting upright, 35 m from the initial impact point.

44 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 Figure 4 Aerial view of accident site (North up) Recorded information Final flight path Radar data for the accident flight was recorded by various radar stations. The final secondary radar return, recorded at 0933:30 hrs by the Clee Hill radar (Figure 5), placed the aircraft on a bearing of about 025° from the accident site. At this point the aircraft was at 1,475 ft amsl7 (1,100 ft agl) and approximately 0.32 nm (590 m) from the accident location. The last RT transmission was almost coincident with the final radar point. For the segment between 2,600 ft amsl and the final radar point, the average ground speed was 108 kt and the estimated average airspeed of the aircraft was 90 kt (167 km/hr), based on a wind from 264° at 18 kt8. Footnote 7 This altitude was derived from Mode S transponder data which is transmitted in 25 ft increments. 8 Derived from the Met Office information obtained from a weather balloon released at 0900 hrs from Larkhill, about 9 nm north-east of the accident site.

45 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01

Figure 5 Accident flight radar data from the Clee Hill radar Commander’s comments The commander was visited by the AAIB in hospital eight weeks after the accident and interviewed 12 weeks after the accident. The commander stated that as the forward visibility from the rear cockpit was “very poor” he briefed some FSPs that, during a forced landing into a field, he would hand over control to them at an appropriate time, dependent on the situation, for them to do the landing. He had no recollection of who had control for the accident landing, though it is possible he handed control to the FSP. If this was the case, he believed he would have done so when the aircraft was straight on the final approach. He also said that the rpm gauges in both cockpits were intermittently serviceable during the QE week. Although the rate of pumping of the primer handle did not allow the aircraft to maintain height, he did not ask the FSP to pump faster. The commander could not recall whether the FSP ceased pumping once the wheat field had been chosen for the landing. Additionally, he had no recollection of the wind at BD, or if ATC had transmitted it after the MAYDAY was declared. He also had no recollection of what he had said to the helicopter commander after the accident.

46 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 Pilots’ experience and qualifications Commander The commander held a current Flying Instructor rating and a Display Authorisation. He first flew the Yak-52 in March 2005, achieving a total of 446 hours on type at the time of the accident. He stated that about 80% of his Yak-52 hours were in the front seat, as the majority of his flying was competing in aerobatic competitions and display flying. Prior to the 2016 QE, the pilot had last flown the Yak-52 on 16 March 2016, for one hour. His most recent logged experience in the Yak-52 prior to this was in July 2015, during the 2015 QE. The commander had completed three successful forced landings in Yak-52s following previous engine failures. All of these had ended with the aircraft landing on a grass strip or an airfield, with the landing gear extended. He had landed the aircraft from the front seat on all three occasions. He had demonstrated PFLs onto an airfield from the rear seat when instructing on the Yak-52, but had not performed an actual forced landing from the rear seat. The commander stated that he would normally conduct an off-airfield PFL to a minimum height of 500 ft agl and his target speed for forced landings in a Yak-52 was 180 km hr (97 kt). While this is greater than the published best glide speed of 160 km hr, he felt it was better to fly faster as it gave him more flexibility. The commander had last supervised and/or demonstrated a PFL in a Yak-52, from the rear seat, during an instructional sortie on 16 March 2016. Front seat pilot The FSP was a qualified service pilot, test pilot and Qualified Flying Instructor. He also held a current ATPL (A) with Single Engine Piston (SEP) (Land) and Flight Instructor Ratings. He had a total of 5,773 military flying hours and 518 civilian flying hours. He had flown 62 hours in the preceding 90 days and 17 hours in the preceding 28 days. His civilian logbook indicated that he last supervised and/or demonstrated a PFL on 5 June 2016 in a Diamond DA40 D, a SEP aircraft with side-by-side seating. He had not flown the Yak-52 prior to the accident flight. Test pilot students’ comments The AAIB interviewed several of the test pilot students and engineers who flew in the aircraft before the accident. They stated that the front and rear cockpit rpm gauges did not work, or did not work properly, and communications via the intercom and radio were of a poor quality. One added that the heading and attitude indicators in the rear cockpit were not working, the former of which was unserviceable before the QE commenced. The extent of the emergencies brief given by the commander, before each flight, varied from, “if anything went wrong, he would take control and deal with the emergency” to “he

47 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 specifically mentioned actions to be taken by the student in case of engine malfunctions that could not be performed by the pilot in the back seat”. Another stated that the commander also talked about what the controls did and what the gauges showed, mentioning that the rpm gauge did not work properly. Others could not recall what was said. Two of the test pilot students stated that they recalled performing all of the landings (about two to three each) from the front seat at BD and the commander did none from the rear. Meteorology An aftercast provided by the Met Office stated that there was a slow-moving cold front lying over the area of the accident, moving south-east. Surface observations from Larkhill9 and METARs from MoD Boscombe Down10 reported broken stratus cloud between 600 and 900 ft agl at first, with bases lifting and cloud thinning later. A radiosonde balloon released from Larkhill at 0900 hrs provided full details of the wind direction and speeds through the lower atmosphere. Table 1 shows some of the balloon’s recorded wind data: Wind direction and speed (kt) Height of reading (GPS) 240°/10 133 m/436 ft 261°/16 471 m/1,545 ft 266°/19 604 m/1,980 ft 270°/24 793 m/2,602 ft Table 1 Recorded wind data Medical and pathological information The FSP’s post-mortem examination was carried out by a consultant histopathologist. Of note, he had serious head and facial injuries and fractures in his arms and hands, with his right hand more severely injured than his left. Additionally, he had serious injuries to the lower part of his legs. Toxicological analysis of blood samples detected two antihistamine drugs which are used for the treatment of allergies such as hay fever. The levels indicated a previous, but not recent use. It was likely that this drug was taken at least 36 to 48 hours earlier and should not have had any detrimental effect on the FSP’s ability to fly the aircraft. Tests for alcohol were negative. Footnote 9 Larkhill is about 433 ft amsl and 9 nm north-east of the accident site. 10 Boscombe Down Airfield is 407 ft amsl.

48 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 The post-mortem report concluded that he had died as a result of multiple traumatic injuries resulting from the accident. Operational information Permit to Fly G-YAKB did not have a Certificate of Airworthiness but was operating on a Permit to Fly (PTF). The rules under which it must operate are in CAP 393, Air Navigation: The Order and Regulations (ANO). The extant version, published in 2015, stated: ‘23 Limitations of national permits to fly (1) Subject to paragraph (3), an aircraft flying in accordance with a national permit to fly must not fly for the purpose of: … (c) aerial work other than aerial work which consists of flights for the purpose of flying displays, associated practice, test and positioning flights or the exhibition or demonstration of the aircraft11. (2) No person may be carried during flights for the purpose of flying displays or demonstration flying (except for the minimum required flight crew12), unless the prior permission of the CAA has been obtained. (3) An aircraft flying in accordance with a national permit to fly may fly for the purpose of aerial work which consists of instruction or testing in a club environment if it does so with the permission of the CAA. …’ The commander stated that he believed the aircraft was performing aerial work at the test pilots’ school by way of demonstration flights, not instructional flights. He added that while he had not read the ANO he had been told it was acceptable to do demonstration flights in an aircraft with a PTF. Given this, and the fact that the flights were for the school, he believed this was appropriate. The FTO that had sub-contracted the pilot stated that they did not believe approval to do aerial work was required from the CAA. This was because they believed an aircraft on a PTF could do aerial work for the purpose of demonstration and exhibition flying. The test pilots’ school stated that they thought the aircraft had a Certificate of Airworthiness and were not aware that the aircraft was operating on a PTF. The CAA stated that they had not had any applications for a Yak-52 to do aerial work or to carry any additional persons while conducting a demonstration flight. Footnote 11 The terms ‘demonstration’ and ‘exhibition’ were not specifically defined in the ANO. 12 G-YAKB’s PTF states that the minimum flight crew is one pilot.

49 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 Yak-52 emergency procedures The CAA stated that they do not approve a flight manual/pilot’s notes for aircraft operating on a PTF. However, a checklist could be created from the information in a flight manual accepted by the CAA as appropriate for that aircraft and the relevant limitations/conditions to enable the safe operation of the aircraft would be stated on its PTF. The emergency procedures in the flight manual accepted by the CAA were comparable to the ones from the YAK-52 manufacturer’s flight manual quoted below. The commander provided the AAIB investigation with a checklist. He stated that there was not one in the aircraft as he had committed the aircraft’s normal and emergency procedures to memory. When he flew in the front seat he described the checks he was performing to the rear seat occupant and when in the rear seat he talked the front seat occupant through the checks. The engine failure checklist read as follows: ‘ENGINE FAILURE Establish 172 KPH Glide Retract Landing Gear Check Mags, Fuel and Pump Turn Pump to left and pump fuel pressure to .1 to .2 Attempt restart’ The YAK-52 manufacturer’s flight manual13, published in 2002, had the following emergency checklists relevant to the symptoms reported by the commander: ‘5. IN-FLIGHT EMERGENCY CASES 5.1. PILOT’S ACTIONS IN CASE OF ENGINE SHUT DOWN DURING FLIGHT …

5.1.3. If the engine stops during inverted flight:

perform a half-rolling and bring the airplane in normal flight:

set the gliding speed at 170-180 km/h:

bring the throttle lever at about one third of stroke:

bring the injection pump handle at 45º to the left and supply fuel until the fuel pressure at carburet[t]or intake is 0.1-0.2 kgf/cm2. NOTE: To make the engine start easier, it is advisable to pump fuel in the engine cylinders [right]14. Footnote 13 The original flight manual was written in Russian. The manufacturer had translated it into English. 14 Pumping fuel in the right position can assist engine start once the fuel pressure has been raised to 0.1 to 0.2 kgf/cm2 by pumping in the left position.

50 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 5.1.4. As soon as the engine starts running again, bring the throttle lever in take-off condition [full power] for 1-2 seconds, then set the required flight condition. … 5.3. PILOT’S ACTIONS IN CASE OF FUEL PRESSURE DECREASE

5.3.1. The fuel pressure decrease is signal[l]ed by:

discontinuous engine running accompanied by the deceleration of the

engine speed, the reduction of the intake pressure and trepidations;

the decrease of the fuel pressure as read on the control instruments, below allowed limits.

5.3.2. In case of fuel pressure decrease the pilot must;

report to the flight controller;

rotate the fuel pump lever 45º to the right [left]15 and start fuelling the

fuel system, checking the pressure by reading the pressure gauges;

interrupt the mission and land on the home- or auxiliary aerodrome. 5.17. SPECIAL AIRPLANE FEATURES WHEN LANDING WITH DAMAGED ENGINE 5.17.1. …In case of a forced landing on a rough or unknown ground, the landing will be performed with the undercarriage retracted. … 5.17.4 In case of emergency landing and engine failure, the pilot must perform

the following operations:

set the instrumental airspeed to 160 km/h;

…

shut the fire cock [fuel shutoff lever], switch off the magneto, the

generator, and the ignition;

determine the height of flight…and calculate the available gliding distance so as to assess the possibility of landing on the aerodrome. Another flight manual, published by a UK Yak-52 maintenance organisation in 1995, additionally stated: ‘Following an in-flight failure of the engine driven fuel pump the primer, set to CARB [left], may be used as an emergency fuel pump to maintain fuel pressure and thus enable the aircraft to be flown to the nearest diversion airfield.’ Footnote 15 The manufacturer stated that this procedure, as published, is incorrect and the pump lever should be turned to the left.

51 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 Yak-52 glide performance The YAK-52 manufacturer’s flight manual stated that after an engine failure the aircraft should be flown at 160 km/hr [86 kt], with the landing gear and the flaps retracted. The gliding range is calculated by multiplying the height by seven (a glide ratio of 7:1) and equates to approximately 1.15 nm per 1,000 ft. To ensure minimum height loss, turns should be flown with 45º angle of bank. A 360° turn, at best glide speed and with 45º angle of bank, has a radius of 200 m, a rate of descent of 8 m/s [1,575 ft/min] and a height loss of 220 m [720 ft]. A forced landing on rough or unknown ground should be carried out with the landing gear retracted, to reduce the risk of tipping over. The commander had previously flown in a PA-28, a side-by-side seat aircraft, and a Bellanca 8KCAB, a tandem seat aircraft, with the most recent flights in March 2016. Their glide ratios are about 10:1 and 12:1 respectively. Aircraft information General The Yak-52 (Figure 6) is an all-metal, two-seat, tandem, single-engine low-wing monoplane, designed by the Yakovlev Design Bureau in Russia as a basic aerobatic training aircraft and manufactured in Romania by Aerostar S.A..  The type first flew in 1978 and about 1,900 were built. Production ceased in 2010. The aircraft type never received civil or military type certification. A number of Yak-52’s and their similar single-seat version Yak-50’s were brought to the UK in the 1980’s and 1990’s and operated on the Russian or Lithuanian register. From 2002 the CAA required that all Yak’s be registered in the UK and operated under a PTF. Each aircraft brought onto the register received an Airworthiness Approval Note (AAN) listing its limitations and maintenance requirements. As of January 2017, there were 40 Yak-52’s and 20 Yak-50’s on the UK register. Figure 6 The accident aircraft G-YAKB

52 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 The Yak-52 is powered by a 360 hp nine-cylinder, single-row, air-cooled radial M-14P engine16 driving a two-bladed, variable-pitch wooden propeller via an epicyclic reduction gear.  Mounted on the rear of the engine are a pressure carburettor and an accessory gearbox.  The latter drives a single stage supercharger, a compressor, dual magnetos, a fuel pump, an oil pump, a tachometer and a generator. The fuel consumption during aerobatic flying is reportedly about 90 litres/hr, and about 10 to 12 litres/hr at idle power. According to the flight manual the maximum range fuel flow is 37.3 litres/hr at 57% engine rpm and 192 km/hr (104 kt). The electrical system is 28V DC, supplied by two batteries and the engine-driven generator.  This is primarily used to power the aircraft instruments, radio and intercom.  The flaps, landing gear and engine starting are powered by a pneumatic system fed by two air-filled pressure vessels which, in turn, are supplied by the engine-driven compressor. The flight controls are conventional, with a central stick controlling the ailerons with push‑pull rods and the elevator with cables; while pedals control the cable-operated rudder. The elevator trim is operated with a trim wheel and cable. YAK-52 cockpit instruments and controls On the left side of the front cockpit is a yellow throttle lever, alongside a propeller speed control lever (Figure 7). In front of these levers is a black fuel shutoff lever (shown red in Figure 7). The fuel shutoff lever is pulled aft to shut off the fuel in an emergency, and normally remains in the full forward position (as shown) at the end of a flight. These three control levers are replicated on the left side of the rear cockpit and each is mechanically connected to its counterpart in the front cockpit, so that the front and rear levers move in unison. The landing gear lever is on the left side of the instrument panel and has three positions: up, neutral and down. There is a manually-selected sliding safety gate on the selector to prevent the gear being selected up inadvertently on the ground. To select the landing gear down, the gear lever is pushed in and moved from up to down and the safety gate is slid to the right. The rear cockpit landing gear lever is normally left in the central neutral position, which gives priority to the front lever. The pneumatically operated landing gear can take up to 15 seconds to move to the fully locked down position. The flap lever is located aft of the throttle lever and has two positions, forward and aft to select flaps up or full down. The rear cockpit flap lever in G-YAKB was gated to render it inoperable. The levers to control the engine cowl flaps and the carburettor heat are on the right side of the front cockpit; they are not replicated in the rear cockpit. On the right side of the front instrument panel are the fuel gauge and the fuel primer handle (Figure 8). The fuel gauge uses small light bulbs to illuminate the fuel quantity in the left and right main tanks. The fuel primer handle has three positions: left, centre and right. The function of this handle is described in the fuel system section of the report. Footnote 16 The majority of M-14P engines, including the one on G-YAKB, were manufactured by the Voronezh Mechanical Plant (VMP).

53 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 Figure 7 Front cockpit controls (left side) from a different Yak-52. Fuel shutoff lever shown in the forward ‘fuel on’ position. On G-YAKB the fuel shutoff lever handle was black Figure 8 Front cockpit controls (right side) from a different Yak-52

54 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 The rear cockpit altimeter in G-YAKB was placarded inoperative, as it had failed an accuracy test. There was no manifold pressure gauge in the rear cockpit, but there was one in the front. The front and rear heading indicators had been unserviceable for some time, although both wet compasses17, on top of the instrument panel, were reportedly serviceable. The commander and some students who flew earlier in the week reported that the front and rear engine rpm gauges were not functioning correctly; they would either indicate zero, run backwards or sometimes work correctly. This did not have any effect on engine performance, but these gauges were needed for proper engine management. Students also noticed that the rear cockpit attitude indicator was not displaying a steady, usable horizon. The minimum equipment requirements for a VFR aircraft, at the time of the accident, were: an airspeed indicator, an altimeter and a compass, of which a wet compass would have been appropriate. YAK-52 fuel system description The fuel system includes two wing tanks, each of 61 litres capacity, which gravity-feed a 5.5 litre collector tank in the lower centre section of the aircraft (Figure 9). The engine‑driven fuel pump draws its fuel supply from the collector tank which provides a short-term supply of fuel for inverted flight (up to 2 minutes is permitted). There is no left/right fuel tank selector, so both tanks feed the collector tank continuously via non-return (‘flapper’) valves. The first pair of non-return valves prevent fuel from passing from one tank to the other. The third non-return valve prevents fuel from flowing from the collector tank back to the main tanks. A rubber flop-tube inside the collector tank is connected to the fuel outlet. The flop-tube is weighted at its end so that it rests at the bottom of the tank during normal flight and rests at the top of the tank during inverted or negative-g flight; this ensures that the outlet can always draw the fuel in the tank. From the collector tank the fuel passes through another non-return valve, the fuel shutoff valve, a coarse fuel filter, the engine-driven fuel pump, a compensation tank, and a fine fuel filter, before entering the pressure carburettor. The compensation tank provides a pressurised fuel reserve because the pressure carburettor does not have an integral tank. Excess fuel from the compensation tank is returned to the collector tank via a restrictor. Fuel pressure is sensed between the fine filter and the carburettor and is displayed on both front and rear cockpit gauges. The fuel shutoff valve is normally only used in the event of a fire or forced landing. Fuel downstream of the valve is sufficient to run the engine for about 1 minute at idle. There is no electric fuel boost pump as seen on many low-wing certified aircraft, so if the engine-driven fuel pump fails, the engine will suffer a complete loss of power. Later model Yak-52W and TW variants are fitted with an electric fuel boost pump. A manual primer handle, installed in the front cockpit, is used to start the engine. When turned to the left ‘System’ position (labelled ‘Manifold’ in Figure 8) and when pulled out and Footnote 17 Wet compasses requires a steady flight path in order to be read accurately.

55 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 pushed in, the plunger in the handle draws fuel from a position upstream of the collector tank, as shown in Figure 9, and pumps it into a position between the collector tank and fuel shutoff valve. This primes the fuel lines, fuel pump and carburettor for engine start. When the primer handle is turned to the right ‘Cylinder’ position and pumped, fuel is drawn from the same location but is pumped into the supercharger compressor. This provides some vapourised fuel ready to be drawn into the cylinders as soon as the engine is turned over. Figure 9 Yak-52 fuel system diagram (© Robert A. Rowe) According to an unofficial flight manual and from anecdotal evidence, the primer handle can be used in the left ‘System’ position to maintain some engine power after a fuel pump failure. However, the aircraft manufacturer does not specify a rate at which the primer handle needs to be pumped to maintain level flight.

56 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 If the primer handle is pumped in the right ‘Cylinder’ position following a fuel-related loss of power, then unmetered fuel would be pumped into the engine, possibly causing brief bursts of power but not sustained running. According to a Yak expert, the engine-driven fuel pump is very sensitive to ingested air. The pump will not easily suck air, so if sufficient air is introduced into the fuel upstream of the fuel pump the fuel pump may not be able to draw any fuel. The pressure carburettor requires fuel to be delivered under pressure because it does not have a float chamber. The lack of a float chamber means that it will work while inverted, but the disadvantage of this design is that it must be constantly fed with pressurised fuel. Any air or vapour in the fuel in the carburettor can result in the engine losing power almost instantly. This is why significant priming is important for engine start. Maintenance history The aircraft was being maintained in accordance with the CAA’s Light Aircraft Maintenance Schedule (LAMS/A/1999/Issue 2). At the time of the accident the airframe had logged 500 hours and the engine had logged 51618 hours. The propeller was overhauled in 2013 and had logged 48 hours. In 2013 the aircraft underwent a CAA-approved lifetime extension inspection which extended the airframe’s original 20-year life by 10 years. During this inspection an automotive spark plug conversion, in accordance with a CAA modification approval, was carried out. All the flexible fuel and oil hoses, and the carburettor diaphragm were replaced in December 2014. The last annual inspection was completed in February 2016 at 479 airframe hours. According to the aircraft’s AAN, the engine was due its first overhaul at 750 hours, and subsequent overhauls every 500 hours, with a maximum life of 2,250 hours. The engine on G-YAKB had logged 516 hours, so it was not yet due its first overhaul. The records indicated that the engine had been fitted to G-YAKB since build, so had been in service for 24 years without an overhaul. The original Russian engine logbook specified a first engine overhaul after 750 hours or 6 years19. There was no calendar overhaul life defined in the AAN. However, the CAA stated that their engine overhaul life principle was for operators to use the manufacturer’s specified overhaul life and justify any changes. CAA CAP 747 ‘Mandatory Requirements for Airworthiness’, Generic Requirement No. 24 ‘Light Aircraft Engine Overhaul Periods’, allows engines in aircraft only used for private flying to continue in service indefinitely, subject to certain conditions. However, for aircraft being used for aerial work the calendar overhaul life limits apply unless an alternative life can Footnote 18 Prior to 2002 the aircraft was registered in Lithuania, where a percentage of the engine ground running time was included in the engine total time. 19 According to the Russian Air Accident Investigation Commission, at the first 6-year overhaul the overhaul organisation decides the next calendar overhaul period, which would be 6 years or less, and this would be entered in the logbook. This applies to engines manufactured by VMP.

57 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 be justified20. Since no Yak-52 operator has yet approached the CAA for permission to conduct aerial work, the CAA could not state what alternative life, if any, would be approved. Aircraft examination Airframe examination The airframe had suffered significant damage to its nose; from the front instrument panel forwards it was almost completely detached from the rest of the airframe. The left wing leading edge and wingtip had suffered crushing damage. The right flap was almost up and the left flap was down and angled forwards, although this was explained by the rod connecting the left flap to its actuator having failed. The front flap lever was in the up position and the lack of damage to the flap trailing edges indicated that the flaps were up at impact. The front landing gear lever was in the down position with the safety gate closed, while the aft landing gear lever was in the neutral position. The nose landing gear leg and its actuator had suffered significant damage and disruption, indicating that it had probably been down or partially down at impact. The right main landing gear leg was up but not locked, while the left main landing gear leg was up and locked. The flight controls were examined and there were no disconnections apart from breaks associated with impact damage. The elevator trim tab was in a near neutral position. The engine controls were examined and there were no disconnections apart from breaks associated with impact damage. The throttle and propeller levers could have easily moved in the impact sequence, so their positions were not reliable pre-impact positions. The front fuel shutoff lever was in the aft closed position which corresponded to the position of the shutoff valve, but there was significant disruption to the control rods to the extent that the interconnecting aft fuel shutoff lever was in the open position; therefore a reliable pre‑impact position could not be determined. The air intake flap had been torn off during the impact sequence which indicated that the flap was probably open and, therefore, that the carburettor heat was set to cold at impact. The front cockpit magneto switch was damaged and the selector was 180° out from any normally selectable position, while the aft cockpit magneto switch was set to ‘1+2’ (both). The front cockpit switch panel housing the generator and battery switches had suffered a significant impact which meant that the switch positions were not reliable pre-impact positions. Instrument examinations The bulbs from the rear cockpit Central Warning Panel (CWP) were examined. These included bulbs which illuminate to indicate that the left and right fuel tank levels are less than 12 litres in each side, that the generator is not producing sufficient output, that the Footnote 20 CAA CAP 747 Generic Requirement No. 24 states that calendar limits must be observed if the aircraft is used for the purposes of Public Transport or Aerial Work. Aerial work means any purpose, other than commercial air transport or public transport, for which an aircraft is flown if valuable consideration is given or promised for the flight or the purpose of the flight. In August 2016 the term ‘aerial work’ was replaced with ‘commercial operation’ when The Air Navigation Order 2016 was introduced.

58 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 master switch is turned on, and a stall warning indication which illuminates close to the stall. The bulbs were examined under the microscope to look for indications of filament stretch. A stretched filament indicates that it was probably hot at impact and, therefore, that the light was on21. Both the bulbs for the master switch caption and the bulbs for the generator caption were stretched, indicating that the master switch was probably on at impact and that the generator was probably generating below normal output. According to a Yak expert, if an engine is windmilling following a loss of power, then the generator output would be sufficient to prevent this light from illuminating if the aircraft is at best glide speed. The cut‑off airspeed is not known, but it is possible that near stalling speed the generator caption might illuminate if the engine had lost power. None of the remaining bulbs had stretched, indicating that the fuel level in each tank was above 12 litres and that the stall warning was probably not illuminated at the moment of impact. The light bulbs inside the fuel gauge (Figure 8) were also examined and three of the bulbs were found to be stretched. These were for the left tank quantities 40 and 45, and for the right tank quantity 40. During transition from one indicated level to the next, the two quantities can be flickering on and off. This indicated that the left fuel tank quantity was probably between 40 and 45 litres and the right fuel tank quantity was probably about 40 litres. Powerplant examination One of the two propeller blades had separated at its root and broken into pieces at impact. The tip of this blade had chordwise scratches consistent with rotation. The blade which remained attached was relatively undamaged, with light chordwise scratching on its forward face near the root, but none at the tip. This evidence indicated that the propeller was rotating at impact but had stopped almost immediately, meaning that the engine was probably producing little, or no power. A full strip examination of the engine was carried out at an approved maintenance facility by an engineer with experience of M-14P engines. Cylinders 3 and 4 (in the lower left corner) had detached, but the damage was consistent with bending failures associated with ground impact in that location. No mechanical damage was found that would explain a loss of power. Both magnetos had suffered impact damage but when tested with their respective ignition leads, the magnetos produced good steady sparks at low and high rpm. The spark plugs were in satisfactory condition. The carburettor was too damaged to test, but a strip examination did not reveal any anomalies or defects. The drive from the accessory gearbox to the fuel pump was checked and was intact. The fuel pump had been knocked off its mounting plate during the impact which had also caused its fuel outlet connection to break. The pump was mounted in a fuel pump test rig and at low rpm there was no fuel flow. When the rpm was increased to 1,000 rpm, the Footnote 21 Hot bulb filaments are more ductile than cold filaments which makes them more likely to stretch than break during a high-g impact. Cold filaments are brittle and are likely to break without any stretch.

59 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 flow started. When the rpm was subsequently reduced to 450 rpm the flow remained. The test engineer explained that the lack of initial flow was due to air in the system. The higher rpm was required to suck the air through and prime the fuel lines. At 2,200 rpm and a specified back pressure of 1.4 psi, the fuel flow exceeded the minimum requirement of 175 litres/hour by 80 litres/hour. Fuel system examination Both main fuel tanks were empty apart from a small trickle of fuel, while the collector tank contained 1.8 litres of fuel. Soil samples beneath the aircraft revealed the presence of fuel, although an accurate quantity could not be determined. There were sufficient impact‑related breaks in the fuel lines to explain the loss of fuel from the main tanks. The fuel in the collector tank was tested and conformed to the properties of AVGAS 100LL, with no evidence of contamination. The non-return valves and attached fuel pipe work were removed and tested with fuel. The valves operated normally with no sticking. The valves were additionally strip examined and there was no evidence of sticking. The flop-tube inside the collector tank was examined and it was free to pivot between top and bottom. The collector tank was partially filled with fuel and fuel flowed to the outlet when inverted and then righted. The coarse and fine fuel filters were not blocked. The fuel hose at the outlet of the coarse filter was loose; it had backed off about 90° from a hand-tight position. The fitting had been wire-locked to the bolt securing the filter bowl to the firewall, but this attachment had failed in the impact so the end of the wire-locking had come free. When the end of the wire-locking was positioned in its likely pre-impact position, there was sufficient slack for the fitting to back off to the as found position, although it’s possible that the wire-locking had stretched when the attachment failed. The filter bowl was filled with fuel but no fuel leaked out of the loose fitting. An additional test was carried out to see if air could be entrained through the loose fitting. A clear plastic hose was attached to the filter bowl outlet and a hand pump, while another hose was connected to the filter bowl inlet and a fuel tank. During pumping some air bubbles were seen in the outlet hose, and the amount of bubbles reduced when the outlet fitting was hand-tightened. The spherical-shaped compensation tank had been flattened during the impact so could not be tested, but its fittings were secure. The fuel primer handle had separated from its cockpit mounting during the impact and its three connecting fuel pipes had failed. The handle had also broken off and its position was half-way between left and neutral. When the primer is in the full left or full right position the handle needs to be pushed inwards before it can be rotated; however, when in the central position it can be rotated left or right without being pushed in which means that it can be knocked left or right from neutral. There is a knurled collar at the base of the primer handle which can be tightened to reduce leaks but also increases the resistance to pumping. The primer was tested by pumping 10 strokes in the left and right positions with the collar in the as-found position. This resulted in an average flow rates per stroke

60 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 of 8.6 ml in the left position and 7.2 ml in the right position. With the collar fully tightened the flow rate increased to 9.2 ml and 9.3 ml per stroke in the left and right positions respectively. Tests were carried out with the collar in the as-found position to see if the flow rate reduced when the pump was actuated at a high rate. When the pump was actuated in the left position 13 times in 10 seconds (1.3 strokes per second) the average flow rate was 8.2 ml per stroke. This would result in a flow rate of 38.4 litres/hour, which would be sufficient to maintain level flight given that the maximum range fuel flow22 is 37.3 litres/hr. Seat harness examinations The front and rear seats were fitted with 5-point harnesses. The straps were secured using a pin and cone fitting (Figure 10). The strap ends with holes are slotted over the cone and then held together by a butterfly pin. This pin is pulled out sideways to release the straps and a short lanyard tethers the pin to the right lap strap. The front and rear seat lap straps were made of a tan linen outer layer and a nylon inner layer, which was the type of strap fitted at original manufacture. The front and rear seat crotch straps and upper portions of the shoulder straps were made of a blue nylon material which was similar to the original type used, but could not be confirmed as such. The lower portions of shoulder straps were made of the same tan linen/nylon material as the lap straps. The blue nylon straps were about 1.6 mm thick but doubled up in some areas. The tan linen/nylon straps were about 4 mm thick and consisted of 2 mm thick layers stitched together. Figure 10 Front seat 5-point harness as found (left); all straps secured (right) Footnote 22 The maximum range fuel flow is the fuel flow that will maximise how far the aircraft can fly. The maximum endurance fuel flow is the minimum fuel flow required to maintain level flight for as long as possible, which will be slightly less than the maximum range fuel flow quoted here. The manufacturer does not quote the maximum endurance fuel flow.

61 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 The front seat right lower shoulder strap had failed in overload at the adjustable buckle (Figure 10) and the crotch strap had failed at its lower fuselage fitting. This lower fitting failure was probably caused by distortion of the floor and seat structure which resulted in the seat pan moving forwards against the crotch strap. The front seat lap straps had not failed but the butterfly pin had come out, so the straps were no longer connected. If the butterfly pin had not been inserted at the time of impact it is unlikely that the shoulder strap or crotch strap fitting would have failed. It appeared most likely that the pin came out during the impact sequence which allowed the FSP to be thrown from his seat. There were no witness marks on the pin or on its tether to help explain how it came out. The rear seat upper shoulder straps had both failed in overload above the adjustable buckles (Figure 11), and the rear seat left lap strap had failed at the adjustable buckle (Figure 12). The butterfly pin was also out, but one witness who attended the scene believes he removed it to help the commander out of his seat. Figure 11 Rear seat shoulder harnesses (both failed at upper strap) Figure 12 Rear seat left lap strap (failed at adjustable buckle) The blue shoulder straps were significantly sun faded on their outer exposed surfaces; their inner surfaces were a much darker blue. The tan straps also appeared to be discoloured

62 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 compared to what their original appearance probably would have been. Samples of the straps were subjected to characterisation using Attenuated Total Reflectance Fourier Transform Infrared (ATR-FIR) spectroscopy to determine if any chemical degradation had occurred. Minor differences in the spectra were observed when comparing some exposed surfaces to unexposed surfaces, suggesting some minor degradation had occurred, but this could not be quantified in terms of loss of strength. Tensile strength tests were carried out on the front seat left and right lap straps. The left strap failed at 570 kgf, while the right strap failed at 460 kgf. Some strength reduction may have occurred during the impact but this could not be estimated. The fact that the lap straps had come undone in the impact would have reduced the loads they had experienced. The shoulder straps were too short to be tested in a tensile test machine. The aircraft manufacturer could not provide a definitive strength figure for the original straps at manufacture and this type of linen/nylon strap is no longer made. One document provided related to an antiseptic and anti-mould treatment of the straps. It listed a strength of 450 kgf for a linen material that was 2 mm thick. It did not mention the nylon material or provide a strength figure for a stitched double layer. If this was the same linen material used on G-YAKB then it could possibly have had an original strength of 900 kgf or possibly more with the nylon. A replacement strap was obtained from a company in Lithuania which maintains and overhauls Yak-52 aircraft. This new replacement strap was made of polyester and had a minimum break strength of 2,650 kgf, which is consistent with military strength requirements23. The civilian strength requirements are specified in terms of deceleration rate using an assumed pilot mass with static and dynamic tests, instead of tensile strength. Survivability The RAFCAM reviewed and reported on the FSP’s post-mortem report and a summary of the injuries sustained by the commander. The FSP wore a headset24 provided by the commander, and the commander wore a Campbell Aero Classics hard shell flying helmet with integrated goggles. The RAFCAM report stated that had the FSP been wearing a protective helmet, it is possible that the protection afforded could have reduced the severity of his head injuries. The presence of helmet visors, if worn in the locked down position, could have provided some added protection and may have lessened the severity of the facial injuries. Similarly, a helmet’s shell could have mitigated the forces causing the head injuries. However, it was difficult to determine if a helmet and visor combination could have reduced the injuries to the extent that the accident might have been survivable. Footnote 23 The Aircraft Crash Survival Design Guide (AD-A218 437, Vol 4) and Military Specification Seat System: Crash-Resistant, Non-Ejection, Aircrew, General Specification For (MIL-S-58095A) indicate that the minimum tensile breaking strength of webbing harnesses should be 2,721kg. 24 A hard shell helmet was available to the students earlier in the week, but as a result of intercom difficulties it was replaced with a headset.

63 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 The commander’s injuries included fractures to his facial bones, bilateral fractures to lower limbs, and fractures to his pelvis, ribs and palm of his right hand. His left eye was also seriously injured. The FSP had similar hand injuries, but his were coupled with upper limb injuries. The fact that the commander’s hand injuries were in isolation of upper limb fractures could indicate that he had his hand on the control column at the time of the impact. However, such injuries can be non-specific and so this evidence is inconclusive. According to the RAFCAM report, it was likely that the commander’s facial fractures resulted from impact with the instrument panel in the rear cockpit and that his forward flail would have been compounded by the failure of his shoulder harness straps. The RAFCAM report also stated that it was likely that the failure of the front-seat webbing of the shoulder harness and the detachment of the anchor point of the negative-g strap, coupled with the inadvertent release of the harness’s locking mechanism, would have influenced the severity of the FSP’s head and face injuries. However, they could not determine conclusively if the severity of the FSP’s injuries would have been lessened had the harness straps remained undamaged and the locking mechanism intact. The type of helmet worn by the commander had been previously tested by RAFCAM. It was determined that this helmet had considerably less impact energy attenuation than the standard Mk 10 and Mk 4 series of helmets typically worn by military pilots. Other information Previous Yak-52 loss of power accidents and incidents The AAIB has published previous reports on 45 Yak-52 accidents. Of these, six were fatal, and none of the fatal accidents involved a loss of power or a forced landing. Five of the 39 non-fatal accidents involved a loss of power and a forced landing. Two cases involved spark plug failures and one involved an accessory driveshaft failure. In the remaining two cases no cause of the loss of power was found. Loss of power events which do not result in an accident (ie no serious injury or no damage sustained during the forced landing) are not reported on; including those experienced by the commander of G-YAKB. An experienced Yak pilot informed the AAIB of a loss of power he experienced in a Yak‑52 in October 2016. It occurred at the top of a stall turn when the engine suddenly lost all power without prior warning. The pilot recovered from the dive and set best glide speed. The fuel pressure was normal and the propeller was windmilling at an engine rpm of about 60%. The throttle was free to move fore and aft, so he ruled out carburettor ice25. Because the fuel pressure was normal and stable, he asked the FSP to pump the primer with it set to the right ‘cylinders’ position. This did not have an immediate effect, but after some time the engine started firing and eventually began running normally. The loss of power lasted about 60 to 75 seconds and the aircraft lost about 2,000 ft of height. A Footnote 25 Carburettor ice is known to cause the throttle to stick with this carburettor type.

64 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 normal landing was carried out. A detailed engine and fuel system examination by an engineer did not reveal any faults that would have caused the loss of power. Whilst this loss of power remains unexplained, it provided evidence that a windmilling propeller can turn the fuel pump sufficiently fast to generate normal fuel pressure. Operating piston engines for long periods without overhaul In July 2009, a P56 Provost T1 (G-AWVF) with an Alvis Leonides radial piston engine suffered a mechanical failure which led to an in-flight engine fire and a fatal accident26. The failure was caused by a fatigue failure of a piston gudgeon pin. Corrosion pits on the inner surface of the pin were probably a contributory factor. This engine had not been overhauled in 45 years. This resulted in AAIB Safety Recommendation 2010-029, which recommended that the CAA: ‘consider implementing calendar time limits between overhauls for Alvis Leonides series engines, and other historic aircraft engines that do not have manufacturer-recommended calendar limits.’ The CAA responded to this recommendation by publishing Leaflet 70-80 ‘Guidance Material for Ageing Engine Continuing Airworthiness’ in CAP 562 ‘Civil Aircraft Airworthiness Information and Procedures’ on 31 October 2012. This leaflet states that in the absence of a manufacturer’s published calendar life the engine is required to be overhauled after 20 years unless a hazard analysis for continued operation is carried out. However Leaflet 70-80 only applies to radial piston engines with power in excess of 400 hp, and therefore does not apply to the Yak-52’s M-14P engine. Maintenance requirements for seat harnesses The Yak-52 Scheduled Servicing Manual27 states to do the following inspection on the front and rear cockpit seat harnesses at every 50-hour and every 100-hour/Annual check: ‘Inspect the belt system, check belt fastening and belts condition, lock operation’. The CAA’s Light Aircraft Maintenance Schedule (LAMS/A/1999/Issue 2) states to inspect ‘Seats, belts/harnesses, attachment, locking and release’ at 50 hours or 6 months, whichever occurs first. According to the CAA, they would expect this check on the belts to include ‘wear/fraying, loose stitching, security of attachment and correct operation’. There is no requirement to check for sun-fading or to track the age of the harnesses. The aircraft manufacturer stated that the aircraft life was 20 years and therefore they considered the life of the seat harnesses also to be 20 years. The CAA’s approved 20-year lifetime extension inspection was focussed on structural inspections and did not refer to seat harnesses. Footnote 26 AAIB Bulletin 10/2010. 27 RGA/Yak52/Maint – 1988 R1 – January 2003

65 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 Analysis General The aircraft’s engine failed without warning after a period of aerobatics, which included some inverted flight. Despite the FSP’s attempts to restart the engine and maintain some power by pumping the primer, this was unsuccessful and a decision was taken to carry out a forced landing. Operational aspects The FSP did not attend the mandatory 90-minute Technical and Safety Briefing at the beginning of the QE week. His flight was brought forward with the pilots being observed in discussion for about 15 minutes before walking to the hangar where they appeared rushed. This was a short amount of time for the commander to brief the FSP on the aircraft’s cockpit, delegation of duties and emergency procedures. This might have been significant, as some of the engine controls were only available in the front cockpit. An aircraft operating on a PTF was not required to have a checklist and there was not one in the aircraft. The commander stated that he committed the aircraft’s normal and emergency procedures to memory. In the absence of a thorough emergency brief the FSP was unlikely to have been able to proficiently assist with the fault diagnosis or any emergency drills. This would have been made more difficult with no checklist available. Response to loss of engine power The manufacturer’s ‘…Engine Shut Down During Flight’ checklist states: ‘bring the throttle lever at about one third of stroke’ before pumping the primer handle in the left position and subsequently states: ‘As soon as the engine starts running again, bring the throttle lever in take-off condition [full power] for 1-2 seconds’. The ‘engine failure’ checklist provided by the commander did not state anything with regards to throttle movement. The commander believed that, having exercised the throttle following the loss of power, he returned it to about 70% rpm. This was not in accordance with the manufacturer’s checklist and may have been a factor that prevented the engine from restarting. The attempted forced landing The aircraft was at about 2,650 ft agl when the FSP transmitted “…probably going to be eh pfl ing [practice forced landing] to a field…” at 0932:06 hrs. The radar data shows that the aircraft continued on a steady heading to the east; during this time the pilots were primarily focussed on attempting to restart the engine with the expectation that they might be able to return to BD. The evidence shows that the commander committed to conducting a forced landing at 0933:29 hrs, at which time the aircraft was approximately 1,100 ft agl and travelling downwind. There were a number of suitable fields available for a forced landing into-wind and, given the commander’s previous experience of forced landings in a Yak-52, a successful outcome should have been possible. The evidence shows that, after the final radar point, the aircraft was initially flown in a westerly direction (into-wind), but this did not culminate in an into-wind landing. The

66 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 position of the aircraft wreckage in the immediate vicinity of the strip and the commander’s limited recollection point towards a late decision having been made to land on the strip. The fact that the landing gear was in transit is supporting evidence for this. It could not be determined whether the aircraft was flown to the north or the south of the strip. The commander’s decision to land on the strip may have been influenced by having previously flown three successful forced landings, with the landing gear down, onto strips or runways. There was about 1 minute, based on the average descent rate of 1,150 fpm, available from the time of the FSP transmitting that they were performing a forced landing into a field, to the aircraft reaching the ground. This was a short period of time to see the strip, commit to it and adjust the flight path to correctly align the aircraft with it. If the pilots had pursued the original plan to land in a field, it would have been less important to align the aircraft on a prescribed track, but more important to land into-wind. Given that the aircraft approached the strip downwind, it is likely that either the pilots’ workload was too high for them to consider the wind direction, or they had incorrectly recalled it. The unserviceable heading indicator may have led to the pilot losing some degree of situational awareness, which may have contributed to the aircraft landing downwind. A compounding factor was the commander being seated in the rear cockpit, which would have restricted his forward visibility, making it more difficult to manoeuvre the aircraft accurately at low level during the final approach to the strip. It is possible that the commander handed control to the FSP in the latter stages of the approach, but there was no definitive evidence as to who was at the controls immediately prior to the accident. Cause of impact The aircraft hit the ground in a steep left bank at the southern edge of the farm strip. Based on the damage and the distance travelled before coming to rest the aircraft was at low speed. The evidence from the CWP bulbs indicated that the generator light was probably on, which can occur at low speed, close to the stall. It is possible that the aircraft stalled prior to impact causing the left wing to drop, but it is equally possible that the aircraft was being manoeuvred at low speed to reach the strip with a deliberate left aileron control input in the last few seconds. The evidence from the landing gear indicated that it was probably in transit, which means that the landing gear was probably selected down using the front cockpit lever less than 15 seconds before impact. Loss of power The engine had suffered a complete loss of power but reportedly produced brief periods of power when the primer was pumped in the left position. The loss of power was reportedly accompanied by a loss of fuel pressure and pumping the primer in the left position caused the fuel pressure to increase. These symptoms are consistent with a fuel pump failure, but the fuel pump operated normally during a bench test and the fuel pump drive was intact. There were no disconnections in the fuel system, apart from breaks associated with impact forces. The non-return valves were tested with fuel and inspected; there was no evidence of the valves sticking that might have caused a loss of fuel pressure. All the filters in the fuel system were clear and no blockages in the fuel system were found.

67 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 The evidence from bulb filament analysis indicates that about 83 litres of fuel remained in the main tanks at the moment of impact, which is consistent with the expected fuel amount based on fuel burn estimates with full tanks on departure. The absence of fuel in the main tanks at the accident site can be explained by the breaks in the fuel lines associated with impact. The collector tank retained 1.8 litres of fuel which was tested and found to be normal for AVGAS. A possible cause for the loss of power was that air had entered the fuel system. According to an experienced Yak engineer, the fuel pump will stop pumping fuel if sufficient air enters it. The outlet fitting of the fuel filter bowl was found to be loose and tests revealed that some air could be entrained, but it was not a significant amount. However, if sufficient air had entered the fuel system by this method, then the symptoms reported by the pilot could be explained. The fuel pressure indication would drop to zero and pumping the primer in the left position would cause the fuel pressure to momentarily increase, because the primer pump would be pushing fuel through the coarse filter to the fuel pump, which would not cause air to be entrained. It is the sucking action of the fuel pump that could have caused air to be entrained through a loose connection. Carburettor icing was considered as a possible cause of the loss of power, but carburettor icing usually causes a gradual loss of power and rough running, neither of which were reported. Carburettor icing is also known to cause the throttle butterfly valve to freeze on the Yak-52, resulting in the throttle lever freezing; however, the pilot recalled exercising the throttle. Carburettor icing could explain a loss of power, but would not cause a loss of indicated fuel pressure. Water in the fuel was another possibility considered. Water in the fuel can cause a sudden loss of power, but it normally occurs shortly after takeoff. The aircraft had been flown the day before and was in a hangar overnight, so the chance of water having formed in the tanks by condensation was low. In addition, water in the fuel would not cause a loss of indicated fuel pressure. The manual pumping of the primer was reportedly at a rate of one stroke every 3 to 4 seconds, which produced brief bursts of power. The fuel primer tests revealed that such a stroke rate would not have produced sufficient power for level flight. A stroke rate of about 1.3 strokes per second would have been necessary to maintain level flight. The cause of the loss of power could not be determined, but the reported symptoms indicated that the problem was related to the fuel system. There have been other cases of loss of engine power on Yak-52 aircraft that could not be explained. The Yak-52 aircraft and its M-14P engine have not been certified to any international standard and so the aircraft is operated on a PTF, which potentially carries a higher risk compared to an aircraft operating on a Certificate of Airworthiness.

68 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 Survivability RAFCAM reported that, had the FSP been wearing a protective helmet, it is possible that the protection afforded could have reduced the severity of his head injuries. However, it was difficult to determine if a helmet and visor combination could have mitigated the injuries to the extent that the accident might have been survivable for the FSP. Seat harness condition The seat harness lap straps were probably original and so would have been in service for 24 years, 4 years longer than that permitted by the aircraft manufacturer. When the CAA granted a 20-year lifetime extension, seat harnesses were not among the items that required replacement. The aircraft manufacturer could not provide a definitive strength figure for the original straps at manufacture, but they provided some evidence to indicate that the strap might have had an original strength in excess of 900 kgf. The right front seat lap strap had failed at 460 kgf, so it was possible that about 50% of its strength had been lost due to ageing. There is no requirement in LAMS to check for signs of ageing or to track the age of seat belts and harnesses. Therefore, it is recommended that: Safety Recommendation 2017-021 The Civil Aviation Authority should review the maintenance requirements for seat belts and harnesses, and, if necessary, revise the maintenance requirements to ensure that seat belts and harnesses remain in a condition with an acceptable residual strength. Engine overhaul period The engine had not been overhauled in 24 years. This was permitted by the CAA as long as the aircraft was not used for aerial work. If the operator had requested using G-YAKB for aerial work it is not clear what calendar limits, if any, the CAA would have imposed as a condition. Although there is no evidence that the lack of engine overhaul contributed to the loss of power, operating engines without calendar limits can cause problems as was the case in the accident to the P56 Provost T1 (G-AWVF). As a result of that accident the CAA now applies a 20-year calendar limit, unless a hazard analysis can demonstrate otherwise (Leaflet 70-80); however, it only applies to engines with more than 400 hp. The CAA have stated that they are conducting a review of engine maintenance to determine if Leaflet 70-80 should be extended to all piston engines and whether any Alternative Means (Methods) of Compliance arising from Leaflet 70-80 should be made mandatory by means of a Mandatory Permit Directive (MPD). This will also include a review of Generic Requirement No. 24 in CAP 747. Permit to Fly G-YAKB was operating on a PTF. The ANO allowed PTF aircraft to do aerial work without CAA permission, by way of a demonstration flight. However, this could only be done with

69 © Crown copyright 2017 AAIB Bulletin: 11/2017 G-YAKB EW/C2016/07/01 the minimum flight crew, which would be one in a Yak-52. If additional persons were to be carried, then CAA permission would have been needed. The commander believed he was performing a demonstration flight; however, because more than the minimum flight crew was on board, permission would have been required from the CAA, but this had not been applied for. Conclusion The cause of the loss of engine power could not be determined, but the reported symptoms were consistent with a fuel system problem. Attempts to restart the engine were unsuccessful and the commander committed to a forced landing from about 1,100 ft agl. Although the commander’s initial intention was to force land in a field, he became aware of a farm strip and probably made a late change of decision to land on the strip. This late decision, and the subsequent manoeuvres in the attempt to reach the strip, ultimately resulted in an unsuccessful forced landing and the aircraft struck the ground in a steeply left banked attitude.

FD06616 ｜ 2017_英国_aircraft-accident-report-aar-1-2017-g-bxfi-22-august-2015__AAR_1-2017_G-BXFI.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

AIRCRAFT ACCIDENT REPORT 1/2017 Report on the accident to Hawker Hunter T7, G-BXFI near Shoreham Airport on 22 August 2015 AAIB Air Accidents Investigation Branch

AIRCRAFT ACCIDENT REPORT 1/2017 Air Accidents Investigation Branch Report on the accident to Hawker Hunter T7, G-BXFI near Shoreham Airport 22 August 2015 This investigation has been conducted in accordance with Annex 13 to the ICAO Convention on International Civil Aviation, EU Regulation No 996/2010 and The Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 1996. The sole objective of the investigation of an accident or incident under these Regulations is the prevention of future accidents and incidents. It is not the purpose of such an investigation to apportion blame or liability. Accordingly, it is inappropriate that AAIB reports should be used to assign fault or blame or determine liability, since neither the investigation nor the reporting process has been undertaken for that purpose.

ii Printed in the United Kingdom for the Air Accidents Investigation Branch This report contains facts which have been determined up to the time of publication. This information is published to inform the aviation industry and the public of the general circumstances of accidents and serious incidents. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and it is not used in a derogatory manner or in a misleading context. Published 3 March 2017 © Crown Copyright 2017

iii © Crown Copyright 2017 Department for Transport Air Accidents Investigation Branch Farnborough House Berkshire Copse Road Aldershot Hampshire GU11 2HH February 2017 The Right Honourable Chris Grayling Secretary of State for Transport Dear Secretary of State I have the honour to submit the report on the circumstances of the accident to Hawker Hunter T7, registration G-BXFI near Shoreham Airport on 22 August 2015.

Yours sincerely Crispin Orr Chief Inspector of Air Accidents

Intentionally left blank

v Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Contents © Crown Copyright 2017 Contents Contents Introduction...................................................................................................................... 1 Summary........................................................................................................................... 2 1 Factual Information............................................................................................... 7 1.1 History of the flight.......................................................................................... 7 1.1.1 Background....................................................................................... 7 1.1.2 The display – general preparation..................................................... 7 1.1.3 The accident flight ............................................................................ 8 1.2 Injuries to persons .........................................................................................11 1.3 Damage to the aircraft ...................................................................................11 1.4 Other damage ................................................................................................11 1.5 Personnel information.................................................................................... 12 1.5.1 Commander..................................................................................... 12 1.5.1.1 Career history................................................................ 12 1.5.1.2 Use of speed and height ‘safety gates’ in military

flying.............................................................................. 13 1.5.1.3 Hunter flying.................................................................. 14 1.5.1.4 Pilot’s display authorisation........................................... 16 1.5.1.5 Displays and display practices...................................... 18 1.5.1.6 Minimum display heights .............................................. 20 1.5.1.7 Flying display emergency manoeuvres ........................ 20 1.5.1.8 Pilot recency requirements ........................................... 21 1.5.2 The Flying Display Director............................................................. 21 1.5.3 The Flying Control Committee......................................................... 22 1.6 Aircraft information.............................................................................................. 22 1.6.1 General............................................................................................ 22 1.6.2 Aircraft description........................................................................... 23 1.6.3 Standard configuration.................................................................... 23 1.6.4 Flying controls................................................................................. 24 1.6.5 Flaps................................................................................................ 24 1.6.6 Hydraulic system............................................................................. 25 1.6.7 Electrical system.............................................................................. 25 1.6.8 Instruments...................................................................................... 25 1.6.8.1 Accelerometer (g-meter)............................................... 25 1.6.8.2 Pitot-static sensors........................................................ 26 1.6.8.3 Airspeed indicators ....................................................... 26 1.6.8.4 Altimeters ..................................................................... 26 1.6.8.5 RPM indicator and tacho-generator.............................. 29

vi Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Contents © Crown Copyright 2017 Contents 1.6.8.6 Engine exhaust gas thermometer ................................ 30 1.6.8.7 Transponder.................................................................. 30 1.6.9 Rolls-Royce Avon Mk 122 engine.................................................... 30 1.6.10 Aircraft fuel system.......................................................................... 32 1.6.11 Pilot escape system......................................................................... 32 1.6.12 Pilot anti-g system........................................................................... 33 1.6.13 Mass and centre of gravity.............................................................. 34 1.6.14 Maintenance records ...................................................................... 34 1.6.14.1 General maintenance and CAA audits.......................... 34 1.6.14.2 Altimeter maintenance records..................................... 36 1.6.14.3 Engine maintenance records........................................ 37 1.6.14.4 Ejection seat maintenance records............................... 37 1.7 Meteorological information............................................................................ 37 1.8 Aids to navigation.......................................................................................... 38 1.9 Communications............................................................................................ 38 1.10 Aerodrome information.................................................................................. 38 1.11 Recorded data............................................................................................... 39 1.11.1 General............................................................................................ 39 1.11.2 Air Traffic Control radar................................................................... 40 1.11.3 Action cameras................................................................................ 40 1.11.4 Flying display videos and photographs........................................... 42 1.11.5 Smartphones................................................................................... 42 1.11.6 Data recorded during the accident flight.......................................... 43 1.11.7 Data recorded during previous flights.............................................. 48 1.11.7.1 General......................................................................... 48 1.11.7.2 Shoreham – August 2014, G-BXFI................................ 48 1.11.7.3 Duxford – September 2014, G-BXFI ............................ 49 1.11.7.4 Recent Jet Provost display flying.................................. 50 1.11.7.5 Imagery from a previous flight....................................... 51 1.11.8 Engine performance........................................................................ 51 1.11.8.1 JPT and rpm ................................................................. 51 1.11.8.2 Engine speed during manoeuvres................................ 52 1.11.8.3 Engine speed indicator.................................................. 54 1.11.9 Recorded information from other aircraft and other flying displays. 54 1.12 Wreckage and impact information................................................................. 54 1.12.1 Accident site examination................................................................ 54 1.12.2 Aircraft on-site examination............................................................. 55 1.12.2.1 Structure........................................................................ 55 1.12.2.2 Cockpit.......................................................................... 55 1.12.2.3 Ejection seats................................................................ 57

vii Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Contents © Crown Copyright 2017 Contents 1.12.3 Further examination......................................................................... 59 1.12.3.1 Flying controls .............................................................. 59 1.12.3.2 Hydraulic system........................................................... 59 1.12.3.3 Electrical system........................................................... 59 1.12.3.4 Pitot-static system......................................................... 59 1.12.3.5 Airspeed indicators ....................................................... 59 1.12.3.6 Altimeters ..................................................................... 60 1.12.3.7 Accelerometer (g-meter)............................................... 62 1.12.3.8 RPM indicator and tacho-generator.............................. 62 1.12.3.9 Anti-g system................................................................ 63 1.12.3.10 Engine examination....................................................... 63 1.12.3.11 Fuel system................................................................... 68 1.13 Medical and pathological information............................................................ 68 1.13.1 Pilot.................................................................................................. 68 1.13.2 Third parties..................................................................................... 68 1.14 Fire................................................................................................................ 69 1.15 Survival aspects............................................................................................ 69 1.15.1 Fire and rescue services................................................................. 69 1.15.2 Pilot’s helmet................................................................................... 69 1.15.3 Aircrew equipment assemblies (AEA) ............................................ 69 1.15.4 Survival equipment ......................................................................... 70 1.16 Tests and research........................................................................................ 70 1.16.1 Flight trials....................................................................................... 70 1.16.2 Radar Mode C validation................................................................. 72 1.16.3 Radar detection of peak altitudes.................................................... 73 1.17 Organisational and management information ............................................... 74 1.17.1 Operation of ex-military aircraft on the UK civil register ................. 74 1.17.2 Record of flight training ................................................................... 74 1.17.3 Safety management systems ........................................................ 75 1.17.3.1 Introduction................................................................... 75 1.17.3.2 International Civil Aviation Organisation ....................... 76 1.17.3.3 CAP 632 – ‘Operation of ‘Permit-to-Fly’ ex-military

aircraft on the UK register’............................................ 76 1.17.3.4 Safety culture................................................................ 79 1.17.4 Approval process for UK civil flying displays in 2015...................... 79 1.17.4.1 The Air Navigation Order............................................... 79 1.17.4.2 Ownership of risk.......................................................... 81 1.17.4.3 Risk assessment of flying displays................................ 82 1.17.4.4 Hierarchy of control....................................................... 83 1.17.4.5 Hazardous materials risk assessments......................... 83

viii Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Contents © Crown Copyright 2017 Contents 1.17.5 Organisation of the Shoreham Airshow........................................... 83 1.17.6 Independent review of risk assessment.......................................... 87 1.17.7 Sequential listing of manoeuvres..................................................... 90 1.17.8 Airworthiness and national permits to fly ........................................ 90 1.17.9 Acceptance and maintenance of ex-military aircraft on

the UK civil register ......................................................................... 92 1.17.10 Maintenance organisation approval................................................. 94 1.18 Additional information.................................................................................... 94 1.18.1 The accident manoeuvre ................................................................ 94 1.18.2 Aircraft handling............................................................................... 96 1.18.2.1 Flying a loop.................................................................. 96 1.18.2.2 Flying a ‘bent loop’........................................................ 97 1.18.2.3 Technique for a loss of thrust during the upward

half of a loop.................................................................. 98 1.18.2.4 Entry speed ................................................................. 98 1.18.2.5 Minimum apex (‘gate’) height ....................................... 99 1.18.2.6 Entry criteria for low-speed aircraft such as the RV-8... 99 1.18.2.7 Correct use of gate heights......................................... 100 1.18.3 Review of recorded imagery by the Test Pilot................................ 100 1.18.3.1 Background................................................................. 100 1.18.3.2 Flying display at Duxford in 2014................................ 100 1.18.3.3 Flying display at Shoreham in 2014 ........................... 102 1.18.3.4 Flying display at Shoreham in 2015............................ 103 1.18.3.5 Manoeuvres analogous to escape manoeuvres ........ 104 1.18.3.6 Other observations...................................................... 105 1.18.4 UK flying display statistics............................................................. 106 1.18.4.1 Fatal accidents at UK flying displays 1996-2015........ 106 1.18.4.2 UK flying display accidents where the aircraft

crashed in the area below its display.......................... 108 1.18.4.3 Accident rates at flying displays ................................. 109 1.18.4.4 Scale of UK flying displays in 2015..............................110 1.18.4.5 UK flying display activity in 2015, by month.................110 1.18.4.6 Other aircraft accidents in the UK involving

third-party fatalities.......................................................112 1.18.5 Monitoring of safety standards at flying displays............................112 1.18.5.1 CAA staff competencies and resources.......................112 1.18.5.2 UK Display inspections................................................114 1.18.6 Separation between the primary crowd and displaying aircraft......115 1.18.7 Non-participant third parties and secondary crowds......................116 1.18.7.1 A27 vehicular traffic ....................................................116 1.18.7.2 Secondary spectators..................................................116 1.18.7.3 Other non-participant third parties................................118

ix Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Contents © Crown Copyright 2017 Contents 1.18.8 Previous Safety Recommendation.................................................119 1.18.9 Minimum heights........................................................................... 120 1.18.9.1 Authorised display heights.......................................... 120 1.18.9.2 Application of minimum heights ................................. 121 1.18.9.3 Standardised European Rules of the Air..................... 121 1.18.9.4 CAA exemption from SERA 5005(f)............................ 122 1.18.9.5 SERA implementation................................................. 123 1.18.10 Human factors .............................................................................. 124 1.18.10.1 Physiology................................................................... 124 1.18.10.2 Study of human performance...................................... 125 1.18.10.3 Previous Safety Recommendation regarding human

factors......................................................................... 129 1.18.11 CAA Review of Civil Air Displays................................................... 130 1.18.12 CAA organisation for general aviation........................................... 134 1.18.13 Original Equipment Manufacturer (OEM) support, documentation

and training .................................................................................. 136 1.18.13.1 OEM support............................................................... 136 1.18.13.2 Documentation............................................................ 137 1.18.13.3 Training of maintenance personnel............................. 141 1.18.14 Mandatory Permit Directive 2001-001........................................... 141 1.18.14.1 Background................................................................. 141 1.18.14.2 Assessment of AMOC applications............................. 142 1.18.14.3 Compliance with MPD 2001-001................................. 142 1.18.14.4 Other relevant engine-related events.......................... 148 1.18.15 Ejection seats................................................................................ 148 1.18.15.1 Ejection seats in ex-military aircraft on the UK civil

register ....................................................................... 148 1.18.15.2 Information from the ejection seat manufacturer......... 150 1.18.15.3 Ejection seat maintenance.......................................... 154 1.18.15.4 Safety of first responders............................................ 157 1.18.16 Safety actions taken...................................................................... 158 1.18.17 Other relevant Safety Recommendation....................................... 158 1.19 Investigation techniques.............................................................................. 158 1.19.1 Accident site mapping using an unmanned aircraft system.......... 158 1.19.2 Analysis tools................................................................................. 158 2 Analysis............................................................................................................... 161 2.1 General........................................................................................................ 161 2.2 Aircraft handling .......................................................................................... 161 2.2.1 The accident manoeuvre............................................................... 161 2.2.1.1 The first half of the accident manoeuvre..................... 162 2.2.1.2 The apex of the manoeuvre........................................ 164

x Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Contents © Crown Copyright 2017 Contents 2.2.2 Conduct of escape manoeuvres.................................................... 165 2.2.3 Possible impairment...................................................................... 166 2.3 Technical issues relevant to the accident flight............................................ 166 2.3.1 Flight instruments.......................................................................... 166 2.3.1.1 Pitot-static instruments................................................ 166 2.3.1.2 Rpm indication............................................................ 168 2.3.1.3 Jetpipe Temperature (JPT) indication......................... 168 2.3.2 Engine and engine controls........................................................... 169 2.3.3 Flying controls and hydraulic system............................................. 169 2.4 Control of flying display risk ........................................................................ 170 2.4.1 Analysis methodology.................................................................... 170 2.4.2 Preventive controls........................................................................ 170 2.4.2.1 Initial and recurrent training programmes .................. 170 2.4.2.2 Pilot currency to maintain proficiency.......................... 171 2.4.2.3 Operator’s procedures................................................ 171 2.4.2.4 Regulatory requirements for pilot competency............ 172 2.4.2.5 Monitoring by the pilot................................................. 173 2.4.2.6 External monitoring detects the missed gate ............. 174 2.4.2.7 Safety systems and regulation.................................... 174 2.4.3 Recovery Controls......................................................................... 182 2.4.3.1 External monitoring detects the missed gate.............. 182 2.4.3.2 Pilot performs an escape manoeuvre having

recognised it was necessary ...................................... 182 2.4.3.3 Separate the consequences from uninvolved

third parties ................................................................ 182 2.4.3.4 Separate the consequences from involved

third parties................................................................. 182 2.4.3.5 Pilot ejects................................................................... 182 2.4.3.6 Mitigate the risk to first responders............................. 183 2.4.4 Performance of risk control measures ......................................... 183 2.5 Engineering aspects.................................................................................... 184 2.5.1 Engine condition monitoring, maintenance history and

regulatory requirements ................................................................ 184 2.5.2 Compliance with MPD 2001-001................................................... 187 2.5.3 Ejection seats................................................................................ 188 2.5.3.1 Initiation of ejection sequence..................................... 188 2.5.3.2 Ejection seat maintenance ......................................... 189 2.5.4 Summary of airworthiness findings................................................ 192 2.6 Governance of flying display activity........................................................... 194

xi Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Contents © Crown Copyright 2017 Contents 3 Conclusions........................................................................................................ 195 (a) Findings....................................................................................................... 195 (b) Causal factors.............................................................................................. 203 (c) Contributory factors..................................................................................... 203 4 Safety Recommendations.................................................................................. 205 Appendices Appendix A – Altimeter system Appendix B – Ejection seats Appendix C – Permit to Fly Appendix D – Log card for the high pressure fuel pump Appendix E – Strip examination and assessment of Avon Mk122 S/N 41H-670815 Appendix F – Laboratory report of ACU, BPC and Hydro-mechanical governor diaphragms Appendix G – Mandatory Permit Directive 2016-001 Appendix H – Report on data gathering flying related to the accident to G-BXFI Appendix J – Review of the 2015 Shoreham Airshow Air Display Risk Assessment Appendix K – Review of the risk assessment sections of CAP 403 Appendix L – Airworthiness Approval Note No: 26172 Issue 2 Appendix M – Royal Air Force Centre of Aviation Medicine human factors report Appendix N – Mandatory Permit Directive 2001-001 Appendix O – .Civil Aviation Publication 562 Leaflet 70-80 – ‘Guidance Material for Ageing

Engine Continuing Airworthiness’ Appendix P – Mandatory Permit Directive 2016-002

xii Glossary of Abbreviations Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 GLOSSARY OF ABBREVIATIONS USED IN THIS REPORT Glossary of abbreviations °C Degrees Centigrade °M Degrees Magnetic AAIB Air Accidents Investigation Branch aal above aerodrome level AAN Airworthiness Approval Note ACAM Aircraft Continuing Airworthiness Monitoring ACU Acceleration Control Unit AEA Aircrew equipment assemblies agl above ground level AIP Aeronautical Information Publication ALARP As low as reasonably practicable AME Aviation Medical Examiner AMOC Alternative Means of Compliance amsl above mean sea level ANO Air Navigation Order ASI Airspeed Indicator ATC Air Traffic Control ATCO Air Traffic Controller ATRE Approved Type Rating Exemption BADA British Air Display Association BCAR British Civil Airworthiness Requirement BKN Broken cloud BPC Barometric Pressure Control BTRU Barostatic Time Release Unit BVCU Bleed Valve Control Unit CAA Civil Aviation Authority CAMO Continuing Airworthiness Management Organisation CAP Civil Aviation Publication CAVOK Ceiling And Visibility OK (for VFR flight) CT Computer tomography DA Display Authorisation DAE Display Authorisation Evaluator EASA European Aviation Safety Agency EEPA Emergency escape parachute assembly EKQ Essential knowledge quiz ESG Emergency Services Group FAA Federal Aviation Administration FACTOR Follow-up Action on Occurrence Report FCC Flying Control Committee FCU Fuel Control Unit FDD Flying Display Director FHT Final Handling Test FSO Flight Standards Officer GA General aviation GAU General Aviation Unit GBASF General Business and Aviation Strategy Forum GNSS Global Navigation Satellite System HF Human factors hp horse power HPSOV High pressure fuel shut-off valve HSE Health and Safety Executive HSL Health and Safety Laboratory IAS Indicated airspeed ICAO International Civil Aviation Organisation ICAS International Council of Air Shows JPT Jetpipe temperature kg Kilogram KIAS Indicated airspeed in kt km Kilometre kt knot m metre MAA Military Aviation Authority MEP Multi-engine piston MOD Ministry of Defence MPAUM Maximum permitted all-up mass MPD Mandatory Permit Directive

xiii Glossary of Abbreviations Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 GLOSSARY OF ABBREVIATIONS USED IN THIS REPORT Glossary of abbreviations nm nautical mile NPF National Permit to Fly OCM Organisational Control Manual OEM Original Equipment Manufacturer OVC Overcast cloud PFL Practice Forced Landing PSP Personal survival pack QFE altimeter pressure setting to indicate height above aerodrome QFI Qualified Flying Instructor QMS Quality Management System QNH altimeter pressure setting to indicate elevation amsl QRF Quick release fitting RAF Royal Air Force RAFA Royal Air Force Association RAFCAM Royal Air Force Centre of Aviation Medicine RSMS Regulatory Safety Management System SB Special Bulletin SEP Single-engine piston SERA Standardised European Rules of the Air SMS Safety Management System SOAP Spectrographic Oil Analysis Programme SPFH Seat Pan Firing Handle SSP State Safety Programme STAMP Systems Theory Accident Modelling and Process TP Test Pilot UAV Unmanned aerial vehicle UTC Co-ordinated Universal Time (GMT) VFR Visual Flight Rules

Intentionally left blank

1 Introduction and Summary Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Introduction and Summary Air Accidents Investigation Branch Aircraft Accident Report No: 1/2017 Registered Owner and Operator Canfield Hunter Ltd Aircraft Type Hawker Hunter T7 Nationality British Registration G-BXFI Place of accident A27, Shoreham Bypass, at the junction with Old Shoreham Road, North of Shoreham Airport Date and Time: 22 August 2015 at 1222 hrs (Times in this report are UTC1 unless stated otherwise) Introduction The accident was reported to the Air Accidents Investigation Branch by Shoreham Air Traffic Control. In exercise of his powers, the Chief Inspector of Air Accidents ordered an investigation to be carried out in accordance with the Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 1996 and the European Regulations EU996/2010 on the investigation and prevention of accidents and incidents in civil aviation. The sole objective of the investigation under these Regulations is the prevention of accidents and incidents and not the apportioning of blame or liability. The AAIB dispatched a team of investigators and support staff to the accident scene to commence an investigation immediately. 1 Coordinated Universal Time.

2 Introduction and Summary Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Introduction and Summary Summary At 1222 UTC (1322 BST) on 22 August 2015, Hawker Hunter G-BXFI crashed on to the A27, Shoreham Bypass, while performing at the Shoreham Airshow, fatally injuring eleven road users and bystanders. A further 13 people, including the pilot, sustained other injuries. The AAIB investigation considered the circumstances in which the aircraft came to be in a position from which it was not possible to complete its intended manoeuvre, and the reasons for the severity of the outcome. The AAIB recognises that as well as being enjoyed by large numbers of spectators and participants, flying displays are also considered to provide important economic and educational benefits2. A safe flying display relies on the training and experience of the participating pilots, the airworthiness of the aircraft, and the planning and risk management of the event. Regulations, guidance and oversight provide the framework for these activities. The aircraft was carrying out a manoeuvre involving both a pitching and rolling component, which commenced from a height lower than the pilot’s authorised minimum for aerobatics, at an airspeed below his stated minimum, and proceeded with less than maximum thrust. This resulted in the aircraft achieving a height at the top of the manoeuvre less than the minimum required to complete it safely, at a speed that was slower than normal. Although it was possible to abort the manoeuvre safely at this point, it appeared the pilot did not recognise that the aircraft was too low to complete the downward half of the manoeuvre. An analysis of human performance identified several credible explanations for this, including: not reading the altimeter due to workload, distraction or visual limitations such as contrast or glare; misreading the altimeter due to its presentation of height information; or incorrectly recalling the minimum height required at the apex. The investigation found that the guidance concerning the minimum height at which aerobatic manoeuvres may be commenced is not applied consistently and may be unclear. There was evidence that other pilots do not always check or perceive correctly that the required height has been achieved at the apex of manoeuvres. Training and assessment procedures in place at the time of the accident did not prepare the pilot fully for the conduct of relevant escape manoeuvres in the Hunter. Footnote 2 Response of the Royal Aeronautical Society to the CAA air display charges consultation, 29 February 2016.

3 Introduction and Summary Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Introduction and Summary The manoeuvre was continued and the aircraft struck the ground on the northern side of the westbound carriageway of the A27 close to the central reservation with a ground track at a slight angle to the direction of the road. When it struck the ground it broke into four main sections. Fuel and fuel vapour released from the fuel tanks ignited. In its path were vehicles that were stationary at, or in the vicinity of, the traffic lights at the junction with the Old Shoreham Road, and pedestrians standing by the junction. The pilot did not attempt to jettison the aircraft’s canopy or activate his ejection seat. However, disruption of the aircraft due to the impact activated the canopy jettison process and caused the ejection seat firing mechanism to initiate. The seat firing sequence was not completed due to damage sustained by its firing mechanism during the impact. The seat was released from the aircraft and the pilot was released from the seat as a result of partial operation of the sequencing mechanism. Some of the pyrotechnic cartridges remained live and were a hazard to first responders until they were made safe. The investigation found that the aircraft appeared to be operating normally and responding to pilot control inputs until it impacted the ground. Defects in the altimeter system would have resulted in the height indicated to the pilot being lower than the actual aircraft height at the apex of the manoeuvre. Information included in a previous AAIB report indicated that there had been several cases involving the type of engine fitted to this aircraft where an un-commanded reduction in engine speed had occurred and subsequent engineering investigation did not establish a clear cause. This investigation was unable to determine whether a reduction in engine speed recorded during the accident manoeuvre was commanded by the pilot. The aircraft’s engine was subject to a Mandatory Permit Directive (MPD) which imposed a calendar life on the engine type, and provided an option to extend that life using an Alternative Means of Compliance (AMOC). Proposals for an engine life extension using an AMOC inspection programme had to be approved by the regulator. Related tasks were being conducted by the maintenance organisation, but the regulator had not approved the operator or its maintenance organisation to use an AMOC to this MPD. The investigation found that defects and exceedences of the aircraft’s operational limits had not been reported to the maintenance organisation, and mandatory requirements of its Airworthiness Approval Note had not been met. During prolonged periods of inactivity the aircraft’s engine had not been preserved in accordance with the approved maintenance schedule. The investigation identified a degraded diaphragm in the engine fuel control system, which could no longer be considered airworthy. However, the engine manufacturer concluded it would not have affected the normal operation of the engine.

4 Introduction and Summary Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Introduction and Summary The aircraft had been issued with a Permit to Fly and its Certificate of Validity was in date, but the issues identified in this investigation indicated that the aircraft was no longer in compliance with the requirements of its Permit to Fly. The investigation found that the parties involved in the planning, conduct and regulatory oversight of the flying display did not have formal safety management systems in place to identify and manage the hazards and risks.  There was a lack of clarity about who owned which risk and who was responsible for the safety of the flying display, the aircraft, and the public outside the display site who were not under the control of the show organisers.  The regulator believed the organisers of flying displays owned the risk. Conversely, the organiser believed that the regulator would not have issued a Permission for the display if it had not been satisfied with the safety of the event.  The aircraft operator’s pilots believed the organiser had gained approval for overflight of congested areas, which was otherwise prohibited for that aircraft, and the display organiser believed that it was the responsibility of the operator or the pilot to fly the aircraft’s display in a manner appropriate to the constraints of the display site.  No organisation or individual considered all the hazards associated with the aircraft’s display, what could go wrong, who might be affected and what could be done to mitigate the risks to a level that was both tolerable and as low as reasonably practicable.  Controls intended to protect the public from the hazards of displaying aircraft were ineffective. The investigation identified the following causal factors in the accident: ● ● The aircraft did not achieve sufficient height at the apex of the accident manoeuvre to complete it before impacting the ground because the combination of low entry speed and low engine thrust in the upward half of the manoeuvre was insufficient. ● ● An escape manoeuvre was not carried out, despite the aircraft not achieving the required minimum apex height. The following contributory factors were identified: ● ● The pilot either did not perceive that an escape manoeuvre was necessary, or did not realise that one was possible at the speed achieved at the apex of the manoeuvre. ● ● The pilot had not received formal training to escape from the accident manoeuvre in a Hunter and had not had his competence to do so assessed.

5 Introduction and Summary Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Introduction and Summary ● ● The pilot had not practised the technique for escaping from the accident manoeuvre in a Hunter, and did not know the minimum speed from which an escape manoeuvre could be carried out successfully. ● ● A change of ground track during the manoeuvre positioned the aircraft further east than planned producing an exit track along the A27 dual carriageway. ● ● The manoeuvre took place above an area occupied by the public over which the organisers of the flying display had no control. ● ● The severity of the outcome was due to the absence of provisions to mitigate the effects of an aircraft crashing in an area outside the control of the organisers of the flying display. The AAIB has published three Special Bulletins (SB) highlighting areas of concern that required timely consideration.

SB 3/2015, published on 4 September 2015, 13 days after the accident, reported initial information about the occurrence.

SB 4/2015, published on 21 December 2015, dealt with the safety of first responders to the accident scene, the maintenance of ejection seats in historic ex-military aircraft and issues regarding the maintenance of ex-military aircraft on the UK civil register. Seven Safety Recommendations were made.

SB 1/2016, published on 10 March 2016, considered the risk management of flying displays, minimum display heights and separation distances, regulatory oversight and piloting standards. It contained a further 14 Safety Recommendations, and was published to inform the air display community ahead of the 2016 air display season. A further 11 Safety Recommendations are made in this report.

Intentionally left blank

7 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1 Factual Information 1.1 History of the flight 1.1.1 Background The pilot was interviewed on seven separate occasions by the AAIB after the accident. Because of his injuries, these interviews were conducted in accordance with restrictions advised by his doctors. In order to comply with these restrictions the AAIB was not able to question the pilot on his conduct of the accident flight. He did not recall events between the evening of Wednesday 19 August 2015 and regaining consciousness in hospital after the accident. Consequently, although he was able to describe his normal practice, he was not able to describe events on the day of the accident. The aircraft was fitted with two image recording devices (‘action cameras’) in the cockpit. These provided a significant amount of information about the accident flight. Recordings of other flying displays flown by the same pilot were also analysed, including manoeuvres similar to the accident manoeuvre. 1.1.2 The display – general preparation The pilot stated that normally he prepared the evening before a display by reading his ground-school notes which described the operation of the aircraft and the limitations to be observed. He would liaise with the engineering staff at the aircraft’s North Weald base to have it checked and refuelled as he required, and provide timings to ensure everything was ready in good time. Daily engineering checks would be carried out and signed by the maintenance engineers. The pilot carried out his own pre-flight inspection and cockpit preparation. After he strapped in, all the ejection seat safety pins would be removed before engine start. The pilot planned a sequence of aerobatic manoeuvres which could be modified for local considerations such as weather. An annotated map showing his intended sequence of manoeuvres was found in his pocket after the accident (see Figure 17). He described one of the manoeuvres he planned for the Shoreham Airshow as a ‘bent loop’ (see Section 1.18.1). This would be preceded by a flypast and Derry Turn, with the aircraft positioning in a left turn back towards the crowd line. His display in the Hunter at Shoreham in 2014 commenced with similar manoeuvres, during which he extended the left turn to go west around Lancing College. From that position it was necessary to bend the loop more than he wished, so in 2015 he planned to turn between the aerodrome and the College.

8 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The aircraft’s airspeed at entry to the ‘bent loop’ was to be a minimum of 350 KIAS, and if the airspeed was less than this the manoeuvre would not be attempted. If the airspeed was at least 350 KIAS, the nose would be pitched up and maximum thrust set. Approaching the vertical in the subsequent climb, the aircraft would be rolled to the left to arrive at the apex inverted with an airspeed of about 150 KIAS. The pitch rate would be judged during the climb to ensure that a minimum ‘gate’ height of 4,000 ft was achieved at the apex. This gate height was the sum of 3,000 ft, needed to carry out the downward half of the loop, his minimum authorised height of 500 ft for conducting aerobatics in a Hunter, and an additional 500 ft as a safety margin. The pull-through from the apex would allow the aircraft to accelerate, the heading to be controlled to obtain the correct track for the next manoeuvre, and the pitch rate to be adjusted to achieve the required height. 1.1.3 The accident flight On the day of the accident the pilot was scheduled to carry out his sequence of aerobatic manoeuvres in the Hawker Hunter aircraft at the Royal Air Force Association (RAFA) Airshow at Shoreham Airport in Sussex. He had flown his light aircraft to North Weald Airfield in Essex where the Hunter was based. The daily inspection had been carried out the previous afternoon by an engineer and the pilot carried out a pre-flight inspection on the day. He requested that the aircraft was fully fuelled and this was carried out by the two ground crew. The pilot was described as being in good spirits and looking forward to the flight. With preparations complete, the pilot seated himself in the left seat and secured his harness before donning his helmet. The ground crew noticed that all the ejection seat and system safety pins had been removed from their safety positions, making the seats and system ‘live’, and were in their dedicated stowage. The engine start appeared normal and the pilot decided to take off from Runway 02, which had a downslope and a tailwind. After taxiing along Runway 12, the aircraft backtracked Runway 02 and lined up for departure. The weather was good. The nearest official weather station, at Stansted, recorded a surface wind from 150° at 14 kt, no cloud below 5,000 ft, visibility more than 10 km, temperature 28°C, dewpoint 16° C and QNH1 1014 hPa. The aircraft departed at 1204 hrs. The takeoff run was longer than usual due to the high air temperature and tailwind, and the pilot raised the nose of the aircraft to begin the lift-off at 112 KIAS instead of the 120 KIAS he would use normally. Once airborne, the aircraft flew towards the south coast east of Shoreham. 1 QNH is the reference barometric pressure set on an altimeter in order to display height above mean sea level, or altitude.

9 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The flight south was uneventful and the aircraft carried out a left-hand orbit over the sea near Brighton between 1,800 ft and 2,500 ft. The pilot was then cleared to commence his display and, remaining offshore, flew west along the coast towards Shoreham Airport. At 1220 hrs Shoreham Airport reported wind from 120° at 12 kt, with no significant cloud and visibility of more than 10 km.  The temperature was 24° C, dewpoint 17° C and QNH 1013 hPa.  The pilot flew parallel to the coast in a gradual descent during which he flew inverted briefly, probably to check that there were no loose articles in the cockpit before his display. Having rolled upright and wings level, the aircraft descended to 800 ft and made a right turn to line up with the display line to the west of Runway 02/20 at Shoreham. The aircraft remained right wing low with the angle of bank decreasing as it descended to 100 ft and flew along the display line. It then commenced a gentle climbing right turn, executed a Derry Turn (Figure 1) to the left which peaked at 1,800 ft, then entered a descending left turn to approximately 185 ft agl, approaching the display line at an angle of about 25º. Figure 1 An illustration of a flat Derry Turn With the aircraft in a right turn, the pilot stops the pitch rate, rolls the aircraft to the right through the inverted, stops the roll at the required bank angle and pulls into a turn to the left.

10 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The aircraft then pitched up into the accident manoeuvre at an indicated airspeed of approximately 310 KIAS and with an engine speed of approximately 7,500 rpm2. As it approached the vertical, the pilot initiated a roll to the left. In the climb the engine speed first reduced, then increased to about 7,200 rpm, then reduced again nearing the apex. The aircraft was almost inverted with its wings level at the apex, at a height of approximately 2,700 ft. During the subsequent descent, its ground track was aligned to the west along the A27, Shoreham Bypass. As it descended it accelerated and the nose was raised but insufficient height was available to recover to level flight before it contacted the westbound carriageway of the A27. Figure 2 Illustration of the accident manoeuvre (This is not a precise depiction of the aircraft’s behaviour or flightpath) Action camera recordings appeared to show that throughout the flight the pilot was conscious and that the aircraft was responding to his control inputs. Engine instruments that were visible did not indicate any engine malfunctions. 2 The maximum permitted engine speed is 8,100±50 rpm.

11 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.2 Injuries to persons Injuries Crew Passengers Others Fatal

11 Serious* 1

1 Minor

11

• ICAO Annex 13 and Regulation (EU) 996/2010 define a ‘serious injury’ as:

An injury which is sustained by a person in an accident and which: a) requires hospitalization for more than 48 hours, commencing within seven days from the date the injury was received; or b) results in a fracture of any bone (except simple fractures of fingers, toes or nose); or c) involves lacerations which cause severe haemorrhage, nerve, muscle or tendon damage; or d) involves injury to any internal organ; or e) involves second or third degree burns, or any burns affecting more than 5 per cent of the body surface; or f) involves verified exposure to infectious substances or injurious radiation. 1.3 Damage to the aircraft The aircraft was destroyed. 1.4 Other damage The aircraft crashed on the A27, Shoreham Bypass and impacted a number of occupied vehicles, pedestrians, street furniture, and vegetation on the roadside verge. The road surface and surrounding vegetation were affected by fire, heat and the effects of fuel. A pool of fuel and oil was present on the ground by the main wreckage.

12 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.5 Personnel information 1.5.1 Commander Age: 51 years Licence: Airline Transport Pilot’s Licence / Private Pilot’s Licence Aircraft Rating: Aircraft Type Rating Exemption3 valid to 27 August 2015 Medical Certificate: Class 1 medical certificate valid to 31 January 2016 Display Authorisation: Valid to 24 July 2016 Two-yearly check: Valid to 23 March 2016 Flying experience: Total hours

• 14,249 hours

On type

43 hours

Last 90 days - 115 hours

Last 28 days - 53 hours 1.5.1.1 Career history Military flying The pilot joined the Royal Air Force (RAF) in 1985 and flew Jet Provost, Hawk and Harrier jet aircraft. He was a Qualified Flying Instructor (QFI) on the Jet Provost between 1988 and 1990. In his RAF Pilot’s Log Book, he had recorded his total flying time in military jet aircraft as: Jet Provost MK 3A/5A

934 hours Hawk MK1/1A

188 hours Harrier T4/GR3, GR5/7 - 517 hours Civil flying The pilot left the RAF in 1994 having obtained a UK Civil Aviation Authority (CAA) Flying Instructor rating. He instructed on a range of single-engine piston aeroplanes before joining an airline to operate commercial jet transport aircraft which he continued to fly up to the time of the accident. In 2003 he began flying a Jet Provost ex-military training aircraft in the civilian environment, operating from its base at North Weald. He completing one or two familiarisation flights and a check flight with the operator’s Chief Pilot. Later he began instructing civilian pilots on Jet Provost aircraft. 3 See Section 1.5.1.3, below Table 1.

13 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information In 2005 he bought a self-build RV-8 aircraft, which he completed in the autumn of 2007. He used it extensively for recreational purposes and also to fly between his home and North Weald for Jet Provost training. In 2008 he commenced display flying in an RV-8 single-engine piston aircraft. He carried out some formation aerobatics with an experienced display pilot and obtained his first display authorisation (DA) in October 2008, valid for intermediate solo aerobatics and as a formation member. The formation was normally led by another pilot and a sequence of manoeuvres was trained and practised. He was also a formation instructor with another organisation at North Weald, and had set up a formation flying school using various RV aircraft. 1.5.1.2 Use of speed and height ‘safety gates’ in military flying The pilot began training for aerobatic display flying with the RAF in 1989 when he was a QFI on the Jet Provost. He described the ‘safety gates’ he used when flying the Jet Provost aircraft as follows: ‘When flying aerobatic manoeuvres in the Jet Provost the safety gate was a height and airspeed. In certain manoeuvres, such as a barrel roll, this was critical.  The loop was less so because the safety gate height was below the minimum height achievable after a normal ‘pull up’.  With the barrel roll, the entry airspeed was the first safety gate followed by the nose attitude after rolling 180 degrees.  The nose must not be below the horizon and a certain height and airspeed otherwise an unusual position recovery would have to be flown.  Generally there was not a safety gate at altitude, but there was at the lower levels used for display flying.  For a loop at a lower level, the minimum entry speed was 220 knots and the apex height for the pull through was 2,200 feet plus the height above the surface by which the manoeuvre had to be completed.’ ‘If the aircraft did not achieve the safety gate, it was effectively in an unusual position and a recovery manoeuvre must be flown. Three classic types of unusual position recovery were taught in the Jet Provost in the RAF, these were:

With a nose high attitude and airspeed low, check the height, select full power and roll upright to the wings level and lower the nose to the horizon.

With a nose low attitude and airspeed increasing, select engine to idle, airbrake out if required e.g. 200K or more and roll upright to wings level before pulling the nose up to the horizon.

14 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information

With a high nose attitude and airspeed below or going below 100 knots, leave the power set and place both hands on the control stick and hold central.  Brace the rudders and wait for the nose to drop and follow the nose attitude low, airspeed increasing recovery. Do not pull through if the safety gate height has not been achieved but follow the unusual position recovery actions to ‘unload’ any ‘g’ forces, roll rapidly to nearest horizon, and pull to a straight and level attitude.’ His technique for performing a loop in the Jet Provost was to increase g4 slowly with full power and no flap selected. The g-meter5, or accelerometer, could be used to calibrate the pilots ‘feel’ for the manoeuvre. The pilot had built up a sequence of aerobatic manoeuvres in the Jet Provost that could be adapted for a particular venue, wind or obstructions. This was written down but he commented that he would not be looking at it during a display. The pilot could not remember any of the heights and speeds used when he flew the Harrier aircraft in the RAF. Aerobatics were not a significant part of flying the Harrier except as part of general handling and as a ‘building block’ for air combat manoeuvring. 1.5.1.3 Hunter flying In 2011 the pilot began training to fly the Hunter with a display team. In order to do so he was required to hold an Aircraft Type Rating Exemption (Training). This was issued on 19 May 2011 and was valid until 18 May 2012. He carried out self-study and his instructor delivered ground training using the Hunter Aircrew Manual and Flight Reference Cards. He made five training flights, three following formation flying as a display team. The fourth was a formation transit during which the pilot conducted the majority of the handling. The fifth was a dedicated single aircraft ‘Final Handling Test’ (FHT). His log book entries are shown at Table 1 below, with his recollection of his participation during each sortie shown in italics. 4 Objects experience acceleration, the magnitude of which depends on the force acting on them. An object accelerated by Earth gravity will experience zero-g if in free fall, or 1 g if stationary on the Earth’s surface (because the surface of the Earth is acting to restrain the object from falling further). Accelerations of more or less than 1g may be experienced by a pilot manoeuvring an aircraft. The pilot of an aircraft in straight, level flight will experience 1 g, whereas the pilot of an aircraft in a level turn banked at 60° will experience 2 g. A tighter turn will increase the g still further. The magnitude of g can also be increased by pitching the nose of the aircraft up, such as would occur in a loop. 5 A g-meter measures the normal acceleration experienced by an aircraft. A further description is given in Section 1.6.8.1.

15 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information DATE REG TYPE CAPT P1/2 Hrs/Min NOTES 26/05/11 G-BXFI Hunter T7 CP/INSTR P U/T 0:50 4 Ship formation aerobatics (1 Overshoot, 1 landing) ‘Familiarisation, checks, Taxi. (Demonstration Practice Forced Landing (PFL)) to overshoot, circuit/ Landing.’ 27/05/11 G-BXFI “ “ “ 0:50 5 Ship display practice Yeovilton (PFL, overshoot, 1 landing ‘Checks, taxi, PFL to overshoot, circuit/ landing.’ 27/05/11 G-VETA “ INSTR “ 0:40 5 Ship display practice Yeovilton ‘Checks, taxi, little if any flying handling.’ 27/05/11 G-BXFI “ CP/INSTR “ 0:40 5 Ship formation aerobatics (Vic takeoff, formation, DA, 1 landing). ‘Checks, taxi, takeoff, majority handling, circuit/ landing, formation member ‘flypast’ DA, Vic/LA + changes.’ 03/06/11 G-BXFI “ “ “ 1:05 FHT/DA (2) ‘Solo ‘Standard’ aerobatics DA. Manual flying, slow speed flight, Chivenor: PFL, manual circuit, flapless circuit, normal circuit, emergencies and navigation.’ Table 1 The accident pilot’s Log Book entries covering his training flights and associated recollections.

16 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Following the successful completion of his FHT, the team’s instructor/examiner signed the pilot’s Approved Type Rating Exemption (ATRE) application form. The ATRE was issued on 8 June 2011 and was valid until 7 June 2012. The Chief Pilot also logged four further continuation training flights with the accident pilot; two on 18 June 2011 and two on 18 September 2011, totalling 2 hours and 40 minutes. The renewal of the ATRE was issued on 28 June 2012 and valid until 27  June  2013. The renewal was based on the applicant having a current licence and not on any specific flight training or checking requirement. Further renewals were on the same basis. The renewal of the Hunter ATRE current at the time of the accident was approved on 27 August 2014 and valid until 27 August 2015. 1.5.1.4 Pilot’s display authorisation A pilot must hold a DA or an exemption from holding a DA in order to take part in a flying display. Civil Aviation Publication (CAP) 403 - ‘Flying displays and special events: A guide to safety and administrative arrangements’ Edition 13, in use at the time of the accident6, defined a DA as: ‘A national document detailing the types or groups of aircraft in which a pilot is authorised to display, together with any limitations and any other specific endorsements.’ CAP 403 defined a Display Authorisation Evaluator (DAE) as: ‘A CAA authorised person qualified to conduct examinations and tests for the award of a DA.’ The aircraft operator’s Chief Pilot renewed the pilot’s DA on 12 September 2014. The assessment was conducted using a pair of Jet Provost aircraft flying in formation, with the Chief Pilot leading and the accident pilot following throughout an aerobatic display sequence. 6 Unless stated otherwise, this report refers to CAP 403 Edition 13, published in February 2015. Since the accident, and at the time of publication of this report, there have been 4 amendments to Edition 13, the latest of which was published on 6 June 2016.

17 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The DAE made the following assessment: ‘Flew as No 2 in a pair’s aerobatic display during the September Duxford Airshow. All aspects of close formation were smooth accurate and formation changes crisp, safe and correct. The tail chase element was again well flown with good positioning and rule following. A safe, smooth, well executed display.’ By following a lead aircraft the pilot did not have the opportunity to demonstrate his ability to perform solo aerobatic manoeuvres in terms of safety gates, speeds, flying technique and observing minimum height requirements, nor his ability to position the aircraft correctly with respect to the display line. During his most recent DA evaluation, on the 24 June 2015, flown in the RV-8, the pilot demonstrated his ability both to lead and to follow another aircraft in a formation aerobatic display sequence. The DAE’s assessment was: ‘Formation leading and following demonstrated with 2xRV8’s. Manoeuvres included flypasts, wingovers, loops and Cubans. All leading flown smoothly and precisely as was the “following”. Evaluation completed at Duxford’ In the section of his assessment entitled ‘Mentoring (enter details of mentoring completed)’, the DAE stated: ‘Importance of mentoring and continuous monitoring discussed.’ Pilots may hold a DA for various categories and types of aircraft. The RV-8, an aircraft with a single piston engine of less than 200 hp, was in ‘Category A’. The swept-wing Hunter and straight-wing Jet Provost were in ‘Category G’, for single jet aeroplanes specified by type. His DA also authorised him to display ‘Category B’ aircraft with a single piston engine between 200 and 600 hp.

18 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The pilot’s DA, current at the time of the accident, is shown in Table 2. Categories, Types Authorised & Minimum flypast height Formation member Formation leader Tailchase leader Tailchase member Aerobatic category & minimum height A/50ft A4 A4 Yes Yes I/200ft G (Jet Provost)/50ft A4 A4 Yes Yes I/200ft B/50ft A4 A4 Yes Yes U/200ft G (Hunter)/100ft A4 A4 Yes Yes S/500ft G (L-29 Delphin) /100ft A4 A4 Yes Yes S/500ft Table 2 The pilot’s DA at the time of the accident ‘S’ – standard, ‘I’ – intermediate, ‘U’ – unlimited level aerobatics as defined in CAP 403 ‘A4’ – advanced formation manoeuvring, with no limit to bank angle or pitch angle, involving close formation of up to 4 aircraft. Under the regime that existed at the time, the pilot was able to renew his DA for all of the categories by renewing his DA in one of them. Consequently the DA evaluation he conducted in the RV-8 also renewed his DA for the Hunter and Jet Provost. 1.5.1.5 Displays and display practices Table 3 below shows the number of display practices and actual displays flown in the Hunter by year, based on records provided by the pilot: Type 2011 2012 2013 2014 2015 Total Display Practices 3 5 0 2 1 11 Displays 4 3 0 2 5 14 Table 3 The accident pilot’s Hunter displays and display practices by year Records indicated that the pilot had flown a total of 19 hours and 25 minutes in the Hunter during flying displays, including transit time.

19 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Table 4 shows the pilot’s recorded Hunter practice and display flights in 2015, five of which took place in G-BXFI, the other in G-BVGH: Date Location Type Flight Time Hr/Min 25 May 2015 Duxford Practice 0:50 04 June 2015 Norwich Display 1:05 21 June 2015 Weston-super-Mare Display 0:45* 18 July 2015 Shannon Display 0:30 19 July 2015 Bray Display 1:10 08 August 2015 Bruntingthorpe Display 1:05 Table 4 The accident pilot’s 2015 Hunter displays and display practice

• This display was a flight during which the pilot flew in formation with another aircraft,

and did not involve solo aerobatics. Following his Hunter display on 8 August 2015, the pilot carried out a further nine displays in the two weeks prior to the accident flight, seven in the RV-8 and two in the Jet Provost (a Mk 5 version, denoted ‘JP5’). Table 5 shows the order in which the types were displayed. DATE REGISTRATION TYPE FLIGHT TIME Hr/Min LOCATION 9 August 2015 G-HILZ RV-8 0:40 Blackpool 10 August 2015 G-HILZ RV-8 0:40 Blackpool 14 August 2015 G-HILZ RV-8 1:25 Eastbourne 15 August 2015 G-BWSG JP5 0:40 Eastbourne 15 August 2015 G-HILZ RV-8 1:25 Herne Bay 16 August 2015 G-BWSG JP5 0:40 Eastbourne 16 August 2015 G-HILZ RV-8 2:20 Whitstable and Eastbourne 19 August 2015 G-HILZ RV-8 No time recorded Broadstairs Table 5 Display flights since the last Hunter display

20 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.5.1.6 Minimum display heights CAP 403 sets out the requirements for minimum heights during displays. Edition 13 stated: ‘Minimum heights during displays’ 5.58 ‘All aerobatic manoeuvres, including inverted flypasts, and manoeuvres which involve pulling through the vertical are to be executed above the approved aerobatic display height. Descent below the approved aerobatic display height to the approved fly-by height is permitted once certain of capturing the aerobatic display height. Slow speed, high angle of attack flypasts are regarded as aerobatic manoeuvres from the minimum height point of view.’ The pilot’s DA stipulated a minimum height of 500 ft for aerobatics in the Hunter. 1.5.1.7 Flying display emergency manoeuvres CAP 403 provided the following guidance for DAEs conducting the oral element of the evaluation of a candidate to establish their aerobatic display management and response to emergencies: ‘5.17 (c) Require the applicant to describe the sequence of the display which he intends to demonstrate. Discuss the logic of his sequence, energy management of manoeuvres, the planning of the manoeuvres in relation to the aircraft limitations, the effects of density altitude, the effects of surface and upper winds and how to adjust the sequence to compensate for external constraints. 5.17 (d) discuss the applicant’s emergency planning for items such as awareness and avoidance of inadvertent stalls/spins, engine or system failures, key heights and speeds and actions if these are not achieved and changes in weather during the display.’ The operator’s Chief Pilot could not remember the detail of what he discussed with the accident pilot when he conducted his DA evaluation but believes he would have considered emergencies and may have given the pilot a simulated emergency at some point during the aerobatic sequence. He stated that he might have introduced a simulated hydraulic system failure at the apex of a loop, the correct response to which would be to roll the aircraft upright immediately. He could not remember if he had introduced this emergency at that moment with the accident pilot. The accident pilot could not recall this or other simulated emergencies during aerobatics.

21 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The accident pilot was aware of the technique for performing a rolling escape manoeuvre at low speeds in other aircraft (his description of which appears in Section 1.5.1.2 above), and the importance of reducing the g loading on the wing until a safe speed was achieved. He had not practised this escape manoeuvre in the Hunter and commented that he would not be sure of the outcome of attempting it at the speed (105 KIAS) achieved at the apex of the accident manoeuvre. 1.5.1.8 Pilot recency requirements CAP 403 Edition 13 set out the recency requirements for display pilots, as follows: ‘In addition to a valid Certificate of Test and Competence, a Display Pilot is required to meet certain recency requirements before his DA is valid. In the 90 days preceding a demonstration at a flying display for which an Article 162 Permission is required, a minimum of three full display sequences must have been flown or practised, with at least one display sequence flown or practised in the specific type of aircraft to be displayed.’ In the 90 days preceding the accident flight, the pilot had flown a total of 33 displays or practice displays: 22 in the RV-8, five in the Jet Provost and six in the Hawker Hunter; exceeding the minimum recency requirements in both total displays and displays on type. An RAF display pilot is required to have flown two displays or practice displays in a specific type in the eight days preceding a public display. 1.5.2 The Flying Display Director CAP 403 described a Flying Display Director (FDD) as ‘The person responsible to the CAA for the safe conduct of a flying display’. The Shoreham FDD had been responsible for previous flying displays, was a display pilot and DAE, and was formerly Head of the CAA General Aviation Department. The organiser of the flying display indicated that it had selected the FDD for his “significant experience in running air displays and his wide recognition within the air display community”.

22 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.5.3 The Flying Control Committee CAP 403 ‘strongly recommends’ that there is a Flying Control Committee (FCC) for displays of seven or more items. It described the FCC’s role as: ‘a) to assist the FDD in monitoring display standards; b) to provide specialist knowledge for specific display items; and c) to offer in-depth opinion in the case of infringement of the regulations.' CAP 403 stated that the FCC should have: ‘…the clear authority of the Event Organiser to curtail or stop, on the grounds of safety, any display item or, in extreme cases, the whole flying display.’ The FCC at Shoreham consisted of four experienced pilots located on or near the appropriate display lines. The FDD stated that the Shoreham FCC had the written authority of the event organiser to override the FDD on any flight safety related matter and to stop any part, or all, of the flying display on the grounds of public safety.

1. 6

Aircraft information 1.6.1 General Manufacturer: Hawker Aircraft Ltd Type: Hunter T7 Manufacturers serial number: 41H-670815 Year of manufacturer: 1955 as a single-seat Hunter but modified to a two-seat T7 in 1959 Total airframe hours: 5,976 at 22 August 2015 Engine: Rolls-Royce Avon Mk 122 Certificate of Validity valid to: 10 March 2016 (issued by the maintenance organisation) Certificate of Registration No: G-BXFI/R7 (issued by the CAA)

23 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.6.2 Aircraft description The Hawker Hunter T7 is a single-engine, swept-wing, military jet trainer capable of speeds close to the speed of sound. G-BXFI was built in 1955 as a single‑seat aircraft, but was modified in 1959, with two pilot seats installed side‑by-side, to become a T7 two-seat trainer. Both pilot positions were fitted with ejection seats. It was transferred to the civil register in 1997. Figure 3 Hawker Hunter G-BXFI (Photo courtesy N Watkin) 1.6.3 Standard configuration Standard aircraft empty weight: 6,087 kg / 13,420 lb (including unusable fuel, oils and fluids) Maximum permitted all-up weight: 11,340 kg / 25,000 lb Length overall: 14.9 m Height overall: 4.1m Wingspan: 10.3 m Fuel capacity7: Internal - fuselage and wing, 1,882 litres / 1,505 kg

External - wing drop tanks, 909 litres / 727 kg Maximum speed: 620 kt Load factor limitations: +7 g / -3.75 g

(negative g limited to 10 seconds)

7 Fuel weights in this section assume a nominal specific gravity of 0.8.

24 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.6.4 Flying controls The dual primary flying controls in the cockpit were connected via a series of push-pull rods and bellcranks to their respective control surfaces. The ailerons and elevator were hydraulically power-assisted with manual backup in the event of hydraulic failure. Spring units were fitted to provide ‘feel’ to the pilot when operating in powered mode. The variable incidence tailplane was electrically operated and had a pilot-selectable follow-up trim interconnection to the elevator. The manual aileron trim position indicator was recorded as being unserviceable. 1.6.5 Flaps The aircraft was equipped with hydraulically-operated, electrically-controlled split flaps which could be selected to one of eight positions by the pilot. The ‘Hunter T Mk 7 & 7A aircrew manual’, reference AP 101B-1302 & 3-15 (referred to as the Aircrew Manual), Part 2, Chapter 2 – ‘Airframe limitations’, pages 2 and 3, states: ‘4 Speed The maximum permitted speeds are: … (e) Flaps

Up to 38° … … … … … … … 300 knots/0.9M

Full

… … … … … … … … 250 knots’ Section 3 of the Aircrew Manual, Part 3, Chapter 2 – ‘Handling in flight’, paragraph 3(f) states: ‘If the IAS limitations for the use of flaps are inadvertently exceeded, the flap angle is limited according to the air load to prevent damage, but sufficient flap is extended to create a strong nose‑down change of trim. This can result in elevator jack stalling and tailplane actuator clutch slip. In this event not only is longitudinal control lost but the aircraft cannot be trimmed nose‑up by either the main or the standby systems. In extreme cases, the air loads may then force the tailplane to move in opposition to the actuator thereby causing an additional nose-down change of trim.’

25 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.6.6 Hydraulic system The aircraft’s hydraulic system was powered by an engine-driven pump mounted on the accessory gearbox. It provided hydraulic power to systems including the ailerons and elevator, landing gear, flaps and air brake. An alternative means of operation was provided in the event of a hydraulic system failure. A failure of the hydraulic system would have been indicated by the illumination of a red warning light on the instrument panel, an aural warning and low pressure indicated on the hydraulic pressure gauge. 1.6.7 Electrical system The aircraft electrical system provided 24 volt (V), direct current (dc) and 115 V, 3-phase, 400 (Hz) alternating current (ac) supplies for the aircraft systems. It consisted of batteries, engine-driven generators and inverters. The system was designed to provide redundancy in case of component failures. 1.6.8 Instruments 1.6.8.1 Accelerometer (g-meter) G-BXFI was equipped with an accelerometer, or ‘g-meter’, mounted just above the right instrument panel, displaying acceleration perpendicular to the aircraft’s longitudinal axis using three pointers. The g-meter operates by detecting the movements of a weight, which is suspended on two guide rails and centred by a spring-loaded control cord. When the aircraft manoeuvres, inertia acts upon the weight causing it to ride up and down on the guide rails. This movement is transmitted to the pointers by the control cord via two pulleys. One pointer indicates the instantaneous acceleration, the other two register the maximum positive and negative accelerations respectively. The pointers are reset by pressing a knob on the instrument case. The aircraft was also fitted with a fatigue meter to record the loads applied to the airframe so that the remaining airframe life could be calculated. The fatigue meter was installed in a remote compartment and was not visible to the pilot. The fatigue state was required to be recorded after each day’s flight but the maintenance organisation read and recorded the fatigue state once a year. Between these readings monitoring of fatigue relied on the pilot reporting any high loads seen on the g-meter in the cockpit.

26 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.6.8.2 Pitot-static sensors A pressure head on the leading edge of the left wing tip provided pitot and static pressures for the pressure-operated flight instruments, including the airspeed indicators and altimeters. 1.6.8.3 Airspeed indicators G-BXFI was equipped with two Munro Mk 12A airspeed indicators (ASI), mounted on the left and right instrument panels. One is shown in Figure 4. Figure 4 Munro Mk 12A Airspeed indicator 1.6.8.4 Altimeters General G-BXFI was equipped with a Mk 29B and a Mk 30B Kollsman servo-operated altimeter, mounted on the left and right instrument panels respectively, which received static pressure from the aircraft pressure head. Altimeters display altitude by comparing the pressure within the sealed altimeter case to the pressure inside an aneroid capsule8. As the aircraft climbs and descends, the outside air pressure, and thus the pressure in the altimeter case, changes. The aneroid capsule expands or contracts according to the pressure change. The capsule deflections are converted into rotary motion, by an arrangement of internal gears to drive a pointer on the instrument face and to display the aircraft height. 8 An aneroid capsule is a sealed, evacuated, thin-walled metal capsule.

27 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Altimeters incorporate a means of setting a reference barometric pressure, to correct the instrument for local pressure conditions so that it indicates the height above a particular reference such as sea level or aerodrome elevation. Traditional altimeters can be subject to error and may not respond accurately to rapidly changing altitude, because tiny capsule deflections must overcome friction in the internal gearing to generate large movements of the pointer. Servo‑operated altimeters increase accuracy by using electrical devices such as synchros9 and servo-motors to amplify and convert the mechanical displacement of the capsule into electrical signals and so drive the pointer. A brief description of the altimeter system is presented in the following sections, and a more detailed description can be found in Appendix A. Mk 30B altimeter (mounted on the right) The Mk 30B10 altimeter is a servo-operated altimeter of a type that displays pressure-corrected altitude. It operates as the master altimeter, providing an electrical signal to the left (Mk 29B) altimeter and an encoded signal to the aircraft transponder for altitude reporting. A setting knob, or ‘baro-knob’, at the front of the instrument (see Figure 5), enables the reference barometric pressure to be set on the four-digit millibar (mb) counter. Rotation of this knob corrects the pressure measured by the capsule, and simultaneously rotates the millibar counter, height counter and pointer. The height of the aircraft above the selected reference is indicated by a single‑needle pointer that shows hundreds of feet and makes one complete rotation every 1,000 ft, and by a height counter in the middle of the instrument face that displays height in thousands and hundreds of feet. The encoded altitude signal and the electrical signal sent to the Mk 29B are based on the ‘standard atmosphere’ reference pressure of 1013.25 mb and are not affected by the setting on the millibar counter. In the event of an electrical failure of the Mk 30B, a red/black striped power failure flag is intended to drop into view to obscure the height counter, and the electrical signals to the Mk 29B altimeter and transponder are disconnected. 9 A synchro is an electrical device which converts a mechanical input to an electrical output, or vice versa. It comprises a rotating shaft (rotor) and a fixed case (stator). 10 Mk 30B is the UK military designation for Kollsman altimeter, part number (P/N) L.83261-04-020.

28 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Figure 5 Mk 30B altimeter (barometric pressure setting not as found) Mk 29B altimeter (mounted on the left) The Mk 29B11 left altimeter is a servo-operated altimeter that can also operate as an uncorrected precision pressure altimeter, either automatically or by selection. In normal operation (‘servo mode’), the Mk 29B receives a pressure‑error‑corrected altitude signal from a synchro-transmitter12 in the Mk 30B, so that it gives a more accurate indication of altitude. Operation of the baro-knob is similar to that on the Mk 30B. A standby/reset knob, labelled ‘s’ and ‘r’, on the front of the instrument (see Figure 6) allows manual selection of the standby or servo mode. The knob is spring-loaded to the centre position. When standby (s) is selected, the altimeter reverts to standby operation, an integral 28 V (dc) vibrator motor starts, to help the capsule overcome friction in the internal gearing, and an orange stby flag appears above the height counter. When selected to reset (r) the altimeter resets to servo mode, the vibrator stops and the stby flag clears. When aircraft electrical power is switched off, the Mk 29B reverts to standby mode.

11 Mk 29B is the UK military designation for Kollsman altimeter, P/N L.82621-04-010. 12 In a synchro-transmitter, mechanical input (shaft rotation) is converted to an electrical output.

29 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Figure 6 Mk 29B altimeter in servo mode (left image) and standby mode (right image). Reference barometric pressure setting not as found The Aircrew Manual describes altimeter failure conditions that will cause the Mk 29B to revert automatically to standby operation (see Appendix A), including a failure of the electrical power supply, and gives the following advice to ensure two independent sources of altitude indication are available for critical phases of flight: ‘When the Mk 29B altimeter is being operated in the servo (R) mode, it is possible for a fault in the system to cause both altimeters to indicate the same incorrect height without any warning flag indications. It is recommended, therefore, that the Mk 29B altimeter be selected to standby (S) for take-off and at the beginning of a descent/recovery procedure.’ The Aircrew Manual does not state which altimeter mode should be selected for dynamic manoeuvring flight, but servo mode is the normal operational mode and provides the greatest accuracy. 1.6.8.5 RPM indicator and tacho-generator G-BXFI was equipped with a Smiths Mk 10A rpm indicator gauge, and a Mk 8C engine-driven tachometer generator (or tacho-generator).

The rpm indicator displays the engine rotational speed between 1,200  and 12,000  rpm. The system is self-powered and driven directly by the tacho‑generator, which is mounted on the engine auxiliary gear box.

30 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.6.8.6 Engine exhaust gas thermometer The exhaust gas thermometer provided a continuous indication of engine exhaust temperature, also referred to as Jetpipe Temperature (JPT), from 0 to 1,000°C. 1.6.8.7 Transponder G-BXFI was equipped with a Becker ATC 2000-3-R civilian transponder, which suffered extensive damage during the accident and could not be tested. 1.6.9 Rolls-Royce Avon Mk 122 engine The Rolls-Royce Avon Mk 122 is an axial flow engine which produces a maximum thrust of 7,575 lb at 8,100 rpm. The engine has a 12-stage compressor with variable inlet guide vanes, eight combustion chambers and a two-stage turbine. High pressure air is bled from either the 8th or 12th stage of the compressor to supply aircraft systems. The delivery of bleed air and compressor airflow is controlled by a Bleed Valve Control Unit (BVCU). Fuel supplied by low pressure pumps in the fuselage fuel tanks passes through a fuel filter in the Fuel Control Unit (FCU) before reaching the engine-driven dual-swashplate fuel pump, shown in Figure 7. The supply of high pressure fuel from the pump is controlled by a servo fuel system which consists of a hydro-mechanical governor (within the fuel pump) an Acceleration Control Unit (ACU) and a Barometric Pressure Control (BPC) unit. The FCU contains the high pressure fuel shut-off cock and the fuel metering valve. The fuel metering valve, connected to the throttle levers via a cam box in the fuselage, varies the fuel flow to the fuel nozzle in each combustion chamber to produce the commanded thrust. If the engine exhaust temperature exceeds 690° C the fuel supply to the nozzles is automatically restricted by the solenoid operated Fuel Dip Unit. In military service, when the aircraft had been fitted with a 30mm Aden cannon, the engine was fitted with a Gun Dip system. This restricted the fuel flow to the fuel nozzles when the gun was fired, to prevent compressor surges. This system was deactivated when the cannon was removed from the aircraft during its military service.

31 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information TRANSMITTER PRESSURE UPPER PUMP ISOLATING VALVE SOLENOID DUAL FUEL PUMP DRAIN FUEL COOLED OIL COOLER LOW PRESSURE FILTER H.P. COCK FUEL CONTROL UNIT PRESSURIZING VALVE FUEL DIP UNIT DUPLE BURNER PRIMARY MANIFOLD BAROMETRIC PRESSURE CONTROL DAMPING FLUID TO AIRCRAFT DE-ICING SYSTEM FUEL DE-ICING SWITCH METERING VALVE UNIT DAMPING FLUID PRESSURE TAPPING MAIN MANIFOLD DRAIN HYDRO-MECHANICAL GOVERNOR TEMPERATURE COMPENSATOR TO AIR INTAKE ACCELERATION CONTROL UNIT ATMOSPHERIC PRESSURE INTAKE AIR PRESSURE BLEED VALVE PRESSURE COMPRESSOR DELIVERY PRESSURE SERVO PRESSURE GOVERNOR PRESSURE RESTRICTED PRIMARY PRESSURE BURNER MAIN PRESSURE BURNER PRIMARY PRESSURE THROTTLE INLET PRESSURE H.P. PUMP DELIVERY L.P. FUEL Figure 7 Rolls-Royce Avon 122 fuel control schematic diagram

32 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.6.10 Aircraft fuel system Fuel was carried in twelve internal tanks, four in each wing, and two front and two rear tanks in the centre fuselage. G-BXFI was also fitted with two 100 gallon underwing tanks, constructed from asbestos-reinforced phenolic resin, mounted on the inboard pylons. Fuel was fed to the engine by a booster pump in each front tank. In normal operation the booster pumps were switched on before engine start and remained on until immediately before engine shutdown. Fuel was automatically transferred from the other fuel tanks using pressurised air bled from the engine’s compressor. The system was designed to empty the fuel tanks in the following order: underwing tanks, wing tanks, rear fuselage then forward fuselage. A warning light in the cockpit was intended to illuminate when each forward tank contained less than 650 lb of fuel. 1.6.11 Pilot escape system G-BXFI was equipped with two Martin-Baker Mk 4HA ejection seats13. The design is capable of safe ejection at ground level, if the aircraft’s flight path is parallel to the ground and it has a forward speed of at least 90 kt. The minimum safe height for ejection from an aircraft that is descending is approximately 100 ft above ground level for every 1,000 feet per minute rate of descent when upright. Each seat is mounted on an ejection gun, which uses pyrotechnic cartridges to provide the propellant power for the ejection. The ejection gun comprises three telescoping tubes; inner, outer and intermediate. A firing unit containing the primary cartridge is located at the top of the inner tube and two secondary cartridges are mounted in the outer tube. The outer tube is attached to the aircraft structure via a ‘bottom fitting’ which is bolted to the cockpit floor, and a ‘top fitting’ bracket attached to the rear cockpit bulkhead. The seat is connected to the ejection gun via a spring-loaded plunger, which engages in a locking collar on the inner tube, through a ‘top-latch’ window on the outer tube. Three sets of steel ‘slippers’ on either side of the seat structure engage in guide rails mounted to each side of the outer tube. The canopy is jettisoned automatically whenever ejection is commanded. Canopy jettison can also be initiated separately by pulling the canopy jettison handle at the rear of the centre pedestal. Under normal conditions, ejection is initiated by pulling either the face-screen firing handle located above the pilot’s head, or the Seat Pan Firing Handle (SPFH), fitted to the front of the seat pan between the pilot’s legs. This causes the canopy cartridge to be fired followed, after a 0.5 second delay, by the 13 The ejection seats are described in more detail in Appendix B.

33 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information primary cartridge. The resulting gases pressurise the ejection gun tube which extends, unlocking the seat from the aircraft and uncovering the secondary cartridges, which fire as they become exposed to the hot gases. As the seat rises up the guide rails, the remaining elements of the ejection sequence are mechanically-activated by static rods, and time delay mechanisms ensure the correct sequence occurs. The drogue gun cartridge fires and deploys a main and controller drogue, which inflate to retard and stabilise the seat as it falls. The ejection seat scissor- shackle releases, transferring the pull of the drogues to extract the pilot’s parachute. The pilot’s harness locks and leg restraint lines release, separating the pilot from the seat. The main parachute canopy inflates and the pilot is rapidly decelerated, and can descend under the parachute as the seat falls away separately. If the seat fails to eject or if automatic seat separation is not achieved following ejection, the pilot can pull a manual separation handle on the left side of the seat pan to release the harness locks and leg restraint lines. As the seat falls away, a cable between the pilot’s parachute and the seat acts to release the firing pin in the guillotine firing unit. As the cartridge fires, a small guillotine blade severs the line connecting the drogues and main parachute canopy14. The pilot is then fully separated from the seat, and can manually pull the parachute rip-cord handle to deploy the main parachute canopy. 1.6.12 Pilot anti-g system The aircraft had an anti-g system which consisted of high pressure air bottles connected to the anti-g trousers worn by the pilots. It comprised a filter, an on/ off selector valve, a pressure-reducing valve, and an anti-g valve to control the air pressure to the anti-g trousers automatically according to g loads when they exceed 2.5g. The pilot was wearing anti-g trousers at the time of the accident. The technical manual for the aircraft states: ‘The use of an anti-g suit raises the pilot’s blackout level and considerably reduces fatigue caused by repeated applications of G and enables the pilot to carry out ‘all round’ observations at high G.’ 14 The guillotine cartridge also fires during automatic seat separation, but the parachute withdrawal line is pulled out of the guillotine gate when the drogues deploy, and is therefore not severed.

34 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.6.13 Mass and centre of gravity The maximum permitted all-up mass (MPAUM) for the aircraft was 25,000 lbs. The forward centre of gravity (cg) limit was 1.0 inch forward of the cg datum and the aft cg limit, 14.5 inches aft of the datum. The aircraft mass and cg prior to start was calculated as 18,814 lbs, with full fuel and a pilot weight of 180 lbs, producing a cg position 3.71 inches aft of the datum. Assuming the estimated fuel use detailed in the flight trials report (see Section 1.16.1) the total mass at impact was estimated to be 17,600 lbs with a cg position 3.97 inches aft of the datum. Therefore, the aircraft was being operated within the MPAUM and cg limitations set out in the Hunter T Mk 7 Aircrew Manual. 1.6.14 Maintenance records 1.6.14.1 General maintenance and CAA audits When G-BXFI was accepted on to the civil register in 1997, maintenance activity had been planned using the aircraft’s military maintenance programme and recorded on documents based on original military documentation. Since 1997 the aircraft had been operated and maintained by a number of organisations, which, up to 2011, had used maintenance programmes based on the Hawker Hunter T7 Master Servicing Schedule15. It had a non-expiring Permit to Fly issued on 17 October 2003 (see Appendix C). In 2011 the aircraft changed ownership and the nominated maintenance organisation elected to change the aircraft’s maintenance programme to a bespoke programme based around an annual “minor check”, and a “major check” every two years, each incorporating tasks from the original maintenance programme. A flight test was conducted on 26 June 2011 as part of the Permit to Fly revalidation process, during which engine speed was recorded on the flight test form to have exceeded the limit of 8,100 ±50 rpm several times: 8,250 rpm on three occasions and 8,350 rpm once. There was no evidence of these exceedences being reported in the technical log or of any inspections or remedial action being taken, and the flight test was signed off by the pilot involved as, ‘airworthy and functionally serviceable to the required standards’. When the aircraft was purchased by the current operator in July 2012, it was flown from St Athan, South Wales, to North Weald to undergo maintenance. After arrival at North Weald the current maintenance organisation completed 15 Air Publication AP101B-1300-5A1. This document was the basis for the aircraft’s maintenance schedule.

35 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information an inspection of G-BXFI’s maintenance records. Due to a lack of clarity regarding the aircraft’s maintenance status, and after discussion with the CAA, the maintenance organisation decided to transfer the aircraft back onto a maintenance programme based on the original military programme and to track maintenance activity using military-style documents. In order to ensure that the aircraft met regulatory requirements it underwent a ‘Minor Star’ inspection (see Table 13). This was completed in December 2012. The subsequent application recommending the issue of a Certificate of Validity (C of V) for its Permit to Fly was accepted by the CAA which then issued the C of V. During this maintenance input the maintenance organisation’s approvals were subject to an audit by the CAA, the report of which the CAA has not provided to the investigation. On 3 January 2013 the CAA conducted an Aircraft Continuing Airworthiness Monitoring (ACAM) audit of the aircraft. A specific item on the audit checklist referred to compliance with MPD 2001-001, an MPD imposing a calendar life on the engine with an option to extend that life using an AMOC approved by the regulator (see Section 1.18.14). The audit report stated: ‘MPD 2001-001 complied with 2009, the next permit renewal was Dec 2012, although in compliance no entry made in aircraft record. Entry made in aircrafts 700 [maintenance log] for MPD before next flight, aircraft had not been released to service.’ There was no specific reference to an AMOC to MPD 2001-001 in the audit report. In November 2013 the maintenance organisation issued a new Certificate of Validity for GBXFI’s Permit to Fly, valid from 28 November 2013 until 4 December 2014 (see Section 1.17.8). Between November 2013 and the end of March 2014 the aircraft underwent a ‘Primary’ inspection. Between December 2014 and March 2015 the aircraft underwent another period of scheduled maintenance which included a ‘Primary Star’ inspection. The CAA conducted an audit of the maintenance organisation’s BCAR16 A8-20 approval in November 2014. This included a review of the issue of G-BXFI’s Certificate of Validity for its Permit to Fly. There were no findings. In March 2015 the maintenance organisation certified another Certificate of Validity for G-BXFI’s Permit to Fly, valid from 11 March 2015 until 10 March 2016. After completion of the maintenance input the aircraft was subject to a post‑maintenance ‘shake down’ flight on 20 March 2015 after which the pilot reported verbally that the aircraft had a number of technical defects, including a problem with the right altimeter. 16 British Civil Airworthiness Requirements.

36 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.6.14.2 Altimeter maintenance records There were no defects relating to the altimeters recorded in the aircraft’s technical log. However, a maintenance work order indicated that the Mk 30B (right) altimeter had been replaced on 23 March 2015. The maintenance organisation advised the AAIB that this work was undertaken as the result of a verbal defect report by one of the pilots following a post-maintenance flight on 20 March 2015. The maintenance work order stated: Master altimeter servo encoder 30B not working in flight.’ The maintenance work order also indicated that the altimeter would not power‑up during subsequent maintenance. The maintenance organisation determined that the fault was linked to inconsistent electrical power supply to the altimeter, due to the compass unit drawing excessive current. The maintenance work order stated: ‘U/S [unserviceable] altimeter #993 replaced with serv [serviceable] altimeter #874. Pitot static checks carried [out] from pitot probe to unit satis [satisfactory].’ The maintenance work order indicated that the pitot-static system had been leak-tested after replacement of the altimeter. The maintenance organisation informed the AAIB that the replacement Mk 30B altimeter was taken from another Hawker Hunter, G-BZSE, which was undergoing refurbishment in its facility. The maintenance organisation was unable to confirm when G-BZSE had last flown, but its most recent Certificate of Validity expired in 2011. The investigation determined that the Mk 30B altimeter fitted to G-BXFI at the time of the accident was in fact S/N 786 and not S/N 874 as the maintenance records indicated. The maintenance organisation informed the AAIB that the altimeter taken from G-BZSE was the only spare altimeter available to it and indicated that the serial number on the work order had been transcribed in error. No functional test of the altimeter system, to confirm electrical synchronisation between the two altimeters, was carried out after replacement of the Mk 30B altimeter. There were no pilot reports regarding the altimeters following the replacement of the right altimeter and the maintenance organisation stated that it had no other means of knowing if there was problem with the altimeters. There were no further entries in the technical records relating to the altimeters.

37 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The maintenance organisation sent the Mk 30B altimeter S/N 993, removed from G-BXFI, to a repair facility for further investigation. The associated repair documentation indicated that the travel-limit micro-switch had activated (see Appendix A for a description of this failure condition). This had most likely occurred due to the baro-knob being wound excessively when the altimeter was unpowered, either in flight or during maintenance trouble-shooting of the reported defect. The repair facility adjusted the baro-knob to reset the micro-switch and subjected the altimeter to the manufacturer’s standard test schedule. No additional anomalies were observed, and the unit was declared serviceable and returned to the maintenance organisation. The maintenance organisation did not keep component log cards for the altimeters and stated that it did not have access to historic component log cards in the aircraft records. It was therefore unable to determine the history of the altimeters or the date of their last service. 1.6.14.3 Engine maintenance records The engine and airframe manufacturers’ documentation required engine removal after 450 flying hours for a ‘hot section inspection’, and an overhaul after 900 flying hours. Records indicated that the engine’s last workshop visit, a ‘hot section inspection’, had been completed in 1990 and, at the time of the accident the engine had completed 846 flying hours. The log card for the high pressure fuel pump (see Appendix D) showed that the pump had been overhauled in 1988 and had operated for 269 hours at the engine’s last workshop visit in 1990. There was no additional information available to identify any other maintenance activity associated with the fuel pump. There were no recorded defects relating to the engine or its systems. 1.6.14.4 Ejection seat maintenance records Ejection seat maintenance is discussed in Section 1.18.15.3. 1.7 Meteorological information On the day of the accident the south-east of England was under the influence of a stable southerly airflow. Satellite images showed that the area was free of significant cloud from the time of departure from North Weald to the time of the accident near Shoreham. Surface observations indicated ‘CAVOK’ conditions (no cloud below 5,000 ft and visibility in excess of 10 km), with surface winds in a south or south-easterly direction at approximately 10 kt, increasing steadily with height to approximately 16 kt at 5,000 ft.

38 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.8 Aids to navigation Not applicable 1.9 Communications The AAIB reviewed recordings of the radio transmissions between the pilot and North Weald Radio, Farnborough Lower Airspace Radar Service East, Shoreham Approach and Shoreham Display frequencies. The relevant content indicated an altitude check in the climb (see Figure 11) and the pilot’s intention to climb slowly to 2,000 ft during the southerly track. The relevant QNH given during the transit was 1013 and the QFE17 and QNH for Shoreham at the time of the accident was also 1013. There were no transmissions on the Shoreham Approach or Display frequencies during the accident display sequence. 1.10 Aerodrome information Shoreham Airport is located 1 nm west of Shoreham-by-Sea. It has four runways: an asphalt surfaced main runway orientated 02/20, 1,036 metres long with a width of 18 metres, and three grass runways, 02/20 (Grass), 07/2518 and 13/31.  The airfield is 7 ft above mean sea level (amsl). On 22 August 2015, a large organised flying display was being undertaken with the minimum separation of aircraft from the crowd being determined by aircraft speed and the type of display being flown.  The relevant display axis for G-BXFI was 230 m from the crowd line, parallel with and broadly west of the main runway.  The extended centreline of the display axis passed through the junction of the A27 and Old Shoreham Road. Restrictions were in place directing pilots not to overfly residential areas at Lancing below 1,000 ft, Shoreham Beach and an industrial area to the north below 500 ft, or Lancing College buildings at any height.  A copy of one of the 2015 Shoreham Airshow display maps provided to pilots is shown in Figure 8.

17 QFE is the reference barometric pressure set on an altimeter in order to display height above a particular aerodrome. 18 The published runway designator changed to 06/24 on 24 June 2016.

39 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Figure 8 2015 Shoreham Airshow display map. (The single display line indicated is not necessarily at the distance from the crowd required by G-BXFI) 1.11 Recorded data 1.11.1 General The flight was recorded by two action cameras recovered from the cockpit. Other relevant information was recorded by a smartphone. External sources of recorded data included radar tracks, radio transmissions and many videos and photographs taken from locations on the airfield and the surrounding area. The aircraft was not fitted with a crash-protected flight recorder, and none was required. Sections 1.11.2 to 1.11.5 describe the sources of the data. The amalgamated data associated with different aspects of the investigation is then considered in Section 1.11.6. Section 1.11.7 onwards includes data from other flights.

40 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.11.2 Air Traffic Control radar NATS19 provided radar tracks recorded by Gatwick, Heathrow, Debden and Pease Pottage radar heads. Pease Pottage provided the best source of radar data for this flight, and had a 6.2 second sweep period20. The recorded track of G-BXFI started at 1206:32 hrs, 14 km southeast of North Weald Airfield, with the aircraft transponder reporting a pressure altitude of 1,100 ft, slowly climbing and tracking in a southerly direction. The last recorded radar point was at 1222:19 hrs. The rotational speed of air traffic control radar antennas is such that the information they receive is not updated sufficiently frequently for accurate tracking of aircraft that are continuously changing direction and speed. Errors associated with aligning the recorded radar track with specific points on the ground include random errors and systematic errors. These vary for the different radar heads for a given aircraft track and complicate the mixing of positional data from different radar sources. Pressure altitude data, referred to as ‘Mode C’, from different recorded radar tracks can be more readily combined as this information is transmitted from the same aircraft's transponder. Some of the Mode C altitude data was automatically flagged by the system as ‘Not-validated’, including a significant proportion of altitudes recorded during the accident display. However, this ‘Not-validated’ radar data appears reasonable when compared with the validated radar data and other evidence, such as the motion captured by imagery and results of photogrammetry analysis. Radar data validation is discussed further in Section 1.16.2. Pertinent radar data is provided in Figure 10 and Figure 11. Radar recordings were also provided for other aircraft at the same display and other displays by the accident aircraft. 1.11.3 Action cameras Two action cameras were recovered from the wreckage. One had been mounted in the cockpit close to the windscreen, pointing forward and to the left. Specialist techniques were required to extract video files from the data recovered from this camera. The recording started in the vicinity of Brighton and ended at impact. It provided a useful visual portrayal of the parts of the flight where the terrain was in the camera’s field of view, but distortion of the image by the windscreen reduced its value for further analysis. 19 The national air traffic services provider. 20 The sweep period of a radar head is the time it takes to scan 360° horizontally. In the case of Pease Pottage this would cause the radar to beam to pass a particular point once every 6.2 s.

41 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The second action camera was mounted on the rear bulkhead of the cockpit between the seats pointing forward and is referred to hereafter as the cockpit action camera. It captured a portion of the instrument panel, and a portion of the view through the canopy and windscreen (see Figure 9). Files recovered from the unit captured two periods of the accident flight; the first included the takeoff and initial climb from North Weald, the second started in the vicinity of Brighton and ended approximately 23 minutes after the accident. The images included a part of the ASI, some of the fuel system controls and indicators, some of the oxygen system controls and indicators, the JPT indicator, and occasionally the engine rpm gauge when the pilot moved sufficiently for it to come into view21. Determining their indications was complicated by image resolution, contrast and partial obscuration. The altimeters, thrust levers, and many other indicators and controls, were not in the camera’s field of view.

Right ASI - partially obs JPT Engine speed (only visible when pilot moves) G-meter Right control stick GPS Radios Fuel controls and indicators Oxygen controls and indicators Figure 9 Cockpit action camera field of view (image lightened for this illustration) The cockpit action camera audio recordings captured ambient aircraft noise, mostly from the engine. Relatively quiet sources of audio such as speech during radio transmissions were not detected. 21 This was the source of airspeed and JPT information. Right ASI - partially obscured

42 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The engine manufacturer provided details of the rotating parts of the engine and the aircraft auxiliary gearbox was stripped to identify key features to assist a spectrum analysis of the audio recording. The spectrum analysis conducted by the AAIB identified a strong signature that correlated with expected engine shaft speeds during the takeoff and transit to the south coast. Other signatures correlated with the first stage compressor blades and the rotational speeds of engine-driven gearbox components. The engine speed data derived in this manner is hereafter referred to as the ‘audio rpm’. The data derived from the in-cockpit video is shown in Figure 11. 1.11.4 Flying display videos and photographs Members of the public provided videos and photographs associated with the accident flight. Some of these were from locations on the airfield and others were from locations in the surrounding area. The Ministry of Defence (MOD), at the request of the AAIB, analysed the imagery using photogrammetry techniques to determine speed and positional information. It also established that the aircraft flap angle relative to a local datum line22 running between the tip of the aircraft’s nose and the centre of the jetpipe was 11° ± 3°. Visually this appeared to be similar to that used during the equivalent manoeuvre flown at Shoreham in 2014. The imagery was also used to assess a vapour plume emanating from the right wing (see Section 1.12.3.11). Imagery relating to other flying displays was also obtained. 1.11.5 Smartphones A recovered smartphone contained an aviation application (app) that recorded a flight track associated with the accident flight. This relied on positional information generated by the smartphone which was probably based on Global Navigation Satellite System (GNSS) technology. It recorded the takeoff and southerly track of the aircraft, showing the transit climbing to approximately 2,000 ft amsl. However, no valid positional data was available after crossing the coastline near Brighton, with the exception of a brief period prior to the display. The pertinent data is shown in Figures 10 and 11. Further data was recorded at the accident site after the accident, probably associated with periods when the phone could receive sufficient GNSS signals to provide data to the app. 22 The flap angle is normally referenced to the wing chord line so the incidence angle of the wing, 1.5°, needs to be subtracted from this figure to compare with angles associated with the flap selection.

43 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information A smartphone situated inside a manoeuvring aircraft may lack valid positional data. GNSS technology relies on tracking weak signals from multiple satellites and using combinations of these to calculate a device’s position. Without antennas that continually have good sight of a large area of the sky, satellite navigation systems can become inaccurate or stop providing positional information altogether during dynamic manoeuvres. 1.11.6 Data recorded during the accident flight The cockpit action camera captured the indications of several systems. The only indication of a malfunction was that the g-meter was not appropriately responding to the manoeuvres flown (see Section 1.12.3.7). The cockpit fuel gauges (indicating the combined contents of the wing, front and rear tanks but not fuel in the drop tanks) were both indicating full (more than 1,500 lbs each side) at the end of the flight. The tank pump switches were set to on. None of the indicators relating to low fuel pressure, fuel transfer failure or tank pump failure were active during the flight (though this is not evidence of the serviceability of the indication system itself). The guarded switches that were in view remained guarded. The elevator power controls indicator was inactive signifying that hydraulic power was on. The oxygen system was set to normal oxygen, and the indicators showed the system was more than half full, pressurised to approximately 300 psi and provided regular periods of flow to the pilot. Figures 10 and 11 combine the evidence from the radar recordings, radio telephony, smartphone recordings, imagery and audio analysis. The photogrammetry results and data derived from it are shown in Figures 12, 13 and 14. The aircraft took off from North Weald Airfield at 1204 hrs. The pilot occupied the left seat. Cockpit video indicates rotation was initiated at 112 KIAS. The pitch attitude was subsequently reduced and then increased again before the aircraft lifted off the runway. During the flight from North Weald to the south coast, radio communications of altitudes, probably made with reference to the left altimeter, indicated the pilot's intent to climb to 2,000 ft during the southerly track and a QNH of

1. The radar Mode C data, based on information from the right altimeter,

indicated a slow climb to the cruise at pressure altitudes around 2,000 ft. The GNSS altitude data was consistently 50 ft to 200 ft higher than the Mode C altitudes during the transit to the south coast, the difference being due to a combination of errors from both systems.

44 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information During the takeoff and climb to 2,000 ft, action camera images of the ASI and smartphone-derived groundspeed data were available. During the acceleration along the coast prior to turning inland to commence the display, images of the ASI and radar data suitable for groundspeed evaluation were available. In both cases, the recordings indicated a better-than 15 kt correlation between ASI indications and derived ground speeds. The accident occurred at the end of a manoeuvre involving both a pitching and rolling component. The pull-up at the start of this manoeuvre commenced at an indicated airspeed of 310 ±15 KIAS23 and from a height of 185 ±35 ft agl24, approximately 900m from the display line and approaching it at an angle of approximately 25°. The aircraft reached an altitude of approximately 2,700 ±200 ft amsl25 at the apex of the manoeuvre, with an indicated airspeed of 105 ±2 KIAS. Flaps were deployed throughout the looping manoeuvre. The cockpit video indicated increased vibration in the final 5.5 seconds before initial impact. The videos showed a slight roll to the left starting approximately 2.3 seconds before initial impact. The imagery did not show the aileron position leading up to this clearly, but did show corrective aileron inputs after this. External imagery showed the elevators deflected in the nose-up pitch sense during this time. Head movement indicated that the pilot remained conscious and active throughout the manoeuvres. The action camera mounted close to the windscreen stopped recording on impact. The other camera continued recording. The audio recording captured some of the speech associated with the emergency services attending the pilot, mixed with varying amounts of ambient noise. The pilot was asked several questions by emergency personnel. The answers included some clear “No” responses. When asked whether he had felt unwell before the crash, the answer was not clearly recorded. Eight AAIB investigators were asked independently to transcribe a short section 23 The ground speed derived from photogrammetry was also 310 ±15 kt (see Figure 12). Allowing for a reported 10 kt south-easterly wind this correlates closely with the indicated airspeed recorded by the cockpit action camera. 24 Height at the start of the pull-up was derived from photogrammetry based on imagery with clear ground references. 25 The apex altitude was derived by using the following: radar Mode C altitude data (Figure 11), knowledge of the Mode C validation process (Section 1.16.2), testing of the altimeter encoding system (Section 1.12.3.6), the behaviour of Mode C data during flight trials (Section 1.16.3), expected pull-through height loss established through flight trials (Section 1.16.1) and indications from photogrammetry data (Figure 14).

45 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information of recording. Regarding the question about feeling unwell, four believed the response was in the negative and four in the positive. The recording was not conclusive in this regard and did not provide evidence of the pilot's understanding of the question he was answering or his ability to answer it accurately. Figure 10 Overview of the flight

46 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Figure 11 Flight parameters Marked non-validated Smoothed radar ground speed is not a reasonable source of data during manoeuvres Farnborough LARS east: “...GOT YOU READING ONE THOUSAND ONE HUNDRED FEET...” Pilot “AFFIRM CLIMBING TWO THOUSAND GENTLY” Estimated errors associated with reading partially obscured ASI 0-250 KIAS: 2 KIAS 250-275 KIAS: 5 KIAS 275-410 KIAS: 15 KIAS Apex: 2,700 ft amsl (±200 ft) Photogrammetry groundspeed: 225 kt (±20 kt) Photogrammetry pull-up Altitude: 225 ft amsl (±25 ft) Groundspeed: 310 kt (±15 kt) Estimated inverted at apex Ground contact Roll Flypast Derry turn See note 1 See note 1 Pull up Note 1: These eight Mode C altitudes were marked as “Not-validated” but appear reasonable when compared to the validated Mode C returns (see section 1.16.2).

47 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Figure 12 An extract from the MOD photogrammetry report showing a schematic representation of the accident manoeuvre. The change in heading is not shown Figure 13 Pitch angle data in the last 10 seconds of flight. Data extracted from the MOD photogrammetry report

48 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Figure 14 Flight path geometry during the final seconds of the descent. Data extracted from the MOD photogrammetry report 1.11.7 Data recorded during previous flights 1.11.7.1 General Cockpit video recordings were obtained of two previous displays in which the accident pilot flew the same aircraft. The camera mounting locations were different in each case, allowing different aspects to be reviewed. Sections 1.11.7.2 and 1.11.7.3 describe specific findings pertinent to each flight and subsequent sections draw on these videos to compare common aspects such as engine usage. External video recordings of both these flights were obtained. Cockpit video recordings of the accident pilot displaying a Jet Provost on the Saturday and Sunday of the weekend prior to the accident were also provided to the AAIB. Section 1.11.7.4 provides the entry and apex values for loops flown during these displays. 1.11.7.2 Shoreham – August 2014, G-BXFI The cockpit action camera captured throttle lever movements, the rpm indicator, the JPT indicator and other instruments. This provided evidence of the engine rpm/JPT relationship, the engine rpm changes in the climb phase of loops, and a comparison between the throttle movements and the engine rpm data sources.

49 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The cockpit action camera did not capture airspeed or altitude indicators. The Mode C function of the transponder was switched off, so the radar recording did not provide any altitude data. The manoeuvres included a modified loop (described in more detail by the Test Pilot in Section 1.18.3.3). The cockpit video shows throttle movements that correlate strongly with the shape of the audio rpm signature. The rpm gauge appeared initially to react quickly to engine speed changes but did not reach the stable audio rpm values. The cockpit action camera captured movement of the right throttle lever, which is mechanically linked to the left throttle lever used by the pilot. Throttle position varied during the climb phase of the loop. Only half the g-meter was captured in the cockpit video, which initially showed movement of all three needles. For the majority of the recording only the main and peak negative load needles were captured, neither of which moved after the initial three manoeuvres, regardless of the rolls, turns and manoeuvres flown subsequently.

1. 11.7.3

Duxford – September 2014, G-BXFI During the display of G-BXFI at Duxford in 2014 an internal camera mounted on the inside of the canopy captured the instrument panel and an external view. Both altimeters were captured with an image resolution sufficient to read the needles but insufficient to read the numbers on their height counters. The instrument images often suffered from poor lighting and the view of the left altimeter was from an oblique angle. This section references the right hand altimeter readings, which indicated approximately 0 ft on the ground before and after the display. The video is an amalgamation of a number of non-contiguous periods, starting with the taxi out and takeoff, a display flying period and the approach, landing and taxi in. An external video, taken from a location on the crowd line, afforded a view of the flaps and airbrake during most of the aircraft’s display. Some pertinent instrument readings extracted from the recordings are provided here. Section 1.18.3.2 contains a more detailed description provided by the Test Pilot. The recorded manoeuvres included a loop. The climbing phase of the loop was carried out with the airbrake deployed. This started at 200 ft aal, peaked at approximately 4,250 ft aal, when the airbrake was stowed, and ended at 400 ft aal. It was not clear if the aircraft could have completed the manoeuvre above this height had the pilot chosen to do so. The speed indication on entry

50 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information to the loop could not be established but was increasing prior to the last visible speed indication of approximately 320 KIAS, 8 seconds before the pull-up. It was 150 KIAS approximately 2 seconds after the apex. The cockpit field of view included the pilot’s use of the left thrust lever. The pilot set constant thrust for the climb phase of the loop. There were discrepancies between the left and right altimeter readings during the display. The left altimeter needle (intended to indicate hundreds of feet, and to complete one revolution every one thousand feet) lagged behind the right altimeter when climbing or descending, often appearing to become stuck temporarily before quickly catching up with the right altimeter. The resulting discrepancies between the two were greatest during dynamic flight. In roughly level flight the difference was approximately 200 ft or less. Over a six second period, during the downward half of one manoeuvre, the right altimeter needle ‘lapped’ the left altimeter needle, indicating a difference of more than 1,000 ft. The smoother motion of the right altimeter needle appeared better matched to the manoeuvres being flown than the more erratic motion of the left altimeter needle. Image resolution and ambient lighting did not support a continuous or certain assessment of the presence of the stby flag on the left altimeter. However, when lighting was favourable, the image suggested the stby flag was in view. The results of the altimeter examination are detailed in Section 1.12.3.6. The g-meter pointer, intended to indicate instantaneous acceleration, showed occasional sporadic movement, was at approximately 5.5 g for the majority of the flight, moved during the landing and indicated 4 g during the subsequent taxi.

1. 11.7.4

Recent Jet Provost display flying The pilot displayed a Jet Provost on both days of the weekend prior to the accident. Cockpit video recordings from both displays were provided. They captured the airspeed indicator and altimeter on both days but also suffered the same image contrast problems as the G-BXFI cockpit imagery when the aircraft was inverted. Two loops were flown as part of the display on both days. The indicated airspeeds and altitudes for each of the loops are given in Table 6. The wider tolerance of indicated altitude in the 'loop apex' column accounts for the reduced quality of the video due to poor image contrast when inverted.

51 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Loop entry Loop apex Indicated altitude (±50 ft) Indicated airspeed (±5 KIAS) Indicated altitude (±100 ft) Indicated airspeed (±10 KIAS) 200 270 2,750 125 200 270 3,150 105 200 260 2,800 110 300 260 2,900 130 Table 6 Jet Provost loop parameters the weekend prior to the accident 1.11.7.5 Imagery from a previous flight In a cockpit image recording from a previous flight in another Hunter part of a hand-drawn diagram of a sequence of manoeuvres is visible on the pilot’s knee. This was identical to the one that would have been visible to the pilot during the accident flight (see Section 1.12.2.2 and Figure 17). 1.11.8 Engine performance 1.11.8.1 JPT and rpm The engine manufacturer does not support the historical engine type fitted to the Hunter but provided analysis based on archived information and expert knowledge of jet engine performance in general. The performance information it provided related to a static engine under stable test conditions. It did not take into account performance losses associated with being installed in an aircraft, or dynamic performance. The engine manufacturer reviewed the JPT indications captured by the cockpit action camera during the accident flight, the audio rpm figures, associated environmental conditions and basic flight parameters. The analysis was limited to periods when engine use was sufficiently stable to make valid comparisons with the documented values. This meant that the initial part of the flight could be assessed but engine performance during the dynamic manoeuvres from the start of the display could not. The engine manufacturer found that the engine appeared to be performing normally, with an appropriate relationship between rpm and JPT. The same analysis was attempted for a flight from the year before. In that case the indicated JPTs were too low to be realistic (in any weather conditions), suggesting there was a problem with the indicated temperatures, making further analysis impossible.

52 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.11.8.2 Engine speed during manoeuvres Figure 15 shows the audio signature associated with engine speed for the accident manoeuvre, derived from audio spectrum analysis, and compares it with the two successful loop manoeuvres captured by the cockpit action cameras from previous displays flown by the same pilot. The exact point at which a pull-up was initiated or an apex was reached was not always clearly defined. Complicating factors include the apex not necessarily coinciding exactly with the aircraft being level and inverted, indistinct horizons in the imagery, climbs initiated in a turn, key instruments being obscured and the changing geometry of the external imagery. Each frame in Figure 15 has an ‘approximate start’ and ‘estimated apex’ marker line, the thickness of which indicates the extent of this uncertainty. The resultant periods between the pull‑up and the apex at the Shoreham 2014 and 2015 Airshows overlap. However, when the videos of the ‘bent loop’ manoeuvres were viewed side by side, it was observed that the first half of the Shoreham 2014 ‘bent loop’ had a slightly higher pitch rate and was completed in a slightly shorter time than the first half of the Shoreham 2015 ‘bent loop’. Engine speed during the loop at Duxford in 2014 was approximately the maximum allowable throughout the climb. The Shoreham 2014 manoeuvre was initiated with a low engine speed which then stepped up in two stages, levelling at slightly under 8,000 rpm for the last part of the climb. The climb for the accident manoeuvre was initiated with an engine rpm approximately half way between the initial engine rpms of the other two manoeuvres. The engine speed then reduced to below 7,000 rpm, recovered to and briefly held at 7,250 rpm, and then reduced further, passing below 7,000 rpm at the apex. At the apex of the accident manoeuvre, the engine speed was approximately 1,000 rpm lower than for the other two manoeuvres. A further distinction of the accident manoeuvre is that the engine speed increased during the descent whereas during the other two comparison manoeuvres the general trend was a reduction in engine speed. To provide some context when comparing engine speeds during the manoeuvres it is helpful to note aircraft speeds and configurations. The entry airspeeds of the loops could not be established from the cockpit videos. Flap settings were similar, if not the same, during the accident manoeuvre and during the comparison manoeuvres at Shoreham and Duxford in 2014. The airbrake was deployed during the climb phase of the loop at Duxford. The aircraft airspeed and height at the apex of the accident manoeuvre was significantly lower than that for the Duxford manoeuvre (approximately 4,250 ft aal; no speed or height data was available for the Shoreham 2014 display).

53 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Note: the relative darkness of the three audio signature lines has no significance Airbrake stowed throughout. Airbrake deployed for the climb and stowed at the apex. Duxford 2014 Loop Shoreham 2014 Bent Loop Accident manoeuvre Engine speed Engine speed Engine speed Engine speed (rpm) Estimated apex Approximate start 32 seconds 8400- 7000- 6000- 8000- 8400- 7000- 6000- 8000- 8400- 7000- 6000- 8000- Tolerance Airbrake stowed throughout. Figure 15 A comparison of engine speed during loop manoeuvres flown by the same pilot in the same aircraft with the same or similar flap settings during different displays

54 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.11.8.3 Engine speed indicator Audio rpm was compared with the indicated rpm captured by the cockpit action camera during brief periods when the rpm indicator was in view. Indicated rpm consistently lagged audio rpm, being less than the audio rpm after speed increases and more than the audio rpm after speed decreases. Fifty-five sample points were taken from the three flying displays recorded on cockpit video. Of these, the maximum difference between the audio rpm and indicated engine speed was 226 rpm. 1.11.9 Recorded information from other aircraft and other flying displays Radar data and video recordings indicated that instances of aerobatic manoeuvres occurring below 500 ft agl more than 1 km from the airfield, or flight below the heights specified in a display plan, were not limited to one aircraft, pilot or venue. 1.12 Wreckage and impact information 1.12.1 Accident site examination The aircraft crashed on to the westbound carriageway of the A27, Shoreham Bypass, near its junction with Old Shoreham Road and Coombes Road, which is close to the northern perimeter of Shoreham Airport (see Figure 16). During the impact sequence the aircraft struck occupied vehicles and people around the road junction, traffic light stanchions, road signs and a crash barrier. Ground marks and photographic evidence showed that the aircraft struck the road in a nose-high attitude on a heading of approximately 230°. The first ground contact was made approximately 50 m east of the road junction by the lower portion of the jetpipe fairing. During the impact sequence the external fuel tanks, which were made of phenolic resin reinforced with asbestos26, fragmented and the right wing detached. Fuel and fuel vapour from the internal and external tanks was released and then ignited. Just before the aircraft reached the Old Shoreham Road junction it came into contact with the crash barrier and trees beside the carriageway. The barrier deflected the path of the aircraft slightly to the right and away from other groups of people congregated around the junction. The aircraft continued across the junction and passed through a number of small trees and down a bank into a shallow overgrown depression to the south of the A27. It came to rest in four main pieces which were close together, approximately 243 m from the initial point of ground contact, as shown in Figure 16. 26 The presence of asbestos was not identified until a week after the accident.

55 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Initial impact point Path of aircraft changed by impact with roadside crash barriers Extended runway centreline A27 Westbound carriageway Main wreckage Affected areas occupied by secondary crowd Figure 16 Illustration of accident site location (image not from the day of accident) 1.12.2 Aircraft on-site examination 1.12.2.1 Structure During the impact sequence the aircraft broke into four large sections. The main items of wreckage comprised the forward fuselage and cockpit; the centre fuselage, engine and left wing; the rear fuselage and tail cone; and the right wing which was found inverted close to the centre fuselage. The nose structure forward of the cockpit was destroyed. The section comprising the centre fuselage, engine and left wing had been subjected to a substantial post-crash fire and was partially submerged in a pool of unburnt jet fuel and firefighting media. The other sections were largely unaffected by the post-crash fire. 1.12.2.2 Cockpit Photographic evidence of the final moments of the accident sequence showed that the cockpit canopy separated from the aircraft soon after it struck the road. The canopy was found in trees at the top of the embankment, close to the cockpit section. The canopy jettison jacks had extended on each side of the cockpit sills. Examination of the canopy frame showed indentations coincident with the location of the canopy jacks, indicating they had operated under gas pressure. The canopy jettison handle had not been operated.

56 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The pilot and his seat were thrown clear of the cockpit during the latter stages of the impact sequence. Emergency first responders reported that the pilot was found on the ground, close to the left side of the cockpit, wearing his combined parachute and restraint harness. A personal survival pack was still attached to the pilot’s harness and had not been opened. The left cockpit sidewall had been breached by a side-on impact. The left lower side of the forward fuselage had sustained substantial disruption during impact. The pattern of damage suggested that it was caused, at least in part, by the aircraft sliding along the roadside crash barrier. There was substantial disruption to the cockpit floor structure just aft of the bottom attachment point of the left ejection seat. Documentation Documentation was retrieved from the pockets of the pilot’s anti-g trousers and flying suit including hand-written notes, a number of checklists and a copy of one of the display maps for the 2015 Shoreham Airshow. Documentation in the transparent knee-pockets, which would have been visible to the pilot during the flight, included a checklist and a hand-drawn diagram. This diagram was not specific to the display routine performed by the pilot at the 2015 Shoreham Airshow; video evidence indicated this same diagram had been visible in the pilot’s knee-pocket during a previous flight (see Section 1.11.7.5). The pilot had annotated one of the display maps for the 2015 Shoreham Airshow (see Figure 17) with the sequence of manoeuvres he intended to fly during the display, and other reference information such as relevant frequencies; this was found folded in a separate pocket, and would not have been visible to the pilot during the flight.

57 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Figure 17 Annotated display map from pilot’s pocket. The image has been edited to remove damage sustained in the accident 1.12.2.3 Ejection seats Pilot’s (left) seat The pilot’s seat was lying face-down on the ground, underneath the main cockpit wreckage and was substantially damaged. During operations to make the ejection seats safe at the accident site, it was found that the left seat primary ejection gun cartridge, drogue gun cartridge and guillotine cartridge had fired, but the two secondary ejection gun cartridges had not. The harness release plunger was extended and the scissor-shackle was released, indicating that the Barostatic Time Release Unit (BTRU) had operated. The canopy jettison cartridge had also fired.

58 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The SPFH was stowed within its housing, indicating that it had not been pulled. The face-screen handle had been fully removed from, and was lying close to, its housing in the ejection seat’s drogue container. The ejection gun had suffered major structural damage at its base. The bottom fitting remained bolted to the cockpit floor but had fractured such that the ejection gun assembly had separated from the bottom fitting and was unrestrained. The bottom portion of both guide rails exhibited damage consistent with having sustained a sideways impact. The ejection gun tubes had not fully extended. The circular bracket attaching the ejection gun to the top fitting had sheared on one side. The spring-loaded plunger had over-ridden the top-latch window and there were a number of damage marks around the top-latch window. The controller and main drogues had been extracted from their housing, but had not inflated and were entangled with cockpit wreckage and tree debris. The drogue-to-parachute withdrawal line had been severed by the ejection seat guillotine. There was no evidence that the manual separation handle had been pulled. The main parachute had remained within its container, but the auxiliary parachute had been fully extracted. Right seat The unoccupied right ejection seat remained inside the cockpit. The circular bracket attaching the ejection gun to the top fitting was sheared on both sides, leaving the seat and ejection gun free to tilt forward, pivoting about the ejection gun bottom fitting. The seat was also free to slide up the guide rails as the spring-loaded plunger had been forced upwards, fracturing the upper part of the top-latch window. The drogue gun cartridge and guillotine cartridge had fired but the primary and secondary ejection gun cartridges had not. The BTRU had operated and released the parachute locks. The parachute withdrawal line had been severed by the guillotine. The controller drogue had been ejected by the drogue gun, and the main drogue was partially withdrawn from its container. The main parachute remained packed within its parachute container.

59 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.12.3 Further examination 1.12.3.1 Flying controls The airframe was severely damaged but, to the extent possible, examination of the primary flying controls did not reveal any pre-accident defects. The three hydraulic actuators (two aileron and one elevator) were taken to the original manufacturer, which was able to assist in their disassembly and inspection. The units were determined to have been in good condition prior to the accident and no defects were found that would prevent their normal operation. The variable incidence tailplane had been subjected to large impact forces. The position of its electric actuator was determined, from inspection of photographs and video evidence, to be in a normal neutral position immediately prior to the accident. This is consistent with the normal operating procedure for this type of flying where the tailplane is used only for trimming and not in its elevator follow-up trim mode. 1.12.3.2 Hydraulic system It was not possible to check the operation of the hydraulic system due to disruption of the aircraft. The hydraulic pump was disassembled and found to be full of fluid and in good condition with no defects. There was no sign of hydraulic fluid staining on the airframe that could indicate a leak. Limited video evidence from the cockpit action camera did not show any anomalies in the aircraft’s response to control inputs. 1.12.3.3 Electrical system It was not possible to test the electrical system. There were no indications of an electrical system failure on the cockpit video. 1.12.3.4 Pitot-static system It was not possible to test or check the integrity of the aircraft’s pitot and static systems due to the extensive structural disruption resulting from the accident, but the altimeters and ASIs were removed from the cockpit and bench tested. 1.12.3.5 Airspeed indicators Both ASIs were removed from the cockpit for testing. The instrument glass on the left ASI was broken as a result of the accident, but the instrument casing was otherwise intact. Computer tomography (CT) scanning determined that there was no evidence of damage to the internal mechanisms of either unit. Despite the damage to the instrument glass, the left ASI functioned normally and

60 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information was determined to be within the required calibration. The right ASI functioned normally but was marginally outside of the required calibration. The results are shown in Table 7. Speed Range (kt) 80-300 310-400 410-500 510-600 610-750 Permitted tolerance (kt) ± 2 ± 4 ± 5 ± 6 ± 7 Right ASI Maximum deviation (kt) +5.0 +6.5 +5.5 +4.0 Not tested Left ASI Maximum deviation (kt) +1.0 +1.0 -2.0 -2.0 Not tested Table 7 Airspeed indicator ranging test results 1.12.3.6 Altimeters The altimeters had not suffered any obvious external damage during the impact and CT scans showed no evidence of damage to the internal mechanisms of either unit. However, the power failure flag on the Mk 30B appeared to be stuck above the height counter drum. The stby flag was visible on the Mk 29B altimeter, but it was not possible to determine which mode had been selected during the accident flight as it would have reverted automatically to standby mode upon disruption to the electrical power supply during the impact. As found in the cockpit, the barometric pressure setting on the left altimeter was 1014 mb and on the right altimeter was between 1016 and 1017 mb. The altimeters were function-tested at a specialist facility in accordance with the original manufacturer’s standard test schedule. Each altimeter was tested in isolation and then both altimeters were connected together, in order to replicate their installed configuration. The build history for each altimeter was also reviewed. The testing is briefly described below, with additional detail presented in Appendix A. Mk 29B testing The Mk 29B failed the manufacturer’s test because it exhibited an offset of approximately -100 ft between the actual altitude and the displayed value across its entire range, such that it would read approximately 100 ft lower than the actual aircraft altitude. The manufacturer stated that this finding suggested the altimeter may have been calibrated incorrectly at build or when last serviced, or that the offset could be attributed to minor slippage within the altimeter gear train due to accident impact forces.

61 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The Mk 29B also failed the testing due to excessive friction identified within the mechanical components of the gear train and height counter drum. This was consistent with expected component wear in an altimeter of this age, which may not have been serviced for many years. Excessive friction could cause lag between the measured and displayed altitude. This effect was particularly evident on the Mk 29B when it was tested in standby mode and more so with its vibrator motor switched off. Mk 30B testing The altitude displayed by the Mk 30B was within the permissible tolerances and the encoded output correctly corresponded to the displayed altitude. However the Mk 30B failed the test because there was no signal output from its synchro- transmitter. The effect of this would be that, when the Mk 29B was operating in servo mode, the Mk 30B altimeter would not transmit the required electrical signal to the Mk 29B. Mk 29B and Mk 30B combined testing The Mk 29B and Mk 30B were connected together using the altimeter wiring loom which had been extracted from the aircraft, in order to observe the effects of the absent synchro-transmitter signal. When in servo mode, the Mk 29B did not follow the Mk 30B accurately, instead displaying lower altitudes; the under- read was more pronounced when altitude was increasing than when it was decreasing. This hysteresis effect was probably associated with the previously identified friction within the internal gearing of the Mk 29B. Furthermore, its vibrator motor did not operate, and the pointer and height counter exhibited ‘stickiness’ and did not rotate smoothly. This test was repeated using workshop test cables to connect the altimeters. The same anomalies were observed, ruling out any faults within the aircraft altimeter wiring loom. The Mk 29B was also connected to a fully serviceable Mk 30 unit, which was similar to the Mk 30B. No anomalies were noted, other than the previously observed -100 ft offset in the Mk 29B, indicating that the Mk 29B functioned correctly in servo mode when it received a valid signal from the master altimeter.

62 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Disassembly of the Mk 30B and the synchro-transmitter Disassembly of the Mk 30B and further testing identified an open circuit across the rotor windings of the synchro-transmitter. It also confirmed that the power failure flag had come off its pivots, probably as a result of the accident impact. Disassembly of the synchro-transmitter, and examination under a digital stacking microscope, identified that one of the input wires to the rotor winding was broken, which could account for the open circuit. This damage was probably not accident related, but there was no way to determine how long this condition had existed. Mk 30B S/N 993 testing The Mk 30B altimeter S/N 993, previously installed in G-BXFI (see Sections  1.6.14.2 and 1.11.7.3), was obtained by the investigation for comparative testing. S/N 993 was tested in isolation and, when connected to the Mk 29B from G-BXFI, no defects were observed. 1.12.3.7 Accelerometer (g-meter) Cockpit video evidence indicated that the g-meter was not working during the accident flight or during a number of previous flights (see Section 1.11.7). There were no defects relating to the g-meter in the technical log and the maintenance organisation informed the AAIB that it was not aware of any. Post-accident examination of the g-meter indicated that the internal mechanism was loose, and it was therefore not possible to test the unit. Disassembly of the unit revealed that the control cord which centres the weight was broken and the weight was free to move unrestrained on the guide shafts. The lower pulley, around which the cord is normally routed, was loose, as was the grub screw which holds it in place. It was not possible to determine whether the cord broke as a result of impact forces, or whether this damage existed prior to the accident. It is unlikely that the grub screw and lower pulley were loose because of the impact, but the loose pulley may have altered the tension in the control cord and the degree to which the weight could move. This could explain the unserviceability of the g-meter prior to the accident. 1.12.3.8 RPM indicator and tacho-generator The rpm indicator appeared to be undamaged, however, the needle indicated 200 rpm when unpowered. The rpm indicator and tacho-generator were connected electrically and tested by the AAIB. The testing indicated that

63 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information both units functioned as expected and the correct relationship was observed between tacho-generator input and the displayed rpm. However, the rpm indicator read on average 200 rpm higher than the actual value. In addition some hysteresis was evident, but not to the same extent observed in the cockpit video recording of the accident flight. At the completion of the testing, the rpm indicator needle remained at +200 rpm rather than returning to zero. It was concluded that the 200 rpm offset was most likely due to accident damage in the internal mechanism of the rpm indicator. Section 1.11.8.3 provides information about the performance of this instrument based on cockpit video recordings.

1. 12.3.9

Anti-g system It was not possible to test the anti-g system due to accident damage. The air bottles and associated pipework were damaged and it was not possible to determine the air pressure in the system at the time of impact. A distinctive noise, recorded on one of the action cameras after the aircraft had come to rest, was similar to that sometimes heard when air from the anti-g bottle leaks across the shut-off valve, indicating that the air bottles were probably pressurised at the time of the accident. The maintenance organisation stated that the air bottles were fully charged prior to the accident flight. Examination revealed that the shut-off valve was not in the fully on position but witness marks indicated that this was probably the result of impact damage. The filter was clean. The pressure-reducing valve was tested and found to leak. Examination of the disassembled components confirmed that the valve bellows had failed due to the presence of a 250° circumferential crack. Microscopic examination of the fracture surfaces had the characteristics of a failure due to overload consistent with the forces experienced during the impact. There was no evidence of corrosion or fatigue on the fracture surfaces. The anti-g valve was tested in a centrifuge and found to operate normally. The hose connecting the anti-g trousers to the aircraft appeared to be in poor condition but as it had been damaged during the impact it was not possible to determine its integrity beforehand. 1.12.3.10 Engine examination The throttle and high pressure fuel shut-off valve (HPSOV) cam boxes, which convert the linear movement of the pilot’s controls into a rotary motion to operate the FCU fuel metering valve and HPSOV in the FCU, were removed from the fuselage and examined using CT scanning. No defects were identified within either unit.

64 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information It was not possible to test the engine exhaust gas thermometer because of extensive damage to the thermocouples and associated wiring. A partial disassembly of the engine was carried out by the AAIB with the assistance of the engine manufacturer and an organisation familiar with maintaining the Avon engine. The report of the manufacturer’s strip examination is included at Appendix E. Examination of the compressor confirmed that all the stators and blades were present. Accident damage was evident on all compressor stages but was particularly severe on the first five stages. Vegetation was found within the compressor case bleed air galleries. Five of the eight combustion chambers were removed and examined. All were in good condition with no evidence of liner cracking or uneven fuel spray patternation. The turbine blades and nozzle guide vanes did not appear damaged. Inspection of the variable inlet guide vane actuator confirmed that it was within the normal operating range and examination of the engine’s Fuel Dip Unit system confirmed that the unit had been disabled. Disassembly of the BVCU confirmed that there was no evidence of a pre-impact defect which would have affected its normal operation. The engine controls were removed and inspected with no abnormalities being identified. The fuel pump, FCU, BPC and ACU were disassembled at a specialist facility, by the manufacturer of the units, under AAIB supervision. Examination of the FCU components confirmed the presence of wear associated with normal operation. There was no evidence of pre-accident defects within the FCU, the ACU and BPC. There was no evidence of pre-existing defects in the swash plate pumps of the fuel pump. The metallic components of the fuel pump hydro-mechanical governor showed evidence of normal operational wear. However, the governor diaphragm showed evidence of deterioration. The governor diaphragm, together with the diaphragms removed from the ACU and BPC, were subject to detailed laboratory analysis. The laboratory examination, Appendix F, confirmed that both ACU diaphragms were intact but showed evidence of the effects of ageing. The BPC diaphragm showed no evidence of distress or ageing. The fuel pump governor diaphragm, which was made from two plies of a Polychloroprene rubber-proofed textile, showed significant signs of distress. The laboratory report made the following findings:

65 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information ‘4.1.2 The base polymer used for the rubber compound, Polychloroprene, has a known limited life in aviation kerosene. 4.1.3 However, when managed correctly any equipment containing a diaphragm manufactured from a Polychloroprene will not proceed to a point at which the resistance of the rubber composition of the kerosene has been exceeded i.e. aged 4.1.4 The ‘Mud-Cracking’ seen across the entire surface of the working convolution was a combined result of calendar life and exposure to kerosene. 4.1.5 The appearance would suggest there have been significant periods of non-operation where fuel will slowly degrade to form active chemical species (peroxides) that will then go on to attack the rubber. 4.1.6 The appearance of a ‘Tide-Mark’ across the convolution was also evidence to suggest the diaphragm has been subject to periods of inactivity and where the fuel has been allowed to drain away. 4.1.7 Draining the fuel away from the diaphragm, whilst reducing the exposure to degrading species, also results in the rubber loosing flexibility and will crack because the fuel can no longer act as a plasticiser for the rubber. ... 4.1.9 The interchange of plasticiser, added to rubber during manufacture, with kerosene when installed, is a well understood phenomenon. It is the reason why equipment containing diaphragms and rubber seals is not left static without constant exposure either to kerosene or inhibiting fluid, when not in use. … 4.1.13 The degradation of the rubber on both faces of the convolution, due to the effects of age, loss of flexibility and chemical interaction with fuel have resulted in a diaphragm that has exceeded the known predictable functional capability of the design.’

66 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The condition of the hydro-mechanical governor diaphragm indicated that it had suffered from the combined effects of calendar ageing, ‘drying out’ and chemical attack due to prolonged periods of inactivity in the presence of aviation kerosene. The extent of this degradation meant it was not in an airworthy condition. The CAA-approved manual for the Rolls-Royce Avon 122 engine (AP 102C-1512 to 1517) details the requirements for engine storage or periods of non-operation: ‘Up to 1 month Apply anti-corrosion fluid to compressor. Fit engine covers and blanks. Spray engine with lanolin resin temporary rust prevention. Up to 6 months As up to 1 month. In addition, ground run every 30 days and repeat application of anti-corrosion inhibiting fluid to compressor. If the engine is not to be ground run, drain engine oil, inhibit fuel system, apply anti-corrosion paper. Grease the control and inlet guide vane ram linkages.’

The maintenance organisation indicated that it was normal practice to keep the aircraft fuel system as full as possible during maintenance to minimise moisture build up and microbiological growth; it was unaware of the possibility of degradation of aviation kerosene into compounds which would actively attack components similar to the governor diaphragm. It was not its normal practice to inhibit the engine fuel system but it indicated that, if downtime was prolonged, engine runs would be carried out. Examination of the aircraft records from July 2012 showed that there were five separate occasions where the aircraft did not operate for a period of more than 30 days. During these periods engine runs were completed towards the end of the maintenance input but no evidence was found of engine runs being completed at 30 day intervals. Between August 2012 and the date of the accident, the periods during which G-BXFI’s engine had been inoperative for more than 30 days amounted to approximately 43% of the time. Records of the aircraft’s utilisation prior to August 2012 showed that this level of inactivity had also been prevalent prior to August 2012. Based on the known utilisation of other civil registered Hawker Hunters, the periods of inactivity identified in G-BXFI’s records are considered to be typical. The preservation of engine fuel systems during prolonged periods of non‑operation was discussed by the AAIB with a number of other organisations involved in the operation of historic jet aircraft, including the Hawker Hunter. They

67 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information considered that the reason for inhibiting the engine fuel system was to prevent water contamination and were also unaware of the effects of fuel degradation. The organisations also confirmed that it was not their normal practice to inhibit engine fuel systems during prolonged periods of non-operation. The fuel control systems of other ex-military gas turbine powered fixed and rotary-winged aircraft may contain components, made from similar materials, whose condition cannot be monitored without specialist facilities. Accordingly, the AAIB presented the findings of the associated laboratory report to the CAA. As a result the CAA published MPD 2016-001 on 07 October 2016. Appendix G. This MPD requires: ‘For any applicable turbine engine with calendar time greater than 20 years since last overhaul: Within 1 month or 10 flying hours from the effective date of this MPD, whichever limit is reached first: Examine the engine records subsequent to the release from military service and record evidence found of: a) Regular running of the engine, shown to be at intervals and to methods in accordance with manufacturer’s instructions and b) Inhibition of the engine fuel system in accordance with manufacturer’s instructions after any period of inactivity specified in the relevant operating manuals.’ For engines which do not meet these requirements a failure analysis must be carried out by the operator/maintenance organisation to determine the severity of a failure of any elastomeric components within the engine’s fuel system. The MPD states: ‘Note: Such a failure analysis is considered an Alternative Means of Compliance (AMOC) and requires separate CAA acceptance. The authors of the analysis and the analysis method to be used are to be acceptable to the CAA’

68 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.12.3.11 Fuel system It was not possible to test the fuel system due to accident damage. Some fuel was recovered from the wing tanks but it was contaminated with firefighting media and debris resulting from the accident so could not be usefully tested. The aircraft had been refuelled to full prior to departure and the extent of the post-accident fire indicated that there was a considerable quantity on board. Examination of the engine fuel pump assembly did not show any signs of cavitation that could indicate a restriction in fuel supply. A number of photographs taken by witnesses showed a plume of vapour emanating from a point close to underwing fuel tank on the right wing. The exact source could not be seen. Examination of these photographs indicate that the vapour plume is likely to be fuel vapour occasionally venting from a fuel system vent in this area. A similar vapour plume can be seen in some photographs taken of the same aircraft during its display at the 2014 Shoreham Airshow, and it is not considered relevant to the accident. 1.13 Medical and pathological information 1.13.1 Pilot The pilot was not aware of any pre-existing medical condition and toxicology did not reveal the presence of drugs or alcohol in his system that may have contributed to the accident. He received serious injuries as result of the accident. He was treated by a doctor and nurse at the scene. He was described by the doctor as “fully aware of what was going on around him and not confused in any way”. The doctor recalled that the pilot, when asked if he felt unwell before the crash, replied “yes”. The investigation could not establish if the pilot understood the intent of this exchange, in what way he might have felt unwell, or if this was his answer. Analysis of the associated audio recording was inconclusive (see Section 1.11.6). 1.13.2 Third parties Eleven people received fatal injuries as a result of the accident.

Thirteen people including the pilot are known to have received non-fatal injuries, and were treated by the ambulance service, local volunteer services and the display organiser’s on-site medical response contractors. The AAIB was unable to determine the number of individuals receiving other injuries, including non-physical injuries, because there was no central record

69 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.14 Fire There was a significant post-impact fuel fire caused by the disruption of the aircraft fuel tanks and fuel system. The released fuel and fuel vapour ignited and initially produced a large fireball, followed by a sustained pooled fuel fire around the wreckage. 1.15 Survival aspects 1.15.1 Fire and rescue services Significant medical and fire-rescue resources were available, including those provided by the display organiser, pre-deployed local authority services and the normal emergency services both on the airfield and in the local community. A local authority Fire and Rescue Service pump ladder vehicle that had been pre-positioned approximately 220 m from the A27 / Old Shoreham Road junction was at the accident site within 90 seconds and commenced firefighting operations immediately. The injuries sustained by those on the ground were not survivable. No additional emergency response provisions would have altered the outcome. 1.15.2 Pilot’s helmet The pilot was wearing a Helmet Integrated Systems Ltd Mk 4A/4 helmet, a type still in use with the UK military. Several areas of damage on the crown and rear of the helmet outer shell were evident, with corresponding areas of damage to the underlying energy-attenuating foam. The damage pattern indicated the helmet had been subjected to multiple discrete impacts, consistent with the pilot having sustained major head impacts during the accident. Nevertheless the energy attenuation afforded by the helmet ensured that his head injuries were not fatal. 1.15.3 Aircrew equipment assemblies (AEA) The pilot was wearing a Mk 15T tropical flying coverall, Mk 2A anti-g trousers, a Mk 30 life preserver, and leather gloves. The flying coverall and anti-g trousers had been cut in several places, consistent with removal by the emergency services, so it was not possible to test the functioning of the bladder system in them. Despite the extensive post-crash fire there was no fire in the cockpit, or the area in which the pilot was found. Accordingly no further assessment was made regarding the protective qualities of the flying overall and gloves.

70 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The pilot was also wearing a P18/P19 oxygen mask. The protective exo‑skeleton was missing. The face piece contained several tears and the emergency oxygen hose was cut. This damage probably occurred during the accident. No maintenance documentation was provided relating to the pilot’s AEA, so it was not possible to determine if it was maintained. 1.15.4 Survival equipment The Mk 4HA ejection seats fitted to G-BXFI were equipped with a Mk 41A emergency escape parachute assembly (EEPA), Mk 6 quick release fitting (QRF) and a personal survival pack (PSP). The EEPAs and PSPs were generally in good condition and packed correctly. It was considered likely that if an ejection had occurred, within the safe ejection envelope, the parachute canopy and PSP would have operated as designed. The EEPAs and QRFs had last been maintained in March 2015 and the PSPs in February 2015. However, no maintenance history or modification records were available. A number of EEPA components had exceeded their recommended lives. The absence of records meant it was not possible to determine when they had been installed in G-BXFI. 1.16 Tests and research 1.16.1 Flight trials The AAIB commissioned a series of three flight trials using a Hunter flown by an experienced Test Pilot (TP), who also acted as an advisor to the investigation. The full trial report is included in Appendix H27. The aim was to gain an understanding of the accident manoeuvre, with four objectives:

To determine if, having reached the apex of the accident manoeuvre, it would have been possible to fly an alternative ‘escape’ manoeuvre such that a collision with the ground could be avoided.

To determine if, having reached the apex of the manoeuvre, it was possible to have continued the pull through manoeuvre, as attempted, and avoid a collision with the ground.

To find out what influenced the speed and height achieved at the apex of the accident manoeuvre. 27 Where Appendix H refers to a ‘bent loop’ manoeuvre, this is the manoeuvre as understood by the TP and not necessarily as intended by the pilot of G-BXFI at the time of the accident.

71 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information

To determine if a ‘bent loop’ manoeuvre could be flown safely if entered with a different combination of airspeed, pull‑up technique and power from those used in the accident manoeuvre. The TP is a qualified military test pilot and tutor at the UK Empire Test Pilots’ school. He has approximately 10,000 hours flying experience on over 150  aircraft types. He has approximately 1,000 hours experience on the Hawker Hunter, and was current on the type at the time of the flight trials. He was also a UK DA holder and DAE. The aircraft used was a single-seat Hawker Hunter F Mk 58. Allowances were made for the differences between this aircraft and the two-seat Hawker Hunter T Mk 7 accident aircraft. For example, the engine manufacturer provided engine speeds for use in the trials aircraft that would produce thrust equivalent to that of the Mk 122 fitted to the accident aircraft. The only significant difference in construction is that the nose and canopy of the two-seat T Mk 7 is wider, potentially developing more lift than the single-seat canopy and increasing instantaneous turn performance. Historical trial data was available for the instantaneous turn performance of the T Mk 7, and comparative data was gathered for the F Mk 58. Analysis of this data indicated that there was not a significant difference in maximum instantaneous turn performance between a T Mk 7 and F Mk 58 and that the lift-related data gathered in the F Mk 58 was representative of the T Mk 7. Two data gathering sorties were flown on 19 October 2015 totalling 1 hour and 25 minutes. Following analysis of the data from these sorties and other information gathered during the course of the investigation, a third 55 minute sortie was flown on 4 December 2015 to gather additional data. Based on the data gathered during the sorties flown, the TP concluded the following:

‘From the apex height and airspeed achieved in the accident manoeuvre, and for up to at least four seconds after passing the apex, it would have been possible for an appropriately trained pilot to fly a straightforward escape manoeuvre in G-BXFI which would have prevented impact with the ground by rolling the aircraft through 180° back to erect flight and then pulling out of the dive to regain level flight.

The measured height loss during a representative pull through from the apex of a loop at the airspeed, all up mass and density altitude of the accident manoeuvre was between

72 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 2,700 and 2,850 ft, and if altimeter reading resolution and instrument errors were considered the range would increase to between 2,600 and 2,950 ft. The height loss appeared to be insensitive to whether 1 or 2 notches of flap were selected and to the power setting.

The ‘bent’ loop tests indicated that the apex height and airspeed of the accident manoeuvre was consistent with a maximum performance pull-up from 300 KIAS with significantly less than full thrust and with a 45-90° bend initiated approximately five seconds after pull-up. They also showed that the apex height for a ‘bent’ loop was 300 to 400 ft less than for a straight loop with all other parameters constant. 4, A 90° ‘bent’ loop entered at 350 KIAS with full T Mk 7 thrust was, for an appropriately trained pilot, a safe and straightforward manoeuvre to fly.’ These flight trials also demonstrated that entering a straight loop at a speed of 300 KIAS from 200 ft agl, and T7 equivalent maximum thrust, the aircraft achieved apex heights between 3,400 ft and 3,800 ft agl while conducting looping manoeuvres, or a height gain of between 3,200 ft and 3,600 ft. Conducing bent loops with the same entry conditions resulted in height gain of between 2,800 ft and 3,200 ft. 1.16.2 Radar Mode C validation There are two sets of criteria required by radar systems to validate Mode C data, one for altitude change since the last sweep and another for quality of data pulses associated with data transferred during a sweep. The maximum allowed altitude rate before a problem is flagged is 15,000 ft/min; given the rotation rate of the Pease Pottage radar, this translates to a maximum allowable change between Pease Pottage sweeps of 1,600 ft. This limitation would only account for one of the ‘Not-validated’ returns. The other ‘Not‑validated’ returns are therefore associated with the quality of pulses received during the sweep. For each detected aircraft a data point is recorded once per sweep by a radar system.  However, the rotating radar head actually carries out the detection process multiple times for each aircraft as it sweeps round, generating multiple positions and Mode C responses.  The system then uses these to generate a single record pertinent to the sweep, marking the Mode C as ‘validated’ or ‘Not‑validated’ in accordance with criteria set by the radar system manufacturer.  There are no standards set across the manufacturers for these validation

73 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information criteria.  The multiple returns generated by each sweep are not recorded so it is not possible to determine the reason for some of the Mode C data not being validated.  Each of the multiple aircraft transponder responses is made of multiple pulses. Ideally, the radar head would receive two replies with identical information made from good quality pulses. The radar builds a confidence level based on typically more than a hundred pulses measured in three different ways. Every radar response sent by an aircraft is subject to degradation from many causes including interference due to responses from other aircraft, the return signal coming via multiple paths and being at the edge of radar coverage. The radar returns from an aircraft carrying out aerobatic manoeuvres, flying relatively close to the ground compared to normal commercial aircraft, and flying in the south-east of England with its relatively high aircraft density, are likely to suffer from all of these issues to varying extents. The original returns used to generate the once-per-sweep data were not recorded, therefore it is not possible to state the exact cause for some of the data being marked as ‘Not-validated’.  During the flight trials there was good correlation between the recorded path of the aircraft and recorded Mode C altitudes despite the majority of the Mode C values being reported as ‘Not-validated’. Given the effects that flying display manoeuvres can have on the quality of radar data pulses and the correlation between the radar recorded path and the other evidence, it is more likely than not that despite the radar data not being validated, it was in fact appropriate.    1.16.3 Radar detection of peak altitudes The looping manoeuvres flown during the flight trials were recorded by a radar with a refresh rate of approximately 8 s. A comparison was made between the peak altitudes achieved (as reported by the TP) and the peak altitudes recorded by the radar (after correcting for ambient pressure conditions). Despite the radar returns being 8 s apart and rarely coinciding with the peak of the manoeuvre, the nearest radar return (in time) was always within 550 ft of the apex height reported by the TP, within 260 ft for the majority of loops (88%) and on average was within 175 ft. The data shows that the loops with larger differences between the apex altitude and highest recorded radar altitude were associated with the smaller differences between the recorded radar altitudes either side of the apex. So, if the radar returns either side of the apex are similar, a larger difference between these and the aircraft peak altitude can be expected.

74 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.17 Organisational and management information 1.17.1 Operation of ex-military aircraft on the UK civil register Ex-military aircraft on the UK civil register are required to operate in accordance with CAP 632 ‘Operation of Permit-to-Fly ex-military aircraft on the UK register.’ 1.17.2 Record of flight training G-BXFI was purchased by the operator in July 2012.  A Chief Pilot was appointed who also carried out pilot training.  As part of the CAP 632 structure, the Chief Pilot had produced a seven page Organisational Control Manual (OCM), which set out the company operating policy and procedures. At the time of setting up the operation, the operator’s two pilots held valid ATREs and DAs for the Hawker Hunter, obtained with the previous operator of the aircraft. The training syllabus was documented in that operator’s OCM but the training records had not been carried over to the new organisation, and were not required to be.  The accident pilot had, however, retained copies of his training records from the previous company and made them available to the investigation.  They did not contain a detailed description of what was covered on each training flight but both the Chief Pilot and the accident pilot provided a general overview of their content, and the summaries of the air exercises were available. The CAA provided copies of both pilot’s ATRE and DA initial issue and renewal forms. The CAA carried out an audit of the operator on 3 January 2013. The Audit Report Form stated: ‘A new OCM, one pilot one aircraft hangered at A8-20 [refers to approved maintenance organisation]. A good system in place for record keeping run by the Chief Pilot who is a current serving RAF officer. Recommended next audit 12 months and then if no Observations 18 months.’

75 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information On 7 January 2014, another audit was carried out and the FSO commented as follows: ‘A reasonably good operation run by an ex RAF Sqn Ldr. There are elements within the operation that could be improved; Notably the requirement to have a Dual Check ‘who checks the checker’ this has been embraced and a log of recurrent training including EKQ28 is going to be embodied within the OCM in the form of an Annex. Level 2 finding: The turn round schedule as referred to in the approval from the A8‑20 not in existence.’ The observation by the FSO that there needed to be a dual check carried out for each pilot was actioned and a flight was carried out on 24 March 2014 when the pilots carried out a mutual check.  This was not recorded in the training records for the operator but, according to the CAA, it should have been. The accident pilot had submitted a proposed Training Record form to the Chief Pilot and had completed one for the dual check he carried out on the Chief Pilot, but this was not filed. Training records are the operator’s documented evidence of what training has been carried out. They can also be an important element of an AAIB investigation. There were no CAA audits of the operator between 7 January 2014 and the accident. 1.17.3 Safety management systems 1.17.3.1 Introduction CAP 795 – ‘Safety Management Systems (SMS) guidance for organisations’, published by the CAA, states: ‘SMS is a proactive and integrated approach to managing safety including the necessary organisational structures, accountabilities, policies and procedures. It is more than a manual and a set of procedures and requires safety management to be integrated into the day to day activities of the organisation. It requires the development of an organisational culture that reflects the safety policy and objectives. 28 Essential knowledge quiz.

76 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information At the core of the SMS is a formal risk management process that identifies hazards and assesses and mitigates risk. It is important to recognise that even with mitigations in place, some residual risk will remain and an effective SMS will enable organisations to manage this.’ 1.17.3.2 International Civil Aviation Organisation Section 3.1 of Annex 19 to the Chicago Convention requires States to have a State Safety Programme (SSP) which should set out: ‘a. State safety policy and objectives b. State safety risk management c. State safety assurance d. State safety promotion’ And requires that: ‘The acceptable level of safety performance to be achieved shall be established by the State. The SSP established by the State is commensurate with the size and complexity of its aviation activities.’ The UK has an extensive flying display community which ranks among the most active in the world. The CAA stated that the duty contained in International Civil Aviation Organisation (ICAO) Annex 19, which places an obligation on specific organisations to implement a SMS, does not apply to organisations that are responsible for the operation of civil air displays in the UK. 1.17.3.3 CAP 632 – ‘Operation of ‘Permit-to-Fly’ ex-military aircraft on the UK register’ CAP 632 states in paragraph 3.4 ‘Safety Management’: ‘High safety standards are achieved not by the imposition of rules and regulations but through the development of a positive safety culture…The development of such a culture can be achieved in a number of ways but that recommended by the CAA is the adoption of a Safety Management System (SMS).’

77 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information And: ‘The CAA website contains guidance for SMS including specific guidance for small non-complex organisations… includes templates for SMS manual contents, safety report forms and hazard logs.’ CAP 632 includes an SMS evaluation tool. CAP 1059 – ‘Safety Management Systems: Guidance for small, non-complex organisations’ published in June 2013 states: ‘In recent years our understanding of how accidents and incidents happen has improved. More emphasis is now placed on the causal factors involved and the organisational factors that contribute to errors being made. Organisational factors include how an organisation operates, how it sets out its procedures, how it trains its staff and what level of importance it gives to safety issues identified within the organisation.’ And: ‘An effective SMS allows the hazards and risks that could affect your organisation to be identified, assessed and prioritised so that appropriate mitigation measures can be put in place to reduce the risks to as low as reasonably practicable (ALARP).’ CAP 1059 defines hazard and risk as follows: ‘A Hazard is simply defined as a condition, event or circumstance that has the potential to cause harm to people or damage to aircraft, equipment or structures. A Risk is defined as the potential outcome from the hazard and is usually defined in terms of the likelihood of the harm occurring and the severity if it does.’ CAP 632 states: ‘During Audits the CAA Inspectors will discuss Safety Management with operators. Their discussions will be based around the SMS evaluation tool...’

78 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The operator of G-BXFI informed the AAIB that a CAA FSO had informally mentioned SMS during an audit. The operator did not have or subsequently implement a SMS29. The AAIB report concerning the accident to G-TIMM30 on 1 August 2015 revealed that its operator also did not have an SMS in place. The CAA’s General Aviation Unit (GAU) did not have a subject matter expert for SMS. It stated: ‘There is no formal requirement for the U.K. aviation safety regulator to operate a Safety Management System within applicable national regulations or EU Implementing rules. The CAA has previously used a traditional approach to carrying out safety regulation on the basis of confirming compliance with a regulatory rule set. The CAA is however currently developing a new Regulatory Safety Management System (RSMS). The CAA’s RSMS will have a safety governance structure at three levels which develops and uses a risk picture to identify and manage Total Aviation System risks. The General Aviation Unit will integrate with, and operate within the wider RSMS of the CAA using the same processes and tools as the rest of CAA. The RSMS is expected to begin operating in its final form during 2016.’ Separately, CAA International Whitepaper of 5 April 2016 – ‘Implementing a regulatory safety management system to enable performance based regulation, the UK CAA journey so far…’, stated: ‘The UK CAA’s RSMS sits at the heart of its approach to Performance‑Based Regulation (PBR). ICAO Annex 19, combined with the EASA Authority Requirements (ARs) for EU Member States, requires national authorities to implement their own management systems for safety regulation.’ 29 The CAA has stated that it is for the operator to decide whether to implement an SMS. 30 Accident to Folland Gnat G-TIMM, reported in AAIB Bulletin 5/2016.

79 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.17.3.4 Safety culture The European Strategic Safety Initiative defines safety culture as follows: ‘Safety Culture is the set of enduring values and attitudes regarding safety issues, shared by every member of every level of an organisation. Safety Culture refers to the extent to which every individual and every group of the organisation is aware of the risks and unknown hazards induced by its activities; is continuously behaving so as to preserve and enhance safety; is willing and able to adapt itself when facing safety issues; is willing to communicate safety issues; and consistently evaluates safety related behaviour.’31 The Health and Safety Executive (HSE) defines safety culture as follows: ‘The safety culture of an organisation is the product of individual and group values, attitudes, perceptions, competencies, and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organisation’s health and safety management.’32 Eurocontrol33 provides the following definition: ‘Safety Culture is the way safety is perceived, valued and prioritised in an organisation. It reflects the real commitment to safety at all levels in the organisation.’ 34 1.17.4 Approval process for UK civil flying displays in 2015 1.17.4.1 The Air Navigation Order Article 162 of the 2009 edition of the Air Navigation Order, current at the time of the accident (ANO) (2009) stated: ‘…no person may act as the organiser of a flying display (in this article referred to as ‘the flying display director’) without first obtaining the permission of the CAA for that flying display.’ 31 Safety management system and safety culture working group, ‘Safety culture framework for the ECAST SMS-WG.’ (European Commercial Aviation Safety Team SMS working group). 32 HSC (1993) ACSNI (Health and Safety Commission Advisory Committee on the Safety of Nuclear Installations) study group on human factors. Third report Organising for Safety. HSE Books. 33 Eurocontrol is the European organisation for the safety of air navigation. 34 Eurocontrol, ‘Safety Culture in ATM an Overview.’ (ATM – air traffic management).

80 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Guidance to FDDs and others involved in the organisation of flying displays is provided by the CAA in CAP 403. Following an application to hold a flying display the CAA may, if it is satisfied that the person is suitable, authorise an individual to be the FDD. CAP 403 states that the FDD is: ‘…the person responsible to the CAA for the safe conduct of a flying display.’ And: ‘Before a Permission can be issued, the CAA must be satisfied that: A person is fit and competent as an FDD, having regard in particular to his previous conduct and experience, his organisation, staffing and other arrangements, to safely organise the proposed flying display.’ The CAA does not define the phrase ‘fit and competent’. It stated: ‘The CAA must be satisfied of the requirements set out in Article 162 of the ANO. The CAA relies upon the explanatory material contained in CAP 403 Edition 13 (para. 2.2 and 2.3). Currently, an FDD is assessed on the basis of personal knowledge of the CAA’s Flight Display Inspector about the individual, his competence and capabilities and any other specific intelligence from prior activities. Also taken into account are the arrangements being made for the flying display. Acceptance of an individual is recorded on the Article 162 permission. This approval is based upon the judgment and knowledge of the CAA’s Flight Display Inspector, taking into account the knowledge of the individual in relation to the elements required by the ANO and CAP 403. There is currently (January 2016) no written policy document that describes selection criteria for a person in relation to acceptance as a FDD.’ The AAIB made Safety Recommendation 2016-032 in Special Bulletin S1/2016 regarding the selection criteria for FDDs (see Section 4.9).

81 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The CAA process for issuing an ANO Article 162 permission, titled: ‘Issuing General Aviation Exemptions and Permissions’, required the FSO to review the application form and prepare a site map. Section 8.2 of that document stated: ‘The principle reason for rejecting an application for a Permission under the ANO 2009 Article 162 is safety. This primarily hinges around the viability of the site for the intended display. Factors such as the proximity of congested areas, heavily used major roads, man-made or natural dangerous obstructions and controlled airspace must be taken into account.’ 1.17.4.2 Ownership of risk The investigation heard conflicting views about who held the ownership of flying display risk. The FDD and the organisers of the Shoreham Airshow believed that the CAA held the risk and the CAA considered that the risk was held by the organisers and the FDD. The FDD stated his belief that the CAA issued an Article 162 permission for a flying display only when it was “satisfied that the situation is safe” and that it would intervene if it believed that “everything is not satisfactory”. The organiser expressed the view that the CAA remains ”the gatekeeper” of all safety and risk management relating to air displays. In 2001 the HSE published the document ‘Reducing risks, protecting people’, the aim of which was to explain the basis for HSE’s decisions regarding the degree and form of regulatory control of risk from occupational hazards35. The document notes that the regulatory environment now has to cope with the increasing trend in industry and elsewhere to outsource work and hence risks, and states: ‘Some of these changes have blurred legal responsibilities for occupational health and safety, traditionally placed on those who create the risks or on those best situated to take steps to control the risks. In certain industries it is often no longer easy to determine who may be in such a position. Though case law has in many instances clarified the situation, the fact remains that for many sectors the above factors make it more difficult to coordinate the adoption of measures for controlling risks. Many more players are involved, some with little access to expertise. 35 The document does not refer specifically to aviation. It is reported here to provide information about risk ownership in organisational environments more generally.

82 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information There has in consequence been a growing demand by small firms for a reversion to prescriptive regulation, running counter to the self-regulatory approach – a demand resisted by large firms because they do not face the same problems and are comfortable with the self-regulatory approach. This has resulted in greater emphasis being placed on the need for clarity of the status and content of the guidance element of the architecture of regulation.’ 1.17.4.3 Risk assessment of flying displays CAP 403 states: ‘Displays must be carefully planned both on the ground and in the air and nothing should be considered without careful thought to ensure that it is safe. A risk assessment procedure is included to help in this process.’ This process was included in Appendix A to CAP 403, which among other things provided tables for deciding levels of severity and likelihood of an occurrence. CAP 403 set out a five-step process, as follows: ‘1. Identify the hazards associated with activities contributing to the event, where the activities are carried out and how they will be undertaken

Identify those at risk and how they may be harmed

Identify existing precautions

Evaluate the risks

Decide what further actions may be required, i.e. mitigation.’ This process is similar to those suggested by the HSE, the Event Industry Forum and others. The HSE states that risk assessments should be conducted by a competent person and defines such a person as: ‘…someone who has sufficient training and experience or knowledge and other qualities that allow them to assist you properly. The level of competence required will depend on the complexity of the situation.’

83 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.17.4.4 Hierarchy of control The HSE and other safety organisations use a ‘hierarchy of control’ for mitigating hazards, listing control measures in order of decreasing effectiveness, as follows:

Elimination (e.g. remove the hazardous element entirely)

Substitution (e.g. replace the material or process with a less hazardous one)

Engineering Controls (e.g. separate the hazard from others by enclosing or guarding)

Administrative Controls (e.g. use warning signs, briefings and procedures)

Personal protective clothes and equipment (if controls 1-4 have all been found ineffective) 1.17.4.5 Hazardous materials risk assessments CAP 403 states that: ‘…risk assessments should contain specific mitigation for dealing with any aviation materials which could become unstable following an accident.’ And: ‘Event Organisers should be aware of the increasing use of hazardous materials, such as carbon fibre, in modern military and civil aircraft construction. Information on such hazards should be included in the risk assessment.’ 1.17.5 Organisation of the Shoreham Airshow The Shoreham Airshow was organised by a company formed specifically to run it, which leased the aerodrome from the aerodrome operator for the period surrounding the event. The organiser contracted a specialist safety consultancy to produce an Event Plan, an Emergency Response Plan, risk assessments for the ground operations (referred to later as the ground operations risk assessment), and to liaise with the emergency services. An Emergency Services Group (ESG) comprising members of the local emergency services, the local authority and others provided comment on the Event Plan and Emergency Response Plan. Elements of the event required a licence from the local authority, but this did not include the flying display itself.

84 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The FDD booked the display acts, arranged the Article 162 permission from the CAA, was responsible for the flying activity, and attended the ESG meetings and a ‘table-top’ simulated emergency response exercise. The FDD provided participants with a briefing document which contained event timings, rules for the flying display, restrictions, and a copy of the Article 162 permission including the CAA-issued map of the flying display area.  Section 4 of the briefing document stated: ‘Display pilots are aware of the fact that their aircraft must be operated in accordance with any airworthiness limitations and that only manoeuvres that are known and have been practiced are to be flown…Furthermore, aircraft positioning at all times to be such that, in the event of an engine or airframe failure causing a forced landing or ground impact, this would be outside the crowd area.’   The second paragraph of Section 18 of the briefing document, ‘Emergency, Fire, Medical and Security’, stated: With the increasing number of earlier jets participating in displays, would pilots concerned please brief the fire crew or Display Park Director of any special requirements or procedures regarding fire handling and the safety of ejector seats.’ The Shoreham FDD had completed a risk assessment relating to the flying display, which stated, in part: ‘For the effective safety management of Flying Display Operations at Shoreham RAFA Air Display 2015 it is essential that all Airshow‑specific aircraft operations, both on the ground and in the air are assessed and the risk quantified.’ The risk assessment document listed ten hazards that had been identified and subject to risk assessment: ‘Airside unauthorised access Mid-air collision – Display and non-Display aircraft Mid-air collision - Display formation Ejector seat impacts crowd Loss of control due to pilot disorientation Location Road and of local built up areas Public Assembly on A27 and local roads

85 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Aircraft Crash Outside the Airfield Boundary Fast Jet aircraft collision into crowd area Fatigue amongst key safety staff’ Each hazard was considered based on a probability of occurrence (Figure 18) and the severity of the consequence (Figure 19). An acceptability matrix (Figure  20) was then applied which defined the risk associated with each hazard as either: ‘‘acceptable’ (may be continued without further reference) ‘unacceptable’ (positive actions must be taken to reduce the risk to an acceptable level before the activity is undertaken) ‘review’ (review must be undertaken at the earliest opportunity in an effort to reduce the risk to an acceptable level)’ CLASSIFICATION FREQUENT OCCASIONAL REMOTE IMPROBABLE EXTREMELY IMPROBABLE Quanlitative Definition.

Likely to occur many times during the Shoreham RAFA Air Display 2015. Likely to ocur sometime during the Shoreham RAF Air Display 2015. Unlikely but possible to occur during the Shoreham RAFA Air Display 2015. Very Unlikely to occur during the Shoreham RAFA Air Display 2015.

Almost inconceivable event will occur during the Shoreham RAFA Air Display 2015. Quantitative Definition.

Definition not required as the Flying Display programme is regulated to one aircraft or one formation displaying at any time.

Figure 18 Probability of occurrence table CLASSIFICATION CATASTROPHIC HAZARDOUS MAJOR MINOR NEGLIGIBLE Results in one or more of the following effects

◊ Total loss of one or more aircraft and/ or multiple fatalities as a result of an aircraft incident during the Shoreham RAFA Air Display 2015 that may or may not lead to Display Cancellation. ◊ Major aircraft damage and/ or a single fatality as a result of an aircraft incident that may or/ may not lead to a prolonged or permanent suspension of the Flying Display.

◊ Serious aircraft incident leading to the temporary suspension of the Flying Display.

◊ Minor aircraft incident that could result in interruption to the Flying Display.

◊ No effect on Shoreham RAFA Air Display 2015.

Figure 19 Consequence severity table

86 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information PROBABILITY EXTREMELY IMPROBABLE IMPROBABLE REMOTE OCCASIONAL FREQUENT OUTCOME CATASTROPHIC REVIEW UNACCEPTABLE UNACCEPTABLE UNACCEPTABLE UNACCEPTABLE HAZARDOUS REVIEW REVIEW UNACCEPTABLE UNACCEPTABLE UNACCEPTABLE MAJOR ACCEPTABLE REVIEW REVIEW REVIEW UNACCEPTABLE MINOR ACCEPTABLE ACCEPTABLE ACCEPTABLE ACCEPTABLE REVIEW NEGLIGIBLE ACCEPTABLE ACCEPTABLE ACCEPTABLE ACCEPTABLE ACCEPTABLE Figure 20 Acceptability matrix HAZARD NUMBER HAZARD DESCRIPTION S P R MITIGATION ACTIONS REQUIRED BY WHOM 8 Aircraft Crash Outside the Airfield Boundary C I U Display regulations require pilots to observe the normal Rules of the Air when outside the display area. There are the major restrictions on displaying aircraft that require them to be at specific minimum heights when over specific areas around the display site. Pilots will be specifically briefed on this restriction at the display briefing. All crews to be briefed on safety requirements and mandatory operating regulations prior to each display flight.

All flights to be monitored by the FDD and FCC to ensure compliance with the regulations, observance of agreed display programme and consistency of presentation. FDD and CFCC to have direct radio contact with the display pilot and can intervene to stop the display at any time. FDD

FDD & FCC

FDD & CFCC Figure 21 Example hazard: 8 - Aircraft Crash outside the airfield boundary At the time of the accident, CAP 403 did not require risk assessments to be submitted to the CAA when applying for approval to hold a flying display. The CAA informed the AAIB that when considering applications for flying displays, and when attending flying displays to conduct inspections, it did not inspect or request copies of hazard logs or risk assessments.

The FDD of the Shoreham display was the FDD at two flying displays after 22 August 2015, for which he applied to the CAA for Article 162 permissions. The risk assessments he presented to the CAA in support of these applications were not materially different from that for Shoreham. Article 162 permissions were issued in both cases and the FDD stated that he interpreted this as confirmation these risk assessments were considered fit for purpose.

87 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.17.6 Independent review of risk assessment The AAIB commissioned a review by the Health and Safety Laboratory (HSL) of the risk assessment for the 2015 Shoreham Airshow. The complete HSL report is included at Appendix J. The HSL considered the risk assessment in the context of guidance available in CAP 403 and elsewhere, and included a comparison with the corresponding risk assessments for two other flying displays at Shoreham. It did not compare the risk assessment with risk assessments from flying displays other than those, and did not determine whether it was “better” or “worse” than the norm. The HSL was not asked to report on any other activities undertaken by the FDD. Its report concluded that the risk assessment did not fully comply with the guidance given in CAP 403. It stated: ‘It was found that the Shoreham Airshow Air Display Risk Assessment contained a number of deficiencies compared to what would be expected for a risk assessment to control risks to the public. There is little, or no, evidence that: ● ●all relevant parties were consulted in the assessment of the hazards and risks, ● ●a comprehensive list of foreseeable hazards was identified, ● ●sufficient and achievable mitigation measures were considered and implemented, ● ●lessons were learned from near misses or incidents at previous airshows (either previous Shoreham airshows or other airshows) There is no demonstration that the hazards and risks identified have been managed sufficiently. The risk assessment does not fully comply with the CAA guidance for air displays… The conclusion of the review is that the 2015 Shoreham Airshow Air Display Risk Assessment is not fit for the purpose of identifying and mitigating the risks and hazards to the public from the air display activities of the airshow.’

88 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The following Safety Recommendation was made in the AAIB Special Bulletin S1/2016: Safety Recommendation 2016-031 It is recommended that the Civil Aviation Authority review and publish guidance that is suitable and sufficient to enable the organisers of flying displays to manage the associated risks, including the conduct of risk assessments. The CAA responded in Follow-up Action on Occurrence Report (FACTOR) F4/2016, published on 9 June 2016, as follows: ‘The CAA has accepted the recommendation that it should review its guidance. It remains the responsibility of the organisers of flying displays to follow this guidance and conduct risk assessments that are suitable and sufficient to manage the risks associated with the air displays that they are organising. The CAA reviewed its guidance and published updated guidance on 3 May 2016 in an updated version of the CAA’s document ‘Flying displays and special events: A guide to safety and administrative arrangements.’ The AAIB commissioned a further HSL study to consider the risk assessment guidance provided by CAP 403 Edition 13. This report is included at Appendix K. The HSL report concluded: ‘A number of observations have been made of good practice in hazard and risk assessment in CAP 403. There are some areas of the guidance, however, where additional information could be of benefit to those using it and would potentially lead to greater confidence that a risk assessment created using the guidance will be suitable and sufficient for managing the risks. This study has identified areas of the guidance where changes are required to give airshow flying display organisers the information needed to undertake meaningful risk assessments, or in some cases, to avoid misleading organisers on what needs to be done. Ultimately, these improvements should ensure that the risk assessments help airshow organisers to target and control the risks from flying displays.’

89 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information It recommended that: ● ● CAP 403 should clearly list the qualifications and experience required of the people who should be involved in assessing the risks. ● ● CAP 403 should include additional information to stress the importance of the hazard identification process to the quality of the overall risk assessment. ● ● CAP 403 guidance could also recommend that a record be kept of the hazard identification process. ● ● CAP 403 is potentially misleading in the area of risk mitigation. This is a significant area that needs to be improved as failing to properly assess the mitigation measures could lead to inappropriate or unachievable measures being put in place that do not control or reduce the risks. ● ● It should be explicitly stated that an explanation should be recorded of how the identified mitigation measures lower the classification of severity or likelihood. ● ● The tolerability of risk criteria should be reviewed as some high consequence events are deemed “tolerable” for relatively frequent likelihoods. The report identified other modifications that might assist flying display organisers and risk assessors.

The CAA updated its response to Safety Recommendation 2016-031 in FACTOR F4/2016 Issue 2, published on 24 January 2017, as follows: ‘The CAA will review the findings contained in the HSL reports on the management of risk, in conjunction with the conclusions of its post-implementation review of UK Civil Air Displays. The CAA will complete this review and publish any updated guidance by April 2017.’

90 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.17.7 Sequential listing of manoeuvres At the time of the accident there was no requirement for the organisers of flying displays or FDDs to be provided with the sequential listing of manoeuvres to be flown by each act. The AAIB explored the regulation of flying displays in other countries where there is some regulation of flying display activity. The circumstances in these countries may be different from those in the UK, but provide examples of other frameworks36. For example, in relation to the sequential listing of manoeuvres, Transport Canada (the aviation regulator in Canada) requires organisers of flying displays to provide the following information at least 10 days before the intended flying display: ‘…sequential listing of all manoeuvres to be flown by the performer, including: (i) the distance of each manoeuvre from spectator areas, including, where applicable, the point of entry into and recovery from each manoeuvre, (ii) the point of entry to, and departure from, the flying display area, where applicable, (iii) the directions of flight relative to the spectator areas, (iv) the location of water drops, pyrotechnics, helicopter rappelling and similar operations relative to the spectator areas, (v) the maximum and minimum speeds for the entire performance, and (vi) the minimum altitudes for each manoeuvre to be performed’ 1.17.8 Airworthiness and national permits to fly ICAO International Standards and Recommended Practices, Annex 8, Airworthiness of Aircraft, defines the following terms: ‘Airworthy. The status of an aircraft, engine, propeller or part when it conforms to its approved design and is in a condition for safe operation. 36 The CAA noted that a number of other EU Member States follow the “UK model” and CAP 403

91 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Continuing airworthiness. The set of processes by which an aircraft, engine, propeller or part complies with the applicable airworthiness requirements and remains in a condition for safe operation throughout its operating life. Maintenance. The performance of tasks required to ensure the continuing airworthiness of an aircraft, including any one or combination of overhaul, inspection, replacement, defect rectification, and the embodiment of a modification or repair.’ The 2009 edition of the ANO, current at the time of the accident, set out the regulations concerning national permits to fly, including: ‘21 Issue of national permits to fly (1) Subject to paragraph (2), the CAA must issue for any non- EASA aircraft registered in the United Kingdom a national permit to fly if it is satisfied that the aircraft is fit to fly having regard to the airworthiness of the aircraft and the conditions to be attached to the permit…. ...The CAA may issue a national permit to fly subject to such conditions relating to the airworthiness, operation or maintenance of the aircraft as it thinks fit. Nothing in this Order obliges the CAA to accept an application for the issue, variation or renewal of a national permit to fly if the application is not supported by such reports from such persons approved under article 244 as the CAA may specify, either generally or in a particular case or class of cases. 22 National permits to fly ceasing to be in force and issue of airworthiness directives for permit aircraft (1) A national permit to fly ceases to be in force if: (a) the CAA has issued a directive that requires: (i) an inspection to be carried out for the purpose of ascertaining whether the aircraft remains airworthy; or (ii) modification or maintenance of the aircraft or any of its equipment necessary for the airworthiness of the aircraft for the purpose of ensuring that the aircraft remains airworthy; or (b) completion of an inspection, modification or maintenance of the aircraft is required as a condition of the permit to fly.

92 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information A national permit to fly which has ceased to be in force under paragraph (1) comes into force again as soon as: (c) any such inspection, modification or maintenance has been satisfactorily completed; and (d) in the case of an inspection, any consequential repair, replacement or modification has been satisfactorily carried out. A national permit to fly ceases to be in force: (e) if any condition (other than a condition of the permit requiring an inspection, modification or maintenance) is not complied with; (f) if the aircraft, engines or propellers, or such of its equipment as is necessary for the airworthiness of the aircraft, are modified or repaired, unless the repair or modification has been approved by the CAA or by a person approved by the CAA for that purpose. A national permit to fly is not in force unless the permit includes a current certificate of validity issued by the CAA or by a person approved by the CAA for that purpose. In this article a certificate of validity means a certificate which certifies that a national permit to fly remains valid for the period specified in the certificate and a certificate of validity is current during that period.’ 1.17.9 Acceptance and maintenance of ex-military aircraft on the UK civil register An aircraft is “airworthy” if it complies with all relevant regulations and requirements of a national certifying authority such as the CAA. The design standard for acceptance of an ex-military aircraft such as G-BXFI is defined in an Airworthiness Approval Note (AAN), and its initial airworthiness is certified by the CAA issuing a National Permit to Fly (NPF). These will include any conditions and limitations under which the aircraft may be flown and any relevant airworthiness, operation or maintenance requirements that are to be met. Appendix L shows the AAN for G-BXFI, No. 26172 Issue 2, dated July 2008. Appendix C shows the NPF for G-BXFI.

93 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The CAA issues an AAN after reviewing an aircraft and its documentation, based on a technical report submitted by the applicant organisation. The AAN is unique to each aircraft and forms the basis of its airworthiness approval. The AAN defines the technical standard of an aircraft and its operational limitations, the documents required to maintain and operate it and any additional requirements applicable at the time of issue. It is a ‘snapshot’ of the aircraft’s status at the time it was placed on the civil register but may be revised by the CAA to reflect changes in an aircraft’s modification standard or a change of a limitation or requirement. The AAN does not usually specify the amendment status of each document listed. An internal CAA Airworthiness Division Technical Procedure, TP-DAW-23-2 ‘Ex  Military Aircraft on a Permit to Fly’ dated 4 July 2012, describes the airworthiness design procedures and standards applied to ex-military aircraft operating on a NPF and provides guidance to CAA Surveyors when considering ex-military aircraft for acceptance onto the UK civil register. This document describes the application process for a NPF, the technical information that should be provided with the application and the information that should be considered for inclusion in the aircraft’s AAN. For fixed wing aircraft with a mass greater than 2,730 kg the initial application for a NPF must be submitted by an organisation approved for that purpose under BCAR A8-20 – Group E4 Design Assessment or, since November 2013, BCAR A8-25 Supplement 2. When issued, the NPF is considered to be ‘non-expiring’. In order to validate the NPF, and to verify that the aircraft remains compliant, an annual submission must be made to the CAA confirming that the aircraft continues to satisfy the requirements of its NPF. This submission includes confirmation that the aircraft is compliant with the requirements of the AAN and all applicable MPDs. When this submission has been verified, a Certificate of Validity (C of V) is issued for the aircraft. At the time of the accident, the CAA required that ex-military jet aircraft on the UK civil register were maintained by organisations holding approvals under BCAR A8-20, 23 or 2537. The privileges granted to a BCAR A8-20 approved organisation (such as the organisation responsible for the maintenance of G-BXFI) allow it to ‘self-certify’ that an aircraft continues to meet the requirements of its NPF and to issue a C of V. The CAA has no requirement to check that such self-certifications are valid but it does perform general compliance audits as part of its oversight of approved organisations. 37 At the time of publication the CAA requires that ex-military jet aircraft on the UK civil register are maintained by organisations holding approvals under BCAR A8-23 or -24 and managed by organisations holding approvals under BCAR A8-25. The period for organisations to transition from A8-20 to A8-23 or -24 and -25 ended in January 2016.

94 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The continued airworthiness of the aircraft is then subject to its operation within specified limitations, a programme of approved maintenance and defect rectification, and compliance with any additional MPDs. The relevant airworthiness procedures were contained in CAP 733 – ‘Permit to Fly Aircraft’ and Chapter A3-7 of CAP 553 – ‘BCAR [British Civil Airworthiness Requirements] Section A – Airworthiness Procedures where the CAA has Primary Responsibility for Type Approval of the Product’. 1.17.10 Maintenance organisation approval The organisation responsible for the aircraft’s maintenance at the time of the accident was contracted by the aircraft operator to provide all maintenance and continuing airworthiness functions for G-BXFI. It held BCAR A8-20 ‘M5 maintenance’ and ‘E4 design’ approvals. These approvals allowed the organisation to restore and maintain former military aircraft for operation on the UK civil register. The requirements of the approvals are defined in Chapter A8‑20 of CAP 553. An Exposition approved by the CAA contained the management organisation, maintenance procedures and quality procedures, also known as Quality Management System (QMS), for the organisation. 1.18 Additional information 1.18.1 The accident manoeuvre The pilot referred to the planned manoeuvre as a ‘bent loop’, a variation of a conventional loop involving a rolling element. A loop is entered from straight and level flight. The nose of the aircraft is then pitched up continuously, passing through the inverted attitude at the apex and continuing through the downward vertical until the aircraft returns to the required height in a straight and level attitude. The entry and exit ground track is the same. See Figure 22. The pilot described the bent loop as a manoeuvre performed by entering a loop and, towards the end of the first quarter, just before the aircraft is vertical, rolling the aircraft a desired amount while continuing to pitch the nose up. The aircraft continues pitching nose-up, pulling through the second half of the loop, which results in the exit track being different from the entry track by the amount of roll applied. See Figure 23. He added that his normal technique was to change the aircraft heading and resulting track by part of the desired amount on the upward vertical, and adjusting the heading on the downward vertical to achieve the desired exit track.

95 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Figure 22 Loop Figure 23 Manoeuvre with vertical component and roll resulting in a change of ground track

96 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information In the accident manoeuvre the aircraft rolled through a greater angle than in the manoeuvre intended by the pilot and resulted in an exit ground track approximately 60° right of the entry ground track. The pilot stated that he had not noticed any problems with the altimeters but commented that he only used the altimeter in front of him (the left altimeter) and not the altimeter on the right. The pilot’s description of altimeter operation in G-BXFI indicated that he was not familiar with selection of the altimeter between standby and servo mode, and that he was not in the habit of changing between these modes. Members of the FCC estimated the height of the aircraft at the apex of the accident manoeuvre. The lowest height estimated was 1,800 ft and the highest estimate was 2,500 ft. 1.18.2 Aircraft handling The TP was asked to describe the method for flying a loop and a loop with a rolling component, in a Hawker Hunter, using the minimum entry speed of 350 KIAS declared by the accident pilot. The TP also described an escape manoeuvre that could be flown if thrust was lost during the first half of the manoeuvre or if a safe gate height was not achieved. His descriptions are set out below. 1.18.2.1 Flying a loop ‘At 350 KIAS and in straight and level flight, select full power and make an aft stick input to pull up initially at approximately 4g, and maintain this until in the vertical.  If buffet onset occurs during this phase the pull force should be adjusted to maintain buffet onset.  Once through the up-vertical the pull force should be adjusted to achieve a pitch rate that ensures that the height at the apex is above the gate height.  At the apex, which is cued to the pilot by the nose being slightly above the horizon, the height and speed are checked.  If above the gate height and below the maximum speed, the loop is continued by modulating the pull force on the stick to give a positive pitch rate to ensure that the aircraft is in level flight at no lower than the permitted minimum height. It should be noted that the pitch rate in the third quarter of the loop (apex to down-vertical) should be high enough that the pull force and g are reducing in the latter stages of the manoeuvre as level off is approached.  The power may be reduced at or past the apex of the loop to achieve an airspeed at level off which is the entry speed

97 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information for the next manoeuvre, typically a reduction to about half throttle at the apex.  If at the apex the aircraft is below the gate height or the speed is above the maximum (defined because the higher the speed at the apex, the higher the g needed to achieve the radius required during the pull through), an ‘escape manoeuvre’ is flown by moving the stick forward to achieve close to zero pitch rate, then smoothly rolling to wings level and then gently pulling back on the stick to achieve level flight.  The nose will drop during this manoeuvre and speed will increase, and if the airspeed is very low at the apex then, prior to rolling, the pitch rate can be maintained to place the aircraft into a shallow dive with increasing airspeed before commencing the roll.’ If flaps are used during a loop, they should be selected once the speed has reduced below 300 KIAS during the pull up; this requires an increase in the pull force on the stick to counter the nose-down trim change due to the flaps and, if required, to use the increase in g that the flaps will provide.  During the downwards half of the loop, the flaps should be selected up at a speed to ensure that they are up before accelerating through 300 KIAS.’ 1.18.2.2 Flying a ‘bent loop’ ‘If the exit heading from a loop is required to be different to the entry heading, there are several means of achieving this, and one is to ‘bend’ the loop by gently rolling during the upwards first half.  If the exit heading is required to be greater than the entry heading (i.e. to the right) the aircraft is rolled left and vice versa. The technique for this is to enter as per a ‘straight’ loop but approaching the up-vertical to pick a point on the horizon to roll towards such that the nose tracks through that point, wings level, at the apex and then gives the required exit heading.  For example, for a 90 degree bend, that point is directly abeam the pilot as he looks out of the side of the canopy towards which he will roll.  Having chosen that point, the pilot commences a gentle roll towards the chosen point on the horizon whilst simultaneously reducing the pull on the stick slightly in order to achieve the same apex height as for a ‘straight’ loop.  The roll rate is modulated to achieve wings level with the nose directly above the chosen point, and then the loop is completed as for a “straight” loop.’

98 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.2.3 Technique for a loss of thrust during the upward half of a loop ‘Any loss of thrust during the first half of a loop that has been  planned  to be flown  with a high power setting will require the aircraft to be flown to achieve wings level flight at a suitable airspeed (gliding speed if a total power loss has occurred) as soon as possible.  If the power loss occurs at or after passing the up vertical, the loop is continued and an escape manoeuvre flown at or just past the apex as described above.  If it occurs before the up vertical the aircraft should be rolled inverted and the nose pulled towards the horizon.  On reaching the apex attitude (nose just above or on the horizon), an escape manoeuvre as described above should be flown.  Even following a total engine failure, the elevator and aileron accumulators should allow the control inputs required for these manoeuvres to be made before the flying controls revert to “Manual” and, therefore, the aircraft response to control inputs would be normal.  Once the escape manoeuvre has been completed an attempt can, if appropriate, be made to regain power.  If power cannot be regained, the aircraft can be positioned for a forced landing if sufficient energy and a suitable runway are available.  If not, it can be pointed into as safe an area as possible prior to ejection.’ 1.18.2.4 Entry speed ‘In aircraft such as the Hunter, the pilot should have derived and nominated a minimum entry speed for each looping manoeuvre that he will fly. Invariably, this speed will be higher if the manoeuvre involves pulling down through the vertical in the second half, such as a complete loop, than if it is an upwards half loop or a manoeuvre such as a half Cuban 8 (5/8 loop with a 180˚ roll from inverted to erect on a down 45˚ line followed by a pull back to level flight). The minimum speed used will be predicated on having a specified power setting and a minimum entry height. If the minimum speed is not achieved then the manoeuvre is not entered and there may be several options for a replacement manoeuvre. For example, if the minimum speed for a complete loop is not achieved but that for a half Cuban 8 is then the latter manoeuvre may be flown. However, the option to just fly through into the following manoeuvre always exists. Looping manoeuvres will invariably be entered above the minimum speed but if too much above then the resulting apex height increase may be excessive, the G pulled may also be excessive, and the exit speed may be wrong for the following manoeuvre. Therefore, energy needs to be managed well in order to achieve the required entry speed for a looping manoeuvre.’

99 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.2.5 Minimum apex (‘gate’) height ‘In order to complete safely the downwards half of a looping manoeuvre a pilot will have a nominated minimum or “gate” height which the aircraft must be above. There will usually be a maximum airspeed associated with the gate height because, if above this speed, excessive g will be required in order to achieve the same radius, possibly resulting in an aircraft overstress or physiological problems for the pilot. Also, if the Mach number increases significantly then elevator/tailplane effectiveness may be reduced such that it may not be possible to achieve the required g. If the aircraft is below the gate height at the apex of a loop then the pilot flies an escape manoeuvre which consists of a smooth roll through 180˚ back to erect flight. The nose will drop into a shallow dive during this roll but this results in an increase in airspeed which helps with the pull back to level flight. If the airspeed is very low at the apex the pilot may continue to pull the aircraft into a shallow [inverted] dive to increase airspeed before commencing the roll. Despite an escape manoeuvre resulting in a shallow dive, if the aircraft has completed an upwards half loop then sufficient height should always be available to complete [the escape manoeuvre] back to level flight safely.’ 1.18.2.6 Entry criteria for low-speed aircraft such as the RV-8 ‘Low-speed aerobatic aircraft have a small looping radius and a high pitch rate. Therefore, there is little variation in the height gained from pull up and insufficient time at the apex to check height, compare it to a ‘gate’ height, decide whether to continue or to abort and then complete an escape manoeuvre without exiting in a very steep dive which could, if roll performance is poor, result in a greater height loss than continuing the loop. Therefore, in low speed aircraft an apex gate height will usually not be used but a minimum entry height will be used in addition to a minimum entry speed. If the loop entry speed is above maximum level flight speed then the manoeuvre will be entered from a dive and, in order to have the required exit speed to fly the following manoeuvre, the exit height will normally be below the pull-up height. So saying, in most aircraft you could pull out to exit at the pull-up height but the completion speed would be significantly less than the pull-up speed.’

100 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.2.7 Correct use of gate heights The AAIB was not able to obtain a comprehensive insight into the use of gate heights by display pilots. However, two pilots other than the accident pilot, who had relevant military and fast jet experience and were interviewed in the course of the investigation, volunteered that they had used an incorrect gate height during a display, or omitted to check a gate height. 1.18.3 Review of recorded imagery by the Test Pilot 1.18.3.1 Background The TP made observations on the following image recordings: • Cockpit and external image recordings of the display flown at Duxford on 13 September 2014. • Cockpit and external image recordings of the display flown at Shoreham on 30 August 2014. • The accident manoeuvre at Shoreham on 22 August 2015. His comments are set out below. 1.18.3.2 Flying display at Duxford in 2014 Loop: ‘The external video shows that the loop was flown with some flap selected through all portions when the flaps were visible. The airbrake was selected out during the turn after the arrival pass and remained out throughout the first half of the loop up to the apex although when the aspect allowed the airbrake to be seen again (just before the down vertical line) it had been retracted. The in-cockpit video shows that in the decelerating turn following the arrival pass a flap selection was made at 360 KIAS although it was not possible to identify any airbrake selections. 12 seconds before pull-up full power was selected and 8,000 rpm indicated (8,100 rpm audio) and this was maintained until the apex when a power reduction was made; the minimum rpm during the second half of the loop was 7,200 rpm indicated (7,000 audio) but it was varying and flown mainly with an average of 7,500 rpm indicated. Eight seconds before pull-up the airspeed was 320 KIAS and increasing. Pull-up to apex was 15 seconds, and 2 seconds past the apex the airspeed was increasing through 150 KIAS and the

101 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information height (from the right instrument panel altimeter) was 4250 ft aal. The manoeuvre was completed 30 seconds after pull-up at 320 KIAS and with a minimum altimeter reading of 400 ft. Overall, this manoeuvre was, with the exception of the airbrake being out for the first half, in accordance with the pilot’s declared nominal parameters. There was no logical reason to have flown the start of the loop with the airbrake out whilst having full power selected. Therefore, it is probable that either the pilot forgot to select it in before pull-up or an ‘in’ selection had been made but was not effective and was not noticed by the pilot. However, it appears that a successful ‘in’ selection was made close to the apex.’ First half Cuban 8: ‘The external video shows that some flap was selected throughout the manoeuvre. The pull-up was from 360 KIAS and 250 ft indicated on the altimeter with full power, although a small aft throttle input was made just after pull-up, followed by an almost immediate reselection of full power. These small throttle movements, that result in a power changes of about 800 rpm indicated, are seen on the majority of occasions in the looping manoeuvres although they would have had no effect on the manoeuvres at all. Approximately three seconds past the apex the airspeed was increasing through 200 kts with the altimeter indicating a height of 4,500 ft. The manoeuvre was completed at 400 KIAS and 300 ft when the aircraft entered a right turn. The final pull out was controlled and the aerobatic minimum of 500 ft could easily have been captured.’ Second half Cuban 8: ‘The external video shows that this was flown with the flaps up. The pull-up was from 430 KIAS at 300 ft with 7,950 rpm indicated (8,050  audio) although the power was reduced to 7,400 rpm indicated (7,130 audio) just after pull-up. Five seconds past the apex the altimeter was reducing through 4,700 ft with the airspeed increasing through 230 KIAS at which point the roll was commenced. The manoeuvre was completed with 7,950 rpm indicated (8,050 audio) set, and at 410 KIAS and 300 ft in a similar manner to the first half Cuban 8.’

102 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.3.3 Flying display at Shoreham in 2014 ‘Bent loop’: ‘This was flown with some flap selected during the turn before pull‑up and maintained until after completion of the manoeuvre. The pull-up was initiated whilst rolling out of the left hand turn and was made with 6,720 rpm indicated (6,720 audio) set. The power was subsequently increased to 7,850 rpm indicated (7,920 audio) by the apex, then during the downward half reduced to 7,500 rpm indicated (7,180 audio) and increased finally to 7,930 rpm indicated in the subsequent climb but when passing through level flight was 7,610 rpm indicated (7,800 audio). The time from pull-up to apex was approximately 2 seconds less than for the 2015 display indicating that the 2014 manoeuvre was flown with a higher mean pitch rate. The test data indicates that the upward part of the 2015 accident manoeuvre had to have been flown at maximum instantaneous turn performance in order to have achieved such a low apex height. Therefore, to have achieved a higher pitch rate in 2014 the airspeed must have been greater, indicating that the airspeed at pull-up was greater in 2014 than in 2015. A slight pitch-rate reduction occurred passing the down-vertical line and the level-off on completion of the loop was smooth, indicating that the apex height had a comfortable margin above what was required for a safe gate height. The exit heading was along the display line parallel to the crowd.’ Half Cuban 8s: ‘Two half Cuban 8s were flown, both with some flap selected throughout. The rpm at pull-up for the first one was 7,650 rpm indicated, reached 8,000 rpm indicated (8,050 audio) and at the apex this was increased to 8,050 rpm indicated (8,100 audio). For the second, the pull-up was flown with 8,030 rpm indicated (8,060 audio) selected and the rpm was then reduced to 7,370 rpm indicated (7,180 audio) in the climb and increased to 7,500 rpm indicated (7,430 audio) at the apex. The JPT with full throttle selected appeared to be slightly higher than on take-off and was possibly up to 580˚C.’

103 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.3.4 Flying display at Shoreham in 2015 Accident manoeuvre: ‘The accident manoeuvre had several significant deviations from the nominal parameters that the pilot stated he used for a Bent Loop. Specifically: The entry airspeed of 310 KIAS +/- 15 kt was 25 - 55 KIAS less than the declared nominal value of 350 KIAS.

The rpm at pull up (derived from the spectrum analysis of the action camera audio) was 7,530 audio, which reduced to less than 6,800 audio, possibly as low as 6,500 audio during the upward half of the manoeuvre and was increased transiently to 7,210 audio. It was 7,010 audio at the apex. This was contrary to the pilot’s declared nominal power setting of increasing to full power at or shortly after the pull‑up. The throttle was not visible on the video and so it is not possible to confirm whether the rpms were pilot selected or due to an engine malfunction.

The airspeed at the apex of the manoeuvre was 105 +/-2 KIAS which was at the very bottom of his stated acceptable airspeed range.

The manoeuvre was continued into the downward half of a loop although the apex height of approximately 2,700 ft was significantly below the lowest value of 3,500 ft that the pilot stated was required to complete the manoeuvre in order not to descend below his 500 ft aerobatic minima.

The downward half of the manoeuvre had a flightpath that tracked straight along the A27 and there appeared to be no attempt to change the flightpath in order to track away from that road. The accident manoeuvre featured very low energy. Of the other six looping manoeuvres analysed, no others had such a significantly low entry speed when compared to that of the nominal manoeuvre described by the pilot, and the low power during pull-up of the accident manoeuvre was not seen in any other. Therefore, all of the other manoeuvres had an apex height above the minimum gate height. The combination of low entry speed and less than maximum thrust meant that the apex height was below the minimum gate height of 3,500 feet and the airspeed at the apex was 105 +/- 2 KIAS. This was the lowest apex airspeed identified

104 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information by the pilot of G-BXFI and was less than his normally expected airspeed of 150 KIAS. In these circumstances the correct action would have been to perform an escape manoeuvre; rolling erect and then pulling out of the resulting dive [shown in Figure 24].’ Figure 24 Illustration of a rolling escape manoeuvre If the height at the apex of the loop is less than the gate height, the stick is moved forward to stop the pitch rate and the aircraft is then rolled through 180°, with the wing unloaded, and then recovered from any descent and returned to level flight. 1.18.3.5 Manoeuvres analogous to escape manoeuvres The TP made the following observations concerning the relationship between an escape manoeuvre and manoeuvres the pilot may have conducted previously, such as a half Cuban 8. ‘There are several manoeuvres flown in many aircraft types that, upon initial consideration, may appear to be analogous to an escape manoeuvre flown at the apex of a loop during low level aerobatics. The criteria that determine the validity of the analogy are the cues and parameter values that a pilot uses, the airspeed existing when the roll is performed and the precise, detailed control strategy that is subsequently employed. Below is a description of these aspects for an escape manoeuvre and the relevant differences for other manoeuvres which may be considered analogous.

105 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information a. Escape manoeuvre In a looping manoeuvre flown at an air display, the pilot will have visual cues available throughout and therefore should have continual awareness of the aircraft’s attitude. At the apex (usually assessed from a pitch attitude comparison against the visual horizon and then confirmed by altimeter indication rate of change being zero), the cue for deciding whether or not to continue with the looping manoeuvre or to perform an escape manoeuvre will be an altimeter reading which is then compared to a known ‘gate height’. Sometimes, there may also be a secondary airspeed consideration even if above the gate height (normally a maximum airspeed and applicable to manoeuvres such as a reverse Cuban 8 or vertical 8). The decision to fly an escape manoeuvre will be made in a near level, inverted attitude. If airspeed is low, the pitch rate may be maintained until in a shallow dive before continuing with the escape manoeuvre. The control strategy in a Hunter is then to reduce the pitch rate to zero (to reduce the amount of nose drop whilst rolling and to reduce angle of attack and thus any departure tendency) and then to roll gently to wings level whilst restraining the rudder at neutral. The aircraft is then pitched nose up to regain level flight. b. 1/2 Cuban 8 In this manoeuvre the fundamental difference to an escape manoeuvre as described above is that the loop is continued until on a down 45˚ line before the pitch rate is stopped and the roll to erect flown. The airspeed when the roll is commenced will be significantly greater than at the apex and will be increasing, and elevator and/or rudder inputs are used to maintain a straight flightpath on the down 45˚ line. It is possible to fly an escape manoeuvre in this manner but that is the extreme nose down pitch attitude that would be used rather than the norm. The fundamental differences to an escape manoeuvre as described above is that the airspeed will be significantly greater in a 1/2 Cuban 8 and that elevator and rudder inputs will be made to control the flightpath.’ 1.18.3.6 Other observations A loose article was seen on the video during the aerobatic sequences at both the Duxford and Shoreham displays in 2014. During the Duxford 2014 display, an A5 size document fell into the cockpit canopy the first time the aircraft became inverted. It then fell down into the cockpit when the aircraft was rolled upright as part of the manoeuvre being undertaken. It did not reappear during the remainder of the display.

106 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information During the Shoreham display in 2014, the pilot was wearing an action camera attached with Velcro to the right side of his flying helmet. During the first rolling manoeuvre the helmet communication lead became caught over the camera and, during the roll to the upright, the lead pulled the camera from the helmet causing it to fall down into the cockpit. It did not reappear during the remainder of the display. The pilot was not seen to recover either loose object and both this display and the display at Duxford continued. CAP 403, Paragraph 5.19, ‘Pre-flight inspection’, stated: ‘The normal pre-flight inspection is to be carried out with special emphasis on the following areas’: Item c) ‘Thorough check for loose objects in the cockpit and elsewhere in the aircraft.’ CAP 403 also draws attention to the hazard of ‘loose articles in the cockpit’. The operator’s OCM did not contain any requirements or guidance on loose articles or fitting of action cameras. With no formal SMS, and relying on informal regular contact between the operator’s two pilots, both loose article incidents went unreported and the Chief Pilot was unaware of them. 1.18.4 UK flying display statistics 1.18.4.1 Fatal accidents at UK flying displays 1996-2015 Table 8 lists fatal accidents at UK flying displays between 1996 and 2015, showing the total flying hours and hours on type of the pilot in each case. The figure is clustered by location (within or outside the area controlled by the display organiser).

107 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information

Date Reg'n Type Location1 What happened Total hours Hours on type 1 22/08/2015 G-BXFI Hawker Hunter Outside Insufficient height to complete looping manoeuvre 14,249 43 2 01/08/2015 G-TIMM Gnat Outside Loss of control rolling manoeuvre 706 218 3 19/06/2010 G-DUKK Extra 300 Outside Did not recover from spin manoeuvre with sufficient height 3,600 70 4 15/09/2007 G-HURR Hawker Hurricane Outside Loss of control during rolling manoeuvre 1,115 186 5 31/05/2003 ES-XCL Spirit of St Louis Replica Outside Structural failure of wing 21,200 190 6 02/06/2001 G-DHAV DH 115 Vampire Outside Loss of control in wake vortex 4,398 185 7 21/07/1996 G-ASKH DH 98 Mosquito Outside Loss of control in rolling manoeuvre, engine issue 10,395 72 8 11/07/1996 N3145X P-38 Lightning Outside (initial impact on airfield) Loss of control in rolling manoeuvre 14,500 60 9 01/07/2012 G-EBHX2 DH 53 Hummingbird On airfield Loss of control in gusty conditions 14,780 0.9 10 03/07/2001 G-BTWR Bell King Cobra On airfield Loss of control in vertical manoeuvre 7,730 13 11 18/08/2000 G-MAYA L29 Delfin Offshore- in MEZ3 Did not recover from vertical manoeuvre 18,222 235 12 09/08/1998 G-BIVZ Druine Turbulent On airfield Loss of control, stalled in formation 784 219 13 04/06/1996 G-FLYV Slingsby On Airfield Did not recover from vertical manoeuvre 3,675 2,500 Table 8 Fatal accidents38 at UK flying displays 1996-2015 Table footnotes: 1 In relation to area controlled by display organiser. 2 The accident to G-EBHX occurred during a display practice at a time when the display crowd was present and the provisions intended for the flying display were in place. 3 Maritime Exclusion Zone. 38 The accident to G-BXFI was the only fatal accident in this table in which members of the public were also fatally injured.

108 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Table 9 lists the other UK civil flying display-related accidents in this period, identified by the AAIB. It excludes the accidents involving engine failure where damage was sustained during the subsequent forced landing. No Date Reg’n Type Location What happened Total hours Hours on type Worst injury 14 22/04/ 2015 G-EDGJ Edge 360 Outside (Practice) Did not recover from vertical manoeuvre 1,290 265 Fatal 15 27/04/ 2013 G-CHFS Replica Fokker EIII On Airfield (Practice) Loss of control rolling manoeuvre 1,903 10 Fatal 16 10/07/ 2012 G-BZGK North American OV-10 Bronco Outside (Practice) Loss of control, rolling manoeuvre 4,096 179 Serious 17 10/07/ 2011 D-FBBD Mustang Outside (Display) Mid-air collision 3,894 1035 Minor 18 22/08/2010 G-IZII Swift Glider On Airfield (Display) Loss of control during landing 473 57 Serious 19 21/07/2002 G-AKXS Tiger Moth On Airfield (Display) Loss of control 14,481 280 Serious Table 9 Selected other UK flying display-related accidents 1996-2015 The flying experience of display pilots involved in fatal accidents during flying displays in this period ranged from 706 hrs to 21,200 hrs. 1.18.4.2 UK flying display accidents where the aircraft crashed in the area below its display Fourteen of the nineteen listed UK display and display practice-related accidents have occurred where control of the aircraft was lost, or structural failure occurred, and it subsequently impacted the surface beneath the manoeuvring area. Table 10 identifies those in the twenty years to 2015:

109 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Year Registration Display / Practice Fatalities 2015 G-BXFI Display Yes 2015 G-EDGJ Practice Yes 2013 G-CHFS Practice Yes 2012 G-BZGK Practice No 2012 G-EBHX Display Yes 2010 G-IZII Display No 2010 G-DUKK Display Yes 2007 G-HURR Display Yes 2003 ES-XCL Display Yes 2001 G-BTWR Display Yes 2000 G-MAYA Display Yes 1998 G-BIVZ Display Yes 1996 N3145X Display Yes 1996 G-FLYV Display Yes Table 10 Display accidents involving impact beneath the manoeuvring area 1.18.4.3 Accident rates at flying displays The CAA estimated that the overall UK general aviation fatal accident rate between 2005 and 2014, including display flying, was approximately 1.3 fatal accidents per 100,000 flying hours39. It does not define a target acceptable level of safety for UK flying displays, and it does not monitor the accident rate for display flying, the number of display items or the number of hours flown by civil display aircraft in any year. CAA records show that in 2015 there were 254 ‘Article 162 permissions’ granted. These included approximately 1,480 individual civil display items40. There were two fatal accidents at organised displays in 2015. Considering a longer period, and assuming the planned 2015 activity was typical, there has been 1 fatal accident per 2,960 display items in the period 2008 to 201541. 39 CAP 1284 – ‘Public consultation: UK Private Pilot Licence and National Private Pilot Licence medical requirements’, published May 2015, Figure 2. CAP 1284 does not specify the date range for this figure. 40 This included 1,730 items approved at civil displays minus approximately 250 UK military items at civil air displays. It was not possible to correct for foreign military or items approved but which did not perform due to weather, technical failure or other reasons. 41 This period was chosen to coincide with relevant data available from the USA, which was of sufficient detail to enable the number of fatal accidents to be extracted, distinct from the total number of fatalities caused.

110 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The International Council of Air Shows, the flying display industry body in the USA and Canada, estimated that in the USA the civil flying display accident rate is 1 fatal accident per 5,600 display items. Between 1996 and 2015 more than half of UK display accidents involved the aircraft crashing outside the area controlled by the organisers of the display. This equates, at 2015 levels of activity, to one display aircraft crash in an area accessible to the public every 2.2 years. Aircraft involved in UK flying display accidents between 1996 and 2015 crashed at varying distances from the areas controlled by the display organisers. The most distant was 2,000 m from the closest point on the aerodrome, following a mid-air collision with the aircraft on an upward trajectory.

1. 18.4.4

Scale of UK flying displays in 2015 Based on the available CAA records, the approximate scale of activity at UK civil flying displays in 2015 is set out in Table 11. An ‘item’ may involve more than one aircraft, for example in the case of a formation display. Half the Article 162 permissions were for a single display item and 84% involved less than seven items42. Number of display items Number of displays Single display item 126 2 to 6 acts 87 7 to 15 24 16 to 20 11 21 or more 6 30 or more Nil Table 11 Article 162 display permissions by size 2015 1.18.4.5 UK flying display activity in 2015, by month UK flying displays occur mostly at the weekends between May and September (see Figure 25 and Figure 26). As an example, in different parts of the UK, on 11 July 2015 there were 16 Article 162 permissions in effect. 42 Displays of seven or more items require a Flying Control Committee.

111 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 4 34 38 59 65 38 11 1 0 10 20 30 40 50 60 70 Number of Art 162 Permissions Month Figure 25 Number43 of approved flying displays in the UK per month in 2015 0 2 4 6 8 10 12 14 16 18 Apr May Jun Jul Aug Sep Oct Nov Number of displays per day Date Figure 26 Distribution of flying displays in the UK in 2015 by month 43 A single permission can cover a flying display held over more than one day.

112 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.4.6 Other aircraft accidents in the UK involving third-party fatalities The AAIB used the CAA’s database of mandatory occurrence reports to search for aircraft accidents involving third-party fatalities in the 40 year period from 197644 to 2015. Accidents involving persons being struck by propellers or rotors during ground operations were excluded as were two accidents involving helicopters operating under Air Operator Certificates. Four accidents were identified and are shown below: Date Type Details Third-party fatalities 09/08/2005 Glider Descended outside airfield during racing finish; struck photographer 1 03/07/1998 Glider Normal landing; struck pedestrian on public right of way which crossed runway 1 30/04/1987 Cessna 172 Loss of control in flight, struck and destroyed yacht 2 28/09/1985 Gemini Microlight Loss of control on takeoff from public fete; struck group of spectators 1 (7 injured) Table 12 Other UK aircraft accidents involving third-party fatalities 1.18.5 Monitoring of safety standards at flying displays 1.18.5.1 CAA staff competencies and resources In 2015 the CAA GAU had two flying display inspectors known as Operations Flight Standards Officers (FSO). A document provided by the CAA, dated 20 October 2014, described the role of a FSO as including: ‘…undertaking specific inspecting audit and oversight tasks…to ensure effective and proportionate on-going oversight of the GA activity meets agreed safety and performance standards’… It listed the ‘principal accountabilities’ of an FSO, including: ‘• Prepare and issue Permissions, Exemptions, Approvals and Variations in area of allocated responsibilities. 44 The database began in 1976. The CAA stated that in a ten year period from 2006-2015 there were no aircraft accidents involving third-party fatalities other than that involving G-BXFI. This information is included to show that the total recorded number of aircraft accidents involving third-party fatalities is not large.

113 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information • Conduct Inspections and Audits in area of allocated responsibilities including Flying Displays, Ex-Military Aircraft Operators, Model Aircraft and Parachuting to establish that operators are compliant with the legislative requirements and to establish an assessment of risk for each operator. • Provide expert input into the regulation of the UK General Aviation Industry to support the GA Unit policy of developing proportionate and performance based oversight to encourage a vibrant GA industry within the UK. • Identify and develop amendments to CAPs and guidance material to keep it up to date with technical and legislative changes.’ It listed the knowledge and experience required of an FSO, as follows: ‘• Must hold or have held a private or professional pilot licence, or have current substantive authority and industry regulatory experience that provides an equivalent level of knowledge required for the job role. • Must have or [have] held a UK CAA Display Authorisation. • Must have thorough knowledge of all aspects of aircraft operations gained through appropriate flying experience, or through authority and industry regulatory experience. • Must be able to communicate verbally and in writing to a high standard. • Must be able to utilise project management disciplines to ensure assigned work is managed to agreed criteria of cost, time and quality. • Must be able to understand and analyse complex technical data.’ Both of the FSO’s held current UK DAs.

One of the FSOs in the CAA GAU had conducted inspections and audits of Article 162 displays and CAP 632 organisations for five years. According to his training records he had received formal training in conducting audits in November  2014. The other FSO’s training records did not show any formal training in the conduct of audits. He had attended a course entitled ‘Advanced Safety Management – Evaluating for Effectiveness’ provided by CAA International Services between 23 and 24 March 2015.

114 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.5.2 UK Display inspections CAP 403 states: ‘The CAA GA Unit is required to inspect and monitor safety standards at a number of events annually.’ On 28 October 2015 the CAA published CAP 1351 - ‘CAA Review of Civil Air Displays: progress report’, which stated that: ‘CAA experts visit a significant number of air displays each year to: • monitor safety standards • confirm the rules are being complied with • identify measures that might further enhance safety standards’ The CAA’s 1996 Review stated that: ‘The Authority had conducted 37 display inspections during 1996 and it was intended to maintain that level of inspection for the 1997 season…it was considered that an acceptable level of safety monitoring in this regard will occur.’ The CAA informed the AAIB that in 2014 it gave permission for 281 displays and inspected eight45 of them (2.8%). In 2015 the CAA attended 18 of the 254 displays (7%), including six displays following the accident to G-BXFI some of which were attended by non-specialist staff. In Special Bulletin S1/2016 the AAIB stated that in the USA, regulatory staff of the Federal Aviation Administration (FAA) attend every authorised display46. The FAA states that: ‘The inspector’s responsibility is to provide adequate safety oversight of the aviation event and to ensure compliance with the provisions of the waiver or authorization.’ The CAA stated that it considers the FAA has a different role in relation to air displays, with a different approach and funding model. 45 At the time of publication of Special Bulletin 1/2016 the CAA had located the inspection reports for five displays (including a model aircraft flying display), and therefore was reported as having attended four (1.4%). Subsequently the CAA located four additional inspection reports that had not been entered into its computerised systems. Accordingly, the AAIB now understands that the CAA inspected eight displays in 2014. 46 The FAA occasionally waives this requirement, in specific circumstances, generally for fewer than 10 events each year.

115 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.6 Separation between the primary crowd and displaying aircraft CAP 403 states the minimum separation distances required between the crowd line and relevant display line based on the speed of the displaying aircraft. At the time of the accident these separation distances had not changed for several years47. The accident to G-BXFI did not involve the primary crowd and its separation from the display aircraft. Nevertheless, as part of its investigation into the separation of the public from the consequences of a loss of an aircraft, the AAIB requested that the CAA provide it with the information supporting the current arrangements. The CAA commissioned a study, published in 1993, (referred to here as the 1993 Study48) to assist it in determining if the existing distances specified in CAP 403 were appropriate. The 1993 Study considered a structural failure, during a display flight, of two different aircraft types: a fast jet travelling at 350 kt and a single piston-engined aircraft travelling at 100 kt. Computer modelling predicted the distance that debris from the aircraft would travel until it reached a height of 5 feet above the surface. The modelling assumed that each aircraft was making a level, 4g turn onto its respective display line, separated from the crowd by the relevant distance shown in CAP 403. The 1993 Study showed that in the circumstances considered, and for both types of aircraft, substantial pieces of wreckage such as engines would cross the crowd line. In the case of the fast jet aircraft it was predicted that the engine(s) would enter the crowd area by at least 130 m. The 1993 Study concluded that: ‘The current issue of CAP 403, ‘Flying Displays: A Guide to Safety and Administrative Arrangements’, reference 2, includes regulations concerning minimum crowd line to display axis distances that are well judged and for the majority of conditions appear to offer a sensible compromise between airshow attractiveness and safety.’ 47 The distances have been amended following this accident and are subject to further review. 48 Airshow Separation Distances, Cranfield Aviation Safety Centre, July 1993.

116 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Since the study there have been advances in both technical modelling capability and in the understanding of managing risk to the public. The accidents considered in the study had low probability but significant consequences. The study showed that display separation distances still being specified in 2015 offered no greater protection of the primary crowd than during the 1952 Farnborough Airshow accident49. 1.18.7 Non-participant third parties and secondary crowds 1.18.7.1 A27 vehicular traffic Figures from the Department for Transport show that on average 58,50050 vehicles use the A27 between the junctions of the A2025 and the A283 daily. This section of road includes the area to the north of Shoreham Airport where the accident occurred. By comparison, a section of motorway that passes another popular UK display site is used by an average of 40,30251 vehicles per day. The organisers of the Shoreham Airshow informed the AAIB that, several years previously, they had discussed closure of the A27 with relevant parties but had been told it would be impossible to close such an important road for the event. Highways England informed the AAIB that mechanisms existed to close major roads such as the A27 for large events, for a few minutes at a time or longer, and that it would consider any case proposed by an event organiser on the basis of risk, cost and benefit. Highways England did not receive a request in relation to the 2015 Shoreham Airshow and it did not comment on what its decision might have been had the organisers done so. 1.18.7.2 Secondary spectators The FAA uses the phrase ‘secondary spectator areas’ in its display regulations regarding the protection of persons who decide to watch an event away from the official crowd. 49 On 6 September 1952 a DH110 prototype fighter aircraft broke up in flight while being demonstrated at the Farnborough Airshow. Parts of the aircraft entered the crowd, injuring 31 fatally. 50 Figures for 2014, the latest year for which they were available. 51 Figures for 2015, the latest year for which they were available.

117 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information These are defined in Section 33 of the FAA FSIMS52 8900 as follows: ‘Secondary Spectator Areas: Any area, not designated as a primary spectator area, where people have a natural tendency to gather to observe the event. This includes, but is not limited to, private property or property not under the control of the event organizer, public roads and private access roads.’53 FSIMS requires display organisers to put in place minimum separations and overflight conditions in relation to these areas. CAP 403 highlights that secondary spectator areas should be discouraged by the display organisers but does not put in place specific protection for them. However, it states: ‘At many events, particularly at airfield sites, the congregation of spectators, outside the airfield boundary, on the live-side, may give organisers cause for concern. […] It is recommended that the event organiser anticipates this during the planning process and takes necessary steps to reduce it by, where possible, blocking the view from obvious vantage points.’ The organisers of the 2015 Shoreham Airshow had identified that the junction of the A27 was a popular location from which to view the display. The AAIB was informed that in previous years several hundred people had been observed at the road junction between the A27, Shoreham Bypass, and the Old Shoreham Road, and in the grounds of a nearby, now closed, public house. The display organisers and the local emergency services had been concerned about the road traffic risk to these crowds and the display organisers had taken steps to minimise the number of people in this area. The ground operations risk assessment identified the hazard as, ‘Fast moving trunk road. 70 mph dual carriageway Traffic lights and queuing traffic.’ and proposed the action as ‘Traffic management plan in place. No right turns. Traffic Lights off and 40 mph limit in place.’

The arrangements, which had been in place for several years, included restricting the view of the airfield, placing signs in the area and having stewards ask people to move on. However, neither the organisers nor the police had requested or been granted the power to exclude people from this area and their efforts did not prevent a gathering at the A27 junction. 52 Flight standards information management system. 53 Unlike the primary crowd area permission may be given for display aircraft to overfly the secondary crowd area if at height of more than 500 ft with wings-level and climbing.

118 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.7.3 Other non-participant third parties CAP 403 requires display organisers to consider: ‘The proximity of congested areas, particularly if they include schools or hospitals.’ Approximately 40% of the surface area, within 2 km of Shoreham Airport, encompasses residential, industrial and recreational parts of settlements, the A27, a rail route and the buildings of Lancing College (Figure 27). Figure 27 2 km radius of Shoreham with congested and high density areas shown in grey There is a large fuel storage facility within an industrial site, located 500 m from the north-east end of the display line, which it is estimated can contain up to 600,000 ltr of road vehicle fuels. Some of these areas were marked on the display map showing overflight restrictions (see Figure 8). AAIB Special Bulletin S1/2016 described that both the FAA and Transport Canada require flying display-related aerobatic flight below normal heights54 to be conducted within a designated volume of airspace, known in Canada as a ‘flying display area’ or in the USA as an ‘aerobatic box’ . 54 The FAA prohibits aerobatic flight below 1,500 ft agl, Transport Canada prohibits aerobatic flight below 2,000 ft agl outside such a volume of airspace.

119 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.8 Previous Safety Recommendation On 15 September 2007, a Hawker Hurricane, G-HURR, crashed while taking part in a flying display at Shoreham Airport. AAIB Aircraft Accident Report 6/2009, concerning this accident, contained six Safety Recommendations. Safety Recommendation 2009-052 stated: ‘It is recommended that the UK Civil Aviation Authority requires that the sequence of manoeuvres for a flying display is clearly specified in advance of the display and provided to the display organiser and that the sequence is practised prior to displaying to the public.’ On 20 October 2009, the CAA published a FACTOR F10/2009 in which it gave its response to the Safety Recommendation, as follows: ‘The CAA accepts this Recommendation in so far as, since the start of the 2008 display season, it has been a requirement for both display pilots and display organisers that any large formation or set piece display must have been specified prior to the display. The requirement to practice the display sequence is already covered in CAP 403, CH 6, para 5. However it is believed to be impractical to require that individual civilian display pilots specify a display sequence prior to the display and are then not allowed to vary it or modify it in any way later. Circumstances and weather conditions on the day of the display, such as time pressure in the display programme and wind strength, may make it safer to vary a display, for example by moving one or more manoeuvres from the approved sequence or by flying a flat display, rather than adhere strictly to the display originally specified.’ The FSOs in post at the time were actively involved in display flying and, like some others in the flying display community, were opposed to accepting Safety Recommendation 2009-052. However, following discussions within the CAA and with members of the flying display community, the then Head of Flight Operations decided that the Safety Recommendation should be accepted and implemented. His decision was recorded and reported in a second FACTOR issued on 9 April 2010, revising the response of 20 October 2009:

120 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information CAA Response ‘The CAA accepts the Recommendation. CAP 403 (Eleventh Edition – dated 1 April 2009) requires that: a. the flying display director during the planning phase of the event will be required to consider and manage pilot display programmes. b. the Flying Display Director ensures that pilots do not carry out any form of impromptu display. c. participants remain aware that the impromptu, ad hoc, unrehearsed or unplanned should never be attempted. d. the Flying Display Director is charged with circulating, prior to the event a written brief to all participants which will include details of manoeuvres to be flown at the event that are known and have been practised (including bad weather ‘flat shows’). e. pilots are required to have flown or practised at least three full display sequences (at least one of which was flown or practised on the aircraft type to be utilised in the display) in the 90 days preceding the event. f. on the day of the event, no pilot may take part in the event unless he has participated in the formal Flying Display briefing, either in person or telephonically (if he is not landing at the flying display site).' In this response the phrase ‘pilot display programmes’ appears to have replaced ‘sequence of manoeuvres’ specified in the Safety Recommendation, and it is not clear if it was intended to address the same issue. The FDD of the 2015 Shoreham Airshow did not know the sequence of manoeuvres intended to be flown by the pilot of GBXFI, and CAP 403 did not indicate that he should. 1.18.9 Minimum heights 1.18.9.1 Authorised display heights A pilot’s DA states the minimum height at which the holder may fly during a display. The CAA commented that this is intended to be an absolute minimum, not a target, and that the pilot must comply with the normal rules of the air55 when not on the display line. Consequently, depending on the aircraft type and length of the display line, the minimum height listed on the pilot’s DA might not be achievable over the entire length of the display line, if at all. 55 This report refers to ‘normal rules of the air’ as those that apply other than at flying displays.

121 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.9.2 Application of minimum heights Part 33 of the ANO, ‘Interpretation’, defines aerobatics as: ‘Aerobatic manoeuvres’ includes loops, spins, rolls, bunts, stall turns, inverted flying and any other similar manoeuvre.’ The report of the CAA’s ‘United Kingdom Civil Air Display 1996 Review’, published on 22 April 1997, stated at Section 3.6.3 that: ‘Pilots whose DA included an aerobatic approval were cleared to perform aerobatic manoeuvres to a specified base height. The DA might also include a fly-by height lower than the aerobatic manoeuvre base height. It was noted that it had become common practice for pilots to use their fly-by height in the middle of an aerobatic sequence, provided they had completed the aerobatic manoeuvre by the specified base height. There was some concern that such an interpretation could lead to subsequent aerobatic manoeuvres being commenced from the wrong datum.’ Following the accident to G-BXFI, the CAA introduced an enhanced risk assessment process. The AAIB was provided with the results of this process for some sites. In it the CAA assessor referred to ‘normal rules of the air’ applying away from the display line as a mitigation related to aircraft overflying roads. The risk assessment for the 2015 Shoreham Airshow identified ‘compliance with the Rules of the Air’ as a mitigation for the hazard of an ‘Aircraft Crash Outside the Airfield Boundary’. The information provided indicated that the CAA, and the Shoreham FDD, assumed pilots would only descend to their approved minimum height over the display line, and the Shoreham risk assessment appeared to rely on this to manage the risk associated with flight at low heights during the flying display. 1.18.9.3 Standardised European Rules of the Air European Union Regulation 923/2012 issued on 26 September 2012 sets out the Standardised European Rules of the Air (SERA). Section 3, paragraph 3105 ‘Minimum heights’ states: ‘Except when necessary for take-off or landing, or except by permission from the competent authority, aircraft shall not be flown over the congested areas of cities, towns or settlements or over an open-air assembly of persons, unless at such a height as will permit, in the event of an emergency arising, a landing to be made without undue hazard to persons or property on the surface. The minimum heights for VFR flights shall be those specified in SERA.5005(f).’

122 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Section 5 paragraph 5005(f), requires aircraft under Visual Flight Rules (VFR) to be at minimum heights of either 500 ft or 1,000 ft depending on other conditions56. The European Aviation Safety Agency ‘Acceptable Means of Compliance (AMC) and Guidance Material to the Rules of the Air’ published in July 2013 state: ‘The permission from the competent authority to fly at lower levels than those stipulated in SERA.5005(f) and SERA.5015(b) may be granted either as a general exemption for unlimited number of cases or for a specific flight upon specific request. The competent authority is responsible for ensuring that the level of safety resulting from such permissions is acceptable.’ 1.18.9.4 CAA exemption from SERA 5005(f) On 13 August 201557 the CAA, as the competent authority in the UK, issued ‘Official Record Series 4-1124’ (ORS4-1124) relating to SERA. It stated in paragraph 4: ‘Flying Displays, Air Races and Contests The Civil Aviation Authority permits, under SERA.3105 and SERA.5005(f), an aircraft taking part in a flying display, air race or contest to fly below 150 metres (500 feet) above the ground or water or closer than 150 metres (500 feet) to any person, vessel, vehicle or structure if it is within a horizontal distance of 1,000 metres of the gathering of persons assembled to witness the event.’ The EASA AMC requires the competent authority to ensure that the resulting level of safety is acceptable. The CAA has not provided any risk assessments or other relevant documentation to support its decision to issue the exemption, but stated: ‘Rule 5 and Rule 6 of the Rules of the Air Regulation 2007 were the relevant rules in place in the UK prior to the publication and implementation of the SERA rules. These rules had been in place since at least 1996 and there was no evidence to suggest that these rules were inherently unsafe.’ 56 SERA 5005(f) states: Except when necessary for take-off or landing, or except by permission from the competent authority, a VFR flight shall not be flown: (1) over the congested areas of cities, towns or settlements or over an open-air assembly of persons at a height less than 300 m (1 000 ft) above the highest obstacle within a radius of 600 m from the aircraft; (2) elsewhere than as specified in (1), at a height less than 150 m (500 ft) above the ground or water, or 150 m (500 ft) above the highest obstacle within a radius of 150 m (500 ft) from the aircraft. 57 Although the ORS exemption was issued in August 2015 this continued a previous UK derogation from the EU standards.

123 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information In August 2005 a glider (BGA 4665), involved in an air race in Leicestershire, struck and fatally injured a person standing outside the boundary of the aerodrome at which it was operating. The AAIB report58 stated: ‘…the root cause was the practice of flying too low outside the confines of the airfield and resorting to pop-up manoeuvres to clear obstacles.’ Five Safety Recommendations were made, including the following: Safety Recommendation 2006-120 The Civil Aviation Authority should clarify and publicise whether permission from the Authority is required before exemption from the 500 feet low-flying rule in accordance with Rule 5 (3)(f) is applicable. In an interim response, in April 2007, the CAA indicated that it accepted this Safety Recommendation stating: ‘…the CAA intends to change Rule 5 (3)(f) as it is unsatisfactory in its present form.’ However, Rule 5(3)(f) was not changed until superseded by the SERA, and the permission in ORS4-1124 has the same effect as Rule 5(3)(f). 1.18.9.5 SERA implementation Between 2008 and 2012, Eurocontrol led the development of SERA. Part A was the first phase and transposed ICAO Annex 2. Part B involved the Rules of the Air and was EASA led. Member States and industry were consulted. The European Commission decided not to introduce Part A but merge it with Part B. The SERA took effect on 12 December 2012 but there was a derogation period until December 2014 during which member states did not have to apply SERA and during which the CAA carried out a full UK consultation in 2013, for which a 12 week period was allowed. The CAA produced a paper, dated 9 May 2013, entitled ‘Standardised European Rules of the Air – UK implementation’, in which, on page 6, a timescale for completing the process was set out. There was some deviation from this timescale but this was mainly due to a rewrite of the ANO, and the CAA were exempted from implementation until April 2015. The ANO revision was centred on the progression of ANO Rules of the Air being aligned with SERA to remove duplication and ensure consistency. 58 Glider BGA 4665, published in AAIB Bulletin 2/2007.

124 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The then Chairman of the CAA SERA implementation working group was unaware of the accident to the glider referred to earlier, the associated AAIB Safety Recommendation and the CAA’s intention to change Rule 5 (3)(f). No comment was made in the SERA consultation report relating to this issue and therefore the Permission was retained. The AAIB made the following Safety Recommendation in Special Bulletin S1/2016 following the accident to G-BXFI: Safety Recommendation 2016-036 It is recommended that the Civil Aviation Authority remove the general exemptions to flight at minimum heights issued for Flying Displays, Air Races and Contests outlined in Official Record Series 4-1124 and specify the boundaries of a flying display within which any Permission applies. The CAA first responded to Safety Recommendation 2016-036 in FACTOR F4/2016, issued on 9 June 2016, removing Official Record Series 4-1124. It updated its response in FACTOR F4/2016 Issue 2, as follows: ‘The CAA has removed the general exemption to flight at minimum heights issued for civil air displays, air races and contests, outlined in Official Record Series 4-1124. Display Permissions granted by CAA under Article 86 of the Air Navigation Order 2016 now specify the boundaries of a flying display within which the permission applies.’ 1.18.10 Human factors 1.18.10.1 Physiology The AAIB considered whether subtle incapacitation by g forces could have reduced pilot performance during the left turn prior to the pull-up into the accident manoeuvre. The actual g experienced is not known because the cockpit g-meter was not functioning, but a study of the available data by the Royal Air Force Centre of Aviation Medicine (RAFCAM) concluded that a high g load was not present at any point in the left turn preceding the entry to, or in the upward half of, the accident manoeuvre. The peak g force calculated for the turn was 2.7 g and, whilst g tolerance varies, it was considered unlikely that the pilot was either partially or totally incapacitated by g forces immediately prior to commencing the accident manoeuvre.

125 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The Consultant in Aviation Medicine (RAF) concluded: ‘Although some day to day variation in G tolerance occurs in every individual, it would be very unusual for an individual to suffer G related impairment at less than +3Gz while wearing a G suit. The video evidence reviewed herein shows no evidence of the classically described G-Loc59 or A-Loc60 syndromes, and the G levels in the accident video are similar to previously experienced levels flown without incident (eg in the Duxford video). Therefore, I can find no evidence of G related impairment in the material available for review.’ The available information did not support an accurate assessment of the peak g force during the accident manoeuvre. As far as could be determined from cockpit image recordings the pilot appeared alert and active throughout the flight. 1.18.10.2 Study of human performance The investigation commissioned a study by the RAFCAM of human factors (HF) that may have contributed to the accident. The study focused on the accident manoeuvre. The aim of the analysis was to understand the scope for human actions and decisions that may have contributed to the accident sequence. Its report refers to the ‘AAIB Operations Advisor’, who was the TP conducting the flight trials and assisted with other aspects of the investigation. A task analysis and human error analysis considered two points in the manoeuvre:

The entry to the accident manoeuvre

The apex of the accident manoeuvre The study aimed to identify which factors affected the following four phases of the hazard sequence: • Hazard entry. - The probability the aircraft would enter a hazardous scenario; • Recovery. - The probability that the aircraft would successfully recover; 59 G-induced loss of consciousness. 60 Acceleration-induced near-loss of consciousness or “almost loss of consciousness”.

126 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information • Escape. - The probability of the pilot escaping without injury; and • Survival. - The probability of personnel surviving. Entry to the accident manoeuvre The study considered that the pilot’s primary decision for entering the manoeuvre was to assess if the aircraft had achieved a minimum of 350 KIAS, which for a minimum height loop was also a target speed. In the 30 seconds prior to entering the accident manoeuvre, cockpit imagery indicated that the pilot looked down towards the instrument panel four times, suggesting he was actively gathering information. Whilst it is not known if he read the ASI, given that 350 KIAS was his entry gate, it would be reasonable for him to be checking it approaching the pull-up point. It was also important for the pilot to ensure that his entry into the manoeuvre was close to the display line but not too close to the spectators that he would infringe the crowd line. This meant important dual tasks being undertaken splitting his attention between the two. Information gathering has limitations, especially during high workload when activities such as scan pattern, locating the correct instrument, allocation of attention, change blindness, distraction, or visual limitations such as contrast and glare can have significant effects on the accuracy of the information gathered. High workload and distraction reduce the available cognitive resources and so increase the likelihood of error. The entry speed was 310±15 KIAS, which was below the stated target. The study identified the following possibilities for his decision making process: • He did not read the ASI but believed he had and simply entered the manoeuvre, concentrating on positioning and flying technique. • He misread the ASI due to the display of the instrument, high workload or distraction of judging the pull-up point. • He read the ASI correctly and elected to enter the manoeuvre and adjust his technique to achieve a height at the apex that would allow him to pull through. • He read the airspeed correctly but incorrectly recalled the entry speed as 300 KIAS.

127 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The pilot stated that he would use maximum thrust from the point of entry to the apex. Had this been set, the aircraft could have reached a safe apex height even with the lower entry speed that was achieved. The reduced thrust used was either selected by the pilot (intentionally or inadvertently) or the result of an engine malfunction. The use of less than maximum thrust was not a technique he used consistently on the Hunter or Jet Provost. The TP explained the difficulty in detecting reduced thrust during the ‘up vertical’ part of the manoeuvre, and given the pilot’s focus on external cues, if it was not selected by him he was probably unaware of it. The main indicators of a reduction in thrust at the apex would have been the low height (2,700 ft) and low airspeed (approximately 105 kt). The apex of the accident manoeuvre The pilot stated that he required a minimum height of 3,500 ft to pull through and not descend below his minimum authorised height for aerobatics of 500 ft. His declared gate height for the manoeuvre was 4,000 ft, which included an extra 500 ft margin. He expected to see an airspeed of approximately 150 KIAS at the apex. The pilot’s head movements approaching and at the apex were mainly directed outside the cockpit but he appeared to look at the area of the flight instruments briefly twice at the apex. It could not be positively determined if the altimeter was scanned during this time. The primary information required for the decision to continue or abandon the manoeuvre was the aircraft height. The study considered that the single-pointer needle of the altimeter, indicating hundreds of feet, was easily read, but that with the single-pointer between 700 and 800 ft, the thousand feet height counter number could be partially obscured as shown in Figure 28. The study identified three possibilities for his decision to continue the manoeuvre:

The pilot did not read the altimeter

The pilot misread the altimeter

The pilot used an incorrect gate height Workload, distraction and expectation could all influence the accuracy of reading the altimeter but, with only four seconds available for deciding whether to continue or abandon the manoeuvre, the decision must be predetermined and instinctive. The height of 2,700 ft achieved at the apex of the accident manoeuvre was the gate height the pilot used for a ‘bent loop’ in the Jet Provost, and a decision to continue having achieved it would have been correct for the Jet Provost but not for the Hunter. Alternatively, if the pilot’s attention was initially drawn to the ASI, seeing an airspeed of 105 KIAS, well below his expectation, may have distracted him from reading the altimeter or from reading it correctly.

128 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The RAFCAM summarised its findings as follows: ‘Analysis has been undertaken to identify the scope of human actions and/or decisions to have contributed to the loop being continued when below the pilot’s stated minimum height at the apex. It is not possible to determine which, if any, of these actions took place based on the evidence available for the HF analysis, but the following accounts are considered credible and feasible: a. The altimeter may not have been seen or read at the apex of the loop as a result of scan pattern, high workload, allocation of attention, distraction (for instance, from detecting a reduction in thrust during the climb or the airspeed being lower than expected), and/or visual limitations (such as contrast and glare). b. An inaccurate perception of aircraft height may have been obtained, specifically, that the aircraft was higher than it was as a result of the altimeter displaying the incorrect altitude61, a misleading or ambiguous display of the altimeter digit drum [height counter], the altimeter digit drum [height counter] being partially obscured, and/or the altimeter being misread.

c. The minimum height required at apex may have been recalled incorrectly. d. An escape manoeuvre may have not been selected as a result of the limited time available to select and implement the action, and the guidance and training that the pilot received with regard to performing an escape manoeuvre at the apex of a loop in the Hunter.’ The RAFCAM report is included at Appendix M. 61 The RAFCAM report was prepared before the results of the altimeter testing were available.

129 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Figure 28 Altimeter height counter partially obscured by pointer (Barometric pressure setting not as found) 1.18.10.3 Previous Safety Recommendation regarding human factors AAIB Aircraft Accident Report 6/2009 made the following Safety Recommendation: Safety Recommendation 2009-054 It is recommended that the UK Civil Aviation Authority introduce a recurrent programme of Human Factors training for display pilots. The training should specifically address human performance and its limitations when undertaking display flying and should form part of the Display Authorisation process. The CAA responded in FACTOR F10/2009, revised on 9 April 2010, as follows: ‘The CAA accepts this Recommendation. CAA Document 743 “Civil Air Displays, A Guide For Pilots”, which is available on the CAA website, contains Human Factors advice in “plain English”. The application procedure for a Display Authorisation requires a Display Evaluator to cover Human Factors in the form of personal limitations and the applicant’s mental attitude to display flying. Further recurrent training for Human Factors was discussed at the 2009 Display Authorisation Evaluator’s Seminar held in November 2009. An amendment has been made to CAP 403 “Flying Displays and Special Events: A Guide to Safety and Administrative Arrangements” to include a Human Factors reference in the Application Forms.’ CAP 743 was superseded by CAP 1047, the current edition of which was published in July 2013.

130 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.11 CAA Review of Civil Air Displays On 9 September 2015, in response to the accident to G-BXFI, the CAA announced that it would conduct a review of UK civil air displays with the intent of evaluating existing guidance, processes and regulations relating to civil flying displays. On 28 October 2015 the CAA published CAP 1351, ‘CAA Review of Civil Air Displays: progress report’ identifying the following themes which would form the main focus of the review: the overall regulatory framework, flying display locations, flying display aircraft and flying display people. On 26 January 2016 the CAA published CAP 1371, ‘UK Civil Air Display Review: Actions that impact on UK civil air displays in 2016.’ CAP 1371 identified 16 actions that the CAA planned to implement to increase the safety of the public, by introducing additional requirements and formalising existing requirements regarding the planning of flying displays and the roles, responsibilities and competencies of those involved in flying displays. On 14 April 2016 the CAA published CAP 1400, ‘UK civil air display review: final report’, identifying 29 actions (including those previously published in CAP 1371) which the CAA intend to implement as follows: Action 1: The CAA will specify, for all future air displays, the risk assessment criteria that it requires event organisers and Flying Display Directors must use in planning and preparing for air displays of all sizes. Action 2: In their application for permission to hold an air display, an event organiser and/or FDD must provide their enhanced risk assessment and full details of how they propose to mitigate any risks they have identified. They must set out in their safety plans evidence of engagement with other authorities. Action 3: An event organiser must provide the CAA with written detail of how they, with input from the FDD, will communicate with the public about areas where they may be at greater risk. Action 4: The CAA will formalise its procedures for ensuring whether, in its opinion, an applicant has the right attitudes and behaviours to fulfil the role of an FDD. The CAA will develop similar procedures for display pilots and Display Authorisation Evaluators (DAE). Action 5: The CAA will accredit FDDs to meet a defined level of competence.

131 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Action 6: At least one day before an air show, any pilot intending to fly aerobatic sequences that flow directly from one manoeuvre into the next must notify the FDD of the series of linked manoeuvres that they intend to perform. If the information is not provided, the FDD must not allow the pilot to fly in the air show. Action 7: With effect from 1 April 2016, a display authorisation will only remain valid for pilots of all registered aircraft who hold either an EU medical certificate issued by an AME or an ICAO medical certificate that is of an equivalent or higher standard. Action 8: The minimum relevant hours required for a pilot to obtain a DA for complex or high-performance aircraft will be increased. Action 9: The CAA will strengthen the display pilot’s initial validation process by introducing an additional revalidation after the first six months and require that no display pilot has the same DAE conducting the revalidation for more than two consecutive years. Action 10: Currency • display pilots authorised to perform at standard level aerobatics in multiple categories including jet powered and helicopter categories must renew in those categories at least every two years; and • where that authorisation also includes one or more of turboprop, multi-engine piston (MEP) or single-engine piston (SEP) categories they must rotate their renewal across those categories year on year. Action 11: A display pilot authorised to perform above standard level aerobatics and in more than one aircraft category will be required to renew their display authorisation in each category. Action 12: The CAA will strengthen the criteria for the nomination, appointment, induction and documentation for DAEs. These criteria will be in effect for all appointments from 31 March 2016 onwards, including reappointments. Action 13: The CAA will enhance the frequency and intensity of its oversight of DAEs to ensure that they are fulfilling their responsibilities to a satisfactory standard. Action 14: The CAA will assist DAEs to maintain their own competency and continuing professional development by organising an annual DAE seminar.

132 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Action 15: To obtain a display authorisation, pilots must be able to prove that they can plan and perform a series of linked manoeuvres. Action 16: With immediate effect, no member of CAA staff will be permitted to act or sit on a Flying Control Committee, or to act as a DAE. CAA Flying Standard Officers will oversee flying displays and the DAE system. Action 17: Pilots authorised to perform standard level aerobatics will only be permitted to perform loops or barrel rolls in civil registered ex-military jet aircraft at civil air displays if they have received explicit approval from a suitably qualified DAE. Approval will be made clear on a pilot’s DA. Action 18: FDDs must verify the DA of pilots wishing to perform standard level loops and barrel rolls in civil registered ex-military jet aircraft to confirm that they have the authorisation to perform the manoeuvres. Action 19: With immediate effect • where a display aircraft is performing aerobatics at a speed of between 200 and 300 kt IAS, the minimum distance between the crowd and the display line must be 230 metres; • where a display aircraft is performing at a speed in excess of 300 kt IAS, and the display includes any high speed manoeuvres towards the crowd, the minimum distance between the crowd and the display line must be 450 metres; and • for light aircraft, with a maximum weight of less than 1200 kg and operating speeds of less than 150 kt IAS throughout the display, the minimum separation is 150 metres. Action 20: From publication of this report, and until further notice, operators of civil registered ex-military jet aircraft must seek formal approval from the CAA to perform aerobatic manoeuvres below 500 feet. Action 21: With immediate effect the weather minima for flying displays by aircraft other than V/STOL aircraft operating in jet-borne flight/V/STOL mode, rotorcraft and other aircraft with a stalling speed below 50 knots, flying flat aerobatic displays, will be 500 ft cloud base BKN62 and OVC63 and 5 km visibility for both solo and formation displays. Action 22: From the 2016 display season onwards all event organisers and FDDs must submit a post-air display report to the CAA. Pilots must also report any aspect of their display that could have caused a significant safety risk. 62 Indicates “broken” cloud, by which more than half the sky is covered. 63 Indicates “overcast”, by which the sky is obscured.

133 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Action 23: FDDs will be responsible for reporting all breaches of safety at their display to the CAA. Where a ‘stop’ call is made during a display for reasons related to the fitness or competence of a pilot the circumstances leading to the ‘stop’ must be reported to the pilot concerned and to the CAA as soon as practicable. In such circumstances the CAA will issue a provisional suspension of the display authorisation to the pilot concerned. Action 24: We will review the criteria and requirements for the acceptance of ex‑military aircraft onto the civil register. This work will be completed by early 2017. Action 25: We will require maintenance schedules for ex-military aircraft on the civil register to be provided to the CAA, so that we can harmonise schedules and improve the standard of these documents. This work will be completed by the end of 2016. Action 26: We will work closely with the MAA64 and the Ministry of Defence to enhance the CAA’s understanding of the revision levels of key military publications on which maintenance schedules for which ex-military aircraft are based. This work will be completed by the end of 2016. Action 27: We will conduct a review of all ex-military aircraft on the civil register that are required to have ejection seats fitted and active to ensure that they are necessary and appropriately maintained. This work should all be concluded by early 2017. Action 28: We will establish continued airworthiness boards for different types and classes of aircraft to facilitate regular exchange of airworthiness information of type- or class-specific best practice. We expect the first of these meetings to be held before the end of May this year. Action 29: The CAA will commence a programme of work to study and enhance understanding of human factor issues within the air display sector, starting with a full-day industry workshop on the causes and impact of human error for display pilots (date to be set). The CAA review of UK civil air displays was separate from the AAIB’s investigation into the accident to G-BXFI. However, the AAIB kept the CAA informed of safety issues emerging from the investigation in order to facilitate safety improvement and enable the CAA to take action where necessary. CAP  1371 and CAP 1400 identify proposed CAA actions in some of the same areas addressed by AAIB Safety Recommendations arising from this investigation. 64 Military Aviation Authority.

134 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.12 CAA organisation for general aviation The CAA General Aviation Unit was set up in 2014 and emerged from the Government’s 2013 General Aviation Red Tape Challenge, which explored ways to reduce the regulatory burden on the general aviation (GA) sector. The CAA document, CAP 1283, GA Annual Report 2015, states: ‘The GA Unit is involved in most of our GA activity and is accountable for the regulatory oversight of: airworthiness, operations and associated personnel training and licensing for non-commercial[65] operation of other than complex[66] aircraft. This encompasses aircraft ranging from microlights, historic and amateur-built aircraft, through balloons, gliders, piston twins and single-engine turbine aeroplanes up to 5700kg maximum weight and single-pilot helicopters up to 3175Kg. The Unit also has oversight of GA-aligned non-EASA aerodromes.’ CAP 632 categorises Permit-to-Fly ex-military aircraft, overseen by the GAU, as follows: ‘a) Simple: single piston engine types. b) Intermediate: multiple piston engine or turbine (single or multiple) engine types with simple mechanical flying controls or with power controls having an independent back-up system which ensures continued safe flight. c) Complex: all other types, in particular those types having features which require a high degree of specialised knowledge and equipment to maintain (e.g. types with no independent back- up system to powered flying controls or with auto-stabilisation systems or electronic engine controls).’ Note that classifications in CAP 632 are different from those used by EASA. The CAA GAU oversees Hunter aircraft, which it categorises an intermediate type, whereas it meets the EASA definition of a complex type and, with an MPAUM of 25,000 lb (11,340 kg) is heavier than the maximum 5,700 kg that the GAU’s statement indicates falls within its remit. 65 The EASA defines ‘commercial operation’ as any operation of an aircraft, in return for remuneration or other valuable consideration, which is available to the public or, when not made available to the public, which is performed under a contract between an operator and a customer, where the latter has no control over the operator. The ANO states that flights that are wholly or principally for the purpose of taking part in a flying display are considered non-commercial. 66 The EASA definition of ‘complex’ includes aircraft with a maximum takeoff mass of over 5700 kg and/or fitted with a turbojet engine. CAP 632 defines ‘simple’, ‘intermediate’ and ‘complex’ categories of aircraft. The CAA has categorised the Hunter as an intermediate type.

135 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Staff from all levels of the GAU reported that they thought the GAU had been resourced at an appropriate level for its day to day core activities but that the pace of the change programme it was undertaking at the time had been a challenge to the unit’s capability. Activities arising as a result of the accident to G-BXFI had added to the unit’s workload. The CAA set out its goals for general aviation in its document, General Aviation Success Measures. These goals included: ‘Ensure the processes, legal basis, policies and guidance are in place to enable maximum delegation of CAA responsibilities to organisations. Address GA Red Tape Challenge recommendations via the GA Programme as agreed with the General Business and Aviation Strategy Forum (GBASF). Reduce airworthiness oversight by at least 20% by 2018 through delegation to other organisations and through implementation of Performance Based Regulation. Produce a rational and proportionate fees & charges model. Complete Impact Assessments for all policy/legal changes and conduct an accurate assessment of the cost/benefit analysis. Ensure all regulatory/de-regulatory/ delegation changes are made using a ‘balance of risk’ approach. No reduction in 3rd party safety as a result of reduced regulation. Improve the reputation of the CAA externally as a result of the CAA embedding the Red Tape Challenge principles. Continue to work in partnership with the GA Community.’

Prior to the formation of the GAU, the CAA conducted an exercise to produce a risk or complexity triangle. This ranked the relative airworthiness risk or complexity of aviation organisations as a means to determine the oversight required. Typically the higher risk/more complex organisations would be subject to more oversight. This resulted in most general aviation organisations being ranked as ‘green – low risk’ and therefore subject to the lowest levels of oversight. This ‘low risk’ category included ex-military jet aircraft. Towards the end of 2012 the CAA decided not to allocate a specific surveyor to a number of approved organisations, including the maintenance organisation responsible for G-BXFI. The CAA allocated a specific surveyor to the maintenance organisation in November 2014.

136 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The GAU informed the AAIB that it intends to refine the oversight arrangements for general aviation organisations as it moves towards performance based oversight and it feels this will add a degree of fidelity to the risk picture and therefore lead to more appropriate levels of oversight for the various organisations within the GAU remit. So far it has applied this methodology to Approved Training Organisations and Ballooning. However, the planned roll- out has been delayed to allow GAU resources to be diverted to the CAA’s response to this accident. 1.18.13 Original Equipment Manufacturer (OEM) support, documentation and training 1.18.13.1 OEM support When jet aircraft like the Hawker Hunter were in military service they were maintained by organisations with significant facilities and trained personnel. In this environment maintenance personnel underwent a structured training regime which provided them with the appropriate skills and understanding to maintain a wide variety of military aircraft. Additional type-specific training was provided by the military organisation and/or the OEM. The OEM also provided maintenance planning documentation, technical manuals, a publication amendment service and specialist technical support. The OEM’s also ensured that the experience of the worldwide fleet of a particular type was shared with all the relevant organisations. When the aircraft type retired from military service the support provided by the OEMs ceased. As a result, the AAIB made the following Safety Recommendation in AAIB Special Bulletin S4/2015 published on 21 December 2015: Safety Recommendation 2015-43 It is recommended that the Civil Aviation Authority establish a process for the effective dissemination of ex-military jet aircraft experience and type-specific knowledge to individual maintenance organisations. The CAA responded to this Safety Recommendation in FACTOR F1/2016, published on 8 April 2016: ‘The CAA accepts this recommendation. By December 2016, the CAA will establish and promote a process for the more effective dissemination of ex-military jet aircraft experience and type-specific knowledge between individual maintenance organisations.’ The AAIB categorised the CAA response as ‘Adequate – Closed.’ The CAA has indicated that this process is now in place.

137 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.13.2 Documentation Technical publications for this type of aircraft were written in the 1950’s and 1960’s and assumed that maintenance personnel had a level of competence commensurate with military operation. The manuals did not always include comprehensive instructions and were written in a style different from current manuals for civilian aircraft. These documents are no longer subject to routine amendment. The planning document approved by the CAA for the maintenance of G-BXFI was the Master Servicing Schedule issued in 1977 and reprinted 1990. This document details the maintenance tasks to be carried out on the aircraft, component installation lives and defines the aircraft’s maintenance cycle as follows: Servicing Cycle (flying hours) Primary 60 Primary Star 120 Minor 240 Minor Star 480 Major 960 Major (2) 1,920 Table 13 Maintenance requirements Due to the low utilisation of G-BXFI (compared to its use in military service) the current maintenance organisation carried out a ‘Primary’ check annually and a “Primary Star” inspection every two years. A Hawker Hunter T7 Aircraft Servicing Manual provided to the AAIB by the RAF included 20 additional amendments which were not included in the equivalent manual that was used to maintain G-BXFI. The maintenance organisation stated that it had taken steps to determine if more up to date manuals were available by contacting other maintenance organisations and museums, but were unable to obtain a more recent manual. It has not been possible to establish the changes introduced by individual amendments or their effect on the standard of aircraft maintenance. Discussion with the CAA confirmed that there is currently no established minimum amendment standard for the technical publications of ex-military jet aircraft. As a result of this, the AAIB made the following Safety Recommendation in AAIB Special Bulletin S4/2015 published on 21 December 2015:

138 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Safety Recommendation 2015-44 It is recommended that the Civil Aviation Authority establish a minimum amendment standard for the technical publications for each ex-military jet aircraft operated on the United Kingdom civil register. The CAA responded to Safety Recommendation 2015-044 in FACTOR F1/2016, published on 8 April 2016 ‘The CAA does not accept this recommendation. Each ex-military aircraft accepted by the CAA is on the basis of its individual build and modification standards and as such, examples of the same type may be operated and maintained to different manual amendments perfectly justifiably – it may not be desirable or even possible to establish a minimum standard for each publication. However, the sharing of information at type or class forums and the review of maintenance programmes mentioned in the Air Display Review may result in some aircraft adopting a later standard of publication, where appropriate.’ The AAIB categorised this response as ‘Not adequate - Open’. CAA document CAP 1400, Section 7.12 (version 1.2, published in May 2016) stated: ‘There is some variation in the amendment status of the military publications on which maintenance schedules for ex-military aircraft are based. As part of our work to improve the standard of these schedules, we will investigate this variation to ensure that it does not affect the airworthiness of the ex-military aircraft fleet.’ In the same document, Action 26 stated: ‘We will work closely with the MAA and the Ministry of Defence to enhance the CAA’s understanding of the revision levels of key military publications on which maintenance schedules for ex-military aircraft are based. This work will be completed by the end of 2016.’ The CAA amended its response on 28 July 2016, stating: ‘The CAA will revise those AAN’s that currently do not reference specific amendment states for each ex-military aircraft with a valid Permit to Fly to include this information before the end of December 2018.’

139 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information FACTOR F1/2016 Issue 2, published by the CAA on 24 January 2017, stated: ‘Working in conjunction with industry, the CAA will establish a minimum amendment standard for the technical publications for each individual ex-military jet aircraft operated on the UK civil register. The established standard will be recorded in the Airworthiness Approval Note (AAN) for each aircraft. The CAA will complete this work by December 2018.’ The AAIB re-categorised the CAA response to Safety Recommendation 2015‑44 as ‘Adequate – Closed’. The CAA confirmed that maintenance organisations are responsible for the development of the aircraft maintenance programme for each individual ex-military jet aircraft under their control. These are usually based on the maintenance planning documentation used when the aircraft was in military service. The rights for the maintenance programme are held by the organisation which developed it. If the aircraft is transferred to another maintenance organisation the maintenance programme remains the property of the originating organisation, and therefore might not be passed on to the new maintenance organisation. Accordingly, the AAIB made the following Safety Recommendation in Special Bulletin S4/2015 published on 21 December 2015: Safety Recommendation 2015-45 It is recommended that the Civil Aviation Authority require that an ex-military jet aircraft’s maintenance programme be transferred with the aircraft when it moves to another maintenance organisation to ensure continuity of the aircraft’s maintenance. The CAA responded in FACTOR F1/2016, published on 8 April 2016, as follows: ‘The CAA does not accept this recommendation. The maintenance programme for an individual aircraft is customised to the particular operation of the aircraft at a given time so continuity may not always be appropriate. This is not unique to the ex-military aircraft community but is common across the aviation industry. The maintenance programme is the proprietary information of its author(s), though an organisation may opt to transfer it with an aircraft. The owner and maintenance organisation to which an aircraft is transferred are required to establish a maintenance

140 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information programme that is suitable for the aircraft, with consideration to its operation and previous maintenance history, which is recorded in the logbooks and technical records that are transferred upon a change of ownership and/or maintenance organisation. The CAA considers that this facilitates an appropriate level of continuity of the aircraft’s maintenance, where appropriate.’ The AAIB categorised the CAA’s response to Safety Recommendation 2015-45 as ‘Not adequate – Open’. CAP 1400, Section 7.11, stated: ‘We know there are differences in approach between individual operators and their Maintenance Organisations and Continuing Airworthiness Management Organisations (CAMO) when producing such schedules for ex-military aircraft. We are currently reviewing a wide range of schedules, with a view to harmonise them and so reducing risks. This may result in additional guidance being developed.’ In the same document, Action 25 stated: ‘We will require maintenance schedules for ex-military aircraft on the civil register to be provided to the CAA, so that we can harmonise schedules and improve the standard of these documents. This work will be completed by the end of 2016.’ The CAA updated its response to Safety Recommendation 2015-045 in FACTOR F1/2016 Issue 2, as follows: ‘The CAA is developing a proposal for consultation with industry to introduce a new requirement into BCAR Section A to require a maintenance programme to be transferred with an ex-military jet aircraft if it moves to a new maintenance/continuing airworthiness management organisation, or new owner/operator. Subject to the outcome of the process of industry consultation, the CAA intends to implement this requirement by April 2018.’ The AAIB re-categorised the CAA’s response to Safety Recommendation 2015‑45 as ‘Adequate – Closed’

141 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.13.3 Training of maintenance personnel The investigation found that civil organisations maintaining ex-military aircraft usually employ a number of maintenance personnel with prior military aircraft maintenance experience some of whom may be familiar with the relevant aircraft type and its manuals. The lack of OEM support, and the limited number of ex-military jet aircraft on the civil register, means that there are no training courses available for civil aircraft maintenance personnel to maintain former military jets. Type-specific training is usually undertaken in-house using ex- military personnel to pass on their experience and understanding of the aircraft. 1.18.14 Mandatory Permit Directive 2001-001 1.18.14.1 Background Following the investigation of a fatal accident to a Hawker Hunter in 1998 the AAIB published Safety Recommendation 99-27 which stated: ‘In view of the marked reduction in flying utilisation of ex- RAF Hawker Hunter jet aircraft which have been acquired for civilian use and the related greatly increased calendar time between scheduled overhaul of the fuel and air system components on their Avon turbojet engines it is recommended that the CAA, in conjunction with Rolls Royce, consider the introduction of appropriate calendar time overhaul periods for such engine systems, the serviceable condition of which can be calendar time dependent due to component material ‘ageing’ affects.’ In response to this Safety Recommendation the CAA issued MPD 2001-001 on 18 May 2001 (see Appendix N), which stated: ‘Reason: Following an investigation into a fatal accident to a Hawker Hunter on 5 June 1998,the Air Accidents Investigation Branch have recommended that consideration be given to imposing calendar life limits on fuel and air systems fitted on Avon engines, since these systems may be subject to ageing effects. It is recognised that ageing effects may not be confined solely to fuel and air systems. Corrosion of discs and blading, for example, may also be time dependent. The CAA has experience of accelerated corrosion occurring on engines fitted to aeroplanes of low usage, and the possibility of an age related failure to either the control units or core engine cannot be discounted.’

142 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The MPD imposed a maximum overhaul life of 15 years on the Rolls-Royce Avon 1, 100 and 200 series engines but, recognising that the integrity of the engine could be monitored by routine inspection and tests, the MPD also stated: ‘Alternative Means of Compliance The intent of this MPD is to prevent potential calendar time related engine deterioration developing to a point where engine integrity is compromised. The CAA will consider alternative inspection/test and sampling programmes which can be shown to prevent unacceptable deterioration of engines in service. Operators may wish to propose such programmes in lieu of engine withdrawal from service. These programmes must, however, be underwritten by an approved BCAR A8-20 organisation or the manufacturer and must address all ageing related deterioration which could occur on the Avon engine series.’ 1.18.14.2 Assessment of AMOC applications In order to assess applications for AMOC’s to existing MPD’s the CAA uses internal Airworthiness Division Technical Procedure, ‘TP-CAW-18, Dealing with Applications of Alternative Methods of Compliance (AMOC) to an Existing Airworthiness Directive or Mandatory Permit directive (Non-EASA Products)’. The process is summarised in a flow chart (see Figure 29). The CAA informed the AAIB that a number of applications for AMOCs to MPD 2001-001 have been approved, which can vary from aircraft to aircraft based on a number of considerations, including utilisation. Many of these AMOC’s have been in place for several years and are unaltered from their original approval. 1.18.14.3 Compliance with MPD 2001-001 Historic records showed that in October 2009, when G-BXFI had been operated by a previous operator, inspections of the compressor, turbine, combustion system, bleed valves and external hoses had been completed. The aircraft maintenance log had been annotated with ‘Biannual MPD 2001‑001 compliance carried out I.A.W. MOE Chap 19’. The CAA had approved an AMOC to MPD 2001-001 as part of that operator’s approved Maintenance Exposition. Records from the subsequent maintenance organisation confirmed that a number of similar inspections had been completed in January 2011, but no reference to MPD 2001-001 was found.

143 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Figure 29 CAA process flow chart for dealing with AMOC applications to existing MPD’s Figure 1 – Approval of AMOCs for ADs/MPDs Applicable to Non-EASA Products Design Liaison Surveyor AMOC application received Review application (See Note 1) Is application supported by state of design or AD issuing authority? Request that applicant obtains support of state of design or AD issuing authority No Is there a suitable AMOC in existence in UK? Request applicant to show compliance with AMOC Has applicant demonstrated that equivalent level of safety can be assured? Yes Yes Compliance shown No No Send applicant letter of acceptance (See Note 2) Yes File all records in ERM Advise applicant that AMOC not acceptable Applicant revises AMOC

144 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Neither that maintenance organisation, nor the one responsible for maintenance of the aircraft at the time of the accident, had access to the original Exposition and were therefore unware of the full scope of the approved AMOC to MPD 2001‑001. The current maintenance organisation stated that its inspection programme to satisfy the requirements of an AMOC to MPD 2001‑001 was based on historic technical log entries which had been annotated with a reference to MPD 2001-001, without access to the original AMOC or the detail it contained. The aircraft was transferred to the current maintenance organisation in July  2012. Its maintenance records showed that during a “Minor Star” maintenance check, carried out between August and December 2012, the current maintenance organisation removed the engine from the aircraft for a number of inspections. These matched those completed in 2009. In addition, the current maintenance organisation took an oil sample which was analysed using Spectrographic Oil Analysis Programme67 (SOAP). The aircraft’s records stated that these inspections had been completed to confirm the engine’s compliance with MPD 2001-001. The maintenance organisation stated that these inspections were based on previous inspections recorded in the aircraft’s historic maintenance records. The ACAM audit of the aircraft conducted by the CAA on 3 January 2013 (see Section 1.6.14.1) did not make specific reference to an AMOC for MPD 2001‑001.

A ‘Primary’ inspection was conducted on G-BXFI between January and March 2014 during which the engine was removed, and the engine inspections carried out on the ‘Minor Star’ maintenance check of 2012 were repeated. The aircraft records were annotated to indicate compliance with MPD 2001‑001. The AAIB investigation did not identify a specific approval for an AMOC to MPD 2001-001 for this aircraft, either in the current maintenance organisation’s approved Exposition, correspondence between the CAA and the current maintenance organisation or in the aircraft’s historic maintenance records. During discussions between the AAIB and the CAA in September 2015, the CAA confirmed that the current maintenance organisation did not hold a CAA‑approved AMOC to MPD 2001-001. 67 SOAP- Spectrographic Oil Analysis Program, a method of analysing oil and other fluids for the presence of microscopic particles suspended in the fluid. It is used to identify wear in oil wetted components such as bearings and requires numerous routine samples to define a “baseline” from which deterioration trends can be identified.

145 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Section 8 of CAP 562 Leaflet 70-80 – ‘Guidance Material for Ageing Engine Continuing Airworthiness’ (see Appendix O), states: ‘Gas Turbine Engine- Generic or Possible AMOC Elements’ 8.1 Particularly relevant for gas turbine engine, where possible the following data could be considered for collection at each engine run, as permitted by the type: a) Pilot reports b) Oil consumption rates/trend monitoring c) Gas path performance trend monitoring d) (e.g.T.G.T spool speeds etc.): e) Engine run down times f) Vibration monitoring (if systems equipment is fitted) g) Engine running times (including ground runs)

1. 2 The above information should be formally recorded as relevant

for each flight, and issues such as gas path parameters, vibration and oil consumption trending plotted for evidence of datum shifts. It is quite likely that optimum health monitoring could be carried out by flight crew at a steady state phase of engine operation.’ Examination of the engine records relating to engine ground running indicated that although no performance figures had been recorded, the engine remained within limits. The only record of engine parameters in flight were those from two routine air tests. Both of these reports included rpm exceedences which were not reported to the maintenance organisation and therefore no remedial action was taken. The maintenance organisation stated that there was no programme in place to routinely record and monitor engine operational performance. Communication between the maintenance organisation and the CAA In mid-January 2014 the organisation responsible for maintenance of the aircraft at the time of the accident contacted the CAA with a proposal for an AMOC to MPD 2001-001, which included annual SOAP samples. The proposal included the following statement: ‘... it is proposed to increase SOAP analysis to include fuel systems to test for seal polymer deterioration.' The CAA responded to the maintenance organisation at the end of January 2014 with additional information, contained in CAP 562 Leaflet 70-80, which should be considered by the maintenance organisation in any formal submission of an AMOC. The response also commented that the proposed

146 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information AMOC did not include any tasks to verify the condition of bleed valves, flexible hoses, fuel pumps and the FCU. During an interview with the AAIB the intended recipient of the email confirmed that he had no recollection of receipt of the email and no additional submission of a proposed AMOC to MPD 2001-001 was made to the CAA. In April 2014, the maintenance organisation contacted a CAA surveyor to obtain an update on the progress of its AMOC for MPD 2001-001 which was passed to the General Aviation Department of the CAA. The investigation has not been able to identify any response from the CAA to the enquiry. CAA action On 19 December 2015, members of the CAA GAU reviewed records relating to G-BXFI and stated to the AAIB that it was unclear whether a legally valid AMOC to MPD 2001-001 was in place for G-BXFI at the time of the accident. The CAA later advised the AAIB that, in its opinion, the current maintenance organisation had completed tasks associated with a pre-existing AMOC to MPD 2001-001 and that therefore the aircraft was compliant with MPD 2001-001. The AAIB requested documentary evidence to support the CAA’s assessment. The CAA provided a summary document stating: ‘The CAA holds records of the A8-20 Maintenance Organisation Exposition for [a previous maintenance organisation], who were formerly approved by the CAA to maintain G-BXFI. This Exposition contained the AMOC approved by the CAA for work on G-BXFI in accordance with MPD2001-001.’…. …‘The CAA cross-referenced this work against a copy of the Exposition for [a previous maintenance organisation]. The engine check work was carried out by [the current maintenance organisation] in line with the tasks defined as part of the approved AMOC’. The CAA also provided the AAIB with a document called ‘AMOC - G-BXFI’ which included a table of engine maintenance tasks and later provided a copy of a previous maintenance organisation’s ‘Exposition’. Part 2 of the Exposition, ‘The Procedures Manual’, included the following statement: ‘This maintenance programme is the alternative means of compliance with MPD 2001-001 as agreed with the CAA for Avon engines operated and maintained by [the previous maintenance organisation]. Any deviation to this programme is to be submitted to the CAA for approval.’

147 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information A copy of a letter from the CAA to a previous maintenance organisation, entitled ‘CAA Approval of Organisations’ and dated 15 March 2011, was included. This indicated CAA approval of the Exposition, which contained an AMOC to MPD 2001-001. The Exposition stated that it was only applicable to Avon engines operated and maintained by that maintenance organisation. The records for G-BXFI indicate that it had been maintained by another organisation since January 2011 and was therefore not under the provision of this previous organisation at the time the Exposition was approved. Section 3.1 of CAA document CAP562 – Book 1, leaflet C-30, ‘CAA Approvals – Non Transferability’, states: ‘CAA Approval is granted to a legal entity and, in the case of an organisation, this is clearly identified with its company registration number. A CAA Approval once granted is not transferable from one registered company to another.’ The CAA stated:

‘The CAA did not issue a separate AMOC approval for MPD 2001‑001 to [the operator] or [the maintenance organisation].’ The ANO 2009 states: ‘Article 22 National permits to fly ceasing to be in force and issue of airworthiness directives for permit aircraft (1) A national permit to fly ceases to be in force if: (a) The CAA has issued a directive that requires: (i) an inspection to be carried out for the purposes of ascertaining whether the aircraft remains airworthy… (b) Completion of an inspection, modification or maintenance of the aircraft is required as a condition of the permit to fly…’

148 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.14.4 Other relevant engine-related events The AAIB report of its investigation into a fatal accident to Hawker Hunter F4, GHHUN, in June 1998, stated: ‘… records kept on a computerised database between 1980 and 1992 showed 22 cases involving the Avon Mk 122 engine where engine speed had dropped and subsequent engineering investigation had not established a clear cause. Anecdotal evidence indicated that Avon Mk 122 engines had suffered from unexplained power reductions from time to time during RAF service, but in most cases the aircraft had returned safely and the subsequent RAF engineering investigations, including related engine ground runs, had failed to identify associated causes or to reproduce the symptoms.’ A review of the investigation files did not identify the source of the computerised database. In 2013 a Hawker Hunter T7 suffered from a complete loss of thrust as a result of the failure of a compressor blade. The cause of the failure was corrosion‑initiated fatigue in the blade pin-hole attachment lug. A number of other cracks were found in other blades from the same stage. The CAA determined that the presence of corrosion in this area could not be identified by in-situ inspections typically included under an AMOC to MPD 2001-001. On 7 October 2016 the CAA published MPD 2016-002 (shown in Appendix P), which introduced a requirement to remove the first four stages of compressor blades from the engine for initial and repetitive inspection. 1.18.15 Ejection seats 1.18.15.1 Ejection seats in ex-military aircraft on the UK civil register Ex-military aircraft are accepted onto the UK civil register on the basis of a satisfactory military safety record. Where the presence of aircrew escape systems, such as ejection seats, contributed to that safety record, the CAA expects that the aircraft will continue to operate with these systems in a serviceable condition. The CAA has approved the disarming of ejection seats in some straight-wing ex-military aircraft, where it considers the aircraft has a landing speed low enough to allow a pilot to make a forced landing. However, based on the higher operating speeds of swept-wing ex-military jet aircraft, the CAA requires these aircraft to operate with serviceable ejection seats to provide a means of aircrew escape.

149 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Paragraphs 5.8 and 5.9 of CAP 632 make the following statements regarding swept-wing ex-military aircraft equipped with ejection seats: ‘5.8 Where ejection seats are an integral part of the aircrew escape system, as specified in the relevant Pilots Notes, Flight or Aircrew Manuals, it is recommended that they be fully serviceable for all flights. Approval should be sought from the CAA (Application and Approvals) at the earliest opportunity if it is intended to operate with inert ejection seats (or other escape systems). It is unlikely that the CAA will allow swept-wing aircraft fitted with ejection seats to be flown unless the equipment is fully operational. 5.9 Ejection seat cartridge lives are typically 2 years installed, within a 6 year shelf life. To be fully serviceable the cartridges installed must be within their appropriate lives.’ Section 2 of the Hunter T7 Master Servicing Schedule, ‘Component Replacement List (Mandatory Changes)’, states that the ejection seat cartridges require replacement every two years due to ‘explosive life’. In addition, G-BXFI’s AAN states: ‘Cartridges for the Aircrew Assisted Escape System have a 6 (six) year overall/shelf life and 2 (two) year installed life…..’ Section 10 of the AAN states: ‘This aircraft must be maintained by a company approved under BCAR A8-20 and rated for the aircraft type (and with consideration given to the ejection seats), in accordance with the AP manuals and schedules referred to in Section 6 above and as agreed with the CAA Regional Office. In the event that the agreed arrangements are to be changed, the maintenance proposals will need to be reviewed and approved by the appropriate CAA Regional Office. The aircraft is to be kept hangared and inhibiting/short term care and maintenance procedures observed to prevent the onset of corrosion in the engine.’ Chapter 5 of the CAP 733 – ‘Permit to Fly Aircraft’ describes maintenance of ex-military aircraft. Paragraph 5.4 of that chapter states: ‘5.4 Ex-military aircraft may have specific life limits for the aircraft structure or critical components defined by the manufacturer, these limits must not be exceeded. Where the manufacturer permits

150 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information further operation for a period dependent upon the embodiment of additional modifications by more comprehensive and in-depth maintenance checks, these must be carried out before an extension to the operating life will be agreed. There will be no extension of aircraft life limits beyond those that are defined and supported by the manufacturer.’ This indicates that the cartridge life specified in AAN No. 26172 was a requirement and not guidance or a recommendation. In respect of ejection seats, CAA document TP-DAW 23-2, paragraph 11.3.1, describes the limitations on aircraft with live ejection seats as follows: ‘For aircraft operated with live seats, the appropriate type of seat must be fitted and it must be maintained in accordance with appropriate publications. These are to be referred by type, manufacturer, serial number and publication on the AAN approving the aircraft. Cartridges powering such seats will be life limited and the lives should be quoted in the AAN. Manufacturers’ lives are employed rather than those arbitrarily extended by former Eastern Bloc military authorities.’ Additionally TP-DAW-23-2 refers to internal Airworthiness Guidance document GU-DAW-49 ‘Aircraft ejection seat maintenance – service information’ dated 23 September 2010, which states: ‘Ejection seat structure and the majority of components are replaced “On condition” as determined by a qualified tradesman during maintenance procedures following a[n] approved schedule, but there are many components subject to both strict shelf life, total life, and installed life limitations. In addition to these normally encountered life limit parameters, it is a requirement to control cartridge and rocket motor life from the date of unit filling.’ 1.18.15.2 Information from the ejection seat manufacturer Cartridge lives Martin-Baker Aircraft Company Ltd. recommends that for climates where the shade temperature is not likely to exceed 30oC, the installed life of the ejection seat and canopy jettison cartridges does not exceed 2 years and that the total life does not exceed 6 years, from the date of cartridge manufacture68. 68 Martin-Baker Aircraft Company Ltd: Service Information Letter (SIL) 90: ‘Aircraft assisted escape systems – Recommended lives of components for Mk 2 to Mk15 ejection seats’ dated September 2014.

151 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Cartridge life limits are introduced because the volatile components of the propellant gradually evaporate or ‘cook-off’ with age. This process may be accelerated by the environmental conditions to which the cartridges are exposed. The installed life is limited to two years because aircraft vibration disturbs the grains of the propellant, gradually reducing their size and changing the cartridge firing characteristics.     The ejection seat manufacturer advised the AAIB that using time-expired cartridges could increase the risk of an un-commanded ejection; or, when ejection is commanded, could result in increased discharge time of cartridges affecting the ejection sequence, or uncontrolled explosion of the cartridges. Historic ejection seats Martin-Baker ejection seats are designed and built exclusively for use in military aircraft. The Mk 4HA seats, fitted to G-BXFI, were derived from the Mk 4 seat designed in the late 1950s, and modified in the early 1960s specifically for the Hawker Hunter. Production of the Mk 4HA seats ceased in the early 1970s. Like many other models of ejection seat, the Mk 4HA is no longer operated by the military and the associated drawings and manuals are now obsolete. However seats of this type, and similar types, are installed in ex-military aircraft operating on civil aircraft registers, both in the UK and overseas.

Historically, Martin-Baker has not supplied ejection seats or components spares directly to civilian operators of ex-military aircraft. However, until 2015 Maker-Baker provided component spares to an intermediate supplier, which maintained ejection seats and provided component spares to the civilian ex‑military market, both in the UK and overseas. In February 2015 Martin-Baker took the decision to stop providing technical support and replacement parts for ‘historic products’. It defines historic products as those ejection seats fitted to aircraft which no longer operate in their original military role. This includes secondhand products which have been sold by the original operator to a third party, even if that third party is a military user. This decision was based on the fact that these ejection seats are very old and were designed at a time when there was a very different risk tolerance to safety issues and hazards; the seat design and instruction manuals would not be deemed adequate by today’s standards and many of the drawings and manuals for legacy products had become obsolete and Martin-Baker no longer had retained technical capability on these products. Ejection seats installed in civil-operated ex-military aircraft fall into the historic product category and as such replacement spares, including cartridges, manufactured by the original manufacturer, are no longer available. Martin‑Baker considers that such ejection seats should be deactivated to prevent the risk

152 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information of inadvertent operation. This is contrary to the current CAA requirement for ejection seats in swept-wing aircraft to be operated in a fully operational and armed condition. Martin-Baker met with the intermediate supplier in February 2015 to inform it of its decision to stop technical support and spares provision for historic products. Martin-Baker also took steps to identify civilian operators of ex-military aircraft equipped with historic ejection seats but did not directly inform any operators or the CAA of its position. Martin-Baker communication with CAA In November 2013 Martin-Baker contacted the CAA to discuss the use of ejection seats in civilian-operated ex-military aircraft and made reference to the following concerns: • The age of the seats, many being beyond their design life and the standard of design which may not be acceptable for civilian purposes today. • The standard of the instruction manuals given the age of the seat – the manuals relied on a higher standard of technical product knowledge and skill than could be expected today and may not meet the required standards today. • The ability and willingness of civilian operators to operate and maintain seats in accordance with Martin-Baker instructions. • The ability and willingness of civilian operators to comply with the total and installed life limit requirements of the pyrotechnic cartridges. Martin-Baker cited evidence based on lack of sales of pyrotechnics to civilian operators to support its assertion that cartridge lives must have been grossly exceeded in some cases. • The potential for a catastrophic accident should a seat be inadvertently ejected causing an aircraft to crash into spectators at events such as flying displays. Martin-Baker outlined its intention to advise against the use of live ejection seats in civilian aircraft but indicated that it wished to understand the CAA position on this subject, and any potential impact on the operation of these aircraft, before further action. In response the CAA informed Martin-Baker of its policy on the use of ejection seats in ex-military aircraft, indicating that where fitted, ejection seats were

153 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information expected to remain live unless specifically approved by the CAA. The CAA indicated that for Permit to Fly ex-military aircraft no involvement (Type Support) was expected from the original manufacturer, including the manufacturers of installed equipment. Specifically in response to the concerns raised by Martin-Baker, the CAA indicated that it believed these areas were already addressed adequately by existing guidance. In particular it expected: • Appropriate seat training to be imposed and controlled under the CAP 632 approval of the operator. • Air displays to be controlled with the intent of reducing the likelihood of aircraft crashing into the crowd. • Maintainers/operators to follow maintenance manuals and schedules and for this to be reviewed for annual revalidation of the Permit to Fly. • The periodic overhaul of ageing ejection seats and the issue of cartridge lives to be appropriately observed by the approved organisation responsible for the aircraft’s maintenance. • Cartridge lives (total and installed) to be observed. The CAA response made reference to the fact that when it had previously been approached for alleviation on ejection seat cartridge lives, such alleviation had been granted on the basis of evidence that new cartridges had been ordered and was only valid for a short duration (months). Specifically in respect to using out-of-life cartridges, the CAA stated: ‘….we would view such a breach as serious and I’d suggest it would jeopardise the individual’s approval.’ The CAA further indicated that if it were to adopt a policy such as that proposed by Martin-Baker, whilst keeping the existing criteria for the deactivation of certain ejection seats, this would effectively ground the great majority of the UK ex-military jet fleet and would have serious consequences for the display community. There was no further communication between the CAA and Martin-Baker on this subject prior to Martin-Baker’s change of policy in February 2015.

154 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.15.3 Ejection seat maintenance General The service and maintenance of ejection seats is a specialist task. Civilian organisations operating or maintaining ex-military jet aircraft in the UK often rely on individuals or organisations with specialist skills and prior military experience in ejection seat maintenance to accomplish these tasks. The CAA does not issue specific maintenance approvals for specialised tasks such as ejection seat maintenance, and these tasks are instead performed under the maintenance approval of designated maintenance organisations, or delegated to specialist individuals or organisations. Some other regulatory authorities do issue maintenance approvals for specialist maintenance tasks, such as ejection seat maintenance. One example is the Civil Aviation Authority of New Zealand, which describes such an approval in Advisory Circular AC43-21 ‘Escape and egress systems’, dated 25 December 1997. Maintenance of G-BXFI’s ejection seats The maintenance organisation employed a technician who had previous ejection seat maintenance experience as an RAF Armourer. This individual performed maintenance on all the ejection seats under the responsibility of the maintenance organisation, but also carried out ejection seat maintenance for other organisations independent of his role at the maintenance organisation. The maintenance organisation did not have specific facilities for ejection seat maintenance, however the ejection seat specialist had set up an ejection seat bay-servicing facility at his home. This facility was not under the control of the maintenance organisation, nor its BCAR A8-20 approval. The maintenance organisation was responsible for the provision of spares for the ejection seats. The ejection seat and canopy jettison cartridges fitted to G-BXFI were from two separate production batches, manufactured in June and July 2008 and the manufacturing date was printed on the external casing of each cartridge. Technical records provided with the aircraft indicated that the ejection seat and canopy cartridges had first been fitted to G-BXFI in December 2008 by a previous maintenance organisation and had been due to be replaced in December 2010, two years after being installed. However, an extension of their installation to January 2011 and then again to January 2012 had been recorded. Responsibility for the maintenance of the aircraft transferred to another organisation between March 2011 and June 2012. However no records relating to the ejection seat maintenance during that time were included with the paperwork subsequently provided to the current maintenance organisation.

155 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information The current maintenance organisation assumed responsibility for G-BXFI’s maintenance in August 2012, and performed a substantial amount of maintenance on the aircraft between then and January 2013, including ‘bay‑servicing’ of the ejection seats, which is required to be completed annually. The ejection seat cartridges were removed to facilitate this work and the same cartridges were re-fitted in November 201269. The technical records were updated to indicate the cartridge life expiry dates as June and July 2014. In January 2014, the maintenance organisation placed an order for new ejection seat cartridges and was advised by the supplier that they would be delivered in approximately 52 weeks. During the aircraft’s annual maintenance inspection in February 2014, when the ejection seats were again bay-serviced, the maintenance organisation decided to leave the cartridges installed until the next scheduled annual inspection and updated the technical records to indicate that the cartridge installation had been extended until February 2015. During the subsequent annual inspection in February 2015, the maintenance organisation again decided to leave the cartridges installed, as the new cartridges had not yet been delivered. The technical records were updated indicating that cartridge replacement was due in February 2016. The new cartridges were delivered in June 2015, but were not fitted to the aircraft. The ejection seat maintenance and the associated removal and reinstallation of the cartridges was carried out by the maintenance organisation’s ejection seat specialist but the relevant work cards and component log cards were signed off by the Deputy Chief Engineer. Maintenance organisation cartridge life policy The maintenance organisation informed the AAIB that it operated a ‘six-year installed life’ policy for ejection seat cartridges, rather than the two-year installed life specified by the manufacturer. However, this policy was not documented either in the company’s Maintenance Exposition or in any other document. Approval for such a policy had not been sought from the CAA. However, the Chief Engineer believed that the policy had been discussed informally with a CAA Airworthiness Surveyor. The maintenance organisation subsequently documented its rationale for extending the cartridge lives in December 2015 and provided a copy of this to the AAIB. The basis of the maintenance organisation’s policy was that it considered the published manufacturer’s cartridge lives to be recommended rather than ultimate lives, and based on the expected utilisation in their original military 69 AAIB Special Bulletin S4/2015 reported that the cartridges were fitted to G-BXFI in November 2012. Subsequent review of historic aircraft records indicated that the cartridges had first been installed in G-BXFI in December 2008.

156 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information roles. It considered that the utilisation of ex-military aircraft operating on a Permit to Fly was substantially less than the typical military utilisation, and therefore the cartridges would be subject to substantially less vibration and temperature-change effects than would have been the case in military service. Additionally it reasoned that as the aircraft were hangared when not in use, installed cartridges were subject to similar environmental conditions as stored cartridges, which were kept in the same hangar. It also asserted that the cartridges were subject to an annual visual inspection for any signs of degradation to the external casing or signs of deterioration of the fillings, such as discolouration or sweating. Furthermore the maintenance organisation were aware that one overseas military operator had operated a 10 ½ year total life and 3 ½ year installed life, for the same type of cartridges.

The organisation’s approved Maintenance Exposition contained the following statement with regard to concession control: ‘Requests for variations against scheduled maintenance requirements shall be raised on Form MA7 when it is not possible to complete the requirement, together with the reason for delaying the requirements. The Chief Engineer will approve the variation if he is satisfied that airworthiness will not be affected. If it is outside his power to approve the variation then he will refer the matter, in writing to the local CAA supervising Surveyor for consideration. Any variation agreed will be entered in the serialised variation file held in Technical Records, and in the aircraft’s log books. Variations to scheduled maintenance check periods and component lives may be granted within the limits laid down by the schedule, subject to mandatory requirements or ultimate lives not being exceeded in the extension period.’ The maintenance organisation stated to the AAIB that it considered the decision to extend the cartridge lives on G-BXFI was taken within the privileges of its A8-20 maintenance approval, and therefore it did not deem it necessary to seek formal approval from the CAA to extend the cartridge lives. Whilst the fact that cartridge lives had been extended was recorded on the Component Life Register for G-BXFI, there was no record of an internal approval, or technical justification for the cartridge life extension, either on ‘Form MA7’ or otherwise. Similarly there was no record of a variation in the variation file.

CAA position on G-BXFI ejection seat cartridge lives During the investigation the CAA stated to the AAIB that it did not have a documented procedure for approving an extension to ejection seat cartridge lives, but it would consider any such applications on a case-by-case basis. It

157 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information also stated that an extension would require prior written approval by the CAA, based on a technical justification submitted by the applicant and proof that new cartridges had been ordered. The CAA confirmed that there was no CAA approval or technical justification in place for the cartridge life extension on the ejection seats fitted to G-BXFI. In December 2015 AAIB Special Bulletin S4/2015 highlighted the AAIB’s initial findings regarding the ejection seat cartridges. As a result the CAA met with the maintenance organisation to discuss the basis on which the cartridge lives had been extended. Following that discussion the CAA changed its position and informed the AAIB, retrospectively, that it was satisfied that the decision by the maintenance organisation to extend the installed cartridge lives had been based upon reasonable technical assumptions, even though these had not been documented in advance, and that it considered this decision fell within the privileges of the organisation’s maintenance approval. The CAA based this assertion on the fact that the organisation’s Maintenance Exposition was a CAA-approved document, and the Exposition contained the statement relating to concession control. The CAA did not offer any position on the fact that the total cartridge lives had also been exceeded. Other maintenance organisations In the course of the investigation it has become apparent that the issue of time- expired ejection seat cartridges, used in civil-operated ex-military aircraft, is not confined to one aircraft or maintenance organisation. 1.18.15.4 Safety of first responders Following the accident to G-BXFI, and a separate accident to a Folland Gnat70 during a flying display at Oulton Park on 1 August 2015, the ejection seats fitted to both aircraft were found in a damaged condition. Some of the pyrotechnic cartridges were still live but had been subject to impact forces and post-crash fire. This posed a significant hazard to the first responders and to other personnel on the accident site. Accident response and investigation work in the vicinity of the seats was delayed until competent persons were brought to the site by the AAIB to make the seats safe. In both cases, the respective flying display organisers did not have access to relevant aircraft hazard information or emergency contact details for organisations which could render the seats safe. Ex-military aircraft may be equipped with other devices, such as miniature detonation cords or other pyrotechnic charges, which can also represent a hazard to first responders and accident site personnel. 70 Accident to Folland Gnat G-TIMM, reported in AAIB Bulletin 5/2016.

158 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information 1.18.16 Safety actions taken AAIB Special Bulletin S4/2015 contained seven Safety Recommendations in the areas of safety of first responders, ejection seats and aircraft maintenance, to which the CAA responded in FACTOR F1/2016. Special bulletin S1/2016 contained a further 14 Safety Recommendations in the areas of risk assessment, safety management and aircraft operation at flying displays, to which the CAA responded in FACTOR F4/2016. These Safety Recommendations and their responses are shown in Section 4.2 of this report. 1.18.17 Other relevant Safety Recommendation AAIB Aircraft Accident Report 6/2009, concerning the accident to Hawker Hurricane G-HURR, contained the following Safety Recommendation: Safety Recommendation 2009-057 It is recommended that the UK Civil Aviation Authority conduct periodic reviews of the current operating requirements to ensure that they provide adequate safety for display flying. The CAA accepted this recommendation. 1.19 Investigation techniques 1.19.1 Accident site mapping using an unmanned aircraft system An unmanned aircraft system was used to obtain aerial images and video of the accident site. The unmanned aerial vehicle (UAV) used weighs 1.24 kg and has a gyro-stabilised camera which can take 14 megapixel stills and 1080p resolution video. The UAV was used in conjunction with a dedicated software application to fly the UAV in a pre-programmed grid pattern while automatically taking a series of overlapping images with the camera pointing 90° down. A number of flights were conducted at a height of 30 and 50 m. The images were then processed using photogrammetry software to generate a 3D model and orthomosaic images of the accident site. 1.19.2 Analysis tools The AAIB analysed the safety system surrounding the accident flight using various techniques including the ‘Bowtie’ methodology, and methodologies derived from Accimap and Systems Theory Accident Modelling and Process (STAMP).

159 Factual Information Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 1 - Factual information Bowtie is a barrier risk model used to assist the identification and management of risk associated with an identified loss of system control, known as a “top event”. It considers “preventive measures” designed to prevent threats resulting in the top event and “recovery measures” designed to recover control should it be lost or to minimise the consequences should control not be recovered. The model is usually organised as shown in Figure 30. TOP EVENT HAZARD CONSEQUENCE CONSEQUENCE THREAT THREAT PREVENTIVE  CONTROL Escalation Factor  (makes control  less effective) CONTROL Escalation Factor  (makes control  less effective) CONTROL PREVENTIVE  CONTROL PREVENTIVE  CONTROL PREVENTIVE  CONTROL PREVENTIVE  CONTROL RECOVERY  CONTROL RECOVERY  CONTROL RECOVERY  CONTROL RECOVERY  CONTROL MITIGATION MITIGATION Figure 30 Example Bowtie The AAIB generated a bespoke Bowtie analysis for this accident informed by the CAA Bowtie templates71 for ‘loss of aircraft control’ and ‘human factors’ and other evidence.

Accimap is an analysis technique based upon the notion that there are multiple layers of causality involved in accidents. Accimap focuses on the causal relationships between layers such as regulatory bodies, technical and operational management and individual operators.72 STAMP is an analysis technique, elements of which were used in this investigation to consider adaption and emergence within complex systems. 71 The CAA has developed and published generic Bowtie templates for predictive risk management and illustrative purposes. The AAIB bowtie was developed to assist in considering this specific accident retrospectively. 72 Human Factors Methods A Practical Guide for Engineering and Design. Stanton, Salmon et al.

Intentionally left blank

161 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis 2 Analysis 2.1 General The aircraft was carrying out an aerobatic manoeuvre consisting of both a pitching and rolling component. The available evidence indicates that it reached a maximum height of approximately 2,700 ft, which was below the minimum height required for it to complete the manoeuvre safely. However, the manoeuvre continued and the aircraft struck the westbound carriageway of the A27, Shoreham Bypass, fatally injuring 11 people and injuring 13 others, including the pilot. This analysis explores why the manoeuvre was not completed safely and why this led to fatal and other injuries to members of the public. Four areas are considered:

Aircraft handling. (Section 2.2)

Technical issues relevant to the accident flight.

(Section 2.3)

Control of flying display risk. (Section 2.4)

Engineering aspects (Section 2.5) 2.2 Aircraft handling 2.2.1 The accident manoeuvre The accident manoeuvre was the third in a linked sequence of manoeuvres, following a flypast and a Derry Turn. The pilot had turned the aircraft between Lancing College and the aerodrome, which was consistent with his plan to reduce the angle at which he would approach the display line and reduce the amount of roll required during the ‘bent loop’. In the event, the pilot bent the loop through approximately 60°, which had the effect of positioning the aircraft north-east of the aerodrome with a final track broadly aligned with the A27 instead of the display line1. The analysis of aircraft handling during the accident manoeuvre has been divided into two parts:

The first half of the accident manoeuvre, from entry until reaching the apex in a near wings level, inverted position.

The apex of the manoeuvre. 1 Section 1.18.1 contains a description of a ‘bent loop’ manoeuvre, the technique for flying it and a description of the pilot’s actions during the accident manoeuvre.

162 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis 2.2.1.1 The first half of the accident manoeuvre Entry parameters The aircraft entered the accident manoeuvre approximately 900 m from the display line at a height of 185 ±35 ft. It pitched up into the manoeuvre at an airspeed of 310 ±15 KIAS, less than the minimum entry airspeed of 350 KIAS; the speed below which the pilot stated he would abandon the manoeuvre. The entry was also below the minimum height of 500 ft specified in his DA for aerobatics. The CAA stated in its 1996 Review that it had become common practice for pilots to descend to their authorised flypast height in the middle of an aerobatic sequence, provided they had completed the aerobatic manoeuvre by the specified base height. Guidance in CAP 403 states: ‘All aerobatic manoeuvres, including inverted flypasts, and manoeuvres which involve pulling through the vertical are to be executed above the approved aerobatic display height. Descent below the approved aerobatic display height to the approved fly-by height is permitted once certain of capturing the aerobatic display height. Slow speed, high angle of attack flypasts are regarded as aerobatic manoeuvres from the minimum height point of view.’ The investigation revealed that this guidance is not applied consistently, and that pilots may not understand what is required. Accordingly, the following Safety Recommendation is made: Safety Recommendation 2017-001 It is recommended that the Civil Aviation Authority amend CAP 403 to clarify the point at which an aerobatic manoeuvre is considered to have been entered and the minimum height at which any part of it may be flown. Cockpit imaging evidence indicated that the pilot looked down towards the flight instruments four times in the 30 seconds before the aircraft pitched up. However, it was not possible to determine if he looked at the ASI.

163 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis Had he done so he may have: • Misread the ASI. • Read the ASI correctly but recalled the incorrect target speed, possibly substituting the required entry speed for that of another aircraft type. • Read the ASI correctly and decided to accept the lower speed and continue the manoeuvre; this would have been a departure from his stated technique. Flight trials demonstrated that entered from 200 ft with an airspeed of 300 KIAS, using T7 equivalent maximum thrust, the aircraft achieved height gains of between 3,200 ft and 3,600 ft in a loop, and between 2,800 ft and 3,200 ft in a bent loop. Engine thrust The TP stated that the correct operating technique for the ‘bent loop’ was to select and maintain maximum thrust. The pilot stated that this was also his technique. However, recorded information indicated that engine thrust modulated during the climb and the maximum thrust available was not achieved. The examination of the engine (see Section 2.3.2) found that elements of the engine fuel control system had degraded, but concluded there was no evidence to suggest it would not have responded normally to the pilot’s inputs. Information included in a previous AAIB report (EW/C98/6/1) indicated that there had been several cases involving the Avon Mk 122 engine where engine speed had reduced and subsequent engineering investigation had not established a clear cause. Were there an un-commanded reduction in engine thrust during the accident manoeuvre it would be best detected by monitoring the engine instruments because a change of thrust may not be detectable audibly. During the climb, the pilot was seen to be looking outside the cockpit and did not appear to look down at the instruments. This suggests that if an un‑commanded thrust reduction had occurred he may not have been aware of it. It was not possible to determine if thrust was modulated by the pilot during the climb because the throttle was not visible in the cockpit image recording during this part of the accident manoeuvre. However, of the two loops recorded during previous displays, where the cockpit action camera captured throttle position, one showed variation of the throttle position during the upward part of the vertical manoeuvre. In that case movement of the throttle correlated with engine speed changes. Throttle position changes can only be made by

164 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis the pilot, indicating that he had deviated from his stated throttle technique on that occasion. Therefore, whilst mechanical issues cannot be ruled out, it is possible that the variation in thrust during the accident manoeuvre was commanded by the pilot. 2.2.1.2 The apex of the manoeuvre The pilot looked down towards the general area of the flight instruments on two occasions as the aircraft arrived at the apex of the manoeuvre but it is not known which, if any, of the instruments he observed. The available evidence indicates that the aircraft reached a height of approximately 2,700 ft, which was below the pilot’s stated target, at an airspeed of approximately 105 kt, which was slower than normal. Test flights indicated that the aircraft required a minimum of 2,700 ft to complete the second half of the manoeuvre and that consequently no margin existed for it to do so safely in this case. The aircraft did not achieve the target parameters at the apex of the manoeuvre because it entered the manoeuvre below the target airspeed and climbed with less than maximum thrust. The maximum height achieved would also have been reduced by any roll initiated before the aircraft reached a vertical attitude in the climb. At the apex of the manoeuvre the altimeter would have indicated that the aircraft was approximately 800 ft below the minimum height that the pilot stated was required. Tests of the left altimeter indicated that under-reading and lag in its operation may have caused it to indicate an even lower altitude (see Section 2.3.1.1). It was not possible to determine what the altimeter displayed at the apex of the manoeuvre. However, the investigation found that when the altimeter indicated approximately 2,700 ft, the pointer would partially obscure the height counter, which provided the only indication of thousands of feet (see Figure 28). The pilot stated that if the aircraft achieved a height below 3,500 ft he would perform an escape manoeuvre by reducing the rate of pitch, increasing the airspeed, rolling the aircraft upright and climbing away. The pilot had not practised the escape manoeuvre he described, but the execution of such a manoeuvre would have been consistent with his background and experience.

165 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis The RAFCAM HF report identified four reasons why the accident manoeuvre may have been continued: • The pilot did not check the altimeter. • The pilot checked the altimeter but did not or could not read it correctly. • The pilot read the altimeter correctly but did not accurately recall the minimum height required at the apex of the looping manoeuvre for this aircraft. • The pilot read the height correctly but decided that an escape manoeuvre was no longer possible. If a false understanding of his height at the apex led him to believe it was sufficient to complete the manoeuvre, he would have had no reason to discontinue it or eject. 2.2.2 Conduct of escape manoeuvres The pilot was aware of the actions to be taken to escape from a looping manoeuvre when insufficient height was available at the apex to complete it safely. He had not performed that manoeuvre in the Hunter and commented that he would not be sure of the outcome of doing so at airspeeds as low as 105 KIAS. The TP observed that flying an escape manoeuvre was not the same as flying other manoeuvres, such as a half Cuban 8, that the pilot might otherwise have practised. Flight trials demonstrated that an escape manoeuvre can be accomplished successfully at airspeeds as low as 80 KIAS, and up to four seconds into the descent after passing the apex. The accident pilot stated that he was unsure of these type-specific aircraft handling characteristics and had not practised them. The RAFCAM report stated that four seconds was adequate time within which to make a rule-based decision and implement a practised action but was not sufficient to make analysis-based decisions. If the pilot had perceived that the apex height was insufficient, it would then have been necessary for him to take the required action to achieve a safe outcome. The available evidence indicates that the pilot had not practised the action required. Therefore the following Safety Recommendation is made:

166 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis Safety Recommendation 2017-002 It is recommended that the Civil Aviation Authority require pilots intending to conduct aerobatics at flying displays to be trained in performing relevant escape manoeuvres and require that their knowledge and ability to perform such manoeuvres should be assessed as part of the display authorisation process. The handling differences between straight-wing and swept-wing jet aircraft introduce the possibility that techniques may be transferred inappropriately from one type to another. Accordingly, the following Safety Recommendation is made: Safety Recommendation 2017-003 It is recommended that the Civil Aviation Authority review the grouping of aircraft types in display authorisations to account for handling and performance differences it considers significant. 2.2.3 Possible impairment The investigation considered the possibility that the pilot suffered a cognitive impairment. There was no evidence of any g-related impairment of the pilot during the aerobatic sequence flown. If the pilot was unwell before the accident, it was not established in what way he was unwell or when the onset of any condition was first experienced. Action camera evidence from the accident flight and from previous flying displays indicated that the pilot’s behaviour and activity did not differ significantly between them. It is not exceptional for flying display accidents to involve experienced display pilots, and an accident is not necessarily an indication of cognitive impairment. 2.3 Technical issues relevant to the accident flight 2.3.1 Flight instruments The flight instruments of particular relevance to the investigation were the altimeters, the left airspeed indicator (collectively known as pitot-static instruments) and the engine performance instruments. 2.3.1.1 Pitot-static instruments It was not possible to test the pitot-static system due to accident damage but there was no evidence of a pre-accident defect. Cockpit action camera recordings showed that the right ASI was providing reasonable indications

167 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis during the accident flight, suggesting that at least this part of the pitot-static system was functional. The left ASI was not visible on the cockpit action camera recordings but functioned normally when tested, despite the damage to the instrument glass, and it was determined to be within the required calibration. The altimeters were not in the field of view of the cockpit action camera during the accident flight. However, during the essentially stable level transit to the south coast the altitude reported by the pilot (probably referring to the left altimeter), the Mode C altitudes and the GNSS altitudes, correlated to within 200 ft of each other, and the magnitude of the differences is not significant to the investigation. It was not possible to determine whether the left altimeter had been selected to standby or servo mode during the accident flight, however, the pilot was not in the habit of selecting between modes and in the absence of such a selection, the altimeter would be in standby mode by default. Bench testing of the left altimeter in both modes showed a permanent under‑read of 100 ft. The manufacturer stated that this finding suggested the altimeter may have been calibrated incorrectly at build or when last serviced, or that the offset could be attributed to minor slippage within the altimeter gear train due to accident impact forces. In addition, when in standby mode, the displayed altitude lagged the measured altitude due to internal friction and some stickiness of the pointer needle was evident. The bench testing could not accurately replicate the rapidly changing altitudes experienced in dynamic manoeuvring flight. However, the cockpit video from the Duxford flight in September 2014, showed the stby flag was present on the left altimeter indicating that it was operating in standby mode during that flight. Therefore it is likely that the stickiness and lag of the pointer needle and the erratic altimeter behaviour exhibited during that flight, was typical of the left altimeter’s operation in standby mode during dynamic manoeuvring flight. Testing also revealed that the right altimeter did not produce the synchronising signal required for the left altimeter to operate correctly in servo mode, due to a defect in its synchro-transmitter. This fault did not trigger the conditions required for the left altimeter to revert automatically to standby mode during testing, and was not among the faults listed in the Aircrew Manual which would cause the left altimeter to revert automatically to standby (see Appendix A). With this fault, if the left altimeter was selected to servo mode during the accident flight it would have been working independently of the right altimeter, displaying

168 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis the altitude sensed by its own capsule. The altimeter may have exhibited even greater lag and stickiness than in standby mode, as it would not have benefited from the vibrator motor to overcome friction in the gearing. Its indication would have lagged and then jumped as friction in its mechanism was overcome, and it would have under-read by a minimum of 100 ft. This degraded condition may not have been evident to the pilot, unless close monitoring of both altimeters revealed a discrepancy in their readings. The broken wire in the right altimeter synchro-transmitter was probably not accident-related but it was not possible to determine how long this fault had existed. The technical records indicated that the right altimeter (S/N 786) was installed in G-BXFI in March 2015, prior to which it had been in an aircraft which had not flown for at least four years. Therefore it is possible this fault existed prior to its installation in G-BXFI. The maintenance organisation stated that it did not keep, or have access to, historic component log cards for the any of the altimeters and was therefore unaware of the component history and last servicing dates. A pitot-static leak check was carried out following the replacement of the right altimeter. A function test confirming electrical synchronisation between the two altimeters would have identified this fault if present at that time, but was not carried out.

The right altimeter fitted during the Duxford flight had been removed from G-BXFI in March 2015. Subsequent testing, both after removal and later during the investigation, revealed no defects with that unit. In standby mode, the behaviour of the left altimeter would have been independent of whatever altimeter was fitted on the right. Overall, whether in servo or standby mode, the left altimeter would have indicated a lower altitude at the apex of the accident manoeuvre than the aircraft actually achieved. 2.3.1.2 Rpm indication The small errors in indicated engine rpm were not considered significant. 2.3.1.3 Jetpipe Temperature (JPT) indication It was not possible to test the JPT indication system due to accident damage but analysis of recorded data indicated that the system was providing appropriate indications.

169 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis 2.3.2 Engine and engine controls The engine manufacturer’s analysis of JPT and engine speed, derived from the cockpit action camera recordings, revealed no anomalies during takeoff and transit steady state conditions. There was insufficient data to verify engine performance during the dynamic manoeuvres. There was no evidence of a pre-impact defect within the engine’s compressor, combustion chambers and turbine. It was not possible to determine engine speed at impact, but damage from foreign objects ingested into the compressor and the presence of vegetation within the compressor case bleed air galley confirmed that the engine was operating at impact. The diaphragm from the hydro-mechanical governor had degraded significantly, having suffered chemical degradation during prolonged periods of inactivity when the fuel system had not been preserved. The laboratory examination of the diaphragm concluded that: ‘The combined degrading effects of age, exposure to aviation kerosene and air have resulted in the pump diaphragm exceeding the known predictable functional capability of the materials it was manufactured from.’ The condition of the FCU, the ACU, the BPC and the fuel pump confirmed that they had been subject to normal operational wear, and had not suffered from any pre- or post-impact failure. The engine manufacturer’s analysis concluded that the engine was operating at impact and that there was no evidence to suggest it would not have responded normally to the pilot’s inputs. However, information included in a previous AAIB report (EW/C98/6/1) indicated that there had been several cases involving the Avon Mk 122 engine where engine speed had dropped and the subsequent engineering investigation did not established a clear cause. Consequently, an uncommanded thrust reduction could not be ruled out. 2.3.3 Flying controls and hydraulic system Photographs and video of G-BXFI’s display indicated that the operation of its flying controls and the aircraft response to the inputs were normal. Engineering examination of the components did not identify any pre-existing defects.

170 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis 2.4 Control of flying display risk 2.4.1 Analysis methodology The AAIB Bowtie analysis of this accident considered that the ‘loss of system control’ occurred when the aircraft reached the apex of the manoeuvre with insufficient height to complete it safely. It explored preventive controls for the circumstances that may have led to this loss of system control, and recovery controls to prevent or mitigate the outcome. In some cases the same controls are represented as both preventive and recovery controls. The analysis also considered the performance of relevant safety systems and regulation. 2.4.2 Preventive controls 2.4.2.1 Initial and recurrent training programmes The Hawker Hunter is a high-performance aircraft and appropriate training is vital to its safe operation. It is also an expensive aircraft to operate, with limited engine life, for which a limited supply of spare parts is available. Consequently, it is not unusual for training to be carried out during flights conducted for other purposes to minimise aircraft utilisation. The training syllabus for an aircraft like the Hunter is devised by the aircraft’s operator and forms part of its OCM. The accident pilot was experienced in displaying RV-8 and Jet Provost aircraft. Aerobatics were not a normal part of his military flying on the Harrier jet, but he was familiar with the recovery from low airspeed and unusual positions experienced in that type during simulated air combat. This experience had some relevance to performing escape manoeuvres during low-level aerobatics, but was not the same as the specific training and demonstration of escape manoeuvres on the Hunter. The flying training syllabus was proposed by the operator and agreed by the CAA. The exercises were not described in detail and the learning objectives were not specified. The purpose of training is to transfer skills, knowledge and abilities to the real environment, but in this case the pilot was apparently not aware of relevant aircraft performance within a part of the operational envelope that the aircraft could be reasonably expected to encounter, such as the need to recover from a looping manoeuvre at or near its apex at low airspeed. Whilst the pilot’s background and experience of flying aerobatics in jet aircraft had some

171 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis relevance to performing escape manoeuvres, this was not assessed during his training and testing on the Hunter. Consequently, the initial and recurrent training programs were not an effective control in this case. Training flights were not recorded by the operator as required by the CAA. The accident pilot had submitted a proposed Training Record form to the Chief Pilot and had completed one for the dual check he carried out on the Chief Pilot, but it was not filed. The absence of required records is contrary to the obligations placed upon an operator by CAP 632. Accordingly, the following Safety Recommendation is made: Safety Recommendation 2017-004 It is recommended that the Civil Aviation Authority remind operators, whose activities are subject to the guidance published in Civil Aviation Publication 632, of the need to maintain detailed training records for pilots and check their compliance during inspections it carries out. 2.4.2.2 Pilot currency to maintain proficiency The pilot had conducted 14 displays and 11 practice displays in the Hunter in the five years before the accident. In 2015 he had conducted one practice and five displays in the Hunter, the most recent being 14 days prior to the accident. The equivalent RAF requirement is to have flown two displays or practice displays on a specific type in the eight days preceding a public display. The majority of the pilot’s jet display flying was in the Jet Provost, which has significantly different performance and lower apex gate heights in looping manoeuvres than the Hunter. His greater experience and recency on the Jet Provost meant that he was more likely to be familiar with the speeds and handling characteristics of this type, and to recall them more easily than those for the Hunter. 2.4.2.3 Operator’s procedures CAP 632 states that ‘the more complex and demanding the aircraft, the more detail that will be required in the OCM.’ The operator’s OCM had been agreed by the CAA.

172 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis 2.4.2.4 Regulatory requirements for pilot competency The pilot required an Approved Type Rating Exemption to fly the Hunter. His was valid at the time of the accident but its renewal was based on a statement of his recent flying experience rather than a test or evaluation. He had renewed his DA in June 2015 in an RV-8 light piston-engined aircraft. This renewal had automatically renewed his DA for all other types including the Hunter, which has significantly different performance and handling characteristics. During his previous renewal in September 2014, flying second in a formation pair of Jet Provosts, he had not been required, nor had the opportunity, to demonstrate his own ability to make decisions or manage the flight path and energy of the aircraft during a display. Both of these renewals complied with the regulations then in force and were carried out by DAEs authorised by the CAA. However, in neither case had the pilot demonstrated his competence in displaying a Hunter nor, in the 2014 renewal, his ability to conduct a flying display other than when following another aircraft in a formation. Accordingly the following Safety Recommendation is made: Safety Recommendation 2017-005 It is recommended that the Civil Aviation Authority specify that the flight demonstration requirement of a display authorisation evaluation, other than to assess formation following, cannot be satisfied by the pilot following another aircraft during the evaluation. The investigation identified that significant differences may exist between aircraft in a given category; for example between swept-wing and straight-wing jet aircraft, or between historic military aircraft and modern aerobatic types. In order to address the potential for transfer of behaviours from a type where they may be appropriate, to another where they are not, such as handling technique, target speeds and gate heights, the AAIB made the following Safety Recommendation in Special Bulletin S1/2016: Safety Recommendation 2016-041 It is recommended that the Civil Aviation Authority require a Display Authorisation to be renewed for each class or type of aircraft the holder intends to operate during the validity of that renewal.

173 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis In FACTOR F4/2016 Issue 2 the CAA responded as follows: ‘The CAA will review the list of different categories of aircraft relevant to pilot Display Authorisation renewal and assess the impact of operating differences between each category. The CAA will expand this work to include a study of the potential for inappropriate transfer of behaviours between aircraft types. The CAA will consider introducing any relevant findings into the ongoing training and assessment requirements for display pilots, including the requirements for Display Authorisation renewal. The CAA will conclude this review and publish its findings by April 2018.’ 2.4.2.5 Monitoring by the pilot The available evidence indicates that the information required to determine the aircraft’s height, speed and engine performance would have been presented on the aircraft’s instruments. The aircraft did not achieve the height and speed that the pilot stated he would require for a ‘bent loop’. The pilot did not recall the accident flight and, although it was not possible to determine why he continued with the manoeuvre when the height at the apex was insufficient to complete it, the investigation identified the four possibilities shown in Section 2.2.1.2. In addition the height and speed achieved was similar to that achieved at the apex of four looping manoeuvres the pilot conducted during two displays in a Jet Provost the previous weekend (see Table 6). In October 2009 the CAA responded to previous AAIB Safety Recommendation 2009-054 concerning this subject, in part by requiring DAEs to explore human factors in the form of personal limitations and the applicant’s mental attitude to display flying, as part of the DA application procedure. CAP 1047 – ‘Civil Air Displays – a guide for pilots’, contains relevant information.

Also, the CAA proposed the following action in CAP 1400 - ‘UK Civil Air Display Review’: ‘Action 29: The CAA will commence a programme of work to study and enhance understanding of human factor issues within the air display sector, starting with a full-day industry workshop: the causes and impact of human error for display pilots (date to be set).’

174 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis The investigation indicates that further efforts in this area would be beneficial. Accordingly, the following Safety Recommendation is made: Safety Recommendation 2017-006 It is recommended that the Civil Aviation Authority undertake a study of error paths that lead to flying display accidents and integrate its findings into the human factors training it requires the holders of display authorisations to undertake. During the investigation two pilots with relevant military and fast jet experience informed the AAIB that they had used an incorrect gate height during a display, or omitted to check that the gate height had been achieved. It is likely that gates will occasionally be missed, reducing the effectiveness of this control and reinforcing the need for other mitigations such as greater performance margins and protection for those positioned beneath the flying display. 2.4.2.6 External monitoring detects the missed gate The risk assessment for the 2015 Shoreham Airshow, as in previous years, stated that monitoring by the FCC mitigated the hazard of an aircraft crashing outside the airfield boundary. However, the investigation found that monitoring of a display by the FCC is unlikely to be a satisfactory control for this type of occurrence. Footage of the 2014 display shows G-BXFI overflying the congested areas of Lancing, which appears not to have been detected or acted upon at the time. During the accident flight, shortly before the pull-up to the accident manoeuvre, G-BXFI was 2 km from the display line, off the airfield and below the pilot’s minimum aerobatic height, but the display was not stopped. At the apex of the accident manoeuvre the aircraft was significantly below its gate height, but the FCC did not know the required height and had no way to assess accurately if the aircraft had achieved it. If the FCC had known and been able to intervene by informing the pilot, flight tests indicate that the pilot would have had to perceive the intent of this information, determine that a recovery manoeuvre was necessary, and initiate a recovery manoeuvre, all within four seconds of passing the apex. Therefore this is unlikely to be an effective control. 2.4.2.7 Safety systems and regulation Safety management systems A safety management system (SMS) enables an organisation to determine its approach to safety and to identify the hazards to which it is subject. CAP 632 included an SMS evaluation tool. However there was no mention of SMS in

175 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis CAP 403 Edition 13 in force at the time of the accident, and no evidence that the available guidance had led to the adoption of SMS or equivalent practices among the operators of displaying aircraft. The operator of G-BXFI was not required to have an SMS and did not have one. The operator of Folland Gnat, G-TIMM also did not have a SMS in place. Likewise, neither the display organiser nor the CAA GAU had, or were required to have, an SMS. Hazards need to be identified before they can be controlled. The operator’s Chief Pilot stated that he had regular discussions with the accident pilot, but he was unaware of the two incidents involving loose articles in the cockpit during displays, which were observed on cockpit camera recordings. A formalised SMS might not have captured these events if the pilot did not report them, but having an effective SMS in place would have provided a mechanism for reporting, and for putting in place safety barriers to counter such events. The maintenance organisation’s Exposition described a QMS but this did not prevent shortcomings in the process intended to ensure that the aircraft was airworthy. Consequently, at the time of the accident to G-BXFI, the controls that could have been introduced or supported by an SMS were absent. The CAA GAU has stated that it intends to introduce a regulatory SMS.

Regulation of complex aircraft The CAA stated that the GAU regulates non-complex aircraft up to a maximum weight of 5,700 kg, including the Hunter which it categorises as an ‘intermediate’ type. However the Hunter is a ‘complex’ type as defined by the EASA (see Section 1.18.12) because it is powered by a turbojet engine and has a maximum takeoff mass of 11,340 kg. Therefore the following Safety Recommendation is made: Safety Recommendation 2017-007 It is recommended that the Civil Aviation Authority review the arrangements for safety regulation and oversight of intermediate and complex ex-military aircraft operated in accordance with Civil Aviation Publication 632, to ensure that they are consistent and appropriate.

176 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis Safety culture A culture of safety involves a willingness to communicate safety issues and evaluate safety related behaviour. Footage from several flying displays showed low-flying away from the display area and overflight of congested areas that was either not reported or not addressed, and was not confined to one pilot, aircraft or venue. With regard to the operation of G-BXFI, the operator's Chief Pilot was not aware of the presence of loose articles on two flights. The aircraft had been operated for some time with a defective g-meter and defective aileron trim indicator, both of which would have been visible to its pilots. A review of maintenance records indicated shortcomings including non-compliance with mandatory requirements. Regulatory oversight The CAA GAU is responsible for regulatory oversight of flying displays in the UK, display pilot and DAE approvals, CAP 632 operator approvals and the oversight of maintenance organisations, including the application of MPDs and the approval of AMOCs. There was no formalised reporting system related to flying displays and the CAA had not implemented previous relevant AAIB Safety Recommendations that it had accepted. The CAA GAU did not have mechanisms enabling it to determine the effectiveness of its regulations and how they were applied. Shortcomings included the small number of displays inspected by regulatory staff in 2014 and 2015, the misfiling of some 2014 reports, and the absence of a process for confirming that display organiser risk assessments were of suitable and sufficient quality to ensure that appropriate controls were in place to protect the public. The AAIB’s assessment of the CAA’s oversight of the maintenance organisation was hindered because the CAA could not find some of its audit reports. The CAA GAU relied on informal feedback concerning compliance with DA limits and safety events such as ‘stop’ calls.

177 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis The AAIB made the following Safety Recommendation in Special Bulletin S1/2016: Safety Recommendation 2016-042 It is recommended that the Civil Aviation Authority publish a list of occurrences at flying displays, such as ‘stop calls’, that should be reported to it, and seek to have this list included in documentation relevant to Regulation (EU) No 376/2014. The CAA responded as follows: ‘The CAA does not accept this recommendation.

The CAA is developing a positive reporting culture - a Just Culture – for the air display community. Within the air display sector the CAA believes that this is the most effective way to identify and address potential safety issues before they lead to accidents. In support of this, from April this year the CAA required all event organisers and FDDs to submit, within seven days, a post-air display report to the CAA. This report must include what went well at the display, as well as information on any lapses or breaches from the required standards. Pilots must also report any aspect of their display that could have caused a significant safety risk. The CAA will record all this information. Key information will be shared with the civil air display community through briefings, the pre- and post-season seminars that the CAA jointly hosts with BADA2 and the MAA, and the annual seminar that the CAA organises for DAEs.’ The AAIB has categorised the response to Safety Recommendation 2016‑042 as ‘Partially adequate – closed’, because the proposed system lacks the rigour of a reporting system described in Regulation (EU) No 376/2014, which states: ‘It is essential to have high-quality and complete data, as analysis and trends derived from inaccurate data may show misleading results and may lead to effort being focused on inappropriate action. In addition, such inaccurate data may lead to a loss of confidence in the information produced by occurrence reporting schemes. In order to ensure the quality of occurrence reports, and to facilitate their completeness, they should contain certain minimum information, which may vary depending on the occurrence category.’ 2 British Air Display Association.

178 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis Design of the display environment Every display site has constraints and limitations. The area surrounding Shoreham is particularly congested, with nearly 40% of the surface area within 2 km of the centre of the airport consisting of major roads, housing, industrial or recreational areas. There were areas where secondary spectators were known to gather despite the display organiser’s efforts to reduce numbers to address the hazard of road traffic to these crowds. There was also a large bulk fuel storage area 500 m from the north-east end of the display line. During the 2014 Shoreham Airshow the Hunter flew over some of these congested areas while conducting aerobatic manoeuvres. In Special Bulletin S1/2016 the AAIB reported that infringements of this nature were not confined to one aircraft, pilot or venue. The risk assessment for the Shoreham Airshow had not considered how individual display aircraft would operate within the constraints of the surrounding area. In the UK most flying display accidents occur underneath the volume of airspace in which the aircraft is manoeuvring and, in more than half of cases, in areas outside the control of the display organiser. There was no evidence that the suitability of the specific display sequences intended for the 2015 Shoreham Airshow were considered either in relation to the environment surrounding Shoreham or their effect on uninvolved third parties. Accordingly the AAIB made the following Safety Recommendation in Special Bulletin S1/2016: Safety Recommendation 2016-039 It is recommended that the Civil Aviation Authority require the organisers of flying displays to designate a volume of airspace for aerobatics and ensure that there are no non-essential personnel, or occupied structures, vehicles or vessels beneath it. The CAA did not accept this recommendation.

179 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis The normal rules of the air are intended to protect the public in circumstances other than at flying displays by requiring, for example, that aircraft do not perform aerobatics over congested areas or fly closer than specified to any person, vehicle, vessel or structure. It follows that enhanced protection of the public may be necessary only where a displaying aircraft will deviate from those normal rules. Discussion with the CAA and with flying display participants reveals that an alternative approach to that envisaged in Safety Recommendation 2016-039 is to ensure that aircraft are only permitted to deviate from the normal rules of the air in circumstances over which the participants have control, and for which they have conducted a suitable and sufficient risk assessment. In Special Bulletin S1/2016 the AAIB made Safety Recommendation 2016-036: Safety Recommendation 2016-036 It is recommended that the Civil Aviation Authority remove the general exemptions to flight at minimum heights issued for Flying Displays, Air Races and Contests outlined in Official Record Series 4-1124 and specify the boundaries of a flying display within which any Permission applies. The CAA updated its response to Safety Recommendation 2016-036 in FACTOR F4/2016 Issue 2, as follows: ‘The CAA has removed the general exemption to flight at minimum heights issued for civil air displays, air races and contests, outlined in Official Record Series 4-1124. Display Permissions granted by CAA under Article 86 of the Air Navigation Order 2016 now specify the boundaries of a flying display within which the permission applies.’ Separation distances required at the time of the accident to G-BXFI were based on the 1993 Study, which concluded that the 230 m line was a ‘sensible compromise between airshow attractiveness and safety’. Inspection of the model used by the study revealed that, in the circumstances considered, dense debris such as engines would enter the crowd area in a manner similar to that which occurred at the 1952 Farnborough Airshow. At the time of the accident there had been no further study to consider more recent concepts such as the debris energy required to cause an injury, the shelter effects of structures or vehicles, or aircraft manoeuvring that has the

180 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis potential to “loft” released components. Accordingly, the AAIB made the following Safety Recommendation in Special Bulletin S1/2016: Safety Recommendation 2016-037 It is recommended that the Civil Aviation Authority require that displaying aircraft are separated from the public by a sufficient distance to minimise the risk of injury to the public in the event of an accident to the displaying aircraft. The CAA accepted this Safety Recommendation. The location of the secondary crowd at the A27/ Old Shoreham Road junction was known to the display organisers. Similar areas exist at other UK display sites. Some members of a secondary crowd may understand the level of risk they are taking but others may be attracted to the area without making that assessment. Accordingly, a minimum level of safety for such areas should be established. The AAIB made the following recommendation in Special Bulletin S1/2016: Safety Recommendation 2016-038 It is recommended that the Civil Aviation Authority specify the minimum separation distances between secondary crowd areas and displaying aircraft before issuing a Permission under Article 162 of the Air Navigation Order. FACTOR F4/2016, issued on 9 June 2016, recorded that the CAA did not accept this recommendation. However, following discussions with the AAIB, the CAA included in FACTOR F4/2016 Issues 2 an updated, combined response to Safety Recommendations 2016-037 and 2016-038, as follows: The AAIB categorised this response as ‘Adequate – closed’. ‘The CAA will conduct a review, within six months of publication by the MAA of a study by Frazer-Nash, to consider whether any changes are required to the minimum distance that display aircraft are to be separated from the public (primary and secondary crowds) to effectively minimise the risk of injury to the public in the event of an accident to the displaying aircraft. In the event that this study does not deliver a clear output or is terminated, for any reason, the CAA will consider what additional work will be needed to resolve this Recommendation. Subject to the findings of the study and the outcome of the review, the CAA shall make any necessary revisions to the application process for Permissions granted under Article 86 of the Air Navigation Order 2016.’

181 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis Guidance for the risk assessment of flying displays The report of the HSL highlighted shortcomings in the risk assessment for the 2015 Shoreham Airshow and the AAIB made the following Safety Recommendation in Special Bulletin S1/2016: Safety Recommendation 2016-031 It is recommended that the Civil Aviation Authority review and publish guidance that is suitable and sufficient to enable the organisers of flying displays to manage the associated risks, including the conduct of risk assessments. The CAA accepted this Safety Recommendation. The second study by the HSL, of risk assessment guidance provided by the edition of CAP 403 in force at the time of the accident, found that parts of CAP 403 represented good practice but that the document required improvement. The CAA issued four revisions to CAP 403 Edition 13 in 2016, and the AAIB has provided the CAA with a copy of the second HSL report. The following Safety Recommendation is made: Safety Recommendation 2017-008 It is recommended that the Civil Aviation Authority consider implementing the changes outlined in Health and Safety Laboratory report MSU/2016/13 ‘Review of the risk assessment sections of CAP 403’. Regulation of flying displays AAIB Aircraft Accident Report 6/2009, concerning the accident to Hawker Hurricane G-HURR, contained the following Safety Recommendation: Safety Recommendation 2009-057 It is recommended that the UK Civil Aviation Authority conduct periodic reviews of the current operating requirements to ensure that they provide adequate safety for display flying. The CAA accepted this recommendation. It conducted the UK civil air display review after the accident to G-BXFI, reporting its findings in CAP 1400.

182 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis 2.4.3 Recovery Controls When the aircraft failed to achieve the required height at the apex of its manoeuvre, effective recovery controls could have prevented the accident (for example by enabling the pilot to recover the aircraft to level flight before it struck the ground) or mitigated the consequences of the aircraft crashing (for example by separating the crash from public gatherings). The investigation explored six controls relevant to the accident involving G-BXFI: 2.4.3.1 External monitoring detects the missed gate This control is discussed in the ‘preventive controls’ section above. It was ineffective at Shoreham and may not be effective in any case. 2.4.3.2 Pilot performs an escape manoeuvre having recognised it was necessary This control relies on the pilot’s monitoring and training and is discussed in the ‘preventive controls’ section above. This control was not effective in this case. 2.4.3.3 Separate the consequences from uninvolved third parties At Shoreham, and similar displays in the UK at the time of the accident, there was no specific requirement to separate the displaying aircraft from uninvolved third parties. The CAA considered that separation from third parties would be managed via the risk assessment process; at the time risk assessments were not routinely reviewed by the CAA. 2.4.3.4 Separate the consequences from involved third parties The investigation found that the display separation distances required at the time would not have protected the crowd from predictable scenarios. 2.4.3.5 Pilot ejects This control only protects aircraft occupants, leaving no control over where the aircraft or ejection seat impacts the ground. It also relies on the ejection seat system being within its escape parameters and serviceable. The seat was probably outside its escape envelope for the majority of the flight from the apex of the manoeuvre to impact. Additionally the cartridges in the ejection seat were time-expired and therefore safe ejection could not be guaranteed.

183 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis 2.4.3.6 Mitigate the risk to first responders Following the accident to G-BXFI some explosive ejection seat cartridges remained live and phenolic asbestos from the underwing drop tanks was scattered over a wide area. Whilst the ejection seat cartridges were rapidly identified as a risk, the presence of asbestos was not identified until a week after the accident. Until then, emergency services personnel and others were exposed to this hazard. CAP 403 stated that organisers should be aware of hazardous materials used in aircraft and that risk assessments should contain specific mitigation for dealing with aviation materials. The display organisers and the operators of G-BXFI did not have controls to manage the risk from these materials and were either not aware of their presence or were aware but did not inform the emergency services. Other aircraft types that participate in air displays may contain hazardous materials. The HSE advises that where possible hazardous material should be replaced with non-hazardous material. Therefore the following Safety Recommendation is made: Safety Recommendation 2017-009 It is recommended that the Civil Aviation Authority require operators of aircraft used for flying displays to identify, and where practicable remove, any hazardous materials. During the course of the investigation the AAIB were made aware that underwing drop tanks made of materials other than asbestos are available and accordingly the following Safety Recommendation is made: Safety Recommendation 2017-010 It is recommended that the Civil Aviation Authority prohibit the use of phenolic asbestos drop tanks on civil registered aircraft. 2.4.4 Performance of risk control measures The investigation found that the only recovery controls capable of preventing a fatal outcome, once the aircraft had failed to achieve the required height at the apex of the manoeuvre, were successful execution of an escape manoeuvre or separation of the accident from the public. The pilot’s recent training and experience did not equip him to conduct an escape manoeuvre in the Hunter. Measures had been taken to reduce the number of people at the A27 junction for the purpose of minimising the road traffic hazard to these crowds. Measures to mitigate the hazard of aircraft crashing outside the airfield boundary were not effective.

184 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis The historic absence of fatal injuries to third parties at UK flying displays does not indicate that the activity is safe. 2.5 Engineering aspects 2.5.1 Engine condition monitoring, maintenance history and regulatory requirements The use of SOAP as a means of detecting deterioration within oil system components is well established but relies on taking frequent samples to enable a ‘baseline’ to be defined for the engine. This baseline is then used to identify component deterioration due to changes in the material elements found suspended in the oil. The low oil sampling rate used on G-BXFI would have made SOAP ineffective as a means of monitoring the condition of its engine’s oil-wetted components. Furthermore, there was no evidence that the performance of the engine was being formally monitored, thereby reducing the likelihood of early identification of any progressive deterioration in engine performance. Ageing, and the lack of fuel system preservation during prolonged periods of inactivity, had resulted in degradation of the hydro-mechanical governor diaphragm. Failure of the diaphragm would have resulted in an un-commanded increase in engine fuel flow and possibly engine failure. The fuel pump was last overhauled in 1998. The current maintenance organisation had been responsible for G-BXFI for approximately three years before the accident, or approximately 12% of the life of the diaphragm. The condition of the diaphragm indicated that deterioration is likely to have been present before the current maintenance organisation had assumed responsibility for the maintenance of the aircraft. The location of the diaphragm meant that its condition could only be verified by physical inspection, which required the disassembly of the fuel pump and governor by an approved overhaul facility. Due to the age of the engine type and the limited numbers currently operating there has been no capability to inspect or overhaul Rolls-Royce Avon 122 engine fuel control systems for several years. The periods of inactivity of G-BXFI are considered typical of the civil Hunter fleet, and there may be other installed engines of this type in which the hydro-mechanical governor diaphragms have deteriorated. The fuel control systems of other ex-military gas turbine-powered fixed and rotary winged aircraft may contain components, made from similar materials, whose condition cannot be monitored without specialist facilities. Accordingly, the AAIB presented the findings of the Rolls-Royce laboratory report to the CAA, which resulted in the publication of MPD 2016-001 on 7 October 2016.

185 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis The requirements of MPD 2001-001 were intended to mitigate the effects of low utilisation and extended the installed life of Rolls-Royce Avon engines in civil operation. Actions taken by the organisations responsible for G-BXFI’s maintenance were capable of identifying deterioration within the gas path and external engine pipes and ducts; they were not capable of identifying the deterioration of compressor blade retention or component deterioration within the engine fuel control system. The engine type has been in operation for 15 years since the publication of MPD 2001-001, during which unanticipated and unmonitored deterioration may have developed. In addition the aviation industry has introduced new inspection methods that may provide improved detection of engine deterioration. The AAIB made the following Safety Recommendation in AAIB Special Bulletin S4/2015 published on 21 December 2015: Safety Recommendation 2015-046 It is recommended that the Civil Aviation Authority (CAA) review the effectiveness of all approved Alternative Means of Compliance to Mandatory Permit Directive 2001-001. The CAA responded as follows: ‘The CAA does not accept this recommendation. There have been no changes to the design of the engine, nor any inadequacy in the effectiveness of associated inspection and monitoring methods identified.’ That position was not supported by the evidence of this investigation. The loss of a compressor blade in a Hawker Hunter T7 in 20133, and subsequently the unmonitored deterioration of the fuel pump governor diaphragm, identified during this investigation, demonstrate that maintenance tasks associated with AMOC’s to MPD 2001-001 are not able to identify all age-related issues on the Rolls-Royce Avon 122 series of engine. 3 This resulted in the publication of MPD 2016-002 (see Section 1.18.14.4)

186 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis Safety action taken The CAA published MPD 2016-01, on 7 October 2016, in order to minimise the possibility of an age-related failure of elastomeric components within an engine’s fuel control system resulting in an “unsafe condition”4 in flight. If an aircraft or engine cannot meet the requirements of the MPD an operator or maintenance organisation can apply to the CAA for an AMOC to this MPD. The application must include a failure analysis, based on the MPD guidance material, of all elastomeric components within the engine fuel system. Failures identified as “severe” must include mitigating actions for the failure. The CAA briefed the investigation on the reasoning and methodology that will be applied to all applications for an AMOC to MPD 2016-01. In recognition that an operator/maintenance organisation may not have a complete understanding of the functionality of such components the CAA has stated that any failure analysis must be completed by someone with a level of specialist knowledge and experience that the CAA find acceptable. The application of the subsequent MPD 2016-02 is intended to improve detection of compressor blade failure due to age-related deterioration. FACTOR F1/2016 Issue 2 stated: ‘The CAA will require ex-military jet aircraft maintenance organisations and/or continuing airworthiness management organisations to conduct a review of their approved Alternative Means Of Compliance (AMOC) to MPD2001-001. Following such a review, each of these affected organisations must make application for a new AMOC in accordance with a new MPD to be issued which will supersede MPD2001-001. The review process will be completed by April 2018.’ The AAIB re-categorised the response to Safety Recommendation 2015-47 as ‘Adequate – closed’ 4 An unsafe condition is defined in MPD 2016-01 as a “severe failure of an elastomeric component such that continued safe flight and landing would be prevented”.

187 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis 2.5.2 Compliance with MPD 2001-001 CAA MPD 2001-001 imposes a calendar life limit on the Rolls-Royce Avon of 15 years, and the MPD allows an alternative means of compliance to be approved by the CAA. It states: ‘The CAA will consider alternative inspection/test and sampling programmes which can be shown to prevent unacceptable deterioration of engines in service. Operators may wish to propose such programmes in lieu of engine withdrawal from service. These programmes must, however, be underwritten by an approved BCAR A8-20 organisation or the manufacturer and must address all ageing related deterioration which could occur on the Avon engine series.’ In January 2014 the maintenance organisation contacted the CAA with a proposal for an AMOC to MPD 2001-001. The CAA responded that the maintenance organisation should consider including all the items contained in CAP 562 Leaflet 70-80 in any formal submission of an AMOC application. The investigation found no evidence of a further submission. Prior to publication of AAIB Special Bulletin S4/2015 the CAA stated to the AAIB that it was unclear whether a legally valid AMOC to MPD 2001-001 was in place for G-BXFI at the time of the accident. Following discussions between the CAA and the current maintenance organisation, and a review of G-BXFI’s maintenance records, the CAA concluded subsequently that a valid AMOC to MPD 2001-001 had been in place. It reached this conclusion by comparing work that had been carried out by that maintenance organisation with an AMOC that had been documented in the approved Exposition of the previous operator, and not on approvals in place at the time. The previous maintenance organisation’s Exposition, an integral part of its CAA Company Approval, stated in Part Two, ‘Procedures Manual’, Chapter 19, that: ‘This maintenance programme is the alternative means of compliance with MPD 2001-001 as agreed with the CAA for Avon engines operated and maintained by [previous maintenance organisation]. Any deviation to this programme is to be submitted to the CAA for approval’

188 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis CAA document, CAP 562, ‘Civil Aircraft Airworthiness Information and Procedures’ – Book 1, leaflet C-30 states: ‘A CAA Approval once granted is not transferable from one registered company to another.’ The current maintenance organisation did not have access to the previously approved AMOC to the MPD and did not know the full scope or limitations of the approval. Its inspection program had been based on historic technical log entries annotated with “MPD 2001-001”. CAA Airworthiness Division Technical Procedure TP-CAW-18 describes the process for approval of an AMOC. If an applicant can show compliance with a suitable existing AMOC the CAA will issue the applicant with a letter of acceptance, which will be recorded by the CAA. There was no evidence to show that this process had been followed, and on 21 April 2016, the CAA stated: ‘The CAA did not issue a separate AMOC approval for MPD 2001‑001 to [the aircraft operator] or [the current maintenance organisation].’ The engine installed in G-BXFI had exceeded the maximum 15 years since its last overhaul. Neither the operator nor the current maintenance organisation had an approved AMOC to MPD 2001-001, and the aircraft was not compliant with the MPD. Therefore it did not appear to meet the requirements of its Permit to Fly under Article 22 of the ANO 2009. 2.5.3 Ejection seats 2.5.3.1 Initiation of ejection sequence The cockpit canopy separated from the aircraft shortly after the aircraft struck the road. Photographic evidence indicated that the ejection seat did not leave the aircraft at this point. There was no evidence from the wreckage examination or the in-cockpit video recording, to indicate that the pilot had attempted to eject or manually jettison the canopy. The investigation concluded that the ejection sequence was initiated by the mechanical damage resulting from the substantial disruption to the cockpit and seat structure. Disruption of the bottom fitting prevented normal pressurisation of the ejection gun and initiation of the secondary cartridges. The seat therefore did not have sufficient thrust to clear the aircraft in a controlled manner.

189 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis Although only a partial ejection sequence occurred, the seat movement was sufficient to initiate the mechanically-activated aspects of the ejection sequence. This resulted in the deployment of the drogue system and the release of the pilot from the seat. The pilot and his seat were thrown clear of the cockpit while it was still moving, probably by a combination of thrust from the primary cartridge, impact dynamics and the drogues becoming tangled in trees. The seat came to rest on the ground and the cockpit subsequently overran it. Had the pilot remained attached to his seat it is likely that his injuries would have been more severe. 2.5.3.2 Ejection seat maintenance There was no evidence that the expired ejection seat cartridges contributed to the initiation of the ejection seat during the impact. However, the investigation made findings about ejection seat maintenance that may be relevant to all civil‑operated ex-military aircraft equipped with ejection seats. The maintenance organisation’s decision to extend the installed and total life of the ejection seat cartridges on G-BXFI was not consistent with cartridge lives specified by the seat manufacturer, the published guidance in CAP 632, or the mandatory requirements of the aircraft’s AAN. The two-year installed life of the cartridges had been substantially exceeded already by the time the maintenance organisation assumed responsibility for the aircraft, indicating that the use of time-expired cartridges is not unique to one organisation. The maintenance organisation was aware of the cartridge expiry dates but had adopted an informal and undocumented policy of increasing the installed cartridge life to six years. It had not sought formal approval from the CAA to do so and had not followed its own documented procedure with regard to concession control. The cartridges were first installed in G-BXFI in December 2008 so, at the time of the accident, the two-year installed cartridge life specified by the manufacturer had been exceeded by more than 4½ years and the six-year total life had been exceeded by more than a year. The maintenance organisation’s own (unapproved) six-year installation life had also been exceeded by more than one year. Therefore, it appeared that the ejection seats installed in G-BXFI did not meet the definition of ‘fully serviceable’ given in CAP 632 paragraph 5.9, nor the requirements of AAN No. 26172 or the Hunter T7 Master Servicing Schedule, and had not done since December 2010. The maintenance organisation extended the installed and total life of the cartridges based on its assumptions about aircraft utilisation, operating

190 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis conditions and storage environment but did so with little knowledge of the operating and storage environment of the cartridges prior to becoming responsible for the aircraft in August 2012. It considered the extension of the manufacturer’s life limit to be within the privileges granted by its A8-20 maintenance approval. The ejection seat manufacturer advised that time-expired cartridges can increase the risk of an un-commanded ejection and uncontrolled explosion of the cartridges, or reduce the likelihood of a successful ejection, both of which present a hazard to uninvolved third parties as well as those involved in the operation of the aircraft. In November 2013 the ejection seat manufacturer informed the CAA of its concerns regarding the use of live ejection seats in civil-operated ex-military aircraft, with specific reference to the use of time-expired cartridges by civilian operators. The CAA response indicated its expectation that these concerns were already adequately addressed by existing guidance, practices and maintenance approvals. The CAA also indicated that it expected operators to adhere to cartridge lives (total and installed) specified by the seat manufacturer and stated that unapproved extension of ejection seat cartridge lives would be considered a ‘serious breach’ that could jeopardise an organisation’s maintenance approval. Initially the CAA informed the investigation that its written approval was required to authorise any short-term extension of ejection seat cartridge lives, based on technical justification and proof that new cartridges had been ordered. The AAIB informed the CAA that the cartridges installed on G-BXFI were time-expired. After consulting with the maintenance organisation, the CAA informed the AAIB that it was satisfied retrospectively with the decision made by the maintenance organisation to extend the installed life of the cartridges on G-BXFI, despite the absence of a prior CAA approval, a formally documented policy or a technical justification. The CAA based its assertion on the fact that a statement in the organisation’s CAA-approved Exposition, not specific to ejection seats, permitted variations to component lives subject to mandatory requirements or ultimate lives not being exceeded in the extension period. The manufacturer published recommended cartridge lives in a document intended for use by original military operators. The Hunter T7 Master Servicing Schedule, on which G-BXFI’s maintenance programme was based, adopted these lives as ultimate lives. All published and internal CAA guidance on ejection seat cartridge lives, including the limitations in G-BXFI’s AAN, indicated that the manufacturer’s cartridge lives were to be considered a requirement. This position was reiterated in the CAA’s correspondence with Martin-Baker.

191 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis Interpretation of this issue therefore depends on whether the manufacturer’s cartridge life limits are considered a recommendation, or if adoption in the Hunter T7 Master Servicing Schedule, the aircraft’s AAN, and guidance in CAP 632 mean they cannot be extended. In the absence of a definitive position, both the existing published CAA guidance on ejection seat cartridge lives, and internal CAA guidance5, is being applied inconsistently by operators, maintenance organisations and the regulator. The ejection seat manufacturer’s decision in February 2015 to cease the provision of technical support and replacement parts for historic ejection seats may adversely affect the ability of operators and maintenance organisations of aircraft equipped with them to comply with the published cartridge lives in the future. As a result, the manufacturer considers that such ejection seats should be deactivated to prevent the risk of inadvertent operation. Conversely, CAP 632 requires ejection seats in sweptwing aircraft to be fully operational and armed for flight.

Ejection seats provide a means of escape from ex-military jet aircraft whose performance makes a safe forced landing unlikely. However, charged systems such as ejection seats present a hazard to operational and maintenance personnel and to first responders in the event of an accident. It may appear that a decision to continue to operate with time-expired ejection seat cartridges simply hazards the crew who may accept this additional risk, but time‑expired cartridges may become unstable and detonate causing the pilot to be randomly ejected from an otherwise serviceable aircraft. This would result in the uncontrolled loss of the aircraft and hazard uninvolved third parties on the ground. The service and maintenance of ejection seats is a specialist task, but there is no specific CAA maintenance approval for individuals or organisations who perform this task. In requiring civilian-operated ex-military aircraft to be equipped with live ejection seats, the CAA should consider the benefits of having a means of aircrew escape against the inherent risks presented by such systems. Accordingly, the AAIB made Safety Recommendation 2015-042 (see Section 4.2), which was accepted by the CAA. 5 CAA Airworthiness Division Technical Procedure (TP)-DAW-23-2 ‘Ex Military Aircraft on a Permit to Fly’ dated 4 July 2012

192 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis 2.5.4 Summary of airworthiness findings The investigation found that G-BXFI was not in compliance with relevant airworthiness requirements. The aircraft engine fuel system had not been inhibited as required by the approved maintenance schedule during periods of inactivity, the engine had exceeded its calendar life without an approved AMOC to MPD 2001-001, and the ejection seat cartridges had exceeded the life limits specified by the ejection seat manufacturer and in the aircraft’s AAN. While in operation, limitations were exceeded and not reported, and defects were not recorded. Nevertheless, and despite CAA oversight during the relevant period, a Permit to Fly – Certificate of Validity had been issued on more than one occasion. In order to provide greater confidence in the airworthiness status of ex-military jet aircraft in the future the AAIB made the following Safety Recommendation in Special Bulletin S4-2015: Safety Recommendation 2015-047 It is recommended that the Civil Aviation Authority review its procedures to ensure that a ‘Permit to Fly Certificate of Validity’ is valid when it is issued. The CAA responded as follows in FACTOR F1/2016, published on 8 April 2016: ‘The CAA does not accept this recommendation. The procedure to ensure that a ‘Permit to Fly-Certificate of Validity’ is valid when issued sits with the approved organisation as set out below. Where a Certificate of Validity is recommended by such an organisation for issue by the CAA, the CAA conducts a quality check to verify the technical and editorial content of the Certificate in accordance with the supporting information provided by the applicant. An organisation approved by the CAA to conduct an airworthiness review on such aircraft is granted the privilege, under its approval, to declare to the CAA that a particular aircraft complies with the requirements of BCAR Section A Chapter A3-7, which includes completing a physical survey of the aircraft and a documented review of its records to determine its airworthiness status. The CAA, under the current oversight regime, is not required to validate the work carried out under this approval before a Certificate of Validity is issued.

193 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis An organisation’s compliance with these requirements, including the adequacy of declarations, is audited as part of CAA’s continued surveillance activity. The current process is consistent with that in place for both National and EASA aircraft operating under a Certificate of Airworthiness.’ The AAIB categorised the response to Safety Recommendation 2015-047 as ‘Not adequate – open’. The CAA updated its response to Safety Recommendation 2015-047 in FACTOR F1/2016 Issue 2, stating: ‘Responsibility for ensuring that a ‘Permit to Fly-Certificate of Validity’ is valid when issued sits with the approved maintenance organisation and not the CAA. An organisation approved by the CAA to conduct an airworthiness review on such aircraft is granted the privilege, under its approval, to declare to the CAA that a particular aircraft complies with the requirements of BCAR Section A Chapter A3-7, which includes completing a physical survey of the aircraft and a documented review of its records to determine its airworthiness status. The CAA is not required to validate the work carried out under this approval before a Certificate of Validity is issued. Instead, an organisation’s compliance with these requirements, including the adequacy of declarations, is audited as part of CAA’s continued oversight activity. Therefore, in order to deliver the intent of this safety recommendation, the CAA will review both the design and implementation of its oversight activity in respect of approved maintenance organisations and the process by which documents such as Permit to Fly Certificates of Validity are issued by approved organisations. By April 2018, the CAA will conclude this review, and, should any changes be necessary, identify the date by which they will be implemented.’ The AAIB re-categorised the response to Safety Recommendation 2015-47 as ‘Adequate – closed’.

194 Analysis © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 2 - Analysis 2.6 Governance of flying display activity Following the accident to G-BXFI the CAA conducted a review of UK civil air displays and determined 29 actions that it has taken or intends to take. Its review was not an investigation of the accident at Shoreham but several of its actions are relevant to it. The AAIB investigation has identified shortcomings in the conduct and oversight of flying displays in the UK in the areas of operation, risk management and maintenance. It revealed areas of flying display activity in which a culture of safety is not well established and a lack of clarity about who owns the associated risks. The extent of these shortcomings indicates that a more fundamental review of the governance of flying display activity is required. The AAIB recognises that the CAA GAU is unlikely to have sufficient resources to conduct such a review itself while meeting its ongoing regulatory responsibilities, and that it may be conflicted in doing so. Accordingly, the following Safety Recommendation is made: Safety Recommendation 2017-011 It is recommended that the Department for Transport commission, and report the findings of, an independent review of the governance of flying display activity in the United Kingdom, to determine the form of governance that achieves the level of safety it requires.

195 Conclusions Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 3 - Conclusions 3 Conclusions (a) Findings Operational aspects

The pilot was licensed and authorised in accordance with the requirements existing at the time of the accident to operate the Hawker Hunter at flying displays.

It was the pilot’s fifth aerobatic display in a Hunter during the 2015 season and the only public display he carried out that day. He met the recency requirements specified in CAP 403.

The accident occurred during a manoeuvre involving pitching and rolling components, intended to be a ‘bent loop’, at the apex of which the aircraft was inverted.

Flight trials indicated that the apex height for a looping manoeuvre with a 90° track change on the upward vertical was 300 to 400 ft less than for a straight loop with all other parameters constant.

The accident manoeuvre started and finished outside the aerodrome boundary, over an area not controlled by the organisers of the flying display.

A general permission granted by the CAA provided an exemption from the Standardised European Rules of the Air, permitting flight below 500 feet up to 1 km from the display gathering.

The pilot’s display authorisation for the Hunter stipulated a minimum height for executing aerobatics of 500 ft.

The manoeuvre started approximately 900 m from the display line at a height of 185 ±25ft agl.

The pilot’s declared minimum entry speed for the manoeuvre was 350 KIAS. The aircraft entered the manoeuvre at approximately 310 KIAS.

Engine speed varied during the upward first half of the manoeuvre. This was contrary to the pilot’s declared technique of using full thrust.

The manoeuvre could have been abandoned during its upward first half if an un-commanded reduction in thrust had occurred and been detected. 196 Conclusions Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 3 - Conclusions

There was no evidence of a pre-existing mechanical defect that would have prevented the engine from responding to pilot throttle inputs. However, the fuel pump governor diaphragm showed significant signs of ageing and chemical attack such that it could no longer be considered airworthy.

Information included in a previous AAIB report (EW/C98/6/1) indicated that there had been a number of cases involving the Avon Mk 122 engine where engine speed had dropped and subsequent engineering investigation had not established a clear cause. Therefore, an uncommanded reduction in thrust during the accident manoeuvre could not be ruled out.

In tests, the left altimeter under-read by approximately 100 feet. It also exhibited lag and stickiness in its operation both during testing and on a previous flight. Overall, these defects would have resulted in the altitude indicated to the pilot being lower than the actual aircraft altitude at the apex of the accident manoeuvre.

The right altimeter had a latent defect which meant it was no longer providing a synchronising signal to the left altimeter.

No other technical defects were identified that were relevant to the accident.

The minimum height loss during the downward half of a looping manoeuvre in the Hawker Hunter is between 2,600 and 2,950 feet (including 100 ft for instrument reading error), when flown at the values of aircraft mass and density altitude relevant to the accident.

The pilot stated that he required a minimum height of 3,500 ft at the apex of the manoeuvre to ensure that he completed it 500 ft or more above the ground (as required by his display authorisation).

The aircraft achieved an apex height of approximately 2,700 ft.

The airspeed at the apex of the accident manoeuvre was 105±2 KIAS, which was at the lower end of the pilot’s declared airspeed range of 100 to 150 KIAS.

The aircraft was lower than required at the apex because it entered the manoeuvre below the target airspeed, because less than maximum thrust was applied during its upward half, and because any rolling element initiated before the aircraft reached the upward vertical would have further reduced apex height.

197 Conclusions Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 3 - Conclusions

The entry height of the manoeuvre was consistent with the 200ft minimum height on the pilot’s DA for a Jet Provost; the apex height and speeds on the accident manoeuvre were consistent with those flown in the Jet Provost the previous weekend.

The pilot stated that he would abandon a ‘bent loop’ manoeuvre if the minimum entry speed, or the minimum gate height at the apex, were not achieved. He did not abandon the accident manoeuvre when these minimums were not achieved.

It is possible that the pilot misread or misinterpreted speed and height indications during the manoeuvre, or recalled those for a different aircraft type.

The pilot had not previously rolled the Hawker Hunter at the low airspeed encountered at the apex, and was not sure that a roll could be achieved at that speed.

Flying an escape manoeuvre is not the same as flying planned manoeuvres such as a half Cuban 8.

Flight trials indicated that a rolling escape manoeuvre was possible up to four seconds after the aircraft passed the apex of the accident manoeuvre.

The pilot had not practised flying escape manoeuvres in the Hunter.

The operator’s Operational Control Manual did not contain information about performing aerobatic manoeuvres and associated escape manoeuvres.

The previous two renewals of the pilot’s display authorisation were not performed on the Hawker Hunter.

The g experienced by the pilot during the manoeuvre was probably not a factor in the accident.

The aircraft struck the carriageway of the A27, Shoreham Bypass, in a wings level, nose-high attitude at a speed of approximately 225 kt.

The aircraft collided with bystanders, road users and vehicles at the junction of the A27 and Old Shoreham Road, in an area outside the control of the flying display organisers. Eleven people were fatally injured and 13 others, including the pilot, were injured as a result of the accident.

198 Conclusions Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 3 - Conclusions Organisation of the flying display

The organiser of the flying display had obtained the permission of the CAA required by Article 162 of the Air Navigation Order (ANO).

The CAA, pursuant to Article 162, had permitted the Flying Display Director (FDD) to act as the FDD for the 2015 Shoreham Airshow, having assessed him as ‘fit and competent’, but had no written policy or procedure for making that determination.

The FDD believed that the risk assessment for the flying display was compliant with CAP 403. However, the risk assessment was not suitable and sufficient to manage the risks to the public.

The risk assessment did not consider which aircraft would be displaying, where they would operate and to whom they would present a hazard.

The FDD did not know the intended sequence of manoeuvres to be flown by the accident pilot, and the edition of CAP 403 in force at the time did not indicate that he should.

The risk assessment and risk management guidance provided to display organisers in CAP 403 requires improvement.

The risk assessment relied upon compliance with Rule 5 of the Rules of the Air (that no aircraft should fly closer than 500 ft to any person, vehicle, vessel or structure) to mitigate the hazard presented by aircraft displaying over areas outside the control of the organisers.

The FDD was not aware that, under a permission granted by the CAA, the aircraft was exempt from this rule when within 1,000 metres of a gathering of persons assembled to witness the event.

The CAA did not require to see or approve risk assessments before issuing a permission to hold a flying display in accordance with Article 162 of the ANO.

The CAA recommended in CAP 632 that operators of Permit to Fly ex- military aircraft adopt a safety management system (SMS). It did not require them to have one.

The operator of the aircraft did not have an SMS or a documented alternative.

199 Conclusions Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 3 - Conclusions

The General Aviation Unit of the CAA did not have an SMS.

The planned display of G-BXFI at the 2015 Shoreham Airshow was similar to that in 2014, in which the location of the aircraft’s manoeuvres did not comply with its Permit to Fly.

The operator did not have a process to ensure that the manner in which the aircraft was operated during flying displays would comply with the conditions of its Permit to Fly.

The CAA did not require persons outside the area controlled by the organisers of the flying display to be protected from the hazards associated with it.

The CAA granted the organisers of the 2015 Shoreham Airshow permission to hold a flying display. However, the CAA considers that the principle reason for rejecting an application is safety, and that the proximity of congested areas and heavily used major roads must be taken into account in determining the viability of the site of a flying display. The A27 is a heavily used major road, carrying approximately 58,500 vehicles per day.

The organisers of the 2015 Shoreham Airshow recognised that the junction of the A27 with the Old Shoreham Road was a popular gathering point for secondary crowds.

Measures taken by the organisers probably reduced the size of the crowd that gathered at the A27 junction, however, there were a number of people standing at the junction of the A27 and Old Shoreham Road during the flying display.

Approximately 40% of the land area within 2 km of Shoreham Airport meets the definition of a ‘congested area’ given in the ANO.

The Flying Control Committee had no means of accurately determining the height and speed of displaying aircraft and had to rely on its judgement and experience to monitor their performance.

The rescue and firefighting resources in place responded promptly to the accident.

The CAA had no means of determining the safety of flying displays other than by attending them. It attended 7% of the flying displays it approved in 2015 and 2.8% of those it approved in 2014.

200 Conclusions Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 3 - Conclusions

The CAA had not established an acceptable level of safety performance for display flying. Engineering aspects Matters related to the accident sequence

The pilot did not command an ejection.

The aircraft was probably outside the operational envelope of the ejection system during the downward portion of the accident manoeuvre.

Activation of the canopy jettison system and the ejection seat was initiated by damage to the cockpit and seat structure sustained during impact.

The ejection sequence did not complete due to damage sustained to the ejection seat gun during the impact.

The pilot and ejection seat were released from the cockpit during the later stages of the impact sequence and the ejection seat automated release features acted to release the pilot from the seat before it came to rest.

Some pyrotechnic cartridges in each of the ejection seats remained live after the aircraft came to rest.

Information about the dangers of the ejection seats and other hazards associated with G-BXFI was not available to the organisers of the flying display and therefore could not be passed on to the first responders. Maintenance and airworthiness

The ejection seat manufacturer’s recommended installed cartridge life was two years with a maximum total (shelf) life of six years. This recommendation was included as a limitation in the aircraft’s AAN, which formed the basis for its certification. The maintenance organisation had adopted a six-year installation life for ejection seat cartridges. This extension to the installed life had not been documented in accordance with the maintenance organisation’s procedures, nor had it been approved by the CAA.

At the time of the accident, the two-year installed cartridge life had been exceeded by more than 4½ years and the six-year total life had been exceeded by more than a year. 201 Conclusions Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 3 - Conclusions

The CAA was not aware of the extension to the ejection seat cartridge lives.

The CAA did not have a documented procedure for approving extensions to ejection seat cartridge lives but stated that applications for extensions would be considered on a case-by-case basis, and would only be granted for a short period upon proof that new cartridges were on order.

The maintenance organisation had new cartridges available, which had not been fitted to the ejection seats in the aircraft.

CAP 632 requires the pilot escape systems of swept-wing jet aircraft, such as the Hawker Hunter, to be ‘fully serviceable’. The use of time- expired ejection seat cartridges meant that the ejection seats fitted to G-BXFI did not meet this requirement.

The practice of using time-expired ejection seat cartridges in civil-operated ex-military aircraft was not confined to G-BXFI or its maintenance organisation.

The engine fitted to G-BXFI was not preserved during periods of inactivity as required by the aircraft’s approved maintenance program.

Neither the operator nor the maintenance organisation had an approved Alternative Means of Compliance with the Mandatory Permit Directive related to engine life (MPD 2001-001).

The maintenance organisation did not have access to the previous operator’s AMOC. It based scheduled maintenance tasks on entries in the aircraft maintenance records associated with MPD 2001-001.

The maintenance organisation submitted a proposal for an AMOC to MPD 2001-001 to the CAA which in turn requested this be resubmitted to include additional tasks detailed in CAP 562 Leaflet 70-80. However, no further application to the CAA was made by the maintenance organisation.

The serial number of the right altimeter did not match that recorded in the technical records.

Engine rpm exceedences occurring during a test flight in 2011 were not reported or investigated.

202 Conclusions Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 3 - Conclusions

There was no formal or documented monitoring of engine performance, either during engine ground runs or in flight, which would enable engine performance deterioration to be identified.

Video evidence showed that the g-meter fitted to the aircraft was defective during the accident flight and in September 2014. No related defects had been reported or recorded, and the maintenance organisation stated that it was not aware of any.

The AAN and Permit to Fly required the fatigue state of the aircraft to be recorded after each day’s flight. The maintenance organisation read and recorded the fatigue state once each year; between these readings, monitoring of high fatigue inducing events relied on the pilots reporting high loads seen on the g-meter.

The aircraft was being operated with the aileron trim position indicator inoperative.

The aircraft had been operated with the flaps extended at speeds exceeding the limit for doing so. This had not been reported in the aircraft technical log.

The maintenance organisation issued a Certificate of Validity to the Permit to Fly. At the time of the accident the aircraft did not meet airworthiness requirements or the conditions of its Permit to Fly.

CAA oversight of the maintenance organisation and the operator did not identify the deficiencies with the aircraft’s airworthiness.

The maintenance organisation did not have an established safety management system and was not required to have one.

The diaphragm of the fuel pump governor had degraded due to the combined effects of age and chemical attack. The engine manufacturer concluded that it would not have prevented the engine from operating normally but considered that it had exceeded its known predictable functional capability and its continued integrity would be severely affected.

MPD 2001-001 was published to mitigate the effects of ageing on the Rolls-Royce Avon series of engines, including the engine fuel systems.

203 Conclusions Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Section 3 - Conclusions

The AMOC approved for a previous operator of the aircraft did not include routine inspections of the condition of engine fuel systems. This inspection regime, continued by the current maintenance organisation, did not identify the degradation of the fuel pump governor diaphragm.

The aircraft was fitted with underwing drop tanks made from phenolic asbestos. This hazard had not been identified. (b) Causal factors • The aircraft did not achieve sufficient height at the apex of the accident manoeuvre to complete it before impacting the ground, because the combination of low entry speed and low engine thrust in the upward half of the manoeuvre was insufficient. • An escape manoeuvre was not carried out, despite the aircraft not achieving the required minimum apex height. (c) Contributory factors • The pilot either did not perceive that an escape manoeuvre was necessary, or did not realise that one was possible at the speed achieved at the apex of the manoeuvre. • The pilot had not received formal training to escape from the accident manoeuvre in a Hunter and had not had his competence to do so assessed. • The pilot had not practised the technique for escaping from the accident manoeuvre in a Hunter, and did not know the minimum speed from which an escape manoeuvre could be carried out successfully. • A change of ground track during the manoeuvre positioned the aircraft further east than planned producing an exit track along the A27 dual carriageway. • The manoeuvre took place above an area occupied by the public over which the organisers of the flying display had no control. • The severity of the outcome was due to the absence of provisions to mitigate the effects of an aircraft crashing in an area outside the control of the organisers of the flying display.

Intentionally left blank

205 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations 4 Safety Recommendations The following Safety Recommendations were made in Special Bulletin S4/2015 on 21 December 2015. The CAA responded to each in FACTOR F1/2016, published on 8 April 2016. 4.1 Safety Recommendation 2015-041: It is recommended that the Civil Aviation Authority require operators of ex-military aircraft fitted with ejection seats or other pyrotechnic devices operating in the United Kingdom, to ensure that hazard information is readily available which includes contact details of a competent organisation or person able to make the devices safe following an accident. The CAA responded as follows: ‘The CAA accepts this recommendation. To ensure that hazard information is readily available for aircraft participating in flying displays, the CAA will amend the certificate supplied to the Flight Display Director by a pilot participating in a flying display to identify the pyrotechnic devices fitted to the aircraft and the contact details of a competent organisation or person able to make the devices safe (or advise on doing so) following an accident. The revised form will be published before the end of April 2016 as part of an amendment to CAP 403. The CAA is currently reviewing how best to ensure that the same information is readily available for aircraft not participating in flying displays. This review will be completed before the end of June 2016.’ The AAIB has categorised the response to this Safety Recommendation as ‘Adequate – closed’. 4.2 Safety Recommendation 2015-042: It is recommended that the Civil Aviation Authority review the guidance in CAP 632 with respect to ejection seats and the means by which operators of ex-military aircraft equipped with them comply with this guidance. This review should include: ● ● The benefits and hazards of aircrew escape systems in civilian-operated aircraft ● ● The use of time-expired components ● ● The availability of approved spares ● ● The seat manufacturer’s guidance on deactivating its historic products ● ● Adoption of a dedicated Maintenance Approval for persons or organisations competent to perform ejection seat maintenance.

206 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations The CAA responded as follows: ‘The CAA accepts this recommendation and is undertaking a review of ejection seat safety as part of the Air Display Review. This review includes consideration of each of the specific points highlighted by this recommendation and will be completed before the end of December 2016.’ The AAIB has categorised the response to this Safety Recommendation as ‘Adequate – closed’. 4.3 Safety Recommendation 2015-43: It is recommended that the Civil Aviation Authority establish a process for the effective dissemination of ex-military jet aircraft experience and type-specific knowledge to individual maintenance organisations. The CAA responded as follows: ‘The CAA accepts this recommendation. By December 2016, the CAA will establish and promote a process for the more effective dissemination of ex-military jet aircraft experience and type-specific knowledge between individual maintenance organisations.’ The AAIB has categorised the response to Safety Recommendation 2015-043 as ‘Adequate – closed’. 4.4 Safety Recommendation 2015-44: It is recommended that the Civil Aviation Authority define a minimum amendment standard for the technical publications for each ex-military jet aircraft type operated on the United Kingdom civil register. Following the publication of FACTOR F1/2016 Issue 2 the CAA’s response is as follows: ‘Working in conjunction with industry, the CAA will establish a minimum amendment standard for the technical publications for each individual ex-military jet aircraft operated on the UK civil register. The established standard will be recorded in the Airworthiness Approval Note (AAN) for each aircraft. The CAA will complete this work by December 2018.’ The AAIB has categorised the CAA response to Safety Recommendation 2015‑44 as ‘Adequate – closed’.

207 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations 4.5 Safety Recommendation 2015-45: It is recommended that the Civil Aviation Authority require that an ex-military jet aircraft’s maintenance programme be transferred with the aircraft when it moves to another maintenance organisation to ensure continuity of the aircraft’s maintenance. Following the publication of FACTOR F1/2016 Issue 2, the CAA’s response is as follows: ‘The CAA is developing a proposal for consultation with industry to introduce a new requirement into BCAR Section A to require a maintenance programme to be transferred with an ex-military jet aircraft if it moves to a new maintenance/continuing airworthiness management organisation, or new owner/operator. Subject to the outcome of the process of industry consultation, the CAA intends to implement this requirement by April 2018.’ The AAIB has categorised the response to Safety Recommendation 2015-45 as ‘Adequate – closed’. 4.6 Safety Recommendation 2015-046: It is recommended that the Civil Aviation Authority review the effectiveness of all approved Alternative Means of Compliance to Mandatory Permit Directive 2001-001. Following the publication of FACTOR F1/2016 Issue 2, the CAA’s response is as follows: ‘The CAA will require ex-military jet aircraft maintenance organisations and/or continuing airworthiness management organisations to conduct a review of their approved Alternative Means Of Compliance (AMOC) to MPD2001-001. Following such a review, each of these affected organisations must make application for a new AMOC in accordance with a new MPD to be issued which will supersede MPD2001-001.

The review process will be completed by April 2018.’ The AAIB has categorised the response to Safety Recommendation 2015-46 as ‘Adequate – closed’.

208 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations 4.7 Safety Recommendation 2015-047: It is recommended that the Civil Aviation Authority review its procedures to ensure that a ‘Permit to Fly-Certificate of Validity’ is valid when it is issued. Following the publication of FACTOR F1/2016 Issue 2, the CAA’s response is as follows: ‘Responsibility for ensuring that a ‘Permit to Fly-Certificate of Validity’ is valid when issued sits with the approved maintenance organisation and not the CAA. An organisation approved by the CAA to conduct an airworthiness review on such aircraft is granted the privilege, under its approval, to declare to the CAA that a particular aircraft complies with the requirements of BCAR Section A Chapter A3-7, which includes completing a physical survey of the aircraft and a documented review of its records to determine its airworthiness status. The CAA is not required to validate the work carried out under this approval before a Certificate of Validity is issued. Instead, an organisation’s compliance with these requirements, including the adequacy of declarations, is audited as part of CAA’s continued oversight activity. Therefore, in order to deliver the intent of this safety recommendation, the CAA will review both the design and implementation of its oversight activity in respect of approved maintenance organisations and the process by which documents such as Permit to Fly Certificates of Validity are issued by approved organisations. By April 2018, the CAA will conclude this review, and, should any changes be necessary, identify the date by which they will be implemented.’ The AAIB has categorised the response to Safety Recommendation 2015-47 as ‘Adequate – closed’.

209 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations The following Safety Recommendations were issued in Special Bulletin S1/2016 on 10 March 2016. The CAA responded to each in FACTOR F4/2016, published on 9 June 2016. 4.8 Safety Recommendation 2016-031: It is recommended that the Civil Aviation Authority review and publish guidance that is suitable and sufficient to enable the organisers of flying displays to manage the associated risks, including the conduct of risk assessments. Following the publication of FACTOR F4/2016 Issue 2 the CAA’s response is as follows: ‘The CAA will review the findings contained in the HSL reports on the management of risk, in conjunction with the conclusions of its post-implementation review of UK Civil Air Displays. The CAA will complete this review and publish any updated guidance by April 2017.' The AAIB has categorised the response to Safety Recommendation 2016-31 as ‘Adequate – closed’. 4.9 Safety Recommendation 2016-032: It is recommended that the Civil Aviation Authority specify the safety management and other competencies that the organiser of a flying display must demonstrate before obtaining a Permission under Article 162 of the Air Navigation Order. In FACTOR F4/2016, published on 9 June 2016 the CAA made the following response to Safety Recommendation 2016-032: ‘The CAA accepts this recommendation. The CAA will specify the safety management and other competencies that the organiser of a flying display must demonstrate before obtaining a Permission under Article 162 of the Air Navigation Order. This will be completed by the end of March 2017.’ The AAIB has categorised the response to Safety Recommendation 2016-31 as ‘Adequate – closed’.

210 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations 4.10 Safety Recommendation 2016-033: It is recommended that the Civil Aviation Authority introduces a process to ensure that the organisers of flying displays have conducted suitable and sufficient risk assessments before a Permission to hold such a display is granted under Article 162 of the Air Navigation Order. The CAA responded in FACTOR F4/2016 as follows: ‘The CAA accepts this recommendation that organisers of flying displays must conduct suitable and sufficient risk assessments.

It remains the responsibility of organisers of flying displays to conduct suitable and sufficient risk assessments. The CAA has introduced a new risk assessment process for display applications together with a new risk assessment template and a revised display application form. These are designed to make it clearer to organisers of flying displays the nature of the risk assessment that must be completed. The revised process was published alongside the guidance ‘Flying displays and special events: A guide to safety and administrative arrangements’ in March 2016.’ Following the publication of FACTOR F4/2016 Issue 2 the CAA’s response to the Safety Recommendation is as follows: The CAA has already introduced enhanced risk assessment guidance to assist event organisers when conducting such risk assessments. The CAA cannot carry out its own risk assessments in respect of every application for a display (and so cannot “ensure” that suitable and sufficient risk assessments have been carried out) and has introduced a process so that, when considering an application for a Permission to hold a display under Article 86 of the Air Navigation Order 2016 (previously Article 162 of the Air Navigation Order 2009), the CAA considers whether the application aligns with the CAA’s guidance. The CAA intends also to review the findings of the HSL reports in conjunction with the conclusions of the CAA’s own post‑implementation review of UK Civil Air Displays in order to consider whether any updated guidance on the management of risk is necessary (see FACTOR response to Safety Recommendation 2016-031 above). The CAA will clarify the responsibilities of organisers / FDDs in this respect during this review and complete and publish any updated guidance by April 2017.

211 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations For the 2017/2018 seasons the CAA will review each risk assessment submitted with an application for a display against the specified criteria notified in CAP 403. Where those criteria are not met, the CAA will request further information from the applicant or, where necessary, not grant a permission for that display.’ The AAIB has categorised the response to Safety Recommendation 2016-31 as ‘Adequate – closed’. 4.11 Safety Recommendation 2016-034: It is recommended that the Civil Aviation Authority specify the information that the commander of an aircraft intending to participate in a flying display must provide the organiser, including the sequence of manoeuvres and the ground area over which the pilot intends to perform them, and require that this is done in sufficient time to enable the organiser to conduct and document an effective risk assessment. The CAA responded in FACTOR F4/2016 as follows: ‘The CAA understands the intent here is to define the area of ground over which the commander of an aircraft will be permitted to display that aircraft. This can be done in a number of ways. The CAA does not accept that it should specify information in the manner set out in the recommendation. The CAA has concluded that the FDD’s risk assessment should be informed by and take account of both the manoeuvres to be flown and the area of ground over which they will be flown. The CAA now requires pilots to confirm to the FDD well in advance of the display briefing that their air display conforms to the air display permission granted by the CAA. If the series of linked manoeuvres or the area of ground over which the aircraft will fly is outside the areas already risk assessed by the FDD, the FDD will be able to take this into account in their risk assessment and document it accordingly. It remains the responsibility of the organisers of flying displays to follow this guidance and conduct risk assessments that are suitable and sufficient to manage the risks associated with the air displays that they are organising.’ Following the publication of FACTOR F4/2016 Issue 2 the CAA’s response to the Safety Recommendation is as follows: ‘The risk assessment conducted by the FDD is required to be informed by and take account of both the manoeuvres intended to be flown and the area of ground over which they will be flown.

212 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations The CAA has amended CAP 403 Appendix B “Certificate to be supplied to the event organiser by a pilot participating in a flying display”, to specify the information that the commander of the aircraft intending to participate in a flying display must provide to an organiser in advance of a display, including the manoeuvres intended to be flown. Appendix B must be supplied in sufficient time to enable the event organiser to conduct a risk assessment for the display. The risk assessment (to be submitted with the application for a Permission) must also take account of the ground area over which the display will be performed, which in turn will enable the CAA to specify the boundaries of a flying display within which any permission applies. The CAA has introduced a requirement, in CAP 403 for any pilot intending to fly aerobatic manoeuvres to notify the FDD of the series of the linked manoeuvres that they intend to perform at least one day prior to a display. If the information is not provided, the FDD must not allow the pilot to fly in the display. This information, together with the prior notification of a defined area within which the permission applies, will support the implementation of an effective risk assessment. CAP 403 was amended in June 2016.Completed.’ The AAIB has categorised the response to Safety Recommendation 2016-31 as ‘Partially adequate – closed’. 4.12 Safety Recommendation 2016-035: It is recommended that the Civil Aviation Authority require operators of Permit to Fly aircraft participating in a flying display to confirm to the organiser of that flying display that the intended sequence of manoeuvres complies with the conditions placed on their aircraft’s Permit to Fly. The CAA responded as follows: ‘The CAA accepts this recommendation. The CAA now requires operators of Permit to Fly aircraft participating in a flying display to confirm to the organiser of that flying display that the intended sequence of manoeuvres complies with the conditions placed on their aircraft’s Permit to Fly. As set out in the March 2016 edition of the CAA’s guidance “Flying displays and special events: A guide to safety and administrative arrangements”, all pilots participating in a flying display must

213 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations supply the FDD of the air display with a certificate confirming that the display that they intend to perform complies with the conditions placed on the aircraft’s Certificate of Airworthiness and Permit to Fly. A template for the certificate is at Appendix B of the guidance.’ The AAIB has categorised the response to Safety Recommendation 2016-035 as ‘Adequate – closed’. 4.13 Safety Recommendation 2016-036: It is recommended that the Civil Aviation Authority remove the general exemptions to flight at minimum heights issued for Flying Displays, Air Races and Contests outlined in Official Record Series 4-1124 and specify the boundaries of a flying display within which any Permission applies. Following the publication of FACTOR F4/2016 Issue 2 the CAA’s response is as follows: ‘ The CAA has removed the general exemption to flight at minimum heights issued for civil air displays, air races and contests, outlined in Official Record Series 4-1124. Display Permissions granted by CAA under Article 86 of the Air Navigation Order 2016 now specify the boundaries of a flying display within which the permission applies.’ The AAIB has categorised the response to Safety Recommendation 2016-036 as ‘Adequate – closed’. 4.14 Safety Recommendation 2016-037: It is recommended that the Civil Aviation Authority require that displaying aircraft are separated from the public by a sufficient distance to minimise the risk of injury to the public in the event of an accident to the displaying aircraft. The CAA responded as follows: ‘The CAA understands that this recommendation relates to members of the public attending a flying display. The CAA accepts this recommendation. The MAA has commissioned an independent study into crowd separation distances. This research is ongoing and should report in 2017. As the MAA research is ongoing, the CAA decided in its review of UK civil air displays that, as an interim measure, where

214 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations current MAA crowd separation distances are higher it would align with them. The increased distances were announced in April this year in the final report of the CAA’s Review of UK Civil Air Displays. The CAA will confirm crowd separation distances after the independent study commissioned by the MAA into crowd separation distances reports in 2017.’ The CAA subsequently updated its response to this and Safety Recommendation 2016-038 as shown below. 4.15 Safety Recommendation 2016-038: It is recommended that the Civil Aviation Authority specify the minimum separation distances between secondary crowd areas and displaying aircraft before issuing a Permission under Article 162 of the Air Navigation Order. FACTOR F4/2016, issued on 9 June 2016, recorded that the CAA did not accept this recommendation. Following discussions with the AAIB the CAA, FACTOR F4/2016 Issue 2 provided an updated, combined, response to Safety Recommendations 2016-037 and 2016-038, as follows: ‘The CAA will conduct a review, within six months of publication by the MAA of a study by Frazer-Nash, to consider whether any changes are required to the minimum distance that display aircraft are to be separated from the public (primary and secondary crowds) to effectively minimise the risk of injury to the public in the event of an accident to the displaying aircraft. In the event that this study does not deliver a clear output or is terminated, for any reason, the CAA will consider what additional work will be needed to resolve this Recommendation. Subject to the findings of the study and the outcome of the review, the CAA shall make any necessary revisions to the application process for Permissions granted under Article 86 of the Air Navigation Order 2016.’ The AAIB categorised this response as ‘Adequate – closed’.

215 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations 4.16 Safety Recommendation 2016-039: It is recommended that the Civil Aviation Authority require the organisers of flying displays to designate a volume of airspace for aerobatics and ensure that there are no non-essential personnel, or occupied structures, vehicles or vessels beneath it. The CAA responded as follows: ‘The CAA does not accept this recommendation. The CAA expects the organisers of flying displays and in collaboration with FDDs to identify and then mitigate or manage all the risks to the public arising from their air display. It is for the organiser of the display and the FDD to decide what course of action is necessary and how they will implement it. Furthermore the pilot is responsible for performing their display in accordance with the Permission granted under Article 162 of the Air Navigation Order and their own display authorisation.’ The AAIB has categorised the response to Safety Recommendation 2016-039 as ‘Superseded – closed’. 4.17 Safety Recommendation 2016-040: It is recommended that the Civil Aviation Authority require Display Authorisation Evaluators to have no conflicts of interest in relation to the candidates they evaluate. The CAA responded as follows: ‘The CAA does not accept this recommendation as it is impractical to achieve in the relatively small air display community and maintain a working display evaluation system.

The CAA believes that it is better to identify any potential conflicts of interest, such as personal or commercial connections, and manage them. In its Action Report of its Review of UK Civil Air Displays, published in January 2016, the CAA strengthened the display authorisation process by requiring, after the first two years, a pilot holding a display authorisation to be revalidated by a different DAE, selected by the CAA. The CAA believes this will reduce the risks of conflicts of interest.’ The AAIB has categorised the response to Safety Recommendation 2016-040 as ‘Partially adequate – closed’.

216 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations 4.18 Safety Recommendation 2016-041: It is recommended that the Civil Aviation Authority require a Display Authorisation to be renewed for each class or type of aircraft the holder intends to operate during the validity of that renewal. Following the publication of FACTOR F4/2016 Issue 2 the CAA’s response is as follows: ‘The CAA will review the list of different categories of aircraft relevant to pilot Display Authorisation renewal and assess the impact of operating differences between each category. The CAA will expand this work to include a study of the potential for inappropriate transfer of behaviours between aircraft types. The CAA will consider introducing any relevant findings into the ongoing training and assessment requirements for display pilots, including the requirements for Display Authorisation renewal. The CAA will conclude this review and publish its findings by April 2018.’ The AAIB has categorised the response to Safety Recommendation 2016-041 as ‘Adequate – closed’. 4.19 Safety Recommendation 2016-042: It is recommended that the Civil Aviation Authority publish a list of occurrences at flying displays, such as ‘stop calls’, that should be reported to it, and seek to have this list included in documentation relevant to Regulation (EU) No 376/2014. The CAA responded as follows: ‘The CAA does not accept this recommendation.

The CAA is developing a positive reporting culture - a Just Culture – for the air display community. Within the air display sector the CAA believes that this is the most effective way to identify and address potential safety issues before they lead to accidents. In support of this, from April this year the CAA required all event organisers and FDDs to submit, within seven days, a post-air display report to the CAA. This report must include what went well at the display, as well as information on any lapses or breaches from the required standards. Pilots must also report any aspect of their display that could have caused a significant safety risk. The CAA will record all this information. Key information will be shared with the civil air display community through briefings, the pre- and post-season seminars that the CAA jointly hosts with BADA1 and the MAA, and the annual seminar that the CAA organises for DAEs.’ 1 British Air Display Association

217 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations The AAIB has categorised the response to Safety Recommendation 2016-042 as ‘Partially adequate – closed’. 4.20 Safety Recommendation 2016-043: It is recommended that the Civil Aviation Authority introduce a process to immediately suspend the Display Authorisation of a pilot whose competence is in doubt, pending investigation of the occurrence and if appropriate re-evaluation by a Display Authorisation Evaluator who was not involved in its issue or renewal. The CAA responded as follows: ‘The CAA accepts this recommendation. In its final report of its Review of UK Civil Air Displays, published in April 2016, the CAA announced that where a stop is called because an FDD, or member of the Flight Control Committee, has reason to doubt the fitness or competence of a pilot that pilot will be subject to a provisional suspension of their display authorisation pending an investigation by the CAA of the circumstances leading to the stop being called. In its investigation, the CAA will determine whether the suspension of the display authorisation should be withdrawn or further regulatory enforcement action taken against the pilot concerned.’ The AAIB has categorised the response to Safety Recommendation 2016-043 as ‘Adequate – closed’. 4.21 Safety Recommendation 2016-044: It is recommended that the Civil Aviation Authority establish and publish target safety indicators for United Kingdom civil display flying. Following the publication of FACTOR F4/2016 Issue 2, the CAA’s response is as follows: ‘The CAA will undertake a study to identify and publish meaningful safety indicators for civil display flying. The CAA will conclude this study and publish safety indicators by September 2017.’ The AAIB has categorised the response to Safety Recommendation 2016-044 as ‘Adequate – closed’.

218 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations The following new Safety Recommendations are made in this report: 4.22 Safety Recommendation 2017-001: It is recommended that the Civil Aviation Authority amend CAP 403 to clarify the point at which an aerobatic manoeuvre is considered to have been entered and the minimum height at which any part of it may be flown. 4.23 Safety Recommendation 2017-002: It is recommended that the Civil Aviation Authority require pilots intending to conduct aerobatics at flying displays to be trained in performing relevant escape manoeuvres and require that their knowledge and ability to perform such manoeuvres should be assessed as part of the display authorisation process. 4.24 Safety Recommendation 2017-003: It is recommended that the Civil Aviation Authority review the grouping of aircraft types in display authorisations to account for handling and performance differences it considers significant. 4.25 Safety Recommendation 2017-004: It is recommended that the Civil Aviation Authority remind operators, whose activities are subject to the guidance published in Civil Aviation Publication 632, of the need to maintain detailed training records for pilots and check their compliance during inspections it carries out. 4.26 Safety Recommendation 2017-005: It is recommended that the Civil Aviation Authority specify that the flight demonstration requirement of a display authorisation evaluation, other than to assess formation following, cannot be satisfied by the pilot following another aircraft during the evaluation. 4.27 Safety Recommendation 2017-006: It is recommended that the Civil Aviation Authority undertake a study of error paths that lead to flying display accidents and integrate its findings into the human factors training it requires the holders of display authorisations to undertake. 4.28 Safety Recommendation 2017-007: It is recommended that the Civil Aviation Authority review the arrangements for safety regulation and oversight of intermediate and complex ex-military aircraft operated in accordance with Civil Aviation Publication 632, to ensure that they are consistent and appropriate. 4.29 Safety Recommendation 2017-008: It is recommended that the Civil Aviation Authority consider implementing the changes outlined in Health and Safety Laboratory report MSU/2016/13 ‘Review of the risk assessment sections of CAP 403’.

219 Safety Recommendations © Crown Copyright 2017 Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Section 4 - Safety Recommmedations 4.30 Safety Recommendation 2017-009: It is recommended that the Civil Aviation Authority require operators of aircraft used for flying displays to identify, and where practicable remove, any hazardous materials. 4.31 Safety Recommendation 2017-010: It is recommended that the Civil Aviation Authority prohibit the use of phenolic asbestos drop tanks on civil registered aircraft. 4.32 Safety Recommendation 2017-011: It is recommended that the Department for Transport commission, and report the findings of, an independent review of the governance of flying display activity in the United Kingdom, to determine the form of governance that will achieve the level of safety it requires.

Intentionally left blank

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Appendices

Intentionally left blank

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix A 223 Appendix A Altimeter Technical Information A1 Altimeter system description General G-BXFI was equipped with a Mk 29B and a MK 30B Kollsman servo-operated altimeter, mounted on the left and right instrument panels respectively, which received static pressure from the aircraft pressure head. Altimeters display altitude by comparing the pressure within the sealed altimeter case to the pressure inside an aneroid1 capsule. As the aircraft climbs and descends, the outside air pressure, and thus the pressure in the altimeter case, changes inversely. The aneroid capsule expands or contracts according to the pressure change. The capsule deflections are converted into rotary motion, by an arrangement of internal gears to drive the pointer on the instrument face and to display the aircraft altitude. Traditional altimeters can be subject to error and may not accurately respond to rapidly changing altitude, as tiny capsule deflections must overcome friction in the internal gearing, to generate large movements of the pointer. Servo-operated altimeters increase accuracy by using electrical devices such as synchros2 and servo-motors to amplify and convert the mechanical displacement of the capsule into electrical signals and so drive the pointer. Mk 30B right altimeter The Mk 30B3 right hand altimeter, is a servo-operated encoding altimeter, which displays pressure-corrected altitude. It is an electro-mechanical instrument, relying on a single-phase 115 V a.c. supply from the aircraft electrical system. The Mk 30B operates as the master altimeter, providing an electrical signal to the left (Mk 29B) altimeter and an encoded signal to the aircraft transponder for altitude reporting. A rocking shaft and gears convert the capsule deflection to rotary motion to drive the rotor of a synchrotel4, which in turn drives the entire gear train to move the pointer and height counter. The gear train also drives a synchro-transmitter,5 which sends an electrical signal to the left altimeter; an altitude encoder, which sends a binary signal equivalent to the altitude to the                                                             1 An aneroid capsule is a sealed, evacuated, thin-walled metal capsule. 2 A synchro is an electrical device which converts a mechanical input to an electrical output, or vice versa. It comprises a rotating shaft (rotor) and a fixed case (stator). 3 Mk 30B is the UK military designation for Kollsman altimeter, part number (P/N) L.83261-04-020 4 The synchrotel amplifies the low torque rotary input from the pressure capsule to rotate an output shaft at high torque, without degrading the accuracy of the input. Unlike a standard synchro, the outer casing of the synchrotel, (stator) , can be rotated mechanically, as well as the rotor. 5 In a synchro-transmitter, mechanical input (shaft rotation) is converted to an electrical output.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix A 224 Appendix A (Cont) aircraft’s transponder; and an adjustable cam, which is calibrated to compensate for known capsule errors at different heights. Figure A1 Mk 30B altimeter A setting knob, or ‘baro-knob’, at the front of the instrument (Figure A1) enables the barometric pressure setting to be set on the four-digit millibar counter. Rotation of this knob corrects the pressure measured by the capsule, and simultaneously rotates the millibar counter, height counter and pointer. The encoded altitude signal and the synchro-transmitter signal to the Mk 29B are based on a 1013.25 mb datum pressure and are not affected by the setting on the millibar counter. Mk 30B failure conditions In the event of a servo malfunction or an electrical power-supply failure to the Mk 30B, a red/black striped power failure flag drops into view to obscure the height counter, and the electrical signals to the Mk 29B altimeter and transponder are disconnected. The Mk 30B has a Pressure Overload protection feature, so that if the instrument indicates an altitude outside of its operational range, a travel-limit micro-switch will open, and disconnect the electrical supply to the altimeter. The travel-limit micro-switch can also be activated when the altimeter is unpowered if the baro-knob is adjusted upwards by more than 90 mb. This condition is described in the Aircrew Manual as follows:

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix A 225 Appendix A (Cont) ‘Note: If the millibar setting is adjusted with the aircraft power off, the altitude counters and the pointer do not move. If the millibar setting is increased more than 90 mb with AC power off, a travel limit switch within the instrument opens and prevents AC power being connected to the instrument. If the failure flag does not clear when AC power to the instrument is switched on, wind the millibar setting towards the lower end of the scale until the flag clears. Normally only adjust the millibar setting with the power on.’ Mk 29B left altimeter The Mk 29B6 left altimeter is a servo-operated altimeter with standby reversion capability to operate as an uncorrected precision pressure altimeter, either automatically or by selection. In normal operation (servo mode), the Mk 29B receives a pressure-error-corrected altitude signal from the Mk 30B, so that it gives a more accurate indication of altitude. The Mk 29B altimeter mechanism comprises two capsules and their deflections are converted to rotary motion via rocking shafts, which engage with internal gearing to drive the pointer and height counter. A synchrotel and a drag-cup motor are also connected through gearing to the pointer and height counter. The capsule deflections drive the synchrotel rotor. Figure A2 Mk 29B altimeter in servo mode (left image) and standby mode (right image)                                                             6 Mk 29B is the UK military designation for Kollsman altimeter, P/N L.82621-04-010

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix A 226 Appendix A (Cont) When the Mk 29B is operating in servo mode, the synchrotel stator receives a pressure-error- corrected signal from the synchro-transmitter in the Mk 30B and the drag-cup motor is driven by a signal from the synchrotel rotor, based on the capsule deflections. The motor in turn drives the pointer and height counter. When the MK 29B is in standby mode, the internal gearing is driven only by the capsule deflections, to move the pointer and height counter. Operation of the baro-knob is similar to that on the Mk 30B. A STANDBY/RESET knob on the front of the instrument (Figure A2) allows manual selection of the standby or servo mode. The knob is spring-loaded to the centre position. When STANDBY (S) is selected, the altimeter reverts to standby operation. An integral 28 V (d.c.) vibrator motor starts up to help the capsule overcome friction in the internal gearing and an orange STBY flag appears at the side of height counter. When selected to RESET (R) the altimeter resets to servo mode, the vibrator stops and the STBY flag clears. When aircraft electrical power is switched off, the Mk 29B reverts to standby mode. The Aircrew Manual states that the Mk 29B will automatically revert to standby operation in the event of a primary electrical power failure; a servo amplifier or servo motor failure [in the Mk 30B]; a failure within any part of the [Mk 29B] detection circuit; or, if the difference between the standby capsule altitude and the servo-indicated altitude exceeds a certain level7. A note in the Aircrew Manual gives the following advice, to ensure two independent sources of altitude are available for critical phases of flight: ‘When the Mk 29B altimeter is being operated in the servo (R) mode, it is possible for a fault in the system to cause both altimeters to indicate the same incorrect height without any warning flag indications. It is recommended, therefore, that the Mk 29B altimeter be selected to standby (S) for take-off and at the beginning of a descent/recovery procedure.’                                                             7 Differences greater than the pressure equivalent of approximately 4,000 ft at sea level, or up to 10,000 ft at altitude.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix A 227 Appendix A (Cont) A2 Altimeter testing General The altimeters had not suffered any obvious external damage during the impact and CT-scans showed no evidence of damage to the internal mechanisms of either unit. However the power failure flag on the Mk 30B appeared to be stuck above the height counter drum. The STBY flag was visible on the Mk29B altimeter, but it was not possible to determine which mode had been selected during the accident flight, as it would have reverted automatically to standby mode upon disruption to the electrical power supply during the impact. The altimeters were function-tested at the manufacturer’s facilities in accordance with the original manufacturer’s standard test schedule. Each altimeter was tested in isolation and then both altimeters were connected together, in order to replicate the aircraft installed configuration. In addition the build history for each altimeter was reviewed. Altimeter build history Altimeter Mk 29B, P/N L82621-04-010, S/N 1131 was manufactured in 1974 and repaired in

1. Altimeter Mk 30B, P/N L82621-04-020, S/N 786 was manufactured in 1975 and

repaired in 1988. Neither unit had been returned to the manufacturer since then. At the time when the altimeters were built and repaired, instrument build and repair records for military products were only required to be retained for seven years. Consequently such documentation is no longer available. Mk 29B testing The Mk 29B failed the manufacturer’s test because it exhibited an offset of approximately -100 ft between the actual altitude and the displayed value across its entire range. The manufacturer stated that this finding suggested the altimeter may have been calibrated incorrectly at build or when last serviced. It was also considered possible that the offset could be attributed to minor slippage within the altimeter gear train due to accident impact forces. The effect of this offset is that the Mk 29B would read approximately 100ft lower than the actual aircraft altitude. The testing also identified a number of anomalies relating to excessive backlash and friction within the mechanical components of the gear train and height counter drum, which resulted in the Mk 29B failing these elements of the test. These anomalies were attributed to wear in the gears and pivots of the gear train and height counter, and were considered to be consistent with expected component wear in an altimeter of this age, which may not have been serviced for many years. The effect of friction is that the displayed altitude could lag the measured altitude. This effect was particularly evident on the Mk 29B when it was tested in standby mode, and more so when the vibrator motor was switched off. Mk 30B testing

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix A 228 Appendix A (Cont) The Mk 30B displayed altitude was within the permissible tolerances across the altitude range, and the encoded signal transmitted to the transponder correctly corresponded to the displayed altitude. However, the Mk 30B failed the test because there was no signal output from the synchro-transmitter. The effect of this would be that, when the Mk 29B was operating in servo mode, the Mk 30B altimeter would not transmit the required electrical signal to the Mk 29B. The testing also confirmed that the power failure flag was stuck in the open position and did not drop to obscure the drum when the relevant power-failure conditions were met. Mk 29B and Mk 30B combined testing The Mk 29B and Mk 30B were connected together using the altimeter wiring loom which had been extracted from the aircraft, in order to observe the effects of the failed synchro-transmitter signal. When in servo mode the Mk 29B did not accurately follow the Mk 30B, but instead displayed values which were lower than the Mk 30B. The Mk 29B pointer and height counter also exhibited some ‘stickiness’ and did not rotate smoothly. When altitude was increasing, the Mk 29B values were between 180 and 250ft lower than the Mk 30B for altitudes up to 12,500 ft. This discrepancy had increased to 500 ft at 30,500 ft. When the altitude was decreasing, the Mk 29B under-read the Mk 30B by up to 40 ft. The lack of correlation between the Mk 29B and Mk 30B demonstrated the effect of the absence of the Mk 30B synchro transmitter on the performance the Mk 29B. The Mk 29B under-read was more pronounced when altitude was increasing than when it was decreasing; this hysteresis effect is likely associated with the previously identified friction within the internal gearing of the Mk 29B. This test was also repeated using workshop test cables to connect the altimeters and the same anomalies were observed, ruling out any faults within the aircraft altimeter wiring loom. Mk 29B and Mk 30 shop unit combined testing The Mk 29B from G-BXFI was connected to a fully serviceable Mk 30 shop unit, which was similar to the Mk 30B. When in servo mode, the Mk 29B correctly followed the Mk 30 displayed altitude, albeit with the previously observed approximate -100 ft offset. The Mk 29B pointer and height counter rotated smoothly and there was no lag between the units. This indicated that the Mk 29B functioned correctly in servo mode when it received a valid signal from the master altimeter. Disassembly of the Mk 30B and the synchro transmitter Disassembly of the Mk 30B and further testing identified an open-circuit condition across the rotor windings of the synchro-transmitter. It also confirmed that the power failure flag had come off its pivots, most likely as a result of the accident impact. Disassembly of the synchro-transmitter and examination under a digital stacking microscope, identified that a circlip holding the rotor in place was not fully seated. This may have allowed

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix A 229 Appendix A (Cont) relative movement of some of the components within the synchro-transmitter. One of the input wires to the rotor winding was observed to be broken and encrusted in a greenish residue. This could account for the open-circuit condition. It was considered that this damage was not accident-related, but there was no means to determine how long this condition had existed. Mk 30B S/N 993 testing Mk 30B altimeter S/N 993 was obtained by the investigation for comparative testing. This altimeter had been installed in G-BXFI during a previous flight where some altimeter anomalies were observed but was removed from G-BXFI in March 2015). S/N 993 was tested in isolation and when connected to the Mk 29B from G-BXFI. Its performance was within the permissible tolerances for all aspects of the manufacturer’s standard test schedule. No defects were noted with S/N 993, or with the Mk 29B8 when operating in servo mode connected to S/N 993.                                                             8 With the exception of the previously observed approximate -100ft offset on the Mk 29B.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix B Appendix B 230 Pilot Escape System Technical Information

B1 Description of Ejection Seat G-BXFI was equipped with two Martin-Baker Mk 4HA ejection seats capable of safe ejection at ground level, providing that the aircraft’s flight path is parallel to the ground and it has a forward speed of at least 90 kt. For an aircraft which is descending, the minimum safe height for ejection is approximately 100 ft above ground level, per 1,000 feet per minute rate of descent.

Each seat is mounted on an ejection gun, which uses pyrotechnic cartridges to provide the propellant power for the ejection. The ejection gun is comprised of three telescoping tubes; inner, outer and intermediate. The ejection gun firing unit, which contains the primary cartridge is located at the top of the inner tube. Two secondary cartridges are mounted in the outer tube. The outer tube is attached to the aircraft structure via the ‘bottom fitting’ which is bolted to the cockpit floor, and a ‘top fitting’ bracket attached to the rear cockpit bulkhead. The seat is connected to the ejection gun via a spring-loaded plunger, which engages in a locking collar on the inner tube, through a ‘top-latch’ window on the outer tube. Three sets of steel ‘slippers’ on either side of the seat structure engage in guide-rails mounted to each side of the outer tube.

Smaller pyrotechnic cartridges are also used in the drogue gun and the guillotine cutter.

The cockpit canopy can be jettisoned by gas pressure from a pyrotechnic cartridge in the canopy firing unit acting upon two pistons, or jacks, which eject the canopy upwards and backwards into the airflow. This can be initiated by pulling the canopy jettison handle at the rear of the centre pedestal. The canopy is also jettisoned automatically whenever ejection is commanded.

In order to make the ejection seats safe for maintenance and to allow safe occupant entry and egress, safety pins are fitted to the firing pins and activation handles of each seat and to the canopy firing unit, when they are not required to be armed. The safety pins are removed from occupied seats prior to flight and placed in a designated stowage.

B2 Normal ejection sequence Under normal conditions, ejection is initiated by pulling either the face-screen firing handle located above the pilot’s head, or the Seat Pan Firing Handle (SPFH), fitted to the front of the seat pan between the pilot legs.

Each firing handle is mechanically connected via cables to a Y-shaped connector, such that when either handle is pulled, two actions happen: the canopy cross shaft rotates to

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix B (Cont) Appendix B 231 mechanically unlock the canopy and to withdraw the ‘sear’1 from the canopy firing unit, firing the canopy cartridge; and, a sear is withdrawn from the ejection gun time-delay firing unit. After a 0.5 sec delay, which allows sufficient time for the canopy to clear the aircraft, the primary cartridge is fired. The resulting gases pressurise the ejection gun tube, and the recoil pressure forces the inner tube overrides the spring-loaded top-latch, plunger unlocking the seat from the aircraft structure. As the seat accelerates up the guide-rails of the outer ejection gun tube, the inner and intermediate gun tubes are displaced upwards uncovering the two secondary cartridges which fire in turn as they become exposed to the hot gases. Activation of the secondary cartridges increases the ejection thrust and the seat’s upward velocity to ensure it clears the aircraft.

As the seat begins to move upwards, leg restraint lines pull tight to prevent occupant leg injury. As the seat leaves the aircraft the shear rivet attaching each leg restraint line to the cockpit floor shears. The ejection gun remains attached to the aircraft structure.

While the seat is rising two static telescopic rods, mounted on either side of a bracket at the rear of the seat, are activated simultaneously. One of the static rods withdraws the sear from the drogue gun, setting a time-delay mechanism into operation. After a 0.5 second delay the drogue gun cartridge fires and a piston (drogue gun bullet) is ejected, carrying with it the drogue withdrawal line and the 22 in controller drogue. The controller drogue then extracts the main 5ft drogue and the two drogues inflate to retard and stabilise the seat as it falls.

The other static rod withdraws the sear from the Barostatic Time Release Unit (BTRU). After a time delay of 1.25 seconds the harness-release plunger extends which releases ejection seat scissor shackle, the pilot’s harness locks and the leg restraint lines. The pull of the main drogue is transferred from the scissor shackle to the parachute withdrawal line, extracting the auxiliary parachute and main parachute canopy and separating the pilot from the seat. Once the main parachute canopy is deployed the pilot is rapidly decelerated and can descend under the parachute and the seat falls away separately. An integral barostat delays operation of the BTRU until the seat is below 10,000ft and is at a safe speed

If the seat fails to eject or if the BTRU does not function correctly to achieve automatic man- seat separation following ejection, a manual separation handle on the port side of the seat pan can be pulled and this will release the locks securing the pilot’s harness to the seat and the leg restraint lines. As the seat, which is still attached to the drogue parachute, falls away from the pilot a cable between the pilot’s parachute and the seat is pulled, removing the sear from the guillotine firing unit. When the cartridge fires a small guillotine blade is forced upwards, severing the line connecting the main drogue to the main parachute canopy. The pilot is then fully separated from the seat and drogues, and will have to manually pull the parachute rip- cord handle to deploy the main parachute canopy.

                                                            1 A sear is part of the firing mechanism which holds back the firing pin, until the correct amount of pressure has been applied, at which point the pin is released firing the cartridge.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix B 232 Appendix B (Cont) The guillotine is also fired during normal automatic separation, but the parachute withdrawal line is pulled out of the guillotine gate by the force of the drogues being deployed before the cartridge is initiated.

B3 Examination of Ejection seats B3.1 Pilot’s (left) seat The pilot’s seat was lying face-down on the ground, underneath the main cockpit wreckage. The seat pan had partially separated from the seat-back and the seat’s main beam assembly was fractured in a number of locations. During the operations to make safe the ejection seats at the accident site, it was identified that the left seat primary ejection gun cartridge, drogue gun cartridge and guillotine cartridge had fired, but the two secondary ejection gun cartridges had not. The BTRU harness release plunger was extended and the scissor shackle was released, indicating the BTRU had operated. The canopy jettison cartridge had also fired. Two of the left ejection seat safety pins were found in the designated cockpit stowage, and a third was recovered from the accident site. It is likely that the remaining safety pins were dislodged from the stowage during the accident sequence. A photograph taken prior to G- BXFI’s departure from North Weald, showed that the left ejection seat and canopy jettison safety pins had been removed and stowed correctly, as would be expected for flight in the occupied condition.

The seat pan firing handle (SPFH) was stowed within its housing, indicating that it had not been pulled. The face-screen handle was found in the wreckage having been fully removed from, but lying close to, its housing in the ejection seat’s drogue container.

The ejection gun had suffered major structural damage at its base. Although the bottom fitting remained bolted to the cockpit floor, the fitting had fractured, compromising the bonded joint with the outer ejection gun tube, such that the entire gun assembly had separated from the bottom fitting and was unrestrained. The bottom 33 cm of the inboard guide-rail had broken off. The outboard guide-rail in the corresponding area had a large dent and some attachment rivets had sheared off.

The intermediate and inner gun tubes remained within the outer tube, but had not fully extended. The circular bracket attaching the ejection gun to the top fitting had sheared on one side. The spring-loaded plunger had over-ridden the top-latch window and there were a number of damage marks around the top-latch window.

One of leg restraint lines remained attached to the cockpit floor at one end, indicating the shear rivet had not experienced sufficient load to cause it to fail, the other end having pulled through the snubbing unit. The other leg restraint line had sheared from the cockpit floor, but the line had also been pulled through the snubbing unit and was found lying near the seat.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix B 233 Appendix B (Cont) The 22in and 5ft drogues had been extracted from their housing and were entangled with cockpit wreckage and tree debris. The drogues had not inflated and were still folded. The drogue-to-parachute withdrawal line had been severed by the ejection seat guillotine. The manual separation handle had not been operated.

The main parachute had remained within its container, but the auxiliary parachute had been fully extracted. The rip cord handle was found stowed and had not been operated.

B3.2 Right hand seat The right-hand ejection seat remained inside the cockpit. The circular bracket attaching the ejection gun to the top fitting was sheared on both sides, leaving the seat and ejection gun free to tilt forward, pivoting about the ejection gun bottom fitting. The seat was also free to slide up the ejection seat guide-rails as the spring-loaded plunger had been forced through the top-latch window, fracturing the top of the top-latch window.

The drogue gun cartridge and guillotine cartridge had fired but primary and secondary ejection gun cartridges had not. The BTRU had operated and released the parachute locks. The parachute withdrawal line had been severed by action of the ejection seat guillotine.

The 22in drogue had been ejected by the drogue gun and the 5ft main drogue was partially withdrawn from its container. The main parachute remained within its parachute container.

The four ejection seat safety pins remained installed, as would be expected in an unoccupied seat.

B4 Analysis relating to initiation of ejection sequence The cockpit canopy separated from the aircraft shortly after the aircraft struck the road. In a normal ejection sequence the ejection gun would fire 0.5s after canopy jettison and the ejection seat would be ejected out of the aircraft. Photographic evidence indicated that the ejection seat did not leave the leave the aircraft at this point.

The SPFH on the left seat was intact and there was no evidence from the in-cockpit video recording to indicate that the pilot had attempted to pull the face-screen handle to initiate ejection prior to or during the impact sequence. Although the face-screen handle had been extracted from its stowed position, this most likely occurred during the break-up of the cockpit structure and extraction of the drogues.

Neither was there any evidence that the pilot had attempted to manually jettison the canopy. It was therefore concluded that the ejection sequence was initiated by the mechanical damage resulting from disruption to the cockpit and seat structure.

The impact sequence resulted in substantial disruption to the cockpit floor, which was forced upwards causing severe disruption to the left seat ejection gun bottom fitting, upwards displacement of the seat, and partial failure of the top attachment bracket. The damage to the

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix B (Cont) Appendix B 234 guide-rails also indicated that the left seat had experienced a sideways impact, most likely from trees or other obstacles.

The impact loads transmitted through the right hand seat caused total failure of its top attachment bracket, leaving the seat and ejection gun free to tilt forward and the seat unrestrained on the guide rails.

The upwards displacement of either seat, or indeed the forward displacement of the right seat, would have placed the cables to the canopy firing unit under tension, thereby initiating canopy jettison. Similarly the upwards displacement of the left seat would have placed the ejection seat initiation cable under tension, firing the primary cartridge.

The disruption to the bottom of the left seat ejection gun allowed the hot gases generated by firing primary cartridge to be vented to atmosphere preventing pressurisation of the ejection gun. As a result, the inner tube failed to fully extend and the secondary cartridges were not exposed to the hot gases required for them to fire. Therefore the seat did not have sufficient thrust to clear the aircraft in a controlled manner.

Although only a partial ejection sequence occurred, the resulting upwards momentum of the seat was sufficient to release the seat from the ejection gun. The seat movement also initiated the mechanically-activated aspects of the ejection sequence, deploying the drogues and releasing the scissor shackle, harness locks and leg restraints.

The drogues did not fully develop due to the aircraft’s decaying speed during the impact sequence and instead became entangled in trees and aircraft wreckage. The pilot and his seat were thrown clear of the cockpit while it was still moving. The unrestrained seat was thrown from the cockpit most likely due to a combination thrust from the primary cartridge, impact dynamics and the drogues becoming tangled in trees.

As the drogues did not develop the main parachute was not extracted and the parachute withdrawal line remained in the guillotine gate, instead of being pulled clear. Once the harness locks had released the relative displacement between the pilot and his seat caused the guillotine to fire, separating the pilot from seat and the drogue system. The seat came to rest on the ground before the cockpit did and the cockpit subsequently landed on the seat. Had the pilot remained attached to his seat it is likely that his injuries would have been much more severe.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix C 235 Appendix C Permit to Fly

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix C 236 Appendix C (Cont) Highlighting appears on original document

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix C 237 Appendix C (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix C 238 Appendix C (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix D 239 Appendix D

Log Card for the High Pressure Fuel Pump

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 240 Appendix E

Security classification#01 Private – Rolls-Royce Data

TECHNICAL REPORT

Project Avon Sub-system Whole engine Process

Part number

Engine types#24 Avon Engine marks/vehicle name Mk122 / Hawker Hunter T7 Vehicle number/build#28 G-BXFI Module

Material Design definition

Design def. issue

CTP#32

ATP#36

Dept#44

File/folder#48 EFI/1186

Security classification#01 Private – Rolls-Royce Data Page 1 of 26#56 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Discipline or report series#10 Air Safety Investigation Document number#12

Report number#52 EFI/1186 Issue#13 1 Title#15

Strip examination and assessment of Avon Mk122 s/n 41H-670815 installed in Hawker Hunter T7 reg G-BXFI Shoreham Airport on 22nd August 2015. Authority: Authors#20

Telephone:

Date#40 22/03/2016

Summary#60 On the 22nd August 2015 Hunter T7 aircraft s/n G-BXFI departed its home base at North Weald in Essex for an air display at Shoreham Airport in West Sussex. Not long after the start of the display the aircraft did not achieve level flight after a vertical manoeuvre and struck the westbound carriageway of the A27

The AAIB were informed of the accident and initiated a field investigation. The AAIB requested Rolls-Royce Air Safety Investigation Department assistance in the investigation. This report details the strip and technical examination of the engine and its accessory units. The report also includes an assessment of engine performance conducted by the Rolls- Royce performance department.

Strip examination of the engine found that its condition was commensurate with its age with no evidence of any pre-accident anomalies. Debris found within the core of the engine was consistent with the engine operating at the point of impact. Detailed strip examination of the engine accessory units found nothing that would prevent the engine from operating across its full speed range. Laboratory examination of seals and diaphragms from the accessory units found that some had evidence of age degradation. However, there was no suggestion that seal or diaphragm integrity had been compromised or that they would have prevented the engine from operating normally. Comparison of engine speed data obtained via spectral analysis with video evidence of engine operating temperatures indicates that the engine appeared to be operating in a stable manner throughout the incident flight. A performance assessment has found that the engine was performing as expected and that no major performance changes were evident. Throttle lever position during the event sortie could not be established therefore it has not been possible to determine if the level of thrust delivered by the engine matched that demanded by the pilot Additional keywords#90

Retention category A Circulation: Alan Thorne, UK AAIB

Approved by:

See report signature section

Strip Examination and Assessment of Avon MK122 SN 41H-670815

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 241 © Crown Copyright 2017 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 2 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

TABLE OF CONTENTS 1 ABBREVIATIONS AND ACRONYMS ..................................................................................................... 2 2 COMPONENT DETAILS .......................................................................................................................... 3 3 REASON FOR INVESTIGATION ............................................................................................................ 3 4 EXTENT OF INVESTIGATION ................................................................................................................ 3 4.1 INITIAL ENGINE INSPECTION / EXAMINATION.................................................................................................. 3 4.2 ENGINE DISASSEMBLY AND EXAMINATION .................................................................................................... 4 4.2.1 General engine appearance ........................................................................................................ 4 4.2.2 Air Intake Casing .......................................................................................................................... 5 4.2.3 Compressor Casing ..................................................................................................................... 5 4.2.4 Compressor Rotor ........................................................................................................................ 5 4.2.5 Combustion Chambers ................................................................................................................ 6 4.2.6 Nozzle Box ................................................................................................................................... 6 4.2.7 High Pressure Guide Vanes ........................................................................................................ 6 4.2.8 High Pressure (1st stage) Turbine ................................................................................................ 6 4.2.9 Low Pressure Guide Vanes ......................................................................................................... 6 4.2.10 Low Pressure (2nd stage) Turbine ................................................................................................ 6 4.2.11 Exhaust Unit ................................................................................................................................. 6 4.3 ACCESSORY UNIT EXAMINATION AT THE REPAIR FACILITY ............................................................................ 6 4.3.1 Dual Fuel Pump - s/n B359 LR .................................................................................................... 6 4.3.2 Fuel Control Unit - p/n GP5857 .................................................................................................... 7 4.3.3 Acceleration Control Unit - s/n B36R ........................................................................................... 8 4.3.4 Barometric Pressure Control Unit - s/n 489 LR............................................................................ 8 4.4 ENGINE PERFORMANCE ASSESSMENT. ........................................................................................................ 9 5 CONCLUSION ....................................................................................................................................... 10 6 SIGNATURES ........................................................................................................................................ 11 7 FIGURES ................................................................................................................................................ 12 1 ABBREVIATIONS AND ACRONYMS AAIB: Air Accident Investigation Branch. ACU: Acceleration Control Unit ASI: Air Safety Investigation BPC: Barometric Pressure Control FCU: Fuel Control Unit ft: Feet. HMG: Hydro Mechanical Governor HP: High Pressure IIC: Investigator In Charge IRHD: International Rubber Hardness Degrees ISA: International Standard Atmosphere JPT: Jet Pipe Temperature KIAS: Knots Indicated Air Speed LP: Low Pressure OAT: Outside Air Temperature OEM: Original Equipment Manufacturer rpm: Revolutions per Minute SLS: Sea Level Static s/n: serial number UTAS: United Technologies Aerospace Systems

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 242 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 3 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc. 2 COMPONENT DETAILS

Subject

Avon Mk122 Aircraft Type & No. Hunter T7 / G-BXFI Authority N/A Part No. N/A Engine Type & No. Avon Mk122 Contract No. N/A Serial No. 41H-670815 Operator

SAP No.

Hours TSN 1222 Location Shoreham Airport Incident Date 22nd August 2015 Manufacturer Rolls-Royce F760 Report & Date N/A

3 REASON FOR INVESTIGATION On the 22nd August 2015 Hunter T7 aircraft s/n G-BXFI departed its home base at North Weald in Essex for an air display at Shoreham Airport in West Sussex. During part of the display sequence a manoeuvre containing both a vertical and rolling component was conducted, at the apex of which the aircraft became inverted. Following the subsequent descent the aircraft did not achieve level flight before striking the westbound carriageway of the A27. The AAIB were informed of the accident and initiated a field investigation. 4 EXTENT OF INVESTIGATION Rolls-Royce Air Safety Investigation Department were made aware of the accident and a request for assistance was made by the AAIB. Rolls-Royce ASI personnel were subsequently detailed to technically assist the AAIB as required by their investigation. On the 3rd September 2015 ASI visited the AAIB in Farnborough where an initial investigation meeting was held followed by a visual assessment of the wreckage. 4.1 Initial Engine Inspection / Examination The Avon engine is a single shaft turbo jet engine comprising of a multi-stage axial flow compressor with variable inlet guide vanes. A multi-cannular combustion system provide heated airflow to a two stage axial flow turbine which drives the compressor and engine accessories via an internal gearbox and external mounted auxiliary gearbox. The Avon engine was designed and manufactured by Rolls-Royce during the 1950’s. As well as the Hawker Hunter the engine has been used in a variety of different military application by the UK MoD as well as overseas operators and covers a number of different mark numbers. Several Avon powered Hunter aircraft are still flown by private operators, however these are not supported by Rolls-Royce. The main engine units can be seen below.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 243 © Crown Copyright 2017 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 4 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

The engine did not detach from the airframe during the accident and remained installed. The airframe was held in the AAIB hanger facility which allowed a visual inspection of the intake and exhaust to be made. The air intake contained a large quantity of debris ingested during the accident. However it was possible to view a number of inlet guide vanes which appeared to be intact, (figure 1). The engine’s jet pipe had detached during the accident impact sequence which allowed the top section of the 2nd stage turbine blades to be seen. The blades that were visible were intact with no visual evidence of material loss. The lower section of the exhaust unit was distorted which restricted a complete view of the turbine (figure 2). The engine was removed from the airframe by the AAIB to allow a detailed strip examination to be conducted. Rolls-Royce Air Safety Investigators were not present during the engine removal. 4.2 Engine Disassembly and Examination The engine disassembly took place at the AAIB facility over the 8th/9th October 2015. 4.2.1 General engine appearance The main engine casings and external surfaces were covered in a layer of soot / carbon (figure 3); this was considered to be the result of the post-crash fire. There was no evidence of any high energy disruption of the casings to support that the engine had suffered an uncontained mechanical break out. With the engine removed from the airframe it was possible to see the amount of debris that had been ingested during the ground impact sequence. The front of the nose cone was detached allowing the starter motor to be viewed. This was also coated in soot however, the electrical connections were in place and intact (figure 4).

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 244 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 5 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc. The exhaust unit was badly distorted over an area of approximately 180° (fig 5). A visual assessment of the accessory units found that the external surface of each unit was soot blackened. The attached fuel pipework and electrical harnesses were in a distressed condition and commensurate with exposure to elevated temperatures. This along with the external blackening was considered to be the result of the post-accident fire The disassembly commenced by removing the accessory units:

Dual Fuel Pump

s/n B359 LR

Acceleration Control Unit

s/n B36R

Taco Generator

s/n 30909/53

VIGV Ram

s/n WE 2863/R

Fuel Control Unit

p/n GP5857

Barometric Pressure Control Unit s/n 489 LR

Fuel Differential Pressure Switch s/n 390 LR The Dual Fuel Pump, Acceleration Control Unit, Fuel Control Unit and Barometric Pressure Control Unit were returned to a repair facility for strip examination. The findings from the strip examination are detailed later in this report. 4.2.2 Air Intake Casing The debris that had collected in the air intake had the appearance of a mixture of both organic and inorganic material. After the debris had been removed it was possible to view the intake guide vanes. All the vanes were present and those not covered by post-accident debris were coated in a layer of soot. Minor damage to the aerofoils was evident which was considered to be the result of debris ingestion. Due to a quantity of remaining debris it was not possible to establish if the vanes could be articulated. (fig 6). 4.2.3 Compressor Casing The Avon compressor casing consists of two half casings joined by a line of bolts at mid-engine height. The bolts were removed and the top half casing lifted off to allow examination of the upper section of the compressor stator vanes. The vane set was complete and the majority were covered in a layer of soot. There was evidence of damage as a result of debris ingress but there was no visual evidence of pre-accident vane fracture (figure 7). 4.2.4 Compressor Rotor Removal of the casing exposed the compressor rotor assembly which could be rotated. Occasionally the compressor rotation was difficult due to the presence of debris that had been ingested during the accident sequence. A visual examination of the 12 stage compressor found all the blades to be intact, however, the majority displayed evidence of damage and material loss. All stages of blades were coated in a layer of loose carbon. Ingested debris was found as far rearward as stage 11 of the compressor. The location of the ingested debris and the nature of the damage to the compressor blades and vanes were consistent with the engine operating at the time of the accident. (figures 8 – 10). The visual examination of the compressor found no evidence of pre-accident blade fracture.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 245 © Crown Copyright 2017 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 6 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc. 4.2.5 Combustion Chambers The Avon Mk122 has eight cannular combustion chambers. No evidence of external distress was found on the areas that were visible and all 8 combustion chambers were installed securely. Four were removed to facilitate a more detailed visual examination. The four examined combustion chambers were intact with no evidence of external distress around the circumference. There was no visual evidence of distress on the internal surface and all four had a degree of carbon build up commensurate with normal operation, (figure 11). 4.2.6 Nozzle Box The nozzle box was visually in a satisfactory condition. Evidence of metallic debris, resulting from compressor blade distress, was found around the combustion chamber location flange and the front of the HP guide vanes. This metallic debris most likely originated from the compressor aerofoils that were damaged by the ingested debris. It also indicates that the engine was operating at the time of the accident. 4.2.7 High Pressure Guide Vanes Removal of four combustion chambers facilitated a visual examination of a number of HP guide vanes. The vanes were coated in a layer of carbon commensurate with engine operation. All the vanes viewed were intact and there was no visual evidence of any pre-accident distress (figure 12). 4.2.8 High Pressure (1st stage) Turbine A visual assessment of the HP turbine blades found they were all intact with no evidence of pre- accident distress. 4.2.9 Low Pressure Guide Vanes A visual assessment of the LP guide vanes found they were intact with no evidence of pre-accident distress. 4.2.10 Low Pressure (2nd stage) Turbine The exhaust unit was removed allowing examination of the LP turbine disc and blades. All the blades were intact with no evidence of pre-accident distress or material loss, (figure 13). The disc was visually satisfactory and its condition was considered commensurate with the service life of the engine. 4.2.11 Exhaust Unit The exhaust unit was severely distorted and commensurate with the accident sequence. 4.3 Accessory Unit Examination at the Repair Facility The strip assessment of the accessory units was conducted at the UTAS repair facility. Unit disassembly was conducted by UTAS fitters and observed by personnel from the AAIB, Rolls-Royce Air Safety Investigation Department and Rolls-Royce Controls Engineers. The laboratory work was conducted at the Rolls-Royce Controls Laboratory. 4.3.1 Dual Fuel Pump - s/n B359 LR The fuel inlet cover was removed whereby water and orange coloured contaminants were found inside the inlets, (figure 14), consistent with post-accident water ingress. The hydro mechanical governor

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 246 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 7 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc. cover was removed; the gasket was fitted correctly and in a good condition. The diaphragm assembly was removed and found to be visually clean and in good condition. The diaphragm and ‘O’ ring seal were also in a visually good condition. The cross drive and HMG gears were removed to allow removal of each pump unit cover. The (fuel) carbon seal and (oil) shaft seal were visually in good condition. There was minor contamination and corrosion within the pump chambers consistent with post-accident water ingress. The pump assemblies were removed where evidence of water contamination and corrosion were found, (figure 15). Tide markings show that this had occurred post-accident. There was slight erosion of the silver plate between the piston ports but the base material was not eroded. There was no evidence of cavitation and all the pistons moved freely in their ports. The hydro mechanical governor was inspected and found to be in a visually good condition. The pump diaphragm was examined by the laboratory. It is manufactured from two-plies of a Polychloroprene rubber proofed textile. The diaphragm consisted of two centrally located riveted plates with associated spring assembly. Around the plates is a shallow convoluted portion of the diaphragm which is exposed to aviation kerosene. The remainder of the diaphragm is compressed between surfaces acting as a gasket, (figure 16). The laboratory assessment of the diaphragm found that the convoluted area on both sides had been significantly degraded. The rubber had the appearance of “Mud-Cracking” across the entire working surface. On one side of the diaphragm a “Tide-Mark” could clearly be seen across the convolution, (figure 17). Mud cracking is a known condition that can occur if the diaphragm has had extended periods of non- operation while still immersed in kerosene. As the residual kerosene degrades, peroxides within the fuel can attack the rubber. The tide mark is an example of where fuel has drained away during periods of inactivity. A reduced exposure to kerosene will lessen the degrading effect of peroxides but will result in the diaphragm losing flexibility resulting in the observed mud cracking as the fuel no longer acts as a plasticiser for the rubber. Nevertheless, the diaphragm was still integral and its functional capability had not been compromised. It is also worthy of note that the design of governor installed on this standard of dual fuel pump will govern at a higher engine speed if the diaphragm ruptures. However, in its current condition its integrity for continued use has been brought into question. 4.3.2 Fuel Control Unit - p/n GP5857 Prior to returning the FCU to the OEM the main fuel filter was removed and visually examined. There was no visual evidence of debris found within the filter element. The throttle valve housing end cover was removed which found that the valve plunger was clean and moved freely during actuation of the input lever. Removal of the throttle valve housing found the metering port to be clean and in good condition. The metering end of the plunger was also clean and in good condition, (figure 18). The housing ‘O’ ring was fitted correctly and visually in good condition. The throttle valve input lever and shaft were removed which found the gasket to be fitted correctly and in a visually good condition. Light damage marks were noted on the rack teeth. This was most likely caused during assembly, but did not affect the operation of the throttle valve. The metering plunger was removed from the housing and found to be in a visually good condition as was the metering housing bore, (figure 19).

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 247 © Crown Copyright 2017 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 8 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc. Removal of the pressurising valve housing found that all the internal components were correctly assembled and in a visually good condition. The HP cock housing assembly was removed from the main body to allow a visual examination of the valve operation. The valve was free to move over its full range and there was no evidence of play in the assembly, (figures 20 & 21). All the fuel washed surfaces that could be inspected were found to be visually clean and in good condition. 4.3.3 Acceleration Control Unit - s/n B36R The bellows cover was removed which revealed the bellows and housing to be visually clean and in good condition. The damping oil present in the unit was clean with no visual evidence of contamination. Removal of the spring cover found the two ‘O’ ring seals correctly seated and in good condition. The housing and spring assembly were clean and visually in good condition. The servo line filter and orifice housing were removed, the orifice hole had evidence of erosion between the hole and end face corner. The half ball valve had what appeared to be fine pitting in line with the orifice and there were small amounts of debris identified in the servo line filter. All components within the adjuster housing were clean and visually in a good condition, (figure 22). The diaphragm separating bleed valve pressure and compressor delivery pressure was visually in a good condition as was the diaphragm between the compressor delivery pressure and bellows chamber. The compressor delivery pressure chamber was visually clean and in a good condition. The pressure balance lever was in a good condition but with a small quantity of a black deposit noted around the needle roller support point. This was not considered to be detrimental to the operation of the unit, (figure 23). The two ACU diaphragms were submitted to the laboratory for examination. None of the rubber surfaces exhibited evidence of aging, i.e. cracking or splitting, however, there was some evidence of compression set on the beaded section of the smaller diaphragm. Both diaphragms operate in air and so were not affected by degrading kerosene and were considered to be in a satisfactory condition. 4.3.4 Barometric Pressure Control Unit - s/n 489 LR On removal of the bellows chamber cover the sealing gasket was found to be in a good condition. The damping oil in the bellows chamber was clean and the bellows were in a good condition, (figure 24). Manipulation of the bellows assembly at its centre locating feature found the vacuum was still functional. The ACU adjusting housing was removed, the gasket and all internal components were in a visually good and clean condition, (figure 25). The pressure tapping housing was removed, its gasket was in a good condition. The diaphragm and piston were also in a visually good condition as was the pivot point assembly The BPC diaphragm was examined by the laboratory. It is manufactured from Nitrile rubber and has an inherent resistance to kerosene. Its removal from a kerosene environment has not had a detrimental effect on its condition. The rubber hardness was assessed and found to be 73 IRHD which was deemed acceptable for this type of material. The BPC unit also has an ‘o’ ring seal and a seal consisting of a small Nitrile disc with a beaded edge. The ‘O’ ring seal had some degree of compression set which was also evident in the beaded section

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 248 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 9 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc. of the disc seal but the hardness values of both seals was acceptable. The ‘O’ ring seal did not exhibit evidence of degradation or aging. 4.4 Engine Performance Assessment. Rolls-Royce was tasked to carry out a performance assessment to establish whether or not the engine was performing as expected leading up to and just prior to the accident. To assist the AAIB in their investigation Rolls-Royce were also asked to establish a set of engine performance parameters that could be used with a different mark of Avon engine (Mk207) in flight trials. These parameters were:

1. The rpm for a Mk207 to give the equivalent thrust to a Mk122 at full throttle (8150 rpm)
2. The rpm for a Mk207 to give the equivalent thrust to a Mk122 whilst performing the final

airshow manoeuvre. To conduct the assessment Rolls-Royce was provided with engine speed (rpm) and Jet Pipe Temperature (JPT) from the airshow flight. Jet Pipe Temperature was taken from snapshots of the cockpit gauge via a recording from a camera situated in the cockpit. Engine rpm was obtained from frequency (spectrographic) analysis of the cockpit noise recording. This data was supplied by the AAIB following an assessment which found a good correlation between the two parameters and expected values. The Performance Brochure for the Mk122 obtained from a Rolls-Royce archive contained a chart which detailed jet pipe temperature, thrust and specific fuel consumption against engine rpm for ISA, SLS conditions (i.e. standard day conditions of 15̊C and 14.696psi). The relationships between JPT and rpm, and thrust and rpm, used in this analysis have been taken from this data. Performance and configuration data for Rolls-Royce engines as of August 1983; state that for the Mk207 the minimum thrust at sea level is 9950lb at 8000rpm. To perform the required analysis for the Mk207, a performance definition was required. There was no performance model of the Mk207; however, there was a performance model for a higher rated Avon Mk200 series engine. This model was created in 2004 and was considered the most likely to represent the Mk207 minimum thrust at sea level of 9950lb at 8000rpm. Therefore, a thrust versus speed relationship was derived for the Mk207 by interpolating between the higher rated Mk200 and the lower rated Mk122, based on the ratio of thrusts between the three marks at 8000rpm. The interpolated Mk207 performance characteristics have therefore been used in the subsequent analysis. In order to carry out the analysis a standard assumption used commonly in engine performance analyses has been utilised. This assumes that engines behave non-dimensionally when operating between choked nozzles, for a fixed engine geometry. It is possible to define, for each common performance parameter (thrust, engine speed, pressure, temperature and mass flow), a full non-dimensional version and a more commonly used semi- dimensional version that allows performance parameters to be compared at different flight conditions. Dimensional parameters plotted at different flight conditions will combine onto the same line if plotted non-dimensionally, figure 26. Equally, non-dimensional corrections can be used to establish engine performance at other flight conditions for a given input. It should be noted that brochure performance such as that used here is stated at uninstalled, steady state conditions (i.e. stable and well thermally soaked) and for a new engine. Variations such as airframe architecture, including power off-takes and air bleeds and allowing for intake losses, engine deterioration and non-stabilised conditions, will all affect the relationship. Therefore it has not been possible to quantify the effects of these uncertainties in the analysis due to the lack of available data.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 249 © Crown Copyright 2017 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 10 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc. To assess the performance of the engine during the accident sortie the analysis was carried out at two spot points. The points chosen were taken when the engine was operating at a relatively stable condition. This aligns with the performance brochure data which is quoted at steady state condition. JPT was the parameter used as this is a good indicator of engine health and performance. The analysis results show a good alignment between the Mk122 brochure derived JPT and the JPT retrieved from the airshow data. This gave a level of confidence that the engine was performing largely as expected and that no major performance changes had taken place. The results are within expectation given the uncertainty around engine installation, stabilisation and deterioration. However, it has not been possible to combine the engine parameters obtained from the airshow flight with the throttle lever position, therefore it cannot be determined if the level of thrust delivered by the engine matched that demanded by the pilot. The analysis to establish the rpm required for a Mk207 to give the equivalent thrust to a Mk122 at full throttle (8150 rpm) gave an average target mechanical speed of approximately 7400rpm. However, this result has a number of caveats associated with it. These include: a) The Mk207 characteristic used is a derived characteristic based on a crude interpolation from two other Avon marks. b) Effects such as stabilisation, engine installation and engine deterioration will affect the thrust versus speed relationship for each engine. The analysis assumes each engine is developing thrust in line with the brochure or derived characteristic. c) No account is taken for any differences in airframe configuration which may affect aerodynamic performance. d) Potential operability issues associated with operation at part power, e.g. blow-off valve operation, have not been assessed. The third analysis was to establish the rpm for a Mk207 to give the equivalent thrust to a Mk122 whilst performing the final airshow manoeuvres. Flight conditions for this assessment have been extracted from the originally supplied data. Three manoeuvres were considered, these were the initial pull up, the rpm reduction between pull up and inverted flight and while inverted. Five different flight conditions were also used at each of these manoeuvres to take into account uncertainty in determining the exact flight condition. Additional flight conditions of 1000ft and 3000ft, each at ISA-5 and ISA-10 were also used to give a range of 20 different Mk207 engine speeds. These are shown in figure 27. The resultant engine speeds required at each of the airshow manoeuvre points and for each of the flight test points show very little difference. These have been plotted alongside the engine speeds observed during the airshow and can be seen in the figure 28. 5 CONCLUSION  Strip examination of the engine found that its condition was commensurate with its age with no evidence of pre-accident anomalies.  Debris found within the core of the engine was consistent with the engine operating at the point of impact.  Detailed strip examination of the accessory units found nothing that would prevent the engine from operating across its full speed range.  Laboratory examination of the seals and diaphragms from the accessory units found that some had evidence of age degradation. However, there was no evidence that seal or diaphragm integrity had been compromised or that they would have prevented the engine from operating normally.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 250 Appendix E (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 251 © Crown Copyright 2017 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 12 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc. 7 FIGURES

Figure1: A view looking at the front of the engine while installed

Figure 2: A section of the 2nd stage (LP) turbine viewed through the distorted exhaust unit.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 252 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 13 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 3: A view of the left side of the engine after removal from the airframe. Although the front half is coated in a layer of soot from the post-accident fire, the engine is complete.

Figure 4: A view looking at the front of the engine. The level of ingested post-accident debris is clearly visible.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 253 © Crown Copyright 2017 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 14 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 5: This is a view of the rear of the engine showing the distorted exhaust unit.

Figure 6: A closer view of the variable inlet guide vanes. The majority of debris has been removed at this stage.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 254 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 15 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 7: The top section of the compressor half casing. All the stator vanes are present but are coated in a layer of post-accident fire soot.

Figure 8: A general view of the compressor. Blade distress is clearly visible and the post-accident fire sooting is clearly visible.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 255 © Crown Copyright 2017 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 16 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 9: a close up view of the mid-stages of the compressor. Damage to the leading and trailing edges of all the blades can be seen.

Figure 10: A piece of ingested debris was found within the stage 11 blades, (arrowed)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 256 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 17 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 11: A general view inside one of the combustion chambers. All the inspected chambers were similar and considered satisfactory.

Figure 12: A section of HP guide vanes viewed through the nozzle box.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 257 © Crown Copyright 2017 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 18 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 13: A general view of the 2nd stage (LP) turbine. All the blades were present and the general condition of the turbine was considered satisfactory.

Figure 14: A general view of the dual fuel pump after removal of the fuel inlet cover. The orange coloured liquid is the result of post-accident water ingress.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 258 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 19 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 15: The condition of the pistons within each pump was satisfactory. The post-accident water damage is also evident.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 259 © Crown Copyright 2017 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 20 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 16: a general view of the dual fuel pump diaphragm.

Figure 17: A close up view of the ‘mud cracking’ and tide marking seen in the convoluted section. Tide marking

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 260 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 21 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 18: The metering section of the FCU plunger was clean and in a satisfactory condition.

Figure 19: After removal of the metering plunger its general condition was considered to be satisfactory

FCU plunger metering section.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 261 © Crown Copyright 2017 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 22 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 20: One half of the HP shut off cock housing. The internal components were clean and the ‘O’ ring seals were in a good condition.

Figure 21: This is the opposite half of the shut off cock seen in figure 19. The valve was clean and its operation was smooth and unrestricted.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 262 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 23 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 22: A general view of the bellows assembly and components from the adjuster housing within the ACU

Figure 23: The pressure balance lever for the ACU which was considered to be in a good visual condition. The black deposit noted during the strip can be seen close to the needle roller contact point.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 Appendix E 263 Appendix E (Cont) © Crown Copyright 2017

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 24 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 24: The bellows assembly of the BPC while installed. The damping oil around the bellows was clean with no visual evidence of contamination.

Figure 25: Another view showing the clean condition of the BPC adjustment housing.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 264 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 25 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 26: Graphs showing the use of non-dimensional values.

Manoeuvre Flight Condition Starting Altitude and OAT for each Flight Condition Start of pull-up 1000ft 300KIAS 1000ft ISA-5 1000ft ISA-10 3000ft ISA-5 3000ft ISA-10 Mid pull-up 1 1800ft 240KIAS Mid pull-up 2 2200ft 200KIAS Inverted 1 3400ft 100KIAS Inverted 2 4400ft 100KIAS Figure 27: This details the 20 different flight conditions used to determine the equivalent Mk207 engine speeds.

N T 𝑇𝑇 𝜃𝜃

𝑁𝑁 √𝜃𝜃

Engine temperature versus engine speed at two different flight conditions Same data plotted non-dimensionally: Non- dimensional engine temperature versus non-dimensional engine speed collapse onto same line

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix E 265 Appendix E (Cont)

Security classification Private – Rolls-Royce Data

Document number EFI/1186 Issue 1 Security classification Private – Rolls-Royce Data

Page 26 of 26 ©2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce plc and may not be copied, or communicated to a third party, or used for any purpose other than that for which it is supplied, without the express written consent of Rolls-Royce plc.

Figure 28: Engine mechanical speed and thrust comparison fixed flight conditions.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 266 Appendix F Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 1 of 25 EXTERNAL CIRCULATION AUTHORISATION AND EXPORT CONTROL (Ref. ES 32-206) MER reports MUST NOT be circulated outside Rolls-Royce Controls without first obtaining the permission and signature of the Manager of the Project/Function for the subject of this report and then countersigned by the Lead Materials Engineer. TAS Code AD018-800-010-000-403 Department Product Support Date

Part No

Description Fabric reinforced diaphragms Customer Material Type Textile Reinforced Polychloroprene Nitrile Rubber

Material Specification

Unit Type GTD64-1A / ACU / GP10055A / BPC 19- 24U

Serial No

ID Ref

Supplier

Engine

Running Time

Reason for Submission and Additional Information The condition of the diaphragms is required to ascertain their performance integrity. Circulation Export Control Requirements Document Classification Function Manager Date Lead Materials Engineer Date Laboratory Report of ACU, BPC and Hydro-mechanical Governor Diaphragms

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 267 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 2 of 25 1.0 SCOPE OF WORK One solid rubber diaphragm, three fabric-reinforced diaphragms and associated rubber items were submitted for evaluation. All of the components were visually examined, measured for rubber hardness where possible; material identification using Infra-Red spectroscopy. The pump diaphragm was also examined using a Scanning Electron Microscope. 2.0 OBSERVATIONS 2.1 Diaphragms 2.1.1 Pump – Operating in Aviation Kerosene 2.1.1.1 The diaphragm consisted of two centrally located riveted plates with associated spring assembly. Around the plates was a shallow convoluted portion of the diaphragm which had been exposed to aviation Kerosene. The remainder of the diaphragm had been compressed between surfaces acting as a gasket. Both sides of the diaphragm are shown in general view by figures 1 and 2. 2.1.1.2 The diaphragm had not perforated. 2.1.1.3 The convoluted area on both sides had been significantly degraded and the rubber had been now “Mud-Cracked” across the entire working surface. 2.1.1.4 On one side of the diaphragm a “Tide-Mark” could clearly be seen across the convolution, see figure-3. 2.1.1.5 The area associated with the “Tide-Mark” appeared to have a greater degree of “Mud-cracking” of the rubber coating. 2.1.1.6 “Mud-cracking” was at its worst in the area adjacent to the spring retaining plates, where the diaphragm is subject to the most movement when in operation, see figures-3 and 4. 2.1.1.7 To image the “Mud-cracking” more clearly the diaphragm was viewed using a Scanning Electron Microscope,(SEM) using the “Variable Pressure” Mode to avoid charging of the diaphragm, see figures-4 to 9 for Face 1 and Figures-10 to 11 for Face 2.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 268 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 3 of 25 Figure 1 GD64-1A Pump Diaphragm (Face-1) Figure 2 GD64-1A Pump Diaphragm (Face-2)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 269 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 4 of 25 Figure 3 GD64-1A Pump Diaphragm Tide Mark (Face-1) Figure 4 GD64-1A Pump Diaphragm Cracking (Face 2)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 270 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 5 of 25 2.1.1.8 The SEM images of Face-1 show the “Mud-Cracking” was present over the entire surface of the convolution. 2.1.1.9 The contrast between the “Mud-Cracked” convolution, in the “Tide-Mark” and protected clamped area is shown by figure-5. 2.1.1.10 The slightly lesser degree of “Mud-Cracking” of the convolution, not associated with the tide mark, is shown by figure-6. Figure 5 GD64-1A Pump Diaphragm “Tide Mark” Region (Face 1)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 271 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 6 of 25 Figure 6 GD64-1A Pump Diaphragm General Convolution (Face 1)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 272 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 7 of 25 2.1.1.11 A severely “Mud-Cracked” region is shown by figure-7 and a high magnification close-up by figure-8. 2.1.1.12 The “Mud-Cracked” surface of Face -2 is shown by Figures-9 and 10. 2.1.1.13 The “Mud-Cracking” on Face 2 appeared to have a degree of directionality. Figure 7 GD64-1A Pump Diaphragm Convolution (Face 1)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 273 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 8 of 25 Figure 8 GD64-1A Pump Diaphragm Convolution (Face 1)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 274 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 9 of 25 Figure 9 GD64-1A Pump Diaphragm Convolution (Face 2)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 275 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 10 of 25 Figure 10 GD64-1A Pump Diaphragm Convolution (Face 2) 2.1.2 Acceleration Control Unit (ACU) – Operating in Air (x2) 2.1.3 The smaller diameter (~38.5mm) of the two diaphragms consisted of a beaded diaphragm moulded to central anodised aluminium plates. The diaphragm appeared to be a single ply of textile proofed with a Polychloroprene rubber, see figures-11 and 12. 2.1.4 None of the rubber surfaces, convolution or clamped area, exhibited evidence of aging, i.e. cracks, splits or rubber reversion. See figures 13 and 14. 2.1.5 The beaded portion of the diaphragm had taken a permanent compression set, having presumably originally been “O-shaped”, see figure-15. 2.1.6 On the high pressure face there was some evidence of loss of adhesion between the rubber and the metal plates see figure-16.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 276 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 11 of 25 2.1.7 The larger diameter diaphragm, (~63mm) consisted of two plies of a Polychloroprene rubber proofed textile. 2.1.8 None of the rubber surfaces, convolution or clamped area, exhibited evidence of aging, i.e. cracks, splits or rubber reversion. See figures-17 to 20. 2.1.9 The rubber to metal bonding was in good condition with no evidence of delamination or loss of adhesion to the metal plates. 2.2 Barometric Pressure Control – Operating in Aviation Kerosene (Solid Rubber Diaphragm) 2.2.1 This diaphragm was manufactured from a Nitrile Rubber which has inherent resistance to aviation fuel. 2.2.2 Removal from fuel had not had a detrimental effect upon the diaphragm, see figure-21. 2.2.3 The rubber hardness of 73 IRHD was an acceptable value for a rubber material of this type and for the application.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 277 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 12 of 25 Figure 11 Acceleration Control Unit Diaphragm (Small) Face-1

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 278 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 13 of 25 Figure 12 Acceleration Control Unit Diaphragm (Small) Face-2

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 279 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 14 of 25 Figure 13 Acceleration Control Unit Diaphragm (Small) Face-1

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 280 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 15 of 25 Figure 14 Acceleration Control Unit Diaphragm (Small) Face-2

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 281 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 16 of 25 Figure 15 Acceleration Control Unit Diaphragm – Bead Compression Set

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 282 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 17 of 25 Figure 16 Acceleration Control Unit Diaphragm – Adhesion Loss

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 283 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 18 of 25 Figure 17 Acceleration Control Unit Diaphragm (Large) Face-1

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 284 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 19 of 25 Figure 18 Acceleration Control Unit Diaphragm Face-2

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 285 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 20 of 25 Figure 19 Acceleration Control Unit Diaphragm (Large) Face 1

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 286 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 21 of 25 Figure 20 Acceleration Control Unit Diaphragm (Large) Face 2

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 287 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 22 of 25 Figure 21 Barometric Pressure Control Solid Diaphragm

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 288 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 23 of 25 3.0 OTHER ITEMS 3.1 The BPC Seal was a small solid Nitrile rubber disc with a beaded edge. The hardness of the seal was 76° IRHD which is an expected value for a material used for the application. 3.2 The beaded section of the BPC seal had taken a minor compression set but was within the original dimensions for a seal of this type, 0.084” (Ref. PN7061156). 3.3 A Nitrile O-ring of cross-section 0.070” and hardness 78° IRHD demonstrated some permanent deformation from the installed configuration but there was no evidence of degradation or ageing. 4.0 DISCUSSION 4.1 GD64-1A Pump Diaphragm 4.1.1 This diaphragm was manufactured from two-plies of a Polychloroprene rubber proofed textile. Depending upon the date of manufacture the textile will either be cellulose type cotton (Fortisan) or polyester type (Terylene). Both textile types have similar properties. 4.1.2 The base polymer used for the rubber compound, Polychloroprene, has a known limited life in aviation kerosene. 4.1.3 However, when managed correctly any equipment containing a diaphragm manufactured from a Polychloroprene will not proceed to a point at which the resistance of the rubber composition to kerosene has been exceeded, i.e. aged. 4.1.4 The “Mud-Cracking” seen across the entire surface of the working convolution was a combined result of calendar life and exposure to kerosene. 4.1.5 The appearance would suggest there have been significant periods of non- operation where fuel will slowly degrade to form active chemical species (peroxides) that will then go on to attack the rubber. 4.1.6 The appearance of a “Tide-Mark” across the convolution was also evidence to suggest the diaphragm has been subject to periods of inactivity and where the fuel has been allowed to drain away. 4.1.7 Draining the fuel away from the diaphragm, whilst reducing the exposure to degrading species, also results in the rubber loosing flexibility and will crack because the fuel can no longer act as a plasticiser for the rubber.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 289 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 24 of 25 4.1.8 The absence of plasticising fluid results in shrinkage of the rubber and then cracking. 4.1.9 The interchange of a plasticiser, added to rubber during manufacture, with kerosene when installed, is a well understood phenomenon. It is the reason why equipment containing diaphragms and rubber seals is not left static without constant exposure either to kerosene or inhibiting fluid, when not in use. 4.1.10 To establish the chemical state of the rubber in the convolution Fourier Transform Infra-Red (FTIR) was used. This technique was able to show a chemical signature of a Polychloroprene rubber used for this design of diaphragm and the difference between the degraded surface and unaffected flange area. 4.1.11 The appended trace appears to show a significant loss of the peak associated with an “alkyl halide” (C-Cl) at around 1280 wave numbers. 4.1.12 The loss of the alkyl halide is indicative of a chemical degradation process. 4.1.13 The degradation of the rubber on both faces of the convolution, due to the effects of age, loss of flexibility and chemical interaction with fuel have resulted in a diaphragm that has exceeded the known predictable functional capability of the design. 4.2 Acceleration Control Unit (ACU) Diaphragms 4.2.1 Both diaphragms operate in air and so are not exposed to the degrading effects of aviation kerosene or the presence of chemically active species that can arise in kerosene. 4.2.2 Both diaphragms, being manufactured from a Polychloroprene, have inherent resistant to atmospheric ozone which is known to affect other rubber materials such as Nitriles. 4.2.3 The compression set witnessed on the bead was significant and would be expected to cause leakage eventually, especially when sealing against a gas rather than a fluid. 4.2.4 The loss of adhesion between the rubber and the metal plate may have been a product of disassembly or evidence of a life limiting feature. There was no evidence, delamination, that air had entered the rubber textile construction.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix F 290 Appendix F (Cont) Controls Materials Evaluation Request MER 10474 ©2015 Rolls-Royce Controls and Data Services Limited The data contained in this document, is the property of Rolls-Royce Controls and Data Services Limited and it may not be copied or communicated to a third party, or used for any purpose, other than that for which it was supplied, without the Company’s prior written consent. Page 25 of 25 4.3 Barometric Pressure Control Solid Diaphragm 4.3.1 This was a solid rubber diaphragm manufactured from a Nitrile rubber which has an inherently greater resistance to aviation kerosene than Polychloroprene rubber. 4.3.2 There was no evidence of distress to the diaphragm. 5.0 CONCLUSION 5.1 With the exception of the Pump Diaphragm the components submitted were in an acceptable condition. 5.1.1 The condition of these components was typical of operating in an environment where calendar life, rather than thermal stress was a significant cause of any “ageing”. 5.1.2 The loss of adhesion seen on the smaller of the ACU diaphragms was likely to be a product of disassembly. 5.1.3 None of these components had reached a condition that had exceeded the know capability of the design or materials. 5.2 The Pump Diaphragm was significantly degraded by the effects of age, exposure to fuel and also air above the “Tide-Mark”. 5.2.1 The condition of the Pump Diaphragm was significantly more degraded than would be acceptable for a unit from a managed fleet. . 5.2.2 Whilst the diaphragm had not failed, its continued integrity would be severely affected by the degraded condition of the rubber both above and below the “Tide- Mark”. 5.2.3 The combined degrading effects of age, exposure to aviation kerosene and air have resulted in the pump diaphragm exceeding the known predictable functional capability of the materials it was manufactured from.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix G 291 Appendix G Mandatory Permit Directive 2016-001

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix G 292 Appendix G (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix G 293 Appendix G (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix G 294 Appendix G (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix G 295 Appendix G (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix G 296 Appendix G (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 297 Appendix H Report on Data Gathering Flying Related to the Accident to G-BXFI 1  Report on Data Gathering Flying   

1. Introduction One aspect of the investigation into the reasons why, on 22 August 2015 at the Shoreham air

show, Hunter T Mk 7 G-BXFI struck the ground during the latter stages of a looping manoeuvre was to undertake data gathering flying in an appropriate airframe in order to ascertain how and why the apex airspeed and altitude were achieved and why the aircraft impacted the ground during a subsequent pull-through. This report details the flying performed and presents the data gathered along with relevant discussion and conclusions. It also includes some relevant analysis of the cockpit GoPro video. In order to help understand the manoeuvres flown some of the relevant theory is covered below.

a. Factors Determining the Apex Height and Airspeed of Looping Manoeuvres The apex of a looping manoeuvre is the point at which the maximum height is achieved and is coincident with the point at which the minimum airspeed occurs. The aircraft is in a wings level, essentially inverted attitude although it will actually be slightly nose low if a high angle of attack and high pitch rate is maintained through the apex. In a straight loop entered from level flight and constant airspeed there are three factors that determine the apex airspeed and the increase in height above the entry height, namely entry airspeed, engine thrust and the manner in which the pilot flies the pull-up in terms of the pitch rate/normal acceleration/Angle of Attack (AOA) that is used. If the pilot also 'bends' the loop during the first, upward half of the manoeuvre (i.e. applies a roll rate for a brief period such that the vertical plane of the loop is adjusted to achieve a different heading on completion of the manoeuvre to that at pull-up) the apex height and airspeed will be affected.

b. Straight Loop In a straight loop the interrelationship between airspeed, thrust and pull-up technique is discussed below, and this description assumes the same entry height, density altitude and all up mass, and entry with power for level flight for the entry speed. The entry kinetic energy (airspeed) is partially converted into potential energy (height) during the pull up. In addition, the overall energy state of the aircraft will be reduced somewhat during the pull up due to the increased lift dependent drag generated by the higher AOA. How much of the airspeed is converted into height is essentially a function of how long it takes to reach the apex of the loop and this time depends upon the pitch rate of the aircraft, which the pilot normally controls by flying a value of normal acceleration (g) or AOA (the latter often by feel as a certain level of buffet), or by a cadence (pitch rate) that is judged based on experience and practise. For a given entry speed and thrust, the greater the normal acceleration/AOA used by the pilot the lower will be the apex height, and unless the increase in lift dependent drag is excessive this will also result in a higher apex airspeed. Conversely, if the pilot uses a slacker pull-up a higher but slower apex will be achieved. However, if the pull-up is too slack then the aircraft may decelerate to zero airspeed before the apex is reached. Therefore, for a given entry airspeed and engine thrust setting there will always be a maximum height that can be achieved whilst still maintaining the required speed to complete the manoeuvre. But if with the same entry speed more thrust is used, the pilot can fly a slacker pull-up and thereby achieve a greater apex height whilst still maintaining the required airspeed to safely complete the manoeuvre; note that apex height will not be increased significantly if the thrust is increased but the same pull-up g/AOA/pitch rate is applied. Similarly, for a given thrust the apex height can be increased by having a higher entry speed. The height gained will always be relative to entry height so if entry airspeed, thrust and pull-up g/AOA/pitch rate are fixed, the apex height will increase if entry height is increased.

c. 'Bent' Loop If a roll component is introduced into the upward half of the loop in order to 'bend' it, for a given entry speed, thrust setting and pull-up g/AOA, the aircraft will reach the apex of the manoeuvre sooner, resulting in lower height and higher airspeed than in a straight loop. Therefore, combined with the factors discussed in paragraph 1b above, a low apex height will be achieved if a

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 298 Appendix H (Cont) 2  Report on Data Gathering Flying    looping manoeuvre is flown from a low entry airspeed with a maximum pitch rate pull-up and with a 'bend' introduced during the pull-up.

Test Philosophy Two specific cases were investigated during this assessment. The first, which constituted the majority of the assessment, related to the parameters of the accident manoeuvre. The second case was flown using the nominal parameters for the manoeuvre that the accident pilot had stated during interview. The values for the accident manoeuvre parameters were derived from various sources: IAS and JPT from cockpit GoPro video and RPM from analysis of the GoPro audio. The timing of the aileron application during the upward half of the manoeuvre was based on a lateral stick deflection observed on the GoPro video. The apex height was deduced from Mode C radar traces. No data was available for the g or AOA during the manoeuvre but because the apex height was so low, the upward half of the manoeuvre was assumed to have been flown with the maximum pitch rate achievable which required maximum instantaneous lift i.e. in light to moderate buffet. The effects of thrust variations upon the accident manoeuvre were assessed because of thrust changes during the accident manoeuvre.

Sortie Details Two data gathering sorties totalling 1 hour 25 minutes of airborne time were flown from RAF Scampton on 19 October 2015. Following analysis of the data from these sorties, and with further information having been gathered during other aspects of the investigation, a decision was made to fly a third sortie. Therefore, a 55 minute sortie was flown on 4 December 2015, again from RAF Scampton, in order to gather more data. All times quoted are UTC.

Pilot Details The pilot who flew the data gathering sorties was a qualified military test pilot and test pilot instructor whose was in current flying practise on several military fast-jet types. He was current to fly military registered Hunters and held a UK ATPL with a Type Rating Exemption for Hawker Hunter aircraft. He held a UK Display Authorisation for the Hunter and was a Display Authorisation Examiner for Class G aircraft (which covers the Hunter). He had Hunter display experience under both UK Military and UK CAA regulations. He had over 1000 flying hours in the Hunter and over 10 000 hours total flight time.

Aim and Objectives The aim of the sorties flown was to gather data to gain an understanding of the accident manoeuvre. There were four specific objectives:

a. To ascertain if, having reached the apex of the accident manoeuvre, it was possible to have flown an alternative 'escape' manoeuvre such that a collision with the ground could have been avoided.

b. To identify if, having reached the apex of the accident manoeuvre, it was possible to have continued the pull through manoeuvre as attempted and have avoided a collision with the ground.

c. To identify the factors that resulted in the flight conditions achieved at the apex of the accident manoeuvre.

d. To ascertain if a 'bent loop' manoeuvre could be flown safely if entered with a different combination of airspeed, pull-up technique and power to those used in the accident manoeuvre, specifically the nominal parameters declared by the accident pilot

• Airframe Used for Data Gathering The aircraft flown for the data gathering was a Hawker Hunter F Mk 58

which was owned and operated by HHA Ltd. It was a UK MAA registered aircraft with the tail number ZZ190 and was flown in accordance with MAA regulations. It had certain specific differences from G-BXFI as detailed below. Any aspects that are relevant to the performance and flying qualities of the tasks flown that are not mentioned below were essentially identical between the two airframes. Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 299 Appendix H (Cont) 3  Report on Data Gathering Flying    a. Engine ZZ190 was fitted with an Avon Mk 207 engine which produced 10 150 lbs of thrust under static ISA sea level conditions. G-BXFI was fitted with an Avon Mk 122 engine which produced 7575 lbs of thrust under the same atmospheric conditions. Rolls Royce provided data to indicate the RPM required to be set on a Mk 207 engine in order to produce the same thrust as for a specified RPM on a Mk 122 engine. Therefore, it was possible to fly the tasks with thrust settings equivalent to those used in the accident manoeuvre as specified in Table 1.

Mk 122 RPM Equivalent Mk 207 RPM Relevance 8100 7400 Maximum T Mk7 thrust 7950 7250 Thrust for lift boundary comparison 7500 6900 RPM setting at pull-up 7200 6600 RPM setting at apex Table 1 - Equivalent Power Settings

b. External Stores Configuration G-BXFI was fitted with an inboard and an outboard pylon on each wing with a 100 gal external fuel tank carried on each inboard pylon. ZZ190 had aerodynamically identical pylons and fuel tanks fitted but in addition had a Swiss shoulder pylon fitted underneath each wing root. This had the effect of increasing drag slightly, thereby reducing the airspeed of ZZ190 slightly for a given thrust setting and making that the worst case airframe. The shoulder pylons should have had no other effects upon performance or flying qualities.

c. Nose Shape A Hunter T Mk7 has a two-seat, side-by-side cockpit that results in its fuselage having a wider nose than that of a single-seat F Mk58 and, theoretically, the difference in nose shapes could result in a difference in the overall lift produced by the airframe which could affect height loss in the downward half of a looping manoeuvre. Data from weapon aiming sight depression calculations indicated that when in a 15 dive at low level and 400 KIAS the AOA at which a T Mk 7 flew was 11.6 mRads (0.66) less than that for a single-seat variant, implying that the T Mk7 flew more nose low for given conditions at this speed and at close to 1g. The mathematics of this result from the T Mk7 having a lift curve slope (relationship between coefficient of lift and AOA) that was 0.36% greater than that of the F Mk58 (i.e. a T Mk7 will have a very slightly greater increase in lift for a given increase in AOA than a F Mk58 will), plus an angle between the 'Zero Lift Line' (ZLL) and the 'Longitudinal Fuselage Datum' (LFD) that was 8.5 mRads (0.49) greater than that of the F Mk58 (LFD below the ZLL). Overall, these are very small differences with respect to the instantaneous turn performance of the aircraft and this data relates to low AOA conditions. No comparative lift data at high AOA was available and, therefore, some tests were flown to ascertain if any differences existed at the AOAs relevant to high AOA looping manoeuvres.

d. Flaps The flaps on the two relevant marks of Hunter were identical except that the F Mk58 had a small cut-out on the inboard corner of each trailing edge to allow larger fuel tanks to be carried. Within the experimental accuracy of the test data, the resulting difference in lift coefficient due to these cut-outs is probably insignificant, and no difference related to the modification standard of the flaps is annotated in the performance manuals with respect to any performance data.

e. All Up Mass and Centre of Gravity

(1) ZZ190 Sorties 1 and 2 with Nose Ballast The All Up Mass with full fuel was 20703 lbs with a C.G position of 4.966 ins aft of datum. The Zero Fuel Mass was 16053 lbs with a C.G position of 7.333 ins aft of datum. Start up fuel mass was 4650 lbs.

(2) ZZ190 Sortie 3 without Nose Ballast The All Up Mass with full fuel was 20121 lbs with a C.G position of 5.109 ins aft of datum. The Zero Fuel Mass was 15471 lbs with a C.G position of 7.608ins aft of datum. Start up fuel mass was 4650 lbs.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 300 Appendix H (Cont) 4  Report on Data Gathering Flying   

• G-BXFI Weight and Balance

a. Aircraft Details The All Up Mass with full fuel was 18814 lbs with a C.G position of 3.710 ins aft of datum. The Zero Fuel Mass was 14087 lbs with a C.G position of 8.821 ins aft of datum. Based on a SG of 0.778 (measured from the bowser at refuel) start up fuel mass was 4824 lbs and internal fuel was 3270 lbs.

b. All Up Mass and CG Position at Impact The Hunter T Mk7 uses approximately 400 lbs of fuel for start-up, taxi and take-off (SUTTO) with the end of this phase being approximately 1 minute after take-off for the sorties considered in this report. The Aircrew Manual (Hunter T Mk7 & 7A Aircrew Manual', AP 101B-1302 & 3-15, 3rd Edition, AL9 dated Sep 1992) quotes 280 lbs for SUTTO but experience has shown that this is a very optimistic figure and, empirically, 400lbs has been accepted as an average value . On the accident sortie the take-off time was 1204 with the first radar trace at 1206:32 when 7.6 nm SSE of North Weald. The final radar trace was at 1222:19. The radar traces show the ground distance flown from first plot to impact was 75.4 nm with a flight time over this distance of 15 minutes 47 seconds. This gave a mean groundspeed of 287 kts, which was rounded to 300 kts for the purposes of using Aircrew Manual fuel consumption data for the transit from North Weald and initial display manoeuvres. The performance data in the Hunter T Mk7 Aircrew Manual indicated that the fuel consumption at this speed should be 52 lbs/min. With the SUTTO phase being complete approximately 1 minute after take-off, the total time for which a mean fuel consumption of 52 lbs/min can be assumed was approximately 17 minutes, which would result in a theoretical fuel usage for this phase of 884 lbs. Therefore, for a start up fuel weight of 4824 lbs the fuel weight at impact was, based on the above values of fuel used for SUTTO, the transit and the start of the display, 3540 lbs giving an AUM of 17 627 lbs. The cockpit fuel gauges indicated that the internal tanks were full at impact confirming that the fuel weight was greater than 3270 lbs. However, the assumptions in the above calculations do contain some unquantifiable errors and therefore the calculated figure has been rounded to a best estimate for All Up Mass at impact of 17600 lbs. This would equate to a fuel quantity in the external underwing tanks of 326 lbs and a C.G position of 3.97 ins aft of datum.

Significant Weight and Balance Differences Between G-BXFI and ZZ190 The Zero Fuel Mass (ZFM) of ZZ190 for sorties 1 and 2 when the nose ballast was fitted was 1966 lbs greater than that of G-BXFI; its ZFM for sortie 3 when the nose ballast had been removed was 1384 lbs greater than G-BXFI. Based on this and with knowledge of the fuel weight in any given manoeuvre flown in ZZ190, the difference in its AUM compared to G-BXFI at the time of the accident can be ascertained. G-BXFI had a slightly further aft c.g. position with zero fuel and slightly further forward c.g. position with full fuel than ZZ190. Therefore, the tests were within the range of c.g positions for G-BXFI. Any c.g. differences would have resulted in a slightly different tailplane angle for trim at a given airspeed but the effect of this upon the difference in instantaneous turn performance would have been be negligible.

Sortie Details

a. Sortie 1: Take-off 1010, land 1054. Manoeuvres flown: Escape manoeuvres, minimum radius loops.

b. Sortie 2: Take-off 1303, land 1342. Manoeuvres flown: Straight and bent loop comparison.

c. Sortie 3: Take-off 1221, land 1314. Manoeuvres flown: Optimum entry condition bent loops, minimum radius loops, lift boundary wind up turns.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 301 Appendix H (Cont) 5  Report on Data Gathering Flying   

• Meteorological Conditions The relevant meteorological conditions at RAF Scampton (airfield elevation

202 ft) for the sorties flown were: a. Sortie 1: QFE 1018 hPa; QNH 1026 hPa; OAT +12C; Dew point +9C. Density altitude -391 ft.

b. Sortie 2: QFE 1018 hPa; QNH 1025 hPa; OAT +13C; Dew point +5C. Density altitude -272 ft.

c. Sortie 3: QFE 1014 hPa; QNH 1021 hPa; OAT +10C; Dew point +7C. Density altitude -482ft.

d. Wind Data The surface winds were observations taken at RAF Scampton. The 2000 and 5000 ft winds were estimates by the Meteorological Office at RAF Waddington. Sorties 1 and 2 Time Surface wind 2000 FT wind 5000 FT wind 0950 010 06 KT 020 15 KT 060 10 KT 1050 060 10 KT 040 15 KT 070 10 KT 1250 040 08 KT 040 15 KT 010 05 KT 1350 030 09 KT 040 10 KT 350 05 KT Sortie 3 Time Surface wind 2000 FT wind 5000 FT wind 1150 230 17 KT 260 40 KT 280 25 KT 1250 230 16 KT 260 40 KT 280 25 KT 1350 210 15 KT 260 40 KT 260 45 KT

1. Shoreham Meteorological Data The relevant meteorological data for Shoreham (airfield elevation 7 ft) at

the time of the accident were: QNH 1013; OAT +24C; Dew point +17C. Density altitude 1310 ft.

1. Accident Video and Photographic Data Sources of information in establishing the test parameters for the

data gathering sorties and analysing the aircraft's flightpath included the GoPro camera video recordings from the accident flight plus ground-based video recordings. The pertinent aspects are detailed below:

a. Airspeed The right hand instrument panel ASI was recorded on the cockpit GoPro. The analysis of this video that had been completed at the time of the data gathering flying indicated an airspeed at pull up of 300 KIAS and a minimum airspeed at the apex of 100 KIAS. The maximum speed during the second half of the accident manoeuvre was analysed as 210 KIAS which was reached at approximately 45 nose down erect; it then remained essentially constant until just prior to impact. Subsequent more detailed analysis has indicated that the airspeed at pull-up was 310 ± 15 KIAS and that at the apex was 105 ± 2 KIAS. Discussion of airspeeds in this report are based upon the values assumed at the time of the data gathering flying.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 302 Appendix H (Cont) 6  Report on Data Gathering Flying    b. Engine Thrust The video recording of the take-off showed a maximum Jet Pipe Temperature (JPT) of approximately 680C. At pull-up for the accident manoeuvre the JPT was approximately 540C. During the accident manoeuvre the JPT gauge indicated a minimum of approximately 480C and a maximum of approximately 550C. This indicated that the engine was not developing full thrust at pull-up and that the thrust did vary during the manoeuvre. In particular, the JPT reduced after the initial pull-up, indicating a further reduction in thrust, and then increased slightly as the apex was reached. It was not possible to replicate these thrust variations precisely and therefore test manoeuvres were flown using a fixed thrust setting or with a single variation of thrust at the apex to achieve worst or best case data.

c. Flying Control Status The Hunter flight control system incorporates 'hydro-boosters' for the elevator and ailerons which enable stick movements to be made with very low applied forces. If the powered flying controls are switched off or if the hydraulic system fails, control of the elevator and ailerons is purely manual and the forces required to move the stick are very high. During the initial run in, the first manoeuvre of the display and for parts of the final manoeuvre the top of the right seat stick can be seen. When pilot inputs were made to move the stick, the rate of movement observed was at times greater than would have been possible if the powered flying controls had been inoperative, including during the final manoeuvre. Therefore, it is reasonable to assume that the powered flying controls were functioning correctly throughout the flight and had not reverted to, nor been selected to, Manual mode. In addition, the switch for the Tailplane and Elevator Interconnection (sometimes referred to as the Follow-Up Tailplane) can be seen to be in the OFF position which is normal when flying at speeds less than 0.9M.

d. Accelerometer At the start of the take-off roll, the instantaneous needle plus the maximum and minimum needles all indicated slightly under +1g. During the take-off roll the vibrations caused the maximum and minimum needles to be moved (which is normal on a rough runway surface) and the instantaneous needle to read approximately 0.5g. During the run-in for the display the maximum and minimum pointers showed less than immediately after take-off, indicating that the pilot probably had pressed the 'reset' button at some point in flight. From commencing the display until reaching approximately 30 nose down erect in the latter stages of the final manoeuvre the accelerometer needles did not move, with the instantaneous pointer showing 0g, the maximum needle showing +4g and the minimum needle showing -1g. On reaching this point in the manoeuvre camera vibration started, almost certainly caused by heavy airframe buffet due to being at high angle of attack. The maximum pointer then moved to and maintained full scale deflection high (+10 g) followed shortly after by the instantaneous needle moving to and stabilising at +2g. The minimum needle then went to full scale deflection low (-5g). These g values could not have been achieved with the indicated airspeed and observed pitch rate of the aircraft. All of the aforementioned indications demonstrated that the accelerometer was not functioning correctly. When flying a looping manoeuvre in aircraft such as the Hunter the pilot normally applies, and initially maintains, a given value of g at the pull up in order to achieve the desired profile and make the required apex height. Therefore, if the accelerometer is not working correctly the pilot is denied an important cue for helping to achieve the desired apex height and thus flying the loop correctly. So saying, for upward half loops when there is no intention to pull down through the vertical and a gate height is not required the aircraft is often flown by feel at a certain level of buffet and for such a manoeuvre an accelerometer is not required. Another implication of not having a correctly functioning accelerometer is that at speeds above corner speed (the minimum speed at which the g limit can be reached) the pilot has no indication of whether or not he has exceeded the g limit of the aircraft. This last factor could lead a pilot to attempt to fly at slower than normal speeds such that the g limit could not be reached and thus avoid an overstress.

e. Flightpath Immediately Prior to Impact During the downward portion of the final manoeuvre vibration was observed in the GoPro video throughout the 3 to 4 seconds before impact. This was

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 303 Appendix H (Cont) 7  Report on Data Gathering Flying    almost certainly due to the aircraft entering heavy buffet at high angle of attack. Shortly after onset of the vibration the aircraft rolled approximately 15 left then rolled back towards wings level. At 1.12 seconds to impact the aircraft reached a level pitch attitude (but still with a significant rate of descent) and then pitched rapidly nose up to 13.6 with an associated increase in rate of descent. At no stage during the final seconds prior to impact did the pitch attitude or pitch rate reduce. Specific stall data for the Hunter at the airspeed, normal acceleration and flap setting that existed just prior to impact was not available but some generic comments on the Hunter's stalling characteristics can be made. The stall (here defined as the angle of attack that produces the maximum lift coefficient) usually occurs at between approximately 25 and 35 depending on flap setting and airspeed (as a function of both Mach number and Reynold's number). The characteristics of the stall are typically very heavy buffet, a large increase in drag leading to a high rate of descent and/or rapid deceleration, and often wing rock through up to about ±15 at a frequency of approximately 0.5 Hz. In addition, having a swept wing there is still a significant, albeit reduced, coefficient of lift past the stall, and in an accelerated stall (i.e. when the normal acceleration is greater than 1g) at airspeeds such as existed during the final stages of the accident manoeuvre the elevators will still be effective such that an additional aft stick input at the stall will probably still result in an initial increase in nose up pitch rate, increase in angle of attack and a resultant increase in drag. Therefore, the video evidence is consistent with the aircraft entering an accelerated stall in the final few seconds of the accident manoeuvre and then being pulled into the post- stall regime which was maintained until impact.

• Data Gathering Manoeuvres Flown

a. Upward Half Loop and Escape Manoeuvre These manoeuvres were flown in order to ascertain the height loss that resulted if, at the apex, a decision was made to abort a planned downward pull- through manoeuvre and then to roll erect and regain level flight. They were commenced at a nominal height of 200 ft (altimeter reading with QFE set), at 300 KIAS and with 7400 RPM set. Some were flown with 1 notch of flap (16) and some with 2 notches of flap (23) selected, and the flap setting remained constant throughout the manoeuvre. The upward half loop phase to the apex was flown in light buffet throughout (ie. at maximum useable AOA), with the initial normal acceleration being approximately 4g. The escape manoeuvre involved moving the stick forward to achieve zero pitch rate then rolling through 180 back to erect flight using 1/2 aileron deflection and with the rudder restrained at neutral. The rolls were commenced at various pitch attitudes between when the nose reached the horizon (approximately 5 - 10 nose down) to as low as 45 nose down. On achieving wings level an aft stick input was made to recover the aircraft to level flight in light buffet. The power either remained constant at 7400 RPM or was selected to idle at the apex of the manoeuvre.

b. Minimum Radius Loop The aim of these manoeuvres was to identify the minimum height loss that could be achieved if, at the apex, a decision to continue with a looping manoeuvre was made. The manoeuvres were entered at a nominal height of 2000 ft on sortie 1 and 1500 ft on sortie 3 (altimeter reading with QFE set), at 300 KIAS with 7400 RPM set on sortie 1 and 300 KIAS and 7200 RPM on sortie 3, some with 1 notch and some with 2 notches of flap. The manoeuvres were flown in light buffet throughout (i.e. at maximum useable AOA) with the exception of one where the pull was slackened immediately prior to the apex in order to allow the airspeed to decay to the required value. At the apex the power was either maintained, the throttle selected to idle, the RPM reduced to 6600, or full throttle selected. On all but one manoeuvre the flaps remained constant throughout, the one exception being a selection from 2 to 4 notches (38) at the apex.

c. 'Bent' Loop A series of upward half loops was flown to investigate the difference in airspeed and height at the apex between a straight upward half loop and one that was 'bent' through 45 or 90. The 'bent' loops were flown with a left rolling phase commenced, as per the accident manoeuvre, approximately 5 seconds after pull up (just before the vertical) such that the exit heading of the loop

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 304 Appendix H (Cont) 8  Report on Data Gathering Flying    would be 45/90 greater than the heading at pull up. The pull ups were flown from a nominal height of either 100, 150 or 200 ft (altimeter reading with QFE set) with 1 notch of flap set and at a speed of 290 or 300 KIAS. Power settings were either 7400, 7200 or 7000 RPM. The pull-ups were flown in light buffet throughout (i.e. at maximum useable AOA), including during the rolling phase. The height and airspeed data required was noted at the apex, and for safety of flight these manoeuvres were all terminated just past this point in an escape manoeuvre flown in the manner described in paragraph 13.a above.

d. Nominal Entry Parameter 'Bent' Loop The aim of these manoeuvres, flown on sortie 3, was to ascertain the apex height and airspeed that would be achieved if a 90 bent loop was flown using the accident pilot's declared nominal entry conditions. These were entered at 350 KIAS and 200 ft QFE with 7400 RPM set (equivalent to full power in a T Mk7) and with an initial pull up at 4g. On decelerating through 300 KIAS the required flap setting (1 or 2 notches) was selected. Approaching the up vertical the pull was slackened, albeit with a continuing nose up pitch rate and with more than 1g normal acceleration maintained, and left aileron was applied to roll through 90. On reaching the apex, power was reduced to approximately 6600 RPM and a pull through flown. On accelerating through 300 KIAS the flaps were raised and the aircraft was levelled at 500 ft QFE.

e. Photographic 'Bent' Loops Two upward bent loops were flown purely for ground photographic purposes with the aim of identifying the flap angle set on G-BXFI. These were flown with full F Mk58 power and so were not representative of T Mk7 performance and are not reported upon here.

• Data Sources and Accuracy

a. Throughout this report, the data quoted was gathered from the following sources and to the specified reading resolution:

• Indicated Airspeed: Cockpit ASI to the nearest 5 kts.
• Altitude: Cockpit altimeter to the nearest 100 ft for sorties 1 and 2, and the nearest 50 ft for sortie 3.

In addition, the accuracy of the altimeter was considered to be +/- 50 ft.

• Fuel weight: Cockpit fuel gauges generally to the nearest 100 lbs although some readings were taken

to the nearest 50 lbs (fuel only gauged with a total fuel weight of 2850 lbs and below).

b. It is assumed that for the low altitude tests flown changes in pressure altitude were equal to changes in density altitude ie. the ambient temperature and dew point lapse rates were the same. Therefore, density altitudes quoted are based on the calculated airfield surface density altitude plus altimeter reading with QFE set.

• Results and Discussion

a. Turn Performance Comparison Between Hunter T Mk 7 and F Mk 58 The only significant difference in build standard with respect to instantaneous turn performance (lift produced by the aircraft) between a Hunter T Mk7 and F Mk58 was the nose shape. Data was available from an Empire Test Pilots' School (ETPS) Stalling report written by the assessment pilot on the accelerated stalling performance of a T Mk7 of identical build standard to G-BXFI and which also had an AOA probe fitted. The manoeuvre reported upon was reproduced in ZZ190 with an equivalent thrust setting for comparison. The manoeuvre was a Wind-up Turn (a constant Mach number, constant power descending turn flown with a slow g onset rate to give pseudo-stable data) flown at 0.7 IMN (~300 KIAS) and a datum altitude of 25 000 ft. The power set in the T Mk7 was 7950 RPM and the AUM was 18 000 lbs; 7250 RPM was set in the F Mk58 for thrust equivalence. The relevant data is in Table2 below.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 305 Appendix H (Cont) 9  Report on Data Gathering Flying   

T Mk7 F Mk58 AUM (lbs) 18 000 18 070 17 770 Pressure Altitude (ft) 25 000 24 600 23 500 Buffet onset g 3.0

3.0

Equivalent g (1)

3.04

-- Buffet onset AOA (degs)

17

-- Heavy buffet g

4.0

-- Equivalent g (1)

4.32

1. 3

Heavy buffet AOA (degs)

24

-- Notes: 1. T Mk7 data value corrected to F Mk58 test weight and altitude. Table 2- Instantaneous Turn Performance Data

The ETPS report indicates that after stabilising in heavy buffet the AOA could be increased further from 24 to 26 but that no increase in g occurred. Therefore, the heavy buffet data presented was the maximum instantaneous turn performance for the T Mk7. From the F Mk58 sortie, normal acceleration data was recorded on a specially installed data logger. The normal acceleration trace from the data logger was affected by the airframe buffet which generated high frequency noise. The amplitude of the noise was a band of approximately 0.75g to 1g at buffet onset and approximately 1.5g to 2g in heavy buffet. However, the values of the T Mk7 normal accelerations corrected to the test weights and altitudes that were flown in the F Mk58 (3.04g at buffet onset and 4.32g in heavy buffet) fell in the middle of the noise band of the normal acceleration trace, indicating that there was no significant difference in instantaneous turn performance between the two Marks at the tested conditions. Therefore, the small AOA differences at low AOA and higher speeds resulting from the different nose shapes, as discussed in paragraph 6c, did not result in a measurable difference in instantaneous turn performance between the T Mk7 and F Mk58. Therefore, the lift related data gathered in the F Mk58 is representative of a T Mk7.

b. Escape Manoeuvres During sortie 1, six upward half loop manoeuvres were flown specifically to identify the handling characteristics and height loss during a rolling escape manoeuvre flown post apex as described in paragraph 13.a above. Data from these manoeuvres is presented in Annex A, Table A-

1. In addition, all 12 manoeuvres flown on sortie 2 and which were associated with the bent loop

evaluation described in paragraph 13. c were terminated in a rolling escape manoeuvre on completion of the apex data gathering. The assessed escape manoeuvres in sortie 1 were flown at AUMs that were 1600 - 2300 lbs heavier than G-BXFI was at impact, and those flown on sortie 2 were 750 - 2300 lbs heavier. The implication of flying these manoeuvres at a heavier weight was that the height loss during the escape manoeuvre was greater than would have been achievable by G-BXFI due to the reduction in normal acceleration available for a given airspeed. The density altitude at the apex of the accident manoeuvre was 4000 ft. During sortie 1 the apex density altitudes varied between 3000 and 3400 ft and during sortie 2 between 2400 and 3200 ft. Therefore, the maximum difference between the density altitudes at which the data gathering manoeuvres were flown and that of the accident sortie was 1500 ft. In flight test a tolerance of +/- 2000 ft is the accepted norm for the comparison of aerodynamic data such as this. Therefore, the differences in density altitude between the accident sortie and the manoeuvres flown during sorties 1 and 2 should have had no significant effect on the escape manoeuvre data collected although, theoretically, with a slighter lower TAS for a given IAS at a lower density altitude, the data gathered would indicate slightly less height lost than for the accident conditions. The maximum altitude loss measured during any of the escape manoeuvres was 2300 ft, and this was the extreme case of delaying the roll for 4 seconds past the apex by when the aircraft was 45 nose down. If an identical manoeuvre had been attempted in G-BXFI during the accident manoeuvre the height loss would probably have been less due to it being 1600 lbs lighter AUM than

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 306 Appendix H (Cont) 10  Report on Data Gathering Flying    the test manoeuvre, albeit with the higher density altitude theoretically reducing this benefit slightly. With respect to aircraft handling, the manoeuvres were very straightforward and instinctive to fly for a pilot with fast jet experience, even when a speed as slow as 80 KIAS (20 KIAS slower than that during the accident manoeuvre) was achieved at the apex. The nose dropped noticeably during all of the rolls, as it would with any aircraft type flown in the same manner, because no attempt was made to maintain level flight by the use of elevator or rudder inputs. It was easy to maintain neutral rudder with just light pressure applied to both rudder pedals with no noticeable tendency for rudder float. At no stage was any lateral acceleration felt and the aircraft behaved very predictably, indicating that if the escape manoeuvre was flown in this manner there was no risk of a departure from controlled flight. Philosophically, the escape manoeuvres flown were akin to a 'roll-off-the-top' or 'Immelmann Turn' which is a standard level aerobatic manoeuvre, albeit one whereby an attempt is made to maintain level flight during the roll by the co-ordinated use of elevator and rudder. Based on the aircraft handling and height loss observed during the 18 escape manoeuvres flown during sorties 1 and 2, it would have been possible for an appropriately trained pilot easily to have flown a straightforward escape manoeuvre in G-BXFI at any time up to at least 4 seconds after reaching the apex of the accident manoeuvre and thereby to have avoided a ground collision.

c. Height Loss During Continued Looping Manoeuvre During sortie 1, seven minimum radius loops, as described in paragraph 13b, were flown with varying flap and power settings as detailed in Annex A, Table A-2. However, these were all at apex density altitudes and fuel weights that were higher than those of the accident sortie and, therefore, the data gathered indicated a greater height loss during the pull through than would have been achievable on the accident sortie. Therefore, a further five minimum radius loops were flown during sortie 3 in order to get more comparable data. The pull- up power setting for this latter sortie of 7200 RPM was determined by an attempt to achieve 100 KIAS at the apex. Although the apex airspeeds were slightly higher than that of the accident sortie, a lower power setting was considered to be unwise for safety reasons. The apex density altitudes achieved on sortie 3 had between 0 and +400 ft difference from the accident sortie, and the AUM was from 100 - 800 lbs less. The altimeter reading resolution was tightened to the nearest 50 ft for both the apex and minimum height points. During the sortie 3 manoeuvres the apex airspeeds ranged from 105 - 135 KIAS (100 KIAS in the accident manoeuvre) and the height loss from the apex to regaining level flight varied from 2700 ft to 2850 ft, with the greater height loss values being seen with the highest apex speeds. However, within the accuracy of the tests and the number of tests flown this relationship between height loss and airspeed may have been within the tolerances of how repeatably the manoeuvres could be flown by pure feel (i.e. the AOA) and, therefore, is not conclusive. The total altimeter reading plus instrument error for the sortie 3 data was ± 100 ft and, therefore, the range of height loss was theoretically between 2600 and 2950 ft. Below is a discussion of the effect of relevant factors on the height loss.

(1) Effect of Flap Four of the sortie 3 loops were flown with 1 notch of flap and one with 2 notches. There was no significant difference in the height loss during pull through between the flap angles. On sortie 1 the first 3 loops were flown with 1 notch of flap, the next 3 with 2 notches and the final one with 4 notches selected at the apex. However, the height loss data from this sortie was inconclusive with respect to flap setting due having simultaneous reducing fuel weight and increasing flap deflection. Overall, it was concluded that the height loss during the pull through was not significantly different as a function of whether 1 or 2 notches of flap were selected.

(2) Effect of Mass During the minimum radius loop manoeuvres flown on sortie 3 the AUM reduced from just 100 lbs below the estimated accident mass to 800 lbs below. The height loss during the first and last manoeuvre was the same. Therefore, the data gathered can, with respect to AUM, be considered as representative of the accident sortie.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 307 Appendix H (Cont) 11  Report on Data Gathering Flying   

(3) Effect of Power The effects of power on the height loss were assessed during sortie 1. All of these loops were entered with the equivalent of T Mk7 maximum thrust, and at the apex the power was varied between idle, which was less than in the accident manoeuvre, and maximum which, in the F Mk58, was greater than was available in G-BXFI. Significant differences (80 KIAS) were seen in the speed at the end of the manoeuvres as a function of power setting past the apex but power did not have any significant effect on the height loss with the exception of the final loop with 2 notches of flap when maximum power may have reduced the height loss slightly. The speeds at the top of the loops on sortie 1 were 15 - 20 KIAS greater than that of G-BXFI but the speed at the bottom bracketed that indicated just before impact (210 KIAS) as a function of power, with idle power from the apex giving 190 and 180 KIAS and maintaining the power from apex giving 260 and 230 KIAS for flaps 1 and flaps 2 respectively. These tests indicated that the height loss from apex during the accident manoeuvre was not affected significantly by power setting.

(4) Handling Qualities The buffet amplitude tended to reduce as IAS reduced. During the pull-through phase of the loops which had the lowest airspeed at the apex sometimes a slight roll-off to the right through about 10 with a simultaneous slight rudder float was observed. The slightest reduction in the pull force on the stick at that point reduced the angle of attack sufficiently for these characteristics to cease; it was then easy rapidly to regain the desired level of buffet for continuing a maximum performance pull-out. This demonstrated that at representative airspeeds, weights and altitudes there were cues to the pilot of when he had reached the maximum instantaneous turn performance of the aircraft, and overall the aircraft was easy to handle in this high angle of attack regime.

To conclude, the measured height loss during a representative pull through was between 2700 and 2850 ft, and if altimeter reading and instrument errors were considered the range would increase to between 2600 and 2950 ft. The height loss appeared to be insensitive to whether 1 or 2 notches of flap were selected and to the power setting.

d. Apex Height and Airspeed in a 'Bent Loop' For consistency, all of these manoeuvres were flown with the same flap setting (1 notch). All were flown in the same level of buffet throughout the pull up which aimed to achieve the optimum lift from the wings and thus the minimum radius. Back-to-back comparisons between straight pulls, 45 bends and 90 bends were flown whenever possible to minimise the effects of fuel consumption and reducing AUM. Power was progressively reduced between each test point in order to attempt to achieve the apex speed of the accident manoeuvre. However, reductions below 7000 RPM (400 RPM below that required for equivalence in thrust to full power in a T Mk7 and 100 RPM greater than that for thrust equivalence with the accident manoeuvre RPM at pull-up) were not made for safety reasons due to the low IAS being reached at the apex of the straight pull-ups. The data from these tests are presented in Annex A, Table A-3. The height at the apex of a 45 or 90 bent loop was consistently 300 - 400 ft less than that of a straight half loop flown at essentially the same weight. Commensurately, the IAS was 20 - 30 KIAS greater at the apex of the bent loops (albeit with one comparison being 45 KIAS greater from a 90 bend). In absolute terms, the final 45 bent loop manoeuvre flown reached an apex height of 2800 ft and a speed of 120 KIAS. The aircraft weight for this manoeuvre was 750 lbs greater than for the accident manoeuvre (which would result in a higher apex height if flown at the same AOA) and therefore the apex parameters seen appeared to be consistent with those achieved in the accident manoeuvre (2700 ft and 100 KIAS). The fact that the speed achieved during the test sortie was 20 KIAS higher than in the accident sortie indicated that the accident manoeuvre was probably flown with a lower mean thrust setting than that of this test manoeuvre; this supposition is supported by the RPM spectrum analysis data. In addition, the minimum radius loop tests (see paragraph 15. c(3) above) showed that power had little measurable

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 308 Appendix H (Cont) 12  Report on Data Gathering Flying    effect on looping radius during the downward portion when flown with an AOA for maximum usable lift and so the small amount of extra thrust used during these tests should not have affected the apex heights significantly. The test data showed consistently that any 'bend' during the first half of a loop would reduce the apex height. It is worthy of note that the minimum radius straight loop data from sorties 1 and 3 showed a height gain from pull-up to completion of 300 - 500 ft. The bent loop data showed a reduction in apex height of a similar amount, implying that if a maximum performance pull through in light buffet was not flown there was a strong possibility that the height at completion of a bent loop could be less than the pull-up height. One aspect that was difficult to reproduce was the impact upon the apex height of the precise pitch attitude at commencement of the roll. In the loops flown, the rolls were commenced at 5 seconds after pull up which was based on what was estimated from the cockpit video evidence of the accident flight. This equated to an estimated 80 nose up pitch attitude on the data gathering flights. If on the accident flight the nose up pitch attitude when the roll was initiated was any less than this, as some external video recordings appear to show, then geometrically the apex height should have been lower. However, to achieve a lower pitch attitude in the same time (5 secs) would have required a reduced pitch rate which would have resulted in a greater apex height; therefore there would have been compensating variations and probably little overall difference in apex height as a function of a slightly different technique. Overall, the data gathered during the bent loop tests indicated that the apex height and airspeed of the accident manoeuvre were consistent with a maximum performance pull-up from 300 KIAS with significantly less than full thrust and with a 45-90 bend initiated approximately 5 seconds after pull-up It also showed that the apex height for a 'bent' loop was 300 - 400 ft less than for a straight loop with all other parameters maintained constant.. .

e. Nominal Entry Parameter 'Bent' Loop These were flown as detailed in paragraph 13.d at an AUM of 1500 - 1600 lbs greater than that of G-BXFI when the accident occurred. The manoeuvre flown with 1 notch of flap had apex conditions of 5250 ft and 170 KIAS. The one flown with 2 notches of flap achieved 5750 ft and 155 KIAS at the apex (altimeter heights with QFE set). These manoeuvres were very comfortable and straightforward to fly, and the variability in apex height was probably due to applying slightly different normal accelerations and pitch rates through the pull-up. During the last quarter of the loop the g was reduced in order to make a smooth capture of the 500 ft base height. The apex heights had a significant margin above what would normally be used as a gate height, and the apex speeds achieved were high enough to give a very comfortable margin above the stall. Due to delaying selection of the flaps until the speed had reduced to the 300 KIAS limit, the aircraft had slightly less drag during the pull-ups as flown compared to that for one flown with flaps set throughout. Therefore, the speed at apex would have been slightly higher as flown compared to using flaps throughout. However, this extra flap drag should not have reduced the speed by an amount that would cause any problems whatsoever. A 90 'bent' loop entered at 350 KIAS with full T Mk7 thrust was, for an appropriately trained pilot, a safe and straightforward manoeuvre to fly.

• Conclusions Based on the data gathered during the sorties flown in Hunter F Mk58 ZZ190, the following

conclusions can be drawn: a. The analysis indicates that there is no significant difference in maximum instantaneous turn performance between a Hunter T Mk7 and F Mk58 and the lift related data gathered in the F Mk58 is representative of that of a T Mk7.

b. From the apex height and airspeed achieved in the accident manoeuvre, and for up to at least 4 seconds after passing the apex, it would have been possible for an appropriately trained pilot to fly a straightforward escape manoeuvre in G-BXFI which would have prevented impact with the ground by

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 309 Appendix H (Cont) 13  Report on Data Gathering Flying    rolling the aircraft through 180 back to erect flight and then pulling out of the dive to regain level flight

c. The measured height loss during a representative pull through from the apex of a loop at the airspeed, all up mass and density altitude of the accident manoeuvre was between 2700 and 2850 ft, and if altimeter reading and instrument errors were considered the range would increase to between 2600 and 2950 ft. The height loss appeared to be insensitive to whether 1 or 2 notches of flap were selected and to the power setting.

d. The 'bent' loop tests indicated that the apex height and airspeed of the accident manoeuvre was consistent with a maximum performance pull-up from 300 KIAS with significantly less than full thrust and with a 45-90 bend initiated approximately 5 seconds after pull-up They also showed that the apex height for a 'bent' loop was 300 - 400 ft less than for a straight loop when all of the other parameters remained constant.

e. A 90 'bent' loop entered at 350 KIAS with full T Mk7 thrust was, for an appropriately trained pilot , a safe and straightforward manoeuvre to fly.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 310 Appendix H (Cont) A‐1    Annex A to D Southwood Report on G-BXFI Accident

Serial Flaps (notches) (1) Manoeuvre Flown (2) Power Apex Height (ft QFE) Minimum height during recovery (ft QFE) Height loss during escape manoeuvre

• Apex to

minimum (ft) Apex IAS (kts) IAS at minimum height during recovery (kts) All Up Mass (lbs) Difference in AUM from G- BXFI (lbs) (3) Difference in apex density altitude from G- BXFI (ft) (4) 1 1 Roll when nose on horizon Maintained throughout 3600 2500 1100 110 220 19 900 +2300 -800 2 1 Roll when nose on horizon  Idle at apex 3800 2500 1300 120 175 19 700 +2100 -600 3 2 Roll when nose on horizon  Maintained throughout 3700 2600 1100 120 210 19 600 +2000 -700 4 2 Roll when nose on horizon  Idle at apex 3400 2200 1200 110 170 19 500 +1900 -1000 5 2 Roll when nose 30 nose down Idle at apex 3600 1600 2000 120 190 19 400 +1800 -800 6 2 Roll when 45 nose down (4 secs past apex) Idle at apex 3500 1200 2300 110 200 19 200 +1600 -900 Notes:

1. 1 notch of flap was 16, 2 notches was 23.
2. Entry/pull up from 300 KIAS, 200 ft QFE, 7400 RPM (T Mk7 maximum thrust equivalent).
3. Rounded down to nearest 100 lbs.
4. Quoted figures rounded down to nearest 100 ft.

Table A-1. Sortie 1: Escape Manoeuvre Data

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 311 Appendix H (Cont) A‐2   

Serial Flaps (notches) (1) Pull Up Parameters Power Apex Height (ft QFE) Minimum height at end of pull through (ft QFE) Height loss during pull through - Apex to minimum (ft) Apex IAS (kts) IAS at minimum height during recovery (kts) All Up Mass (lbs) Difference in AUM from G- BXFI (lbs) (3) Difference in apex density altitude from G- BXFI (ft) (4) SORTIE 1 7 1 300 KIAS, 7400 RPM, 2000 ft QFE Maintained throughout 5600 2300 3300 115 260 19 100 +1500 +1200 8 1 Idle at apex 5600 2400 3200 115 190 18 900 +1300 +1200 9 1 Max at apex 5500 2300 3200 120 270 18 800 +1200 +1100 10 2 Maintained throughout 5500 2500 3000 120 230 18 750 +1100 +1100 11 2 Idle at apex 5500 2400 3100 120 180 18 200 +600 +1100 12 2 Max at apex 5200 2400 2800 115 260 18 050 +400 +800 13 2 with 4 selected at apex Maintained throughout 5300 2400 2900 125 230 17 750 0 +900 SORTIE 3 14 1 310 KIAS, 7200 RPM, 1500 ft QFE Nominal 6600 RPM selected at apex 4550 1850 2700 115 200 17 500 -100 0 15 1 300 KIAS, 7200 RPM, 1500 ft QFE 4750 1900 2850 135 220 17 300 -300 +200 16 1 4500 1750 2750 105 190 17 100 -500 0 17 2 4600 1800 2800 135 230 16 950 -600 +100 18 (5) 1 4950 2250 2700 110 220 16 800 -800 +400 Notes:

1. 1 notch of flap was 16, 2 notches was 23, 4 notches was 38.
2. Max power was full F Mk58 thrust.
3. Rounded down to nearest 100 lbs.
4. Quoted figures rounded down to nearest 100 ft.
5. g was reduced before apex to reduce IAS at apex.

Table A-2. Sorties 1 and 3: Minimum Radius Loop Data

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix H 312 Appendix H (Cont) A‐3   

Serial Manoeuvre (1) Pull-Up Parameters (QFE height) Pull-up Power (RPM) Apex Height (ft QFE) Height increase pull-up to apex (ft) Apex IAS (kts) All Up Mass (lbs) Difference in AUM from G-BXFI (lbs) (2) Difference in apex density altitude from G-BXFI (ft) (3) 19 Straight pull-up 200 ft, 300 KIAS 7400 3700 3500 115 19 900 +2300 -600 20 90 bend 200 ft, 300 KIAS 7400 3400 3200 135 19 800 +2200 -900 21 Straight pull up 200 ft, 290 KIAS 7000 3600 3400 80 19 600 +2000 -700 22 Straight pull up 200 ft, 290 KIAS 7200 3600 3400 90 19 500 +1900 -700 23 90 bend 150 ft, 290 KIAS 7200 3200 3050 135 19 400 +1800 -1100 24 Straight pull-up 150 ft, 300 KIAS 7000 3300 3150 90 19 300 +1700 -1000 25 90 bend 250 ft, 300 KIAS 7000 3000 2750 110 19 200 +1600 -1300 26 45 bend 200 ft, 300 KIAS 7000 3000 2800 110 19 000 +1400 -1300 27 Slightly less than 45 bend  100 ft, 300 KIAS 7000 3300 3200 100 18 800 +1200 -1000 28 45 bend 100 ft, 300 KIAS 7000 2800 2700 110 18 600 +1000 -1500 29 Straight pull-up 100 ft, 290 KIAS 7000 3200 3100 90 18 400 +800 -1100 30 45 bend 100 ft, 290 KIAS 7000 2800 2700 120 18350 +700 -1500

Notes:

1. All manoeuvres flown with 1 notch (16) of flap.
2. Rounded down to nearest 100 lbs.
3. Quoted figures rounded down to nearest 100 ft.

Table A-3. Sortie 2: Bent Loop Data

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 313 Appendix J Review of the 2015 Shoreham Airshow Air Display Risk Assessment OFFICIAL SENSITIVE Review of the 2015 Shoreham Airshow Air Display Risk Assessment February 2016 MSU/2016/04 Enabling a better working world

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 314 Appendix J (Cont) OFFICIAL SENSITIVE REVIEW OF THE 2015 SHOREHAM AIRSHOW AIR DISPLAY RISK ASSESSMENT MSU/2016/04 Production of this report and the work it describes were undertaken under a contract with the Air Accident Investigations Branch (AAIB). Its contents, including any opinions and/or conclusion expressed or recommendations made, do not necessarily reflect policy or views of the Health and Safety Executive. © Crown Copyright 2016 Report Approved for Issue by: Date of Issue: 25 February 2016 Lead Author: HSL Project Manager Technical Reviewer(s): Editorial Reviewer: HSL Project Number: PE06406 Harpur Hill, Buxton Derbyshire, SK17 9JN T: +44 (0)1298 218000 W: www.hsl.gov.uk

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 315 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 DISTRIBUTION Air Accident Investigations Branch (AAIB) Health and Safety Laboratory (HSL) Health and Safety Laboratory (HSL) HSL Reports and Papers Library

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 316 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 CONTENTS 1 INTRODUCTION ..................................................................................... 1 2 REVIEW OF THE 2015 AIR DISPLAY RISK ASSESSMENT................. 2 2.1 Overview of the structure of the risk assessment .................................... 2 2.2 General comments .................................................................................. 3 2.3 Comments on the hazard assessments ................................................. 13 2.4 Health and Safety Executive (HSE) guidance........................................ 26 3 CONCLUSIONS .................................................................................... 32 4 REFERENCES ...................................................................................... 35

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 317 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 SUMMARY The Air Accident Investigation Branch (AAIB) asked the Health and Safety Laboratory (HSL) to assess the 2015 Air Display Risk Assessment for the Shoreham Airshow in 2015. A crash leading to multiple fatalities occurred at the airshow and the AAIB would like to know whether the risk assessment undertaken prior to the show was fit for purpose. HSL is the science laboratory for the Health and Safety Executive (HSE). HSL provides scientific evidence to support HSE policy and regulation and provides expertise and advice for businesses both within the UK and internationally. The HSL risk assessment specialists therefore have extensive experience in assessing hazard and risk assessments from a regulatory Health and Safety perspective. HSL reviewed the 2015 Shoreham Air Display Risk Assessment to ascertain whether it was suitable, sufficient and fit for the purpose of ensuring that the risks for the air display had been fully considered and were being managed appropriately. The equivalent 2013 and 2014 Air Display Risk Assessments were used to assess how the risk profiles for the show had been developed over time. The Royal Air Forces Association (RAFA) Battle of Britain Air Show Shoreham Airport Risk Assessment, which is essentially a ground risk assessment, for 2015 was also considered within this review process. The guidance for air displays given by the Civil Aviation Authority (CAA) was also considered within the review, as was HSE guidance on risk assessment and other literature on risk assessment and risk management. It was found that the Shoreham Airshow Air Display Risk Assessment contained a number of deficiencies compared to what would be expected for a risk assessment to control risks to the public. There is little, or no, evidence that:  all relevant parties were consulted in the assessment of the hazards and risks,  a comprehensive list of foreseeable hazards was identified,  sufficient and achievable mitigation measures were considered and implemented,  lessons were learned from near misses or incidents at previous airshows (either previous Shoreham airshows or other airshows). There is no demonstration that the hazards and risks identified have been managed sufficiently, e.g. evidence of implementation of mitigation controls, re-assessing risks to ascertain impact of mitigation, etc. The risk assessment does not fully comply with the CAA guidance for air displays. Compliance with the industry guidance would be expected as a minimum. It is not clear that those who assessed the risks and recorded the assessment had a full understanding of the purpose of the risk assessment. There is no evidence that a review process was undertaken. Although additional information has been obtained by the AAIB that indicates some form of review was undertaken, it is not clear who was consulted and it was not recorded in the risk assessment. It is not clear whether there was a proper sign-off of the Risk Assessment due to the use of a digital signature, especially where there are contradictory dates for the assessment document with the sign-off date. The conclusion of the review is that the 2015 Shoreham Airshow Air Display Risk Assessment is not fit for the purpose of identifying and mitigating the risks and hazards to the public from the air display activities of the airshow.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 318 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 1 1 INTRODUCTION At the Shoreham Airshow on 22 August 2015 a vintage jet aircraft crashed onto a nearby road, killing 11 people and injuring 16 others. The pilot was amongst those injured in the accident. The Air Accident Investigation Branch (AAIB) is undertaking the accident investigation to determine the causes of the accident and identify recommendations to avoid any similar occurrences in the future. The AAIB asked the Health and Safety Laboratory (HSL) to assess the 2015 Air Display Risk Assessment for the Shoreham Airshow in 2015 [1]. As part of the Health and Safety Executive (HSE), HSL provides scientific advice on health and safety matters to the UK government and to businesses in the UK and internationally. The HSL risk assessment specialists have experience of reviewing hazard and risk assessments from a regulatory perspective across a range of industries and activities. The AAIB provided HSL with the Shoreham Air Display Risk Assessment for the 2015 airshow [1], together with the corresponding assessments for 2014 [2] and 2013 [3].The AAIB also provided the RAFA (Royal Air Forces Association) Battle of Britain Air Show Shoreham Airport Risk Assessment [5], which is a ground risk assessment for the 2015 airshow. HSL reviewed the 2015 Air Display Risk Assessment in relation to the guidance for flying displays and special events published by the Civil Aviation Authority (CAA) [4]. The risk assessment was compared with the guidance given in the HSE publication “Reducing Risks, Protecting People” [6], together with other published guidance [7, 8] and health and safety legislation [9]. The remainder of the report is structured as follows:  Section 2 presents the findings of the review and the comparison with the RAFA Battle of Britain Air Show Shoreham Airport Risk Assessment [5], the various guidance documents and the legislation; and  Section 3 presents the conclusions from the review.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 319 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 2 2 REVIEW OF THE 2015 AIR DISPLAY RISK ASSESSMENT 2.1 OVERVIEW OF THE STRUCTURE OF THE RISK ASSESSMENT The Air Display Risk Assessment for the 2015 Shoreham Airshow has followed the same structure as the assessments undertaken for the 2013 and 2014 Shoreham Airshows. The version of the 2015 assessment provided to HSL states that it is a draft assessment. The AAIB has confirmed that a final version of the risk assessment has not been made available to the AAIB. It is unclear if the 2015 assessment was ever finalised, or whether the document provided is the final version that is incorrectly described as a draft. The lack of clarity over a final version of the risk assessment indicates a deficiency in the record keeping in the risk assessment process. The document reviewed and discussed in this section is therefore the Draft 2015 Air Display Risk Assessment for the Shoreham Airshow that has been obtained by the AAIB. Within the Air Display Risk Assessment, there is a description of the roles of key people throughout the duration of the airshow. These are:  The Flying Display Director (FDD) who has overall responsibility for “Air Display Flight Safety” under the Civil Aviation Authority (CAA) permissions. The FDD is responsible for developing and maintaining a “Flight Safety culture” throughout all aspects of the flying display operation;  The Flying Control Committee (FCC) who have specific safety oversight of the flying display operations;  The Chair of the FCC (CFCC) who has “the authority to make over-riding operational and flight safety decisions on any part of the Flying Display”. The risk assessment does not provide the qualifications for the FDD but states that the CFCC and FCC are chosen because of their “wealth of flying experience in general and display related experience in particular”. The risk assessment states that the FDD and CFCC must ensure that members of the FCC are present throughout the display flying periods. In addition, part of the FDD, CFCC and FCC duties includes contacting the pilots directly by radio during displays, should the need arise. This is for the sole purpose of terminating a display in progress for safety reasons. The purpose of the risk assessment is discussed within the Shoreham Airshow Air Display Risk Assessment document. Safety assessment criteria are described and the risk matrix used to assess the risks is outlined. Tables are provided for each hazard that has been identified and considered. These tables include:  a description of each hazard;  the risk of the hazard identified by use of the risk matrix;  what mitigation can be considered;  the appropriate actions to take and by whom for each mitigation method.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 320 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 3 Each row of the table is signed by the Flying Display Director (FDD). A final table is provided in the Air Display Risk Assessment summarising each hazard, the risk of the hazard on the risk matrix and the impact of the risk mitigation methods identified. A statement is made at the end of the report stating that all risks are now “Acceptable”. The Air Display Risk Assessment does not cover normal airport licensed operations (e.g. take- offs and landings) as these are covered under the Shoreham Airport risk assessment. 2.2 GENERAL COMMENTS 2.2.1 Comparison with previous risk assessments The comparison of the 2015 Air Display Risk Assessment with those from 2013 and 2014 revealed that only minor modifications had been made to two of the hazards assessed when compared to the 2014 Air Display Risk Assessment. It was also noted that the date that each of the hazards had been signed off on was the same for 2015 and 2014, with just the year itself changed. In the 2015 assessment the date for the sign-off for each hazard is given as 14 August 2015, but the assessment itself is dated 6 April 2015. The date for the 2014 assessment document is given as 14 August 2014. The signature used for the sign-off appears to be scanned in, and so there is no indication that the assessment was seen by the person whose signature appears on the form. The concern from these points identified is that there appears to have been no proper review of the hazards and risks undertaken in 2015. It looks like the previous year’s assessment was reused with only the minor amendments and the change of dates. It is possible that the assessment was not even signed off by the Flying Display Director (FDD), with the previous year’s signatures used to authorise the assessment. Even if these anomalies are just typographical errors, it does not give confidence in the quality of the assessment and the acceptance criteria used in the sign-off of the document. The AAIB has obtained information that indicates that the FDD, who signed off the risk assessment, did see the document and passed it to others for comment. This is not made clear from the risk assessment itself and it is not clear who else has seen the risk assessment. As there is no obvious final version of the risk assessment, there does not appear to be a final sign-off prior to the Shoreham Airshow. There is nothing within the preliminary sections of the Air Display Risk Assessment that states when and how the risk assessment was reviewed. Section 2.1.4 does state that the “Airshow Management of Safety is subject to routine review” but it is not stated how often this occurs. This section of the assessment also states that “the introduction of new RA [Risk Assessment] and associated Actions Required and the progress of existing Actions Required will be reviewed for each Flying Display and during informal meetings between RAFA [Royal Air Forces Association], CAA, the Airport Operator and Air Traffic Control”. There is no record if and when this process has occurred for this assessment. Information obtained by the AAIB indicates that the risk assessment was reviewed annually prior to the event. It is not made clear how this review was undertaken, and who contributed to the review. It appears that issues highlighted by other people consulted as part of the review process have not been properly incorporated within the risk assessment. For example, in this review process, SATCO (Senior Air Traffic Control Officer) highlighted that the majority of the crowd line is not visible from the VCR (Visual Control Room); however, the final risk assessment still lists Air Traffic Control observing the crowd barrier line as a mitigation

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 321 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 4 measure to reduce the risk. The risk assessment should have been updated to reflect the concerns raised by SATCO that this measure was not a practical way of reducing this risk. This indicates an incomplete or insufficient review process. There is no record of this process within the risk assessment. It is not obvious from the risk assessment document that the risk assessment has been reviewed or even seen by the appropriate people (e.g. the FDD, the FCC, pilots, etc.), although additional information obtained by the AAIB indicates that some form of review has occurred. No record is made that the indicated review process did take place. The only signature in the assessment document is that of the FDD which, as has already been stated, appears to be a digitally scanned-in signature. There is no evidence that any process has been undertaken to determine if the identified hazards are still appropriate, or if there are any additional mitigation methods that could be considered. It appears that even in the review process that was undertaken that issues that were identified with some of the hazards and mitigation measures have not been implemented in the risk assessment. It is not clear that there has been any thought given to the impact of changes in the layout and running of the show which may or may not have occurred in the intervening years. 2.2.2 Comparison with the Shoreham Airshow ground risk assessment The RAFA Battle of Britain Air Show Shoreham Airport Risk Assessment covers events that are occurring on the ground, from issues with the car parks to accidents in the children’s areas to possible fires in marquees and food stalls. This document has not been reviewed but the structure of the assessment and the process undertaken has been compared with the Air Display Risk Assessment. The main difference between the two risk assessments is in the structure of the risk matrix and how it is used. The ground risk assessment more closely follows the guidance given in CAP 403 [4]. The RAFA Battle of Britain Air Show Shoreham Airport Risk Assessment lists:  the activity;  the hazard associated with the activity;  the people that could be affected by the hazard;  the severity of the consequences if the hazard were to occur;  the likelihood of the hazard occurring and affecting a person;  the consequent risk rating on the risk matrix;  the actions that can be taken to lower the risk;  the effect of the actions on the likelihood and/or severity of the consequences; and  the final level of risk following the implementation of the mitigation and controls. The Air Display Risk Assessment, in contrast, does not separate the hazard from the activity, and it does not directly state who is at risk. The Air Display Risk Assessment does not show the impact of any mitigation measures on the severity or likelihood. The conclusion of the Air Display Risk Assessment is that the risks have all been reduced to “Acceptable”, the lowest risk

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 322 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 5 ranking, with no link made to how the mitigation and control measures affect the final risk rating. 2.2.3 General points No map is included with the risk assessment. The inclusion of a map of the show area would aid with the identification of the areas that could be affected by the hazards. This would indicate population areas, where the spectators are expected to be, nearby population centres, and neighbouring roads, etc. This visual aid would be beneficial to those involved in the assessment process, and to those involved with the show who may not be familiar with the layout of the area. It would also aid in highlighting areas that have changed since the previous year’s airshow. In Section 2.1.1 of the Air Display Risk Assessment, four questions are asked, the first of which is “Does an actual or potential hazard to Airport/ATS [Air Traffic Services] operational safety exist in this area of operation?”. The emphasis of the question may cause confusion in the assessment of the risks. The purpose of the risk assessment is to assess the risk of people being harmed by the operations of Shoreham Airshow. Therefore, it might be more beneficial to explicitly state this purpose, especially as an airshow is likely to have a different demographic of people located in different areas than for normal airport operations. 2.2.4 Hazard identification When carrying out a risk assessment, a process needs to be undertaken to identify the hazards associated with the activity, in this case, the hazards from aircraft displays. This is often referred to as a hazard identification process and can take the form of a “brain-storming” session, where experts in the field use their knowledge to identify a number of hazards. Some of the hazards identified in this way may later be discarded, provided valid reasoning is given (e.g. the hazard is found not to be credible given the type of aircraft at the airshow). It is normal good practice to provide some record of this process. This would include the people who performed the hazard identification, their qualifications and experience, and a list of the hazards identified. The reasons for discounting some of these identified hazards would also be given. For an event such as an airshow, it would be expected that representatives from the airfield, pilots, the FDD, members of the FCC and other parties directly concerned with the safety of the event would be involved in the hazard identification process. In the Shoreham Airshow Air Display Risk Assessment for 2015, no information is provided as to how the hazards considered in the assessment were identified, or who was involved in the Hazard Identification process. This means that it is not possible to state whether or not a comprehensive process was undertaken and whether the hazards identified are exhaustive. HSL has quickly identified additional hazards that have not been considered in the risk assessment (e.g. mechanical failure of the aircraft, the effects of the pilot becoming incapacitated, detachable parts of the plane falling into the crowd, aircraft crash within the airfield boundary and so on). Each of these hazards could have catastrophic consequences and should have been considered in the assessment.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 323 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 6 The hazards considered in the risk assessment are: 1. Airside unauthorised access; 2. Mid-air collision – display and non-display aircraft; 3. Mid-air collision – display formation; 4. Ejector seat impacts crowd; 5. Loss of control due to pilot disorientation; 6. Location of built up areas; 7. Public assembly on A27 and local roads; 8. Aircraft crash outside the airfield boundary; 9. Fast jet aircraft collision into crowd area; and

1. Fatigue amongst key safety staff.

Hazards number 6 and 7 are potentially misleading and are not hazards as described. It is the consequences of an aircraft crashing in these areas that is the actual hazard. The lack of clarity could lead to confusion regarding exactly what is being assessed. This will be discussed in more detail in subsequent sections. There is no record that the list of hazards has been reviewed to ascertain whether or not they are still suitable and sufficient for the purposes of the risk assessment. Any changes to the operation of the airshow, or to the type of aircraft flying at the airshow could affect the list of identified hazards. Additional information obtained by the AAIB indicates that the first risk assessment, including the identified hazards, was written in 2013 and circulated for comments, allowing people to suggest additional hazards. However, there is no record that these people were directly involved in the hazard identification process. The risk assessment was circulated again in 2014 and 2015 for comment. There is no record in the risk assessment itself that any of these reviews occurred. One of the responses from circulating the risk assessment identified that there are civil aircraft that could lead to hazard 4 (ejector seat impacts crowd). In the risk assessment, the mitigation measures are only applied to military aircraft. No modification to the text in the risk assessment was made as a result of the comment made by one of the reviewers. At the least, the risk assessment should have identified that this observation had been raised and given a justification for not incorporating this into the risk assessment. There is no recorded process for identifying mitigation measures for each of the identified hazards. Only those that are being implemented are discussed in the risk assessment. It could be expected that additional measures were identified, which may have been dismissed for legitimate reasons. There is, however, no record that any additional measures have been considered, or that any systematic process was undertaken to identify potential mitigation measures or actions.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 324 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 7 It is possible that a full hazard identification process was undertaken and recorded elsewhere. No reference is made to such a document from the risk assessment, however, and none has been made available to HSL. In summary, there is no evidence that a suitable hazard identification process was undertaken and it appears that not all plausible hazards have been considered. In addition, there appears to have been no clear process for identifying mitigation measures, and then determining which could and should be implemented. 2.2.5 Review process A risk assessment should be reviewed regularly to ensure that it is still valid for the processes/events being assessed and a record made that a review has been undertaken. Even if no changes have been identified, a statement to this effect should be included. In the Shoreham Airshow Air Display Risk Assessment there is no process described for updating and reviewing the risk assessment, other than very general statements in Section 2.1.4 of the assessment. These statements have already been discussed in Section 2.2.1 of this report. There is no statement made that a review was undertaken prior to the 2015 airshow. There are some minor modifications to the text for two of the hazards assessed, which are in revision mode and appear to be incomplete. Given the other issues identified, which are discussed subsequently, such as the misclassification of risks which has been there since at least 2013, then it seems likely that there has not been a proper review of the risk assessment. More significant changes would be expected for an annual event where each year should increase the knowledge of managing the safety at the event. The AAIB have obtained additional information that indicates the risk assessments for 2013, 2014 and 2015 were sent to other people for comments. It appears that this was done by email with no record of any meetings to fully discuss the risk assessment. There is no record of the review process in the risk assessment. It is also not clear who was involved in the review process in the risk assessment document. Some of the comments made by the reviewers do not appear to have been fully incorporated within the risk assessment (e.g. the identification of civil aircraft that could cause hazard 4, but the mitigation measures only being applied to military aircraft). It would be expected that at a dynamic event such as an airshow, lessons would be learnt each year from issues that arise. These can be from issues that occurred and had to be resolved during the airshow, and also from processes that were particularly effective at managing the risks. This allows an assessment to be made as to whether measures in place are working effectively, and whether they can be applied to other aspects of the show, or whether problems have arisen which require additional measures to enhance the safety. Anything identified in this manner would be expected to be added to the risk assessment to improve safety both during the event and also for subsequent events. Even incidents that do not lead to any serious issues (near misses) can provide useful lessons for future risk management of an activity. The risk assessment should be updated to reflect lessons learnt at each airshow. There is no indication that any such process has been undertaken. Lessons can also be learnt from incidents that have occurred at similar events (e.g. other airshows). No mention is made of this in the document. A quick internet search has identified aircraft crashes in previous years at Shoreham Airshow [10, 11] and that there was a fatal crash at CarFest North [12] in the weeks leading up to the 2015 show. These do not appear to have been considered in the risk assessment, even if only to reassure the organisers of the Shoreham Airshow that such events could not occur during the Shoreham Air Display in 2015.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 325 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 8 A statement is made in Section 2.1.3 of the Shoreham Airshow Air Display Risk Assessment that all personnel should “appreciate the need to take a proactive approach towards the identification of potential risk situations throughout the Flying Display period”. It is not stated how or if any of this information should be recorded, however. An additional point on the review process pertains to the CAA document, CAP 403 [4], which provides guidance for flying displays. It is stated in CAP 403 that the document was completely rewritten for the latest version, which is dated February 2015. HSL has not compared the latest version with the previous version so it is not clear how the guidance has changed, if at all. As part of the risk assessment review process, however, it should be ascertained whether any changes have been made to the guidance and to incorporate them within the risk assessment, if necessary. If no changes have been made to the CAP 403 guidance or there are no changes that are applicable to the Shoreham Airshow, a sentence should be included in the risk assessment to outline that this guidance has been considered. No such statement has been made in the Shoreham Airshow Air Display Risk Assessment. In summary, there is no evidence in the risk assessment that the Shoreham Airshow Air Display Risk Assessment has been suitably reviewed since the 2014 risk assessment. 2.2.6 The risk matrix The purpose of a risk matrix is to identify a level of risk (either quantitatively or qualitatively) associated with a particular hazard. From this, the degree of mitigation required to lower the risk can be identified. The higher the risk, the greater the consideration required to be given to identifying and implementing potential risk reduction measures. This is discussed in more detail in Section 2.4. Paragraph 3.3.2 of the Shoreham Airshow Air Display Risk Assessment states “Should a risk be calculated that produces an acceptable (A) level then the activity may be continued without further reference”. This contradicts the guidance in CAP 403, which states that “Mitigation action should be taken whenever possible to reduce risk ratings even when the risk is low”, and also contradicts standard risk assessment practice. It is expected that mitigation measures will still be considered for events with a low level of associated risk, but that the measures taken will be proportionate to the level of risk posed. In other words, inexpensive and easy to implement (practicable) mitigation measures would still be expected to be applied when the risk is low. It is stated in paragraph 3.3.3 of the Shoreham Airshow Air Display Risk Assessment that “Should the risk be deemed unacceptable (U) positive actions must be carried out to reduce the risk to an acceptable level before the activity is undertaken”. Standard risk assessment practice states that the risk should be lowered ALARP (As Low As Reasonably Practicable) which does not mean that it must be reduced to the “Acceptable” level, in the terminology of the Shoreham Airshow Air Display Risk Assessment. It is recognised that it is not always possible to reduce the risk into this region but that people are prepared to tolerate the risks, given the benefits accrued from an operation/process/event (i.e. in the case of the Shoreham Airshow, people tolerate a certain level of risk for the benefit of seeing air displays). CAP 403 states that unacceptable risks should be reduced to medium or low risk (i.e. not necessarily the “Acceptable” region, as used in the Shoreham Airshow Air Display Risk Assessment). Paragraph 3.3.4 of the risk assessment states “Should the risk be determined to require review (R) then this review must be undertaken at the earliest opportunity in an effort to reduce the risk to an acceptable level”. This is not what is required by standard risk assessment guidance. The review should aim to reduce the risk ALARP, which may mean that it ends up in

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 326 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 9 the same risk level category, but either or both the consequences and the likelihoods have been reduced. The terminology used in the risk matrix is perhaps confusing. A more standard phrase for the “Review” region would be “Tolerable” or “Tolerable if ALARP”. It is possible that the “acceptable level” in paragraphs 3.3.3 and 3.3.4 of the Shoreham Airshow Air Display Risk Assessment does not actually mean the “Acceptable” band in the risk matrix. The phrase used leads to this inference, however, and the subsequent reduction of all the risks to “Acceptable” would imply that this is how it has been interpreted by those performing the risk assessment. Table 1 in the risk assessment (replicated as Table 1 in this document) defines the severity classifications for the consequences. They are given as “Catastrophic”, “Hazardous”, “Major”, “Minor” and “Negligible”. Table 1 Replication of Table 1 from the 2015 Shoreham Air Display Risk Assessment [2] showing the consequence category definitions Classification Catastrophic Hazardous Major Minor Negligible Results in one or more of the following effects Total loss of one or more aircraft and/or multiple fatalities as a result of an aircraft incident during the Shoreham RAFA Air Display 2015 that may or may not lead to Display Cancellation Major aircraft damage and/or a single fatality that may or may not lead to a prolonged or permanent suspension of the Flying Display Serious aircraft incident leading to the temporary suspension of the Flying Display Minor aircraft incident that could result in interruption to the Flying Display No effect on Shoreham RAFA Air Display 2015 The wording is different from that given in CAP 403 and the emphasis in the description of each has been changed from injury/death of people to damage to aircraft or the impact on the airshow. In this case, this appears to be misguided. There may be occasions where there are legitimate reasons to assess the risk of damage to aircraft or the impact on the airshow, but this risk assessment should be assessing hazards and risks where there could be adverse effects to people. This assessment should not be explicitly concerned with damage to aircraft or other inanimate object (unless this is then directly linked to the consequence to people, whether pilots or members of the public). It should not be explicitly concerned with whether the airshow, or a particular display, has to be cancelled. Even though the catastrophic and hazardous classifications do refer to the consequences to people as well as aircraft, the major, minor and negligible categories do not refer to people at all. This is a serious and worrying deficiency in the risk matrix. Even if the intentions were to relate these categories to the effects on people, by not explicitly stating this in the consequence categories there could be an unconscious bias upon those assessing the hazards and risks to concentrate upon aircraft impacts rather than the health and safety of people. Table 2 in the Shoreham Airshow Air Display Risk Assessment (replicated as Table 2 in this document) lists the likelihood categories in the risk matrix and provides a qualitative definition of them. They are given as “Extremely improbable”, “Improbable”, “Remote”, “Occasional”

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 327 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 10 and “Frequent”. The table also has a section described as a quantitative definition, in which it is stated “Definition not required as the Flying Display programme is regulated to one aircraft or one formation displaying at any time”. It is not clear what this statement is trying to say and appears to have no relevance to the table. It does not provide justification for not providing a quantitative assessment. A quantitative assessment may not be possible as there may be insufficient data available to provide any quantitative information, in which case a statement should be made to this effect. Table 2 Replication of Table 2 from the 2015 Shoreham Air Display Risk Assessment [2] showing the likelihood definitions Classification Frequent Occasional Remote Improbable Extremely Improbable Qualitative definition Likely to occur many times during the Shoreham RAFA Air Display 2015 Likely to occur sometime during the Shoreham RAFA Air Display 2015 Unlikely but possible to occur during the Shoreham RAFA Air Display 2015 Very unlikely to occur during the Shoreham RAFA Air Display 2015 Almost inconceivable event will occur during the Shoreham RAFA Air Display 2015 Quantitative definition Definition not required as the Flying Display programme is regulated to one aircraft or one formation displaying at any time. The risk matrix is presented in Table 3 of the risk assessment (replicated as Table 3) where each cell is labelled as “Unacceptable”, “Review” or “Acceptable”. This differs from the matrix provided in CAP 403 [4] where numbers are assigned to each consequence and likelihood category. The numbers are multiplied together, leading to different numbers in each cell of the matrix. Risk reduction measures reduce the consequence or likelihood number, which in turn affect the final risk score. This allows for a clearer interpretation of how the risk reduction measures are affecting the overall level of risk than can be made in the Shoreham Airshow Air Display Risk Assessment. Table 3 Replication of Table 3 from the 2015 Shoreham Air Display Risk Assessment [2] showing the risk tolerability matrix Probability Extremely Improbable Improbable Remote Occasional Frequent Outcome Catastrophic REVIEW UNACCEPTABLE UNACCEPTABLE UNACCEPTABLE UNACCEPTABLE Hazardous REVIEW REVIEW UNACCEPTABLE UNACCEPTABLE UNACCEPTABLE Major ACCEPTABLE REVIEW REVIEW REVIEW UNACCEPTABLE Minor ACCEPTABLE ACCEPTABLE ACCEPTABLE ACCEPTABLE REVIEW Negligible ACCEPTABLE ACCEPTABLE ACCEPTABLE ACCEPTABLE ACCEPTABLE Table 4 in the risk assessment lists each of the 10 identified hazards and considers each in turn. It provides the hazard description, the severity and probability ratings and the risk level rating from the risk matrix. A list of mitigation measures, actions required, and who should perform the action is given. Each hazard is signed off by the FDD although, as has already been stated,

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 328 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 11 the signature appears to be a digital one, the date is four months after the date of the draft risk assessment, and the date is the same as the preceding year’s assessment with just the year changed. Table 4 replicates the Hazard 1 information in Table 4 in the Shoreham Air Display Risk Assessment. Table 4 Replication of Table 4 from the 2015 Shoreham Air Display Risk Assessment [2] showing the Hazard identification and mitigation for Hazard 1 Hazard Number Hazard Description S P R Mitigation Actions Required By Whom 1 Airside Unauthorised Access M I R Full crowd barriers in place. All security staff to be briefed prior to the show. RAFA There is only 1 access point to airside at the Airport terminal building. Access to airside is controlled by security staff and only duly authorised and identified personnel will be permitted to enter airside. Crowd barrier line is observed where possible by ATC and continually patrolled by Marshalls. Security guards in place at all entry points to prevent unauthorised access. RAFA Crowd barriers inspected daily for security during show. RAFA FCC and ATC briefed to maintain a watch of the crowd line. FDD, FCC & SATCO1 Two-way radio contact with all aircraft on circuit. Pilots fully briefed on “stop action” instructions. Procedures in place to be reviewed daily for currency and relevance. Daily Show Debrief Name REDACTED Flying Display Director Signature Assessment Date 14 August 2015 1 SATCO = Senior Air Traffic Control Officer 2.2.7 The hazard assessments Detailed comments on the individual hazards assessed are given in Section 2.3, but there are a number of comments that apply to all of the hazards. In particular:  The hazard is not always clearly defined and described;  Most of the mitigation measures and actions do not go beyond those given in the code of practice;  There is no information linking the mitigation measures and/or actions required with a reduction in the level of risk;

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 329 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 12  There is no assessment performed to determine whether the proposed mitigation measures and actions required are sufficient;  There is no demonstration that the risks have been reduced ALARP;  There are no measures listed which have been proposed and discounted, with reasons given as to why they have not been considered further. In a standard risk assessment, it would be expected that additional measures could be identified that may not be practicable, either in terms of implementation or cost. This process should be recorded. There is insufficient evidence that the proposed mitigation measures reduce the risk ALARP, or that all practicable mitigation measures and controls have been considered, for all of the hazards identified and described in the Shoreham Air Display Risk Assessment. 2.2.8 Risk mitigation table Table 5 in the Shoreham Airshow Air Display Risk Assessment lists each of the hazards, the original risk rating and the final risk rating, after the actions required identified in Table 4 of the risk assessment have been implemented. Table 5 in this document replicates the table given in the Air Display risk assessment. Hazards 3 and 4 are erroneously listed as being “Review”, which is an error that occurred in Table 4 of the risk assessment and will be discussed in more detail in Section 2.3. This is possibly also true of Hazard 7. In all cases, the statement is made that the required actions reduce the risk to “Acceptable”. A summary is then made of the number of hazards that have been reduced from “Unacceptable” (at least 2 fewer than should be the case) or “Review” to “Acceptable” and how many remain in each category (i.e. all 10 are at level “Acceptable” after the actions required have been implemented). There is no argument given as to why each of the hazards has been reduced to “Acceptable”. In the guidance provided in CAP 403 [4], the tables assessing each hazard contain a column that allows it to be seen whether the likelihood or severity has been reduced by the mitigation measures (although no justification is given for the reduction). This is followed through so that the final risk rating is given, after the mitigation measures have been considered. In the Shoreham Airshow Air Display Risk Assessment, no link is made between the mitigation measures/actions required and the reduction in the severity or likelihood, and consequently the overall risk. In the examples given in CAP 403, not all of the risks are reduced to the “Acceptable” region, as expected in standard risk assessment practice. It is unlikely that an event that has the potential to have catastrophic consequences will fall into the “Acceptable” region, unless the event itself (in this case, flying an aircraft) is prevented entirely. It is also not required that the risk is reduced this low, according to standard risk assessment guidance [6]. The requirement is to show that all practicable measures have been considered and implemented and that the risk is reduced ALARP (which would fall into the “Review” category in the matrix given in the Shoreham Airshow Air Display Risk Assessment).

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 330 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 13 Table 5 Replication of Table 5 from The 2015 Shoreham Air Display Risk Assessment [2] summarising the Hazards and risk mitigation Hazard # Description Risk Mitigation 1 Air Unauthorised Access Risk rated as “Review”. Required actions reduce impact to “Acceptable”. 2 Mid-air collision – Display and non- Display aircraft Risk rated as “Unacceptable”. Required actions mitigate risk to “Acceptable” provided all aspects of the actions are sustained particularly the emphasis on visual lookout by ATC and FCC. 3 Mid-air collision – Display Formation Risk rated as “Review”. Actions required and limitations on formation items displaying at Shoreham reduce this to “Acceptable”. 4 Ejector seat impacts crowd Risk assessed as “Review”. Actions reduce the risk to “Acceptable”. 5 Loss of control due to pilot disorientation Risk rated as “Unacceptable”. Required actions mitigate risk to “Acceptable”. Poor weather / lack of horizon warnings included in Pilot’s Brief. 6 Location Road and of local built up areas Risk assessed as “Unacceptable”. Action required reduce the risk to “Acceptable”. 7 Public Assembly on A27 and local roads Risk rated as “Review”. Required actions as agreed with the Police reduce impact to “Acceptable”. 8 Aircraft Crash Outside the Airfield Boundary Risk assessed as “Unacceptable”. Action required reduce the risk to “Acceptable”. Real time monitoring of display items by the FCC ensure compliance with the relevant rules and regulations. 9 Fast jet aircraft collision into crowd area Risk assessed as “Unacceptable”. Action required reduce the risk to “Acceptable”. Real time monitoring of display items by the FCC ensure compliance with the relevant rules and regulations. 10 Fatigue amongst key safety staff Risk rated as “Review”. Required actions reduce impact to “Acceptable” The statements made in the Shoreham Airshow Air Display Risk Assessment indicate a lack of understanding of how to perform a risk assessment and its purpose. It provides no confidence that a comprehensive process has been undertaken or that serious consideration has been given to the risks. 2.3 COMMENTS ON THE HAZARD ASSESSMENTS 2.3.1 Hazard 1: Airside unauthorised access The severity classification for this hazard is given as “M”. Given that there are two severity classifications that begin with M, “Major” and “Minor”, it should be made clearer which has been assigned. The combination of a likelihood of “Improbable” and a risk matrix category of “Review” implies that the severity is “Major”, but this has to be inferred from other information and is not explicit.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 331 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 14  Mitigation The first two mitigation measures listed relate to the use of crowd barriers and preventing the public from entering prohibited areas, specifically the terminal building and airside. These measures can be considered to be standard practice as they are listed in paragraph 3.16 of CAP 403 [4]. There are two additional points in the second mitigation measure, however, concerning preventing the public entering airside at the airport. The first is that “there is only 1 access point to airside at the Airport terminal Building”. It is not clear whether this is a general statement with regards to the layout of Shoreham Airport, or whether this is an additional measure that has been imposed for the duration of the airshow. The second additional point for the mitigation is that the “Crowd barrier line is observed where possible by ATC [Air Traffic Control] and continually patrolled by Marshals”. Paragraph 3.16 in CAP 403 explicitly states that marshals control the movements of spectators throughout the event. The use of ATC to monitor the crowd is not mentioned in CAP 403. As ATC are employed to monitor the airspace around the airfield and to instruct pilots on appropriate actions to take for the duration of their flights, it does not seem reasonable that they are also monitoring the crowd line. In addition, they may not have a clear line of sight to the crowd line. It should be noted that it has been assumed that ATC refers to Air Traffic Control due to SATCO (Senior Air Traffic Control Officer) being responsible for ensuring that the required actions are carried out. This applies throughout this report. ATC can also refer to Air Training Corps, whose cadets are sometimes used in an official capacity at airshows. All acronyms should be expanded on first use to avoid the ambiguity seen here. These two additional points made concerning the mitigation measures are either unclear or impractical. The third mitigation measure concerns two-way radio contact with all aircraft in circuit and the pilots being fully briefed on “stop action” instructions (i.e. terminate the display). Paragraphs 3.47 and 3.48 in CAP 403 consider the use and allocation of radio frequencies. This states the requirement for some level of radio communication and, where possible, that a quiet frequency for use during the flying display should be allocated. If only one frequency is available, then the Flying Display Director (FDD) must make this clear in the written and verbal briefings. In other words, this is standard practice for running an airshow. There is a section in CAP 403 on pilot briefings (paragraphs 3.50 to 3.54) with details of what is required to be covered in the briefings given in Appendix C of CAP 403. One of these requirements considers procedures for the cancellation or the variation of the programme. It is not explicitly stated that pilots should be fully briefed on “stop action” instructions, but it could be inferred from the list of areas to be covered in the briefings. There are no practicable mitigation measures above and beyond the code of practice that are considered under this category.  Actions Required The first action required states that all security staff should be briefed prior to the show. Whilst this requirement is not specifically stated in CAP 403, marshals are expected to control the movement of spectators (paragraph 3.16). It could be expected, therefore, that all marshals will have been briefed on their role prior to commencing work at the show.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 332 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 15 The second action required states “Security Guards in place at all entry points to prevent unauthorised access”. This is in relation to the mitigation measure of limiting access to the terminal building and to airside. As stated previously, CAP 403 states that marshals are expected to control the movement of spectators throughout the event. The third action states “Crowd barriers inspected daily for security during show”. Paragraph 3.16 of CAP 403 clearly states the need for effective barriers. It does not explicitly state that the barriers should be regularly inspected, but the phrase “effective barriers” used in the document implies the need to ensure that they are capable of restraining the crowd throughout the duration of the show. The fourth action is not in CAP 403 and is “FCC [Flying Control Committee] and ATC [Air Traffic Control] briefed to maintain a watch of the crowd line”. This appears to be an additional measure but, given the level of responsibility that the FCC and ATC have for ensuring that the flying display is proceeding as planned (e.g. the pilots are following instructions, minimum heights are observed etc.) then it is not clear how the FCC and the ATC can also be watching the crowd line. This is an instance of where implementing a control measure may decrease the risk from one hazard but may increase the risk from another (e.g. in this case, potentially hazardous situations in the air may not be seen in time to prevent them occurring). The implications of this measure do not appear to have been assessed adequately. The final action relates to the mitigation measure for two-way radio contact with all the aircraft in circuit and pilots being briefed on “stop action” instructions. It states “Procedures in place to be reviewed daily for currency and relevance”. CAP 403 does not explicitly state that the items covered in the briefing should be reviewed daily. It does, however, state that briefings must be given on each day of the flying and it also provides a list of items that should be covered in the briefing. It could be inferred that any changes pertinent to the briefing would be covered in the daily briefing. It should be noted that the risk assessment does not state that any changes to the procedures should be recorded, which is an oversight.  Summary The mitigation measures identified are from the code of practice and would be expected to be the basic activities required for running an airshow. Only one of the actions required potentially appears to go beyond the code of practice but it is debatable as to whether this action is practicable. No assessment seems to have been made as to whether any of the mitigation measures and actions required are suitable and sufficient. No specific measures for the Shoreham Airshow have been included in the risk assessment. The lack of additional measures may be because there is nothing practicable that can be done. As no recorded process has been undertaken to determine what measures are possible, however, then it is not possible to state that all measures have been considered, or whether any additional ones have been considered but discarded for a legitimate reason. 2.3.2 Hazard 2: Mid-air collision – display and non-display aircraft The first comment on this part of Table 4 is that there are a number of acronyms that have not been explained. Whilst the people looking at and creating the risk assessment are likely to be familiar with the terms, it should not be assumed that everyone who needs to see the document

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 333 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 16 is familiar with these terms and either a glossary should be provided or the acronyms expanded on first use. It is not clearly stated in the table whether the hazard is just to the pilots themselves or to the people on the ground as well. Intuitively it will be both but it should be clearly stated who can be adversely affected by the hazard.  Mitigation The first item listed under the mitigation column refers to NOTAMs (Notice to Airmen) and a Temporary Restricted Airspace (RA(T)). A NOTAM is required to alert pilots of potential hazards along a flight route or at a specific location. It is therefore a requirement that NOTAMs are in place to notify pilots of additional hazards posed by the airshow. Similarly, RA(T)s would be expected to be in place for the duration of the display, to ensure that only display aircraft are in the airspace. Considering and making arrangements for airspace and air traffic management requirements forms part of the preliminary planning for airshows listed in paragraph 2.23 of CAP 403 [4]. This mitigation measure does not go beyond standard practice that would be expected for an airshow. The second mitigation measure concerns closing the east side heliport for the Battle of Britain Memorial Flight (BBMF) and for other displays on request. An immediate question that arises, that is not explained, is why the heliport is only closed for this display? If the use of the heliport increases the risk of a mid-air collision, then the possibility of closing it for all displays should be considered and if there is a logical reason why this is not the case then this should be recorded. If the risk of a mid-air collision with a helicopter from the heliport and a display aircraft is considered large enough to warrant closing the heliport, why is that decision left with the pilot and not the FDD who is in overall charge of safety at the event? If the heliport is not closed for all displays then, potentially, all pilots should be asked if they require the heliport to be closed and the FDD then makes the final decision, feeding back to the pilot. Refusing the request to close the heliport would require a valid reason that should be recorded. The third mitigation measure refers to the ATC VCR (Air Traffic Control Visual Control Room) having full time visual surveillance. This would fall under the category of good practice, but may be limited by the design of the ATC VCR.  Actions Required The first action pertains to briefing the pilots on stop actions. Although this is not explicitly covered in Appendix C of the CAP 403, which covers the written and verbal briefings to pilots, it could be considered part of the “Display procedures” in the verbal briefing or “Procedures for cancellation or variation of programme” in the written briefing. The second action states that the display will only be carried out in weather conditions stipulated in CAP 403 or higher limits. In other words, this is an example of following the code of practice. The third action relates to the mitigation measure of closing the heliport, if requested to do so by the pilots. It is stated that “Air Display profiles are flown within reserved airspace”. It is presumed that this means that the displays are flown within the airspace that has been restricted using a RA(T) (Temporary Restricted Airspace) and that does not contain helicopters from the east side heliport, which has been closed. It would be expected that the display itself (excluding

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 334 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 17 the approach to the airport if pilots are flying in from elsewhere) would be flown within the reserved airspace. Again, this is standard good practice that would be expected from an airshow. The final action states that the Flying Display Director (FDD) must remind ATC (Air Traffic Control) and the Flying Control Committee (FCC) to “maintain visual lookout of display area and environs and intervene, if required, with the display aircraft by radio to prevent collision”. ATC continually monitor what is occurring in the air as part of their job and CAP 403 [4] states in paragraph 2.14 that “The FCC should have the clear authority of the Event Organiser to curtail or stop, on the grounds of safety, any display item, or, in extreme cases, the whole flying display” i.e. this forms part of the role of the FCC. Although this measure may help to prevent some accidents, there is an issue as to how effective this action would be in practice for incidents where there could be short timescales from noticing an arising issue to flight crew being informed and responding. An assessment should be performed as to the effectiveness of this measure in mitigating the risk of a mid-air collision.  Summary There appear to be no mitigation measures or actions required listed in the hazard identification that are over and above following the code of practice, with the exception of the potential closure of the heliport. Given that this hazard falls into the “Unacceptable” region of the risk matrix, it would be expected that additional measures and actions would have been considered, even if later found to be impractical. 2.3.3 Hazard 3: Mid-air collision – display formation This concerns a mid-air collision involving members of a display team. The severity has been assessed as being catastrophic and the likelihood as improbable. On the risk matrix, this gives it a classification of “Unacceptable”. In the table, however, it is recorded as “Review”. This is an error and, checking against the 2014 and 2013 versions of the assessment, it is one that has been there in previous years and not corrected. This adds weight to the suggestion that that the risk assessments have been reused without proper and due consideration of the hazards and risks each year.  Mitigation The first mitigation measure states that only recognised display teams with the appropriate authorisations will be allowed to display at Shoreham Airshow. This is a standard requirement, as detailed in Chapter 1 of CAP 403 [4]. The second mitigation measure states “Display airspace maintained to reduce/eliminate possibility of incursion by unknown traffic”. There are two points to make here. Firstly, it is standard practice and a role of Air Traffic Control to ensure the airspace is clear, and that it is maintained as such. Secondly, the hazard under consideration is a mid-air collision between two display aircraft. This measure would appear to be more appropriate under Hazard 2.  Actions Required In terms of the actions required, the first one, which requires confirmation of the Display Authorisations, is again standard practice and a requirement for holding Air Displays, as detailed in CAP 403. The second action is “ATC monitor airspace”. This is part of the role of air traffic control.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 335 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 18 The third requirement relates to the participants being familiar with stop instructions, which is to be covered during the mandatory briefings. This has been discussed previously in Section 2.2.7 and can essentially be considered to be following the code of practice. The final action relates to the weather conditions, which are stipulated within CAP 403. It is stated that the higher of the team requirements or CAP 403 should be used. The risk is incorrectly classified and there are no mitigation measures or actions required that are above and beyond the code of practice for an airshow. There is no assessment made as to whether these measures are suitable and sufficient. No additional measures appear to have been considered that might be specifically relevant for the Shoreham Air Display. Given that the risk level should be correctly identified as “Unacceptable”, it would be expected that additional measures would have been identified and considered, even if later dismissed. This does not appear to be the case. 2.3.4 Hazard 4: Ejector seat impacts crowd For this hazard, the severity has been assessed as catastrophic, the probability has been assessed as improbable but the risk ranking has been given as “Review” even though, according to the risk matrix, it should be “Unacceptable”. This is an error that can also be seen in the 2013 and 2014 assessments.  Mitigation There is one mitigation measure listed, which has tracked changes applied to it but is essentially the same as previous versions of the risk assessment. The measure essentially states that aircraft manoeuvres must be commenced before the 230 m display line (i.e. 230 m from the crowd line), or, for military aircraft in excess of 300 knots, at 450 m from the crowd line. The 450 m requirement is greater than that specified in CAP 403 [4] but is only applied to military aircraft. It is not made clear why any civilian aircraft that satisfy these criteria are not included in this mitigation measure. The distinction should be made on the capabilities of the aircraft, rather than on whether it is military or civilian.  Actions Required Under the “actions required” section, there is a generic statement made about monitoring other events and meeting any changes to the rules stated in CAP 403. These actions would be expected from following the code of practice for risk assessments but, as has been detailed in Section 2.2.5, there is no recorded evidence that this process has been followed. The remaining action is to review wind effects daily to “ensure that any on crowd wind is not so strong as to increase likelihood of ejector seat entering crowd area in the aftermath of ejection”. There is no indication given as to what these wind limits are likely to be. Also, there are different types of ejector seats available, which will behave in different ways on release. This does not appear to have been considered.  Summary The risk for this hazard is assessed as lower than it should be, the mitigation measure appears insufficient when all aircraft are considered and the actions required are too vague. There is no evidence that all mitigation measures have been identified and assessed, or that those considered are suitable and sufficient.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 336 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 19 It should be noted that only the risk from an ejector seat falling into the crowd has been assessed. Other objects falling or crashing into the crowd, such as the aircraft itself, have not been assessed. 2.3.5 Hazard 5: Loss of control due to pilot disorientation This hazard is listed as being “Unacceptable”.  Mitigation The first mitigation measure for this hazard requires pilots to have the required display currency “at least as required by CAP 403”. This forms part of the standard guidance as detailed in Chapter 1 of CAP 403. The second mitigation measure states that pilots must operate to the more stringent of the weather limits given in CAP 403, and their personal clearance. The recommended weather minima are given in paragraphs 3.43 to 3.46 in CAP 403. Paragraph 3.46 also states that “It should be borne in mind that participants may be further restricted by their licence or rating privileges”. This mitigation measure is therefore following the code of practice. The third mitigation measure concerns limiting radio transmissions during the display. The use of radio frequencies is covered in paragraphs 3.47 and 3.48 of CAP 403. It is stated in CAP 403 that, ideally, a quiet frequency should be allocated for use during the flying display, with another allocated to administration tasks. If only one frequency is available, then “the FDD must emphasise, in the written brief and at the verbal briefing, the need for good Radio Telephony (RT) discipline and for the minimum use of RT”. This measure is another example of following the code of practice. The fourth measure states “Each display pilot has the option to have the east side Heliport closed during his/her display”. It is unclear what effect this has on pilot disorientation. If it is perceived as a potential risk that could distract pilots, then the option of closing the heliport for all of the displays should be assessed as a separate specific hazard in the risk assessment. The final mitigation measure concerns marking the display line with Day-Glo markers to aid orientation. Paragraph 3.20 of CAP 403 states “Where the display line is not clearly delineated by a paved runway or other obvious line feature it should be marked with Day-Glo pyramids or panels, whitewashed lines or by some other suitable method”. This mitigation measure is another example of following the code of practice.  Actions Required The five actions required relate directly to the five mitigation measures. The first one is actioned for the FDD and is to ensure that all the CAP 403 and Display Regulations requirements are followed. This forms part of the role of the FDD as detailed in Chapters 1 and 2 of CAP 403. It is not clearly stated in CAP 403 that the FDD will ensure that the display pilots have the required authorities (which the pilot obtains from the CAA for civilian aircraft and the Ministry Of Defence (MOD) for military aircraft) but it is made clear that the FDD is responsible for the organising of the flying display and that the pilots must have the relevant display authorisation. It therefore appears reasonable that the FDD would be expected to review display pilot authorisations as part of the standard practice for airshows. The second action is on the FDD and Chair of the FCC to monitor weather conditions before and during the display. CAP 403 defines the type of events that may occur at specified minimum weather conditions, but it is not clearly stated how the weather is monitored or by

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 337 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 20 whom. In order to observe these conditions, however, people must be in place who are monitoring the weather conditions. This would therefore fall under the category of following the code of practice. The third action is to ensure that ATC (Air Traffic Control) are briefed to minimise the number of radio transmissions during the display. This action should be on all people with radio control (the FDD and the FCC, as well as ATC). It also forms part of the guidance given in paragraph 3.48 of CAP 403. The fourth action is to “confirm heliport suppression requirements during the display briefing”. This is an action that is specific to Shoreham Airshow. It would appear to be essential, if the option of closing the heliport is to be given to the pilots. The final action states “Mandatory daily briefing to all display pilots to emphasise the need for caution in reduced visibility or lack of horizon”. A daily briefing forms part of the guidance given in paragraphs 3.50 to 3.54 of CAP 403. Pilots are given details of current and forecast weather conditions, along with any local conditions or effects as part of the verbal briefing detailed in Appendix C of CAP 403. The note in bold in paragraph 3.43 of CAP 403 states “Pilots and FDD’s should give greater consideration to visual reference when there is little or no defined horizon.” This action is another example of following the code of practice that would normally be expected at an airshow. No assessment appears to have been made to determine if the measures and actions are sufficient for controlling the risks. The only measure above and beyond the code of practice relates to the closing of the heliport. It is not obvious why this measure is deemed relevant to the hazard under consideration.  Summary There are no mitigation measures or actions required that are above and beyond the guidance, with the exception of the closure of the heliport. No assessment has been made as to whether these measures are sufficient. If the heliport is considered a credible risk, then the option of closing it for all displays should be assessed as a separate specific hazard in the risk assessment. There is no indication as to whether any method has been used to identify and discount alternative measures. Given that the risk level was identified as “Unacceptable” for this hazard then it would be expected that alternative measures would have been identified and considered. 2.3.6 Hazard 6: Location of local built up areas This hazard has been assessed as having a risk level of “Unacceptable”. It has been subject to some changes to the text when compared to earlier versions of the risk assessment, but this has left the hazard description as “Location of local built up areas including”. Either the word “including” should no longer be there, or whatever should have been included is missing. It should be noted that the modifications from the previous version are marked up as “tracked changes”, confirming the draft nature of the document. It should be noted that built up areas are not a hazard. The hazard relates to aircraft flying over them and crashing, either above the area or into a building within the area. Alternatively, the hazard may be to the aircraft, perhaps through particularly tall buildings, an element of distraction etc. In either case, the hazard should be more clearly described.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 338 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 21  Mitigation The first mitigation listed is “The major built up areas lie close to the south-west of the display area”. This is not a mitigation measure but a description of the location of the population. Similarly, the second mitigation is “A small built-up area lies south of the display area along the coastal strip”. This is again a description and does not correspond to a mitigation measure. If the inclusion of these locations is to define no fly areas or areas where there are restrictions on minimum heights, etc, then this should be explicitly stated to make this clear. The third mitigation states that overflight of Lancing College is prohibited. The final mitigation is a modification from the previous version of the risk assessment and states that revised restrictions with respect to over flying congested areas have been agreed with the CAA. This includes the new football ground in the area. The first mitigation measure does not relate to the main built up areas around the airfield, where it might be considered that the consequences of the hazard are greater (whatever actual definition of the hazard is used in this instance). It is not stated in the assessment documents what the revised restrictions over the congested areas requires pilots to do in their display to minimise the risk.  Actions Required In terms of the actions required, the first relates to the restrictions being covered in the mandatory display briefing. This is covered in Appendix C of CAP 403 and can therefore be considered to be following the code of practice. The second action relates to the minimum height that is mandated over the built up areas to the south west. The tracked changes indicate that this has reduced from 1500 feet above ground level (agl) in 2014 to 1000 feet in 2015. No justification is given for this, even though this action would intuitively lead to an increase in the risk of an aircraft crashing in a built up area (e.g. if the pilot loses control they have less space and time to implement corrective measures). It is stated in the assessment that “Aircraft to be visually monitored to ensure compliance with this requirement”. This statement also applies to the next action, which gives the minimum height above the built up areas to the south west of the airfield as 500 feet agl, and forms the entirety of the fourth action which relates to the no flying zone over Lancing College. In all cases, a person on the ground needs to be able to accurately assess the height of an aircraft that also may be some distance away horizontally. This mitigation measure does not consider the possibility that these personnel may be distracted by events occurring on the ground or in other parts of the airshow. Alternative methods to assess the height, such as radar, are not mentioned and so it must be assumed that they have not been considered. It could be that an assessment would reach the conclusion that the implementation of radar would be too costly when compared to the decrease in the risk but the reasoning for this should be recorded. This is particularly true for this hazard, which has been identified as falling into the “Unacceptable” region of the matrix due to the potential for many people to be killed should an accident occur. The more serious the risk, the more has to be done to control the risk to a tolerable level. The final action states that the revised restrictions are to be briefed to the display pilots, both in the written and verbal briefs. This forms part of Appendix C in CAP 403 and is another example of recommended guidance and hence following the code of practice.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 339 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 22  Summary It is not entirely clear what the scenario under consideration is for this hazard. Two of the mitigation measures are descriptions of areas, and are not mitigation measures to control the hazard or risk. One of the mitigation measures identified relates to a specific area and another measure does not detail what revised restrictions are in place. The actions given are either within the CAP 403 guidance or have serious limitations. No assessment has been made as to whether the identified measures and actions are sufficient, and no additional measures appear to have been assessed. 2.3.7 Hazard 7: Public assembly on A27 and local roads The first issue with this hazard is that public assembly on the roads is not a hazard in itself, unless it impacts on the flying displays. The hazard is that an aircraft could crash on this area, where a large number of people may be congregated. If this is the case, then the consequences are likely to be catastrophic with the potential for multiple fatalities. In the risk assessment, however, it has been categorised as being “Hazardous” and the overall risk rating has been given as “Review”. If the more accurate category of “Catastrophic” is used, the risk rating would be “Unacceptable”. The probability rating for this hazard is given as “Improbable”. This is where it becomes important that the hazard is clearly defined. If the hazard is an aircraft crashing on this population area, then the probability rating is accurate. If, as appears to be the case in the risk assessment, the hazard is the likelihood that people stop on the local roads to watch parts of the airshow, then the likelihood rating must be “Frequent”. Regardless of whether the consequence rating is given as “Hazardous” or “Catastrophic”, a likelihood rating of “Frequent” leads to an overall risk rating of “Unacceptable”.  Mitigation In terms of mitigation, the risk assessment states that police take action to restrict parking on the A27 and other areas are monitored where possible.  Actions Required The actions are given as “Arrange for A27 and attractively placed parking areas to be cordoned off”. Neither of these seems sufficient to lower the likelihood that people will congregate around the airfield. An obvious additional measure that is not mentioned at all is the possibility of closing the A27 and/or any surrounding roads. This may not be possible but should be considered. It may not also prevent people from walking along the side of the road, but does make some attempt to stop people standing at the edge of the airfield. Another measure that has not been considered is the possibility of preventing aircraft flying over this area. This would significantly decrease the likelihood of an aircraft crashing onto the crowd. The risk assessment should recognise that people are likely to congregate outside the airfield boundary and that they need protecting from the consequences of any incident that occurs during the airshow. It is not sufficient to say that attempts will be made to prevent them stopping in the first place, unless it can be shown that they are completely prevented from congregating.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 340 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 23 There are also other issues concerning the congregation of people, such as people trying to gain access to the airfield from the perimeter. Given the broadness of the title of the hazard, it would be expected that a number of additional issues would need to be addressed. This has not occurred.  Summary The hazard is not clearly defined and the severity and risk ratings are too low. The mitigation measures and actions appear insufficient and there is no evidence that any alternative measures have been considered. 2.3.8 Hazard 8: Aircraft crash outside the airfield boundary One immediate point to note with this hazard is that it is not specified whether the mitigation and actions required apply equally to all aircraft or only to certain categories. For example, do all aircraft have to observe the same minimum height restrictions? Are some aircraft prohibited from overflying particular areas? More clarity is required.  Mitigation The first mitigation measure states that pilots must observe the normal “Rules of the Air” when outside the display area. This is standard practice outside any area that has non-standard regulations applied to it. There is a caveat in the “Rules of the Air” that exempts pilots from following these rules outside the display area if they are within 1 km of people congregated for the air display and with agreement from the competent authority, provided there is a suitable risk assessment. The normal “Rules of the Air” impose height restrictions and areas of no overflying. This has particular relevance for any people congregated outside the airfield boundary (as in the case of Hazard 7). If this exemption has been granted for Shoreham Airshow, then the first mitigation measure listed (normal “Rules of the Air” apply outside the display area) is not correct. The second mitigation measure states that there are major restrictions on the display aircraft that require specific minimum flight heights over specific locations around the display site. The third states that the pilots will be briefed on the restrictions. Paragraph 3.3 of CAP 403 states “FDDs should consider imposing minimum height restrictions over local sensitive and congested areas”. It is stated that the restrictions should be clearly declared in the flying display instructions. These two measures are therefore following the code of practice.  Actions Required The first and third actions, relating to briefing of crews on safety requirements and mandatory operating regulations, and direct radio contact between the pilots and the FDD or CFCC are both following the guidance given in CAP 403 (Appendix C for the details of the briefing and paragraphs 3.47 and 3.48 for the use of radio). The second action relies on the FDD and FCC being able to correctly ascertain whether the regulations regarding minimum heights and the display programme are being observed, and to have the ability to stop the display at any time. It could be argued that it would be difficult for anyone on the ground, regardless of their own flying experience, to be able to always correctly determine whether the regulations are being complied with. In addition, does the “agreed display programme” include the manoeuvres that will be performed in that part of the display, or just the order of the displays on that day? If it is the former, then it will be difficult for a

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 341 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 24 person on the ground to judge whether or not all aspects of the display have been followed. If it is the latter, then it has little relevance to the hazard under consideration. The ability to issue a stop command is given as part of the third action. This forms part of the guidance in CAP 403 (e.g. paragraph 2.14). In the event of an emergency, by the time the person on the ground has realised that there is an issue, it may be too late to issue a stop command. Whilst the ability to do so is essential, it should be recognised that it may have limited effectiveness. No alternative mitigation measures or actions appear to have been considered. In particular, the possibility of using radar to monitor the flights has not been discussed. The option may not be feasible for a number of reasons but it should have been considered and reasons given as to why it is not suitable. The lack of consideration of such a measure leads to uncertainty as to whether or not all possible measures have been considered.  Summary It has not been clearly stated in the assessment whether all aircraft are subject to the same measures or whether these apply to just some of the aircraft. The mitigation measures and actions required are following the code of practice, but no assessment has been made as to whether or not these measures are sufficient to control and reduce the risk. One of the identified mitigation measures outlined may not apply to all areas outside of the airfield boundary, and some of the actions required rely on a degree of visual accuracy on behalf of the FDD and FCC. 2.3.9 Hazard 9: Fast jet aircraft collision into crowd area This hazard has been assessed as having a risk level of “Unacceptable”.  Mitigation It appears to only consider military aircraft and the only mitigation relates to the display line for aircraft that can reach speeds in excess of 300 knots. In this instance, the display line is moved to 450 m from the crowd line. This is greater than the minimum required in paragraph 3.25 of CAP 403 [4] but there is nothing to indicate why it only applies to military aircraft and not all aircraft that are capable of speeds of 300 knots.  Actions Required The actions required are very similar to those listed for Hazard 8 and represent following the code of practice (e.g. briefing crew on safety requirements and having radio contact with the display pilot). As in the case of Hazard 8, there appears to be a large reliance on the FDD and FCC being able to monitor the flights on the ground and notice if the aircraft is outside of the specified limits (either vertically or horizontally if the “display programme” is taken to mean the details of the specific display). The ability of the FCC to issue a stop command is listed as an action to reduce the risk. Whilst this is obviously essential, in an emergency there may not be time to issue such a command and for the pilot to have sufficient scope to act upon the stop command. There are no other mitigation measures or actions considered. Alternatives are not discussed or mentioned.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 342 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 25  Summary This hazard has been identified as applicable to military aircraft only. Civilian aircraft have not been considered, although some are capable of reaching speeds of 300 knots. There is only one mitigation measure listed and whilst some of the actions represent following the code of practice there is nothing to indicate that the measures and actions listed are sufficient. Other actions identified are potentially impractical. 2.3.10 Hazard 10: Fatigue of essential safety staff This hazard relates to the FDD, CFCC, FCC or ATC becoming fatigued, leading to impairment of their judgement so that safety is compromised. It must be inferred that fatigue could lead to these key personnel issuing an erroneous command which leads to aircraft collision, a crash etc. or that they miss an issue relating to the safety of the airshow. The severity rating is given as “Hazardous” leading to a risk level of “Review”. It could be argued that, if fatigue of staff leads to safety being compromised, the consequences could be catastrophic (e.g. an aircraft crash). In this case, the risk level would be “Unacceptable”. It is important that the hazard is clearly defined in order that it can be ranked accurately in the risk matrix.  Mitigation The only mitigation measures listed are that the ATC staff work to legal working requirements i.e. they follow the law, and that the FDD and FCC members are “familiar with the threat posed by personal fatigue and are used to monitoring for it in themselves and others”. This is a vague control that does not obviously reduce the likelihood or severity of the hazard. A more effective specific measure would be to ensure mandatory regular breaks and a timetable that ensures no one is on duty for longer than a specified time. It should also be ensured that there are sufficient members of the FCC (and a deputy FDD) such that, should a member be taken ill for any reason, there are enough other members to cover the safety of the airshow. These controls may be in place during the show, but they are not mentioned in the risk assessment.  Actions Required Two required actions are listed. The first relates to ensuring that the ATC staff follow the legal requirements. The second is on the FDD, CFCC and FCC to monitor their own and others’ work patterns and to rest individuals where fatigue is expected. All are to be reminded that they are required to make critical judgements throughout their duty periods and that they need “to self- and cross-monitor for individual fatigue and to report any concerns to (the CFCC)”. This action places a large reliance on people noticing their own and others’ fatigue levels. At a busy airshow it may be difficult to notice how others are behaving, or if they are showing any signs of fatigue. Also, although work patterns are mentioned, it is not made clear as to how long people are expected to be on duty for, how long breaks are, and if there are sufficient staff to cover in the event of illness or fatigue. These controls should be explicitly defined as part of the risk assessment to make the mitigation and consequent reduction in risk levels clear in the assessment.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 343 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 26  Summary The hazard is not clearly defined and the risk level may be too low. The mitigation measures are either legal requirements or are too vague to control or reduce the risk levels. The actions either ensure legal compliance or are potentially impracticable. There is no evidence that an assessment was performed to determine if the actions and measures are sufficient. There is no record of any additional measures being considered. 2.4 HEALTH AND SAFETY EXECUTIVE (HSE) GUIDANCE The HSE guidance, “Reducing Risks, Protecting People” (R2P2) [6] has been considered in relation to the Shoreham Airshow Air Display Risk Assessment, together with other published guidance [7, 8] and health and safety legislation [9]. One of the aims of R2P2 is to set out a framework for “decision taking by HSE which would ensure consistency and coherence across the full range of risks falling within the scope of the Health and Safety at Work Act”. The document outlines the principles that HSE uses to assess and control risks and may be regarded as guidance on how HSE would expect others to consider control of health and safety risks. The main point from the “Management of health and safety at work regulations 1999” [9] is the need for employers to have a risk assessment that is a “suitable and sufficient assessment” of the risks to the health and safety of employees and to the health and safety of persons not in their employ but who are exposed to risk through the employer’s undertakings. In the case of the Shoreham Airshow, this means that the health and safety of the public watching the show, or in areas that could be affected by the show, needs to be considered, along with the health and safety of the people working at the airshow. Gadd et al [7] builds on the work of R2P2 and highlights some of the common failings seen with risk assessments, i.e. the ‘pitfalls’ of risk assessment. The HSE guidance, “Managing for health and safety” [8] is primarily aimed at commercial businesses, but the concepts used are generally applicable and some of the practices can be applied to events such as airshows. The legislation [9] sets out the legal requirements with regard to managing health and safety in the workplace. 2.4.1 Hazard identification Paragraph 87 of R2P2 discusses the issue of ignorance in relation to the identification of hazards. In order to counteract this, a “wide engagement of different disciplines and communities of interest in the characterisation of the issue” should be undertaken. It also states that a further measure is to be as open as possible to enable alternative views to be considered at an early stage. Gadd et al discusses failure to identify all hazards as one of the common mistakes made in risk assessments. The “Managing for health and safety” guidance [8] discusses the reasons for doing what it calls “risk profiling”, which is equivalent to a risk assessment. In particular it states that the outcome of the risk profiling will be that the right risks have been identified and that it will inform decisions about what control measures are needed. All of the guidance states that a lack of awareness of the key hazards or risks is an indication of a lack of competence in the management of health and safety.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 344 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 27 In relation to the Shoreham Airshow Air Display Risk Assessment, no detail is given as to how the hazards were identified. No list is given of the people involved in the process, or of any additional hazards that may have been identified but subsequently dismissed. HSL has been able to quickly identify additional hazards that appear to have not been considered, even without undertaking a full hazard identification process. This suggests that a thorough process was not performed for the Shoreham risk assessment. Paragraph 93 of R2P2 considers hazards where there is a large degree of uncertainty involved and conventional techniques may not be applied to assess the risks. It is stated that the uncertainty may be overcome by “constructing credible scenarios on how the hazards could be realised and thereby making assumptions about consequences and likelihoods. The credible scenarios can range from a ‘most likely’ worst case to a ‘worst case possible’ depending on the degree of uncertainty”. It further states that, although “risk assessments based on scenarios are inevitably narrower in scope than a full blown risk assessment, this may not be a serious limitation if the scenarios are carefully chosen to reflect what could happen in reality”. In the Shoreham Airshow Air Display Risk Assessment, some scenarios have been considered and an attempt made to determine how likely these scenarios are to occur. The general approach used is not unreasonable i.e. constructing a list of possible scenarios. However, it does not appear that all credible scenarios have been considered; there are insufficient scenarios to reflect what could happen in reality. There is a requirement to assess all “reasonably foreseeable” hazards (paragraph 6 in R2P2). 2.4.2 Risk mitigation Paragraphs 99 and 100 in R2P2 are concerned with identifying options to consider how to manage the risks. In particular, the use of experience is given as one way of identifying options. It also states that possible good practice should be examined as a way of addressing the hazards identified. Good practice needs to be evaluated as to whether it is relevant and sufficient for the hazards posed. If specific good practice is not available then good practice that applies in comparable circumstances should be considered, if it is directly transferable to the hazard in question or can be suitably modified. Section 4.15 of Gadd et al lists a lack of consideration of further measures that could be taken as one of the errors often made in risk assessments. It states that it is necessary to explicitly identify possible risk reduction options and assess whether they are reasonably practicable. In addition, “all options, or combination of options that are reasonably practicable must be implemented”. It goes on to say that each option should be measured against the present situation. Most of the mitigation measures and actions required given in the Shoreham Airshow Air Display Risk Assessment are taken from the code of practice as laid down in the CAP 403 guidance [4]. No assessment appears to have been performed as to whether these are suitable and sufficient for each of the hazards considered, however. R2P2 states that it needs to be determined if there are any constraints attached to using a particular option e.g. is it technically feasible, are there any legal constraints etc. Also, any adverse consequences for using a particular option need to be considered e.g. a measure may reduce the risk from one hazard, but increase it from another. Section 4.18 of Gadd et al also states that it is necessary to examine the effectiveness of the risk control measure, and to consider whether any unexpected risks have been inadvertently created.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 345 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 28 The “Managing for health and safety” guidance [8] states that health and safety controls that do not seem practical are an example of poor worker consultation. These issues do not appear to have been considered in the Shoreham Airshow Air Display Risk Assessment. In many cases it is stated that the FDD and FCC will monitor the display from the ground and ensure that the minimum heights and the display plan are being observed. There appears to be no recognition of how difficult it might be to perform this role in practice, regardless of the experience of the FDD and FCC. There is a possibility that other issues regarding the airshow could distract these key personnel from this important activity. This suggests that the people involved in this action have not been properly consulted on the identified mitigation measure’s practicality and effectiveness. Paragraph 100 in R2P2 continues by stating that the “precautionary approach” should be used. In particular, as the degree of uncertainty increases, there is an increasing requirement for more stringent measures to mitigate the risks. This could be applied to all hazards where the consequences are “Catastrophic”, as defined in the Shoreham Airshow Air Display Risk Assessment. In practice, this does not appear to have happened. The only measures listed for many of the “Unacceptable” risks are based on the code of practice and additional measures do not appear to have been considered. R2P2 also refers to the relative costs and benefits of introducing a risk reduction measure. This can be used to determine whether or not a measure is proportionate to the level of risk involved. There is no evidence that this has formed part of the Shoreham Airshow Air Display Risk Assessment in either a quantitative or qualitative form. R2P2 has a section on evaluating the effectiveness of any action taken (paragraphs 115 to 117), and this is also covered in Section 4.18 of Gadd et al. In particular, R2P2 states that procedures should be in place to review the decisions made after a suitable interval. These should establish whether the actions taken were effective in controlling the risk, and whether any decisions needed to be modified as a result of new knowledge. An assessment should be made as to whether the information gathered to identify the hazards and mitigate the risks was appropriate, and whether improved knowledge and data can help make better decisions. An assessment should be made as to what lessons could be learned from the process. It is further stated that having a system for monitoring and evaluating progress provides a “good opportunity to assess whether such ‘established standards of good practice’ are out of date. New developments such as better knowledge of the risk involved and advances in technology may indicate that a higher standard would be more appropriate to control he risk”. The “Managing for health and safety” guidance [8] further asks the question of whether lessons have been learned from occasions where things went wrong and how the health and safety performance is reviewed. There is a whole section concerning the investigation of accidents and incidents, another on reviewing performance and a further one on learning lessons. In the Shoreham Airshow Air Display Risk Assessment, no mention is made of recording the effects of the risk reduction measures and actions, or any infringements of the regulations and measures. There appears to be no process for evaluating the measures in place and adjusting the risk assessment accordingly. There is no recorded process for learning lessons from previous incidents [10, 11, 12], and no reference to any incidents are made in the risk assessment. Although there is a statement made about routine reviews, there is no record of the reviews occurring. Additional information obtained by the AAIB indicates that the FDD requested comments from other people on the risk assessment prior to the 2015 airshow, but there is no record within the risk assessment of this. Not all of the comments from the reviewers have been fully incorporated, although legitimate issues were raised. There is no indication that lessons

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 346 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 29 learnt from previous airshows or incidents formed part of the review. According to the “Managing for health and safety” guidance [8], having a poor incident history is an example of poor health and safety management. 2.4.3 Tolerability of Risk R2P2 introduces the “TOR framework” in paragraph 122. TOR refers to the Tolerability of Risk and aids in the categorisation of a particular risk. HSE represents this concept by an inverted triangle with the risk increasing as you move up the triangle (see Figure 1). If the risk is low, then it will fall into the “Broadly acceptable” region. As the risk increases, it moves into the “Tolerable” region and high risks may end up in the “Unacceptable” region. Risks in the “Tolerable” region are described in Gadd et al [7] as “typical of those that people are prepared to tolerate in order to secure certain benefits”. In terms of the Shoreham Airshow Air Display Risk Assessment, the comparable categories used in the risk matrix are “Acceptable” for the HSE “Broadly acceptable” category, “Review” for the HSE “Tolerable” category and “Unacceptable” for the HSE “Unacceptable” category. Risks in the HSE “Tolerable” and “Broadly acceptable” categories must still be controlled or reduced As Low As Reasonably Practicable (ALARP). Figure 1 HSE Framework for the tolerability of risk [6] In the description of the TOR framework, it is stated that any activity or practice that leads to a risk that falls into the “Unacceptable” region “would, as a matter of principle, be ruled out unless the activity or practice can be modified to reduce the degree of risk so that it falls in one of the regions below, or there are exceptional reasons for the activity or practice to be retained”. In the Shoreham Airshow Air Display Risk Assessment, the authors have claimed that all risks have been reduced to the “Acceptable” level, including those that fell into the “Unacceptable” category initially. It appears possible that there has been a misunderstanding around what the various categories mean in practice and it has been assumed that an activity cannot take place if it falls into any region other than the “Acceptable” category of risk. R2P2 makes it clear that, even if a risk falls into the “Broadly acceptable” region, reasonably practicable measures to reduce the risks should be considered. In the Shoreham Airshow Air

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 347 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 30 Display Risk Assessment, it is stated that no further consideration of the risk is required if it falls into the “Acceptable” region on their matrix. This contradicts the guidance in R2P2. Within the “Tolerable” region in the TOR framework, it is expected that residual risks “are not unduly high and kept as low as reasonably practicable (the ALARP principle)”. It is also expected that the risks are reviewed periodically to ensure that they still meet the ALARP criteria e.g. by considering any new techniques or information that have become available. An assessment is needed to determine whether the risks have been reduced ALARP. The starting point of such an assessment should be the present situation in the duty holder’s undertaking or, if this is not possible, an option which is known to be reasonably practicable (e.g. one which represents existing good practice). Any additional measures are considered against this starting point, to determine whether or not they are reasonably practicable (paragraph 5 in Appendix C of R2P2). Gadd et al [7] is more succinct and states that “Reducing risks ALARP means that if it is reasonably practicable to implement a risk reduction measure, it must be implemented.” In addition, it states that “Duty holders should consider what more could be done to reduce a risk and why it is not being done i.e. whether or not it is reasonably practicable to implement any possible additional measures that are identified”. A lack of consideration of ALARP or further measures that could be taken is recognised a common mistake made in risk assessments and is discussed in Section 4.15 of Gadd et al. The Shoreham Airshow Air Display Risk Assessment does not appear to have regularly reviewed the risks as indicated by the very few changes that have been made over the years and the lack of a procedure for updating the assessment. Additional information obtained by the AAIB indicates that the risk assessment was sent to others for comment, but there is no record of this process and not all of the comments have been fully incorporated, although they raised legitimate concerns. No ALARP assessment appears to have been performed for any of the identified hazards. Instead, broad statements are made that all the risks have been reduced to “Acceptable”. Additional mitigation measures have not been considered and assessed to see whether they should be implemented, under the ALARP principle. 2.4.4 Risk management In R2P2, paragraph 141, it is stated that HSE start with the expectation that the controls in place “should, as a minimum, implement authoritative good practice precautions (or achieve similar standards of prevention/protection), irrespective of specific risk estimates”. Paragraph 142 goes on to state that authoritative sources of relevant good practice include “guidance agreed by a body representing an industrial or occupational sector”. In this instance, the guidance provided by the Civil Aviation Authority (CAA) should be implemented as a minimum. R2P2 continues by stating that an assessment should be made as to whether adoption of the good practice is an adequate response to the hazards. In the Shoreham Airshow Air Display Risk Assessment, the guidance given by the CAA has generally been followed, although there are notable exceptions (e.g. not considering risk reduction measures for risks assessed as “Acceptable”, using a risk matrix that does not explicitly consider the risks to people etc.). For all the identified hazards, however, mitigation measures are given but no link is made with a subsequent reduction in risk, or whether the reduction is sufficient. In paragraphs 145 and 146 of R2P2, it is stated that there will be examples where existing good practice is insufficient to control the risks. In this instance, additional measures identified previously should be examined to determine if they lower the risks to an acceptable level.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 348 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 31 The Shoreham Airshow Air Display Risk Assessment makes no direct link between the mitigation measures and the risks, which is a common problem recognised in Section 4.18 of Gadd et al. In the majority of cases, no additional measures have been considered. Given that no process has been recorded for identifying both the hazards and mitigation measures, it is not clear whether any additional measures were considered and disregarded. If this was the case, the process was not recorded and the reasons for discarding additional measures have not been given. In Section 4.19 of Gadd et al [7] the issue of not doing anything with the results of the risk assessment is discussed. It states that it is “essential that action is taken as a result of the findings of the risk assessment” and that it should not be considered a “paper exercise”. At the end of the section it says “The assessment will almost inevitably result in recommendations for improvements and further actions to control and reduce risk …”. In the Shoreham Airshow Air Display Risk Assessment, no recommendations are made and the majority of the mitigation measures and actions do not go beyond the code of practice given in CAP 403 [4]. Additional mitigation measures do not appear to have been considered and assessed. The second paragraph of Section 2 in the “pitfalls” paper [7] states “The findings from a risk assessment can be used to inform decisions as to whether any existing precautions or control measures are adequate, or whether additional prevention or control measures are needed. Risk assessment can also be used to perform a systematic comparison of different risk control/reduction options so that the optimal decision can be made”. In the Shoreham Airshow Air Display Risk Assessment, no assessment is made as to whether the proposed measures control the risk or whether additional measures are required. An overview of the law on health and safety is given in the “Managing for health and safety” guidance [8]. It states that risk assessment must be “suitable and sufficient” which is interpreted as showing, amongst other areas, that the precautions are reasonable and the remaining risk is low, and the workers were involved or represented in the process. In the Shoreham Airshow Air Display Risk Assessment, it is not recorded who was involved in the risk assessment process and no assessment has been given for the effects of identified mitigation measures and actions. No link is made between these measures and the final tables in the risk assessment stating that the risks are all “Acceptable” prior to the show. In summary, the guidance given by HSE has not been followed and there appears to be a general lack of understanding of the risk assessment process and what is required.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 349 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 32 3 CONCLUSIONS A review of the 2015 Shoreham Airshow Air Display Risk Assessment [1] has been conducted. This has included a comparison with the corresponding risk assessments for the airshows from 2014 and 2013, consideration of the RAFA Battle of Britain Air Show Shoreham Airport Risk Assessment 5 from 2015, against the CAP 403 guidance from the Civil Aviation Authority (CAA) [4] and with Health and Safety Executive (HSE) and other risk assessment guidance [6]. The main findings from the review are:  The risk assessment does not fully comply with the guidance given in CAP 403. Compliance with the industry guidance would be expected as a minimum.  The 2015 Air Display Risk Assessment does not appear to have been finalised as only a draft version has been made available. A risk assessment should be properly documented and a record kept of changes made;  The risk assessments from the previous years are almost identical to that for the 2015 airshow, with only minor modifications to two of the identified hazards assessed. According to the HSE guidance [6, 7, 8], risk assessments should be regularly reviewed, with a record of the review being made. The review should incorporate any additional knowledge gained since the previous review was undertaken. Additional information from the AAIB indicates that the risk assessment was sent to others for comments but there is no indication that additional knowledge was considered and not all of the legitimate concerns raised were incorporated into the document;  The Civil Aviation Authority (CAA) guidance for organising and running airshows given in CAP 403 [4] has not been fully followed (e.g. the use of an alternative risk matrix which makes it harder to assess the effects of mitigation measures on the risk, not considering additional risk reduction measures for risks that fall into the “Acceptable” region of the matrix, etc.);  There is no acknowledgement that the CAP 403 guidance was rewritten in February 2015, which may or may not impact on the risk assessment;  The risk assessment does not comply with the guidance given by HSE for assessing that risks are being properly controlled and managed 6, 7;  It is unclear how the hazards and appropriate mitigation measures have been identified, leading to a lack of confidence that all credible hazards and mitigation measures have been considered. A reference to a meeting where the hazard identification was undertaken, together with a list of attendees would be expected. The meeting would also consider risk reduction measures for the identified hazards. The outcome of this meeting would either be recorded directly in the risk assessment, or in another document with reference made to it from the risk assessment;  There is no evidence that all relevant parties (e.g. representatives from the airfield, pilots, members of the Flying Control Committee (FCC), etc.) have been consulted on the risk assessment and provided input to it. A record of those involved in the identification of hazards and risk reduction measures should be included, together with their qualifications and areas of expertise;

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 350 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 33  There appears to be no account taken of lessons learnt, from either previous airshows at Shoreham or elsewhere. HSE guidance [6, 7, 8] states that previous incidents should be considered as part of the risk assessment process;  There appears to be no comprehensive review of the risk assessment each year, and there is little evidence that there was a comprehensive review of the assessment in 2015 compared to the previous year (the signatures are digitally scanned in the assessment document and so there is nothing to indicate that the person in overall charge viewed the risk assessment in 2015. Also, the date of the signature for the 2015 risk assessment is August 2015 although the date on the risk assessment is April 2015. The August date given for the signature in the 2015 assessment corresponds with the date given in the 2014 assessment). A regular review of the risk assessment to ensure that the hazards are still relevant, no new mitigation measures have been identified, etc, forms part of the guidance given by HSE [6, 7, 8]. The AAIB have obtained additional information that indicates that some form of review did occur prior to the 2015 airshow. The risk assessment was sent to others for comment but there is no indication that a comprehensive review process occurred, no record is made of this in the risk assessment, and there is one legitimate issue that has not been incorporated into the risk assessment;  There is an error in the interpretation of what is required for risks that are considered to be “Acceptable”. Both the CAA guidance [4] and the HSE guidance [6, 7, 8] state that risk reduction measures should be considered for risks that fall into this region and any that are assessed as being practicable should be implemented;  Some of the risks identified have been wrongly classified as “Review” when they should be “Unacceptable”;  Some of the hazards have not been clearly defined; they are not hazards in themselves but could affect the consequences of an aircraft crash (e.g. the congregation of people along the A27 and other surrounding roads);  The majority of the mitigation measures are taken from the code of practice. In most cases, additional specific mitigation measures have not been considered. HSE guidance [6, 7, 8] is clear that, as the risks increase, greater effort is required to identify additional mitigation measures over and above standard good practice, to reduce the risks. Many of the identified hazards at the Shoreham Airshow fall into the “Unacceptable” region of the risk matrix but very few additional measures have been assessed;  Some of the mitigation measures apply only to military aircraft, when some civilian aircraft could also cause the hazard under consideration;  There is no clear link between the mitigation measures and actions required and the reduction in the risk. Instead it is stated that all risks have been reduced to the “Acceptable” region. This is a recognised pitfall as given in an HSE paper [7];  There appears to be no understanding of the need to reduce risks to ALARP (As Low As Reasonably Practicable), which does not mean that they must all fall into the “Acceptable” region. HSE guidance [6, 7, 8] requires the risks to be reduced ALARP and that the risks should be regularly reviewed to ensure that they are being managed effectively; and  There is no demonstration that the mitigation measures reduce the risks ALARP.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 351 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 34 The majority of the mitigation measures identified are taken from CAP 403 guidance, and are therefore referring to a code of practice. However, there is no assessment as to whether these measures do reduce the risk levels of the hazard, and whether this is from a reduction in the likelihood, severity or both. An assessment of the impact of any mitigation measure should be considered as well as assurance that the mitigation measures are being correctly implemented. Where there is a more significant risk then other measures should be identified to control and reduce the risks ALARP. This is especially true for features that were specific to the Shoreham Airshow, such as nearby population centres, weather conditions, and so on. In conclusion, the risk assessment is not considered to be fit for purpose as it does not demonstrate that the risks from the air display at the airshow were being managed and controlled.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 352 Appendix J (Cont) OFFICIAL SENSITIVE HEALTH AND SAFETY LABORATORY Review of the 2015 Shoreham Airshow Air Display Risk Assessment, MSU/2016/04 35 4 REFERENCES 1. RAFA (2015). Shoreham RAFA Air Display 2015, air display risk assessment. 6 January 2015. 2. RAFA (2014). Shoreham RAFA Air Display 2014, air display risk assessment. 14 August 2014. 3. RAFA (2013). Shoreham RAFA Air Display 2013, air display risk assessment. 20 August 2013. 4. CAA (2015). Flying displays and special events: A guide to safety and administrative arrangements. CAP 403, http://publicapps.caa.co.uk/docs/33/CAP%20403%20Flying%20displays%20and%20sp ecial%20events.pdf, accessed 25 January 2016. 5. Air Show and Event Safety Services (2015). RAFA Battle of Britain Air Show Shoreham Airport Risk Assessment. First Issue, 25 May 2015. 6. HSE (2001). Reducing risks, protecting people. HSE Books, ISBN 0 7176 2151 0, http://www.hse.gov.uk /risk/theory/r2p2.pdf, accessed 25 January 2016. 7. Gadd SA, Keeley DM and Balmforth HF (2004). Pitfalls in risk assessment: examples from the UK. Safety Science, Vol. 42, pp. 841-857. 8. HSE (2013). Managing for health and safety. HSG65, HSE Books, ISBN 978 0 7176 6456 6, http://www.hse.gov.uk/pubns/priced/hsg65.pdf, accessed 25 January 2016. 9. The Management of Health and Safety at Work Regulations 1999. http://www.legislation.gov.uk/uksi/1999/3242/made, accessed 9 February 2016. 10. AAIB (2009). Formal report AAR 6/2009. https://www.gov.uk/aaib-reports/6-2009- hawker-hurricane-mk-xii-iib-g-hurr-15-september-2007, accessed 2 February 2016. 11. AAIB (2011). AAIB Bulletin 7/2011. https://assets.digital.cabinet-office.gov.uk/media/5422f9e5e5274a1314000733/Swift_S- 1__G-IZII_07-11.pdf, accessed 2 February 2016. 12. BBC (2015). http://www.bbc.co.uk/news/uk-england-manchester-33748256, accessed 9 February 2016.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix J 353 Appendix J (Cont) OFFICIAL SENSITIVE The Health and Safety Laboratory (HSL) has been developing health and safety solutions for over 100 years. Our long history means that we’re well-placed to understand the changing health and safety landscape, and anticipate future issues. We are part of the Science Directorate of the Health and Safety Executive (HSE) – our work with the regulator gives us a unique insight into the changing face of workplace health and safety. HSL employs about 400 staff, who help make working environments and working lives safer, in the UK and around the world. From our base in Buxton, and with staff in six other locations across the UK, we focus on the development of practical solutions to workplace health and safety problems. Our scientists have a strong international reputation for world-class research, undertaken on behalf of the Health and Safety Executive (HSE) and other sponsors in government and industry. ISO 9001 ISO 14001 OHSAS 18001 Health and Safety Laboratory Harpur Hill Buxton Derbyshire SK17 9JN UK www.hsl.gov.uk T : +44 (0) 1298 218218 E : hslinfo@hsl.gsi.gov.uk

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 354 Appendix K Review of the Risk Assessment Sections of CAP 403 Review of the risk assessment sections of CAP 403 20 June 2016 MSU/2016/13 Enabling a better working world

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 355 Appendix K (Cont) OFFICIAL SENSITIVE REVIEW OF THE RISK ASSESSMENT SECTIONS OF CAP 403 MSU/2016/13 Production of this report and the work it describes were undertaken under a contract with the Air Accident Investigations Branch (AAIB). Its contents, including any opinions and/or conclusion expressed or recommendations made, do not necessarily reflect policy or views of the Health and Safety Executive. © Crown Copyright 2016 Report Approved for Issue by: Date of Issue: 20 June 2016 Lead Author: HSL Project Manager Technical Reviewer(s): Editorial Reviewer: HSL Project Number: PE06406 Harpur Hill, Buxton Derbyshire, SK17 9JN T: +44 (0)1298 218000 W: www.hsl.gov.uk

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 356 Appendix K (Cont) OFFICIAL SENSITIVE DISTRIBUTION Air Accident Investigations Branch (AAIB) Health and Safety Laboratory (HSL) Health and Safety Laboratory (HSL) HSL Reports and Papers Library

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 357 Appendix K (Cont) OFFICIAL SENSITIVE CONTENTS 1 INTRODUCTION ..................................................................................... 1 2 REVIEW OF THE RISK ASSESSMENT ASPECTS OF CAP 403 .......... 3 2.1 Overview of CAP 403 .............................................................................. 3 2.2 CAP 403 references to risk assessment .................................................. 3 2.3 Guidance on how to undertake a risk assessment .................................. 7 2.4 Guidance on who should be involved in the risk assessment process .. 13 2.5 Guidance for different sizes of event ..................................................... 15 2.6 Management of risks using the guidance .............................................. 16 2.7 Guidance in relation to health and safety legislation .............................. 18 2.8 Summary of observations ...................................................................... 27 2.9 CAP 760 hazard and risk assessment guidance ................................... 23 3 CONCLUSIONS .................................................................................... 31 4 REFERENCES ...................................................................................... 34

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 358 Appendix K (Cont) OFFICIAL SENSITIVE SUMMARY The Air Accident Investigation Branch (AAIB) asked the Health and Safety Laboratory (HSL) to assess the risk assessment sections of CAP 403, a document produced by the Civil Aviation Authority (CAA) which provides guidance on how to run an airshow, including information on considering the safety aspects of airshows. The AAIB would like to know if the guidance provided by the CAA is a suitable and sufficient aid to those managing the air display risks at airshows. HSL is the science laboratory for the Health and Safety Executive (HSE). HSL provides scientific evidence to support HSE policy and regulation and provides expertise and advice for businesses both within the UK and internationally. The HSL risk assessment specialists therefore have extensive experience in assessing hazard and risk assessments from a regulatory Health and Safety perspective. HSL reviewed CAP 403 to determine whether the guidance provided sufficient aid for airshow risk assessors considering the safety of air displays. The review considered whether any additional detail that could be included in the guidance would help inform the risk assessment process for airshow air displays. A number of points to consider as part of the review were identified following discussions between the AAIB and HSL. These were to assess:  How the guidance describes the risk assessment process;  How the guidance identifies those who should be involved in the risk assessment process;  Whether the risk assessment guidance is applicable to all sizes of event;  How the implementation of the risk assessment guidance allows risks to be managed;  Whether the guidance adequately reflects health and safety legislation;  Where there is risk assessment good practice outlined in the guidance; and  How the guidance given in CAP 403 compares to other CAA hazard and risk assessment guidance. A number of observations have been made of good practice in hazard and risk assessment in CAP 403. There are some areas of the guidance, however, where additional information is required to lead to greater confidence that a risk assessment created using the guidance will be suitable and sufficient for managing the risks. The people undertaking the risk assessments are likely to be experts in flying but not in risk assessments. There are several areas, therefore, where the inclusion of additional information for assessors might be beneficial. The basic principles of risk assessment are covered in the CAP 403 guidance on the safety aspects of air displays at airshows. The guidance given is applicable to risk assessments in general. The focus of this study has been on the application of this advice to the assessment of the risks from the air displays planned at the airshows.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 359 Appendix K (Cont) OFFICIAL SENSITIVE This study has identified areas of the guidance where changes are required to give airshow flying display organisers the information needed to undertake meaningful risk assessments, or in some cases, to avoid misleading organisers on what needs to be done. Ultimately, these improvements should ensure that the risk assessments help airshow organisers to target and control the risks from flying displays.  Identifying the right people to assess the risks CAP 403 should clearly list the qualifications and experience required of the people who should be involved in assessing the risks. This will ensure that people with sufficient knowledge to identify the hazards and the mitigation measures, and to assess the associated risks, will undertake the risk assessment;  Improving guidance on hazard identification CAP 403 should include some additional information to stress the importance of the hazard identification process to the quality of the overall risk assessment. This could include advice on defining what is meant by a “hazard”, and recommending that more information is provided in an assessment explaining the thoughts of the assessor behind the hazards identified. The CAP 403 guidance could also recommend that a record be kept of the hazard identification process. This allows an understanding of the expertise used by the personnel involved in the process and would allow an understanding of the reasons why some hazards have not been considered further in an assessment;  Issues with the guidance on mitigation measures An area where the existing guidance in CAP 403 is potentially misleading is concerning the area of risk mitigation. This is a significant area that needs to be improved as failing to properly assess the mitigation measures could lead to inappropriate or unachievable measures being put in place that do not control or reduce the risks. The guidance uses examples where CAP 403 requirements to allow an airshow to go ahead are used as measures to mitigate the risks from the identified hazards. The guidance in CAP 403 should be taken as the minimum requirement and the risks assessed initially assuming that the guidance has been followed. Identified mitigation measures to lower the risk should go beyond those contained within the guidance. It should be explicitly stated that an explanation of how the identified mitigation measures lower the severity or likelihood classification in the risk assessment calculation should be recorded. Additional information on how to identify mitigation measures and assess the impact of the measures, together with revised examples should be included in CAP 403. CAP 403 should encourage assessors to demonstrate that the risks have been reduced As Low As Reasonably Practicable (ALARP) for the air displays; and  Risk criteria review It is recommended that the tolerability of risk criteria currently provided in CAP 403 (i.e. the definitions of high, medium and low risk) are reviewed to assess whether these need to be modified. Risks are currently classified as high if the risk level is calculated to be above 15. Using this scoring system means that there are some high consequence events that are deemed “tolerable” for relatively frequent likelihoods. A review would clarify whether the criteria are acceptable or whether a change would be appropriate.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 360 Appendix K (Cont) OFFICIAL SENSITIVE This study has also identified areas within CAP 403 where additional information or restructuring could help airshow organisers and risk assessors when assessing the risks.  Location of the risk assessment guidance in the document Moving the risk assessment section out of the appendices of CAP 403 and into the main body of the document would raise awareness of the importance of generating a risk assessment. Detailed examples and additional information could be retained in appendices;  Including the risk matrix as a visual aid The risk matrix should be explicitly included within the guidance to make it easier for an assessor to determine where the risks from an activity lie;  Highlighting the need for regular reviews of the risks assessed Guidance should be provided on the need to regularly review the risk assessment, particularly for airshows that will occur more than once (e.g. annually). This provides assurance that any new risks introduced at a subsequent airshow are considered and managed, and also that lessons have been learned from previous airshows; and  Guidance on reducing and controlling risks The guidance could clearly state that the risks from the airshow do not need to be reduced to a low risk level and can remain as medium risk, provided that it is demonstrated that the risks are effectively managed. This is to ensure that more significant risks are treated with the appropriate level of caution. Some additional modifications to CAP 403 have been identified that would add further value to the document and potentially make it easier for airshow organisers and risk assessors to undertake assessments to control the risks.  Clearly distinguishing the air display risks from other risks Specifying that the air display risk assessment and the ground based aspects should be separated in some way to distinguish between these different aspects of the airshow. This would ensure that those who need to be aware of the air display risks, and the measures to mitigate them, do not inadvertently ignore some of the risks through having the details of these risks and mitigation included with the risks from ground based activities;  Making the glossary more accessible Moving the glossary to a separate section and including all risk assessment terms would aid the clarity of the guidance given to the people undertaking the risk assessment. Ensuring that the glossary is in alphabetical order would be of further benefit; and  Clarifying risk assessment responsibilities Carrying out a risk assessment should be clearly listed as one of the requirements and responsibilities of the Event Organiser and the FDD. This will help emphasise the importance of the risk assessment, and who should be responsible for ensuring that a risk assessment is undertaken. A search was undertaken to determine whether there was any suitable guidance for similar high hazard public events that could be used as part of a benchmarking exercise. This included Formula 1 racing, the Isle of Man TT and Speedway. No guidance was found for similar events that was suitable for benchmarking the risk assessment and safety aspects of CAP 403.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 361 Appendix K (Cont) OFFICIAL SENSITIVE 1 1 INTRODUCTION At the Shoreham Airshow on 22 August 2015 a vintage jet aircraft crashed onto a nearby road, killing 11 people and injuring 16 others. The pilot was amongst those injured in the accident. The Air Accident Investigation Branch (AAIB) are undertaking the accident investigation to determine the causes of the accident and identify recommendations to avoid any similar occurrences in the future. The AAIB asked the Health and Safety Laboratory (HSL) to assess the risk assessment guidance provided by the Civil Aviation Authority (CAA) for flying displays and special events. This guidance forms part of CAP 403 [1] and would have been used to help produce the risk assessment for the Shoreham Airshow. As part of the Health and Safety Executive (HSE), HSL provides scientific advice on health and safety matters to the UK government and to businesses in the UK and internationally. The HSL risk assessment specialists have experience of reviewing hazard and risk assessments from a regulatory perspective across a range of industries and activities. The aim of the review was to assess how well the guidance available at the time covered specific areas related to the risk assessment process. Other items to consider in the review were identified following discussions between the AAIB and HSL. The topic areas identified were:  How the guidance describes the risk assessment process Assessing the way in which the guidance describes the risk assessment process for a potential risk assessor;  How the guidance identifies those who should be involved in the risk assessment process Assessing the clarity of the guidance in determining who should be undertaking the risk assessment in terms of their qualifications and experience, and of anyone else that should be involved;  Whether the risk assessment guidance is applicable to all sizes of event Assessing whether the guidance provides sufficient information for a risk assessor to assess both large and small events;  How the implementation of the risk assessment guidance allows risks to be managed Assessing whether, if the guidance is followed in the production of a risk assessment, the risks will be managed adequately;  Whether the guidance adequately reflects health and safety legislation Comparing the risk assessment guidance in CAP 403 to guidance produced by HSE [2], other published guidance [3, 4] and legislation [5];  Where there is risk assessment good practice outlined in the guidance Identifying areas of good practice in the guidance with regard to risk assessment procedures, together with areas where improvements could be beneficial; and  How the guidance given in CAP 403 compares to other CAA hazard and risk assessment guidance Comparing the risk assessment guidance in CAP 403 to the CAP 760 [6] guidance published by the CAA.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 362 Appendix K (Cont) OFFICIAL SENSITIVE 2 A search was undertaken to determine whether there was any suitable guidance for similar high hazard events that could be used as part of a benchmarking exercise. This included Formula 1 racing, the Isle of Man TT and Speedway. The remainder of the report is structured as follows:  Section 2 presents the findings of the work carried out during the review of CAP 403; and  Section 3 presents the conclusions from the review.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 363 Appendix K (Cont) OFFICIAL SENSITIVE 3 2 REVIEW OF THE RISK ASSESSMENT ASPECTS OF CAP 403 2.1 OVERVIEW OF CAP 403 The 13th Edition of the CAA guidance document, CAP 403 [1] has been reviewed in this work. This is the version that was available at the time of the Shoreham Airshow in 2015. CAP 403 is divided into two parts; the first part is aimed at flying displays and the second at special events such as air races, balloon events etc. There are twelve appendices that provide additional information and support to the main sections of the document. There is a revision history included in the document indicating that the13th Edition of CAP 403 represented a complete rewrite from the previous version. This version of CAP 403 was issued in February 2015. Part A of CAP 403 is divided into 14 chapters, covering subject areas such as flying display legal requirements, personnel and preliminary planning, site and display management etc. Part B is divided into six chapters, each of which considers additional information required when considering specific special events such as air races, balloon events and model flying events. This report is concerned with the guidance given on risk assessments. Only the sections of CAP 403 that are relevant to this review have been considered. 2.2 CAP 403 REFERENCES TO RISK ASSESSMENT All references to risk assessment within CAP 403 have been identified and highlighted in order to determine what emphasis is placed on the need for risk assessment. The document contains a number of references to risk assessments, in relation to various aspects of the event being considered, indicating that all the risks relating to an event need to be properly assessed and managed. An outline of the structure of CAP 403 is provided in Table 1 in order to illustrate the location of each reference.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 364 Appendix K (Cont) OFFICIAL SENSITIVE 4 Table 1 Structure of CAP 403 Section Description Revision history Details of this edition and the previous four editions. General information Brief introduction outlining the purpose of CAP 403, the background to it, and a glossary of terms. Part A Chapter 1 Detailing the legal requirements for running an airshow. Chapter 2 Details of the personnel required to run the show, and a brief description of what is required for the preliminary planning stage. Chapter 3 Management of the site and display for the airshow. Chapter 4 Description of what is required in terms of liaison with the CAA, Local Authority and the Emergency Services. Chapter 5 The competencies required of a pilot displaying at the airshow. Chapter 6 The skill levels required for different types of acrobatic displays. Chapter 7 Guidance concerning formation flying. Chapters 8 to 14 Guidance for ballooning, parachuting, banner towing, foot-launched aircraft, model aircraft and air racing as part of a flying display, and twilight and airborne pyrotechnic displays. Part B Chapters 1 to 6 Guidance for special events covering air races, ballooning, fly-ins, rallies, helicopters, gyroplanes, model flying events and microlights. Appendices Appendix A Guidance on how to carry out a risk assessment. Appendices B to L Guidance covering other aspects of the event such as verbal and telephone briefings, deadlines for organisers, notification forms etc. CAP 403 contains an initial, introductory section entitled “General information”. Paragraph 1.3 in this section makes it clear that participating in or organising either flying displays or special events “carries a heavy responsibility”. It is stated that “[s]afety is paramount” and this applies to participants and spectators, both those that are paying and those that are not. The paragraph continues “[d]isplays must be carefully planned both on the ground and in the air and nothing should be considered without careful thought to ensure that it is safe. A risk assessment procedure is included to help in the process”. The introductory paragraph makes it clear that the safety of everyone concerned with a flying display or special event must be carefully considered. This reflects general health and safety practice i.e. the importance of ensuring the safety of people affected by an event. The guidance does not explicitly mention others in the vicinity of the flying display or special event who are not spectators but who could also be impacted should an incident occur (e.g. local populations). This may be something that could be considered an implicit consideration, but it might make it clearer for a person undertaking a risk assessment if this was explicitly mentioned in the guidance as something to be taken into consideration when assessing the risks. The paragraph in CAP 403 states, with regard to the planning process to ensure that the event is safe, that “[a] risk assessment procedure is included to help in this process”. A risk assessment forms an integral part of the safety procedure as this informs the organisers of the mitigation

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 365 Appendix K (Cont) OFFICIAL SENSITIVE 5 and control measures to control and reduce the risks from the hazards identified. Therefore, a slight change in the wording of this sentence would make it clearer that a risk assessment procedure should form part of the safety process and not just a ‘help’ to it. This would prevent any misunderstanding about whether there is the need for a risk assessment. Chapter 3 in Part A of CAP 403 is concerned with the management of the site and the display. Paragraphs 3.30 to 3.32 consider overflight of spectators. Paragraph 3.31 states that permission may be granted for overflying of spectators by established formation teams of four or more similar powered fixed wing aircraft, provided they are supported by a comprehensive risk assessment that must be updated annually. This indicates that the overflying of spectators could be considered especially hazardous and that it therefore requires special consideration before permission will be granted. It is not made clear if this risk assessment is to be carried out by the participants of the display, or by the organisers of the event. It might aid the guidance if it was made clear that ultimately the show organisers are responsible for ensuring that all the risks are properly assessed and managed. Including some clarity on the legal responsibilities of each of the key roles at the event may help in this process. It could be of use if guidance was given on the type of experience required by a person carrying out a risk assessment, in order to make it easier for the organisers to find the appropriate person/people for the task. Paragraph 3.32 says that “[a]ircraft carrying parachutists may overfly the spectators’ enclosures or car parks whilst positioning to drop …”. No mention is made of a risk assessment in this instance, however, which appears to be an inconsistency with the requirement to have a risk assessment for other forms of overflight. If there are valid reasons for not requiring a risk assessment in this case, then a brief outline of the reasons could make it clearer for the people running the airshow. Chapter 4 in Part A of CAP 403 is concerned with liaison with the CAA, the Local Authority and the Emergency Services. Paragraph 4.41 states the requirement for a suitable and sufficient risk assessment for all contractors and emergency services working on the airfield or in the adjacent areas. The risk assessments should “contain specific mitigation for dealing with any aviation materials which could become unstable following an accident”. Paragraph 4.46 in Chapter 4 is entitled “Risk assessment” and states that “[r]isk assessment is an essential element of the production of any safety plan”. It says that a simple procedure is given in Appendix A that should be suitable for most flying displays and special events. The guidance continues by stating that “other alternative systems can be equally effective” and that advice on risk assessment can be obtained by contacting the CAA GA (General Aviation) Unit. A link is provided from the electronic version of CAP 403 to the email address of the CAA GA Unit. For the benefit of people not viewing the electronic version of the document, it could be beneficial to explicitly include the CAA GA Unit contact email address in the document. Paragraph 4.49, under “The Police” section, refers to the “event risk assessment” and, in particular, to the likelihood of criminal activity or disorder. It is implied that this risk assessment is different from the flying display risk assessment. Under the “Fire and Rescue Service” section in Chapter 4, paragraph 4.54 states that there must be adequate facilities on site to respond to any fire or rescue emergency. It further states that aerodromes “may have dedicated trained staff available; the degree to which these need to be augmented will be dictated through the risk assessment”.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 366 Appendix K (Cont) OFFICIAL SENSITIVE 6 Paragraph 4.60, under the “General” section of Chapter 4 mentions the use of hazardous materials and states that “[i]nformation on such hazards should be included in the risk assessment”. The main risk assessment guidance is contained in Appendix A of CAP 403, which is discussed in the subsequent sections. 2.2.1 Observations There is some ambiguity as to whether there needs to be an overall risk assessment undertaken covering all aspects of the event, or whether there should be a number of assessments covering specific areas. In reality, different approaches may be appropriate for different sizes and types of airshow. It does seem sensible to at least undertake a separate air display risk assessment from other ground based activity assessments. The air display assessment findings could be referenced in the general risk assessment or in an overarching assessment document for larger airshows. The benefits in doing this are that people with the relevant experience could be involved in the individual risk assessments, rather than the same people trying to identify hazards that are outside their area of expertise. It also makes it easier for a worker who has not been involved in the development of the risk assessment to absorb the parts of the document that are relevant to themselves. It might be beneficial for the guidance to explicitly make this point. The guidance given in Appendix A can be applied to all aspects of an event. If more than one risk assessment is expected (which is likely at large events where there may be a wide variation in the types of risks that will need to be assessed), a brief description of what each risk assessment is expected to cover could be useful. A description of the experience and knowledge required of people who are producing the risk assessments should be provided. This would aid the event organisers, who have overall responsibility for safety, in assigning the task to an appropriate person/appropriate people, if they are not undertaking it themselves. CAP 403 does contain a glossary explaining many of the acronyms and terms in use in the document. However, the glossary forms part of the introductory “General information” section and is not in alphabetical order. This makes it more awkward to find terms when reading the document. It also does not include specific risk assessment terms, or provide a reference of where to find this information. A distinct, alphabetic glossary of all terms used within CAP 403 could aid comprehension and remove the potential for ambiguity and misunderstandings. In paragraph 2.23 of CAP 403, under the title “Preliminary planning”, a list is given of items that the Event Organiser and the Flying Display Director (FDD) need to consider. The FDD is the person responsible to the CAA for the safe conduct of the flying display. A risk assessment does not form part of the list of requirements for the organisers and the FDD. As these are the personnel ultimately responsible for the safe running of the airshow then the risk assessment and implementation of risk controls should be specified amongst the requirements and responsibilities of the Event Organiser and the FDD. Key point The qualifications and experience required of the people undertaking the risk assessment should be clearly identified.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 367 Appendix K (Cont) OFFICIAL SENSITIVE 7 2.3 GUIDANCE ON HOW TO UNDERTAKE A RISK ASSESSMENT The review considered whether the risk assessment guidance provided by CAP 403 describes the risk assessment process in enough detail. This is seen as an important point to consider as it is assumed that most assessors are unlikely to be risk assessment experts, rather being experienced pilots and people familiar with organising airshows. This does mean they should have the experience and knowledge to identify appropriate hazards and mitigation measures. However, a lack of understanding of assessing risks might mean this knowledge and experience is not being captured properly. Appendix A in CAP 403 provides some guidance on how to undertake a risk assessment. It is only referred to from paragraph 4.46 in the main body of the document, although risk assessments are referred to from elsewhere in the document. Appendix A outlines why risk assessments are needed. It states that a risk assessment does not need to be complicated and that the procedure given should “suit the needs of most flying display[s] and Special Events”. It is stated that other alternative systems can be equally effective and that the CAA GA Unit can be contacted to provide further advice. A link is provided to the email of the CAA GA Unit from the electronic version of CAP 403. As in the case of the link provided from the main body of the guidance, it could be beneficial to explicitly include the email address for those people viewing a paper copy of the document. The Appendix provides a definition of the risk as the severity of the hazard times the likelihood of occurrence. The five steps to risk assessment that are defined by the HSE are referenced and an outline of the five steps given as:  Step 1: Identify the hazards associated with activities contributing to the event, where the activities are carried out and how they will be undertaken;  Step 2: Identify those at risk and how they may be harmed;  Step 3: Identify existing precautions;  Step 4: Evaluate the risks; and  Step 5: Decide what further actions may be required, i.e. mitigation. It is stated that Step 4 will involve a combination of the likelihood and severity of the identified risk. The five steps in CAP 403 have a slightly different emphasis than the risk assessment guidance available on HSE’s website [7]. From the website, the five steps are given as:  Step 1: Identify the hazards;  Step 2: Decide who might be harmed and how;  Step 3: Evaluate the risks and decide on precautions;  Step 4: Record your significant findings; and  Step 5: Review your assessment and update if necessary. The five steps in CAP 403 are effectively encapsulated in Steps 1 to 3 of the HSE guidance. The requirement to record the findings applies to employers with five or more employees, although it is recommended that a record is made in all cases. Step 5 of the HSE guidance is captured in the last paragraph of Appendix A of CAP 403, rather than within the five steps. It may be beneficial to move this statement to one of the five steps as this provides an indication that it is

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 368 Appendix K (Cont) OFFICIAL SENSITIVE 8 an integral part of the risk assessment process. Recording the process lends confidence to the conclusions reached (i.e. that the risks are being properly managed). The guidance does not mention reviewing the risk assessment and updating the assessment if required. This forms an integral part of the risk assessment process. It allows the risk assessor to evaluate how effective the control measures are and to determine whether more needs to be done. This can be an iterative process, even for events that are one-off. For events that are not one-off, any existing risk assessment should be reviewed prior to each event to ensure that it is still suitable and sufficient and to incorporate any additional information that has become available since the previous risk assessment. In paragraph A5 of CAP 403 it is stated that the assessment of the likelihood and severity of a hazard is “subjective” and is “based on personal experience of the activity under assessment or statistical evidence when available”. Lessons learnt from previous airshows can aid the process, together with the experience gained by people over the years. Paragraph A6 makes it clear that the assessment needs to be carried out by someone who is aware of the risks being assessed and who will use “sound judgement” in the preparation of the risk assessment. The document notes that the risk assessment process could be subject to challenge in the event of an incident. Paragraphs A5 and A6 in CAP 403 make it clear that the assessor needs to have a firm understanding of the risks being assessed. This is an important point to make as it means that there is a greater likelihood of all the hazards and appropriate mitigation measures being identified. However, CAP 403 does not give any examples of the type of qualifications and experience that a risk assessor would be expected to have. Including this information would be beneficial in terms of clarifying who should undertake the risk assessment. It is generally good practice to include within the risk assessment a record of those that were involved in the process, together with their qualifications and experience. This could be added as a requirement to the risk assessment section in CAP 403 to further improve the guidance being provided. Paragraphs A7 and A8 of Appendix A in CAP 403 provides a list of the headings that should be used for the severity and likelihood classifications as part of a risk matrix. Numerical values are given for each category that can be used to provide a risk rating by multiplying the severity and likelihood values together. The severity classifications are reproduced in Table 2 and the likelihood classifications in Table 3. Table 2 Severity classifications in CAP 403 [1] Trivial Minor injury Serious injury Single fatality Multiple fatalities 1 2 3 4 5 Table 3 Likelihood classifications in CAP 403 [1] Highly unlikely Possible Quite possible Likely Highly likely 1 2 3 4 5 One suggested area for improvement is the likelihood classifications. It is recognised that the assessment is necessarily subjective but it would be beneficial if additional wording around the classifications could be included to give a clearer idea of what frequency is associated with each term. It could also be stated that the risk assessor can determine what the classifications mean for their event and that they record their assumptions. This could aid future assessors and also their own development.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 369 Appendix K (Cont) OFFICIAL SENSITIVE 9 An example of how to use the severity and likelihood classifications is given in a table at paragraph A9 of Appendix A in CAP 403. It is reproduced in Table 4. CAP 403 clearly states after the table that it is used for example only and that it “does not imply or infer a risk level” i.e. the examples given do not represent an actual risk assessment but provide an indication of how to carry out a risk assessment. Table 4 Example of using the risk scores from CAP 403 [1] Hazard Severity Likelihood Rating Mitigation M/factor Final rating Aircraft accident involving crowd casualties 5 3 15 Adhere to separation distances; ensure crowd remains inside crowd line Likelihood reduced to 1 5 Fire in exhibition area 3 3 9 Provision of First Aid Fire Fighting facilities Severity reduced to 2 6 Terrorist activity 5 2 10 Close, early liaison with police Likelihood reduced to 1 through planning 5 The first hazard identifies that people could be harmed. This is useful because it makes it clear that it is the risk of people being harmed that is being assessed. However, this entry does not give a location for where these people could be harmed, which is not useful because it makes it harder to determine the likelihood of the incident occurring and also to identify suitable mitigation measures. The other two examples in the Table reproduced from CAP 403 do not explicitly state that people could be harmed, although it is implied in the severity ratings used. These two entries do not state who would be harmed i.e. the public, participants, staff or a combination of all three. In terms of the example mitigation measures given in the table, they are taken from the main body of the guidance. It would be expected that the guidance should be followed as a minimum and so these measures should be carried out anyway. The assessment should be carried out with the assumption that these measures have been incorporated and the mitigation column should only contain additional measures required to reduce the risk further. This means that, in terms of the examples given in Table 4, the mitigation measures listed are not actually mitigation measures and should have no impact on the risk rating. This point should be clearly stated in the guidance. Examples of the types of additional measures that may be considered should then be given in CAP 403. Table 4 has a column describing the mitigation measure and another showing the revised likelihood or severity rating, together with the final risk rating. This is very useful and links the mitigation measure with the reduction in risk. The examples of mitigation given, however, do not directly explain why the severity or likelihood is reduced. A general explanatory guidance note could be given in CAP 403 stating that an explanation should be given as to why a mitigation measure reduces the likelihood and/or the severity for each identified hazard. The examples would aid assessors when making their own assessments. Using the examples given currently in CAP 403, an additional sentence in the mitigation column would be beneficial to illustrate this point e.g. in the first example concerning crowd casualties following an aircraft crash, a sentence explaining that the mitigation measures limit

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 370 Appendix K (Cont) OFFICIAL SENSITIVE 10 the number of places that the public will be located leading to a lower likelihood that an aircraft will crash into these public areas makes it clearer why this mitigation reduces the risk level. A sentence in CAP 403 explaining that who is at risk should be identified and where they are likely to be located in order to make this connection could be of use. Providing more detail in the “Hazard” column of the example table could also be beneficial to help illustrate this point. Paragraph A11 defines a risk with a rating of less than 6 as low risk, a risk with a rating of between 6 and 15 as medium risk, and a risk with a rating higher than 15 as high risk. The use of likelihood and severity scores to calculate a risk rating allows a risk matrix approach to be adopted. The risk matrix that would be generated by the use of the severity and likelihood classifications and the definitions of low to high risk is not included in the document but can be constructed from the other information given. A risk matrix is a matrix of severity against likelihood and indicates where risks are broadly acceptable, tolerable if controlled sufficiently, and unacceptable. The inclusion of the risk matrix could be beneficial to those undertaking the risk assessment. It would help assessors to know where the risk falls and hence provide an indication of how much effort is required to reduce the risk. It would also aid in showing whether the mitigation measures given are sufficient. This information is given in the various paragraphs in the Appendix but a visual aid could improve the clarity for a potential assessor. An example of what the risk matrix would look like, based on the information given in CAP 403, is shown in Table 5. Table 5 Example risk matrix Severity Likelihood Highly unlikely Possible Quite possible Likely Highly likely Trivial 1 2 3 4 5 Minor injury 2 4 6 8 10 Serious injury 3 6 9 12 15 Single fatality 4 8 12 16 20 Multiple fatalities 5 10 15 20 25 The colour coding reflects the tolerability of risk by indicating areas of unacceptable risk (red), areas that are tolerable provided the risks are appropriately managed (yellow), and areas of broadly acceptable risk (green), or high, medium and low risk using the terminology in CAP

1. The different areas provide the assessor with an indication of the level of effort required to

reduce the risks. It also aids in the assessment of how beneficial a risk reduction measure is, and whether it is sufficient at reducing the risks (e.g. if a risk falls into the red box with a rating of 20 and a measure reduces it to 16, the matrix indicates that the risk is still intolerable and more must be done to reduce the risk). It could be argued that the risk matrix given in CAP 403 is not cautious enough when considering the likelihood of some of the more severe consequences. A more conventional matrix would code risks with a rating of 5 as tolerable i.e. in the yellow region, and risks rated as 15 as unacceptable i.e. in the red region. As it stands, a hazard that is “quite possible” and that can cause multiple fatalities sounds like it is something that can occur fairly frequently and hence should be in the unacceptable region of the matrix, whereas it currently falls into the tolerable region. The same is true of a hazard that causes serious injury and is “highly likely”. It

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 371 Appendix K (Cont) OFFICIAL SENSITIVE 11 is possible that, if the matrix had been reproduced as in Table 5, then it may have been decided to adjust some of the classifications. The remaining paragraphs in Appendix A of CAP 403 state that attempts should be made to reduce the risks, even when the risk is low. It also states that high risk ratings are generally unacceptable and that risk reduction measures should be sought to reduce the rating to medium or low risk. This represents accepted good risk assessment practice, as provided in guidance by HSE (e.g. [2]). A risk assessment should be able to demonstrate that the identified mitigation measures have reduced the risks As Low As Reasonably Practicable (ALARP). The Health and Safety at Work etc. Act, 1974 requires duty holders to ensure, So Far As Is Reasonably Practicable (SFAIRP), that their activities do not expose the public to health and safety risks. The Health and Safety Executive (HSE) considers this requirement of the Act to be met if the duty holder reduces the residual risks As Low As Reasonably Practicable (ALARP). Risk assessors may find text explaining the process constructive, which could include text for both hazard identification and for the assessment of mitigation measures. One important point regarding risk assessment that does not come across clearly in CAP 403 is that the effort required to undertake a risk assessment should be proportionate to the risks being considered. This applies both in terms of the scale of the event being assessed, and in terms of the individual hazards that are identified. In particular, it would be expected that a large airshow, for example, with a number of different displays and types of participating aircraft and with a significant number of spectators, will require more consideration than a much smaller event where far fewer people and aircraft (which includes balloons, microlights etc.) will be involved. Similarly, a hazard that has been identified as having a medium to low risk will require less consideration than one that has been identified as having a high risk (although, as has been made clear in CAP 403, mitigation measures should be considered even for low risk hazards). The examples given in Table 4 imply that one risk assessment will be undertaken for all hazards associated with an event, whether they are caused by events occurring in the air (e.g. an aircraft crash), or by incidents occurring on the ground (e.g. fires in catering areas). This is generally acceptable for small events but, at large events where there are a significant number of potential hazards, it may be beneficial to undertake a separate air display risk assessment. This may make it easier to read and understand by those who are helping/working at an event and who are likely to be assigned to specific tasks. It could be beneficial to extend this advice to all sizes of event. An advantage of having separate risk assessments for different aspects of the show is that the people with a particular area of expertise can be involved in helping develop the risk assessment that is pertinent to their knowledge (e.g. people with flying expertise can help with a risk assessment looking at the hazards from flying displays, those with expertise in running ground based activities can be involved in identifying the hazards from catering, car parking etc.). Some guidance on this could be provided in CAP 403, noting that a single risk assessment for a small event with few hazards might be sufficient but that a separate air display risk assessment may be preferable. A risk assessment can be informed by incidents that have occurred previously, either at the event under consideration, or at similar events. This can aid in the identification of the hazards and the risk associated with them. It may also aid in the identification of any suitable mitigation measures.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 372 Appendix K (Cont) OFFICIAL SENSITIVE 12 Incidents at an airshow, even near misses that have not caused an accident or instance of ill- health, should be recorded in order to learn from them at future events. It could be beneficial to include a paragraph in CAP 403 to make this point. A risk assessment is a living document and should be reviewed regularly. This may mean that an existing document is reviewed prior to each event, or that it is reviewed during the event if additional information becomes available (e.g. a mitigation measure has been shown to be particularly beneficial and it can be applied to other aspects of the event, or an incident has occurred at the event). A review after the event can also be of value in helping identify aspects that went particularly well or risks that were not so well managed. A record of the review process should be kept. It would be useful to mention this aspect of the risk assessment process within Appendix A, but noting that this will be of less value for a one-off event. Any lessons learnt could be applied at other events, however. The final point made is that organisations should “record and retain the details of their risk assessment process”. This is an important point and it may be beneficial to incorporate it as part of the “five steps”, as suggested by HSE. Moving this statement to earlier in the document (or repeating it at an earlier stage) may help to ensure that assessors are aware of the need to keep a record of the process that they have undertaken to assess and manage the risks. 2.3.1 Observations Appendix A of CAP 403 provides some useful information for potential risk assessors, and does provide guidance on how to undertake a risk assessment, including the use of a risk matrix and the need to try and reduce all the risks, even those that are assessed as being low. There are some areas that could potentially be improved by providing additional information, however. Some of these have been identified in the discussion above and are summarised here. Moving the risk assessment guidance into the main body of the document rather than the appendices might be a useful modification. This would highlight the importance of undertaking an adequate risk assessment. Any additional detail and examples could be kept in the appendices for the sake of brevity in the main sections. More guidance is required on how to identify the hazards, including how to record the process and who was involved. Guidance could be given on the qualifications and experience required of people undertaking the risk assessment. Part of the hazard identification process is also to identify any mitigation measures that can be used to lower the risk. These should be recorded and each one assessed to determine how effective the measure is at controlling the risk. A measure may be discounted for valid reasons (e.g. it would be costly/problematic to implement and has a minimal effect on the risk), but a record should be made of the reasons for not considering it further. Providing text to explain the ALARP process may be constructive. This could include information on hazard identification and the assessment of mitigation measures. As has already been discussed in Section 2.3, the likelihood phrases used in the risk matrix are open to interpretation. It would be beneficial if the guidance provided an additional description around each term and/or suggested that the risk assessor provides a clear definition of the likelihoods and records their definition in the risk assessment. In order to accurately assess the severity associated with a particular hazard, it may be of use to suggest that maps of the surrounding area are included. These can show areas of local population and areas where people may congregate, together with sites that could lead to an

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 373 Appendix K (Cont) OFFICIAL SENSITIVE 13 escalation in severity should an accident occur (e.g. industrial chemical sites). The maps may also indicate the areas over which the aircraft, balloons, microlights etc. are permitted to fly, and at what heights. These may aid the assessor in determining who is at risk and also in the severity classification. Explicitly including the risk matrix, using colour coding to indicate where the risks are acceptable, tolerable if managed sufficiently, and unacceptable, would aid readers of the guidance in understanding the accepted tolerability of risk. It may be of value to the risk assessor in determining where the risks from a particular hazard lie and how effective the mitigation measures are at reducing that risk. The guidance currently implies the use of a single risk assessment to cover both ground hazards and air display hazards. It could be beneficial to suggest that these are separated into two documents, particularly for larger displays. The guidance given in CAP 403 does not provide a link between the mitigation measures and the reduction in severity and/or likelihood. Information could be provided on this point, with appropriate examples. Key points The risk assessment guidance should be moved into the main body of the report. More guidance should be provided on the hazard identification process. More information is required to aid assessors in identifying suitable mitigation measures and assessing that these measures are appropriate and are achievable. The risk matrix should be reviewed to determine if the acceptable risk levels are appropriate. 2.4 GUIDANCE ON WHO SHOULD BE INVOLVED IN THE RISK ASSESSMENT PROCESS The review considered whether CAP 403 provides guidance on who should be involved in the risk assessment process, and if the responsibilities of the organisers are clearly defined. In Chapter 2 of Part A of CAP 403 [1] definitions are given of the people responsible for the running of the event. These are listed as:  The Event Organiser who assumes overall responsibility for the event. “Responsibility for particular aspects … should only be allocated to people with the relevant experience and, if applicable, licences”. It is inferred that the Event Organiser determines who takes on responsibility for each aspect of the event;  The Flying Display Director (FDD) is “the person responsible to the CAA for the safe conduct of the flying display”. The FDD must be suitably experienced in “all matters relating to flying in general and flying displays in particular”. The FDD is “responsible for flying discipline generally, control of the flying display programme and cancellation or modification to the programme”. At a small display (up to 3 items), the FDD may be a pilot of a participating aircraft. At a medium display (up to 6 items), the Event Organiser and FDD may be the same person although it is recommended that they are kept separate. At larger displays (7 or more items), the FDD should not take part in any other part of the flying display and should not be the Event Organiser; and

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 374 Appendix K (Cont) OFFICIAL SENSITIVE 14  The Flying Control Committee (FCC). At larger events (7 or more display items) it is recommended that a FCC is formed to provide assistance to the FDD. The FCC “should, wherever possible, comprise pilots with experience on the types of aircraft being flown at the flying display”. It is also expected that members of the FCC “hold, or have held, a civilian [Display Authorisation] DA, or they should have extensive military flying display experience”. Details are also given of other officials responsible, for example, for supervising the parking of aircraft and cars, and of the flight crews involved in the displays. Under the “Preliminary planning” section at paragraph 2.23 of CAP 403, a list is given of the items that need to be considered by the Event Organiser and the FDD. This list does not currently include a risk assessment. Including a risk assessment in this list would emphasise the importance of undertaking a risk assessment to the event organisers. Paragraph 4.41 of CAP 403 makes it clear that the Event Organiser is responsible for the production of a safety plan. It continues by saying that “[s]uitable and sufficient risk assessments must be produced and circulated to all contractors and emergency services working on the airfield or adjacent areas used for the Air Show and associated displays.” It is not made clear whether the Event Organiser is the person who should be carrying out these risk assessments. It also is implied that these are separate risk assessments from the event risk assessment, or, at least, that they form a separate part of the event risk assessment. In Appendix A of CAP 403, which provides the guidance on how to undertake a risk assessment, paragraph A6 states that the assessment process “must be undertaken by someone who is aware of the risks associated with the activity being assessed and who will use sound judgement in the preparation of the assessment”. There are no details given of the qualifications and/or level of experience required of the person who is carrying out the assessment. Including some examples of suitable experience or skills could aid the Event Organisers, or the FDD, to determine who is best placed to carry out the assessment. Although not directly related to risk assessment, Chapter 3 of CAP 403 is concerned with the site and display management and Chapter 4 considers liaison with the CAA, Local Authority and Emergency Services. In both of these chapters it is not always made entirely clear who has responsibility for undertaking the required tasks, although it generally appears to be either the Event Organiser or the FDD. 2.4.1 Observations There is only limited information provided in CAP 403 on who should be involved in the risk assessment process. This process includes hazard identification, mitigation measure identification and assessment, recording and reviewing etc. It is appreciated that the guidance cannot explicitly prescribe who should be involved, but it might be useful to include some guidelines on the experience and qualifications that would be expected for the people undertaking the assessment (e.g. flying experience, airshow experience, risk assessment experience and so on). Explicitly asking for this information to be recorded in the risk assessment would also be of value in the guidance. The main area to improve in terms of responsibility for the organisation of the air show or other event is to either clearly state who should be responsible for each aspect of the event, or to suggest that the Event Organiser has ultimate responsibility and therefore needs to appoint people to cover each aspect. Records should be kept of who was involved with each task or activity. By not specifying responsibilities there is the danger that different people will assume that someone else is dealing with a particular issue. This might mean that a particular task is

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 375 Appendix K (Cont) OFFICIAL SENSITIVE 15 neglected or ends up being rushed in the end. Explicitly specifying the responsibilities ensures that all the guidelines are complied with and that there is no ambiguity as to individual responsibility. It also ensures that tasks are carried out to a high standard by appointing those who have the right background to make important decisions and judgements. This is of particular importance for risk assessments. 2.5 GUIDANCE FOR DIFFERENT SIZES OF EVENT The review considered whether the guidance provided by CAP 403 can be applied to all sizes of events. For example, is the guidance sufficient for large events with a greater number of associated hazards, or is the guidance overly complicated for small events? Chapter 2 of CAP 403 defines the roles of the Event Organiser and Flying Display Director of a flying display or special event. Guidelines are provided as to whether the roles can be combined, depending on the size of the event. Additional guidelines are provided as to whether these people can also take part in the event, which again depends on the size of the event. At larger events (7 or more display items) the use of a Flying Control Committee is recommended, in order to help the FDD. Most of the information and guidance contained within the individual chapters of CAP 403 applies for all sizes of events (e.g. ensuring the site is suitable for the aircraft, that spectators are kept at a distance from the aircraft, that the pilots have the correct authorisations etc.). Where differences do occur (e.g. the use of radio communication is not required at small events), statements are made to exclude certain sizes of events. It should be noted that some aspects of the guidance will not be relevant for some types of event, both large and small (e.g. not all events will have pleasure flights). In terms of the guidance on risk assessment, paragraph 4.46 implies that a risk assessment is required for all types and sizes of event, as would be expected. In Appendix A, however, there is nothing to indicate that greater consideration may have to be given to larger events. Compared to the smaller events, large airshows are likely to have a greater number of hazards and potentially more serious hazards and higher consequences (e.g. due to larger crowds, more aircraft displays, more complex displays etc.). The risk assessment needs to be proportionate to the risks being considered. Appendix A of CAP 403 provides generic advice for all airshows. This is not an issue in itself, as the same processes should be applied in all cases. This may mean, however, that a risk assessor does not apply the required amount of consideration and rigour to larger events. The example table given at paragraph A9 of CAP 403 and reproduced in Table 4 contains three examples of hazards, only one of which is related to the flying aspects of the event. It is technically acceptable for all types of hazard, both ground based and air based, to be dealt with within one table and within one risk assessment for smaller events. For larger events, however, it would be beneficial to produce a separate air display risk assessment. This allows a small group of suitably qualified people to be involved in the identification of the hazards specific to their area of expertise, rather than having a large group of disparate people identifying a broader range of hazards. Guidance could be given within Appendix A, with additional example tables provided. The guidance could state that it is also preferable to provide a separate air display risk assessment at smaller events. Carrying out separate risk assessments for the air display and for the ground based activities of the airshow allow the relevant risks to be assessed by the personnel involved in those particular areas and with the appropriate experience and skills. If a single risk assessment is used to assess all the airshow risks then there is a danger that not all parts that are pertinent to a person’s role will be obvious i.e. because so much of the risk assessment will not be relevant to them, they do

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 376 Appendix K (Cont) OFFICIAL SENSITIVE 16 not notice all parts that are relevant, or key parts of the assessment end up being undertaken by people with insufficient experience to fully understand the hazards. The methods used to determine if a risk is being suitably managed do not differ significantly for the different sizes of event. In all cases, scenarios that are identified as having a high risk require greater consideration than those identified as having low or medium risk. In addition, the risk assessment process should be recorded for both large and small events. HSE guidance states that this is not a requirement, only a recommendation, for employers with fewer than 5 employees. Whilst there is a chance that small airshow events may technically fall into this category, it would be good practice for all airshows to record this information due to the significant impact of hazards to third parties from the airshow activities. 2.5.1 Observations The general guidance on risk assessment provided in CAP 403 is generic and equally applicable to both large and small events. Additional clarity around the effort required for the different scale of events, however, could prove beneficial to the risk assessor to ensure that the effort expended is proportionate to the risks being assessed. The examples given in the guidance indicate that all the identified risks can be assessed within the same table. The guidance should suggest that the risk assessment is split into separate sections covering different aspects of the event, where the air display risk assessment is undertaken separately. 2.6 MANAGEMENT OF RISKS USING THE GUIDANCE Sections 2.3 and 2.5 discuss the risk assessment guidance given within CAP 403 Using this guidance as it stands, could an assessor develop an air display risk assessment that controls and reduces the risks “As Low As Reasonably Practicable” (ALARP) for the air display? In order for risks to be ALARP, all mitigation measures that are not disproportionate in terms of cost or practicability should be applied, noting that higher risk scenarios will require a proportionally greater consideration of mitigation measures than lower risk scenarios. The higher the risk level, the more that is expected to be done to control or reduce the risk. If the CAP 403 guidance is followed, it is not entirely certain that the hazard identification process will be recorded sufficiently. Although the guidance does state that the assessment process “must be undertaken by someone who is aware of the risks associated with the activity being assessed” and also, on a later page, that the risk assessment process should be recorded, it is not made completely explicit that a number of details should be recorded. This recorded information should include the people involved in the hazard identification, their experience and/or qualifications, and the identified hazards (including some reference to hazards that are later deemed to be unrepresentative for the event in question). Lack of detail in this area could lead to a lack of assurance that all potential hazards have been identified. The severity and likelihood classifications used to assess the risks are adequate although the likelihood categories could be considered to be ambiguous. Additional guidance could be provided to allow assessors to determine their own definitions, provided they are recorded in the risk assessment (see Section 2.3.1for more detail) and/or additional wording could be used in the guidance to provide a clearer definition. Assuming that the correct severity and likelihood categories are allocated to each hazard, then there can be a reasonable level of confidence that the initial assessment of the risk is suitable, given the definition of low, medium and high risk level given in paragraph A11 of CAP 403.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 377 Appendix K (Cont) OFFICIAL SENSITIVE 17 The tolerability of risk criteria used to define high, medium and low risk may need to be investigated and possibly revised (e.g. a hazard that can cause multiple fatalities and that is “quite possible” is defined as being tolerable or medium risk). This uncertainty over the risk criteria can lead to uncertainty that the risks have been correctly classified. If the example table given in paragraph A9 of CAP 403 is used as a template, there is some uncertainty that the hazard will be clearly described. To illustrate this point, the second example given in the table is a “[f]ire in exhibition area”. It is not made clear who would be affected by this hazard, specifically where these people are located, or how many people have the potential to be affected. No explanation is given as to the choice of severity classification for this hazard, which is given as 3 (serious injury). It is unclear why the severity rating is not higher, as a fire can potentially cause death. Using the example as it stands could lead to uncertainty that the hazard has been correctly classified. Including an additional description to this example explaining who could be affected, in what area and why the severity level has been selected could improve the understanding of the assessment and an appreciation as to how the mitigation measures apply to reduce the risks from this hazard. This is not a large amount of additional information and this information is necessary to identify how and where mitigation can be used to control the risk. If this information is not included then there is a concern that this is being treated as a paper exercise as the mitigation controls are listed but it is not clear how these would be implemented. If a person undertook a risk assessment following a similar format to this example, then there would be uncertainty around how the hazard has been classified and to whom the risk applies. A good point from the example table at paragraph A9 is that it is clear to see how the initial risk rating has been derived, assuming that there is confidence in the severity and likelihood classifications. It is also clear how the final risk rating is calculated, assuming that the reduction to either the severity or likelihood classification is accurate. There are potential issues, however, with the mitigation and multiplication factor columns, which could lead to concerns with the overall assessment. Although the process itself appears satisfactory (i.e. identify mitigation measures, assess how these affect the likelihood or severity, and then calculate the final risk), in the examples given, there is no explanation on how the mitigation measures reduce the severity or the likelihood. An understanding of how a mitigation measure is controlling or reducing the risk is necessary to correctly implement that measure. Considering the example with the “[f]ire in exhibition area” hazard, the mitigation measure is given as “Provision of First Aid Fire Fighting facilities” and the severity is reduced from 3 to 2. It might be deduced that the fire-fighting facilities are located close enough to lead to a quick response in the event of a fire, that there are sufficient people who are adequately trained in the use of the fire-fighting facilities, and that the area can be quickly evacuated. If this is the case, then it is reasonable to assume that there will be a reduction in the severity classification. If a person follows this example as given in CAP 403, however, and does not include all the additional information on what the mitigation measure actually means, then there may not be a high level of confidence in the reduction factor and the final risk rating. The examples given for the mitigation in the table at paragraph A9 (reproduced in Table 4) appear to follow the guidance given elsewhere in CAP 403 i.e. the mitigation measures listed are merely the standard good practice. It would be expected that the general guidance given in CAP 403 would be followed as a minimum, and the initial risk has been assessed assuming that these measures have been implemented. Additional mitigation measures need to be considered in order to reduce the risk still further. The risk assessment guidance does not make this clear,

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 378 Appendix K (Cont) OFFICIAL SENSITIVE 18 and the examples could lead an assessor to assume that the measures given elsewhere in CAP 403 are sufficient to further reduce the risk. This should not be the case. There is no explicit reference made to recording additional mitigation measures that may not be considered practicable, perhaps in terms of cost or implementation. If the examples given in Appendix A of CAP 403 are used as a template, then there may be insufficient evidence that all reasonable measures have been taken to reduce the risk. The guidance makes it clear that the risk assessment should be recorded and uses the phrase “risk assessment process”. It could be deduced that this includes items such as the hazard identification process and statements concerning additional mitigation measures that are not practicable, but these are not explicitly stated. It would be quite possible for these items to not be included due to a lack of awareness on the part of the person carrying out the risk assessment. No reference is made in Appendix A of CAP 403 of reviewing a risk assessment or from learning lessons from previous incidents. Undertaking a review prior to an event leads to greater assurance in the validity of the risk assessment. Reviewing the risk assessment after the event, and possibly during the event, enables it to be seen whether the implemented risk mitigation measures were successful at managing the risks and whether all the hazards were identified. Many of the important points for undertaking risk assessments are covered in the guidance given in CAP 403. There are some aspects where some additional information could fill some potential gaps. Some of the examples given in the guidance do not provide enough detail of the full processes required. It is possible that a risk assessment based solely on this guidance would not ensure that risks were being managed ALARP. 2.7 GUIDANCE IN RELATION TO HEALTH AND SAFETY LEGISLATION Appendix A of CAP 403, which contains the guidance on risk assessment, has been compared to the HSE guidance “Reducing Risks, Protecting People” (R2P2) [2], together with other published guidance [3, 4] and health and safety legislation (“Management of health and safety at work regulations 1999”) [5]. R2P2 outlines the principles that HSE uses to assess and control risks and may be regarded as guidance on how HSE would expect others to consider control of health and safety risks. Gadd et al [3] builds on the work of R2P2 and highlights some of the common failings seen with risk assessments i.e. the “pitfalls” of risk assessment. The HSE guidance, “Managing for health and safety” [4] is primarily aimed at providing guidance to commercial businesses, but the concepts used are more widely applicable and can be compared, in general, to the guidance provided in CAP 403. The “Management of health and safety at work regulations 1999” [5] sets out the legal requirements with regard to managing health and safety in the workplace. It specifies the need for employers to have a risk assessment that is a “suitable and sufficient assessment” of the risks to the health and safety of employees and to the health and safety of persons not in their employ but who are exposed to risk through the employer’s undertakings e.g. spectators or surrounding populations. 2.7.1 Hazard identification Paragraph 87 of R2P2 discusses the issue of ignorance in relation to the identification of hazards. In order to counteract this, a “wide engagement of different disciplines and communities of interest in the characterisation of the issue” should be undertaken. It also states

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 379 Appendix K (Cont) OFFICIAL SENSITIVE 19 that a further measure is to be as open as possible to enable alternative views to be considered at an early stage. Gadd et al discusses failure to identify all hazards as one of the common mistakes made in risk assessments. The “Managing for health and safety” guidance [4] discusses the reasons for doing risk assessment. In particular it states that the outcome of the risk profiling will be that the right risks have been identified and that it will inform decisions about what control measures are needed. All of the guidance states that a lack of awareness of the key hazards or risks is an indication of a lack of competence in the management of health and safety. The guidance given in CAP 403 states in paragraph A1 that “it is necessary to identify these hazards and to minimise them”. The table in paragraph A4, which lists the five steps to risk assessment, states that identifying the hazards is step 1 in the process. It might be possible to improve the guidance in CAP 403 by providing more information on the importance of hazard identification, and also some indication as to how the hazards can be identified. As part of this additional information, some guidance can be provided on the people that should be involved, methods of recording the outcomes and also on keeping the effort required proportionate to the risks involved i.e. small events will require less effort and the involvement of fewer people than a large event. 2.7.2 Risk mitigation Paragraphs 99 and 100 in R2P2 are concerned with identifying options to consider how to manage the risks. In particular, the use of experience is given as one way of identifying options. It also states that possible good practice should be examined as a way of addressing the hazards identified. Good practice needs to be evaluated as to whether it is relevant and sufficient for the hazards posed. If specific good practice is not available then good practice that applies in comparable circumstances should be considered, if it is directly transferable to the hazard in question or can be suitably modified. Section 4.15 of Gadd et al lists a lack of consideration of further measures that could be taken as one of the errors often made in risk assessments. It states that it is necessary to explicitly identify possible risk reduction options and assess whether they are reasonably practicable. In addition, “all options, or combination of options that are reasonably practicable must be implemented”. It goes on to say that each option should be measured against the present situation. R2P2 states that it needs to be determined if there are any constraints attached to using a particular option e.g. is it technically feasible, are there any legal constraints etc. Also, any adverse consequences for using a particular option need to be considered e.g. a measure may reduce the risk from one hazard, but increase the risk from another hazard. Section 4.18 of Gadd et al also states that it is necessary to examine the effectiveness of the risk control measure, and to consider whether any unexpected risks have been inadvertently created. The “Managing for health and safety” guidance [4] states that health and safety controls that do not seem practical are an example of poor worker consultation. CAP 403 should outline “good practice” for airshow risk management as it represents the guidance offered by the industry body. Some modifications are required to the document to ensure that it is enabling the successful risk management of airshows. The main chapters

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 380 Appendix K (Cont) OFFICIAL SENSITIVE 20 provide information on various measures that need to be undertaken in order to protect the safety of both the spectators and the people working at the event. These measures would be expected to be carried out as a minimum. It would then be expected that the risk assessor would carry out an evaluation to determine whether these measures are sufficient for the hazards posed and then identify additional measures to reduce the risk further. The specific risk assessment guidance given in Appendix A of CAP 403 provides examples of mitigation measures for three example hazards, although these appear to be taken from elsewhere in the guidance and hence represent “good practice”. It does not discuss methods of identifying mitigation measures, or of how they can be assessed to determine whether or not they are suitable and sufficient, or whether they inadvertently introduce new risks. Providing additional information on these areas would improve the guidance. It could be of benefit to explicitly state that there is an expectation that the measures contained within the main body of the CAP 403 guidance document are implemented as standard and the initial risk assessment will be based on that assumption. To reduce the risk, additional measures would need to be considered. Paragraph 100 in R2P2 continues by stating that the “precautionary approach” should be used. In particular, as the degree of uncertainty increases, there is an increasing requirement for more stringent measures to mitigate the risks. R2P2 also refers to the relative costs and benefits of introducing a risk reduction measure. This can be used to determine whether or not a measure is proportionate to the level of risk involved. The guidance in CAP 403 does make it clear, in paragraphs A12 and A13, that “mitigation action should be taken whenever possible to reduce risk ratings even when the risk is low” and that mitigation measures should be sought to reduce high risk ratings to an acceptable level. The guidance could be improved by making it clear that a greater amount of effort is expected to reduce the risks as the risk increases. Providing some examples of when a mitigation measure is identified that could be considered disproportionate, together with some examples of reasonable measures, may be of benefit and make the process clearer to potential risk assessors. R2P2 has a section on evaluating the effectiveness of any action taken (paragraphs 115 to 117), and this is also covered in Section 4.18 of Gadd et al. In particular, R2P2 states that procedures should be in place to review the decisions made after a suitable interval. These should establish whether the actions taken were effective in controlling the risk, and whether any decisions needed to be modified as a result of new knowledge. An assessment should be made as to whether the information gathered to identify the hazards and mitigate the risks was appropriate, and whether improved knowledge and data can help make better decisions. An assessment should be made as to what lessons could be learned from the process. It is further stated that having a system for monitoring and evaluating progress provides a “good opportunity to assess whether such ‘established standards of good practice’ are out of date. New developments such as better knowledge of the risk involved and advances in technology may indicate that a higher standard would be more appropriate to control the risk”. The “Managing for health and safety” guidance [4] further asks the question of whether lessons have been learned from occasions where things went wrong and how the health and safety performance is reviewed. There is a whole section concerning the investigation of accidents and incidents, another on reviewing performance and a further one on learning lessons. CAP 403 does not discuss the importance of reviewing risk assessments regularly. It is appreciated that the guidance will often be used for single events, where a review is less relevant. The guidance does, however, also cover events that are held regularly. It could be constructive to include some statements regarding the importance of reviewing any existing risk

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 381 Appendix K (Cont) OFFICIAL SENSITIVE 21 assessments, both prior to the event and afterwards. This could cover lessons learnt from risks that were well controlled, as well as from those that were less well managed. The importance of recording this information could be emphasised, as lessons learnt from individual events can ultimately be used to feed back into the guidance. Within the guidance given on risk assessment, it may be beneficial to reiterate that, although these processes would be expected to be carried out for all events, the level of effort required should remain proportionate to the risks being assessed i.e. a small event with low risks will require significantly less effort than a large event with high risks. The aim is to encourage people to produce a risk assessment that is suitable and sufficient for the risks being managed and not to appear to be unduly onerous and burdensome. 2.7.3 Tolerability of risk R2P2 introduces the “TOR framework” in paragraph 122. TOR refers to the Tolerability of Risk and aids in the categorisation of a particular risk. HSE represents this concept by an inverted triangle with the risk increasing as you move up the triangle (see Figure 1). If the risk is low, then it will fall into the “Broadly acceptable” region. As the risk increases, it moves into the “Tolerable” region and high risks may end up in the “Unacceptable” region. Risks in the “Tolerable” region are described in Gadd et al [3] as “typical of those that people are prepared to tolerate in order to secure certain benefits”. Figure 1 HSE Framework for the tolerability of risk [2] In the description of the TOR framework, it is stated that any activity or practice that leads to a risk that falls into the “Unacceptable” region “would, as a matter of principle, be ruled out unless the activity or practice can be modified to reduce the degree of risk so that it falls in one of the regions below, or there are exceptional reasons for the activity or practice to be retained”. R2P2 makes it clear that, even if a risk falls into the “Broadly acceptable” region, reasonably practicable measures to reduce the risks should be considered. Within the “Tolerable” region in the TOR framework, it is expected that residual risks “are not unduly high and kept as low as reasonably practicable (the ALARP principle)”. It is also expected that the risks are reviewed periodically to ensure that they still meet the ALARP

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 382 Appendix K (Cont) OFFICIAL SENSITIVE 22 criteria e.g. by considering any new techniques or information that have become available. An assessment is needed to determine whether the risks have been reduced ALARP. The starting point of such an assessment should be the present situation in the duty holder’s undertaking or, if this is not possible, an option which is known to be reasonably practicable (e.g. one which represents standard good practice). Any additional mitigation measures are considered against this starting point (i.e. existing situation or standard good practice) to determine whether or not they are reasonably practicable to implement to reduce the risk level (paragraph 5 in Appendix C of R2P2). Gadd et al [3] is more succinct and states that “[r]educing risks ALARP means that if it is reasonably practicable to implement a risk reduction measure, it must be implemented.” In addition, it states that “[d]uty holders should consider what more could be done to reduce a risk and why it is not being done i.e. whether or not it is reasonably practicable to implement any possible additional measures that are identified”. A lack of consideration of ALARP or further measures that could be taken is recognised as a common mistake made in risk assessments and is discussed in Section 4.15 of Gadd et al. The guidance given within CAP 403 clearly defines the different levels of risk in paragraph A11, although it uses the phrases low, medium and high risk. In paragraph A13, it states that “[h]igh risk ratings should generally be deemed unacceptable” and goes on to say that they should be reduced to medium or lower. This is in broad agreement with R2P2. In paragraph A12 it states that “[m]itigation action should be taken whenever possible to reduce risk ratings, even when the risk is low”. This sentence is, in effect, stating that the risks must be reduced ALARP, although it does not use this phrasing. Although the guidance appears to be following the ALARP principle, it could be beneficial to explain how to assess the effectiveness of any mitigation measures. CAP 403 uses the phrase “whenever possible” in regard to taking mitigation action. It might be of use to elaborate on what this phrase means in practice, with some examples given. 2.7.4 Risk management In R2P2, paragraph 141, it is stated that HSE start with the expectation that the controls in place “should, as a minimum, implement authoritative good practice precautions (or achieve similar standards of prevention/protection), irrespective of specific risk estimates”. Paragraph 142 goes on to state that authoritative sources of relevant good practice include “guidance agreed by a body representing an industrial or occupational sector”. In this instance, the guidance provided by the Civil Aviation Authority (CAA) in CAP 403 should be implemented as a minimum. R2P2 continues by stating that an assessment should be made as to whether adoption of the good practice is an adequate response to the hazards. As has already been stated in Section 2.7.2, CAP 403 provides a range of guidance for running air displays or special events. It may be beneficial to state within the risk assessment guidance that it would be expected that these measures will be carried out as a minimum and that an assessment will need to be made to determine whether or not they are sufficient for controlling the risks, or whether further measures are required. In Section 4.19 of Gadd et al [3] the issue of not doing anything with the results of the risk assessment is discussed. It states that it is “essential that action is taken as a result of the findings of the risk assessment” and that it should not be considered a “paper exercise”. At the end of the section it says “The assessment will almost inevitably result in recommendations for improvements and further actions to control and reduce risk …”.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 383 Appendix K (Cont) OFFICIAL SENSITIVE 23 The second paragraph of Section 2 in Gadd et al [3] states “[t]he findings from a risk assessment can be used to inform decisions as to whether any existing precautions or control measures are adequate, or whether additional prevention or control measures are needed. Risk assessment can also be used to carry out a systematic comparison of different risk control/reduction options so that the optimal decision can be made”. CAP 403 mentions risk assessment in relation to the production of a safety plan. It could be beneficial to elaborate on this and include some of the information in Gadd et al, emphasising that the process is likely to lead to recommendations and identification of additional control measures. It might be worth including a comment in CAP 403 to stress the importance of recording the identification, assessment and implementation of additional control measures. 2.8 CAP 760 HAZARD AND RISK ASSESSMENT GUIDANCE A comparison has been made with the CAP 760 [6] guidance produced by the CAA, which provides guidance on hazard identification, risk assessment and the production of safety cases. Although the guidance is primarily considering risk assessment and safety cases for system lifecycles, the principles used are generally applicable. Areas of CAP 760 that are of direct relevance to the risk assessment guidance in CAP 403 [1] are highlighted. In some cases, it may be beneficial to include risk assessment information in CAP 403 similar to that given in CAP 760. Alternatively, the relevant sections of CAP 760 could be referenced in CAP 403 as an additional source of information that can be used by an assessor. CAP 760 contains a glossary of all the terms used within the document, including specific risk assessment terms such as ALARP. CAP 403 does contain a glossary but it is not prominent and does not include risk assessment terms. It could be beneficial to move the glossary to a separate section in CAP 403 and include additional terms in a similar manner to the glossary in CAP 760. Chapter 2 of CAP 760 introduces what it calls the “Seven-Step Process”. This is similar to the five steps to risk assessment process given in CAP 403. Step 1 of the CAP 760 process provides a system description and Step 7 outlines documenting the process in a safety case. CAP 403 mentions the requirement to record the risk assessment in paragraph A14. Recording the risk assessment is not included explicitly in the five steps as quoted in CAP 403. The seven steps in CAP 760 are given as:  Step 1: System description;  Step 2: Hazard and consequence identification;  Step 3: Estimation of the severity of the consequences of the hazard occurring;  Step 4: Estimation/assessment of the likelihood of the hazard consequences occurring;  Step 5: Evaluation of the risk;  Step 6: Risk mitigation and safety requirements; and  Step 7: Claims, arguments and evidence that the safety requirements have been met and documenting them in a safety case. A flow chart is provided to illustrate the process, which makes it clear that developing a risk assessment is often an iterative process. The flow diagram is reproduced in Figure 2.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 384 Appendix K (Cont) OFFICIAL SENSITIVE 24 Step 1 Describe the system and its operational environment Step 2 Identify hazard and consequence(s) Step 3 Classify the severity of the consequence(s) Step 4 Classify the likelihood of the consequence(s) manifesting Step 5 Evaluate the risk Is the risk acceptable? Is the risk ALARP? No Step 6 Identify risk mitigation measures (Safety Requirements) No (Don’t know) Recommend applying ALARP even when risk acceptable Yes Can you live with the remaining risk? Yes Step 7 Develop claims, arguments and evidence that the Safety Requirements have been met. Develop the Safety Case and proceed to the next lifecycle stage Abandon project or revise original project objectives Yes Information from all steps above feed in here No LIFECYCLE Iterations as system design progresses and additional hazards are identified and mitigations implemented Figure 2 The Seven-Step Approach from CAP 760 [6]

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 385 Appendix K (Cont) OFFICIAL SENSITIVE 25 Chapter 3 of CAP 760 describes each of the seven steps in more detail. For Step 2, the hazard and consequence identification, four key activities are described. These are:  Create a hazard log;  Identify the hazards;  Identify the consequences of each hazard; and  Update the hazard log. A hazard log is described as a method used to document hazards. CAP 760 states that the log consists of forms that allow details of the hazard to be recorded, the risks associated with it and any mitigation measures. An example of the form is given in Appendix F of CAP 760. It may be beneficial for CAP 403 to suggest that the information specified within the hazard log in CAP 760 is recorded in the risk assessments generated using CAP 403. A suggested format could be provided, if desired, noting that alternative methods can be used. CAP 760 states that “[t]he hazard identification step should consider all the possible sources of system failure”. It goes on to provide some possible examples of the types of systems that could fail. An equivalent sentence applicable to air displays could be used in CAP 403. Examples could also be given in CAP 403 for such a case, provided that it is noted that these are not exhaustive and that some may not apply to the event under consideration. Details are provided of different hazard identification methods, including the use of historical information, brainstorming and systematic methods such as a HAZOP (HAZard and OPerability analysis). Some of these methods may not be suitable for the events covered under CAP 403 but a brief description of suggested methods that are suitable (e.g. brainstorming) could be of benefit to potential risk assessors. CAP 760 emphasises the need to record the results of the hazard identification in the hazard log, and provides information on what information should be recorded. This is given in Step 3 of the seven step process and includes the severity of each consequence (noting that there may be more than one consequence for each hazard) and the rationale behind the severity classification chosen. Guidance is given on how to assess the severity. Similar information could be provided in CAP 403, perhaps with one or two examples, noting that the severity classifications are already given in Appendix A of CAP 403. Step 4 considers the estimation and assessment of the likelihood of the consequences occurring, the results of which must be recorded in the hazard log. Similar methods to those used in Steps 2 and 3 are advocated and the terms used (extremely improbable, extremely remote etc.) are equivalent to the terms used in CAP 403. CAP 760, however, also includes a numerical range to provide some quantification for the qualitative terms (e.g. < 10-9 per hour, 10-7 to 10-9 per hour etc.) as well as a qualitative definition (e.g. should virtually never occur, very unlikely to occur etc.). CAP 403 may benefit from the addition of a paragraph providing guidance on how to determine likelihoods. The use of a more quantitative definition for the terms used, or a more detailed qualitative description, could help with consistency between risk assessments produced by different assessors. An example of a quantitative definition could be given, although it would need to be recognised that it might not be applicable for all sizes and types of event. A more detailed qualitative description would also help to remove ambiguity, particularly if a quantitative definition is not suitable. Over time, the definitions used within individual risk

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 386 Appendix K (Cont) OFFICIAL SENSITIVE 26 assessments could be collated to see if any consistency has been developed, and these could be incorporated into future guidance. CAP 760 provides a colour coded risk matrix and describes the three different regions within it, which it names as acceptable, review and unacceptable. As in the case of CAP 403, it notes that even acceptable risks (or low risks in the CAP 403 terminology) should be assessed to see if they can be reduced still further. CAP 760 provides more detail about what each of the terms means in practice. Including this detail in CAP 403 may be of benefit as it provides a clearer understanding of the terms and can also provide an indication of the level of effort required to reduce the risks. There is a discussion in CAP 760 around different hazards producing the same consequence. The guidance makes it clear that it is the risk of the consequence that is being assessed, not the hazard itself e.g. if there are several hazards with the same consequence, the likelihood of each hazard may be low, but the combined likelihood of all the hazards leading to the consequence being assessed is considerably higher. In such a case, individual hazards should not be treated independently as it could lead to the risk being assessed as lower than the risk that would be associated with the actual consequence. Guidance is given in CAP 760 on how to accumulate the likelihoods, and how to mitigate the associated risk. This is an area that is currently not considered in CAP 403 and a paragraph covering this topic could be included as this is a point that could be easily missed by an assessor. If this was added to CAP 403 then also including a suitable example would aid clarity. CAP 760 states that the assessment must be clearly recorded, particularly where the risk has been assessed as being in the review region of the matrix but the conclusion is that the risk is ALARP. Justification for the decision needs to be clearly stated. This last point has been discussed elsewhere in this document (e.g. Section 2.3.1). It may be of value to potential risk assessors if CAP 403 provided a clearer link between risk mitigation and reducing risks ALARP. Including explanations for decisions made in the risk assessment would lead to more confidence in the output of any risk assessment produced using the guidance. For Step 6, CAP 760 provides guidance on risk mitigation and safety requirements. It reemphasises the recommendation that all risks are reduced, if possible, including those that fall into the acceptable region of the matrix. It provides examples of risk mitigation strategies and states that the mitigation may either reduce the likelihood or the severity of the consequence, or possibly both. The potential issue of a mitigation measure introducing new hazards is also highlighted in the guidance. CAP 403 currently provides limited information to a risk assessor on mitigation measures and how to assess the impact of mitigation on the level of risk (likelihood, severity, or both). It may be beneficial to include a paragraph giving a broad outline containing similar information to that contained within CAP 760 on this area. Examples of the types of mitigation measures that may be worth considering could also aid clarity, although it would need to be made clear that these measures may not be exhaustive and/or appropriate in all situations and that other measures may be more suitable to consider and implement. Step 7 in the CAP 760 process relates to the generation of safety cases, but does include guidance to ensure that the results of the previous steps are documented in a “logical and complete” manner.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 387 Appendix K (Cont) OFFICIAL SENSITIVE 27 CAP 403 currently states that the details of the risk assessment process should be recorded. It may be of use to assessors if CAP 403 provided more guidance as to what information should be recorded as part of the risk assessment process. If it is decided that producing a hazard log would be a beneficial addition to the guidance, examples of how to complete one could be given and this would form a significant part of any final risk assessment. The log would include the hazard identification process, the identification of the consequences, the assessment of the likelihood and severity of each consequence, the initial risk rating assessment, the identification and assessment of mitigation measures, and the final risk rating including all justifications for why the risk cannot be reduced further. In other words, the guidance currently given in CAP 760 could be adapted for use within CAP 403. 2.9 SUMMARY OF OBSERVATIONS 2.9.1 Risk assessment good practice in the guidance The previous sections have provided a number of comments on the risk assessment guidance given in CAP 403. In summary, the areas of good practice are:  Recognising the importance of undertaking a risk assessment;  Recognising that a risk assessment need not be complicated;  Listing a simple to follow 5 steps to risk assessment (noting that these do not completely correspond to the risk assessment 5 step process given by HSE);  Stating that the risk assessment must be undertaken by someone who is aware of the risks associated with the activity;  Providing the basis of a risk matrix that recognises that it is injury to people that is of importance when assessing the risks;  Providing an example of how to use the matrix, including attempting to show how mitigation measures may reduce the risk (it is recognised that there are some aspects that are missing from the example table given, but the principle is good);  Indicating what the risk ratings mean in terms of low, medium or high risk;  Stating that mitigation measures should be considered even when the risk is low;  Recognising that high risk activities are generally unacceptable and that the risks must be reduced to medium or low. In particular, not stating that the risks must be reduced to low risk, but recognising that medium risk is acceptable. In this case, further statements should be made to state that medium risk is acceptable provided they are ALARP, but the principle of not enforcing all risks to be low is good; and  Stating that the risk assessment process should be recorded and retained.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 388 Appendix K (Cont) OFFICIAL SENSITIVE 28 2.9.2 Changes to the guidance The review has identified a number of areas where changes could be made to the guidance that would be of benefit to a risk assessor. There are several key points that have been raised within the review of CAP 403 where changes should be made to the guidance to ensure that any risk assessment produced using the guidance will effectively manage the risks from an airshow.  The qualifications and experience required for the people undertaking the risk assessment should be clearly identified in the guidance. This will ensure that people with sufficient knowledge to identify the hazards and the mitigation measures, and to assess the associated risks, will undertake the risk assessment;  The information in the guidance on hazard identification should be amended. The guidance in CAP 403 could emphasise the need to identify all of the hazards, and provide some information on how to identify hazards. CAP 403 could highlight that the hazard identification process should be recorded, including keeping a record of hazards that were identified as part of the process but subsequently dismissed as not being applicable for the event being assessed. CAP 403 could include more information to ensure that assessors think about who is affected by the hazard and where they might be located in relation to the hazard. Including examples and/or a possible format to use for recording purposes could provide additional support to airshow organisers and assessors;  The existing guidance is potentially misleading around the area of risk mitigation. More advice is required to guide organisers and assessors to consider where, how and why the mitigation measures suggested do reduce and control the risks. Failing to provide this information could lead to uncertainty as to whether the risks have been reduced As Low As Reasonably Practicable (ALARP) and, consequently, whether the risks would then be sufficiently controlled;  The guidance implies, through the examples given, that the requirements for running an airshow listed in the main chapters of CAP 403 can be used to mitigate the risks from the identified hazards. CAP 403 should be taken as the minimum requirement and the risks assessed initially assuming that the guidance has been followed. Identified mitigation measures to lower the risk should go beyond those contained within the guidance. Providing additional information in CAP 403 on how to identify mitigation measures, and assess that the measures are appropriate and achievable, would be of benefit. Revised examples removing the CAP 403 mitigation measures and including some simple alternative measures could help deliver this message more clearly. CAP 403 could ask that the process for identifying and assessing mitigation be recorded. This would allow the inclusion of mitigation measures that were considered and then legitimately dismissed as being impracticable. Including examples and/or a possible format to use for recording purposes could provide additional support to airshow organisers and assessors; and  The tolerability of risk criteria currently used (i.e. the definitions of high, medium and low risk) should be reviewed. The current criteria has some significant consequences occurring in timeframes that cannot be perceived as cautious. Consideration should be given to modifying the definitions used e.g. this could be as simple as specifying that risks with a rating of 15 or higher should be classed as high.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 389 Appendix K (Cont) OFFICIAL SENSITIVE 29 Areas of CAP 403 where additional modifications could be made to provide further assistance to those carrying out risk assessments have also been identified.  It would be beneficial to move the risk assessment guidance in CAP 403 to a separate chapter, rather than a paragraph in Chapter 4 with the detail given in the Appendix. Placing it in the main part of the document will give it more emphasis, thereby reinforcing its importance as part of the safety management at air display events. It would also be useful to include links or references to guidance given by HSE and/or other CAA guidance (e.g. CAP 760). This would provide assessors with additional support and information as required;  The risk matrix should be explicitly included within the guidance to make it easier for an assessor to determine where the risks from an activity lie;  Guidance should be provided on the need to regularly review the risk assessment, particularly for airshows that will occur more than once (e.g. annually). This provides assurance that any new risks introduced at a subsequent airshow are considered and managed, and also that lessons have been learned from previous airshows; and  The guidance could clearly state that the risks from the airshow do not need to be reduced to low risk and can remain as medium risk, provided that it is demonstrated that the risks are effectively managed. This ensures that people involved in the airshow are aware of the more significant risk activities. There are other points where suggestions have been made that could potentially improve the risk assessment guidance in CAP 403. Consideration should be given to these suggestions to determine whether it would be of benefit to make the associated changes to the guidance.  Including an alphabetic glossary of all terms used and putting the glossary in its own section;  Providing more detail on the qualifications and experience of those identifying the hazards;  Adding “reviewing the risk assessment” as part of the five steps to risk assessment in the guidance;  Suggesting the use of maps to aid with assigning a severity classification;  Providing additional wording for the likelihood classification and/or some guidance to suggest that the risk assessor must define and record the likelihood classifications that are applicable to the event being considered;  Stating that risk assessments for the air display and for the ground based activities of the airshow should be carried out separately, especially at large events and with a further recommendation that this is followed for all sizes of event;  Recognising the importance of learning from previous incidents and recording the lessons learnt;  Making it clear that the risk assessment should be available for all people associated with the event and that they should particularly familiarise themselves with the parts pertinent to their role;  Providing links to other risk assessment guidance, including CAP 760 [6]; and  One other general area of improvement in the guidance is clarifying exactly who is responsible for undertaking each task.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 390 Appendix K (Cont) OFFICIAL SENSITIVE 30 2.10 IDENTIFICATION OF GUIDANCE FOR OTHER EVENTS An internet search was undertaken to ascertain what guidance is available for organisers of other public events. These include Formula 1, car rallies, speedway, motocross, trials and track racing, the Isle of Man TT, events covered by British Cycling, horseracing and general events that occur on the highways. The FIA (Federation Internationale de L’Automobile) cover Formula 1 and rallying events. The guidance that could be found on the internet mentions the need for a safety plan and for keeping the public away from the cars, but no specific risk assessment guidance was found. Most of the information related to safety measures are for those involved in the race. In the case of speedway, it is made clear who is responsible for carrying out the risk assessment but no guidance could be found. Each individual track appears to have its own risk assessment. The ACU (Auto Cycle Union) provide a risk assessment form for motocross, trials and track racing. To obtain copies of the guidance, membership of the ACU is required. The Isle of Man government provides general guidance for events such as the TT. This includes a generic risk assessment form. Guidance is available from British Cycling for club events, which appears to be reasonably comprehensive. Guidance for both competitive and non-competitive events is only available to members of British Cycling, and it only appears to be available for certain types of event. Forms are provided for completion. An example of a safety handbook is provided for horseracing events by the RCA (Racecourse Association Limited). Mention is made of risk assessment but no guidance was found. Events on the highways are covered by the local highways authority, which is either the county council or the city/metropolitan council. Guidance is provided in a Home Office document on how to carry out a risk assessment and it is made clear that it is the responsibility of the event organiser to do the risk assessment. None of the guidance identified was considered suitable for use as a benchmarking exercise with CAP 403 due to a general lack of detail in the advice given.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 391 Appendix K (Cont) OFFICIAL SENSITIVE 31 3 CONCLUSIONS A review has been conducted of the risk assessment guidance given by the Civil Aviation Authority (CAA) in CAP 403 [1] for flying displays and special events. The review has been carried out by the Health and Safety Laboratory (HSL) at the request of the Air Accident Investigations Branch (AAIB). This review has included a comparison of the risk assessment guidance within CAP 403 with Health and Safety Executive (HSE) and other risk assessment guidance [2, 3, 4], health and safety legislation [5] and with other CAA risk assessment guidance [6]. The review has aimed to address seven areas, identified as being of importance by the AAIB and HSL. A number of observations have been made of good practice in hazard and risk assessment in CAP 403. There are some areas of the guidance, however, where additional information could be of benefit to those using it and would potentially lead to greater confidence that a risk assessment created using the guidance will be suitable and sufficient for managing the risks. This study has identified areas of the guidance where changes are required to give airshow flying display organisers the information needed to undertake meaningful risk assessments, or in some cases, to avoid misleading organisers on what needs to be done. Ultimately, these improvements should ensure that the risk assessments help airshow organisers to target and control the risks from flying displays.  Identifying the right people to assess the risks CAP 403 should clearly list the qualifications and experience required of the people who should be involved in assessing the risks. This will ensure that people with sufficient knowledge to identify the hazards and the mitigation measures, and to assess the associated risks, will undertake the risk assessment;  Improving guidance on hazard identification CAP 403 should include some additional information to stress the importance of the hazard identification process to the quality of the overall risk assessment. This could include advice on defining what is meant by a “hazard”, and recommending that more information is provided in an assessment explaining the thoughts of the assessor behind the hazards identified. The CAP 403 guidance could also recommend that a record be kept of the hazard identification process. This allows an understanding of the expertise used by the personnel involved in the process and would allow an understanding of the reasons why some hazards have not been considered further in an assessment;  Issues with the guidance on mitigation measures An area where the existing guidance in CAP 403 is potentially misleading is concerning the area of risk mitigation. This is a significant area that needs to be improved as failing to properly assess the mitigation measures could lead to inappropriate or unachievable measures being put in place that do not control or reduce the risks. The guidance uses examples where CAP 403 requirements to allow an airshow to go ahead are used as measures to mitigate the risks from the identified hazards. The guidance in CAP 403 should be taken as the minimum requirement and the risks assessed initially assuming that the guidance has been followed. Identified mitigation measures to lower the risk should go beyond those contained within the guidance.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 392 Appendix K (Cont) OFFICIAL SENSITIVE 32 It should be explicitly stated that an explanation of how the identified mitigation measures lower the severity or likelihood classification in the risk assessment calculation should be recorded. Additional information on how to identify mitigation measures and assess the impact of the measures, together with revised examples should be included in CAP 403. CAP 403 should encourage assessors to demonstrate that the risks have been reduced As Low As Reasonably Practicable (ALARP) for the air displays; and  Risk criteria review It is recommended that the tolerability of risk criteria currently provided in CAP 403 (i.e. the definitions of high, medium and low risk) are reviewed to assess whether these need to be modified. Risks are currently classified as high if the risk level is calculated to be above 15. Using this scoring system means that there are some high consequence events that are deemed “tolerable” for relatively frequent likelihoods. A review would clarify whether the criteria are acceptable or whether a change would be appropriate. This study has also identified areas within CAP 403 where additional information or restructuring could help airshow organisers and risk assessors when assessing the risks.  Location of the risk assessment guidance in the document Moving the risk assessment section out of the appendices of CAP 403 and into the main body of the document would raise awareness of the importance of generating a risk assessment. Detailed examples and additional information could be retained in appendices;  Including the risk matrix as a visual aid The risk matrix should be explicitly included within the guidance to make it easier for an assessor to determine where the risks from an activity lie;  Highlighting the need for regular reviews of the risks assessed Guidance should be provided on the need to regularly review the risk assessment, particularly for airshows that will occur more than once (e.g. annually). This provides assurance that any new risks introduced at a subsequent airshow are considered and managed, and also that lessons have been learned from previous airshows; and  Guidance on reducing and controlling risks The guidance could clearly state that the risks from the airshow do not need to be reduced to a low risk level and can remain as medium risk, provided that it is demonstrated that the risks are effectively managed. This is to ensure that more significant risks are treated with the appropriate level of caution. Some additional modifications to CAP 403 have been identified that would add further value to the document and potentially make it easier for airshow organisers and risk assessors to undertake assessments to control the risks.  Clearly distinguishing the air display risks from other risks Specifying that the air display risk assessment and the ground based aspects should be separated in some way to distinguish between these different aspects of the airshow. This would ensure that those who need to be aware of the air display risks, and the measures to mitigate them, do not inadvertently ignore some of the risks through having the details of these risks and mitigation included with the risks from ground based activities;

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 393 Appendix K (Cont) OFFICIAL SENSITIVE 33  Making the glossary more accessible Moving the glossary to a separate section and including all risk assessment terms would aid the clarity of the guidance given to the people undertaking the risk assessment. Ensuring that the glossary is in alphabetical order would be of further benefit; and  Clarifying risk assessment responsibilities Carrying out a risk assessment should be clearly listed as one of the requirements and responsibilities of the Event Organiser and the FDD. This will help emphasise the importance of the risk assessment, and who should be responsible for ensuring that a risk assessment is undertaken.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 394 Appendix K (Cont) OFFICIAL SENSITIVE 34 4 REFERENCES 1. CAA (2015). Flying displays and special events: A guide to safety and administrative arrangements. CAP 403, Thirteenth Edition, February 2015. 2. HSE (2001). Reducing risks, protecting people. HSE Books, ISBN 0 7176 2151 0, http://www.hse.gov.uk /risk/theory/r2p2.pdf, accessed 23 March 2016. 3. Gadd SA, Keeley DM and Balmforth HF (2004). Pitfalls in risk assessment: examples from the UK. Safety Science, Vol. 42, pp. 841-857. 4. HSE (2013). Managing for health and safety. HSG65, HSE Books, ISBN 978 0 7176 6456 6, http://www.hse.gov.uk/pubns/priced/hsg65.pdf, accessed 23 March 2016. 5. The Management of Health and Safety at Work Regulations 1999. http://www.legislation.gov.uk/uksi/1999/3242/made, accessed 23 March 2016. 6. CAA (2010). Guidance on the conduct of hazard identification, risk assessment and the production of safety cases. CAP 760. 7. Controlling the risks in the workplace. http://www.hse.gov.uk/risk/controlling- risks.htm, accessed 23 March 2016.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix K 395 Appendix K (Cont) OFFICIAL SENSITIVE The Health and Safety Laboratory (HSL) has been developing health and safety solutions for over 100 years. Our long history means that we’re well-placed to understand the changing health and safety landscape, and anticipate future issues. We are part of the Health and Safety Executive (HSE) – this gives us a unique insight into the changing face of workplace health and safety. HSL employs about 400 staff, who help make working environments and working lives safer, in the UK and around the world. From our base in Buxton, and with staff in six other locations across the UK, we focus on the development of practical solutions to health and safety problems. Our scientists have a strong international reputation for world-class research, undertaken on behalf of HSE and other sponsors in government and industry. ISO 9001 ISO 14001 OHSAS 18001 Health and Safety Laboratory Harpur Hill Buxton Derbyshire SK17 9JN UK www.hsl.gov.uk T : +44 (0) 1298 218218 E : hslinfo@hsl.gsi.gov.uk

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix L 396 Appendix L

Airworthiness Approval Note No: 26172 Issue 2

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix L 397 Appendix L (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix L 398 Appendix L (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix L 399 Appendix L (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix L 400 Appendix L (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix L 401 Appendix L (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix L 402 Appendix L (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix L 403 Appendix L (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 404 Appendix M

ROYAL AIR FORCE CENTRE OF AVIATION MEDICINE

AIRCRAFT ACCIDENT HUMAN FACTORS REPORT

HAWKER HUNTER G-BXFI, SHOREHAM AIRSHOW, 22 AUGUST 2015

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 405 Appendix M (Cont) Originator

Originator

Accident Investigation and Human Factors Section RAF Centre of Aviation Medicine RAF Henlow HENLOW SG16 6DN Head of Aviation Psychology

Additional author(s)

Accident Investigation and Human Factors Section RAF Centre of Aviation Medicine RAF Henlow HENLOW SG16 6DN Aviation Psychologist

The findings, conclusions and recommendations contained in this report are based on the evidence that was made available to the Accident Investigation and Human Factors Section, Royal Air Force Centre of Aviation Medicine (RAF CAM).

The report has been written prior to the final conclusions of the Air Accident Investigation Branch (AAIB) accident report.

Distribution list

This report should not be released to any person other than those listed on the distribution list without prior permission from OC Accident Investigation and Human Factors Section, RAF CAM and the AAIB.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 406 Appendix M (Cont) Contents

Introduction ........................................................................................................................... 4 Overview of accident ......................................................................................................... 4 HF approach...................................................................................................................... 4 Hazard sequence .................................................................................................................. 7 Entry into loop decision gate .............................................................................................. 7 Loss of thrust on climb ..................................................................................................... 11 Apex of loop decision gate ............................................................................................... 12 Potential entry conditions .................................................................................................... 17

Acronyms and abbreviations

AAIB Air Accident Investigation Branch ATSB Australian Transport Safety Bureau ARM Accident Route Matrix CAM Centre of Aviation Medicine ft Feet G Gravito-inertial forces GPS Global Positioning System HEA Human Error Analysis HET Human Error Template HF Human Factors HFACS Human Factors Analysis Classification System hrs hours HTA Hierarchical Task Analysis kts Knots OC Officer Commanding PCM Perceptual Cycle Model RAF Royal Air Force SA Situation Awareness SHERPA Systematic Human Error Reduction and Prediction Approach TA Task Analysis

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 407 Appendix M (Cont) Introduction

RAF CAM was tasked by the Air Accidents Investigation Branch (AAIB) to investigate specific Human Factors (HF) aspects of the Hawker Hunter G-BXFI accident that took place at Shoreham Air Show on 22 August 2015. This report presents the results of the HF investigation. Overview of accident

Hawker Hunter G-BXFI took off from North Weald Airfield in Essex at approximately 1200hrs on Saturday 22 August 2015. The aircraft transited to the South Coast and commenced the air display over Shoreham Airport at approximately 1220hrs. The aircraft performed a fly past at the display line, completed a “derry turn” to the left, and then entered a descending left turn reaching an altitude of 200ft.

The next manoeuvre was a bent loop, the aircraft climbing to reach an almost fully inverted position at the apex, at a height of approximately 2700ft. The aircraft accelerated through the descent, reaching a nose up attitude but had not achieved level flight before impacting the ground at the A27 road at approximately 1222hrs.

HF approach

Evidence collection. RAF CAM had access to the following evidence that was collected by the AAIB which provided the basis for this HF report: a. In-cockpit video of accident sortie.

b. Observation of the aircraft wreckage at the AAIB hangar in Farnborough.

c. Observation of a Hunter T7 cockpit located at Bruntingthorpe.

d. Flight parameters identified by AAIB (including altitude, airspeed, and thrust during the display sequence).

e. G-BXFI pilot’s hand written in-flight notes which outlined a display sequence.

f. Flight trials report prepared by the AAIB’s Operations Advisor.

g. Notes from AAIB interviews undertaken with the G-BXFI pilot.

Scope. Following initial discussions with AAIB, three specific tasks were identified to be undertaken by RAF CAM with regards to the HF aspects of the accident. The tasks were: a. Task Analysis (TA) and Human Error Analysis (HEA). TA and HEA techniques would be used to analyse key decision points within the display sequence. The aim of this task was to understand the scope for human actions and/or decisions to have contributed to the accident sequence, and to analyse the nature of any errors that may be identified.

b. Review of video evidence. The aim of this task was to maximise the understanding of the pilot tasks and point of focus during the display sequence by reviewing the in-cockpit video.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 408 Appendix M (Cont)

c. Review of pilot experience and task practice. The aim of this task was to understand the nature of the recent, relevant, task practice undertaken by the pilot in the period leading up to the accident.

These tasks address particular areas in which AAIB wished to integrate specialist HF advice, rather than provide a full review of HF issues associated with the accident. Therefore, the results of the RAF CAM analysis should not be considered in isolation, but rather in the context of the wider investigation and other HF issues identified and reported by AAIB.

TA and HEA. Two key points in the accident sortie were identified through discussion with AAIB at which human action and/or decision making may have contributed to the accident. These two points were the decisions made on entry to the loop and at the apex of the loop. Two HEA approaches were applied to analyse each of these decision points: a. Systematic Human Error Reduction and Prediction Approach (SHERPA)1. SHERPA is a technique for identifying the type of errors that could credibly occur, with the aim of developing methods for mitigating those errors. SHERPA is based on a Hierarchical Task Analysis (HTA) for the actions being assessed. Each task within the HTA is categorised according to the nature of the task and, dependent on that categorisation, a defined set of error terms are reviewed for credibility. Use of SHERPA provided a detailed analysis of the cognitive/decision making aspects of the task.

b. Australian Transport Safety Bureau (ATSB) HF analysis of see and avoid2. As a task requiring decision making based on visual information, the decisions analysed during the accident sortie had commonalities with the see and avoid task. Therefore, to provide an alternative to the traditional error analysis approach of SHERPA, the ATSB breakdown of the potential errors that can arise during see and avoid was adapted to the key decisions in the accident sequence. Applying the ATSB approach enabled a detailed analysis of the influence of perception on decision making during the accident sequence.

Review of video evidence. The in-cockpit video for the entry to the loop and the bent loop itself was reviewed. The overall phases of the manoeuvre were identified and a set of characteristics were defined for each second of video. These characteristics included pilot head movements, instrument panel contrast, position of sun, and control movements made.

Review of pilot experience and task practice. At the stage of issuing this report, RAF CAM has not undertaken the proposed analysis of pilot experience and task practice.

HF analysis of findings. The results of the video analysis and HEA were examined independently and in combination using the structure of the Accident Route Matrix (ARM)3. The ARM is based on the systematic and validated framework of the Human Factors Analysis Classification System (HFACS)4 and aims to identify which factors, and at which point each factor, increased the risk of:

1 Harris, D. Standon, N.A., Marshall, A., Young, M.S., Demagalski, J. and Salmon, P. (2005). Using SHERPA to predict design- induced error on the flight deck. Aerospace Science and Technology, 9, 525-532. The Human Error Template (HET) HEA approach was also used to examine decision making at the apex of the loop, but produced the same findings as SHERPA so was not used to analyse the decision making on entry to the loop. 2 Australian Transport Safety Board (1991). Limitations of the See and Avoid Principle. Levels of Situation Awareness (SA) and the Perceptual Cycle Model (PCM) were also used to examine decision making at the apex of the loop but were of limited value due to the available evidence and so were not used to analyse decision making on entry to the loop. 3 For a full description see: Harris, S. (2011). Human factors investigation methodology. International Symposium on Aviation Psychology. Available from: http://www.wright.edu/isap/. 4 Weigmann, D.A. and Shappell, S.A. (2003). A Human Error Approach to Aviation Accident Analysis. Aldershot, UK: Ashgate.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 409 Appendix M (Cont)

a. Hazard entry. The probability the aircraft would have entered a hazardous scenario;

b. Recovery. The probability the aircraft would have successfully recovered;

c. Escape. The probability the pilot would have escaped without injury; and

d. Survival. The probability that personnel would have survived.

Hazard sequence. The four stages described in paragraph 9 are known as the hazard sequence. In the case of the G-BXFI accident, the HF analysis has focussed on understanding the actions that led up to hazard entry and decisions regarding recovery actions, with the aim of identifying the human actions that may have occurred and contributed to the accident. These results are described in the “Hazard Sequence” section of the report. Based on the hazard sequence analysis, key HF issues that would have made these actions more likely are identified and are summarised in the “Entry Conditions” section of the report. Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 410 Appendix M (Cont) Hazard sequence

This section of the report maps the sequence of actions during the flight that led up to the hazard entry against the associated HF analysis. As such, this section characterises what role human actions may have played in the accident sequence. Due to the limited availability of evidence regarding the accident (e.g. lack of flight data recorder or interview with the pilot regarding the accident sequence), it has not been possible to positively determine which of these actions and decisions were made. However, the analysis has identified the credible range of actions and decisions that may have occurred. Entry into loop decision gate

Decision gate. At entry to the bent loop manoeuvre, a decision gate may have been used to determine if the parameters were suitable for the manoeuvre to be undertaken. The primary decision at this stage was if the airspeed was above the minimum required for the manoeuvre to be safely completed. The AAIB’s Operations Advisor has stated that some pilots would adopt a 300kts minimum speed for a bent loop in a Hawker Hunter, whereas other pilots would adopt a 350kts minimum speed. At present, it has been estimated that the aircraft was travelling at 300kts to 310kts on entry to the loop. The different minimum speed criteria used by different pilots and uncertainty regarding the aircraft speed give rise to a number of possibilities regarding the decision to continue with the bent loop during the display sequence on 22 Aug 15 – as shown in Table 1. Table 1: Nature of continue decision dependent on the aircraft speed and pilot decision criteria Aircraft speed Pilot used a 300kts minimum speed Pilot used a 350kts minimum speed 299kts or below Continue decision not in line with criteria Continue decision not in line with criteria 300-349kts Continue decision in line with criteria Continue decision not in line with criteria 350kts or above Continue decision in line with criteria Continue decision in line with criteria

In interview with AAIB, the G-BXFI pilot stated that he used a 350kts minimum speed (except where circumstances demanded a “minimum height loop” in which case 350kts would be seen as a target speed). The aircraft speed was as estimated by AAIB (300- 310kts) on entry to the bent loop was below 350kts. Therefore, it appears that the action to continue with the manoeuvre was not in line with the criteria that he used. Although there remains some uncertainty regarding the aircraft speed, an HEA has been undertaken on the assumption that the pilot used a 350kts minimum speed criteria and the aircraft airspeed was below this. Should this assumption be found to be incorrect, then the HEA presented below is invalid. The HEA has identified the potential for human error at each stage of the decision making process (as described in paragraph 6). It is not possible to determine which, if any, of these options took place based on the available evidence.

Gathering information. Limitations on gathering information about the aircraft speed could have led the pilot to have incomplete or inaccurate information about the speed at entry to the bent loop manoeuvre. Analysis of video evidence indicated that the pilot moved his head downwards towards the instrument panel 4 times in the 30 seconds prior to the pull up into the loop, suggesting that the pilot may have scanned his instruments during these times. However, there is not adequate information to determine if the airspeed indicator was read during these scans. Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 411 Appendix M (Cont)

a. Information about aircraft speed not obtained. The pilot may not have seen and/or read the airspeed when entering the loop manoeuvre. The airspeed may not have been read as a result of the scan pattern, the level of workload, the allocation of attention, change blindness, distraction, and/or visual limitations (such as contrast and glare)5. Although the pilot may have been aware that he had not obtained airspeed information, shortfalls in information gathering can occur without detection.

(1) Scan pattern. Video evidence indicated that the pilot was likely to have scanned the instruments during entry to the loop. However, it cannot be positively determined if the airspeed was scanned during this time. A pilot may learn or develop a poor scan technique which would increase the likelihood that the airspeed may not be read. The AAIB’s Operations Advisor highlighted that airspeed is the primary focus on entry to a loop manoeuvre and so it would be expected that the airspeed indicator would form part of any instrument scan undertaken at this stage. Further information on the scan technique used by the pilot may provide insights on this matter.

(2) Workload. Both high and very low levels of workload can influence a pilot’s visual search performance as these workload levels result in a reduction in the available attentional resources. It is considered unlikely that the pilot was experiencing very low levels of workload during the loop manoeuvre due to him having fewer total flying hours on the Hunter aircraft (compared to other aircraft types that he flew) and the demands imposed by display flying. However, these factors could give rise to high workload. High workload can affect the frequency of the pilot’s visual scans and/or the duration of those scans. Thus a high level of workload could have increased the likelihood of airspeed information being missed.

(3) Allocation of attention. Attentional resources are limited and so if a pilot’s attention is targeted at one particular area, this is likely to be at the expense of other areas. Therefore, if the pilot’s attention was focussed on another part of the cockpit displays or outside the cockpit then information on the airspeed indicator could have been missed. Analysis of in-cockpit video indicated that the pilot’s focus was predominantly on external cues to the left and upper left. However, the pilot was observed to move his head towards the cockpit instruments on a number of occasions prior to the manoeuvre. Therefore a failure to allocate any attention to the cockpit instruments is considered unlikely, although it is possible that limitations on attentional processes while looking towards the instruments could have led airspeed information to be missed.

(4) Change blindness. The pilot was observed to move head between external (left and upper left) and internal (downwards) cues. When there is a break in the observation of the target, for instance, when shifting attention between different areas, it is more difficult for changes occurring in one of those

5 The scope for diffusion of responsibility, gravito-inertial (G) forces, obstructions, blind spot, accommodation, or visual narrowing to influence information gathering was reviewed but considered extremely unlikely to influence pilot behaviour in this instance. Although G on entry to the loop may have been sufficient to influence the pilot, the check of airspeed would occur before initiating the manoeuvre and so before this level of G was experienced. Diffusion of responsibility was not relevant as there was only one pilot in the cockpit, and so no other person with whom tasks could be perceived to be shared. The airspeed indicator could not be seen on the cockpit video and so it cannot be ruled out that it was obstructed, however, the position of the airspeed indicator within the cockpit means that it is unlikely that it was obstructed and review of the cockpit layout revealed it was not possible to obstruct the airspeed indicator with the stick controller. Due to the lack of obstructions, blind spot issues would not occur as binocular vision of controls was possible at all times. Accommodation was not considered relevant as the task to check the instruments would have been planned rather than alerted. Visual narrowing is addressed under the attentional focus and high workload points described in the main text.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 412 Appendix M (Cont) areas to be detected – a phenomena known as “change blindness”. Therefore, it is possible that the pilot’s changed point of focus could have led a change to the airspeed on entry to the loop to be missed.

(5) Distraction. Distraction occurs when attention is diverted from the pilot’s primary focus to another source. Distraction can affect the frequency and/or duration of a pilot’s visual scan as the pilot re-focuses their attention elsewhere. Should the pilot’s attention be drawn away from the airspeed indicator on entry to the loop, then the information could have been missed.

(6) Instrument contrast. Instrument visibility can be influenced by the visual environment in which it is being viewed. The accident occurred on a bright, sunny day; in these environments, there can be areas of shadow which influence the visual contrast of controls. During the pilots head movements towards the instrument panel, the contrast changed, starting initially in shade, the top half of the instrument panel was then in sun for the second head movement, and then back into shade for the final two downwards head movements. The instrument panel appeared particularly dark during the last head movement. In these conditions, the pilot would have been adjusting his focus from a bright external view to a regularly changing instrument panel. The time taken to adjust from bright to shaded conditions can reduce visibility during this time.

(7) Glare. The presence of a glare source (in this case the sun) can have a significant impact on visual effectiveness6. The exact position of the sun in relation to the pilot during entry to the loop has not been calculated at this stage, but there is potential for glare to have made it more difficult to gather information from the displays.

b. Inaccurate information obtained about airspeed. As the pilot looked towards the displays during the entry to the loop, he may have looked at the airspeed indicator. However, he may have obtained an inaccurate perception of the airspeed, specifically, that the aircraft was faster than it actually was. Should the pilot obtain information that led him to believe the aircraft was faster than 350kts when it was not, then the subsequent action to continue with the manoeuvre would have been correctly made and implemented.

(1) Airspeed indicator displayed the incorrect speed. At present it is not known if the airspeed indicator was serviceable and displaying the correct speed on entry to the loop. Technical analysis is on-going by AAIB which may provide further information on this point. The airspeed indicator is the primary display used for speed information and so should this display have indicated that the aircraft was above 350kts then it would have led the pilot to believe the aircraft was at the correct configuration to continue with the manoeuvre.

(2) Airspeed display misleading or ambiguous. The airspeed display uses a moving pointer, with two scales one inside the other. On the first revolution, the pointer uses the outside scale to indicate speeds from 0 to 400kts, on the second revolution the pointer uses the inside scale to indicate speeds from 400kts to 750kts. Thus, the pointer indicates two speeds at any one time and the pilot will need to interpret which of these speeds is correct. For airspeed of approximately 300kts, the second dial would indicate approximately 750kts, which is above the maximum speed of the aircraft. Therefore, it is not

6 Hawkins, F.H. (1987). Human Factors in Flight. Aldershot: Gower.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 413 Appendix M (Cont) considered feasible that the pilot would have misread the inner dial as the actual aircraft speed.

(3) Another dial read as airspeed. The Hunter cockpit includes a number of moving pointer displays with rows of digits with a single pointer. While there are unique features of the airspeed dial which enable it to be discriminated from the other displays, the method of reading the airspeed display is similar to other displays which could lead to an error whereby another display was read as the airspeed. It has not been identified whether there was another display which would have been pointing to a position which could be misinterpreted as being a speed above the actual airspeed on entry to the loop.

(4) Global Positioning System (GPS) read as airspeed. The GPS within the G-BXFI cockpit displayed ground speed. Therefore, it is theoretically possible for the pilot to have read the GPS ground speed as the aircraft speed during entry to the bent loop. However, the AAIB’s Operations Advisor has indicated that it is not feasible that the pilot would have used this figure rather than the airspeed indicator dial.

(5) Airspeed was misread. Moving pointer displays offer an acceptable ease of reading and are an effective means of presenting change over time and fluctuations around a level7, but the nature of the pointer means that an exact reading is difficult to obtain and so there is a risk of error in reading the airspeed display8. Accuracy of reading displays can be influenced by workload and attention, but also by the pilot’s expectation, in that the pilot sees what he or she expects to see, rather than what is actually presented. If the pilot was used to being above 350kts when checking the indicator on entry to the loop, then it could lead to such an expectation.

c. Information about aircraft speed obtained at the wrong time. The check of the airspeed indicator may have been mistimed so that it was undertaken either too early or too late. If the airspeed was checked during the downwards head movements, then it would have been checked at 26, 22, 14, and 7 seconds prior to pull up. Estimates of the indicated airspeed at these times (made by AAIB based on the in- cockpit video) are between 275kts and 313kts – all below the pilot’s stated 350kts minimum entry speed. Therefore, while it cannot be positively determined when the airspeed was checked (assuming that it was checked – see earlier paragraphs), it is unlikely that the time at which the airspeed was checked could have led to an inaccurate perception of being above 350kts.

Selecting course of action. Had the pilot obtained accurate information about the aircraft speed at the entry to the loop, the next stage of the decision making process was to use that information to select a course of action. An error may have been possible at each stage of this process which could have led to a decision being made to continue with the manoeuvre at too slow a speed. These errors would have been made more likely by high workload and distraction (discussed in paragraph 13), which reduce the available cognitive resources and so increase the likelihood of error. a. Recollection of entry speed criteria. While the pilot stated that he normally used 350kts minimum speed, it is possible that this criterion was not recalled correctly during the air display. If the pilot had incorrectly recalled a minimum entry speed of

7 Kroemer, K.H.E and Grandjean, E. (1997). Fitting the Task to the Human (fifth edition). London: Taylor and Francis. 8 E.g. Kroemer and Grandjean (ibid); McCormick, E.J. and Sanders, M.A. (1982). Human Factors in Engineering and Design (fifth edition). London: Mc-Graw-Hill.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 414 Appendix M (Cont) 300kts or below, or recalled 350kts as a target entry speed, it could lead him to believe that it was safe to complete the manoeuvre when at 300kts to 310kts.

b. Recollection of options if too slow at entry. It is not considered credible that the pilot was unaware of the option to not undertake the loop, but it was possible that the pilot recalled options to adjust the way the loop was flown to overcome a lower than desired airspeed. In interview with AAIB, the G-BXFI pilot indicated that if too slow on entry to a bent loop he would not pull up into the manoeuvre, due to the possibility of not having the airspeed to complete the loop. However, the pilot also described that he could select full power to accelerate early if speed was low. Analysis by the AAIB’s Operations Advisor has concluded that the height at the apex of the loop is determined by a combination of the entry airspeed, engine thrust, the manner in which the pull-up is flown, and the extent of any bend to the loop. Therefore, it is possible that having identified a low speed the pilot may have intended to adjust the way in which the manoeuvre was flown to overcome the low speed on entry.

Summary. Analysis has been undertaken to identify the scope for human actions and/or decisions to have contributed to the entry to the loop being instigated below the pilot’s stated minimum speed criteria of 350kts. It is not possible to determine which, if any, of these options took place based on the evidence available for the HF analysis, but the following accounts are considered credible and feasible: a. The airspeed may not have been seen or read when entering the loop manoeuvre as a result of scan pattern, high workload, allocation of attention, change blindness, distraction, and/or visual limitations (such as contrast and glare).

b. An inaccurate perception of the airspeed may have been obtained, specifically, that the aircraft was faster than it actually was, as a result of the airspeed indicator displaying an incorrect speed, another dial in the aircraft being read as the airspeed, and/or the airspeed dial being misread.

c. The minimum speed required on entry to the loop may have been recalled incorrectly.

d. The pilot may have selected to continue with the bent loop but adjust the way the manoeuvre was flown to overcome the low speed on entry.

Loss of thrust on climb

Issue. Analysis undertaken by AAIB has identified that there was a reduction in thrust during the climb component of the bent loop. It was not known at the time of writing this report what caused the loss of thrust (such as pilot action, technical fault, etc) and so no HF analysis has been undertaken of it. However, in the course of the analysis of the in-cockpit video it was considered whether the pilot was aware of the loss of thrust and, if so, when. Such analysis assumes that the loss of thrust was not initiated by the pilot intentionally. If subsequent work by AAIB identifies that the pilot intentionally reduced thrust during the climb, then the analysis presented in paragraphs 17 and 18 is invalid.

Detection during climb. During the climb, the pilot’s point of focus was on the external cues, looking left and briefly to the right twice. Video evidence indicated that the pilot’s head did not move downwards towards the instrument panel during the climb. The AAIB’s Operations Advisor has indicated that there would have been few clear indications on the climb to the loss of thrust, either on the instruments or in the other characteristics of the

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 415 Appendix M (Cont) aircraft’s flight. Therefore, it is considered unlikely that the loss of thrust was detected during the climb.

Detection at apex. The airspeed and altitude at the apex of the loop may have provided a cue to the loss of thrust. At the apex of the loop the pilot’s head moved from an external point of focus towards the cockpit instruments. Therefore, there was scope for the pilot became aware of the loss of thrust at the apex. It cannot be positively determined if the pilot became aware of the loss of thrust at this stage but, if he were aware of it, the loss of thrust could have increased workload and been a source of distraction from that point in the sortie onwards. Apex of loop decision gate

Decision gate. At the apex of the loop, a decision gate may have been used to determine if the parameters were suitable for the manoeuvre to be completed. The primary decision to be made at this stage was if the height was above the minimum required, but the aircraft speed would also be considered. The Flight Test report from the AAIB’s Operations Advisor has indicated that the absolute minimum height required for the loop to be completed successfully and the aircraft to capture a 500ft height on exit would have been between 3100ft and 3450ft. In interview with AAIB, the G-BXFI pilot indicated that he used a minimum height at apex of between 4000ft and 5000ft. 4000ft was described as a “minimum height loop” (comprising 3000ft to complete the loop, 500ft for the height on exit, and an additional 500ft to act as a safety buffer) which was only used in some circumstances. On a typical display the pilot stated that he used a minimum apex height of 4500ft to 5000ft. The G-BXFI pilot also stated that the speed at apex would be acceptable between 100kts and 150kts, but at 100kts control of the aircraft would be reduced. At present it has been estimated that the aircraft reached a maximum altitude of 2700ft at the apex of the loop at airspeed of 100kts, which is below the minimum height outlined above for the manoeuvre to be completed safely and lower than the pilot’s desired airspeed. At this altitude, it would have been necessary to perform an escape manoeuvre to avoid impact with the ground; therefore, analysis has been undertaken of the decision to continue with the loop when below the pilot’s stated minimum height criteria. The potential for human error at each stage of the decision making process has been reviewed and the following options identified. It is not possible to determine which, if any, of these options took place based on the available evidence.

Gathering information. Limitations on gathering information about aircraft height could have led the pilot to have incomplete or inaccurate information about the altitude at the apex of the loop. Analysis of video evidence indicated that just prior to reaching the apex of the loop the pilot’s focus was to the right and up. Then, through the apex of the loop the pilot looked down, to the left and up, down and to the right and up, before looking forward and up. Such a range of head movements indicate that the pilot was actively engaged in gathering information at the apex of the loop and looked towards the instruments on at least two occasions. However, there is not adequate information to determine if the altimeter was read during these times.

a. Information about aircraft height not obtained. The pilot may not have seen and/or read the altimeter when at the apex of the loop. The altimeter may not have been read as a result of the scan pattern, the level of workload, the allocation of attention, distraction, or visual limitations (such as contrast and glare)9. As was

9 The scope for G forces, diffusion of responsibility, obstructions, blind spot, accommodation, or visual narrowing to influence information gathering was reviewed but considered extremely unlikely to influence pilot behaviour in this instance. G forces were discounted as the level of G force estimated at the apex of the loop was too low to have influenced visual search.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 416 Appendix M (Cont) highlighted in relation to the airspeed on entry to the loop, although the pilot may have been aware that he had not obtained height information, shortfalls in information gathering can occur without detection due to the role of expectation.

(1) Scan pattern. Video evidence indicated that the pilot was likely to have scanned the instruments at the apex of the loop. However, it cannot be positively determined if the altimeter was scanned during this time. A pilot may learn or develop a poor scan technique which would increase the likelihood that the altimeter may not be read. The AAIB’s Operations Advisor has stated that the scan pattern used in swept-wing high-speed aircraft, such as the Hunter, differs from that used in other aircraft classes, due to the increased importance of altitude. Therefore, if the pilot was trained and was more experienced on another platform which uses a different scan pattern, there may be a risk of altitude information being missed. Scan technique would be developed through training and experience and so further information on the pilot’s background may provide additional insights on this matter.

(2) Workload. As identified in relation to the decision making on entry to the loop (paragraph 13), it was possible that the pilot was experiencing a high level of workload during the display which could have increased the likelihood of altitude information being missed.

(3) Allocation of attention. Attentional resources are limited and so if a pilot’s attention is targeted at one particular area, this is likely to be at the expense of other areas. During the bent loop sequence, it is necessary for the pilot to shift attention between the external view and the cockpit instruments. Analysis of the in-cockpit video indicated that the pilot’s focus was being shifted in line with this requirement – with a primary focus on external cues and two head movements downwards while at the apex of the loop. Although the overall allocation of attention appeared to be in line with task requirements, it is not possible to determine whether the allocation of attention to the cockpit displays was adequate to enable altitude information to be gathered. The allocation of attention during the bent loop sequence could, therefore, have led altitude information to be missed.

(4) Distraction. As identified in relation to the decision making on entry to the loop (paragraph 13), it was possible that distraction led the pilot’s attention to be drawn away from the altimeter. If indications of a loss of thrust were detected during the instrument scans, these could have been a source of distraction and so a reduced likelihood of altitude information being gathered. In addition, the AAIB’s interviews with the G-BXFI pilot indicate that he expected the airspeed at the apex of the loop to be higher than that achieved during the accident sortie (100kts), such an unexpected figure on one display could have distracted the pilot from gathering information about altitude.

(5) Instrument contrast. Instrument visibility can be influenced by the visual environment in which it is being viewed (as highlighted in paragraph 13). During the pilot’s head movements towards the instrument panel, the displays were in dark shade. As a result, the pilot would have had to adjust his eyes from the bright external view to the dark instrument panel. The time taken to adjust from bright to shaded conditions can reduce visibility during this time.

Obscuration of the altimeter by the stick controller is possible, but only when the stick controller is moved to the left; such a movement of the stick controller was not required at this stage of the manoeuvre and so is considered unlikely. Diffusion of responsibility, blind spot, accommodation, and visual narrowing were discounted for the same reasons described in footnote5.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 417 Appendix M (Cont)

(6) Glare. The presence of a glare source (in this case the sun) can have a significant impact on visual effectiveness (as highlighted in paragraph 13). During the bent loop manoeuvre the position of the sun changed in relation to the pilot and, therefore, there is scope for glare to have made it more difficult to gather information from the displays.

b. Inaccurate information obtained about aircraft height. As the pilot looked towards the displays at the apex of the loop he may have looked at the altimeter. However, he may have obtained an inaccurate perception of the aircraft height, specifically, that the aircraft was higher than it actually was. Should the pilot obtain information that led him to believe the aircraft was above the minimum required height when it was not, then the subsequent action to continue with the manoeuvre would have been correctly made and implemented (albeit based on inaccurate information).

(1) Altimeter displayed the incorrect altitude. At present it is not known if the altimeter was serviceable and displaying the correct altitude during the loop. Technical analysis is on-going by AAIB which may provide further information on this point. The altimeter is the only display of height available in the cockpit and so should this information have indicated that the aircraft was above the gate height then it would have led the pilot to believe the aircraft was at a safe height to continue with the manoeuvre.

(2) Altimeter display misleading or ambiguous. The AAIB’s Operations Advisor has described an issue with altimeters of the type used in the Hunter, that when changing digits for 1000s ft, the drum may be at a position partially between the previous and next 1000ft altitude (for instance, in the process of moving between 2000ft and 3000ft). Should G-BXFI suffer with this issue, it is feasible that the altitude information presented to the pilot was ambiguous or misleading, resulting in the pilot reading the altimeter as being 1000ft higher than it was. A 1000ft difference in altitude could position the aircraft close to the minimum required height at the apex, which could lead to a perception that the aircraft was at a safe height to continue with the manoeuvre. Technical analysis is on-going by AAIB which may provide further information on this point.

(3) Altimeter was misread. It was considered whether another dial within the cockpit could have been misread as being the altimeter. However, the altimeter is unique amongst the displays in that it presents the altitude using a numeric drum (showing 1000s and 100s ft) and a single needle (for 100s ft and below). Given the different method of reading the altimeter compared to the other dials it is unlikely that the pilot had read another display as the altimeter. Digital displays are generally associated with a lower level of reading errors than moving pointer displays. However, there remain some instances of reading error in experimental studies8 and in reading aircraft altimeters of the type found in G- BFXI10. The risk of such error may have been increased at certain altitudes as the pointer can obscure the digit display when it is between the 700ft and 800ft markers. At present it has been estimated by AAIB that the aircraft reached a maximum altitude of 2700ft. Therefore, there is scope that the digit drum could have been obscured by the pointer at the apex of the loop increasing the likelihood of the altitude being misread. Accuracy of reading displays can also be influenced by workload, distraction, and expectation (paragraph 20).

10 Hemmingway, J.C. (1980). Altimeter reading and setting errors as factors in aviation safety. In NASA Aviation Safety Reporting System: Quarterly Report No. 12. NASA Technical Memorandum 81252.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 418 Appendix M (Cont) Misreading the altimeter could have led the pilot to believe that the aircraft was at a safe height to continue with the manoeuvre.

c. Information about aircraft height obtained at the wrong time. The check of the aircraft altimeter may have been mistimed so that it was undertaken either too early or too late. Such mistiming could have led to the pilot estimating the height at the apex, which would have been subjective and so at an increased risk of error than directly reading the altimeter. If the altitude was checked during the downwards head movements, then the video analysis indicated that altitude was checked at the appropriate time. While a check of height at the wrong time cannot be ruled out (as it is possible that the pilot checked the displays without moving his head) the video evidence suggests that this error is unlikely.

Selecting course of action. Had the pilot obtained accurate information about the aircraft height at the apex of the loop, the next stage of the decision making process was to use that information to select a course of action. An error may have been possible at each stage of this process which could have led to the manoeuvre being continued when at too low a height. These errors would have been made more likely by high workload and distraction (discussed in paragraph 20) which would reduce the available cognitive resources and so increase the likelihood of error. a. Recollection of gate height. The pilot may have recalled the minimum height at apex incorrectly. While the pilot stated that he used a 4000ft to 5000ft decision criterion, it is possible that this criterion was not recalled correctly during the air display. If the pilot had incorrectly recalled a gate height of 2800ft or below, it could lead the pilot to believe that it was safe to complete the manoeuvre when too low.

b. Knowledge of options if too low at apex. The pilot may have not known the option to undertake the escape manoeuvre if too low at the apex of the loop, or may have recalled another option to recover the aircraft. In interview with the AAIB, the G- BXFI pilot described a method of recovering from either low height or low airspeed, but stated that at both a low height and low airspeed (as occurred in the accident sortie) a roll out manoeuvre would not be successful. Such knowledge would have arisen through formal guidance (such as procedures and documents), training, and experience. In interview, the G-BXFI pilot stated that he had not performed unusual position recovery training in the Hunter and, while unusual position recovery had been discussed, he could not recall discussing recovery from 100kts while inverted. The pilot also commented that rolling the Hunter at 100kts was not in line with his understanding of the information in the Hunter aircrew manual. If, at the apex of the loop, the pilot believed an escape manoeuvre would not be successful then it is unlikely that the pilot would decide to take this action.

c. Decision made to continue with manoeuvre. It was possible that, despite being at a lower height than the decision gate, the pilot decided to continue with bent loop. Such a decision is considered credible if the pilot believed that it would be possible to complete the manoeuvre safely from the lower height. However, in interview with the AAIB the G-BXFI pilot stated that he believed that the aircraft needed 3000ft to successfully complete the loop. Therefore, it is not considered credible that the pilot believed he could safely complete the loop when below 3000ft.

d. Decision regarding course of action made too late. The AAIB’s Operations Advisor’s Flight Test Report has indicated that 4 seconds were available from the apex of the loop in which to implement the escape manoeuvre. 4 seconds is an adequate period of time to make rule-based decisions and implement practiced actions. However, it is too short a period of time to engage in complex decision making and

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 419 Appendix M (Cont) implement novel actions11. The G-BXFI pilot’s comments regarding his knowledge of options if too low and at low speed at the apex indicate that the selection of this escape manoeuvre could not be characterised as rule-based or practiced, resulting in a requirement for a longer decision time. Therefore, it is possible that the pilot was not able to identify a suitable course of action within the window available to do so. Such a delay to decision making could have led to the aircraft entering a flight profile from which impact with the ground was unavoidable.

Summary. Analysis has been undertaken to identify the scope for human actions and/or decisions to have contributed the loop being continued when below the pilot’s stated minimum height at the apex. It is not possible to determine which, if any, of these options took place based on the evidence available for the HF analysis, but the following accounts are considered credible and feasible: a. The altimeter may not have been seen or read at the apex of the loop as a result of scan pattern, high workload, allocation of attention, distraction (for instance, from detecting a loss of thrust during the climb or the airspeed being lower than expected), and/or visual limitations (such as contrast and glare).

b. An inaccurate perception of aircraft height may have been obtained, specifically, that the aircraft was higher than it actually was as a result of the altimeter displaying the incorrect altitude, a misleading or ambiguous display of the altimeter digit drum, the altimeter digit drum being partially obscured, and/or the altimeter being misread.

c. The minimum height required at apex may have been recalled incorrectly.

d. An escape manoeuvre may have not been selected as a result of the limited time available to select and implement the action, and the guidance and training that the pilot received with regard to rolling out of an inverted loop in the Hunter.

11 Leach, J. (2004). Why people ‘freeze’ in an emergency: temporal and cognitive constraints on survival responses. Aviation Space and Environmental Medicine, 75, 539-542.

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix M 420 Appendix M (Cont) Entry conditions

The HF analysis of the hazard sequence outlined in the previous section has identified a range of credible actions and decisions that may have contributed to the accident. The likelihood of these actions and decisions would be increased by factors present before the day of the accident. In the language of RAF CAM’s accident investigation approach (the ARM), these factors are known as “entry conditions”. The HF analysis undertaken by RAF CAM of the G-BXFI accident has focussed on specific aspects of the accident, and so has not identified the broad range of entry conditions that contributed to the accident. The main text of the report has described some potential entry conditions regarding training and experience of recovery manoeuvres, design of cockpit displays, and instrument scan pattern training. Given the important role of entry conditions in influencing behaviour on the day of an accident, the results of the RAF CAM analysis must not be considered in isolation, but rather in the context of the wider investigation and the factors prior to the day that have been identified and reported by AAIB. Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix N 421 Appendix N Mandatory Permit Directive 2011-001

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix N (Cont) Appendix N 422

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix O 423 Appendix O CAP 562 – Book 2 Civil Aircraft Airworthiness Information and Procedures Chapter 70 Leaflet 70-80 Page 1 Leaflet 70-80 Guidance Material for Ageing Engine Continuing Airworthiness 1 Introduction 1.1 This guidance material has been produced following a number of accidents over a period, involving the serious failure of high calendar time engines or their accessories. Over a prolonged calendar time engine parts risk deterioration due to corrosion and the hardening of materials such as seals, gaskets, diaphragms and flexible pipes. This leaflet has been compiled to accommodate historic engine types and their ancillary equipment which are typically without manufacturer-recommended calendar time backstops available. 1.2 The intention of this guidance is to provide continuing airworthiness recommendations for the management of engines against potential calendar time related deterioration. This is particularly relevant to certain categories of non-EASA aircraft types where the product is no longer actively supported by the engine manufacturer. If the Original Equipment Manufacturer (OEM), does not provide any recommended calendar time between overhauls, under a low utilisation operation regime, this can result in an engine remaining on wing for a protracted period before removal for workshop strip/overhaul under the TBO limit (in hours or cycles run). This guidance provides a framework of generic best practices as examples of how to allow ageing engines to continue to operate with acceptable standards of continuing airworthiness. 2 Applicability 2.1 This guidance is intended specifically for the following categories of fixed and rotary wing aircraft and engines: a) Non-EASA aircraft types with National Certificates of Airworthiness powered by gas turbine engine(s) or by radial piston engine(s) of > 400 hp; b) Ex-military aircraft with National Permits to Fly powered by gas turbine engine(s) or radial piston engine(s) of > 400hp. Complex aircraft types and their engines, however, are not covered by this guidance material. 2.2 While aimed at a specific group of high calendar time engines, owners and operators of other high time engines can consider the practices and the need for additional maintenance actions to ensure appropriate standards of continuing airworthiness are upheld. The principles laid out in this document may be useful for this purpose. 3 Engine Manufacturer’s Recommendations 3.1 Typically ageing and ex-military engines do not have calendar time recommendations between overhaul quoted in the manufacturer’s instructions for continuing airworthiness. Any limitations that have been imposed by the OEM, however, must be respected, such as whole engine and critical part hard lives, and cycle/hour times between overhaul, whichever come first. Furthermore, ancillaries must be controlled within their OEM recommended lives. Other instructions such as maintenance tasks, frequencies and inspections, as well as those for ancillary equipment should be respected. 31 October 2012 Leaflet 70-80: Guidance Material for Ageing Engine Continuing Airworthiness

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix O 424 Appendix O (Cont) CAP 562 – Book 2 Civil Aircraft Airworthiness Information and Procedures Chapter 70 Leaflet 70-80 Page 2 4 The Maintenance Organisation (MO) Environment 4.1 In the context of ex-military Permit to Fly aircraft and National Certificate of Airworthiness aircraft with large radial piston or gas turbine engines (as defined in paragraph 2, titled Applicability, above) it is expected that the aircraft will be maintained by a suitably approved organisation (such as a BCAR A8-20/A8-23 approved maintenance organisation, or appropriate equivalent). This organisation will accordingly have responsibility for the control of engine records (including storage), hazard analysis and management of scheduled tasks within the Maintenance Schedule including a regular review of the effectiveness of the programme. 5 Hazard Risk Assessment 5.1 BCAR A8-20/A8-23 appropriately approved maintenance organisations can where applicable conduct a hazard risk assessment on the continuing airworthiness aspects of the operation of engines with prolonged calendar lives since new or last overhaul to establish the levels of maintenance required. Potential areas of consideration can include but not be limited to: a) Multiple engine and system applications with adequate redundancy and safety margin; b) The safety record of the specific type, taking into account UK and worldwide events, the specific failure modes and their consequences; c) The likelihood of any safety critical failure modes such as in-flight fire, uncontained failure or propeller release; d) The consequences of the loss of thrust of a single engine; e) Any systems or measures which can realistically be used to mitigate against the consequences of a significant failure event. If a Hazard Risk Assessment (HRA) is carried out as a means of compliance against this guidance material a formal review process should be carried and a documented report compiled. 6 Alternative Means of Compliance 6.1 In the absence of OEM calendar time limitations on engine overhaul periods, Table 1 illustrates the option either to remove from service engines which have reached or exceeded 20 years of service since last recondition, overhaul or termination of last accepted storage period, or through an appropriately approved organisation (e.g. BCAR A8-20 Maintenance Organisation), construct a customised Alternative Means Of Compliance (AMOC) programme. 31 October 2012

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix O 425 Appendix O (Cont) CAP 562 – Book 2 Civil Aircraft Airworthiness Information and Procedures Chapter 70 Leaflet 70-80 Page 3

1. 2

It is possible that AMOCs could include a broad spectrum of in-service monitoring, inspection and partial disassembly actions (which may vary across different engine types) to verify that acceptable standards are being maintained, and to ensure that age-related deterioration is addressed. The basic elements and considerations of an AMOC are covered in the sections below. Figure 1 Fixed Calendar Time Overhaul and Alternative Means of Compliance Options

Applicable category aircraft/engines

20 years TSO/TSN(if never overhauled)

Overhaul Engine at 20 year intervals in the absence of OEM’s recommended calendar life ALTERNATIVELY Continuing Airworthiness Management Organisation Environment Hazard Analysis; Higher Risk engines: gas turbines & radial engines > 400hp Approved A/C Maintenance Programme including engine off-wing maintenance Data Collection and Analysis Alternative Means of Compliance e.g. Partial Engine Disassembly, Inspection, Trending Information Management Review 31 October 2012

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix O 426 Appendix O (Cont) CAP 562 – Book 2 Civil Aircraft Airworthiness Information and Procedures Chapter 70 Leaflet 70-80 Page 4 7 Maintenance Programmes/Schedules 7.1 It is considered important that the MO compiles a customised Maintenance Programme (MP) that reflects all engine on-wing and off-wing scheduled AMOC maintenance such as inspections, trend monitoring, workshop visits, and partial disassemblies where necessary. An MP should include references to the OEM’s data such as manuals, instructions, bulletins and service letters where applicable. Similarly any modification or de-modification status should be reflected. 7.2 The scheduled engine maintenance and inspection tasks that constitute the AMOC (including those required to be carried out off-wing, in a workshop) should be integrated with the higher level aircraft MP. 7.3 The elements needed for a particular programme aimed at developing an AMOC will depend upon the outcomes of the hazard assessments, data collection, analysis and review functions as outlined in Table 1 of paragraph 6.1 above. Paragraphs 8 and 9 below detail some generic items which might be considered for inclusion in any possible programme, but it is accepted that the details of each individual programme will vary depending on the results of the preparatory work and the specific issues pertinent to the type being reviewed. 8 Gas Turbine Engines – Generic or Possible AMOC Elements 8.1 Particularly relevant for gas turbine engines, where possible the following data could be considered for collection at each engine run, as permitted by the type: a) Pilot reports; b) Oil consumption rates/trend monitoring; c) Gas path performance trend monitoring d) (e.g. TGT, spool speed, etc.); e) Engine run down times; f) Vibration monitoring (if system equipment is fitted); g) Engine running times (including ground runs). 8.2 The above information should be formally recorded as relevant for each flight, and issues such as gas path parameters, vibration, and oil consumption trending plotted for evidence of datum shifts. It is quite likely that the optimum health monitoring could be carried out by flight crew at a steady state phase of engine operation. 8.3 Further maintenance tasks relevant to the AMOC may not be limited to those listed below as follows: a) Borescope inspections of gas path components; b) Hot section inspections (with or without combustor removal); c) Compressor inspections with compressor half case removal; d) Oil filter element sectioning and analysis; e) Oil analysis (i.e. SOAP); f) Fuel contamination checks; g) Magnetic Chip Detector (where fitted) findings and recorded history; h) Jet pipe inspections for corrosion, cracking (particularly of circumferential welds) and evidence of damage; i) Bleed valve check/inspection; 31 October 2012

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix O 427 Appendix O (Cont) CAP 562 – Book 2 Civil Aircraft Airworthiness Information and Procedures Chapter 70 Leaflet 70-80 Page 5 j) Module changes; k) Compressor water washes under OEM’s instructions. 8.4 Inspections should clarify which areas and how the inspection is to be carried out. For example compressor inspections should clarify whether rotating blades, static vanes and rotor path linings are inspected, and at which stages. If engine design and the manufacturer’s instructions permit, then periodic compressor inspections, with the top casing removed, allow for a more thorough inspection to be carried out. Similarly, combustor-can removal could provide a useful insight into the status of combustor and initial turbine stage conditions. Inevitably, some inspections may require the removal of the engine from the airframe. An example of possible generic AMOC inspections for consideration on gas turbine engines is provided below. *NOTE: The task frequencies given above are only intended as generic guidelines in the absence of any recommendations or specific inspections from the manufacturer. Furthermore, the intervals should not supersede reduced repeat inspection intervals that may be required to monitor any permitted deterioration within the approved limits of certain parts. Findings resulting from the above tasks should be documented in the aircraft records for future reference when carrying out periodic reviews of the effectiveness of the implemented programme. Zones Gas Turbine Engine – Inspection Type Frequency * Compressor Inlet Visual inspection (where possible) of compressor inlet for signs of FOD and corrosion. Monthly/pre-flight daily Axial Compressor Stages as far as is practical Borescope blades through IGV, vanes and rotor path linings of stages as far as possible, for corrosion, damage and deterioration. 3-12 Monthly All stages of compressor Detailed visual inspection of all compressor stages (blades, vanes and linings) with compressor top casing removed, for corrosion, damage and deterioration. 2-6 yearly Combustion chamber and burners Check for erosion, corrosion, hot spots and deterioration of all cans and burners. Also for evidence of symmetrical flame pattern, streaking and coking. 2-4 yearly HP Turbine Check HPT blades and vanes for erosion and heat damage, with combustor cans removed. 2-6 yearly LP Turbine Check LPT blades and vanes for erosion and heat damage, utilising access from the jet pipe. 3 monthly Jet Pipe Detailed visual inspection for damage or age- related deterioration. 3 monthly Jet Pipe FPI or suitable alternative NDT inspection of welded areas for signs of deterioration. 3 yearly Bleed Valves Visual inspection for corrosion. 6 monthly Oil and Fuel Filter Replacement Remove, section and analyse filter elements for evidence of contaminants – sending deposits away for analysis and plot findings where applicable. 12 monthly Spectrometric Oil Analysis Programme SOAP oil analysis. 6-12 monthly Ancillary Equipment Remove for overhaul, disassembly or bench test ancillary components (such as , pumps, fuel control units, etc.). 4-6 yearly Flexible Hoses Inspect, replace, pressure test in accordance with OEM’s recommendations. CAP 562 Book 2, Leaflet 20-50 provides some generic test details. 2-8 yearly 31 October 2012

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix O 428 Appendix O (Cont) CAP 562 – Book 2 Civil Aircraft Airworthiness Information and Procedures Chapter 70 Leaflet 70-80 Page 6 9 Large Radial Piston Engine – Generic or Possible AMOC Elements 9.1 Along similar lines to the operation of gas turbine engines, the following data should be collected following the operation of large radial engines, such as: a) Pilot reports; b) Oil consumption rates/trend monitoring; c) Engine running times (including ground runs); 9.2 Additional piston engine checks and inspections could include but not be limited to the following: a) External engine inspection including crankcase and cylinder inspections; b) Cylinder compression including differential pressure checks; c) Borescope Inspection; d) Oil and fuel analysis; e) Engine power checks; f) Checks for evidence of hydraulicing. 9.3 Tasks involving partial engine disassembly to ensure against the onset of the effects of age deterioration could include the following: a) Removal and inspection of cylinder heads; b) Removal and inspection of cylinders; c) Disassembly of pistons, gudgeon pins and connecting rods for condition inspection; d) Crankshaft inspection in-situ; e) Crankcase inspection in-situ. An example of additional generic AMOC inspections for consideration on large radial piston engines is shown below. Zones Large Radial Piston Engine - Inspection Type Frequency * Engine Externals General Visual Inspection of the cylinders and crankcase including baffles for corrosion, cracking, heat distress, leaks etc. 12 monthly Cylinder Compression Check Compression check where applicable and in accordance with manufacturer’s instructions, recording the results. 12 monthly Cylinder Valves Carry out cylinder valve clearance check for all cylinders. 12 monthly Sample Cylinder Removal Remove master cylinders (where applicable) from each bank plus other sample cylinders (alternating at each maintenance opportunity where possible) and carry out detailed visual inspection of internal cylinder bore and components such as pistons, master rod, connecting rod assys, gudgeon pin internal bores for evidence of wear and age related deterioration. 6 yearly Internal Crankcase Check internal crankcase for evidence of oil sludge and moisture. 6 yearly 31 October 2012

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix O 429 Appendix O (Cont) CAP 562 – Book 2 Civil Aircraft Airworthiness Information and Procedures Chapter 70 Leaflet 70-80 Page 7 *NOTE: The task frequencies given above are only intended as generic guidelines in the absence of any recommendations or specific inspections from the manufacturer. Furthermore, the intervals should not supersede reduced repeat inspection intervals that may be required to monitor any permitted deterioration within the approved limits of certain parts. Findings resulting from the above tasks should be documented in the aircraft records for future reference when carrying out periodic reviews of the effectiveness of the implemented programme. 10 Utilisation of Approved Maintenance Organisations 10.1 Appropriately approved maintenance organisations (e.g. BCAR A8-20/A8-23) are required to carry out all maintenance tasks (whether in the AMOC or otherwise) in accordance with the OEM’s maintenance manual instructions. 10.2 It is acknowledged that some of the tasks involved in engine continuing airworthiness may have transitioned in the AMOC package from the dedicated workshop (where these tasks were originally carried out) into the aircraft base maintenance environment. The maintenance organisation has responsibility to ensure that all staff involved in the engine maintenance activity (including the AMOC) are assessed and controlled for appropriate experience, competence and training to carry out the tasks prescribed. Whatever the task, the maintenance organisation should ensure that it has available the appropriate tooling and equipment, approved data and contamination free environment to carry out any engine maintenance operations (including those requiring partial disassembly and complex activities). Cylinder Borescope Carry out internal borescope inspection of each cylinder via spark plug hole, recording and assessing the condition of valves, piston crown, cylinder head and cylinder walls. 12 monthly Engine Oil Condition Send sample of engine oil for SOAP oil analysis Remove, inspect and clean oil sump plugs and oil screens as applicable. 12 monthly Engine Filters/ Screens Replace, section and examine fuel and oil filter elements where applicable for evidence of debris. Collect filter debris for inspection, analysis and future reference. 12 monthly Power Runs Carry out engine ground power assurance check. 12 monthly Ancillary Equipment Remove for overhaul, disassembly and bench test ancillary components (such as magnetos, carburettors, pumps, control units etc). 4-6 yearly Crankshaft/ Reduction Gear Assembly Carry out in-situ inspection of crankshaft/reduction gear assembly for signs of corrosion, cracking deterioration (e.g. along propeller attachment splines), viewing as much of the crankshaft as is accessible or possible. 3-6 yearly or at propeller removal opportunity (whichever is soonest) Flexible Hoses Inspect, replace, pressure test flexible hoses in accordance with OEM’s recommendations. CAP 562 Book 2, Leaflet 20-50 provides some generic test details. 2-8 yearly intervals Cylinder Base Nut Check Break torque check on cylinder bolts, to ensure bolts are not backing off. 3 yearly Zones Large Radial Piston Engine - Inspection Type Frequency * 31 October 2012

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix O 430 Appendix O (Cont) CAP 562 – Book 2 Civil Aircraft Airworthiness Information and Procedures Chapter 70 Leaflet 70-80 Page 8 11 Safety Critical Tasks 11.1 Whenever multi-system maintenance is carried out on aircraft systems including engines, fuel etc, the Maintenance Organisation shall establish procedures to minimise the risk of multiple errors by individual maintenance personnel during a single line or base activity (the principles of BCAR A8-23 paragraph 15.2 c) refer). 12 Engine Records 12.1 The retention of full engine records is necessary for the confidence of the continuing airworthiness programme. Therefore, the following issues should be accommodated: a) Details of last restoration or overhaul (dates etc.) activities; b) Completion of engine operation hours and cycles in log books (including for ground running); c) Strict disc, drum and shaft (i.e. critical part) life logging and controls within the framework of OEM declared lives; d) Evidence of compliance with Mandatory Permit Directives (MPDs) and Airworthiness Directives (ADs) as applicable; e) Retention of maintenance workpack details; f) Engine storage details – compliance with OEM’s instructions (refer to 13.1 below for clarification). 13 Engine Storage 13.1 Installed engines which are used only infrequently should be either run periodically or inhibited and stored in accordance with manufacturer’s instructions. Removed engines should be stored and sealed as detailed by the engine OEM’s recommendations. Maintenance organisations regularly involved in the storage and inhibiting of engines should consider establishing procedures and work sheets based on the manufacturer’s instructions, which include maintaining the engine storage status within the records. Engine log books and records should clarify the dates and extent of system inhibition/de-inhibition, providing details where relevant. 14 Periodic Review 14.1 MOs wishing to utilise the AMOC option should periodically review the effectiveness of their reliability programmes by utilising findings and feedback data as well as workshop findings/strip reports on a regular basis, as formalised under their organisation’s procedures. 15 AMOC Management 15.1 It is the responsibility of the appropriately approved Maintenance Organisation (e.g. BCAR A8-20/A8-23 or equivalent) to manage the AMOC package (under its privileges) as an alternative to a 20 year calendar life to recondition or overhaul the engine in a workshop environment, and to reflect all elements of the package within the aircraft level Maintenance Programme. 16 Mandatory Permit Directive (MPD) and Airworthiness Directive (AD) Compliance 16.1 Where the guidance information provided in this leaflet conflicts with an MPD or an AD (either already in existence or in the future) against an aircraft/engine type, the MPD/AD must still be complied with. 31 October 2012

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix P 431 Appendix P Mandatory Permit Directive 2016-002

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix P 432 Appendix P (Cont)

Appendices Air Accident Report: 1/2017 G-BXFI EW/C2015/08/04 © Crown Copyright 2017 Appendix P 433 Appendix P (Cont)

Intentionally left blank

Unless otherwise indicated, recommendations in this report are addressed to the appropriate regulatory authorities having responsibility for the matters with which the recommendation is concerned. It is for those authorities to decide what action is taken. In the United Kingdom the responsible authority is the Civil Aviation Authority, CAA House, 45-49 Kingsway, London WC2B 6TE or the European Aviation Safety Agency, Postfach 10 12 53, D-50452 Koeln, Germany.

AAIB Air Accidents Investigation Branch Aircraft Accident Report 1/2017 Report on the accident to Hawker Hunter T7, G-BXFI near Shoreham Airport on 22 August 2015

FD06617 ｜ 2017_英国_annual-safety-review-2017__AAIB_Annual_Safety_Review_2017_Hi_res.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Annual Safety Review 2017 AAIB Air Accidents Investigation Branch

Air Accidents Investigation Branch Annual Safety Review 2017 AAIB Air Accidents Investigation Branch © Crown Copyright 2018 All rights reserved. Copies of this publication may be reproduced for personal use, or for use within a company or organisation, but may not otherwise be reproduced for publication. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and it is not used in a derogatory manner or in a misleading context. Published 14 March 2018 Enquiries regarding the content of this publication should be addressed to: Air Accidents Investigation Branch Farnborough House Berkshire Copse Road Aldershot Hampshire GU11 2HH. This document is also available in electronic (pdf) format at www.aaib.gov.uk

Air Accidents Investigation Branch Annual Safety Review 2017 i AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Foreword and Contents Foreword The AAIB’s purpose is to improve aviation safety by determining the circumstances and causes of air accidents and serious incidents, and promoting action to prevent reoccurrence. I am pleased to introduce the AAIB’s 2017 Annual Safety Review which includes information on our activity and progress on the status of Safety Recommendations that were published in 2017. The AAIB received 708 occurrence notifications in 2017 and deployed 38 times to conduct field investigations, 16 of which were fatal accidents in the UK resulting in 28 deaths. A further 204 investigations were conducted by correspondence. Most of the fatal accidents involved General Aviation with the dominant causal factors again being loss of control in flight and weather-related issues. In this Review, analysis has been presented of 72 fatal accidents which occurred between 2010-2015 to highlight the most common causes and draw attention to the extensive advice that is available to help pilots avoid the circumstances that all too often lead to accidents. In 2017 the AAIB deployed to 7 accidents overseas, including to Norway, Ireland, Holland, the USA, the British Virgin Islands and the Turks and Caicos Islands, and participated in 98 other international investigations as the UK’s Accredited Representative or Expert. 2017 was notable as a year in which there were no fatal accidents involving a passenger jet airliner anywhere in the world; a very welcome statistic. However, 2 passenger airliner accidents in February 2018 unfortunately provides a reality check that such catastrophes are not a thing of the past, and a forceful reminder of the human cost of such tragedies. The need to learn from accidents is as pressing as ever. But so too is the need to learn from serious incidents (which, by definition, were nearly accidents) to establish why safety margins were compromised and promote action to address any weaknesses in the system. AAIB published 3 Special Bulletins in 2017, which each related to occurrences where the outcome was much less severe than it might have been, largely due to good fortune; two of them involved Commercial Air Transport. The AAIB is investigating these occurrences with as much rigour as if the outcome had been catastrophic to ensure the safety issues are fully understood and addressed. In March 2017, the AAIB published its Final Report on the accident involving the Hawker Hunter aircraft which crashed on to the A27 Shoreham Bypass, while performing at the Shoreham Airshow in 2015, fatally injuring 11 road users and bystanders. A further 35 Field Investigations were concluded in 2017, and an update on the responses to all 29 Safety

Air Accidents Investigation Branch Annual Safety Review 2017 ii AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Recommendations made in 2017 is provided in this Review. This Review also summarises 99 significant Safety Actions undertaken by manufacturers, operators and regulators, following close engagement with AAIB inspectors. The AAIB must continually develop its capabilities and relationships to ensure it is ready for current and future challenges. During 2017 the AAIB completed a major review of its strategy and established priority areas for development. One example is the further strengthening of the Branch’s human factors investigation capability by the recruitment of a specialist into the newly established Inspector of Air Accidents (Human Factors) discipline, and an article on this is included in this Review. Other ongoing measures include the further development of techniques for investigating accidents involving unmanned air systems, and preparing the AAIB for the advent of launches into space from the UK. In 2018 our new regulations will be laid before Parliament and we will conduct a comprehensive survey of our stakeholders to inform the further development of our working practices and our outputs. We look forward to your feedback. In the meantime, there is a lot of information in this Annual Safety Review which I trust you will find informative and useful.

Crispin Orr Chief Inspector of Air Accidents

Air Accidents Investigation Branch Annual Safety Review 2017 1 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Foreword and Contents Contents Foreword..............................................................................................................................i AAIB General Aviation Fatal Accident Review................................................................3 Human Factors in Accident Investigation.......................................................................9 CICTT Factors on Investigations by the AAIB in 2017.................................................13 Field investigations.................................................................................................. 14 Correspondence investigations............................................................................... 15 Fatal investigations.................................................................................................. 16 Statistics for 2017............................................................................................................17 Category Definition.................................................................................................. 18 Notifications 2017.................................................................................................... 19 Notifications 2016.................................................................................................... 20 Notifications 2015.................................................................................................... 21 Safety Recommendations in 2017..................................................................................23 Safety Actions from investigations reported on in 2017..............................................32 Special Bulletin........................................................................................................ 32 Field Investigations.................................................................................................. 33 Correspondence Investigations............................................................................... 41 Appendix 1 - CICITT Occurrence Categories................................................................48 Follow us on Twitter: @aaibgovuk

Air Accidents Investigation Branch Annual Safety Review 2017 2 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Boeing 737-4Q8, OE-IAG Belfast International (Aldergrove) Airport 4 October 2016

Air Accidents Investigation Branch Annual Safety Review 2017 3 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB General Aviation Fatal Accident Review AAIB General Aviation Fatal Accident Review Introduction / Overview The AAIB has conducted a review of fatal General Aviation (GA) accident reports it published between 2010 and 2015, inclusive. The total number of accidents was 72, resulting in 105 fatalities. Of these accidents, 63 involved fixed wing aircraft and 9 rotary wing. Almost half the accidents were attributed to loss of control in flight. This article is intended to provide pilots with a summary of the most common causes of GA fatal accidents in the UK, so that lessons may be learnt and actions taken to prevent similar accidents in the future. Summary of events Figure 1 shows a breakdown of the dominant causal factors in these accidents:   46% 16% 16% 14% 8% Dominant causal factors Loss of control in flight Weather related Other Struck object during takeoff / landing Mid‐air collision Figure 1 Analysis and commentary Loss of Control The predominant causal factor was loss of control in flight, which accounted for almost half of the accidents. Of these, most involved the aircraft entering an inadvertent stall and/or spin following engine failure, or during aerobatics. The UK CAA has published a Handling Sense Leaflet to increase stall/spin awareness: http://publicapps.caa.co.uk/docs/33/ga_srg_09webHSL02.pdf

Air Accidents Investigation Branch Annual Safety Review 2017 4 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB General Aviation Fatal Accident Review Where the accident involved a complete or partial engine failure, the loss of control was often associated with inadequate airspeed, particularly whilst manoeuvring at low level (Figure 2). Figure 2 Cessna 150F, G-ATKF Hinton-in-the-Hedges Airfield, Northamptonshire 4 September 2015 Pilots are taught in the PPL syllabus how to handle a complete engine failure, but the more insidious partial engine failure is not normally covered during training. Recognising this, the Australian Transport Safety Bureau has published a safety leaflet on managing partial power loss after takeoff in single engine aircraft: http://www.atsb.gov.au/publications/2010/avoidable-3-ar-2010-055/ Common features of the aerobatic accidents were a lack of pilot training and experience in aerobatics and insufficient height to recover when the planned manoeuvre was unsuccessful. The CAA has published a Safety Sense Leaflet that contains pertinent information to consider before engaging in aerobatics: http://publicapps.caa.co.uk/docs/33/20130121SSL19.pdf Weather A significant number of the accidents reviewed in this study were weather-related. Common themes were: collision with terrain due to flying below the minimum safe altitude (MSA) in IMC (Figure 3) and flying in IMC without the appropriate training and qualifications. Whilst new technology has undoubtedly made the tasks of flight planning and navigation easier, poor weather remains a constant threat to GA pilots and should not be underestimated. Research AR-2010-055 Avoidable Accidents No. 3 Managing partial power loss after takeoff in single-engine aircraft

Air Accidents Investigation Branch Annual Safety Review 2017 5 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB General Aviation Fatal Accident Review Figure 3 Piper PA-28-140 Cherokee, G-BHXK Near Loch Etive, Oban, Argyll and Bute 4 April 2015 The ATSB has published a safety leaflet on Visual Flight Rules pilots who enter Instrument Meteorological Conditions: http://www.atsb.gov.au/publications/2011/avoidable-4-ar-2011-050/ Collision with objects during takeoff or landing The majority of accidents in this category involved collision with power cables or trees, often at unlicensed airfields. Operating to such airfields can be more challenging and the CAA has published a Safety Sense Leaflet to highlight appropriate considerations when operating from an unlicensed or private airstrip: http://publicapps.caa.co.uk/docs/33/20130121SSL12.pdf Research AR-2011-050 Avoidable Accidents No. 4 Accidents involving pilots in Instrument Meteorological Conditions

Air Accidents Investigation Branch Annual Safety Review 2017 6 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB General Aviation Fatal Accident Review Mid-air collisions Of the six accidents in this category, three occurred whilst in the circuit and the others in uncontrolled airspace. The CAA has published a safety poster that aims to remind pilots of the standard overhead join by means of a simple pictorial representation: http://publicapps.caa.co.uk/docs/33/ga_srgwebStandardOverheadJoinPosterJan09.pdf The CAA has also published a Safety Sense Leaflet providing an overview of the principles of see-and-avoid and highlighting the importance of maintaining an effective visual scan: http://publicapps.caa.co.uk/docs/33/20130121SSL13.pdf Other In this category no specific trend was identified which could help prevent future accidents. Other resources In addition to the links already provided, further safety information is available from the following sources: Refresher or further training with an instructor Flying skills are perishable. Flying instructors can provide knowledge on specific safety issues and valuable training to help pilots improve their skills. CAA Publications CAA safety information for recreational flying can be found at the following link: https://www.caa.co.uk/General-aviation/Safety-information/Safety-information/ CAA Handling and Safety Sense Leaflets cover a wide range of topics summarising key safety points and techniques relevant to GA pilots. Leaflets are available to download here: http://publicapps.caa.co.uk/modalapplication.aspx?appid=11&mode=list&type=sercat&id=21 The CAA ‘Skyway Code’ provides private pilots with practical guidance on operational, safety and regulatory issues related to their flying: https://www.caa.co.uk/General-aviation/Safety-information/The-Skyway-Code/

Air Accidents Investigation Branch Annual Safety Review 2017 7 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB General Aviation Fatal Accident Review General Aviation Safety Council (GASCo) Safety Evenings These are designed to provide an opportunity for pilots to reflect on GA safety as it affects them and the people they fly with.  The aim is to facilitate an exchange of views on how to improve flight safety by sharing information, thoughts and ideas. The title of GASCo’s current presentation is ‘Aware Today, Alive Tomorrow’. It addresses maintaining situational awareness and the use of threat and error management to prevent loss of control accidents, mid-air collisions and airspace infringements. GASCo website : http://www.gasco.org.uk/ Safety evenings : http://www.gasco.org.uk/safety-evenings.aspx Sud-Aviation SE-313B Alouette II, HA-PPC Breighton Aerodrome, Yorkshire 17 July 2016

Air Accidents Investigation Branch Annual Safety Review 2017 8 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Boeing 737-476(SF), EI-STD East Midlands Airport 29 April 2014

Air Accidents Investigation Branch Annual Safety Review 2017 9 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Human Factors in Accident Investigation Human Factors in Accident Investigation Introduction As air accident investigators our job can often be as much about trying to understand the human contribution to an accident or incident, as it is about trying to understand the technical contribution. It can be a common misconception to think that the human involvement lies only with those most recently involved in the moments leading up to an accident, for example the pilot who happens to be at the controls at the time of the accident, the air traffic controller who issued the last clearance or the engineer or who last worked on the aircraft. However, people in operational roles often inherit decisions, policies and procedures that may have been made or implemented many years before. And they may have to carry out complex tasks involving competing priorities and variable threats in a constantly changing work environment. It is important therefore that an accident or incident investigation explores all of the aspects which have the potential to influence how an individual executes a task on any given day. Human factors v human error Human error, in isolation, is not an acceptable conclusion for accident investigation. Instead, identifying the presence of human error, or human performance that was not as expected, should be the starting point for an investigation. As investigators we need to look at all the human interactions and organisational influences that may have contributed to an accident, whether those be in the immediate lead-up to an accident or further back in time. When examining these issues we have the gift of hindsight, which is not something those involved at the time of an accident possess. It is therefore vital that rather than looking back in time, scrutinising someone’s actions and trying to understand them based on what we now know, we instead need to put ourselves in their shoes and understand how the situation unfolded in their eyes - what information did they have available to them at the time, what threats were they managing, how had they been trained, what condition was the equipment in? Only in this way can we attempt to work out why an individual’s thoughts, actions and behaviours may have made perfect sense to them at the time. It is only when we gain proper insight into these issues that we can identify the areas that will deliver the most meaningful safety improvements. What is ‘normal’? We must also strive to understand what ‘normal’ looks like. People may routinely employ work-arounds and adaptations to facilitate the smooth running of an operation, however if we only consider these in the context of the circumstances of an accident we might fail to appreciate how such actions form a normal part of the operation and routinely deliver Annual Safety Review 2017 AAIB Air Accidents Investigation Branch Slingsby T67M Mk II Firefly, G-BNSO Whitwell-on-the-Hill, North Yorkshire 30 April 2016

Air Accidents Investigation Branch Annual Safety Review 2017 10 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Human Factors in Accident Invesigation a safe outcome. Understanding how such tasks are normally executed by the individuals involved, and by other individuals, can provide relevant context to the investigation. And of course, it is also equally important to understand what went right as well as what went wrong, for example, what safety features worked as intended or what human interventions prevented the outcome from being even worse. Historically Historically the AAIB has often relied on external human factors expertise to support its investigations on a case-by-case basis. However, in recent years the AAIB has been taking steps to enhance its capability in the field of investigating human factors and human performance, including the establishment of an internal human factors working group in 2013. Included in the working group’s activities were a review of how other safety investigation agencies are resourced to investigate human performance aspects, identification of suitable human factors training provision for AAIB inspectors and creation of a database of external HF expertise in specialist areas. Inspectors come to the AAIB with a wide range of aviation industry experience, and this includes some with a wealth of human factors knowledge and others with less knowledge in this area. The training identified by the working group has served to update and refresh inspectors’ knowledge on the investigation of human factors and human performance issues, as well as bringing the inspectorate to a common baseline on current thinking in this field. By March 2017 all AAIB inspectors had undertaken this training and it is a mandatory requirement for all new joiners. Human factors today In late 2017 the AAIB embarked upon a campaign to recruit its first dedicated in-house human factors specialist. This involved the creation of a new investigation discipline within the AAIB, adding to the established disciplines of operations, engineering and flight data recording. The new Inspector of Air Accidents (Human Factors) will take up post in April 2018 and the AAIB is looking forward to integrating this new capability into our existing investigation activities and to the new opportunities that this will bring. There will still of course be a need for assistance from external specialist human factors expertise from time to time to support AAIB investigations – the field of human factors is vast and it would be impossible for any human factors practitioner to be expert in all of the many different facets of human factors. The AAIB will therefore continue to seek external expertise as appropriate under the direction of the Human Factors Inspector. Accident Investigation Branch collaboration In addition, over the last few years the AAIB has been working closely with colleagues from the Rail and Marine Accident Investigation Branches (RAIB and MAIB) via a tri-Branch human factors working group. While technology, procedures and operating environment can differ greatly between the transport modes, the fundamentals of human performance Operator Manual

Air Accidents Investigation Branch Annual Safety Review 2017 11 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Human Factors in Accident Investigation in a complex or safety-critical operational environment remain the same. The cross-branch working group therefore strives to exchange experiences, learning and expertise relevant to the investigation of human factors and human performance aspects, consider ways in which human factors capability can be developed across and within the three Branches and to explore ways of developing the competence of inspectors to investigate human factors aspects. The RAIB has recruited an Investigation Support Officer who will carry out human factors research in support of investigations across the three Branches. Conclusion Truly getting to grips with the human performance and organisational aspects of an air accident is an integral part of the AAIB’s role and the AAIB has been taking steps to enhance its capability in these areas over recent years. Recruitment of a dedicated Inspector of Air Accidents (Human Factors) is an important and defining step on this journey, and we look forward to reporting further on our progress in this field in future Annual Reports, as we continue to shape and develop this evolving capability. AAIB Air Accidents Investigation Branch

Air Accidents Investigation Branch Annual Safety Review 2017 12 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk SZD-24-4A Foka 4, G-DBZZ Bicester Airfield, Oxfordshire 8 August 2010

Air Accidents Investigation Branch Annual Safety Review 2017 13 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2017 CICTT Factors on Investigations by the AAIB in 2017 Every occurrence in the UK is recorded on the European Central Repository (ECCAIRS) and is coded using the occurrence taxonomy defined by the CAST/ICAO Common Taxonomy Team (CICTT). This is a worldwide standard taxonomy to permit analysis of data in support of safety initiatives. In the UK the coding of occurrences is carried out by the CAA. It should be noted that they are recorded as multiple factors, for example turbulence (TURB) leading to loss of control in flight (LOC-I). Similarly, other (OTHER) is also used and may include maintenance manual errors or human factors, aspects that do not have specific classifications. Factors for all investigations reported on by AAIB in 2017 OTHR ARC SCF-NP LOC-I LOC-G SCF-PP RE CTOL GCOL TURB F-NI CFIT ICE UNK ADRM FUEL F-POST WSTR... NAV MED MAC RAMP L... A... BI... See Appendix 1 for category descriptions 91 67 55 50 38 35 31 18 11 11

Air Accidents Investigation Branch Annual Safety Review 2017 14 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2017 Field investigations Factors for field investigations reported on by AAIB in 2017 In 2017 the AAIB reported on 38 field investigations, 16 of which were fatal accidents in the UK and 22 were non-fatal accidents or serious incidents. The analysis of the CICTT factors for each of these reveal that the overall major factor in fatal accidents reported on in 2017 was LOC-I. The 22 non-fatal field investigations that were reported on in 2017 were mostly on serious incidents to commercial air transport (CAT) aircraft. The majority of CAT serious incidents were attributed to other followed by system/component failure or malfunction non powerplant (SCF-NP). However, in general aviation (GA) private flying, the statistics show the most prolific cause of accidents and serious incidents was again LOC-I. OTHR ARC SCF-NP LOC-I LOC-G SCF-PP RE CTOL TURB F-NI CFIT ICE UNK F-POST MED MAC See Appendix 1 for category descriptions 14 11 10 4 3 3 2 2 2 2 2

Air Accidents Investigation Branch Annual Safety Review 2017 15 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2017 Correspondence investigations Factors for correspondence investigations reported on by AAIB in 2017 Correspondence investigations are usually conducted on non-fatal accidents on GA aircraft and to some serious incidents on CAT aircraft. The factors most predominant in these occurrences were classified as other followed by abnormal contact with the ground (ARC). OTHR ARC SCF-NP LOC-I LOC-G SCF-PP RE CTOL GCOL TURB F-NI CFIT ICE UNK ADRM FUEL F-... WSTRW NAV M... MAC RAMP LA... AM... BIRD See Appendix 1 for category descriptions 80 65 45 37 36 31 30 16 11 9

Air Accidents Investigation Branch Annual Safety Review 2017 16 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2017 Fatal investigations Factors for fatal investigations reported on by AAIB in 2017

The predominant cause of fatal accidents in general aviation, in common with previous years, was loss of control in flight (LOC-I). The article at the beginning of this Annual Safety Review explores the reasons behind this in more detail.

OTHR ARC SCF-NP LOC-I SCF-PP RE CTOL CFIT ICE F-POST MED MAC See Appendix 1 for category descriptions 9 4 3 2 2 1 1 1 1 1 1 1

Air Accidents Investigation Branch Annual Safety Review 2017 AAIB Air Accidents Investigation Branch 17 © Crown copyright 2016 www.aaib.gov.uk @aaibgovuk Aircraft Accident Reporting - Telephone number +44 (0)1252 512299 Statistics for 2017 An overview of what we were involved with during 2017 can be seen below: UK Registered Overseas 44 Average months to publication for a Field Investigation 8.9 2.3 Average months to publication for a Correspondence Investigation Number of Safety Studies published 0 Number of Correspondence Investigation Reports published 220 Correspondence (AARF) Investigations opened 204 Number of Safety Recommendations 29 Referred to Sporting Associations 52 Joint Military & Civil Aircraft 0 Number of Field Reports published 35 Overseas (no AAIB involvement) 9 Military (AAIB assistance) 1 Military (no AAIB involvement) 1 UK Fatal Accidents 16 Number of Deaths 28 Foreign Registered Overseas 61 Number of Formal Reports published 1 No further AAIB action (Civil) 298 Number of Special Bulletins published 3 UK Field Investigations opened 38 17.4 Average months to publication for a Formal Investigation Total Number of Notifications received by the AAIB 708 Number of Safety Actions noted 99 Investigation Statistics

Air Accidents Investigation Branch Annual Safety Review 2017 18 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Introduction The following pages provide the statistics for 2017, 2016 and 2015, for accidents and serious incidents involving the Air Accidents Investigation Branch. An explanation of the categories is as follows: Category Definition UK Aircraft overseas Investigations involving UK registered aircraft, or aircraft registered in one of the UK Overseas Territories or Crown Dependencies, occurring in a Foreign State where the AAIB has participated in the capacity as the Accredited Representative in accordance with ICAO Annex 13. Foreign Aircraft overseas Accidents and serious incident investigations to Foreign registered aircraft occurring in a Foreign State where the AAIB has participated in the capacity as the Accredited Representative or Expert in accordance with ICAO Annex 13. UK Field Investigations Investigations involving the deployment of a ‘Field’ team within the UK or to one of the UK Overseas Territories or Crown Dependencies and those investigations where a team has not deployed but Safety Recommendations are made. Also includes investigations which have been delegated to the AAIB by another State. Military with AAIB Assistance Where an MoD Service Inquiry is convened following an accident / serious incident to a Military aircraft and an AAIB Inspector is appointed to assist. AARF Investigations Investigations conducted by correspondence only using an Aircraft Accident Report Form (AARF) completed by the aircraft commander. Overseas (no AAIB) Notifications to the AAIB of an overseas event which has no AAIB involvement. Referrals to Sporting Investigations referred to the relevant UK Sporting Associations. Associations No further AAIB action (Civil) Occurrences notified to the AAIB involving civil registered aircraft which do not satisfy the criteria of an accident or serious incident in accordance with the Regulations. Military (no AAIB inv) Notifications to the AAIB concerning Military aircraft with no AAIB involvement.

Air Accidents Investigation Branch Annual Safety Review 2017 19 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics UK Registered Overseas 6% Foreign Reg Overseas 9% UK Field Investigation 6% Military (AAIB assist) 0% Correspondence Investigation   (AARF) 29% Overseas (no AAIB involvement) 1% Referred to the appropriate Aviation  Sporting Association 7% Non‐reportable (Civil) 42% Non‐reportable (Military) 0% Notifications 2017 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 5 4 3 4 5 4 6 2 5 4 2 0 44 Foreign Reg Overseas 3 3 4 9 6 7 8 4 5 2 3 7 61 UK Field Investigations 2 3 4 2 6 3 2 4 5 1 2 4 38 Military (AAIB Assistance) 0 0 0 0 0 1 0 0 0 0 0 0 1 Correspondence Investigations (AARF) 9 7 15 15 36 29 24 25 17 11 10 6 204 Overseas (no AAIB involvement) 2 1 0 1 0 0 1 1 1 1 0 1 9 Referred to the appropriate Aviation Sporting Association 4 2 1 5 9 9 4 9 3 2 2 2 52 No further AAIB action (civil) 15 19 24 22 22 29 33 27 32 34 18 23 298 Military (no AAIB involvement) 0 1 0 0 0 0 0 0 0 0 0 0 1 Total 40 40 51 58 84 82 78 72 69 55 37 43 708 UK Fatal accidents 1 0 1 1 3 2 1 1 3 0 1 2 16 Number of deaths 1 0 5 1 4 2 2 2 4 0 4 3 28

Air Accidents Investigation Branch Annual Safety Review 2017 20 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Notifications 2016 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 5 3 5 6 6 4 6 4 2 4 3 2 50 Foreign Reg Overseas 1 5 4 7 4 9 3 5 18 8 6 4 74 UK Field Investigations 3 2 2 2 1 3 8 3 3 4 2 5 38 Military (AAIB Assistance) 0 0 0 0 0 0 0 1 0 0 0 0 1 Correspondence Investigations (AARF) 9 15 10 16 19 25 27 31 22 16 8 10 208 Overseas (no AAIB involvement) 1 2 1 1 0 0 0 0 0 2 0 0 7 Referred to the appropriate Aviation Sporting Association 1 2 3 4 4 3 5 9 8 4 0 1 44 No further AAIB action (civil) 18 12 19 20 22 27 29 23 21 11 15 14 231 Military (no AAIB involvement) 0 0 0 1 0 0 0 1 0 0 0 1 3 Total 38 41 44 57 56 71 78 77 74 49 34 37 656 UK Fatal accidents 0 0 1 1 1 1 4 1 1 2 0 2 14 Number of deaths 0 0 1 2 2 2 4 1 2 2 0 2 18 UK Registered Overseas 8% Foreign Reg Overseas 11% UK Field Investigation 6% Military (AAIB assist) 0% Correspondence Investigation   (AARF) 32% Overseas (no AAIB involvement) 1% Referred to the appropriate Aviation  Sporting Association 7% Non‐reportable (Civil) 35% Non‐reportable (Military) 0%

Air Accidents Investigation Branch Annual Safety Review 2017 21 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Notifications 2015 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 4 1 0 1 6 4 10 4 4 1 1 3 39 Foreign Reg Overseas 5 2 4 3 5 4 8 6 4 3 4 3 51 UK Field Investigations 3 1 1 5 1 5 5 4 2 3 3 1 32 Military (AAIB Assistance) 1 0 0 0 0 0 0 0 0 1 0 0 2 Correspondence Investigations (AARF) 11 7 12 24 16 29 24 20 27 12 7 5 194 Overseas (no AAIB involvement) 1 3 0 0 1 0 0 1 1 1 0 0 8 Referred to the appropriate Aviation Sporting Association 0 5 2 1 7 3 11 11 8 2 0 0 50 No further AAIB action (civil) 24 15 15 24 15 13 21 15 26 16 17 13 214 Military (no AAIB involvement) 0 0 1 0 0 2 0 0 1 2 0 0 6 Total 49 34 35 58 51 58 79 61 73 41 32 25 596 UK Fatal accidents 1 0 0 3 1 3 2 3 1 2 1 1 18 Number of deaths 2 0 0 4 2 3 6 13 1 3 4 1 39 UK Registered Overseas 7% Foreign Reg Overseas 9% UK Field Investigation 5% Military (AAIB assist) 0% Correspondence Investigation   (AARF) 33% Overseas (no AAIB  involvement) 1% Referred to the appropriate  Aviation Sporting Association 8% Non‐reportable (Civil) 36% Non‐reportable (Military) 1%

Air Accidents Investigation Branch Annual Safety Review 2017 22 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Inspector at accident site of Boeing 737-500, VQ-BBN Kazan International Airport, Kazan, Russia 17 November 2013

Air Accidents Investigation Branch Annual Safety Review 2017 23 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendations in 2017 In 2017 the AAIB issued 29 Safety Recommendations from 8 investigations. 13 17 26 32 28 32 9 10 26 38 40 19 20 17 39 82 39 76 68 114 76 58 37 82 69 66 58 57 95 55 139 109 150 146 128 98 109 95 103 39 23 42 47 57 29 0 20 40 60 80 100 120 140 160 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 Each Safety Recommendation is classified using the SR Topic taxonomy defined by the European Network of Safety Investigation Authorities (ENCASIA) Working Group 6 (WG6) which the AAIB is a member. The majority of the Safety Recommendations were dealing with safety issues relating to aircraft operations and safety risk management. Each addressee to a Safety Recommendation has to respond within 90 days in accordance with European Regulation EU 996/2010 Article 18 and detail what actions have been taken or are under consideration and the time taken for their completion. If no actions are being considered by the addressee they have to provide their reasoning for the decision. On receipt the AAIB has 60 days in which to assess the response and to inform the addressee on whether it is adequate. If the reply is not adequate or partially adequate then to provide justification to the addressee. The responsibility to monitor the progress of action taken in response to a recommendation lies with the addressee including the authorities responsible for civil aviation safety. The AAIB will keep open Safety Recommendations where it expects to receive responses from the addressee. If no further response is expected the recommendation is closed. A closed status does not necessarily mean the actions for a Safety Recommendation are complete, nor that the Safety Issue has been addressed.

Air Accidents Investigation Branch Annual Safety Review 2017 24 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview The chart above shows the recommendation topics. It should be noted that a recommendation can encompass several topics within the classification system. A ‘Not adequate’ assessment means that the response does not address the intent of the Safety Recommendation nor does it address the safety issue concerned. A ‘Partially adequate’ assessment means the response goes someway to meeting the intent of the Safety Recommendation and the action will address the safety issue to a certain extent, but further action would be required to fully address the issue identified. An ‘Adequate’ assessment means that the response fully meets the intent of the Safety Recommendation and the action is expected to address the safety issue. Of the 29 Safety Recommendations issued in 2017, as of the end of February 2018, responses have been received for 21. In assessing the responses, 15 were adequate and closed, 5 were partially adequate and 1 was not adequate. Following the assessment, 16 Safety Recommendations from 2017 were closed, 11 remain open. The AAIB is awaiting responses from addressees for 5 of the open Safety Recommendations. Responses have recently been received for two Recommendations and are pending AAIB classification. Each Safety Recommendation is also defined as to whether it is a Safety Recommendation of European Union Wide Relevance (SRUR) or a Safety Recommendation of Global Concern (SRGC). Of those issued in 2017, 6 were SRUR and 3 were SRGC. The AAIB, as well as all EU Member States, is required to record on the European Central Repository Safety Recommendation Information System (SRIS) all recommendations it raises and the response that are received. Data from SRIS is available to view publically at: http://eccairsportal.jrc.ec.europa.eu/index.php?id=114&no_cache=1 Safety Recommendation Topics 22 7 6 4 3 3 3 3 3 2 2 1 1 1 1 1 1 1 1 Procedures / Regulations - Aircraft operations Personnel - Training / proficiency / check Aircraft / Equipment / Facilities - Aircraft equipment - Aircraft systems QMS/SMS/SSP - Safety assurance Aircraft / Equipment / Facilities - Aircraft equipment - Powerplant Aircraft / Equipment / Facilities - Aircraft equipment - Safety equipment Personnel - Medical / Human Factors QMS/SMS/SSP - Safety risk management Procedures / Regulations - Aircraft maintenance/inspection QMS/SMS/SSP - Safety policy and objectives Procedures / Regulations - Oversight/Auditing Personnel - Other Procedures / Regulations - Aircraft dispatch Aircraft / Equipment / Facilities - Aircraft equipment Procedures / Regulations - Aircraft certification Procedures / Regulations - Design/Production/Manufacturing Procedures / Regulations - Rescue Fire Fighting Services Procedures / Regulations - Search and Rescue QMS/SMS/SSP - Safety promotion 0 5 10 15 20 25

Air Accidents Investigation Branch Annual Safety Review 2017 25 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendations issued in 2017

Notes: Safety Recommendation classification correct at time of publication. Safety Recommendations can also be made through AAIB Special Bulletins and are then also reflected in the final report. Reflects the situation with Safety Recommendatations at 28 February 2018. Safety Recommendation 2017-001 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority amend CAP 403 to clarify the point at which an aerobatic manoeuvre is considered to have been entered and the minimum height at which any part of it may be flown. Adequate - Closed Safety Recommendation 2017-002 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority require pilots intending to conduct aerobatics at flying displays to be trained in performing relevant escape manoeuvres and require that their knowledge and ability to perform such manoeuvres should be assessed as part of the display authorisation process. Adequate - Closed Safety Recommendation 2017-003 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority review the grouping of aircraft types in display authorisations to account for handling and performance differences it considers significant. Adequate - Closed Safety Recommendation 2017-004 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority remind operators, whose activities are subject to the guidance published in Civil Aviation Publication 632, of the need to maintain detailed training records for pilots and check their compliance during inspections it carries out. Adequate - Closed

Air Accidents Investigation Branch Annual Safety Review 2017 26 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Recommendation 2017-005 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority specify that the flight demonstration requirement of a display authorisation evaluation, other than to assess formation following, cannot be satisfied by the pilot following another aircraft during the evaluation. Adequate - Closed Safety Recommendation 2017-006 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority undertake a study of error paths that lead to flying display accidents and integrate its findings into the human factors training it requires the holders of display authorisations to undertake. Response Received - pending AAIB classification Safety Recommendation 2017-007 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority review the arrangements for safety regulation and oversight of intermediate and complex ex-military aircraft operated in accordance with Civil Aviation Publication 632, to ensure that they are consistent and appropriate. Partially Adequate - Open Safety Recommendation 2017-008 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority consider implementing the changes outlined in Health and Safety Laboratory report MSU/2016/13 ‘Review of the risk assessment sections of CAP 403’. Adequate - Closed Safety Recommendation 2017-009 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority require operators of aircraft used for flying displays to identify, and where practicable remove, any hazardous materials. Adequate - Closed

Air Accidents Investigation Branch Annual Safety Review 2017 27 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendation 2017-010 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority prohibit the use of phenolic asbestos drop tanks on civil registered aircraft. Partially Adequate - Open Safety Recommendation 2017-011 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Department for Transport commission, and report the findings of, an independent review of the governance of flying display activity in the United Kingdom, to determine the form of governance that will achieve the level of safety it requires. Partially Adequate - Open Safety Recommendation 2017-012 made on 2 June 2017 G-KAXT Westland Wasp HAS1 on 23 September 2016 It is recommended that, for ex-military aircraft on the UK civil register, the Civil Aviation Authority requires maintenance and overhaul tasks to be reviewed in the light of the expected aircraft utilisation and calendar-based time limits introduced where appropriate. Where such calendar-based time limits already exist, these should be reviewed to ensure that they are appropriate for the aircraft utilisation. Adequate - Closed Safety Recommendation 2017-013 made on 7 September 2017 G-BDZC Reims Cessna F150M on 17 October 2016 It is recommended that the Civil Aviation Authority promulgates to flying instructors the need for specific training to highlight the differences between the C150 and C152 flap switch designs. Training should also include the effect on aircraft performance and handling of Flap 40°. Adequate - Closed Flap selector switch

Air Accidents Investigation Branch Annual Safety Review 2017 28 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Recommendation 2017-014 made on 8 September 2017 G-PRPC DHC-8-402 on 14 December 2016 It is recommended that Flybe Ltd introduces defined and consistently delivered flight crew training on pre‑departure inspections for the DHC-8-402 (Q400), compliant with the inspection procedure documented in its Operations Manual. This should include a practical element on the aircraft and a demonstration of correctly secured main engine access panels. Adequate - Closed Safety Recommendation 2017-015 made on 8 September 2017 G-PRPC DHC-8-402 on 14 December 2016 It is recommended that Flybe Ltd considers introducing a means of disseminating pertinent safety information to ground operations staff in an appropriate format. Adequate - Closed Safety Recommendation 2017-016 made on 20 September 2017 C-FWGH Boeing 737-86J on 21 July 2017 It is recommended that the Federal Aviation Administration, mandate the use of Flight Management Computer software revision U12.0, or later revision incorporating the outside air temperature crosscheck, for operators of Boeing 737 Next Generation aircraft. Partially Adequate - Open Safety Recommendation 2017-017 made on 20 September 2017 C-FWGH Boeing 737-86J on 21 July 2017 It is recommended that The Boeing Company promulgates to all 737 operators the information contained within this Special Bulletin and reminds them of previous similar occurrences reported in the Boeing 737 Flight Crew Operations Manual Bulletin dated December 2014. Response Received - pending AAIB classification

Air Accidents Investigation Branch Annual Safety Review 2017 29 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendation 2017-018 made on 25 September 2017 G-GSGS Glasflugel 304 ES on 10 August 2017 It is recommended that the European Aviation Safety Agency (EASA) requires that all powered sailplanes, operating under either an EASA Restricted Type Certificate, or an EASA Permit to Fly, and fitted with a Front Electric Sustainer (FES) system, are equipped with a warning system to alert the pilot to the presence of a fire or other hazardous condition in the FES battery compartment. Adequate - Closed Safety Recommendation 2017-019 made on 25 September 2017 G-GSGS Glasflugel 304 ES on 10 August 2017 It is recommended that Alisport Srl modifies the Silent 2 Electro microlight to incorporate a warning system to alert the pilot to the presence of a fire or other hazardous condition in the Front Electric Sustainer (FES) battery compartment. Adequate - Closed Safety Recommendation 2017-020 made on 25 September 2017 G-GSGS Glasflugel 304 ES on 10 August 2017 It is recommended that Albastar d.o.o. modifies the AS13.5m Front Electric Sustainer (FES) microlight to incorporate a warning system to alert the pilot to the presence of a fire or other hazardous condition in the FES battery compartment. Partially Adequate - Open Safety Recommendation 2017-021 made on 9 November 2017 G-YAKB YAK-52 on 8 July 2016 The Civil Aviation Authority should review the maintenance requirements for seat belts and harnesses, and, if necessary, revise the maintenance requirements to ensure that seat belts and harnesses remain in a condition with an acceptable residual strength. Adequate - Closed

Air Accidents Investigation Branch Annual Safety Review 2017 30 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Recommendation 2017-022 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the Federal Aviation Administration mandate Service Bulletin GTCP331-49-7936 to add a system that shuts down the APU automatically if there is contamination of the lubricating oil. Response Awaited – Open Safety Recommendation 2017-023 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the European Aviation Safety Agency mandate Service Bulletin GTCP331-49-7936 to add a system that shuts down the APU automatically if there is contamination of the lubricating oil. Not Adequate - Open Safety Recommendation 2017-024 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the Federal Aviation Administration regulate the operation of interphone handsets, including during emergency communications, so that it is standardised irrespective of aircraft type. Response Awaited - Open Safety Recommendation 2017-025 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the European Aviation Safety Agency regulate the operation of interphone handsets, including during emergency communications, so that it is standardised irrespective of aircraft type. Partially Adequate - Closed Safety Recommendation 2017-026 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the Federal Aviation Administration reconsider the requirements for briefings given to passengers seated at exits, to ensure they offer appropriate guidance on exiting the aircraft rapidly in an emergency without implying undue responsibility for opening the exits. Response Awaited - Open

Air Accidents Investigation Branch Annual Safety Review 2017 31 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendation 2017-027 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the Federal Aviation Administration require cabin crew on aircraft that are parked, and with passengers on-board who are neither boarding nor deplaning, to be evenly distributed throughout the cabin and in the vicinity of floor-level exits in order to provide the most effective assistance in the event of an emergency. Response Awaited - Open Safety Recommendation 2017-028 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the European Aviation Safety Agency require cabin crew on aircraft that are parked and with passengers on-board to be evenly distributed throughout the cabin and in the vicinity of floor-level exits, in order to provide the most effective assistance in the event of an emergency. Adequate - Closed Safety Recommendation 2017-029 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the Federal Aviation Administration require that flight and cabin crew participate in joint training to enhance their co-ordination when dealing with emergencies. Response Awaited - Open

Air Accidents Investigation Branch Annual Safety Review 2017 32 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Actions from investigations reported on in 2017 Early in an investigation the AAIB will engage with authorities and organisations which are directly involved and have the ability to act upon any identified safety issues. The intention is to prevent recurrence and to that end to encourage proactive action whilst the investigation is ongoing and not for those involved to wait for the issue of official Safety Recommendations. When safety action is taken, it may mean there is no need to raise a Safety Recommendation as the safety issue may have been addressed. However, if the issue remains then a Safety Recommendation will be raised. The published report details the safety issues and the safety action that has taken place, usually with a green highlight. In 2017 safety actions directly as a result of AAIB investigations were recorded on two formal investigations, eighteen field investigations and seventeen correspondence investigations. SPECIAL BULLETIN Sikorsky S-92A, G-WNSR on 28 December 2016 Safety issue – HUMS procedures, component failure, airworthiness The operator The operator has subsequently introduced a number of measures to further strengthen the ability to detect impending bearing degradation. These include: a review of all HUMS data to ensure no anomalies, fleet-wide borescope inspections, a requirement for HUMS to be serviceable before flight and the time between HUMS download/analysis reduced to a maximum of 5 hours. The operator has also reviewed their HUMS processes and analytical procedures and introduced a requirement to carry out an additional assurance check. The helicopter manufacturer On 31 December 2016, the helicopter manufacturer issued to all operators an ‘All Operators Letter’ (AOL), CCS-92-AOL-16-0019, which described the event. It emphasises the use of the HUMS Tail Gearbox Bearing Energy Tool, provided on the ground station, which will detect a TRPCS bearing that is experiencing degradation, and recommends that this Tool should be utilised as often as reasonably possible. This was followed by an Alert Service Bulletin (ASB) issued by the manufacturer on 10 January 2017. ASB 92-64-011 introduces a one- time inspection of the TRPCS and bearing assembly for ratcheting, binding, or rough turning. The manufacturer has recommended that compliance is essential and is to be accomplished prior to the next flight from a maintenance facility; three flight hours are

Air Accidents Investigation Branch Annual Safety Review 2017 33 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview allowed in order to return directly to a maintenance facility. Concurrent with the release of ASB 92-64-011, the manufacturer published Temporary Revision  45-03 to require operators to use S-92 HUMS ground station software to review Tail Rotor Gearbox energy analysis Condition Indicators for alert conditions on a reduced flight hour interval. Records in excess of published alert levels require inspection of the pitch change shaft and bearing. FIELD INVESTIGATIONS Hawker Sea Fury T Mk 20, G-RNHF on 31 July 2014 Safety issue – Historic aircraft airworthiness and maintenance Various marks of the Centaurus engine are still in use in a small number of aircraft but findings in this case could equally apply to other radial and inline aero-engine types. Based on this, the CAA has undertaken to publish a Safety Notice aimed at the historic aircraft community, to draw attention to the issues and difficulties of maintaining airworthiness of aging aircraft engines and their associated components. Saab 2000, G-LGNR on 6 November 2015 Safety issue – checklist unintended result, reduced control The manufacturer stated that it intended to add the following to the ‘Aileron system open failure’ section of the malfunction checklist at the next AOM revision: “NOTE: Verify an open failure by visually observing that one of the ailerons do not follow control wheel input.” ATR 72-212 A, G-COBO on 4 March 2016 Safety issue – effects of icing, pre-flight inspection and training The ATO responsible for the pilot’s type conversion training is adjusting its conversion course to align with the EASA Operational Suitability Data report. This is being achieved by incorporating the manufacturer’s simulator profile for a badly de-iced tailplane. The operator has enhanced its winter awareness training for pilots by purchasing a computer-based training module. All pilots will complete this before each winter season and their knowledge will be tested as part of the process. The operator’s conversion courses are being extended through the inclusion of a ground training day, with a training captain, prior to the start of Line Flying Under Supervision. This is to ensure time is spent discussing, in detail, technical issues relating to line operations. Winter operations and de-icing/anti- icing will be among the topics covered.

Air Accidents Investigation Branch Annual Safety Review 2017 34 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview The operator provided the co-pilot with additional training before he was allowed to resume line flying duties. The operator is reviewing its requirements for aircraft inspections following use of thickened de-icing fluids. The operator intends to provide better guidance for the aftermath of a serious incident by making changes to its Operations Manual (Part A). This is likely to include a recommendation for a group debrief to take place as a matter of course, so the crew can discuss what happened and what they have learnt. The manufacturer has stated it will contact all operators prior to the start of the next European winter, to promote awareness of the circumstances which led to this serious incident. Airbus A319-111, G-EZFJ on 14 April 2016 Safety issue – EFB software anomaly, potential cockpit display confusion ● ●The operator sent an email to all pilots on 22 April 2016 highlighting this specific anomaly. ● ●The MRC function was disabled across the operator’s fleet in May 2016. ● ●The operator has reviewed and proposed further modification to their SOPs. ● ●In the L6.x versions of FlySmart, it has been verified by the manufacturer that the MRC function is not affected by this anomaly. ● ●The manufacturer has sent Flysmart Communication reference X46D16018565 to operators highlighting the anomaly discovered during this investigation and recommending that the affected operators disable the MRC option. ● ●The manufacturer sent Flight Operations Transmission (FOT) 999.0095/16 to all operators reminding them of the manufacturer’s recommended procedures for EFB use. This involves each crew member performing their own independent calculations, the results of which are then cross-checked. Dropdown box for single runway selection ‘CONDITIONS’ entry area Runway selection area

Air Accidents Investigation Branch Annual Safety Review 2017 35 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Rans S6-ESD (Modified) Coyote II, G-MYES on 30 May 2016 Safety issue – Low speed handling, pilot information and airfield markings As a result of the rate of stall/spin accidents involving Rans S6 aircraft in the UK, the LAA has undertaken to conduct a safety review encompassing the following aspects: ● ●‘Complete a review of accident data with the type to date, including consideration of the aircraft configuration, weights and cg positions, mission and pilot profiles of those involved, including a comparison with the accident data for similar types of microlight ● ●Carry out a flight test program on at least two representative examples, to investigate possible handling, performance or other factors that might contribute to an elevated accident rate, including: • Longitudinal stability • Ability to trim (in pitch) • Longitudinal and lateral/directional trim changes with changes in power and configuration (i.e. flap position) • Directional stability and control, including contributing effects of adverse yaw with aileron input, and any contributing ergonomic aspects • Pre-stall warning • Stall characteristics • Ease of operation of controls • Adequacy of low-speed stall recovery/ climb performance at different weights and centre of gravity positions • Behaviour in a simulated engine failure • Instrumentation, in particular, adequacy of indication of airspeed and slip’ The LAA has advised that the applicable paragraphs of BCAR Section S, both current and extant at the time the type was introduced to the UK, are being used as the basis for this evaluation. The results of the safety review will be communicated to all Rans S6 pilots within the LAA membership The LAA has also undertaken to produce a series of pilot’s notes for the Rans S6, tailored to each airframe/engine combination on the UK fleet, on completion of the flight tests. The relevant Rans S6 TADS will be updated accordingly. Flying club Recognising the possibility of future confusion, the flying club at Shifnal Airfield reported that it had removed the landing T and signal square, to prevent incorrect signals being displayed. Throttle cable (note 90o bend) Throttle valve (not visible) Throttle valve actuation Mounting bracket

Air Accidents Investigation Branch Annual Safety Review 2017 36 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Airbus A330-323, N276AY on 26 June 2016 Safety issue – Emergency evacuation procedures, master minimum equipment list (MMEL) guidance and component maintenance policy Operator All pilots were informed that an evacuation should only be halted by the commander if he ‘has clear information that continuation of the evacuation would cause greater injury’. Studies of the interphone equipment on different aircraft types confirmed a need to refine the communication process on certain types. On the Airbus A319, A320, A321 or A330-300, FAs should now press the emer call button once to contact the flight deck in an emergency. On the Airbus A330‑200 they should press the prio capt button and on the Embraer E190 the emer pilot button. A video was produced with the co-operation of the crew involved in this occurrence, to highlight the issues they experienced. This video is being used as an educational tool for all pilots during their recurrent Human Factors (HF) training, for the nine month cycle commencing 1 February 2017. It may also become possible to use this video during FA training. A type-specific ’Emergency Deplaning’ drill has been developed for use by pilots on each of the operator’s aircraft types and incorporated into the OM and the appropriate QRH. This drill is relevant to parked aircraft that are using a jetbridge or steps. Details were promulgated to all crews and pilots received relevant simulator training. As there is no commonality between the cabin interphone handsets on different aircraft types, a physical training aid is being developed for use during initial and recurrent FA training. This is intended to give FAs a better understanding of the differences they will encounter and to help them adapt to any of the 14 aircraft types or variants on which they can be qualified. Recurrent HF training for the aircraft operator’s 12,000 pilots takes place on a 9 month cycle. The 27,000 FAs are on a 12 month cycle. This makes it difficult to conduct joint evacuation training with entire crews, so the operator is considering having pilot representatives participate in FA training and vice-versa. Future recurrent training for both pilots and FAs will focus on unplanned cabin evacuations when the aircraft is not on the runway. The Continuing Qualification training given to all FAs between April 2017 and March 2018 includes a review of an ‘Emergency Deplaning’ and it is likely attendees will hear the specific aural alert signals for each aircraft type.

Air Accidents Investigation Branch Annual Safety Review 2017 37 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview The operator expects a company safety investigator to contact the commander by telephone as soon as its ‘Dispatch’ department has been advised of a serious incident or accident. The safety investigator is now required to remind the commander during this contact that action be taken to ensure the circuit breaker for the CVR is pulled without delay. Training procedures were developed for the aircraft operator’s ramp personnel, to ensure they know how best to react if a slide evacuation occurs while an aircraft is parked. Twice a year, US operators, along with some foreign airlines that operate to the US, share experiences at a safety forum. The operator intends to discuss issues raised by this event at such a forum; to raise the industry’s awareness of the challenges that can be created by a cabin evacuation from a parked aircraft. Aircraft manufacturer The aircraft manufacturer has reviewed and amended the MMEL section 24-23-01, for the dispatch of an aircraft with APU AC auxiliary generation unserviceable and a summary of these changes is as follows: MMEL item 24-23-01A ‘APU not used’: No change, as not relevant to the event. MMEL item 24-23-01B ‘Electrical failure’: To insure a more robust detection of a mechanical failure, a review has been conducted with the APU Generator supplier and the following 4 failure messages will be added to the list from the AMM task 24‑23‑00‑040-803. GEN APU (8XS) GEN APU (8XS) EX FLD / GAPCU (40XG) GAPCU (40XG) EX FLD / GEN APU (8XS) GEN APU (8XS) EX FLD / GAPCU (40XG) If any of these messages is present in the PFR when doing the interactive APU test, then the MMEL 24-23-01C must be applied. MMEL item 24-23-01C ‘AC auxiliary generation deactivated or removed (mechanical failure)’: An update of the related AMM tasks (e.g. 24-23-00-040-801 and -802) has been decided, to prevent oil cross-contamination from the APU Gen to the APU. The AMM TASK 49-91-41-210-802-A “Check of the APU Oil System for APU Generator

Air Accidents Investigation Branch Annual Safety Review 2017 38 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Debris” has been added at the end of those tasks, and must be carried out prior to aircraft dispatch. This AMM task includes a physical check of the APU oil system (inlet screens of the scavenge-oil, inspection of the magnetic chip detectors and the mechanical differential pressure indicator, check of the lubrication oil supply and generator scavenge filters). Yak-52, G-YAKB on 8 July 2016 Safety issue – Smaller (less than 400 hp) historic engines overhaul policy The CAA have stated that they are conducting a review of engine maintenance to determine if Leaflet 70-80 should be extended to all piston engines and whether any Alternative Means (Methods) of Compliance arising from Leaflet 70-80 should be made mandatory by means of a Mandatory Permit Directive (MPD). This will also include a review of Generic Requirement No. 24 in CAP 747. Druine D.31 Turbulent, G-ARNZ on 14 August 2016 Safety issue – Aircraft system design The operators of the aircraft developed a modification to fit a screen to the engine’s carburettor intake, with the intention of preventing the ingress of similar debris to the balloon fragment. Should this screen become blocked, air can still be supplied to the carburettor via the alternative hot air supply, thereby allowing the engine to operate normally. After satisfactory testing, the modification was approved by the Light Aircraft Association. Spitfire IXT, G-LFIX on 15 September 2016 Safety issue – Cockpit indicator visibility In order to prevent the illumination of the complete word “DOWN” in the landing gear position indicator in the event that one landing gear has not achieved the fully locked position, the maintenance organisation modified the landing gear indicator to prevent light from either of the indicator bulbs illuminating the complete down caption.

Air Accidents Investigation Branch Annual Safety Review 2017 39 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Westland Wasp HAS1, G-KAXT on 23 September 2016 Safety issue – Continued airworthiness of historic aircraft and servicing policy The investigation findings were highlighted to the CAA at an early stage. The CAA took urgent action to ensure the continued airworthiness of Westland Wasp and Scout helicopters on the UK register by issuing Emergency Mandatory Permit Directive (EMPD) No 2017‑002‑E. (http://publicapps.caa.co.uk/modalapplication. aspx?appid=11&mode=detail&id=7759) The EMPD requires operators to perform a visual check of the condition of the universal joint and conduct periodic lubrication of the joint. Airbus A319-131, G-EUPM on 19 October 2016 Safety issue – CVR/FDR data preservation Following this event, the operator of G-EUPM made changes to its procedures to ensure that the commander is aware of his responsibility to ensure that the recordings are preserved. Airbus A320-214, G-EZWX on 28 November 2016 Safety issue - Component malfunction, OEM information and crew awareness ● ●By 9 December 2016, the operator of G-EZWX had removed all affected static inverters from its fleet and those that were held as spares. ● ●The operator’s engineering department is now reviewing all TFUs on a routine basis. Further safety action ● ●The aircraft manufacturer has advised that, later in 2017, it will release an Inspection Service Bulletin (ISB) to assist operators in identifying and rectifying any of the affected static inverters. ● ●The aircraft manufacturer has also advised that it will provide additional information to operators on the operation of the emergency interphone system. ● ●The operator has advised that, following the provision of the additional information of the emergency interphone system from the aircraft manufacturer, it will include this as part of crew training and update the appropriate internal manuals. ● ●The operator has also advised that it intends to conduct a review of its processes that relate to VSBs.

Air Accidents Investigation Branch Annual Safety Review 2017 40 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview ATR 72-212 A, 500 Version, G-COBO on 21 December 2016 Safety issue – Operating procedures, crew response Operator The operator reviewed its ATR procedures and amended them to improve safeguards against similar occurrences. Flight crews were reminded of the required response to APM cautions, and the operator now replicates this incident, and APM messages, during pilots’ flight simulator training. Several internal recommendations were made, addressing non-normal situation handling in general. The following FLYING STAFF INSTRUCTION – ATR was issued on 28 December 2016, with an amendment to the ATR Operations Manual Part B, Section 2.4: ‘2.4.16.2 Climb Speed Standard Climb Speed is 170 kt IAS or Red Bug + 10 kt, whichever is the higher, achieved using AFCS [Automatic Flight Control System] IAS mode. Climb speed may only be reduced below 170 knots if required for terrain clearance or mandatory ATC requirements. Under these circumstances the minimum IAS is White Bug + 10 kt in Normal Conditions and Red Bug + 10 kt in Icing Conditions. … If during climb at Standard Climb Speed the average rate of climb falls below 500 feet per minute, crews should request to stop climb at the next available level or advise ATC of the reduced climb capability. Speed must not be reduced to maintain a given rate of climb.’ The following memo was sent to all ATR pilots: ‘APM / Reduced Performance Crews are also reminded that Severe Icing may be encountered without the presence of the normally associated visual cues, and reduced rate of climb or cruise airspeed are sometimes the only indication of significant ice accretion. Whenever crews encounter or suspect severe icing, the full checklist at QRH page 1.09 [Severe Icing] must be completed. Aircraft manufacturer The aircraft manufacturer stated that it is working to improve the APM to avoid the illumination of cautions that are perceived as spurious. As a result of this occurrence and that investigated by the AIBN the manufacturer has amended the DEGRADED PERF and SEVERE ICING procedures.

Air Accidents Investigation Branch Annual Safety Review 2017 41 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview The amended DEGRADED PERF procedure will state that the SEVERE ICING procedure should be actioned if the aircraft is unable to maintain a climb rate greater than 100 ft/min, when climbing at red bug +10 kt. The SEVERE ICING procedure will have fewer memory items and will state that, after IAS and engine power are increased and the autopilot is disconnected, a descent is to be initiated to escape the severe icing conditions. The amendments, in the appropriate documents, are due to be distributed to all operators in January 2018. The manufacturer of this aircraft, together with other aircraft manufacturers, has contributed to the update of the Airplane Upset Prevention and Recovery Training Aid (AUPRTA), Revision 3, which is available on ICAO website. This update includes information specific to turboprop aircraft. Boeing 737-36E Freighter, TF-BBF on 3 February 2017 Safety issue - Component failure The operator is replacing the V-band clamps at the failure location on TF-BBF across its fleet of 737-300 and 737-400 aircraft. This is being carried out on a rolling programme, as the aircraft undergo scheduled C-check maintenance inspections. The operator is also considering replacement of other V-band clamps on their aircraft where the release of bleed air may create a hazard. Europa, G-NDOL on 28 May 2017 Safety issue – Modification standard, system integrity On 19 July 2017, the LAA issued Airworthiness Information Leaflet LAA/MOD/247/010. This required a mandatory inspection, before next flight, of all Europa aircraft operating under an LAA administered Permit to Fly. The inspection was to check for the correct installation of a fuel vapour return line. Details can be found on the LAA website. CORRESPONDENCE INVESTIGATIONS Robinson R44 II, G-SAIG and Spitfire IXT, G-CCCA on 15 June 2016 Safety issue – airfield movements deconfliction After the accident, the Aerodrome Safety Manager issued a safety notice to the helicopter operator based at the airfield, requiring helicopters to hold short of the active runway and request clearance to cross. The A/G radio operator will then inform the helicopter pilot of any known traffic and the pilot, having checked it is safe to do so, may then cross the runway.

Air Accidents Investigation Branch Annual Safety Review 2017 42 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Europa XS, G-BYSA on 10 August 2016 Safety issue – Airfield information The airfield operator has informed the publishers of various flight guides that the runway width is now 10 m and requested that they include a warning to ‘Beware cliffs on the east side of the airfield’. The Light Aircraft Association included this accident in their October 2016 ‘Safety Spot’ feature to advise their members of the circumstances. Flight Design CTSW, G-CGVG on 8 October 2016 Safety issue – Airworthiness and NDT servicing policy In response to this accident the UK agent intends to issue Service Bulletin CT145, which requires removal and dye penetrant crack inspection of the main landing gear legs of all CT2K and CTSW aircraft at intervals of 300 flying hours. Service Bulletin CT145 will supersede SB CT123. Service Bulletin CT145 will also introduce modification M309, in which the edges of the main attachment hole in the legs are peened, leaving residual compression stress at the hole edges intended to supress fatigue crack initiation. Service Bulletin CT145 continues to include the requirement to inspect the legs for cracks and straightness following heavy landing events. Eurofox 912(LS), G-ODGC on 15 October 2016 Safety issue – Component fatigue, lifing policy and airworthiness As a result of the incident and discussions with the LAA, on 1 November 2016 the aircraft manufacturer issued Mandatory Service Bulletin, EuroFOX SB 03/2016 LAA (v2). This required the replacement of the landing gear mounting bolts within 20 flying hours of the release date of the Bulletin and introduced a 500 flying-hour mandatory life on the bolts. On 4 November 2016, the LAA published Airworthiness Alert LAA/AWA/16/07 which detailed the failure and alerted operators of the aircraft to the requirements of the Mandatory Service Bulletin. The incident was also publicised in the LAA’s November 2016 Safety Sense article.

Air Accidents Investigation Branch Annual Safety Review 2017 43 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview UAS Schiebel Camcopter S-100 (unregistered) on 18 October 2016 Safety issue – Human factors, workload and control logic The manufacturer has implemented a software change to reduce operator workload during takeoff. If the UA is on the ground and the trim mode has been selected: ● ●Operator thumb rocker climb-rate inputs between -50% and +50% produce an automatic climb rate command of +50% until the trim becomes active, and ● ●All cyclic joystick inputs are ignored until the trim becomes active. Dassault Falcon 7X, VQ-BSO on 24 November 2016 Safety issue – Aircraft ground handling and observation London City Airport identified the following safety actions:

1. The parking positions for the Falcon 7X should be identified and the position of

their main and nose wheels marked on the apron surface.

1. All the Jet Centre’s marshallers should receive refresher training on the correct

ICAO marshalling signals.

1. Marshalling wands must be used for all

manoeuvring not just at night or in reduced visibility.

1. Initially, marshallers and ‘wing walkers’ would

be equipped with belt mounted horns to provide an audio STOP signal. This would subsequently be replaced providing digital radios on a dedicated frequency.

1. A new supervisory level appointment would be

created to oversee all parking.’ Robin DR400/180 Regent, G-ETIV on 7 December 2016 Safety issue – CRM, spatial awareness and airfield knowledge Following an investigation, a safety action was taken at the airfield to ensure pilots are told the runway in use when they call on the radio prior to arrival. In May 2017, the CAA published CAP 1535, ‘The Skyway Code’ which is intended to provide General Aviation pilots involved in non‑commercial and flight training operations

Air Accidents Investigation Branch Annual Safety Review 2017 44 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview with practical guidance on the operational, safety and regulatory issues relevant to their flying. ‘The Skyway Code’ includes a section on the responsibilities of the Pilot in Command in a format which is intended to be more accessible than from regulatory documents. To further clarify the term ‘Safety Pilot’ when used with an ‘Operational Safety Pilot Limitation (OSL)’ placed on a Medical Certificate, the CAA will produce an article for ‘Clued Up’, its magazine for the general aviation community. Additionally, the CAA will also ask the General Aviation Safety Council (GASCO) to publish the same article in its Flight Safety Bulletin. DHC-8-402, Dash 8, G-FLBB on 8 December 2016 Safety issue – Component history and reliability The operator has expressed concerns over the reliability of the outflow valve and has initiated a reliability investigation involving the spare part provider and the OEM. At the time of writing the results of the reliability investigation are not known. Piper PA-28-181 Cherokee Archer II, G-BPAY on 29 December 2016 Safety issue – Ground movements, parking and observation Since the accident the airfield operator has changed its procedures to reduce the need for parallel rows of parked aircraft and therefore lessen the risk of ground collisions. Agusta AW139, G-VINB on 20 January 2017 Safety issue – Flight planning and CRM The operator carried out a prompt internal investigation into the incident and identified a number of potential safety actions. The following are of relevance to this report: Carry out a Flight Planning Software review for robustness and ease of use. Carry out a review of the destination nomenclatures used for planning applications and software. Reiterate to all crews the importance of clear and unambiguous communications. Reiterate to crews the importance of re-briefing all aspects of the flight when a significant change has been applied.’ The remaining sectors were completed without incident.

Air Accidents Investigation Branch Annual Safety Review 2017 45 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Bell 206B Jet Ranger III, G-BTHY on 19 February 2017 Safety issue – Air space use and NOTAM requirements The operator has advised its pilots of the potential hazard of high flying kites and the need to avoid areas where they suspect the activity is taking place. The CAA has been advised of the activity and an investigation is being conducted. The incident has also been reviewed by the CAA Safety Risk Panel. Airbus A320-214, G-EZTV on 3 March 2017 Safety issue – Aircraft ground handling procedures and equipment knowledge There have been several safety actions made by three organisations as a result of this accident. These are outlined below. The ground handling company has instigated several changes to its procedures and to personnel training, including: Improvements to towbar maintenance and inspection procedures. A training aid has been developed to help ground crew recognise when shear pins are unserviceable. A standard fault-finding procedure has been introduced for ground crews when they hear an unusual sound or suspect a shear pin has broken while pushing or pulling an aircraft. Improvements have been made to ground crew training to ensure that correct procedures for aircraft engine start are followed for each stand at Manchester. The airfield operator has issued safety alerts to airfield users regarding inspections and maintenance of pushback equipment and regarding stand-specific pushback procedures. The aircraft operator has reviewed its pushback procedures in response to the aircraft manufacturer’s comments.

Air Accidents Investigation Branch Annual Safety Review 2017 46 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Airbus A320-214, G-EZTM on 26 March 2017 Safety issue – Aircraft ground movements and support procedures The operator’s engineering department is reviewing the AMM task (324200710001-A Rev.55) and will make recommendations to the aircraft manufacturer to amend the AMM accordingly. The ground handling company has undertaken the following actions to prevent a recurrence:

1. Raised awareness of the event;
2. Retrained the staff involved concerning the correct chocking procedures;
3. The defective equipment local operating procedure has been re-issued to all

staff to prevent inoperative equipment being available for use. Agusta A109S Grand, G-PBWR on 5 May 2017 Safety issue – Airworthiness, left horizontal stabiliser failure Prompted by this event, the manufacturer issued a Service Bulletin providing new instructions for a one-time inspection and new repetitive inspections at a reduced inspection threshold and interval. As a result of this and its own safety assessment, EASA issued Emergency Airworthiness Directive AD 2017-0085-E, on 12 May 2017, to mandate these instructions. Reims Cessna F406 Caravan II, G-RVLX on 1 June 2017 Safety issue – Hatch and door security, crew aircraft knowledge The operator is taking the following safety actions: An email was sent to all crew to notify them of the event and to highlight correct door operation and security A fleet check of aircraft fitted with a similar door was carried out to ensure that both primary and secondary locks operated correctly. Placarding of the secondary handle will be improved to clearly identify when it is the locked position. A strap will be fitted to the emergency exit main handle to minimise the likelihood of it being inadvertently disturbed.

Air Accidents Investigation Branch Annual Safety Review 2017 47 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Cessna 510 Citation Mustang, OE-FHK on 15 June 2017 Safety issue – Aircraft system knowledge The aircraft operator has taken the following Safety Actions; A ‘Safety Bulletin’ to flight crew was circulated which stated that the parking brake is only to be set with the battery switch in the batt position and that the appropriate checklists are always to be followed. This notice also warns crew not to remove chocks if there are obstacles such as a fuel bowser nearby and states that trainee pilots are always to be accompanied by an experienced crew member while operating the aircraft. The SOPs were modified and additional guidance on operation of the parking brake and the use of wheel chocks was placed in the OM. Pilot training was revised to try to ensure a comprehensive understanding of the hydraulic system and the aircraft brakes. Quest Q-200 UAS on 12 July 2017 Safety issue - Commercial UAV operating procedures The operator has made the following procedural changes to minimise the probability of collisions with high obstacles on this and other construction sites: Construction site staff will be contacted, prior to launch, to check the height of the highest structure to ensure that sufficient clearance can be met. If this cannot be achieved that part of the site will not be overflown. Any flights that have the potential to overfly the construction site will be flown at 400 ft. Manual corrective action will be taken to manoeuvre the UA in the event of deviations from the flight plan. AW109SP Grand New, G-HLCM on 2 August 2017 Safety issue - Rotor blade integrity and airworthiness The manufacturer identified the main rotor blades that were potentially affected and issued Service Bulletin 109SP-116 to introduce a periodic inspection. The EASA issued Emergency Airworthiness Directive 2017-0176-E to mandate the requirements of the Service Bulletin.

Air Accidents Investigation Branch Annual Safety Review 2017 48 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Appendix 1 - CICITT Occurrence Categories CODE DESCRIPTION ARC ABNORMAL RUNWAY CONTACT AMAN ABRUPT MANEUVER ADRM AERODROME MAC AIRPROX/TCAS ALERT/LOSS OF SEPARATION/NEAR MIDAIR COLLISIONS/MIDAIR COLLISIONS ATM ATM/CNS BIRD BIRD CABIN CABIN SAFETY EVENTS CTOL COLLISION WITH OBSTACLE(S) DURING TAKEOFF AND LANDING CFIT CONTROLLED FLIGHT INTO OR TOWARD TERRAIN EVAC EVACUATION EXTL EXTERNAL LOAD RELATED OCCURRENCES F–NI FIRE/SMOKE (NON-IMPACT) F–POST FIRE/SMOKE (POST-IMPACT) FUEL FUEL RELATED GTOW GLIDER TOWING RELATED EVENTS GCOL GROUND COLLISION RAMP GROUND HANDLING ICE ICING LOC–G LOSS OF CONTROL–GROUND LOC–I LOSS OF CONTROL–INFLIGHT LOLI LOSS OF LIFTING CONDITIONS EN ROUTE LALT LOW ALTITUDE OPERATIONS MED MEDICAL NAV NAVIGATION ERRORS OTHR OTHER RE RUNWAY EXCURSION RI RUNWAY INCURSION SEC SECURITY RELATED SCF–NP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (NON-POWERPLANT) SCF–PP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (POWERPLANT) TURB TURBULENCE ENCOUNTER USOS UNDERSHOOT/OVERSHOOT UIMC UNINTENDED FLIGHT IN IMC UNK UNKNOWN OR UNDETERMINED WILD WILDLIFE WSTRW WIND SHEAR OR THUNDERSTORM

GLOSSARY OF ABBREVIATIONS aal above airfield level ACAS Airborne Collision Avoidance System ACARS Automatic Communications And Reporting System ADF Automatic Direction Finding equipment AFIS(O) Aerodrome Flight Information Service (Officer) agl above ground level AIC Aeronautical Information Circular amsl above mean sea level AOM Aerodrome Operating Minima APU Auxiliary Power Unit ASI airspeed indicator ATC(C)(O) Air Traffic Control (Centre)( Officer) ATIS Automatic Terminal Information Service ATPL Airline Transport Pilot’s Licence BMAA British Microlight Aircraft Association BGA British Gliding Association BBAC British Balloon and Airship Club BHPA British Hang Gliding & Paragliding Association CAA Civil Aviation Authority CAVOK Ceiling And Visibility OK (for VFR flight) CAS calibrated airspeed cc cubic centimetres CG Centre of Gravity cm centimetre(s) CPL Commercial Pilot’s Licence °C,F,M,T Celsius, Fahrenheit, magnetic, true CVR Cockpit Voice Recorder DME Distance Measuring Equipment EAS equivalent airspeed EASA European Aviation Safety Agency ECAM Electronic Centralised Aircraft Monitoring EGPWS Enhanced GPWS EGT Exhaust Gas Temperature EICAS Engine Indication and Crew Alerting System EPR Engine Pressure Ratio ETA Estimated Time of Arrival ETD Estimated Time of Departure FAA Federal Aviation Administration (USA) FDR Flight Data Recorder FIR Flight Information Region FL Flight Level ft feet ft/min feet per minute g acceleration due to Earth’s gravity GPS Global Positioning System GPWS Ground Proximity Warning System hrs hours (clock time as in 1200 hrs) HP high pressure hPa hectopascal (equivalent unit to mb) IAS indicated airspeed IFR Instrument Flight Rules ILS Instrument Landing System IMC Instrument Meteorological Conditions IP Intermediate Pressure IR Instrument Rating ISA International Standard Atmosphere kg kilogram(s) KCAS knots calibrated airspeed KIAS knots indicated airspeed KTAS knots true airspeed km kilometre(s) kt knot(s) lb pound(s) LP low pressure LAA Light Aircraft Association LDA Landing Distance Available LPC Licence Proficiency Check m metre(s) MDA Minimum Descent Altitude METAR a timed aerodrome meteorological report min minutes mm millimetre(s) mph miles per hour MTWA Maximum Total Weight Authorised N Newtons NR Main rotor rotation speed (rotorcraft) Ng Gas generator rotation speed (rotorcraft) N1 engine fan or LP compressor speed NDB Non-Directional radio Beacon nm nautical mile(s) NOTAM Notice to Airmen OAT Outside Air Temperature OPC Operator Proficiency Check PAPI Precision Approach Path Indicator PF Pilot Flying PIC Pilot in Command PNF Pilot Not Flying POH Pilot’s Operating Handbook PPL Private Pilot’s Licence psi pounds per square inch QFE altimeter pressure setting to indicate height above aerodrome QNH altimeter pressure setting to indicate elevation amsl RA Resolution Advisory RFFS Rescue and Fire Fighting Service rpm revolutions per minute RTF radiotelephony RVR Runway Visual Range SAR Search and Rescue SB Service Bulletin SSR Secondary Surveillance Radar TA Traffic Advisory TAF Terminal Aerodrome Forecast TAS true airspeed TAWS Terrain Awareness and Warning System TCAS Traffic Collision Avoidance System TGT Turbine Gas Temperature TODA Takeoff Distance Available UAS Unmanned Aircraft System UHF Ultra High Frequency USG US gallons UTC Co-ordinated Universal Time (GMT) V Volt(s) V1 Takeoff decision speed V2 Takeoff safety speed VR Rotation speed VREF Reference airspeed (approach) VNE Never Exceed airspeed VASI Visual Approach Slope Indicator VFR Visual Flight Rules VHF Very High Frequency VMC Visual Meteorological Conditions VOR VHF Omnidirectional radio Range Air Accidents Investigation Branch Annual Safety Review 2017 AAIB Air Accidents Investigation Branch

FD06618 ｜ 2017_英国_annual-safety-review-2017__AAIB_Annual_Safety_Review_2017_Lo_res.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Annual Safety Review 2017 AAIB Air Accidents Investigation Branch

Air Accidents Investigation Branch Annual Safety Review 2017 AAIB Air Accidents Investigation Branch © Crown Copyright 2018 All rights reserved. Copies of this publication may be reproduced for personal use, or for use within a company or organisation, but may not otherwise be reproduced for publication. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and it is not used in a derogatory manner or in a misleading context. Published 14 March 2018 Enquiries regarding the content of this publication should be addressed to: Air Accidents Investigation Branch Farnborough House Berkshire Copse Road Aldershot Hampshire GU11 2HH. This document is also available in electronic (pdf) format at www.aaib.gov.uk

Air Accidents Investigation Branch Annual Safety Review 2017 i AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Foreword and Contents Foreword The AAIB’s purpose is to improve aviation safety by determining the circumstances and causes of air accidents and serious incidents, and promoting action to prevent reoccurrence. I am pleased to introduce the AAIB’s 2017 Annual Safety Review which includes information on our activity and progress on the status of Safety Recommendations that were published in 2017. The AAIB received 708 occurrence notifications in 2017 and deployed 38 times to conduct field investigations, 16 of which were fatal accidents in the UK resulting in 28 deaths. A further 204 investigations were conducted by correspondence. Most of the fatal accidents involved General Aviation with the dominant causal factors again being loss of control in flight and weather-related issues. In this Review, analysis has been presented of 72 fatal accidents which occurred between 2010-2015 to highlight the most common causes and draw attention to the extensive advice that is available to help pilots avoid the circumstances that all too often lead to accidents. In 2017 the AAIB deployed to 7 accidents overseas, including to Norway, Ireland, Holland, the USA, the British Virgin Islands and the Turks and Caicos Islands, and participated in 98 other international investigations as the UK’s Accredited Representative or Expert. 2017 was notable as a year in which there were no fatal accidents involving a passenger jet airliner anywhere in the world; a very welcome statistic. However, 2 passenger airliner accidents in February 2018 unfortunately provides a reality check that such catastrophes are not a thing of the past, and a forceful reminder of the human cost of such tragedies. The need to learn from accidents is as pressing as ever. But so too is the need to learn from serious incidents (which, by definition, were nearly accidents) to establish why safety margins were compromised and promote action to address any weaknesses in the system. AAIB published 3 Special Bulletins in 2017, which each related to occurrences where the outcome was much less severe than it might have been, largely due to good fortune; two of them involved Commercial Air Transport. The AAIB is investigating these occurrences with as much rigour as if the outcome had been catastrophic to ensure the safety issues are fully understood and addressed. In March 2017, the AAIB published its Final Report on the accident involving the Hawker Hunter aircraft which crashed on to the A27 Shoreham Bypass, while performing at the Shoreham Airshow in 2015, fatally injuring 11 road users and bystanders. A further 35 Field Investigations were concluded in 2017, and an update on the responses to all 29 Safety

Air Accidents Investigation Branch Annual Safety Review 2017 ii AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Recommendations made in 2017 is provided in this Review. This Review also summarises 99 significant Safety Actions undertaken by manufacturers, operators and regulators, following close engagement with AAIB inspectors. The AAIB must continually develop its capabilities and relationships to ensure it is ready for current and future challenges. During 2017 the AAIB completed a major review of its strategy and established priority areas for development. One example is the further strengthening of the Branch’s human factors investigation capability by the recruitment of a specialist into the newly established Inspector of Air Accidents (Human Factors) discipline, and an article on this is included in this Review. Other ongoing measures include the further development of techniques for investigating accidents involving unmanned air systems, and preparing the AAIB for the advent of launches into space from the UK. In 2018 our new regulations will be laid before Parliament and we will conduct a comprehensive survey of our stakeholders to inform the further development of our working practices and our outputs. We look forward to your feedback. In the meantime, there is a lot of information in this Annual Safety Review which I trust you will find informative and useful.

Crispin Orr Chief Inspector of Air Accidents

Air Accidents Investigation Branch Annual Safety Review 2017 1 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Foreword and Contents Contents Foreword..............................................................................................................................i AAIB General Aviation Fatal Accident Review................................................................3 Human Factors in Accident Investigation.......................................................................9 CICTT Factors on Investigations by the AAIB in 2017.................................................13 Field investigations.................................................................................................. 14 Correspondence investigations............................................................................... 15 Fatal investigations.................................................................................................. 16 Statistics for 2017............................................................................................................17 Category Definition.................................................................................................. 18 Notifications 2017.................................................................................................... 19 Notifications 2016.................................................................................................... 20 Notifications 2015.................................................................................................... 21 Safety Recommendations in 2017..................................................................................23 Safety Actions from investigations reported on in 2017..............................................32 Special Bulletin........................................................................................................ 32 Field Investigations.................................................................................................. 33 Correspondence Investigations............................................................................... 41 Appendix 1 - CICITT Occurrence Categories................................................................48 Follow us on Twitter: @aaibgovuk

Air Accidents Investigation Branch Annual Safety Review 2017 2 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Boeing 737-4Q8, OE-IAG Belfast International (Aldergrove) Airport 4 October 2016

Air Accidents Investigation Branch Annual Safety Review 2017 3 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB General Aviation Fatal Accident Review AAIB General Aviation Fatal Accident Review Introduction / Overview The AAIB has conducted a review of fatal General Aviation (GA) accident reports it published between 2010 and 2015, inclusive. The total number of accidents was 72, resulting in 105 fatalities. Of these accidents, 63 involved fixed wing aircraft and 9 rotary wing. Almost half the accidents were attributed to loss of control in flight. This article is intended to provide pilots with a summary of the most common causes of GA fatal accidents in the UK, so that lessons may be learnt and actions taken to prevent similar accidents in the future. Summary of events Figure 1 shows a breakdown of the dominant causal factors in these accidents:   46% 16% 16% 14% 8% Dominant causal factors Loss of control in flight Weather related Other Struck object during takeoff / landing Mid‐air collision Figure 1 Analysis and commentary Loss of Control The predominant causal factor was loss of control in flight, which accounted for almost half of the accidents. Of these, most involved the aircraft entering an inadvertent stall and/or spin following engine failure, or during aerobatics. The UK CAA has published a Handling Sense Leaflet to increase stall/spin awareness: http://publicapps.caa.co.uk/docs/33/ga_srg_09webHSL02.pdf

Air Accidents Investigation Branch Annual Safety Review 2017 4 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB General Aviation Fatal Accident Review Where the accident involved a complete or partial engine failure, the loss of control was often associated with inadequate airspeed, particularly whilst manoeuvring at low level (Figure 2). Figure 2 Cessna 150F, G-ATKF Hinton-in-the-Hedges Airfield, Northamptonshire 4 September 2015 Pilots are taught in the PPL syllabus how to handle a complete engine failure, but the more insidious partial engine failure is not normally covered during training. Recognising this, the Australian Transport Safety Bureau has published a safety leaflet on managing partial power loss after takeoff in single engine aircraft: http://www.atsb.gov.au/publications/2010/avoidable-3-ar-2010-055/ Common features of the aerobatic accidents were a lack of pilot training and experience in aerobatics and insufficient height to recover when the planned manoeuvre was unsuccessful. The CAA has published a Safety Sense Leaflet that contains pertinent information to consider before engaging in aerobatics: http://publicapps.caa.co.uk/docs/33/20130121SSL19.pdf Weather A significant number of the accidents reviewed in this study were weather-related. Common themes were: collision with terrain due to flying below the minimum safe altitude (MSA) in IMC (Figure 3) and flying in IMC without the appropriate training and qualifications. Whilst new technology has undoubtedly made the tasks of flight planning and navigation easier, poor weather remains a constant threat to GA pilots and should not be underestimated. Research AR-2010-055 Avoidable Accidents No. 3 Managing partial power loss after takeoff in single-engine aircraft

Air Accidents Investigation Branch Annual Safety Review 2017 5 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB General Aviation Fatal Accident Review Figure 3 Piper PA-28-140 Cherokee, G-BHXK Near Loch Etive, Oban, Argyll and Bute 4 April 2015 The ATSB has published a safety leaflet on Visual Flight Rules pilots who enter Instrument Meteorological Conditions: http://www.atsb.gov.au/publications/2011/avoidable-4-ar-2011-050/ Collision with objects during takeoff or landing The majority of accidents in this category involved collision with power cables or trees, often at unlicensed airfields. Operating to such airfields can be more challenging and the CAA has published a Safety Sense Leaflet to highlight appropriate considerations when operating from an unlicensed or private airstrip: http://publicapps.caa.co.uk/docs/33/20130121SSL12.pdf Research AR-2011-050 Avoidable Accidents No. 4 Accidents involving pilots in Instrument Meteorological Conditions

Air Accidents Investigation Branch Annual Safety Review 2017 6 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB General Aviation Fatal Accident Review Mid-air collisions Of the six accidents in this category, three occurred whilst in the circuit and the others in uncontrolled airspace. The CAA has published a safety poster that aims to remind pilots of the standard overhead join by means of a simple pictorial representation: http://publicapps.caa.co.uk/docs/33/ga_srgwebStandardOverheadJoinPosterJan09.pdf The CAA has also published a Safety Sense Leaflet providing an overview of the principles of see-and-avoid and highlighting the importance of maintaining an effective visual scan: http://publicapps.caa.co.uk/docs/33/20130121SSL13.pdf Other In this category no specific trend was identified which could help prevent future accidents. Other resources In addition to the links already provided, further safety information is available from the following sources: Refresher or further training with an instructor Flying skills are perishable. Flying instructors can provide knowledge on specific safety issues and valuable training to help pilots improve their skills. CAA Publications CAA safety information for recreational flying can be found at the following link: https://www.caa.co.uk/General-aviation/Safety-information/Safety-information/ CAA Handling and Safety Sense Leaflets cover a wide range of topics summarising key safety points and techniques relevant to GA pilots. Leaflets are available to download here: http://publicapps.caa.co.uk/modalapplication.aspx?appid=11&mode=list&type=sercat&id=21 The CAA ‘Skyway Code’ provides private pilots with practical guidance on operational, safety and regulatory issues related to their flying: https://www.caa.co.uk/General-aviation/Safety-information/The-Skyway-Code/

Air Accidents Investigation Branch Annual Safety Review 2017 7 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB General Aviation Fatal Accident Review General Aviation Safety Council (GASCo) Safety Evenings These are designed to provide an opportunity for pilots to reflect on GA safety as it affects them and the people they fly with.  The aim is to facilitate an exchange of views on how to improve flight safety by sharing information, thoughts and ideas. The title of GASCo’s current presentation is ‘Aware Today, Alive Tomorrow’. It addresses maintaining situational awareness and the use of threat and error management to prevent loss of control accidents, mid-air collisions and airspace infringements. GASCo website : http://www.gasco.org.uk/ Safety evenings : http://www.gasco.org.uk/safety-evenings.aspx Sud-Aviation SE-313B Alouette II, HA-PPC Breighton Aerodrome, Yorkshire 17 July 2016

Air Accidents Investigation Branch Annual Safety Review 2017 8 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Boeing 737-476(SF), EI-STD East Midlands Airport 29 April 2014

Air Accidents Investigation Branch Annual Safety Review 2017 9 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Human Factors in Accident Investigation Human Factors in Accident Investigation Introduction As air accident investigators our job can often be as much about trying to understand the human contribution to an accident or incident, as it is about trying to understand the technical contribution. It can be a common misconception to think that the human involvement lies only with those most recently involved in the moments leading up to an accident, for example the pilot who happens to be at the controls at the time of the accident, the air traffic controller who issued the last clearance or the engineer or who last worked on the aircraft. However, people in operational roles often inherit decisions, policies and procedures that may have been made or implemented many years before. And they may have to carry out complex tasks involving competing priorities and variable threats in a constantly changing work environment. It is important therefore that an accident or incident investigation explores all of the aspects which have the potential to influence how an individual executes a task on any given day. Human factors v human error Human error, in isolation, is not an acceptable conclusion for accident investigation. Instead, identifying the presence of human error, or human performance that was not as expected, should be the starting point for an investigation. As investigators we need to look at all the human interactions and organisational influences that may have contributed to an accident, whether those be in the immediate lead-up to an accident or further back in time. When examining these issues we have the gift of hindsight, which is not something those involved at the time of an accident possess. It is therefore vital that rather than looking back in time, scrutinising someone’s actions and trying to understand them based on what we now know, we instead need to put ourselves in their shoes and understand how the situation unfolded in their eyes - what information did they have available to them at the time, what threats were they managing, how had they been trained, what condition was the equipment in? Only in this way can we attempt to work out why an individual’s thoughts, actions and behaviours may have made perfect sense to them at the time. It is only when we gain proper insight into these issues that we can identify the areas that will deliver the most meaningful safety improvements. What is ‘normal’? We must also strive to understand what ‘normal’ looks like. People may routinely employ work-arounds and adaptations to facilitate the smooth running of an operation, however if we only consider these in the context of the circumstances of an accident we might fail to appreciate how such actions form a normal part of the operation and routinely deliver Annual Safety Review 2017 AAIB Air Accidents Investigation Branch Slingsby T67M Mk II Firefly, G-BNSO Whitwell-on-the-Hill, North Yorkshire 30 April 2016

Air Accidents Investigation Branch Annual Safety Review 2017 10 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Human Factors in Accident Invesigation a safe outcome. Understanding how such tasks are normally executed by the individuals involved, and by other individuals, can provide relevant context to the investigation. And of course, it is also equally important to understand what went right as well as what went wrong, for example, what safety features worked as intended or what human interventions prevented the outcome from being even worse. Historically Historically the AAIB has often relied on external human factors expertise to support its investigations on a case-by-case basis. However, in recent years the AAIB has been taking steps to enhance its capability in the field of investigating human factors and human performance, including the establishment of an internal human factors working group in 2013. Included in the working group’s activities were a review of how other safety investigation agencies are resourced to investigate human performance aspects, identification of suitable human factors training provision for AAIB inspectors and creation of a database of external HF expertise in specialist areas. Inspectors come to the AAIB with a wide range of aviation industry experience, and this includes some with a wealth of human factors knowledge and others with less knowledge in this area. The training identified by the working group has served to update and refresh inspectors’ knowledge on the investigation of human factors and human performance issues, as well as bringing the inspectorate to a common baseline on current thinking in this field. By March 2017 all AAIB inspectors had undertaken this training and it is a mandatory requirement for all new joiners. Human factors today In late 2017 the AAIB embarked upon a campaign to recruit its first dedicated in-house human factors specialist. This involved the creation of a new investigation discipline within the AAIB, adding to the established disciplines of operations, engineering and flight data recording. The new Inspector of Air Accidents (Human Factors) will take up post in April 2018 and the AAIB is looking forward to integrating this new capability into our existing investigation activities and to the new opportunities that this will bring. There will still of course be a need for assistance from external specialist human factors expertise from time to time to support AAIB investigations – the field of human factors is vast and it would be impossible for any human factors practitioner to be expert in all of the many different facets of human factors. The AAIB will therefore continue to seek external expertise as appropriate under the direction of the Human Factors Inspector. Accident Investigation Branch collaboration In addition, over the last few years the AAIB has been working closely with colleagues from the Rail and Marine Accident Investigation Branches (RAIB and MAIB) via a tri-Branch human factors working group. While technology, procedures and operating environment can differ greatly between the transport modes, the fundamentals of human performance Operator Manual

Air Accidents Investigation Branch Annual Safety Review 2017 11 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Human Factors in Accident Investigation in a complex or safety-critical operational environment remain the same. The cross-branch working group therefore strives to exchange experiences, learning and expertise relevant to the investigation of human factors and human performance aspects, consider ways in which human factors capability can be developed across and within the three Branches and to explore ways of developing the competence of inspectors to investigate human factors aspects. The RAIB has recruited an Investigation Support Officer who will carry out human factors research in support of investigations across the three Branches. Conclusion Truly getting to grips with the human performance and organisational aspects of an air accident is an integral part of the AAIB’s role and the AAIB has been taking steps to enhance its capability in these areas over recent years. Recruitment of a dedicated Inspector of Air Accidents (Human Factors) is an important and defining step on this journey, and we look forward to reporting further on our progress in this field in future Annual Reports, as we continue to shape and develop this evolving capability. AAIB Air Accidents Investigation Branch

Air Accidents Investigation Branch Annual Safety Review 2017 12 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk SZD-24-4A Foka 4, G-DBZZ Bicester Airfield, Oxfordshire 8 August 2010

Air Accidents Investigation Branch Annual Safety Review 2017 13 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2017 CICTT Factors on Investigations by the AAIB in 2017 Every occurrence in the UK is recorded on the European Central Repository (ECCAIRS) and is coded using the occurrence taxonomy defined by the CAST/ICAO Common Taxonomy Team (CICTT). This is a worldwide standard taxonomy to permit analysis of data in support of safety initiatives. In the UK the coding of occurrences is carried out by the CAA. It should be noted that they are recorded as multiple factors, for example turbulence (TURB) leading to loss of control in flight (LOC-I). Similarly, other (OTHER) is also used and may include maintenance manual errors or human factors, aspects that do not have specific classifications. Factors for all investigations reported on by AAIB in 2017 OTHR ARC SCF-NP LOC-I LOC-G SCF-PP RE CTOL GCOL TURB F-NI CFIT ICE UNK ADRM FUEL F-POST WSTR... NAV MED MAC RAMP L... A... BI... See Appendix 1 for category descriptions 91 67 55 50 38 35 31 18 11 11

Air Accidents Investigation Branch Annual Safety Review 2017 14 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2017 Field investigations Factors for field investigations reported on by AAIB in 2017 In 2017 the AAIB reported on 38 field investigations, 16 of which were fatal accidents in the UK and 22 were non-fatal accidents or serious incidents. The analysis of the CICTT factors for each of these reveal that the overall major factor in fatal accidents reported on in 2017 was LOC-I. The 22 non-fatal field investigations that were reported on in 2017 were mostly on serious incidents to commercial air transport (CAT) aircraft. The majority of CAT serious incidents were attributed to other followed by system/component failure or malfunction non powerplant (SCF-NP). However, in general aviation (GA) private flying, the statistics show the most prolific cause of accidents and serious incidents was again LOC-I. OTHR ARC SCF-NP LOC-I LOC-G SCF-PP RE CTOL TURB F-NI CFIT ICE UNK F-POST MED MAC See Appendix 1 for category descriptions 14 11 10 4 3 3 2 2 2 2 2

Air Accidents Investigation Branch Annual Safety Review 2017 15 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2017 Correspondence investigations Factors for correspondence investigations reported on by AAIB in 2017 Correspondence investigations are usually conducted on non-fatal accidents on GA aircraft and to some serious incidents on CAT aircraft. The factors most predominant in these occurrences were classified as other followed by abnormal contact with the ground (ARC). OTHR ARC SCF-NP LOC-I LOC-G SCF-PP RE CTOL GCOL TURB F-NI CFIT ICE UNK ADRM FUEL F-... WSTRW NAV M... MAC RAMP LA... AM... BIRD See Appendix 1 for category descriptions 80 65 45 37 36 31 30 16 11 9

Air Accidents Investigation Branch Annual Safety Review 2017 16 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2017 Fatal investigations Factors for fatal investigations reported on by AAIB in 2017

The predominant cause of fatal accidents in general aviation, in common with previous years, was loss of control in flight (LOC-I). The article at the beginning of this Annual Safety Review explores the reasons behind this in more detail.

OTHR ARC SCF-NP LOC-I SCF-PP RE CTOL CFIT ICE F-POST MED MAC See Appendix 1 for category descriptions 9 4 3 2 2 1 1 1 1 1 1 1

Air Accidents Investigation Branch Annual Safety Review 2017 AAIB Air Accidents Investigation Branch 17 © Crown copyright 2016 www.aaib.gov.uk @aaibgovuk Aircraft Accident Reporting - Telephone number +44 (0)1252 512299 Statistics for 2017 An overview of what we were involved with during 2017 can be seen below: UK Registered Overseas 44 Average months to publication for a Field Investigation 8.9 2.3 Average months to publication for a Correspondence Investigation Number of Safety Studies published 0 Number of Correspondence Investigation Reports published 220 Correspondence (AARF) Investigations opened 204 Number of Safety Recommendations 29 Referred to Sporting Associations 52 Joint Military & Civil Aircraft 0 Number of Field Reports published 35 Overseas (no AAIB involvement) 9 Military (AAIB assistance) 1 Military (no AAIB involvement) 1 UK Fatal Accidents 16 Number of Deaths 28 Foreign Registered Overseas 61 Number of Formal Reports published 1 No further AAIB action (Civil) 298 Number of Special Bulletins published 3 UK Field Investigations opened 38 17.4 Average months to publication for a Formal Investigation Total Number of Notifications received by the AAIB 708 Number of Safety Actions noted 99 Investigation Statistics

Air Accidents Investigation Branch Annual Safety Review 2017 18 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Introduction The following pages provide the statistics for 2017, 2016 and 2015, for accidents and serious incidents involving the Air Accidents Investigation Branch. An explanation of the categories is as follows: Category Definition UK Aircraft overseas Investigations involving UK registered aircraft, or aircraft registered in one of the UK Overseas Territories or Crown Dependencies, occurring in a Foreign State where the AAIB has participated in the capacity as the Accredited Representative in accordance with ICAO Annex 13. Foreign Aircraft overseas Accidents and serious incident investigations to Foreign registered aircraft occurring in a Foreign State where the AAIB has participated in the capacity as the Accredited Representative or Expert in accordance with ICAO Annex 13. UK Field Investigations Investigations involving the deployment of a ‘Field’ team within the UK or to one of the UK Overseas Territories or Crown Dependencies and those investigations where a team has not deployed but Safety Recommendations are made. Also includes investigations which have been delegated to the AAIB by another State. Military with AAIB Assistance Where an MoD Service Inquiry is convened following an accident / serious incident to a Military aircraft and an AAIB Inspector is appointed to assist. AARF Investigations Investigations conducted by correspondence only using an Aircraft Accident Report Form (AARF) completed by the aircraft commander. Overseas (no AAIB) Notifications to the AAIB of an overseas event which has no AAIB involvement. Referrals to Sporting Investigations referred to the relevant UK Sporting Associations. Associations No further AAIB action (Civil) Occurrences notified to the AAIB involving civil registered aircraft which do not satisfy the criteria of an accident or serious incident in accordance with the Regulations. Military (no AAIB inv) Notifications to the AAIB concerning Military aircraft with no AAIB involvement.

Air Accidents Investigation Branch Annual Safety Review 2017 19 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics UK Registered Overseas 6% Foreign Reg Overseas 9% UK Field Investigation 6% Military (AAIB assist) 0% Correspondence Investigation   (AARF) 29% Overseas (no AAIB involvement) 1% Referred to the appropriate Aviation  Sporting Association 7% Non‐reportable (Civil) 42% Non‐reportable (Military) 0% Notifications 2017 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 5 4 3 4 5 4 6 2 5 4 2 0 44 Foreign Reg Overseas 3 3 4 9 6 7 8 4 5 2 3 7 61 UK Field Investigations 2 3 4 2 6 3 2 4 5 1 2 4 38 Military (AAIB Assistance) 0 0 0 0 0 1 0 0 0 0 0 0 1 Correspondence Investigations (AARF) 9 7 15 15 36 29 24 25 17 11 10 6 204 Overseas (no AAIB involvement) 2 1 0 1 0 0 1 1 1 1 0 1 9 Referred to the appropriate Aviation Sporting Association 4 2 1 5 9 9 4 9 3 2 2 2 52 No further AAIB action (civil) 15 19 24 22 22 29 33 27 32 34 18 23 298 Military (no AAIB involvement) 0 1 0 0 0 0 0 0 0 0 0 0 1 Total 40 40 51 58 84 82 78 72 69 55 37 43 708 UK Fatal accidents 1 0 1 1 3 2 1 1 3 0 1 2 16 Number of deaths 1 0 5 1 4 2 2 2 4 0 4 3 28

Air Accidents Investigation Branch Annual Safety Review 2017 20 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Notifications 2016 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 5 3 5 6 6 4 6 4 2 4 3 2 50 Foreign Reg Overseas 1 5 4 7 4 9 3 5 18 8 6 4 74 UK Field Investigations 3 2 2 2 1 3 8 3 3 4 2 5 38 Military (AAIB Assistance) 0 0 0 0 0 0 0 1 0 0 0 0 1 Correspondence Investigations (AARF) 9 15 10 16 19 25 27 31 22 16 8 10 208 Overseas (no AAIB involvement) 1 2 1 1 0 0 0 0 0 2 0 0 7 Referred to the appropriate Aviation Sporting Association 1 2 3 4 4 3 5 9 8 4 0 1 44 No further AAIB action (civil) 18 12 19 20 22 27 29 23 21 11 15 14 231 Military (no AAIB involvement) 0 0 0 1 0 0 0 1 0 0 0 1 3 Total 38 41 44 57 56 71 78 77 74 49 34 37 656 UK Fatal accidents 0 0 1 1 1 1 4 1 1 2 0 2 14 Number of deaths 0 0 1 2 2 2 4 1 2 2 0 2 18 UK Registered Overseas 8% Foreign Reg Overseas 11% UK Field Investigation 6% Military (AAIB assist) 0% Correspondence Investigation   (AARF) 32% Overseas (no AAIB involvement) 1% Referred to the appropriate Aviation  Sporting Association 7% Non‐reportable (Civil) 35% Non‐reportable (Military) 0%

Air Accidents Investigation Branch Annual Safety Review 2017 21 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Notifications 2015 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 4 1 0 1 6 4 10 4 4 1 1 3 39 Foreign Reg Overseas 5 2 4 3 5 4 8 6 4 3 4 3 51 UK Field Investigations 3 1 1 5 1 5 5 4 2 3 3 1 32 Military (AAIB Assistance) 1 0 0 0 0 0 0 0 0 1 0 0 2 Correspondence Investigations (AARF) 11 7 12 24 16 29 24 20 27 12 7 5 194 Overseas (no AAIB involvement) 1 3 0 0 1 0 0 1 1 1 0 0 8 Referred to the appropriate Aviation Sporting Association 0 5 2 1 7 3 11 11 8 2 0 0 50 No further AAIB action (civil) 24 15 15 24 15 13 21 15 26 16 17 13 214 Military (no AAIB involvement) 0 0 1 0 0 2 0 0 1 2 0 0 6 Total 49 34 35 58 51 58 79 61 73 41 32 25 596 UK Fatal accidents 1 0 0 3 1 3 2 3 1 2 1 1 18 Number of deaths 2 0 0 4 2 3 6 13 1 3 4 1 39 UK Registered Overseas 7% Foreign Reg Overseas 9% UK Field Investigation 5% Military (AAIB assist) 0% Correspondence Investigation   (AARF) 33% Overseas (no AAIB  involvement) 1% Referred to the appropriate  Aviation Sporting Association 8% Non‐reportable (Civil) 36% Non‐reportable (Military) 1%

Air Accidents Investigation Branch Annual Safety Review 2017 22 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Inspector at accident site of Boeing 737-500, VQ-BBN Kazan International Airport, Kazan, Russia 17 November 2013

Air Accidents Investigation Branch Annual Safety Review 2017 23 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendations in 2017 In 2017 the AAIB issued 29 Safety Recommendations from 8 investigations. 13 17 26 32 28 32 9 10 26 38 40 19 20 17 39 82 39 76 68 114 76 58 37 82 69 66 58 57 95 55 139 109 150 146 128 98 109 95 103 39 23 42 47 57 29 0 20 40 60 80 100 120 140 160 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 Each Safety Recommendation is classified using the SR Topic taxonomy defined by the European Network of Safety Investigation Authorities (ENCASIA) Working Group 6 (WG6) which the AAIB is a member. The majority of the Safety Recommendations were dealing with safety issues relating to aircraft operations and safety risk management. Each addressee to a Safety Recommendation has to respond within 90 days in accordance with European Regulation EU 996/2010 Article 18 and detail what actions have been taken or are under consideration and the time taken for their completion. If no actions are being considered by the addressee they have to provide their reasoning for the decision. On receipt the AAIB has 60 days in which to assess the response and to inform the addressee on whether it is adequate. If the reply is not adequate or partially adequate then to provide justification to the addressee. The responsibility to monitor the progress of action taken in response to a recommendation lies with the addressee including the authorities responsible for civil aviation safety. The AAIB will keep open Safety Recommendations where it expects to receive responses from the addressee. If no further response is expected the recommendation is closed. A closed status does not necessarily mean the actions for a Safety Recommendation are complete, nor that the Safety Issue has been addressed.

Air Accidents Investigation Branch Annual Safety Review 2017 24 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview The chart above shows the recommendation topics. It should be noted that a recommendation can encompass several topics within the classification system. A ‘Not adequate’ assessment means that the response does not address the intent of the Safety Recommendation nor does it address the safety issue concerned. A ‘Partially adequate’ assessment means the response goes someway to meeting the intent of the Safety Recommendation and the action will address the safety issue to a certain extent, but further action would be required to fully address the issue identified. An ‘Adequate’ assessment means that the response fully meets the intent of the Safety Recommendation and the action is expected to address the safety issue. Of the 29 Safety Recommendations issued in 2017, as of the end of February 2018, responses have been received for 21. In assessing the responses, 15 were adequate and closed, 5 were partially adequate and 1 was not adequate. Following the assessment, 16 Safety Recommendations from 2017 were closed, 11 remain open. The AAIB is awaiting responses from addressees for 5 of the open Safety Recommendations. Responses have recently been received for two Recommendations and are pending AAIB classification. Each Safety Recommendation is also defined as to whether it is a Safety Recommendation of European Union Wide Relevance (SRUR) or a Safety Recommendation of Global Concern (SRGC). Of those issued in 2017, 6 were SRUR and 3 were SRGC. The AAIB, as well as all EU Member States, is required to record on the European Central Repository Safety Recommendation Information System (SRIS) all recommendations it raises and the response that are received. Data from SRIS is available to view publically at: http://eccairsportal.jrc.ec.europa.eu/index.php?id=114&no_cache=1 Safety Recommendation Topics 22 7 6 4 3 3 3 3 3 2 2 1 1 1 1 1 1 1 1 Procedures / Regulations - Aircraft operations Personnel - Training / proficiency / check Aircraft / Equipment / Facilities - Aircraft equipment - Aircraft systems QMS/SMS/SSP - Safety assurance Aircraft / Equipment / Facilities - Aircraft equipment - Powerplant Aircraft / Equipment / Facilities - Aircraft equipment - Safety equipment Personnel - Medical / Human Factors QMS/SMS/SSP - Safety risk management Procedures / Regulations - Aircraft maintenance/inspection QMS/SMS/SSP - Safety policy and objectives Procedures / Regulations - Oversight/Auditing Personnel - Other Procedures / Regulations - Aircraft dispatch Aircraft / Equipment / Facilities - Aircraft equipment Procedures / Regulations - Aircraft certification Procedures / Regulations - Design/Production/Manufacturing Procedures / Regulations - Rescue Fire Fighting Services Procedures / Regulations - Search and Rescue QMS/SMS/SSP - Safety promotion 0 5 10 15 20 25

Air Accidents Investigation Branch Annual Safety Review 2017 25 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendations issued in 2017

Notes: Safety Recommendation classification correct at time of publication. Safety Recommendations can also be made through AAIB Special Bulletins and are then also reflected in the final report. Reflects the situation with Safety Recommendatations at 28 February 2018. Safety Recommendation 2017-001 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority amend CAP 403 to clarify the point at which an aerobatic manoeuvre is considered to have been entered and the minimum height at which any part of it may be flown. Adequate - Closed Safety Recommendation 2017-002 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority require pilots intending to conduct aerobatics at flying displays to be trained in performing relevant escape manoeuvres and require that their knowledge and ability to perform such manoeuvres should be assessed as part of the display authorisation process. Adequate - Closed Safety Recommendation 2017-003 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority review the grouping of aircraft types in display authorisations to account for handling and performance differences it considers significant. Adequate - Closed Safety Recommendation 2017-004 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority remind operators, whose activities are subject to the guidance published in Civil Aviation Publication 632, of the need to maintain detailed training records for pilots and check their compliance during inspections it carries out. Adequate - Closed

Air Accidents Investigation Branch Annual Safety Review 2017 26 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Recommendation 2017-005 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority specify that the flight demonstration requirement of a display authorisation evaluation, other than to assess formation following, cannot be satisfied by the pilot following another aircraft during the evaluation. Adequate - Closed Safety Recommendation 2017-006 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority undertake a study of error paths that lead to flying display accidents and integrate its findings into the human factors training it requires the holders of display authorisations to undertake. Response Received - pending AAIB classification Safety Recommendation 2017-007 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority review the arrangements for safety regulation and oversight of intermediate and complex ex-military aircraft operated in accordance with Civil Aviation Publication 632, to ensure that they are consistent and appropriate. Partially Adequate - Open Safety Recommendation 2017-008 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority consider implementing the changes outlined in Health and Safety Laboratory report MSU/2016/13 ‘Review of the risk assessment sections of CAP 403’. Adequate - Closed Safety Recommendation 2017-009 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority require operators of aircraft used for flying displays to identify, and where practicable remove, any hazardous materials. Adequate - Closed

Air Accidents Investigation Branch Annual Safety Review 2017 27 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendation 2017-010 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Civil Aviation Authority prohibit the use of phenolic asbestos drop tanks on civil registered aircraft. Partially Adequate - Open Safety Recommendation 2017-011 made on 24 February 2017 G-BXFI Hawker Hunter T7 on 22 August 2015 It is recommended that the Department for Transport commission, and report the findings of, an independent review of the governance of flying display activity in the United Kingdom, to determine the form of governance that will achieve the level of safety it requires. Partially Adequate - Open Safety Recommendation 2017-012 made on 2 June 2017 G-KAXT Westland Wasp HAS1 on 23 September 2016 It is recommended that, for ex-military aircraft on the UK civil register, the Civil Aviation Authority requires maintenance and overhaul tasks to be reviewed in the light of the expected aircraft utilisation and calendar-based time limits introduced where appropriate. Where such calendar-based time limits already exist, these should be reviewed to ensure that they are appropriate for the aircraft utilisation. Adequate - Closed Safety Recommendation 2017-013 made on 7 September 2017 G-BDZC Reims Cessna F150M on 17 October 2016 It is recommended that the Civil Aviation Authority promulgates to flying instructors the need for specific training to highlight the differences between the C150 and C152 flap switch designs. Training should also include the effect on aircraft performance and handling of Flap 40°. Adequate - Closed Flap selector switch

Air Accidents Investigation Branch Annual Safety Review 2017 28 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Recommendation 2017-014 made on 8 September 2017 G-PRPC DHC-8-402 on 14 December 2016 It is recommended that Flybe Ltd introduces defined and consistently delivered flight crew training on pre‑departure inspections for the DHC-8-402 (Q400), compliant with the inspection procedure documented in its Operations Manual. This should include a practical element on the aircraft and a demonstration of correctly secured main engine access panels. Adequate - Closed Safety Recommendation 2017-015 made on 8 September 2017 G-PRPC DHC-8-402 on 14 December 2016 It is recommended that Flybe Ltd considers introducing a means of disseminating pertinent safety information to ground operations staff in an appropriate format. Adequate - Closed Safety Recommendation 2017-016 made on 20 September 2017 C-FWGH Boeing 737-86J on 21 July 2017 It is recommended that the Federal Aviation Administration, mandate the use of Flight Management Computer software revision U12.0, or later revision incorporating the outside air temperature crosscheck, for operators of Boeing 737 Next Generation aircraft. Partially Adequate - Open Safety Recommendation 2017-017 made on 20 September 2017 C-FWGH Boeing 737-86J on 21 July 2017 It is recommended that The Boeing Company promulgates to all 737 operators the information contained within this Special Bulletin and reminds them of previous similar occurrences reported in the Boeing 737 Flight Crew Operations Manual Bulletin dated December 2014. Response Received - pending AAIB classification

Air Accidents Investigation Branch Annual Safety Review 2017 29 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendation 2017-018 made on 25 September 2017 G-GSGS Glasflugel 304 ES on 10 August 2017 It is recommended that the European Aviation Safety Agency (EASA) requires that all powered sailplanes, operating under either an EASA Restricted Type Certificate, or an EASA Permit to Fly, and fitted with a Front Electric Sustainer (FES) system, are equipped with a warning system to alert the pilot to the presence of a fire or other hazardous condition in the FES battery compartment. Adequate - Closed Safety Recommendation 2017-019 made on 25 September 2017 G-GSGS Glasflugel 304 ES on 10 August 2017 It is recommended that Alisport Srl modifies the Silent 2 Electro microlight to incorporate a warning system to alert the pilot to the presence of a fire or other hazardous condition in the Front Electric Sustainer (FES) battery compartment. Adequate - Closed Safety Recommendation 2017-020 made on 25 September 2017 G-GSGS Glasflugel 304 ES on 10 August 2017 It is recommended that Albastar d.o.o. modifies the AS13.5m Front Electric Sustainer (FES) microlight to incorporate a warning system to alert the pilot to the presence of a fire or other hazardous condition in the FES battery compartment. Partially Adequate - Open Safety Recommendation 2017-021 made on 9 November 2017 G-YAKB YAK-52 on 8 July 2016 The Civil Aviation Authority should review the maintenance requirements for seat belts and harnesses, and, if necessary, revise the maintenance requirements to ensure that seat belts and harnesses remain in a condition with an acceptable residual strength. Adequate - Closed

Air Accidents Investigation Branch Annual Safety Review 2017 30 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Recommendation 2017-022 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the Federal Aviation Administration mandate Service Bulletin GTCP331-49-7936 to add a system that shuts down the APU automatically if there is contamination of the lubricating oil. Response Awaited – Open Safety Recommendation 2017-023 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the European Aviation Safety Agency mandate Service Bulletin GTCP331-49-7936 to add a system that shuts down the APU automatically if there is contamination of the lubricating oil. Not Adequate - Open Safety Recommendation 2017-024 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the Federal Aviation Administration regulate the operation of interphone handsets, including during emergency communications, so that it is standardised irrespective of aircraft type. Response Awaited - Open Safety Recommendation 2017-025 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the European Aviation Safety Agency regulate the operation of interphone handsets, including during emergency communications, so that it is standardised irrespective of aircraft type. Partially Adequate - Closed Safety Recommendation 2017-026 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the Federal Aviation Administration reconsider the requirements for briefings given to passengers seated at exits, to ensure they offer appropriate guidance on exiting the aircraft rapidly in an emergency without implying undue responsibility for opening the exits. Response Awaited - Open

Air Accidents Investigation Branch Annual Safety Review 2017 31 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendation 2017-027 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the Federal Aviation Administration require cabin crew on aircraft that are parked, and with passengers on-board who are neither boarding nor deplaning, to be evenly distributed throughout the cabin and in the vicinity of floor-level exits in order to provide the most effective assistance in the event of an emergency. Response Awaited - Open Safety Recommendation 2017-028 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the European Aviation Safety Agency require cabin crew on aircraft that are parked and with passengers on-board to be evenly distributed throughout the cabin and in the vicinity of floor-level exits, in order to provide the most effective assistance in the event of an emergency. Adequate - Closed Safety Recommendation 2017-029 made on 7 December 2017 N276AY Airbus A330-323 on 26 June 2016 It is recommended that the Federal Aviation Administration require that flight and cabin crew participate in joint training to enhance their co-ordination when dealing with emergencies. Response Awaited - Open

Air Accidents Investigation Branch Annual Safety Review 2017 32 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Actions from investigations reported on in 2017 Early in an investigation the AAIB will engage with authorities and organisations which are directly involved and have the ability to act upon any identified safety issues. The intention is to prevent recurrence and to that end to encourage proactive action whilst the investigation is ongoing and not for those involved to wait for the issue of official Safety Recommendations. When safety action is taken, it may mean there is no need to raise a Safety Recommendation as the safety issue may have been addressed. However, if the issue remains then a Safety Recommendation will be raised. The published report details the safety issues and the safety action that has taken place, usually with a green highlight. In 2017 safety actions directly as a result of AAIB investigations were recorded on two formal investigations, eighteen field investigations and seventeen correspondence investigations. SPECIAL BULLETIN Sikorsky S-92A, G-WNSR on 28 December 2016 Safety issue – HUMS procedures, component failure, airworthiness The operator The operator has subsequently introduced a number of measures to further strengthen the ability to detect impending bearing degradation. These include: a review of all HUMS data to ensure no anomalies, fleet-wide borescope inspections, a requirement for HUMS to be serviceable before flight and the time between HUMS download/analysis reduced to a maximum of 5 hours. The operator has also reviewed their HUMS processes and analytical procedures and introduced a requirement to carry out an additional assurance check. The helicopter manufacturer On 31 December 2016, the helicopter manufacturer issued to all operators an ‘All Operators Letter’ (AOL), CCS-92-AOL-16-0019, which described the event. It emphasises the use of the HUMS Tail Gearbox Bearing Energy Tool, provided on the ground station, which will detect a TRPCS bearing that is experiencing degradation, and recommends that this Tool should be utilised as often as reasonably possible. This was followed by an Alert Service Bulletin (ASB) issued by the manufacturer on 10 January 2017. ASB 92-64-011 introduces a one- time inspection of the TRPCS and bearing assembly for ratcheting, binding, or rough turning. The manufacturer has recommended that compliance is essential and is to be accomplished prior to the next flight from a maintenance facility; three flight hours are

Air Accidents Investigation Branch Annual Safety Review 2017 33 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview allowed in order to return directly to a maintenance facility. Concurrent with the release of ASB 92-64-011, the manufacturer published Temporary Revision  45-03 to require operators to use S-92 HUMS ground station software to review Tail Rotor Gearbox energy analysis Condition Indicators for alert conditions on a reduced flight hour interval. Records in excess of published alert levels require inspection of the pitch change shaft and bearing. FIELD INVESTIGATIONS Hawker Sea Fury T Mk 20, G-RNHF on 31 July 2014 Safety issue – Historic aircraft airworthiness and maintenance Various marks of the Centaurus engine are still in use in a small number of aircraft but findings in this case could equally apply to other radial and inline aero-engine types. Based on this, the CAA has undertaken to publish a Safety Notice aimed at the historic aircraft community, to draw attention to the issues and difficulties of maintaining airworthiness of aging aircraft engines and their associated components. Saab 2000, G-LGNR on 6 November 2015 Safety issue – checklist unintended result, reduced control The manufacturer stated that it intended to add the following to the ‘Aileron system open failure’ section of the malfunction checklist at the next AOM revision: “NOTE: Verify an open failure by visually observing that one of the ailerons do not follow control wheel input.” ATR 72-212 A, G-COBO on 4 March 2016 Safety issue – effects of icing, pre-flight inspection and training The ATO responsible for the pilot’s type conversion training is adjusting its conversion course to align with the EASA Operational Suitability Data report. This is being achieved by incorporating the manufacturer’s simulator profile for a badly de-iced tailplane. The operator has enhanced its winter awareness training for pilots by purchasing a computer-based training module. All pilots will complete this before each winter season and their knowledge will be tested as part of the process. The operator’s conversion courses are being extended through the inclusion of a ground training day, with a training captain, prior to the start of Line Flying Under Supervision. This is to ensure time is spent discussing, in detail, technical issues relating to line operations. Winter operations and de-icing/anti- icing will be among the topics covered.

Air Accidents Investigation Branch Annual Safety Review 2017 34 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview The operator provided the co-pilot with additional training before he was allowed to resume line flying duties. The operator is reviewing its requirements for aircraft inspections following use of thickened de-icing fluids. The operator intends to provide better guidance for the aftermath of a serious incident by making changes to its Operations Manual (Part A). This is likely to include a recommendation for a group debrief to take place as a matter of course, so the crew can discuss what happened and what they have learnt. The manufacturer has stated it will contact all operators prior to the start of the next European winter, to promote awareness of the circumstances which led to this serious incident. Airbus A319-111, G-EZFJ on 14 April 2016 Safety issue – EFB software anomaly, potential cockpit display confusion ● ●The operator sent an email to all pilots on 22 April 2016 highlighting this specific anomaly. ● ●The MRC function was disabled across the operator’s fleet in May 2016. ● ●The operator has reviewed and proposed further modification to their SOPs. ● ●In the L6.x versions of FlySmart, it has been verified by the manufacturer that the MRC function is not affected by this anomaly. ● ●The manufacturer has sent Flysmart Communication reference X46D16018565 to operators highlighting the anomaly discovered during this investigation and recommending that the affected operators disable the MRC option. ● ●The manufacturer sent Flight Operations Transmission (FOT) 999.0095/16 to all operators reminding them of the manufacturer’s recommended procedures for EFB use. This involves each crew member performing their own independent calculations, the results of which are then cross-checked. Dropdown box for single runway selection ‘CONDITIONS’ entry area Runway selection area

Air Accidents Investigation Branch Annual Safety Review 2017 35 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Rans S6-ESD (Modified) Coyote II, G-MYES on 30 May 2016 Safety issue – Low speed handling, pilot information and airfield markings As a result of the rate of stall/spin accidents involving Rans S6 aircraft in the UK, the LAA has undertaken to conduct a safety review encompassing the following aspects: ● ●‘Complete a review of accident data with the type to date, including consideration of the aircraft configuration, weights and cg positions, mission and pilot profiles of those involved, including a comparison with the accident data for similar types of microlight ● ●Carry out a flight test program on at least two representative examples, to investigate possible handling, performance or other factors that might contribute to an elevated accident rate, including: • Longitudinal stability • Ability to trim (in pitch) • Longitudinal and lateral/directional trim changes with changes in power and configuration (i.e. flap position) • Directional stability and control, including contributing effects of adverse yaw with aileron input, and any contributing ergonomic aspects • Pre-stall warning • Stall characteristics • Ease of operation of controls • Adequacy of low-speed stall recovery/ climb performance at different weights and centre of gravity positions • Behaviour in a simulated engine failure • Instrumentation, in particular, adequacy of indication of airspeed and slip’ The LAA has advised that the applicable paragraphs of BCAR Section S, both current and extant at the time the type was introduced to the UK, are being used as the basis for this evaluation. The results of the safety review will be communicated to all Rans S6 pilots within the LAA membership The LAA has also undertaken to produce a series of pilot’s notes for the Rans S6, tailored to each airframe/engine combination on the UK fleet, on completion of the flight tests. The relevant Rans S6 TADS will be updated accordingly. Flying club Recognising the possibility of future confusion, the flying club at Shifnal Airfield reported that it had removed the landing T and signal square, to prevent incorrect signals being displayed. Throttle cable (note 90o bend) Throttle valve (not visible) Throttle valve actuation Mounting bracket

Air Accidents Investigation Branch Annual Safety Review 2017 36 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Airbus A330-323, N276AY on 26 June 2016 Safety issue – Emergency evacuation procedures, master minimum equipment list (MMEL) guidance and component maintenance policy Operator All pilots were informed that an evacuation should only be halted by the commander if he ‘has clear information that continuation of the evacuation would cause greater injury’. Studies of the interphone equipment on different aircraft types confirmed a need to refine the communication process on certain types. On the Airbus A319, A320, A321 or A330-300, FAs should now press the emer call button once to contact the flight deck in an emergency. On the Airbus A330‑200 they should press the prio capt button and on the Embraer E190 the emer pilot button. A video was produced with the co-operation of the crew involved in this occurrence, to highlight the issues they experienced. This video is being used as an educational tool for all pilots during their recurrent Human Factors (HF) training, for the nine month cycle commencing 1 February 2017. It may also become possible to use this video during FA training. A type-specific ’Emergency Deplaning’ drill has been developed for use by pilots on each of the operator’s aircraft types and incorporated into the OM and the appropriate QRH. This drill is relevant to parked aircraft that are using a jetbridge or steps. Details were promulgated to all crews and pilots received relevant simulator training. As there is no commonality between the cabin interphone handsets on different aircraft types, a physical training aid is being developed for use during initial and recurrent FA training. This is intended to give FAs a better understanding of the differences they will encounter and to help them adapt to any of the 14 aircraft types or variants on which they can be qualified. Recurrent HF training for the aircraft operator’s 12,000 pilots takes place on a 9 month cycle. The 27,000 FAs are on a 12 month cycle. This makes it difficult to conduct joint evacuation training with entire crews, so the operator is considering having pilot representatives participate in FA training and vice-versa. Future recurrent training for both pilots and FAs will focus on unplanned cabin evacuations when the aircraft is not on the runway. The Continuing Qualification training given to all FAs between April 2017 and March 2018 includes a review of an ‘Emergency Deplaning’ and it is likely attendees will hear the specific aural alert signals for each aircraft type.

Air Accidents Investigation Branch Annual Safety Review 2017 37 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview The operator expects a company safety investigator to contact the commander by telephone as soon as its ‘Dispatch’ department has been advised of a serious incident or accident. The safety investigator is now required to remind the commander during this contact that action be taken to ensure the circuit breaker for the CVR is pulled without delay. Training procedures were developed for the aircraft operator’s ramp personnel, to ensure they know how best to react if a slide evacuation occurs while an aircraft is parked. Twice a year, US operators, along with some foreign airlines that operate to the US, share experiences at a safety forum. The operator intends to discuss issues raised by this event at such a forum; to raise the industry’s awareness of the challenges that can be created by a cabin evacuation from a parked aircraft. Aircraft manufacturer The aircraft manufacturer has reviewed and amended the MMEL section 24-23-01, for the dispatch of an aircraft with APU AC auxiliary generation unserviceable and a summary of these changes is as follows: MMEL item 24-23-01A ‘APU not used’: No change, as not relevant to the event. MMEL item 24-23-01B ‘Electrical failure’: To insure a more robust detection of a mechanical failure, a review has been conducted with the APU Generator supplier and the following 4 failure messages will be added to the list from the AMM task 24‑23‑00‑040-803. GEN APU (8XS) GEN APU (8XS) EX FLD / GAPCU (40XG) GAPCU (40XG) EX FLD / GEN APU (8XS) GEN APU (8XS) EX FLD / GAPCU (40XG) If any of these messages is present in the PFR when doing the interactive APU test, then the MMEL 24-23-01C must be applied. MMEL item 24-23-01C ‘AC auxiliary generation deactivated or removed (mechanical failure)’: An update of the related AMM tasks (e.g. 24-23-00-040-801 and -802) has been decided, to prevent oil cross-contamination from the APU Gen to the APU. The AMM TASK 49-91-41-210-802-A “Check of the APU Oil System for APU Generator

Air Accidents Investigation Branch Annual Safety Review 2017 38 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Debris” has been added at the end of those tasks, and must be carried out prior to aircraft dispatch. This AMM task includes a physical check of the APU oil system (inlet screens of the scavenge-oil, inspection of the magnetic chip detectors and the mechanical differential pressure indicator, check of the lubrication oil supply and generator scavenge filters). Yak-52, G-YAKB on 8 July 2016 Safety issue – Smaller (less than 400 hp) historic engines overhaul policy The CAA have stated that they are conducting a review of engine maintenance to determine if Leaflet 70-80 should be extended to all piston engines and whether any Alternative Means (Methods) of Compliance arising from Leaflet 70-80 should be made mandatory by means of a Mandatory Permit Directive (MPD). This will also include a review of Generic Requirement No. 24 in CAP 747. Druine D.31 Turbulent, G-ARNZ on 14 August 2016 Safety issue – Aircraft system design The operators of the aircraft developed a modification to fit a screen to the engine’s carburettor intake, with the intention of preventing the ingress of similar debris to the balloon fragment. Should this screen become blocked, air can still be supplied to the carburettor via the alternative hot air supply, thereby allowing the engine to operate normally. After satisfactory testing, the modification was approved by the Light Aircraft Association. Spitfire IXT, G-LFIX on 15 September 2016 Safety issue – Cockpit indicator visibility In order to prevent the illumination of the complete word “DOWN” in the landing gear position indicator in the event that one landing gear has not achieved the fully locked position, the maintenance organisation modified the landing gear indicator to prevent light from either of the indicator bulbs illuminating the complete down caption.

Air Accidents Investigation Branch Annual Safety Review 2017 39 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Westland Wasp HAS1, G-KAXT on 23 September 2016 Safety issue – Continued airworthiness of historic aircraft and servicing policy The investigation findings were highlighted to the CAA at an early stage. The CAA took urgent action to ensure the continued airworthiness of Westland Wasp and Scout helicopters on the UK register by issuing Emergency Mandatory Permit Directive (EMPD) No 2017‑002‑E. (http://publicapps.caa.co.uk/modalapplication. aspx?appid=11&mode=detail&id=7759) The EMPD requires operators to perform a visual check of the condition of the universal joint and conduct periodic lubrication of the joint. Airbus A319-131, G-EUPM on 19 October 2016 Safety issue – CVR/FDR data preservation Following this event, the operator of G-EUPM made changes to its procedures to ensure that the commander is aware of his responsibility to ensure that the recordings are preserved. Airbus A320-214, G-EZWX on 28 November 2016 Safety issue - Component malfunction, OEM information and crew awareness ● ●By 9 December 2016, the operator of G-EZWX had removed all affected static inverters from its fleet and those that were held as spares. ● ●The operator’s engineering department is now reviewing all TFUs on a routine basis. Further safety action ● ●The aircraft manufacturer has advised that, later in 2017, it will release an Inspection Service Bulletin (ISB) to assist operators in identifying and rectifying any of the affected static inverters. ● ●The aircraft manufacturer has also advised that it will provide additional information to operators on the operation of the emergency interphone system. ● ●The operator has advised that, following the provision of the additional information of the emergency interphone system from the aircraft manufacturer, it will include this as part of crew training and update the appropriate internal manuals. ● ●The operator has also advised that it intends to conduct a review of its processes that relate to VSBs.

Air Accidents Investigation Branch Annual Safety Review 2017 40 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview ATR 72-212 A, 500 Version, G-COBO on 21 December 2016 Safety issue – Operating procedures, crew response Operator The operator reviewed its ATR procedures and amended them to improve safeguards against similar occurrences. Flight crews were reminded of the required response to APM cautions, and the operator now replicates this incident, and APM messages, during pilots’ flight simulator training. Several internal recommendations were made, addressing non-normal situation handling in general. The following FLYING STAFF INSTRUCTION – ATR was issued on 28 December 2016, with an amendment to the ATR Operations Manual Part B, Section 2.4: ‘2.4.16.2 Climb Speed Standard Climb Speed is 170 kt IAS or Red Bug + 10 kt, whichever is the higher, achieved using AFCS [Automatic Flight Control System] IAS mode. Climb speed may only be reduced below 170 knots if required for terrain clearance or mandatory ATC requirements. Under these circumstances the minimum IAS is White Bug + 10 kt in Normal Conditions and Red Bug + 10 kt in Icing Conditions. … If during climb at Standard Climb Speed the average rate of climb falls below 500 feet per minute, crews should request to stop climb at the next available level or advise ATC of the reduced climb capability. Speed must not be reduced to maintain a given rate of climb.’ The following memo was sent to all ATR pilots: ‘APM / Reduced Performance Crews are also reminded that Severe Icing may be encountered without the presence of the normally associated visual cues, and reduced rate of climb or cruise airspeed are sometimes the only indication of significant ice accretion. Whenever crews encounter or suspect severe icing, the full checklist at QRH page 1.09 [Severe Icing] must be completed. Aircraft manufacturer The aircraft manufacturer stated that it is working to improve the APM to avoid the illumination of cautions that are perceived as spurious. As a result of this occurrence and that investigated by the AIBN the manufacturer has amended the DEGRADED PERF and SEVERE ICING procedures.

Air Accidents Investigation Branch Annual Safety Review 2017 41 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview The amended DEGRADED PERF procedure will state that the SEVERE ICING procedure should be actioned if the aircraft is unable to maintain a climb rate greater than 100 ft/min, when climbing at red bug +10 kt. The SEVERE ICING procedure will have fewer memory items and will state that, after IAS and engine power are increased and the autopilot is disconnected, a descent is to be initiated to escape the severe icing conditions. The amendments, in the appropriate documents, are due to be distributed to all operators in January 2018. The manufacturer of this aircraft, together with other aircraft manufacturers, has contributed to the update of the Airplane Upset Prevention and Recovery Training Aid (AUPRTA), Revision 3, which is available on ICAO website. This update includes information specific to turboprop aircraft. Boeing 737-36E Freighter, TF-BBF on 3 February 2017 Safety issue - Component failure The operator is replacing the V-band clamps at the failure location on TF-BBF across its fleet of 737-300 and 737-400 aircraft. This is being carried out on a rolling programme, as the aircraft undergo scheduled C-check maintenance inspections. The operator is also considering replacement of other V-band clamps on their aircraft where the release of bleed air may create a hazard. Europa, G-NDOL on 28 May 2017 Safety issue – Modification standard, system integrity On 19 July 2017, the LAA issued Airworthiness Information Leaflet LAA/MOD/247/010. This required a mandatory inspection, before next flight, of all Europa aircraft operating under an LAA administered Permit to Fly. The inspection was to check for the correct installation of a fuel vapour return line. Details can be found on the LAA website. CORRESPONDENCE INVESTIGATIONS Robinson R44 II, G-SAIG and Spitfire IXT, G-CCCA on 15 June 2016 Safety issue – airfield movements deconfliction After the accident, the Aerodrome Safety Manager issued a safety notice to the helicopter operator based at the airfield, requiring helicopters to hold short of the active runway and request clearance to cross. The A/G radio operator will then inform the helicopter pilot of any known traffic and the pilot, having checked it is safe to do so, may then cross the runway.

Air Accidents Investigation Branch Annual Safety Review 2017 42 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Europa XS, G-BYSA on 10 August 2016 Safety issue – Airfield information The airfield operator has informed the publishers of various flight guides that the runway width is now 10 m and requested that they include a warning to ‘Beware cliffs on the east side of the airfield’. The Light Aircraft Association included this accident in their October 2016 ‘Safety Spot’ feature to advise their members of the circumstances. Flight Design CTSW, G-CGVG on 8 October 2016 Safety issue – Airworthiness and NDT servicing policy In response to this accident the UK agent intends to issue Service Bulletin CT145, which requires removal and dye penetrant crack inspection of the main landing gear legs of all CT2K and CTSW aircraft at intervals of 300 flying hours. Service Bulletin CT145 will supersede SB CT123. Service Bulletin CT145 will also introduce modification M309, in which the edges of the main attachment hole in the legs are peened, leaving residual compression stress at the hole edges intended to supress fatigue crack initiation. Service Bulletin CT145 continues to include the requirement to inspect the legs for cracks and straightness following heavy landing events. Eurofox 912(LS), G-ODGC on 15 October 2016 Safety issue – Component fatigue, lifing policy and airworthiness As a result of the incident and discussions with the LAA, on 1 November 2016 the aircraft manufacturer issued Mandatory Service Bulletin, EuroFOX SB 03/2016 LAA (v2). This required the replacement of the landing gear mounting bolts within 20 flying hours of the release date of the Bulletin and introduced a 500 flying-hour mandatory life on the bolts. On 4 November 2016, the LAA published Airworthiness Alert LAA/AWA/16/07 which detailed the failure and alerted operators of the aircraft to the requirements of the Mandatory Service Bulletin. The incident was also publicised in the LAA’s November 2016 Safety Sense article.

Air Accidents Investigation Branch Annual Safety Review 2017 43 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview UAS Schiebel Camcopter S-100 (unregistered) on 18 October 2016 Safety issue – Human factors, workload and control logic The manufacturer has implemented a software change to reduce operator workload during takeoff. If the UA is on the ground and the trim mode has been selected: ● ●Operator thumb rocker climb-rate inputs between -50% and +50% produce an automatic climb rate command of +50% until the trim becomes active, and ● ●All cyclic joystick inputs are ignored until the trim becomes active. Dassault Falcon 7X, VQ-BSO on 24 November 2016 Safety issue – Aircraft ground handling and observation London City Airport identified the following safety actions:

1. The parking positions for the Falcon 7X should be identified and the position of

their main and nose wheels marked on the apron surface.

1. All the Jet Centre’s marshallers should receive refresher training on the correct

ICAO marshalling signals.

1. Marshalling wands must be used for all

manoeuvring not just at night or in reduced visibility.

1. Initially, marshallers and ‘wing walkers’ would

be equipped with belt mounted horns to provide an audio STOP signal. This would subsequently be replaced providing digital radios on a dedicated frequency.

1. A new supervisory level appointment would be

created to oversee all parking.’ Robin DR400/180 Regent, G-ETIV on 7 December 2016 Safety issue – CRM, spatial awareness and airfield knowledge Following an investigation, a safety action was taken at the airfield to ensure pilots are told the runway in use when they call on the radio prior to arrival. In May 2017, the CAA published CAP 1535, ‘The Skyway Code’ which is intended to provide General Aviation pilots involved in non‑commercial and flight training operations

Air Accidents Investigation Branch Annual Safety Review 2017 44 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview with practical guidance on the operational, safety and regulatory issues relevant to their flying. ‘The Skyway Code’ includes a section on the responsibilities of the Pilot in Command in a format which is intended to be more accessible than from regulatory documents. To further clarify the term ‘Safety Pilot’ when used with an ‘Operational Safety Pilot Limitation (OSL)’ placed on a Medical Certificate, the CAA will produce an article for ‘Clued Up’, its magazine for the general aviation community. Additionally, the CAA will also ask the General Aviation Safety Council (GASCO) to publish the same article in its Flight Safety Bulletin. DHC-8-402, Dash 8, G-FLBB on 8 December 2016 Safety issue – Component history and reliability The operator has expressed concerns over the reliability of the outflow valve and has initiated a reliability investigation involving the spare part provider and the OEM. At the time of writing the results of the reliability investigation are not known. Piper PA-28-181 Cherokee Archer II, G-BPAY on 29 December 2016 Safety issue – Ground movements, parking and observation Since the accident the airfield operator has changed its procedures to reduce the need for parallel rows of parked aircraft and therefore lessen the risk of ground collisions. Agusta AW139, G-VINB on 20 January 2017 Safety issue – Flight planning and CRM The operator carried out a prompt internal investigation into the incident and identified a number of potential safety actions. The following are of relevance to this report: Carry out a Flight Planning Software review for robustness and ease of use. Carry out a review of the destination nomenclatures used for planning applications and software. Reiterate to all crews the importance of clear and unambiguous communications. Reiterate to crews the importance of re-briefing all aspects of the flight when a significant change has been applied.’ The remaining sectors were completed without incident.

Air Accidents Investigation Branch Annual Safety Review 2017 45 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Bell 206B Jet Ranger III, G-BTHY on 19 February 2017 Safety issue – Air space use and NOTAM requirements The operator has advised its pilots of the potential hazard of high flying kites and the need to avoid areas where they suspect the activity is taking place. The CAA has been advised of the activity and an investigation is being conducted. The incident has also been reviewed by the CAA Safety Risk Panel. Airbus A320-214, G-EZTV on 3 March 2017 Safety issue – Aircraft ground handling procedures and equipment knowledge There have been several safety actions made by three organisations as a result of this accident. These are outlined below. The ground handling company has instigated several changes to its procedures and to personnel training, including: Improvements to towbar maintenance and inspection procedures. A training aid has been developed to help ground crew recognise when shear pins are unserviceable. A standard fault-finding procedure has been introduced for ground crews when they hear an unusual sound or suspect a shear pin has broken while pushing or pulling an aircraft. Improvements have been made to ground crew training to ensure that correct procedures for aircraft engine start are followed for each stand at Manchester. The airfield operator has issued safety alerts to airfield users regarding inspections and maintenance of pushback equipment and regarding stand-specific pushback procedures. The aircraft operator has reviewed its pushback procedures in response to the aircraft manufacturer’s comments.

Air Accidents Investigation Branch Annual Safety Review 2017 46 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Airbus A320-214, G-EZTM on 26 March 2017 Safety issue – Aircraft ground movements and support procedures The operator’s engineering department is reviewing the AMM task (324200710001-A Rev.55) and will make recommendations to the aircraft manufacturer to amend the AMM accordingly. The ground handling company has undertaken the following actions to prevent a recurrence:

1. Raised awareness of the event;
2. Retrained the staff involved concerning the correct chocking procedures;
3. The defective equipment local operating procedure has been re-issued to all

staff to prevent inoperative equipment being available for use. Agusta A109S Grand, G-PBWR on 5 May 2017 Safety issue – Airworthiness, left horizontal stabiliser failure Prompted by this event, the manufacturer issued a Service Bulletin providing new instructions for a one-time inspection and new repetitive inspections at a reduced inspection threshold and interval. As a result of this and its own safety assessment, EASA issued Emergency Airworthiness Directive AD 2017-0085-E, on 12 May 2017, to mandate these instructions. Reims Cessna F406 Caravan II, G-RVLX on 1 June 2017 Safety issue – Hatch and door security, crew aircraft knowledge The operator is taking the following safety actions: An email was sent to all crew to notify them of the event and to highlight correct door operation and security A fleet check of aircraft fitted with a similar door was carried out to ensure that both primary and secondary locks operated correctly. Placarding of the secondary handle will be improved to clearly identify when it is the locked position. A strap will be fitted to the emergency exit main handle to minimise the likelihood of it being inadvertently disturbed.

Air Accidents Investigation Branch Annual Safety Review 2017 47 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Cessna 510 Citation Mustang, OE-FHK on 15 June 2017 Safety issue – Aircraft system knowledge The aircraft operator has taken the following Safety Actions; A ‘Safety Bulletin’ to flight crew was circulated which stated that the parking brake is only to be set with the battery switch in the batt position and that the appropriate checklists are always to be followed. This notice also warns crew not to remove chocks if there are obstacles such as a fuel bowser nearby and states that trainee pilots are always to be accompanied by an experienced crew member while operating the aircraft. The SOPs were modified and additional guidance on operation of the parking brake and the use of wheel chocks was placed in the OM. Pilot training was revised to try to ensure a comprehensive understanding of the hydraulic system and the aircraft brakes. Quest Q-200 UAS on 12 July 2017 Safety issue - Commercial UAV operating procedures The operator has made the following procedural changes to minimise the probability of collisions with high obstacles on this and other construction sites: Construction site staff will be contacted, prior to launch, to check the height of the highest structure to ensure that sufficient clearance can be met. If this cannot be achieved that part of the site will not be overflown. Any flights that have the potential to overfly the construction site will be flown at 400 ft. Manual corrective action will be taken to manoeuvre the UA in the event of deviations from the flight plan. AW109SP Grand New, G-HLCM on 2 August 2017 Safety issue - Rotor blade integrity and airworthiness The manufacturer identified the main rotor blades that were potentially affected and issued Service Bulletin 109SP-116 to introduce a periodic inspection. The EASA issued Emergency Airworthiness Directive 2017-0176-E to mandate the requirements of the Service Bulletin.

Air Accidents Investigation Branch Annual Safety Review 2017 48 AAIB Air Accidents Investigation Branch © Crown copyright 2018 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Appendix 1 - CICITT Occurrence Categories CODE DESCRIPTION ARC ABNORMAL RUNWAY CONTACT AMAN ABRUPT MANEUVER ADRM AERODROME MAC AIRPROX/TCAS ALERT/LOSS OF SEPARATION/NEAR MIDAIR COLLISIONS/MIDAIR COLLISIONS ATM ATM/CNS BIRD BIRD CABIN CABIN SAFETY EVENTS CTOL COLLISION WITH OBSTACLE(S) DURING TAKEOFF AND LANDING CFIT CONTROLLED FLIGHT INTO OR TOWARD TERRAIN EVAC EVACUATION EXTL EXTERNAL LOAD RELATED OCCURRENCES F–NI FIRE/SMOKE (NON-IMPACT) F–POST FIRE/SMOKE (POST-IMPACT) FUEL FUEL RELATED GTOW GLIDER TOWING RELATED EVENTS GCOL GROUND COLLISION RAMP GROUND HANDLING ICE ICING LOC–G LOSS OF CONTROL–GROUND LOC–I LOSS OF CONTROL–INFLIGHT LOLI LOSS OF LIFTING CONDITIONS EN ROUTE LALT LOW ALTITUDE OPERATIONS MED MEDICAL NAV NAVIGATION ERRORS OTHR OTHER RE RUNWAY EXCURSION RI RUNWAY INCURSION SEC SECURITY RELATED SCF–NP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (NON-POWERPLANT) SCF–PP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (POWERPLANT) TURB TURBULENCE ENCOUNTER USOS UNDERSHOOT/OVERSHOOT UIMC UNINTENDED FLIGHT IN IMC UNK UNKNOWN OR UNDETERMINED WILD WILDLIFE WSTRW WIND SHEAR OR THUNDERSTORM

GLOSSARY OF ABBREVIATIONS aal above airfield level ACAS Airborne Collision Avoidance System ACARS Automatic Communications And Reporting System ADF Automatic Direction Finding equipment AFIS(O) Aerodrome Flight Information Service (Officer) agl above ground level AIC Aeronautical Information Circular amsl above mean sea level AOM Aerodrome Operating Minima APU Auxiliary Power Unit ASI airspeed indicator ATC(C)(O) Air Traffic Control (Centre)( Officer) ATIS Automatic Terminal Information Service ATPL Airline Transport Pilot’s Licence BMAA British Microlight Aircraft Association BGA British Gliding Association BBAC British Balloon and Airship Club BHPA British Hang Gliding & Paragliding Association CAA Civil Aviation Authority CAVOK Ceiling And Visibility OK (for VFR flight) CAS calibrated airspeed cc cubic centimetres CG Centre of Gravity cm centimetre(s) CPL Commercial Pilot’s Licence °C,F,M,T Celsius, Fahrenheit, magnetic, true CVR Cockpit Voice Recorder DME Distance Measuring Equipment EAS equivalent airspeed EASA European Aviation Safety Agency ECAM Electronic Centralised Aircraft Monitoring EGPWS Enhanced GPWS EGT Exhaust Gas Temperature EICAS Engine Indication and Crew Alerting System EPR Engine Pressure Ratio ETA Estimated Time of Arrival ETD Estimated Time of Departure FAA Federal Aviation Administration (USA) FDR Flight Data Recorder FIR Flight Information Region FL Flight Level ft feet ft/min feet per minute g acceleration due to Earth’s gravity GPS Global Positioning System GPWS Ground Proximity Warning System hrs hours (clock time as in 1200 hrs) HP high pressure hPa hectopascal (equivalent unit to mb) IAS indicated airspeed IFR Instrument Flight Rules ILS Instrument Landing System IMC Instrument Meteorological Conditions IP Intermediate Pressure IR Instrument Rating ISA International Standard Atmosphere kg kilogram(s) KCAS knots calibrated airspeed KIAS knots indicated airspeed KTAS knots true airspeed km kilometre(s) kt knot(s) lb pound(s) LP low pressure LAA Light Aircraft Association LDA Landing Distance Available LPC Licence Proficiency Check m metre(s) MDA Minimum Descent Altitude METAR a timed aerodrome meteorological report min minutes mm millimetre(s) mph miles per hour MTWA Maximum Total Weight Authorised N Newtons NR Main rotor rotation speed (rotorcraft) Ng Gas generator rotation speed (rotorcraft) N1 engine fan or LP compressor speed NDB Non-Directional radio Beacon nm nautical mile(s) NOTAM Notice to Airmen OAT Outside Air Temperature OPC Operator Proficiency Check PAPI Precision Approach Path Indicator PF Pilot Flying PIC Pilot in Command PNF Pilot Not Flying POH Pilot’s Operating Handbook PPL Private Pilot’s Licence psi pounds per square inch QFE altimeter pressure setting to indicate height above aerodrome QNH altimeter pressure setting to indicate elevation amsl RA Resolution Advisory RFFS Rescue and Fire Fighting Service rpm revolutions per minute RTF radiotelephony RVR Runway Visual Range SAR Search and Rescue SB Service Bulletin SSR Secondary Surveillance Radar TA Traffic Advisory TAF Terminal Aerodrome Forecast TAS true airspeed TAWS Terrain Awareness and Warning System TCAS Traffic Collision Avoidance System TGT Turbine Gas Temperature TODA Takeoff Distance Available UAS Unmanned Aircraft System UHF Ultra High Frequency USG US gallons UTC Co-ordinated Universal Time (GMT) V Volt(s) V1 Takeoff decision speed V2 Takeoff safety speed VR Rotation speed VREF Reference airspeed (approach) VNE Never Exceed airspeed VASI Visual Approach Slope Indicator VFR Visual Flight Rules VHF Very High Frequency VMC Visual Meteorological Conditions VOR VHF Omnidirectional radio Range Air Accidents Investigation Branch Annual Safety Review 2017 AAIB Air Accidents Investigation Branch

Air Accidents Investigation Branch Annual Safety Review 2017

FD06619 ｜ 2018_英国_aaib-investigation-to-airbus-a319-111-g-ezim__Airbus_A319-111_G-EZIM_04-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

13 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018 G-EZIM EW/C2017/03/04 INCIDENT Aircraft Type and Registration: Airbus A319-111, G-EZIM No & Type of Engines: 2 CFM56-5B5/P turbofan engines Year of Manufacture: 2005 (Serial no: 2495) Date & Time (UTC): 31 March 2017 at 1723 hrs Location: Isle of Man Airport, Isle of Man Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 6 Passengers - 124 Injuries: Crew - None Passengers - None Nature of Damage: None Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 34 years Commander’s Flying Experience: 7,800 hours (of which 7,543 were on type)

Last 90 days - 164 hours

Last 28 days - 76 hours Information Source: AAIB Field Investigation Synopsis Shortly after takeoff the flight crew experienced a smell and smoke/mist in the cockpit. The cabin crew also reported smoke in the cabin. The commander decided to return to land and while approaching the end of the downwind leg the smoke began to dissipate. The landing was uneventful. The aircraft had been dispatched with a seized Air Cycle Machine (ACM) in Pack 1, and in accordance with the Minimum Equipment List it had been activated in ‘heat exchanger mode’ after takeoff. It is probable that, in this mode, the air flowing through the damaged ACM produced the smell and smoke/mist. Background to the flight On 26 March 2017 an overheat defect was reported in G-EZIM for Air Conditioning Pack 1 (AIR PACK 1 OVHT). The pack was made inoperative and a FL370 altitude restriction was applied. The following day, troubleshooting maintenance activity resulted in new sensor parts being ordered and on 31 March, the morning of the incident, further maintenance resulted in the determination that the Air Cycle Machine1 (ACM) in Pack 1 had seized. This was based on there being no airflow at the Pack 1 ram-air outlet. A new ACM was ordered and Pack 1 was reinstated for in-flight use only in ‘heat exchanger mode’, in accordance with the aircraft manufacturer’s Minimum Equipment List (MEL) 21-52-01G ‘Air cycle machine failed’. ‘Heat exchanger mode’ means only operating the pack in flight when the total air Footnote 1 An ACM consists of a turbine-driven compressor and fan.

14 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018 G-EZIM EW/C2017/03/04 temperature (TAT) is less than, or equal to, 12°C. This results in the pack using cool ram air but the air still passes through the ACM. History of the flight The aircraft departed from Bristol Airport for the Isle of Man Airport and the flight crew operated Pack 1 in accordance with MEL 21-52-01G. The flight was uneventful. On the return flight, about 90 seconds after takeoff from Runway 26 at Isle of Man Airport, the commander noticed what looked like mist coming from the vent above his windshield. He described it as being light grey and that it was followed almost immediately by an “acrid burning smell much akin to a match just being struck.” He turned to the co-pilot to ask if he could smell anything and noticed that the mist behind his seat was dense enough to highlight rays of sunshine entering the cockpit. The cabin manager (CM) reported that, about 30 seconds after liftoff, he and another cabin crew member seated at the front of the aircraft noticed that the cabin smelt of burning and seconds later the cabin began to fill with “grey/hazy smoke”. The commander asked the co-pilot to transmit a MAYDAY call to ATC of “smoke in the cockpit” and requested a level-off at FL50. The commander then handed control to the co-pilot and noticed that the cabin attendant light was flashing on the Audio Control Panel on the centre pedestal, indicating that the cabin crew were trying to call them. The buzzer had probably been drowned out during the initial radio exchange with ATC. He gave the “Attention crew at stations” call over the public address (PA) which is a standard call to indicate to cabin crew that the flight crew are aware of a potential emergency situation but are unable to respond immediately due to cockpit workload. The flight crew discussed their options but the density of the mist was sufficient to convince the commander that an ECAM warning, most likely for ‘avionics smoke’, was almost inevitable. They advised ATC that they intended to return to the Isle of Man and were given a downwind heading. The co-pilot retained control while the commander spoke to the CM over the interphone, who confirmed that smoke was present in the cabin and that the passengers were anxious. The commander gave the CM a NITS2 briefing, including that there might be a slim possibility of an evacuation should the situation worsen. He then made a similar announcement to the passengers over the PA stating than an evacuation was unlikely. While approaching the end of the downwind leg for a tight base turn the smoke began to dissipate but the smell remained so the crew elected to continue with the MAYDAY instead of downgrading to a PAN. The commander resumed control at about 2,000 ft and an uneventful landing was made to a full stop on the runway. He made contact with the fire service who stated that they could not see anything unusual so they escorted the aircraft to the stand. The total flight time was about 11 minutes. Footnote 2 The NITS briefing is an emergency briefing given to cabin crew; it stands for Nature, Intention, Time, Special Instructions.

15 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018 G-EZIM EW/C2017/03/04 Commander’s comments The commander stated that the co-pilot had selected Pack 1 on after reaching 1,000 ft aal and Pack 2 about 10 seconds later. The occurrence of the smoke was not soon enough after selecting the packs on for him to associate this as being a possible cause. The smoke visually dispersed after about 2 to 3 minutes but the acrid smell remained. He commented that his main concern was the possibility of receiving an avionics smoke message on the ECAM which would have resulted in needing to consider setting the emergency electrical configuration. This would have increased the landing distance required while the landing distance available at the Isle of Man was only 1,613 m. He said they had insufficient time to troubleshoot or consult the Quick Reference Handbook and he was surprised at how quickly the 11 minutes passed. It was only after landing that the flight crew discussed the faulty pack as being a possible cause. Description of the Air Cycle Machine The ACM is installed between the fan plenum and the condenser of the air conditioning pack (Figure 1). The ACM contains a rotary body which is composed of three wheels connected by a tie-rod (Figure 2). The three wheels are a fan, a compressor and a turbine, which are encased in a fibreglass plenum diffuser. The shaft of the rotary body is supported by two self-acting foil-air bearings and a double self-acting air-thrust bearing. These bearings are located in closed chambers which are supplied with cool and pressurized air from the turbine stage. In the case of a significant air leakage to or from those chambers, or an increase of temperature of the cooling air, the air bearing can fail which eventually leads to ACM seizure. Figure 1 Schematic of the air flow through the Pack. ACM shown in the centre

16 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018 G-EZIM EW/C2017/03/04 Figure 2 Schematic of ACM Aircraft examination During the aircraft troubleshooting process, Pack 1 ACM was suspected to be the cause of the smoke so Pack 1 was deactivated (by closing the pack flow control valve) and an operational test of Pack 2 was performed using bleed air from engines 1, 2 and the APU in turn, with no apparent smoke or smells. The ACM from Pack 1 was replaced and the aircraft returned to service. As of 29 June 2017 the aircraft had accumulated a further 903 hours and 541 cycles without any reports of further smoke or smells. The ACM was sent to a repair and overhaul organisation but it was not tagged as being the subject of an air safety investigation; therefore, no detailed report or photographs of its examination were available. However, the overhaul organisation stated that ‘the machine

17 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018 G-EZIM EW/C2017/03/04 was tested faulty with rotary body seized’. The repair documentation revealed that the turbine wheel was found damaged by friction on the turbine scroll and the rotary tie rod was also found damaged by friction, so the whole rotary body was replaced. The fan housing was not replaced, which indicates that the fan wheel had probably not touched the housing, and so the fan wheel had probably not been damaged. The ACM had accumulated 25,000 flying hours. The ACM does not have a life limit but there is a repair scheme that is dependent on flying hours and cycles. It had previously been in a workshop for repair in April 2014 at 7,885 flying hours. Aircraft manufacturer’s MEL procedures The aircraft manufacturer’s Minimum Equipment List (MEL) contained the following entry for a failed ACM. The procedure allowed for the pack with the failed ACM to be operated in ‘Heat Exchanger Cooling Mode only’ providing certain alerts were not present, which were not present in the case of G-EZIM. This mode allows the pack to be operated in flight when the TAT is less than or equal to 12°C. The aircraft manufacturer confirmed that it was the intention of MEL 21-52-01G to allow the pack to be operated in the air when the ACM had seized. They did not have any records from other customers reporting that a seized ACM had started turning again in flight. Based on the findings from this investigation the manufacturer stated: ‘In the absence of evidence further to the ACM examination, it was not possible to determine the root cause of the ACM failure and its condition at the time of the event. Therefore, the aircraft manufacturer is not in position to propose any safety action at this stage.’ Aircraft operator comment The aircraft operator had stated that it had applied MEL 21-52-01G to three other A320 series aircraft following inoperative ACMs in the previous 12 months, with no adverse effects. However, it was not known if any of these involved ACM seizures. The operator is reviewing what action should be taken in the future when an ACM is found to be seized. The aircraft manufacturer’s manuals do not provide the option of dispatching with one pack turned off. The pack either has to be disabled, which means that the flight crew cannot turn it on if the other pack fails, or they have to operate the pack in ‘heat exchanger mode’.

18 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018 G-EZIM EW/C2017/03/04 Analysis In this event on G-EZIM, the smells and smoke/mist experienced by the flight crew and cabin crew occurred after Pack 1 was turned on, which was believed to contain a seized ACM. Turning the pack on in ‘heat exchanger mode’ results in air flowing through the ACM and it is possible that this airflow caused the ACM to turn, but due to a problem with the air bearings there was friction which generated heat and smells. This scenario does not explain why the symptoms did not occur on the earlier flight. However, the ACM in Pack 1 was found to be damaged and replacing it has resulted in no further occurrences of smells or smoke/mist, which increases the likelihood that the ACM was the cause. The manufacturer’s manuals permit an air-conditioning pack to be operated in ‘heat exchanger mode’ when the ACM has seized. Operating a pack in ‘heat exchanger mode’ with an ACM in such a condition could result in the airflow being sufficient to turn what was considered to be a seized ACM. The friction from this operation could then produce undesirable smells and potential smoke/mist into the cabin and cockpit air systems. The aircraft operator is reviewing what action should be taken in the future when an ACM is determined to be seized.

FD06620 ｜ 2018_英国_aaib-investigation-to-boeing-737-800-ei-dlv__Boeing_737-800_EI-DLV_09-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

3 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 ACCIDENT Aircraft Type and Registration: Boeing 737-800, EI-DLV No & Type of Engines: 2 CFM56-7B26 turbofan engines Year of Manufacture: 2006 (Serial no: 33,598) Date & Time (UTC): 15 September 2017 at 0807 hrs Location: London Stansted Airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 6 Passengers - 184 Injuries: Crew - None Passengers - None Nature of Damage: Failure of left nose landing gear axle and separation of left nosewheel Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 33 years Commander’s Flying Experience: 4,500 hours (of which 4,300 were on type)

Last 90 days - 255 hours

Last 28 days - 85 hours Information Source: AAIB Field Investigation Synopsis As the aircraft was lining up on the runway to take off, the flight crew heard a noise similar to a nosewheel passing over a runway centre light; they did not consider the noise to be unusual. During the takeoff roll, the flight crew in an aircraft holding near the start of the runway noticed one of the nosewheels depart EI-DLV and be blown off the runway into the area behind the threshold. They informed ATC who informed the crew of EI-DLV, which was now in the climb. A diversion was carried out to East Midlands Airport where an uneventful landing was made. The nosewheel was found to have separated from the aircraft because the nose landing gear axle had failed at the left inboard journal (the part of the axle that rests on bearings). This was the result of heat-induced cracking and material property changes due to abusive grinding of the chrome plate during the part’s last overhaul almost three years earlier. The Maintenance and Repair Organisation that performed the overhaul has introduced a new inspection for detecting abusive grinding. History of the flight The following has been compiled using information from crew interviews and downloads from the Flight Data Recorder (FDR) and Cockpit Voice Recorder (CVR). The crew, comprising the commander, co-pilot and four cabin crew, reported for duty at their home base of Kaunas, Lithuania at 0240 hrs on the day of the accident. They operated two

4 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 sectors, from Kaunas to Copenhagen and then Copenhagen to Stansted, without incident. They then prepared the aircraft for a third sector back to Copenhagen. The co-pilot completed the walkaround checks and reported seeing nothing abnormal. Nor was anything unusual seen by the ground crew handling the turnaround, including the tug crew which had attached, and subsequently detached, the towbar to the nose gear. The aircraft pushed back off Stand 43R at 0757 hrs, with the commander acting as pilot flying, and was cleared to taxi via taxiway C to holding point S1 for Runway 22 (Figure 1). The crew reported there was nothing abnormal during the taxi and, on reaching S1, they held in turn before being cleared by ATC to line up and hold. As the aircraft entered the runway, ATC cleared the crew to take off. The commander taxied the nose of the aircraft beyond the centreline to line up on the centre of the runway for a rolling takeoff. As he did so, the flight crew heard a noise similar to the nosewheels passing over a runway centre light. The same noise was heard by the two cabin crew members at the front of the cabin. Neither the pilots nor the two cabin crew members considered the noise to be anything out of the ordinary. The commander reported that during the takeoff roll, despite there only being a light wind at the time, he used aileron and rudder to keep the aircraft straight on the centreline, as if the aircraft was experiencing a crosswind from the right. The takeoff otherwise appeared normal to the flight crew and, after rotation, the gear was raised with no apparent problems. They continued with the CLN 1E departure given by ATC, before being given a radar heading and climb to FL170. An aircraft operating on a different radio frequency to EI-DLV and waiting at the S1 hold, informed ATC that, as EI-DLV had started its takeoff roll, they had seen one of the nosewheels depart the aircraft and be blown off the runway into the area behind the threshold. They could also see what appeared to be a part of the aircraft on the runway. ATC ordered a check of the runway and the aircraft parts were recovered. When ATC notified EI-DLV of what had happened, the aircraft was passing about FL110. The crew entered a hold whilst they assessed the situation. The most appropriate guidance they could find in the aircraft manuals was for ‘landing with a flat tyre’ in the Flight Crew Training Manual, which they elected to follow. The crew decided their best option was to return to Stansted, a decision agreed when they contacted the company’s engineering base at the airport by radio. The flight crew informed ATC of their intention to return to Stansted and the commander gave the cabin supervisor an emergency brief before advising the passengers of the situation over the PA. Having prepared the aircraft for the approach, the crew was cleared by ATC to descend and head towards the ABBOT holding and arrival point for Stansted. Shortly afterwards ATC contacted the crew to inform them that the aircraft operator had requested that the aircraft now divert to either East Midlands or Prestwick, rather than Stansted. As this conflicted with the request from the engineering base, on arrival at ABBOT the crew took up the hold in order to contact the company Operations Department by radio via their

5 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 ground handling agent at Stansted. The Operations Department confirmed the new diversion preferences and the crew determined they had sufficient fuel to divert to East Midlands. The crew then re-briefed and set the aircraft up for a diversion to East Midlands before advising ATC of the new diversion request, at which time they also declared a PAN. The weather report for East Midlands was for light winds, good visibility and a broken cloud base of 3,700 feet aal. Figure 1 Extract from Aerodrome Chart for London Stansted Airport ATC gave the crew vectors to establish on the ILS for Runway 27 at East Midlands Airport. When established on the approach, the crew flew a CAT 1 ILS, lowering the gear early; the gear operated normally and gave the normal indications. They elected to use full flaps (flaps 40) for landing to give a lower touchdown speed and calculated that autobrake 2 was the lowest usable autobrake selection they could use, as advised in the guidance they had consulted earlier. The commander disengaged the autopilot just below 500 feet aal and, on

6 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 touchdown, lowered the nosewheel as gently as possible onto the runway1. He reported the landing appeared normal and that he stopped the aircraft on the runway. The fire service attended quickly; they inspected the aircraft and confirmed that one of the nosewheels was missing. The commander decided against taxiing the aircraft off the runway as the taxiway entrances ahead of them were all at 90° to the runway and he was concerned about putting stress on the remaining wheel. The engines were shut down and the passengers were deplaned onto buses before the aircraft was towed to a stand. Diversion destination The operator’s preferred choice of diversion destination, relayed to the crew, was based on a desire to avoid closing the busy runway at Stansted Airport and the associated safety and operational implications this would have caused. East Midlands Airport reported that the incident resulted in their runway being closed for about 75 minutes. The closure was promulgated as quickly and as widely as possible, allowing a number of inbound flights to be delayed before they had taken off from their departure airports. It also coincided with a quiet operational period and resulted in only one inbound flight having to divert. Aircraft examination The aircraft was examined after it arrived at East Midlands Airport. The left axle of the nose landing gear (NLG) inner cylinder had failed at the inboard journal location (Figure 2). The wheel bearing spacer was still in place and in good condition. On the axle fracture face, near the 6 o’clock position, there were visible bands consistent with fatigue cracking. The separated nosewheel, axle and wheel bearings were recovered from Stansted Airport and, other than the break in the axle, no anomalies were found with these components. Figure 2 Left nosewheel axle failure at inboard journal. Bands of fatigue visible near the 6 o’clock position (right image) Footnote 1 Maximum de-rotation rate for this landing was -1.4°/sec. Previous landings recorded on the FDR were also reviewed with no hard landings or rapid de-rotations recorded.

7 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 Description of the NLG inner cylinder The nosewheel axles are integral parts of the NLG inner cylinder (Figure 3). Each axle has an inboard and an outboard journal onto which the two bearings from each nosewheel are fitted. The axles are made of a high strength steel alloy and the journals are chrome plated with a minimum chrome thickness of 0.003 inches. The highest stressed area of the axle is at the 6 o’clock position and the highest stress occurs during landing when the nosewheels touch down and load the axles upwards.

Figure 3 NLG inner cylinder with its four chrome plated wheel bearing journals Metallurgical examination of the axle failure The NLG cylinder was taken to a metallurgical lab for detailed examination. This revealed multiple crack initiation points on the lower circumference of the axle around a total length of about 47 mm; however, the dominant crack was near the 6 o’clock position as shown in Figure 2 (right image). A magnified image of this area is shown in Figure 4. Underneath an approximately 80 µm (0.003 inches) layer of chrome plating there was an area of intergranular fracture, about 250 µm thick, which was consistent with either stress corrosion cracking (SCC) or hydrogen embrittlement cracking. Underneath this area was an area characteristic of fatigue cracking, followed by alternating bands of SCC and fatigue. The fracture surfaces outside the banded region were all typical of overload failure. Visual examination of the chrome plating showed some surface cracking adjacent to the fracture in a direction perpendicular to the axle, but there was no widespread cracking. A fluorescent dye penetrant inspection (FPI) revealed additional cracks, in the same

8 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 direction, in the area of the main initiation point on both the inboard and outboard surfaces of the axle. A FPI of the left outboard journal and both journals on the right axle did not reveal any cracks.

Figure 4 Scanning Electron Microscope image of primary crack initiation site (near 6 o’clock position) The NLG cylinder was sent to the aircraft manufacturer for a Barkhausen inspection. This is a non-destructive inspection that uses a sensor to measure the material’s magnetic properties. It can detect heat damage in steel beneath non-ferromagnetic coatings such as chrome. When applied to the failed journal it detected a raised Barkhausen response, consistent with base metal heat damage in the area around the 6 o’clock position. A similar but smaller area of base metal heat damage was also detected on the outboard journal of the intact right axle, also near the 6 o’clock position. The remaining two journals did not exhibit any heat damage. The base metal heat damage was subsequently confirmed following the removal of the chrome plate. Nital etch2 revealed characteristic dark patches in the areas with the raised Barkhausen response (Figure 5). The aircraft manufacturer stated that these dark patches indicated that the steel microstructure had changed to overtempered martensite (OTM), also known as a re-tempering burn. This can occur if the part is excessively heated during grinding of the chrome plating and is commonly referred to as ‘abusive grinding’. An examination of the wheel bearings showed that they were in good condition and rotated freely indicating that bearing deterioration did not contribute to the heating of the axle bearing journals. The bearing covers about half the width of the axle bearing journal and yet the heat damage expanded nearly the entire width of the journal. Given this information, the aircraft manufacturer concluded that the only explanation for the base metal heat damage was that it had occurred during post-plating grinding. Footnote 2 Nital etch is a test for checking machining damage or grinding burn of a hardened steel component. It involves applying a Nital solution, which is a mixture of nitric acid and alcohol commonly used for etching steels, to reveal their microstructure.

9 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04

Figure 5 Lower face of the failed axle after chrome removal. The dark areas are evidence of heat damage When the base metal becomes overtempered from abusive grinding, there is a softening of the material and its strength reduces. The heating also causes a significant change in residual stress from compressive stresses on the surface to tensile stresses which increase the part’s susceptibility to cracking. During an abusive grinding event there is rapid localised heating followed by rapid cooling which results in thermal strain that can cause heat-induced cracking. During subsequent cadmium plating of other parts of the inner cylinder, hydrogen can diffuse into areas of tensile stress causing hydrogen embrittlement cracking. This can occur during the period between the cadmium plating and the stress relief bake which removes the hydrogen. These cracks can then propagate in service due to SCC or fatigue or both. According to the aircraft manufacturer, if OTM is present at the 6 o’clock position then axle fracture is inevitable within about 2 or 3 years, depending on utilisation. The metallurgical examination also revealed variability in the chrome plating thickness of all four journals. The aircraft manufacturer’s measurements are in Table 1. The measurements show that the chrome plating thickness at the failure location was 0.0028 ± 0.0005 inches, which meant that it could have been slightly below or above the 0.003 inches minimum allowable thickness. The right axle inboard journal was measured to be below the minimum thickness at the 6 o’clock position.

10 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 Clock position Left axle (fractured) Right axle Inboard journal 12:00 6.4 6.5 Forward 4.1 3.1 6:00 2.8 1.9 Aft 4.2 4.8 Outboard journal 12:00 5.0 5.8 Forward 3.6 3.0 6:00 3.6 3.0 Aft 4.0 5.0 Table 1 Chrome plate thickness measurements in the centre of the journals (all values in 1/1000 inches with accuracy of ± 5/10,000 inches). Minimum thickness 3/1000 inches Previous Boeing 737NG3 NLG axle failures due to base metal heat damage On 7 April 2014, the aircraft manufacturer published Service Letter 737-SL-32-171-A which stated: ‘Boeing has received reports of four (4) Nose Landing Gear (NLG) Inner Cylinder Axle fractures in the last several years believed to be caused by improper chrome plate grinding during original manufacture. All four fractures occurred at the inboard wheel bearing journal. In three of the cases, the fractured axles were stripped of chrome plate and a Nital etch inspection was performed which indicated severe base metal heat damage (grinding burns) inflicted by poor chrome plate grinding. Since the release of the reference a) multi operator message, 55 other NLG axles which have been subjected to Barkhausen or Nital inspection to look for base metal heat damage have had findings that are indicative of base metal heat damage.’ The manufacturer had discovered that some issues with the grinding process had been introduced when the manufacture of the NLG inner cylinders was moved to a new facility in February 2001. These manufacturing issues have subsequently been addressed. The Service Letter recommends that suspect4 NLG inner cylinders are inspected for heat damage at first overhaul, either by stripping the chrome plating and performing a Nital etch inspection or by performing a Barkhausen inspection. It also states that any suspect NLG inner cylinders that had already been overhauled and not inspected for heat damage should have an on-wing Barkhausen inspection at the next maintenance opportunity. Footnote 3 Boeing 737NG refers to the newer models of Boeing 737, the -600, -700, -800 and -900. 4 Suspect NLG inner cylinders are identified by serial number in the SL but also include all inner cylinders delivered on aircraft line number 830 and line numbers 858 to 2566.

11 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 The Service Letter provides the following background information regarding the chrome plating of the bearing journals: ‘After application of the chrome plate it is required to grind the chrome plate to obtain the required design dimensions and surface finish. This grinding process has to be very tightly controlled to avoid generation of too much heat as a result of the friction generated between the grinding wheel and the part. Excessive heat can cause the mechanical properties of the high strength steel substrate to change due to stress relief and surface temper effects which can result in cracks forming and subsequent fracture of the axle.’ Maintenance history of the NLG cylinder on EI-DLV The NLG cylinder on EI-DLV was previously installed on a different Boeing 737-800 (line number 1642) which was delivered from new in February 2005; therefore, the aforementioned Service Letter was applicable. The cylinder had accumulated 36,238 hours and 22,094 cycles since new. The life limit for the component is 75,000 cycles and an overhaul is required at 10 years or 21,000 cycles, whichever occurs sooner. The cylinder was overhauled by an approved Maintenance and Repair Organisation (MRO) in December 2014 when it had accumulated 17,035 cycles. After overhaul and carrying out the Service Letter instructions, the cylinder was installed on EI-DLV and, other than general visual inspections during wheel changes, there had been no detailed axle inspection since. At the time of the axle failure it had accumulated 9,089 hours and 5,059 cycles since overhaul. Overhaul of the NLG cylinder on EI-DLV When the NLG cylinder from EI-DLV was overhauled in December 2014 the MRO had the option of performing either a Nital etch or a Barkhausen inspection in accordance with the Service Letter. The Nital inspection involves removing the chrome plating, performing a visual inspection, re-plating and then grinding the chrome to the required dimensions. The Barkhausen inspection is non-destructive and, if the part passes inspection, there is no requirement to strip the chrome plating. The operator of EI-DLV had requested that the MRO perform a Nital etch inspection on all its NLG cylinders. The operator stated that this decision was taken at the time because it was thought that Nital etch was a more effective inspection process and that Barkhausen had the potential to miss heat damage or to pass lower levels of heat damage. It was also felt that by re-chroming they would have an axle in an ‘as new’ condition. In both the aircraft manufacturer’s and the MRO’s experience, the Barkhausen inspection did not miss heat damage. All the other operators that had their NLG cylinders overhauled by this MRO had the Barkhausen inspection carried out. The overhaul record for EI-DLV’s NLG inner cylinder was examined. The first two processes involved stripping the cadmium plate from the inner cylinder and the chrome plate from the journals. The records revealed that the Nital etch inspection of the journals was passed, which meant that no evidence of heat damage was found on the base metal. Following shot

12 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 peening, the journals were re-plated with chrome and then underwent a 6-hour stress relief bake. Chrome plating involves lowering the part into an electrolyte bath of chromic acid and then passing an electric current between two electrodes. The MRO’s chrome plating process used non-conforming anodes5 which resulted in an uneven thickness of chrome being applied. The grinding was then carried out using a manual grinder. The basic setup of the grinder, grinding wheel and the NLG cylinder is shown in Figure 6. The process is manual and involves the operator turning a wheel to move the grinding wheel towards the cylinder which is rotated by the grinder at a speed of 20 rpm. Before starting the grinding operation, the operator uses a Dial Test Indicator (DTI) gauge to measure any high spots on the journals and then marks them with a chinagraph pen. With the grinding wheel stationary, it is then slowly brought towards the rotating cylinder until first contact, which is the highest spot. The digital reader on the machine is then zeroed and the wheel is brought back by 0.1 inches. During the grinding operation there is a ratchet on the handle which prevents the wheel being moved in by more than 0.0001 inches between movements of the ratchet. Checks are carried out and the grinding wheel is dressed (sharpened) after every 0.003 inches to 0.005 inches of material removal. A number of different factors can cause a grinding burn which is a consequence of the part getting too hot: ● ● Not identifying the highest spot correctly which then results in a large slice being removed at first touch. ● ● Moving the grinding wheel in too quickly (ie not using the ratchet or moving the ratchet too quickly). ● ● Poor condition of the cooling fluid or inadequate flow. ● ● Insufficiently dressed grinding wheel which results in heat build-up. ● ● Machine setup and balance which results in the part rotating non‑concentrically. After grinding, there is a visual inspection of the journals to check for cracks. The parts of the inner cylinder which had the cadmium removed are then re-plated with cadmium. All parts, including the journals, then undergo a magnetic particle inspection (MPI)6. Following painting, the final overhaul operation is a 23-hour de-embrittlement bake to remove any hydrogen that was introduced during plating. Footnote 5 Conforming anodes conform to the shape of the part being plated. Non-conforming anodes do not and typically consist of anode plates on either side of the part. 6 Magnetic particle inspection (MPI) is a non-destructive testing (NDT) process for detecting surface and shallow subsurface discontinuities in ferromagnetic materials such as iron, nickel, cobalt, and some of their alloys. It will not detect cracks in chrome but it may detect cracks in a ferromagnetic material beneath a thin chrome layer.

13 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 Figure 6 MRO’s grinding setup for the NLG cylinder Investigation by the MRO Since there was no evidence of grinding burns following the Nital etch carried out at the beginning of the overhaul process, the MRO carried out an internal investigation to determine what might have caused them to occur during overhaul. They reviewed all their processes and interviewed all eight of their grinding operators. The operator who had ground the chrome journals on EI-DLV’s cylinder had been carrying out grinding operations for the MRO since March 2006. He had ground 33 NLG inner cylinders during the period leading up to grinding EI-DLV’s cylinder and 42 NLG inner cylinders since. None of these other NLG cylinders are known to have suffered from grinding burns. The manufacturer’s Standard Overhaul Practices Manual (SOPM) instructions for grinding required a degree of interpretation by the grinding operators. Interviews with the grinding operators revealed some differences in how they performed the grinding process. There was nothing identified in the processes employed by the grinding operator of EI-DLV’s cylinder that was particularly unusual. The grinding of all four journals was completed within one shift. There had not been any significant maintenance on the grinding machine prior to grinding or afterwards. The same machine had been used to grind the journals on about 957 Boeing 737NG inner cylinders Footnote 7 During this period 205 Boeing 737NG NLGs were overhauled; of these, 59 were from the operator of EI‑DLV and all required chrome removal. The remainder were from other operators that did not require chrome removal and it was estimated that a quarter of these would have had the chrome removed for defects found.

14 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 between 2008 (when the MRO started overhauling 737NG cylinders) and December 2014 (when EI-DLV’s cylinder was overhauled); of these, 59 were from the same operator as EI‑DLV, and about half of these had been ground by the same operator who worked on EI‑DLV. Since December 2014, the MRO has overhauled an additional 90 NLGs, of which 60 were from the operator of EI-DLV. The MRO concluded from their investigation that all grinding operators were following the aircraft manufacturer’s procedures and that they: ‘understood the implications of making a heavy contact between the wheel and the job when they first touch on. They understood the importance of reporting an incident where this may happen and confirmed good practices to ensure a light touch-on of the wheel to the job when eliminating high spots.’ The MRO also determined that all the mandatory stress relief bakes had been properly performed. Grinding tests carried out by the MRO As part of the investigation, the MRO carried out some grinding tests to see if there were any deflections of the part during spinning due to an imbalance. Because of the long cylinder at right angles to the axle, the part is not balanced about the rotational axis. The aircraft manufacturer stated that a counterweight might need to be added; however, tests at different speeds using a DTI gauge to measure deflection did not reveal any variations, so the benefit of installing a counterweight is not clear. During one of the tests observed by the AAIB, the DTI gauge indicated a fluctuation of 0.001 inches during rotation of the part. This could not be explained and subsequent tests did not reveal the same level of fluctuation. It is possible that differences in the setup could result in the part sometimes not being spun concentrically which could increase the chance of inadvertent contact with the grinding wheel. Use of non-conforming anodes The MRO’s chrome plating process involves using non-conforming anodes which results in an uneven thickness of chrome being applied. The MRO reported that the chrome is usually thicker at the 3 and 9 o’clock positions. If the chrome is very thick then it prolongs the grinding process, potentially increasing heat build-up. An uneven thickness also means that there will be high spots which increases the risk of abusive grinding from inadvertent contact with the grinding wheel. The aircraft manufacturer stated that using conforming anodes was best practice as it results in an even chrome thickness, but it was noted that the manufacturer’s SOPM did not state which type of anodes should be used. The MRO agreed that using conforming anodes would be best practice but they had been using non-conforming anodes for the previous 10 to 15 years, and the grinding processes they had in place catered for it.

15 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 Previous NLG axle failure on a Boeing 737-800 belonging to the operator of EI-DLV On 3 May 2017 another of the operator’s Boeing 737-800 aircraft, registration EI-DHB, experienced an NLG axle failure during taxi at Murcia airport in Spain. The right axle had failed at the inboard journal and there were fatigue cracks which had initiated at the 6 o’clock position. During the investigation of this event, which is ongoing, both a Barkhausen inspection and a Nital etch inspection were performed on the failed journal which did not reveal any base metal heat damage, indicating that no abusive grinding had occurred, and therefore this event was not directly linked to that of EI-DLV. Aircraft manufacturer’s comments The aircraft manufacturer stated that it was not aware of any other Boeing 737NG NLG axle failures that had occurred due to abusive grinding during overhaul. The only other similar events were due to abusive grinding at manufacture and this issue was addressed by the Service Letter. The aircraft manufacturer stated that performing a Barkhausen inspection after grinding would help to prevent any parts with abusive grinding damage entering service. However, it does not currently have any plans to mandate such an inspection. Barkhausen inspection reference standard To perform a Barkhausen inspection, a reference standard is required to calibrate the equipment. The effectiveness of the equipment is highly dependent on the quality of the calibration which is dependent on the reference standard. The reference standard is made from the same material as the axle and has one or more burns applied to it. Different thickness titanium foils are then applied to the surface to represent the thickness of the chrome plating in the inspection area. The MRO had been using a reference standard with a single burn. In 2015, the aircraft manufacturer produced a new standard for the Barkhausen inspection (BSS 7423) which included a specification for a reference standard with three burns of different intensity on its surface8. This reference standard resulted in more accurate Barkhausen tests with fewer false ‘fails.’ The aircraft manufacturer had four of these new reference standards made for internal purposes, but did not make the details required to manufacture them available to MRO’s. Following the EI-DLV axle failure, the aircraft manufacturer loaned one of their reference standards to the MRO of EI-DLV which it used in subsequent Barkhausen inspections. Analysis The NLG axle failed as a result of a crack that had initiated near the 6 o’clock position of the left inboard journal and had then propagated over time via fatigue and SCC until the remaining material failed in overload. The final failure occurred as EI-DLV turned onto the runway prior to takeoff. Footnote 8 As well as having additional burns, the burns were applied using a controlled induction heating process. The older reference standard with the single burn, had the burn applied using an acetylene flame to produce ‘cherry redness’.

16 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 The initial cracks had developed because the journal, whilst being overhauled, had experienced a re-tempering burn near the 6 o’clock position during post-chrome plate grinding. This abusive grinding would have resulted in heat-induced cracking in the base metal that probably grew by hydrogen embrittlement cracking during the cadmium plating process, prior to the stress relief bake. If the cracks had extended through the chrome surface from the base metal then they were probably microscopic cracks as they were not detected during the post-grinding visual inspection. The MPI did not detect any cracks but it will not detect cracks in non-ferrous material such as chrome, and it may not detect cracks in steel beneath a chrome layer. There was no requirement to perform an FPI which might have detected cracks in the chrome plating. Because no cracks were detected, the part was returned to service. Over time, in-service axle flexure caused fatigue cracks to initiate from the hydrogen embrittlement region, and propagate through the wall of the axle. This flexure probably also caused through thickness cracks to develop in the chrome plating, at locations coincident with the base metal cracks. These cracks would have allowed moisture to reach the advancing crack tip and cause the fracture to continue to propagate by the observed alternating modes of SCC and fatigue, until final ultimate fracture occurred by ductile separation through the remaining intact axle wall. This report identifies a number of possible causes of abusive grinding; however, the cause of the two grinding burns on EI-DLV’s cylinder could not be determined. Regardless of the cause, there was no effective mechanism for detecting that abusive grinding had occurred. Since the failure, the MRO has introduced a post-grinding Barkhausen inspection. This type of inspection should identify any journals that have suffered abusive grinding and prevent them from being released to service. The effectiveness of the Barkhausen inspection is dependent on the quality of the reference standard for calibrating the machine. If the aircraft manufacturer were to make and supply more of the new reference standards, or supply MRO’s with the detailed instructions to make them, then this could increase the effectiveness of Barkhausen inspections worldwide. The aircraft manufacturer’s Service Letter allows a Barkhausen inspection to be used instead of Nital etch. If a Barkhausen inspection had been carried out on EI-DLV’s NLG at the beginning of the overhaul process then there would have been no need to strip the chrome, re-plate and grind the journals, thus removing the opportunity for abusive grinding to occur. Although the aircraft manufacturer is not aware of any other Boeing 737NG NLG axle failures due to abusive grinding during overhaul, it is considering the issues raised in this report but, at the time of writing, had not initiated any related changes to maintenance, repair or overhaul procedures for 737NG NLG cylinders.

17 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 EI-DLV EW/C2017/09/04 Conclusion The nosewheel was found to have separated from the aircraft because the NLG axle had failed at the left inboard journal. The failure was caused by a crack that had initiated near the 6 o’clock position of the journal and had then propagated over time via fatigue and SCC until the remaining material failed in overload. The crack was the result of heat-induced cracking and material property changes caused by abusive grinding of the chrome plate during the part’s last overhaul. The cause of the abusive grinding could not be determined, but the abusive grinding would probably have been identified if a post-grinding Barkhausen inspection had been carried out. Safety action To ensure that any abusive grinding is detected, the MRO of EI-DLV has introduced a new process to perform a Barkhausen inspection on all journals after grinding. The MRO has also introduced a Barkhausen inspection early in the overhaul process, prior to the Nital etch test. In addition, the MRO is carrying out Barkhausen inspections on all 12  Boeing  737NG NLGs that were overhauled during the one-year period covering six months before and after the date of EI-DLV’s NLG overhaul. These inspections are carried out on the aircraft, on the line, after removing the wheel and bearings. Out of these 12, nine have already been inspected and no evidence of abusive grinding was found. As some of the manufacturer’s SOPM instructions, such as wheel dressing, are open to interpretation, the MRO is developing an internal protocol for grinding so that there is greater consistency among grinding operators.

FD06621 ｜ 2018_英国_aaib-investigation-to-boeing-747-8r7f-lx-vcf__Boeing_747-8R7F_LX-VCF_07-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

3 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 SERIOUS INCIDENT Aircraft Type and Registration: Boeing 747-8R7F, LX-VCF No & Type of Engines: 4 x GEnx-2B67 turbofan engines Year of Manufacture: 2012 Date & Time (UTC): 30 March 2017 at 1216 hrs Location: En route from Houston to Prestwick Type of Flight: Commercial Air Transport (Cargo) Persons on Board: Crew - 3 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Extensive fuel contamination of aircraft interior and wiring Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 52 years Commander’s Flying Experience: 12,900 hours (of which 9,200 were on type)

Last 90 days - 164 hours

Last 28 days - 47 hours Information Source: AAIB Field Investigation Synopsis Following an uneventful scheduled cargo flight, it became apparent after landing that a large quantity of fuel had leaked from a Bell 412EP helicopter which was being shipped as cargo on the main deck of the freighter aircraft. The escaped fuel then made its way through the lower deck and spilled onto the airport apron. Airport Rescue and Fire Fighting Services (RFFS) attended the aircraft to contain the fuel spill and manage the associated risk of fire and explosion. The investigation determined that the helicopter, which was disassembled and prepared for transportation some months prior to the incident, had not been shipped in accordance with the required provisions for transportation of such vehicles by air. In particular, the helicopter had not been drained of fuel prior to transportation. Approximately 322 litres of fuel escaped from the helicopter during the flight. One Safety Recommendation is made concerning procedures for the preparation of helicopters for air transportation. History of the flight On 30 March 2017, LX-VCF was operating scheduled cargo flight CV7754 from Houston, Texas to Luxembourg with an intermediate stop at Prestwick International Airport, UK. Following an uneventful flight, the aircraft arrived at Prestwick and parked on stand. As the

4 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 flight crew were shutting down the engines they smelled fuel. When the ground operations agent entered the aircraft via the main deck door to commence unloading operations, he too detected a strong smell of aviation fuel and heard the sound of running liquid. He identified the source as a Bell 412EP helicopter, which was being shipped as cargo on the main deck of the aircraft and noted that fuel appeared to be leaking from a vent on the forward right‑hand side of the helicopter. The ground operations agent reported the situation to the flight crew. The Airport Authority and RFFS were notified and the airport emergency response plan was activated. The flight crew shut down the aircraft and opened the escape hatch and upper deck service door to ventilate the aircraft. Upon arrival at the aircraft the RFFS noted that fuel was coming out of the bottom of LX-VCF’s fuselage, close to the left body landing gear, having leaked through the main deck, lower deck and avionics bay and was pooling on the apron beneath the aircraft (Figure 1). The aircraft was evacuated, electrically isolated and quarantined by the RFFS. The RFFS subsequently stated that the measured fuel vapour levels indicated a high risk of explosion and that the fuel flammability limits were potentially in range. After the aircraft had been made safe, all cargo, including the helicopter, was offloaded manually. Figure 1 Fuel exiting lower fuselage of LX-VCF

5 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Examination of the aircraft and helicopter The aircraft and helicopter were examined on 4 April 2017 by representatives from the aircraft operator, the UK Civil Aviation Authority (CAA), the airport authority, the helicopter owner and the owner’s insurer. Based on the initial information available, the AAIB had initiated a Correspondence Investigation and did not attend this examination. However, those who participated in the examination provided information to the investigation and the AAIB subsequently upgraded the investigation to a Field Investigation. The helicopter was encased in strong white plastic shrink-wrap and had been secured to a cargo pallet for the flight, which occupied three loading positions on the right side of the aircraft’s main cargo deck (Figure 2). During the aircraft examination, some fuel was present in the wells of the pallet and the securing straps were soaked with fuel. Figure 2 Bell 412-EP fuselage, wrapped in shrink-wrap, on main deck of LX-VCF prior to being offloaded at Prestwick In the area of the helicopter’s forward right-hand fuel vent, from which fuel was reported to have leaked, the shrink-wrap had been applied so that the opening of the vent was exposed (Figure 3). White tape had been applied on top of the shrink-wrap in the vicinity of the vent.

6 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Vent opening exposed Fig 3 Forward right-hand fuel vent on Bell 412-EP helicopter By comparison, the forward left-hand fuel vent on the opposite side of the helicopter was completely covered in shrink-wrap, so that the vent opening was sealed. White tape had also been applied in this area, but there was no evidence of fuel having leaked from this vent. The shrink-wrap was removed from the helicopter. No standing fuel was observed inside the shrink-wrap but some oil staining was evident on the inner surface of the wrapping. Some absorbent pads were also found inside the shrink-wrap. Upon opening the helicopter cabin, it was noted that the helicopter’s main battery (which displayed a ‘Class 8 (corrosive) hazard’ label) was installed in its normal stowage, but was disconnected. A fire extinguisher was secured to a stowage on the cabin floor. A number of cardboard packages containing various items were also found inside the helicopter cabin. During the examination the helicopter, including all wrapping and the internal packages, was weighed on the pallet and the total pallet weight was noted as 4,200 kg. The fuel filler cap was removed, allowing access to visually inspect the right upper fuel cell; fuel was present and the level was observed to be approximately half-way up the cell. There was no means to visually inspect the remaining cells. The helicopter was powered-up and the cockpit fuel quantity indicator indicated a total quantity of fuel on board of 1,440 lb. The helicopter was subsequently refuelled to full, after which the total fuel quantity indicated was 2,160 lb. The fuel bowser meter registered 467 litres. Following refuelling, the helicopter was observed by the onsite team for a period of two hours and the RFFS continued to observe the helicopter overnight. No fuel leaks

7 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 were observed. The helicopter was subsequently defuelled and shipped to the owner, after which it underwent a ‘5-year’ maintenance inspection. The owner advised that no defects were noted on the fuel system during this inspection which could have accounted for the fuel leak. Aircraft damage The interior of LX-VCF had suffered extensive fuel contamination. After the fuel vapours had dispersed, internal floor panels, ceiling panels and sidewall liners in the aircraft were lifted and contaminated insulation blankets were removed. Additionally, all aircraft system electronics, avionics wire looms and harnesses required decontamination. The aircraft undertook a ferry flight to its home base on 11 April 2017, after which a number of additional actions were required to return it to a fully airworthy condition, including extensive inspections, cleaning and application of corrosion-inhibiting fluid. All insulation blankets and lower deck ceiling liner panels and some elements of the cargo loading system required replacement. Background information In December 2016, the helicopter, a Bell 412EP serial number (S/N) 36414 had been sold by Bristow US LLC based in Louisiana, United States (the seller) to Agrarflug Helilift GmbH and Co in Germany (the buyer). Several agencies and individuals were involved in various aspects of the sale, preparation and transport of the helicopter. In addition to the seller and buyer, these included a sales agent acting as the buyer’s representative in the United States (US) and his assistants. Freight forwarding1 work was carried out by three organisations. A routing agent based in New Zealand was appointed to oversee the export requirements and transportation of the helicopter to Germany. It subsequently sub-contracted this work to a US-based cargo logistics company to act on their behalf in the US, which in turn appointed a US-based shipping agent to prepare the Air Waybill2 and report on progress. The helicopter was disassembled and prepared for transportation by the seller’s staff at their facility and loose items were loaded into crates. To protect it during transport, the helicopter fuselage was shrink-wrapped by a specialist company contracted by the sales agent. A road transport company then collected the shipment from the seller’s facility in Louisiana on 23 January 2017 and transported it by road to Houston Airport. It was intended that the buyer’s sales agent would oversee the disassembly and preparation of the helicopter for transport; however, he was unable to attend and instead sent two assistants to oversee the preparations on his behalf and to ensure that no Footnote 1 A freight forwarder, or forwarding agent, is a person or organisation that organises shipments of goods, often contracting with multiple carriers to move the goods. Freight forwarders who handle international shipments typically have additional expertise in preparing and processing customs and other shipping documentation. 2 The Air Waybill is a document issued by, or on behalf of, the shipper for the air transportation of cargo. It acts as a contract of carriage between the shipper and the carrier(s).

8 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 damage occurred to the helicopter. One assistant was present at the seller’s facility when the helicopter was shrink-wrapped; however, it had already been disassembled prior to his arrival. A second assistant was present to observe the helicopter shipment being loaded onto the delivery trucks. Shipping of the helicopter The shipping agent booked the shipment with the operator’s sales department on 23 January 2017, having previously obtained a quotation for shipment from the operator in August 2016. During the quotation and booking process, the shipping agent explicitly indicated in writing that all fuels and batteries had been removed from the helicopter and that the shipment was non-hazardous. The shipping agent issued an Air Waybill for the shipment on 24 January 2017. The final destination for the shipment was Germany, and it was planned to travel by air via Luxembourg to Brussels and then onward by road to Germany. The shipment, comprising nine loose crates and the helicopter secured to a 20 ft pallet, was delivered to the operator’s facility at Houston Airport on 26 January 2017. After checking the documentation and conducting a visual inspection of the exterior of the wrapped helicopter, it was accepted for travel by the Dangerous Goods Manager from the operator’s contracted Ground Handling Agent (GHA). The loose crates were built-up on two pallets. The shipment was subsequently placed on hold by both the US Department of Commerce and US Customs, and was not released for export until 21 March 2017. It remained in the operator’s cargo warehouse during this time. The shipment was booked to travel on flight CV8617 on 24 March 2017; however, the operator was unable to produce a lashing scheme to secure the helicopter due to a software problem and only the nine loose crates travelled on this flight. The helicopter was re‑booked to travel on flight CV8617, on 27 March 2017. However, after having been loaded onto flight CV8617 the operator’s loading supervisor noticed a small fuel leak from the helicopter. The leak was described as a ‘patch/stain of fluid on the ULD under the centre of the helicopter, approximately 6 to 10 inches in diameter’ and was reported to smell like jet fuel. The helicopter was offloaded and returned to the cargo warehouse. The operator’s sales department informed the shipping agent and asked it to arrange for an inspection of the helicopter. On 28 March 2017, a mechanic3 inspected the helicopter at the operator’s cargo facility. Also present was a representative from the shipping agent4 and one from the operator’s sales department. The mechanic, again accompanied by the shipping agent, returned later the same day to re-inspect the helicopter and perform additional work. They were escorted by a GHA agent. Review of CCTV footage from the cargo facility showed that Footnote 3 Who was also one of the sales agent’s assistants and had witnessed the helicopter being loaded onto the road transportation at the seller’s facility. 4 Who had prepared the Air Waybill.

9 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 this inspection lasted approximately 30 minutes. No walkaround was conducted and the mechanic appeared to focus his attention on the lower surface of the helicopter. He did not use any tools or remove the shrink-wrap to facilitate inspection of the helicopter. He used a cleaning spray to clean parts of the exterior surface, inserted absorbent pads between the shrink-wrap and the helicopter skin and applied some white tape over the shrink-wrap. The mechanic and shipping agent informed the cargo operator, and the other agencies involved in the transportation including the cargo logistics company, that the fuel leak had originated from residual fuel in the fuel lines and had been capped off. On 29 March 2017, the shipping agent provided the cargo operator with a revised Air Waybill and Air Cargo Manifest, together with a Purge Certificate indicating that the helicopter was free from fuel. The cargo operator accepted the shipment for travel and it was loaded on flight CV7754, which departed Houston on 30 March 2017. The loading supervisor responsible for this flight checked the helicopter several times prior to, during, and after loading and there was no evidence of a fuel leak or spill. Documentation The aircraft sales agreement for purchase of the helicopter was signed on 30  December  2016. The supporting documentation which formed part of the sales agreement stated that the helicopter was sold on an ‘As is – where is’ basis; that the helicopter was in a non-flyable condition at the time of sale; that the helicopter would be ‘delivered’ (handed over) at the seller’s (Bristow US LLC) facility for shipment at the buyer’s (Agrarflug’s) expense; that the seller would assist the buyer in disassembly and packaging of the aircraft at the seller’s facility, using reasonable packing practices; and, that the buyer’s representatives would be on hand to supervise and accept the packaging. A US Department of Commerce Shipper’s Export Declaration prepared by the cargo logistics company, stated that no hazardous materials were being exported. This document was signed by a Bristow US LLC employee on 23 January 2017, authorising the cargo logistics company to act as a forwarding agent for export control and customs purposes for the export of the helicopter. The original Air Waybill, issued by the shipping agent on 24 January 2017, described the helicopter as ‘Civil Model B412EP Helicopter (Helicopter main cabin)’ and declared the shipment as: ‘Consolidated cargo5 as per attached manifest’, which was also reflected on the original Air Cargo Manifest issued on 29 January 2017. Both the Air Waybill and the Air Cargo Manifest listed the cargo logistics company as the shipper. An Air Waybill requires two signatures, one from the ‘Shipper or his agent’ and one from the ‘Issuing carrier or its agent’. The original Air Waybill had a single signature across both fields. Footnote 5 Consolidated cargo refers to a consignment comprising of multiple packages, originating from more than one person, and shipped under one Air Waybill.

10 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Following inspection of the helicopter in Houston, a new Air Waybill and Air Cargo Manifest were issued by the shipping agent with the following statement added: ‘Not restricted as per special provisions A70.’ The revised Air Waybill was not signed. Additionally, a Purge Certificate dated 29 March 2017, produced by Agrarflug and signed by its Director of Maintenance, was provided to the cargo operator. This stated that the helicopter had been: ‘flushed, purged of all fluids and is clean and dry. Inhibiting fluid in accordance with (IATA) International Air Transportation Associated [sic] and is NOT considered as DANGEROUS GOODS.’ The load sheet for flight CV7754/30 March 2017 on which the helicopter travelled stated that the weight of the helicopter pallet was 4,455 kg. The Notification to Captain (NOTOC6) document for flight CV7754/230 March 2017 did not include any reference to the helicopter shipment. Additional information Bristow US LLC advised that, under the terms of the sales agreement, the buyer had complete responsibility for inspecting and transporting the helicopter. Agrarflug advised that it understood that the seller was responsible for preparing the helicopter for transport. It provided an email from the seller written in December 2016 which stated that ‘the aircraft will be prepared for shipping on 09 Jan.’ Other email correspondence from the buyer indicated that its representatives would oversee preparations of the helicopter for movement to Germany. The buyer’s sales agent confirmed that neither he nor his assistants had performed any work to disassemble, clean, drain, or package the helicopter and were not present when it was disassembled for transport. Additionally, he stated that he had no reason to suspect that the helicopter was fuelled as the Shipper’s Export Declaration provided to him by the seller indicated that no hazardous materials were being exported. Furthermore, based on his previous experience, he was aware that Bristow US LLC usually drained all fuel from helicopters it sold. A representative from the company who shrink-wrapped the helicopter advised that an open-flame torch was used to shrink the plastic wrap and stated that they would not have wrapped the helicopter if they had known it was fuelled. Representatives from both the cargo logistics company and the shipping agent reported that they were not aware that there was fuel or other dangerous good onboard the helicopter, when making arrangements for its transport or producing the Air Waybill. They based this understanding on the Shipper’s Export Declaration which indicated that no hazardous materials were being exported. Footnote 6 The NOTOC is a form which is used to notify the commander of an aircraft when dangerous goods are to be loaded on the aircraft board their flights. The NOTOC describes the nature, quantity of the dangerous goods and the location where it is loaded on the aircraft.

11 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 The mechanic who inspected the helicopter in the cargo warehouse in Houston informed the investigation that he had not seen any active dripping of fuel, just fuel residue. He concluded that escape of fuel was due to residual fuel in a fuel line that had been released when the helicopter was moved. He stated that the drip appeared to have come from the right side of the helicopter in the area of the fuel booster pump. In email correspondence relating to the fuel leak and subsequent inspection of the helicopter in Houston, the cargo logistics company indicated that if the mechanic could remove all the residual fuel, it might still be possible to ship the helicopter as non-hazardous cargo, but that a purge letter would be required from the shipper on company letterhead to verify this. The routing agent indicated that he did not believe the seller would provide this and instead asked Agrarflug to provide this. An email sent by the mechanic on 28 March 2017 following his inspection of the helicopter stated that ‘there was a minimal amount of residual fuel which had collected in the left-hand sump area and was seeping out of the drain’. He also indicated in the email that he had cleaned up the escaped fuel and placed approximately 50 absorbent pads between the fuselage and the shrink-wrap to absorb any additional fuel which might move to the sump area when the aircraft was moved. The buyer’s Director of Maintenance informed the investigation that he had issued the Purge Certificate stating that the helicopter had been flushed and purged of all fluids, following confirmation from the mechanic that the fuel leak in Houston was caused by residual fuel in the fuel lines. Shipping of dangerous goods by air ICAO Annex 18 to the Chicago Convention describes the international standards and recommended practices relating to the ‘Safe transport of dangerous goods by air’. It requires that dangerous goods are carried in accordance with ICAO document 9284 ‘Technical instructions for the safe transport of dangerous goods by air’ (known as the “Technical Instructions”), which contains requirements for the classification, preparation, packaging, documentation and transportation by air of dangerous goods. The International Air Transport Association (IATA) publishes the Dangerous Goods Regulations (DGR), a field manual which describes the requirements of the ICAO Technical Instructions, along with additional explanatory material. It is widely used by IATA member airlines and shippers and, is recognised as the industry standard guidance on the transportation of dangerous goods by air. The 58th edition of the DGR, effective 1 January 2017, was valid at the time the helicopter was packaged and transported. Air transportation of a vehicle, such as the helicopter, falls into the category of ‘UN3166 Vehicle, flammable - liquid powered’ and is considered as Class 9 Dangerous Goods. Shipment by air would require compliance with stringent requirements for preparation, packaging and labelling of the helicopter to identify it as dangerous goods. However, the DGR contained Special Provision A70 relating to the transport of engines and vehicles, which states:

12 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 ‘A70 Internal combustion or fuel cell engines of machinery, being shipped either separately or incorporated into a vehicle, machine or other apparatus, without batteries or other dangerous goods, are not subject to these Regulations when carried as cargo, provided that: (a) For flammable liquid powered engines:

The engine is powered by a fuel that does not meet the classification criteria for any class or division; or

The fuel tank of the vehicle, machine or other apparatus has never contained any fuel, or the fuel tank has been flushed and purged of vapours and adequate measures taken to nullify the hazard; and

The entire fuel system of the engine has no free liquid and all fuel lines are sealed or capped or securely connected to the engine and vehicle, machinery or apparatus. …… When this special provision is used, the words “Not Restricted” and the Special provision number must be included in the description of the substance on the Air Waybill as required by 8.2.6., when an Air Waybill is issued.’ The DGR defines the shipper’s responsibilities when offering a consignment of dangerous goods for air transportation. Section 1.3.2 ‘Specific Responsibilities’ states: ‘ …. (b) the shipper must ensure that the articles or substances are not prohibited for transport by air (c) the articles or substances must be properly identified, classified, packed, marked, labelled, documented and be in the condition for transport in accordance with these Regulations.’ Helicopter transportation guidance Bell Helicopter publish transportation guidance for the 412-series helicopter in a document entitled ‘M412 Transportation Guide’. It describes the actions taken by Bell when a helicopter is prepared for shipping from its manufacturing facility. In the list of components removed for shipping, it recommends that fuel is drained from the helicopter. Agrarflug indicated that it believed the helicopter had been prepared for transportation in accordance with this guidance.

13 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Operator’s procedures The operator’s Ground Operations Manual states the following with respect to accepting shipments: ‘Reasonable measures (e.g. physical check of documentation and/or packages) shall be taken to avoid the transportation of hidden dangerous goods; confirmation shall be obtained from the shipper/forwarder about the contents of any consignment whenever there is any suspicion that it may contain dangerous goods.’ It also states: ‘Vehicles including cars, motorcycles, helicopters etc. shall be booked as dangerous goods, unless they are shipped under Special provision A70 and do not contain any hazardous equipment such as a battery, fire extinguisher, tire-inflation canister, safety device, etc. and completely empty of residual fuel. This means that they must be completely drained, sufficiently cleared of residue and purged of vapors [sic] to remove/nullify potential hazard.’ The operator’s procedures included a Helicopter Acceptance Checklist to be used when an unpackaged helicopter was booked as dangerous goods however, it was not required to be used if a helicopter was shipped under Special Provision A70. Operator’s safety investigation The cargo operator’s safety department conducted an internal safety investigation. It identified a number of issues relating to recurrent training of its staff; however, both the loading supervisors and the GHA DG Manager involved in the shipping of the helicopter held valid dangerous goods licenses. The operator also identified some issues with adherence to its internal emergency notification and response procedures, and the reporting of occurrences pertaining to damaged or leaking dangerous goods to its safety department. Following this event, the operator made a number of revisions to its procedures and made safety recommendations to various areas of its business. This including recommending that its contracted GHA take steps to raise awareness among its staff about the possibility of dangerous goods in general cargo and to improve methods for detecting of undeclared dangerous goods. Bell 412EP fuel system description General The Bell 412EP helicopter is fuelled by Jet A1 fuel and, in its standard configuration, has a total fuel capacity of 337.5 US Gallons (USG)/1,277.58 litres. Fuel is stored in ten interconnected lightweight cells made from a laminated fabric and rubber construction.

14 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 There are six cells below the cabin floor; three on each side, and four cells located below the engine compartments aft of the cabin and pylon (Figure 4). The helicopter is fuelled through a filler cap in the upper right cell, located on the right side of the aft fuselage. Fuel gravity-feeds from the upper cells into lower cells through interconnecting fuel lines. The helicopter being transported in LX-VCF had been modified to add a single rigid auxiliary fuel tank on the left side of the aft cabin, which had a capacity of 81.7 USG (309 litres), giving a total fuel capacity of 419.2 USG (1,587 litres). The auxiliary tank was installed by Bristow US LLC, in accordance with Bell Helicopter’s Service Instruction BHT-412-SI-4 ‘Bell Model 412 Service Instruction for Auxiliary Fuel Kit’. The fuel system includes a number of fuel transfer, boost and ejector pumps located in the lower fuel cells. Each of the six lower cells has a spring-loaded, poppet-type sump drain valve; those in the lower main cells can be opened by either electrical or manual actuation, while those in other lower cells are manually operated, push-to-drain valves. Defuelling valves located in the sump areas of the lower main cells require removal of a plug and insertion of a standard fitting to open the spring-loaded poppet and operate the valve. To enable fuel transfer, an interconnect system, shown by the pink lines in Figure 4, joins the lower cells together. Each lower forward and lower middle cell is permanently connected to its opposite side cell via the interconnect lines and fuel can pass freely from the left to right side and vice versa. The combined capacity of the two lower forward cells is approximately 48.5 USG (183.6 litres) and the combined capacity of the two lower middle cells is approximately 32 USG (121.1 litres). At fuel loads above approximately 1,663 lb, all six lower cells would be full. Fuel vent system The fuel vent system is shown by blue lines in Figure 4. A collective vent on top of upper aft centre cell connects the four upper cell vent spaces with two vertical lines which vent overboard beneath the fuselage. Each lower main cell vents through a line connecting into the upper forward centre cell. A forward vent line on each side of the fuselage connects with the respective lower forward and lower middle cells. These lines rise through the helicopter doorposts to a waterline above the upper cells and then double back downward to vent overboard beneath the fuselage. AAIB investigation The US Federal Aviation Administration (FAA) Hazardous Materials Safety Division were notified of this event and initiated its own separate investigation to explore the issues relating to undeclared and leaking dangerous goods. The FAA interviewed many of the individuals and organisations involved in preparing the helicopter for transportation and issuing the associated shipping documentation. Details from these interviews were shared with the AAIB; however, not all the individuals and organisations engaged directly with the AAIB safety investigation. The AAIB was therefore limited in its ability to explore more fully some of the issues relating to this event.

15 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 UPPER RIGHT UPPER LEFT UPPER LEFT UPPER AFT & FWD CENTRE LOWER LEFT FWD LOWER LEFT MIDDLE LOWER LEFT MAIN LOWER RIGHT MIDDLE LOWER RIGHT MAIN LOWER RIGHT FWD UPPER RIGHT Figure 4 Bell 412EP Simplified fuel system schematic (Note: auxiliary tank not shown) Discussion General The escape of fuel from the helicopter represented a substantial hazard to the safety of the aircraft, the flight crew and those on the ground at Prestwick Airport. The airport RFFS advised that the measured fuel vapour levels within the aircraft indicated a high risk of explosion and that the fuel flammability limits were potentially in range. Additionally,

16 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 photographs show that fuel was exiting the aircraft close to the left body landing gear and pooling beneath the aircraft. The presence of fuel in proximity to potentially hot wheel brakes created a substantial risk of fire. Preparation and packaging of the helicopter for transport Correspondence and documentation relating to the sale of the helicopter indicated that the seller would assist the buyer in disassembly and preparation of the helicopter for transportation, under the supervision of the buyer’s representatives. The buyer believed that these preparations would include defuelling of the helicopter. The seller considered that all transportation matters were the responsibility of the buyer, but was aware of the intention for the helicopter to be transported as air cargo. Notwithstanding the issue of where the contractual commitment for preparation and defuelling of the helicopter lay, the disassembly of the helicopter and preparations for its transport took place at the seller’s facility and were conducted by its staff, despite a substantial amount of fuel remaining on the helicopter. The buyer assumed that the helicopter would be prepared in accordance with guidance published by the helicopter manufacturer, which recommends defuelling as part of the preparations for transportation. The preparations also included packaging of the helicopter using an open flame, which would have represented a significant health and safety risk to those involved. Neither the seller’s staff undertaking the disassembly, nor the buyer’s representatives who were subsequently in attendance, identified the fact that a substantial amount of fuel remained onboard the helicopter prior to it being packaged and transported. The following Safety Recommendation is therefore made: Safety Recommendation 2018-011 It is recommended that Bristow US LLC review their procedures relating to the preparation of helicopters for air transportation to ensure that they are defuelled. Shipping and shipping documentation The Shipper’s Export Declaration for the helicopter indicated that no hazardous materials were being exported. This document formed the basis upon which other transportation documentation was raised. However, it did not accurately reflect the presence of fuel on board the helicopter, nor the battery and fire extinguisher within the helicopter cabin, which also required identification as dangerous goods. Special Provision A70 of the IATA Dangerous Goods Regulations allows vehicles such as the helicopter to be transported by air without being declared as dangerous goods, providing batteries or other dangerous goods are removed, that the fuel tank and fuel system has been flushed and purged of all fuel and fuel vapours and that the statement ‘Not restricted as per special provision A70’ is included on the Air Waybill. When using this provision, it is the shipper’s responsibility to ensure that the shipment complies with these requirements.

17 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Email correspondence between the shipping agent and the cargo operator during the booking process specifically stated that all fuels and batteries had been removed and that the shipment was non-hazardous. However, although the paperwork generated for transportation and export of the helicopter indicated that the shipment was non-hazardous consolidated cargo, there were a number of anomalies with the shipping documentation. The original Air Waybill neither declared the shipment as dangerous goods, nor referenced the exemptions of Special Provision A70, and was therefore not in compliance with either the DGR or the operator’s own acceptance procedures. Additionally, neither the original nor the revised Air Waybill contained the required signatures. The operator’s GHA acceptance staff indicated that the decision to accept the shipment was influenced in part by the description of the helicopter as ‘Civil Model B412EP Helicopter Main Cabin’ on the Air Cargo Manifest and the assumption that only the frame of the helicopter was being shipped. Although the revised shipping documentation subsequently indicated the helicopter was being shipped as unrestricted cargo under the provisions of Special Provision A70, it did not reflect the actual condition of the helicopter and the shipment was not in compliance with the requirements of the Special Provision. As such, the helicopter was shipped as non‑declared dangerous goods and this hazard was not identified to the operator, nor the flight crew of flight CV7754. Proper declaration and documentation of dangerous goods by a shipper ensures that all parties involved in the transportation chain know what type of goods they are transporting, how to load and handle them and what steps to take in the event of an incident such as a leakage. Three entities were involved in organising the shipping logistics and documentation for the helicopter. The routing agent took a coordinating role, having sub-contracted responsibility for the export and transportation of the helicopter to the cargo logistics company. As the designated shipper named on the Air Waybill, the legal contract of carriage by air was between the cargo logistics company and the operator. The DGR identify that it is the shipper’s responsibility to ensure articles are properly identified, classified, packed, marked, labelled and documented. However, the cargo logistics company further delegated responsibility for production of the shipping documentation to the shipping agent and the documentation did not fully comply with the DGR, nor did it reflect the actual state of the helicopter. The dilution of responsibility among the various individuals and organisations involved in the shipping of the helicopter meant that no single organisation or individual was able to assure that the shipping documentation reflected the actual condition of the helicopter. The investigation did not determine whether this was indicative of a wider issue within the air freight industry, however the cargo operator indicated its belief that it was. Due to the limitations of the AAIB investigation there was not considered to be sufficient evidence to make a formal Safety Recommendation on this subject. However, this report has been shared with the IATA Dangerous Goods Board7 for its consideration. Footnote 7 The IATA Dangerous Goods Board reviews and determines standards and procedures necessary for the safe carriage of dangerous goods by air, and promotes the worldwide recognition, adoption of and adherence to those standards and procedures. It works closely with the ICAO Dangerous Goods Panel, which sets the international requirements for transportation of dangerous goods by air and is responsible for reviewing proposed revisions to ICAO document 9284.

18 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 Opportunity to detect the presence of Dangerous Goods in Houston A small fuel leak observed while the helicopter was being loaded onto an aircraft for planned travel on 27 March 2017 resulted in the shipment being offloaded and returned to the cargo warehouse. This fuel leak, and the subsequent inspection of the helicopter by a mechanic and shipping agent, presented an opportunity to detect that the helicopter had not been defueled prior to transport. However, CCTV footage of the inspection shows that while the mechanic cleaned fuel residue from the shrink-wrap coating and inserted absorbent pads, he took no steps to determine the actual fuel state of the helicopter during the inspection. Despite this, the mechanic subsequently confirmed that the source of leak was residual fuel in the fuel lines and this information was communicated to the cargo operator and to the other agencies involved in the transportation of the helicopter. Based on this information, and at the request of the routing agent, Agrarflug issued a Purge Certificate, expressly stating that the helicopter had been purged of all fluids and was not considered as dangerous goods, despite not having been able to verify the actual condition of the helicopter. The Air Waybill and Air Cargo Manifest were updated accordingly and these three documents were presented to the operator. The operator did not question the fact that the Purge Certificate had been issued by the buyer in Germany, as it is not a mandatory document for items shipped under Special Provision A70. With no expectation that dangerous goods were a factor in the transportation of the helicopter, and having taken steps to address the source of the fuel leak from the helicopter, the operator accepted the helicopter for transport on its aircraft. Escape of fuel during the flight During the post-incident inspection at Prestwick, the helicopter battery was observed to be disconnected; therefore, none of the helicopter fuel pumps could have operated during the incident flight. The investigation considered that possible routes for fuel to escape from the helicopter could have included: via the sump drain valves, defuelling valves, the fuel vent lines or a loose connection in a fuel system interconnect line. With the exception of the small fuel leak noticed on 27 March 2017, no fuel was observed to escape from the helicopter during the two-month period it was stored in the cargo warehouse in Houston. Nor did any fuel escape from the helicopter after refuelling in Prestwick following the incident. Furthermore, a subsequent maintenance inspection at the new owner’s facility, did not reveal any defects with the fuel system which could have accounted for the fuel leak. It was therefore considered unlikely that a loose connection in a fuel line or a partially-open or stuck sump drain/defuelling valve could have contributed to the fuel escape during the flight. When the aircraft arrived in Prestwick, the ground operations agent who first entered the aircraft observed that fuel appeared to be escaping via a vent tube on the forward right‑hand side of the helicopter. Subsequent inspection of the helicopter identified that the shrink‑wrap in which the helicopter had been encased had been applied such that the opening in the forward right-hand fuel vent tube was exposed, while that on the forward left-hand vent was completely sealed. The forward vent lines serve the lower forward and lower middle cells on each side of the helicopter. Although the left and right side vent lines are not connected, each lower forward

19 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03 and lower middle cell is permanently connected to its opposite side cell via the interconnect lines and fuel can pass freely from the left to right side and vice versa. The manner in which the helicopter was shrink-wrapped created a seal over the forward left vent tube; this may have prevented the pressure within the four forward fuel cells from equalising in response to aircraft cabin pressure changes during the descent into Prestwick. In the absence of any other defects which could account for the escape of fuel, the investigation considered that this wrapping of the vents may have induced a siphon-like effect, or caused the flexible fuel cells to temporarily deform, as the aircraft’s cabin pressure equalised during the descent to land at Prestwick, causing fuel to be ejected via the forward right-hand vent tube. The aircraft operator reviewed the aircraft’s pressurisation profile for the incident flight and compared it with a number of flights by the same aircraft on the same route. There was nothing unusual about the pressurisation profile on the incident flight. The helicopter manufacturer checked its occurrence database and did not find any reports of customers reporting fuel exiting out of the forward fuel vent tubes. The manufacturer commented that there is a fuel/air separator within the forward fuel vent system which is intended to allow fuel vapours to escape to the overboard vent, while any liquid fuel should drain back into the relevant fuel cell by gravity. However, the circumstances of this fuel leak are somewhat unique, and it is highly unlikely that the behaviour of the helicopter fuel system in such circumstances would have been previously considered or predicted. The precise fuel state of the helicopter prior to its shipment by air is not known however, the post-incident weight of the helicopter pallet was some 255 kg lighter than that noted on the label attached to the pallet and the load sheet for flight CV7754. The scales used to weigh the pallet in Houston and Prestwick were both within calibration requirements. It is therefore concluded that approximately 255 kg of fuel had escaped from the helicopter during the flight, which equates to approximately 322 litres8 of fuel. Only the upper right fuel cell can be visually inspected on the Bell 412EP and during the post- incident inspection in Prestwick this cell was observed to be approximately half full. The fuel distribution within the remaining cells was not determined. The total indicated fuel quantity was noted as 1,440 lb, symmetrically distributed between the left and right cells. When the helicopter was refuelled, 467 litres were required to reach the fully fuelled condition. Given the helicopter’s total fuel capacity of 1,587 litres, the post‑incident volume of fuel was determined to have been 1,120 litres. Taking into account the approximate 322 litres which escaped, the fuel state prior to transportation of the helicopter was calculated to have been approximately 1,442 litres. At this fuel state, all the lower fuel cells would have been full. The combined capacity of the lower forward and lower middle tanks, served by the forward vent lines, is approximately 304.7 litres, which is broadly equivalent to the quantity of fuel calculated to have escaped during the flight. Footnote 8 Converting a weight of fuel to a volume of fuel requires the specific gravity of the fuel to be known. The specific gravity of fuel varies with temperature and can be influenced by a number of other factors. The specific gravity of Jet A1 fuel is typically 0.79 at 15oC, but can range from 0.77 to 0.83. The specific gravity of the fuel on the helicopter is not known however a specific gravity of 0.79 has been used for illustrative purposes.

20 © Crown copyright 2018 All times are UTC Conclusions Regardless of the exact mechanism by which the fuel escaped from the helicopter, the IATA Dangerous Goods Regulations exist to prevent the transportation of hazardous cargo representing a hazard to the safety of an aircraft. Adequate steps were not taken to correctly prepare the helicopter for transport and this situation was not identified prior to it being offered for transportation by air. The investigation identified that the dilution of responsibility among the various individuals and agencies involved meant that no one agency or individual could assure that the shipping documentation reflected the actual condition of the helicopter and was in compliance with the DGR. An inspection of the helicopter prior to travel was superficial in nature and, although no attempt was made to verify the actual fuel state of the helicopter, incorrectly concluded that the helicopter had been defuelled. This resulted in the helicopter shipment being identified as unrestricted cargo, despite containing non-declared dangerous goods. The fuel hazard was not identified to the operator or the commander of the flight on which the helicopter travelled, and they were therefore unaware of the risk it posed. The escape of fuel from the helicopter during the flight represented a substantial hazard to the safety of the aircraft, the flight crew and those on the ground at Prestwick Airport. The containment actions taken by the RFFS at Prestwick Airport substantially reduced the possibility of a more adverse outcome. One Safety Recommendation is made concerning procedures for the preparation of helicopters for air transportation. In addition, the operator has made a number of revisions to its procedures. It has also recommended that its contracted GHA take steps to raise awareness among its staff about the possibility of dangerous goods in general cargo and to improve methods for detecting of undeclared dangerous goods. Bulletin Corrections Following publication of the report the following two corrections were made. Page 11: The first sentence of the section titled ‘Shipping of dangerous goods by air’ has been deleted and replaced to provide additional clarification. Page 17: Footnote 7 has been amended to provide additional clarification. Further information regarding these corrections can be found on the AAIB website - https:// www.gov.uk/aaib-reports/aaib-investigation-to-boeing-747-8r7f-lx-vcf and will be published in Bulletin 10/2018. The online version of the report was amended on 15 August 2018. AAIB Bulletin: 7/2018 LX-VCF EW/C2017/03/03

FD06622 ｜ 2018_英国_aaib-investigation-to-boeing-757-28a-g-oobc__Boeing_757-28A_G-OOBC_03-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

121 © Crown copyright 2018 All times are UTC AAIB Bulletin: 3/2018 G-OOBC EW/G2017/07/07 SERIOUS INCIDENT Aircraft Type and Registration: Boeing 757-28A, G-OOBC No & Type of Engines: 2 Rolls-Royce RB211-535E4-37 turbofan engines Year of Manufacture: 2003 (Serial no: 33098) Date & Time (UTC): 8 July 2017 at 0600 hrs Location: En route from Manchester to Girona Airport, Spain Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 7 Passengers - 204 Injuries: Crew - 3 (Minor) Passengers - None Nature of Damage: None Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 55 years Commander’s Flying Experience: 21,230 hours (of which 9,650 were on type)

Last 90 days - 240 hours

Last 28 days - 90 hours Information Source: Aircraft Accident Report Form submitted by the pilot and investigation by the operator Synopsis During a passenger flight to Spain, extensive smoke emitted from the forward galley ovens which, despite cabin crew actions, did not dissipate. The aircraft subsequently diverted to London Gatwick. An investigation by the operator determined that the ovens had been cleaned with a degreasing fluid which was not designed to be used in aircraft ovens. History of the flight Approximately 15 minutes after takeoff a member of the cabin crew switched the forward galley ovens on prior to starting the in-flight drinks service. When the cabin crew member returned to the galley a few minutes later, smoke was emanating from both ovens. The cabin crew member pulled the circuit breakers for the ovens and requested assistance from other crew members in the rear galley. A BCF extinguisher was discharged into both ovens and the commander was informed of the situation and that the fire drill actions had been completed. The smoke did not dissipate or reduce, so the cabin crew discharged a second BCF extinguisher which, once again, had no noticeable effect. The cabin crew updated the commander of the situation and the decision was made to divert to London Gatwick. After landing, the aircraft taxied onto a stand where AFRS personnel confirmed that there was no further fire hazard. Ground staff assisted with passenger

122 © Crown copyright 2018 All times are UTC AAIB Bulletin: 3/2018 G-OOBC EW/G2017/07/07 disembarkation while three cabin crew members received medical assistance on board before being taken to hospital for checks. Investigation Examination of the forward galley ovens confirmed that a fluid was present in the interior of both ovens. The ovens were removed from the aircraft for cleaning and testing. Inspection of the ovens in the rear galley showed that they were contaminated with a similar fluid. The rear galley ovens were cleaned and the ovens operated to ensure that they did not produce smoke. The fluid in both the forward and rear galley ovens was found to be a degreasing fluid, commonly used for removing chewing gum from carpets, and not the approved oven cleaning fluid. The aircraft ovens had been ‘deep cleaned’ 48 hours prior to the incident flight and the incident flight was the first time the aircraft had operated since the ‘deep clean’. The aircraft operator and the contracted aircraft cleaning company reviewed the approved oven cleaning instructions and confirmed that they were unambiguous and make reference to the use of the correct cleaning fluid. An investigation carried out by the cleaning company appeared to confirm that the ‘deep clean’ had been completed in accordance with the approved cleaning instructions, that the correct fluid had been used and that it was not possible to identify when or how the ovens became contaminated with the degreasing fluid.

FD06623 ｜ 2018_英国_aaib-investigation-to-boeing-777-236-g-viij__Boeing_777-236_G-VIIJ_09-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

51 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018

AAIB Bulletin: 9/2018 G-VIIJ EW/G2017/11/13 SERIOUS INCIDENT Aircraft Type and Registration: Boeing 777-236, G-VIIJ No & Type of Engines: 2 General Electric Co GE90-85B turbofan engines Year of Manufacture: 1997 (Serial no: 27492) Date & Time (UTC): 13 November 2017 at 1230 hrs Location: In the decent into London Heathrow Airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 14 Passengers - 149 Injuries: Crew - None Passengers - None Nature of Damage: N/A Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 49 years Commander’s Flying Experience: 20,000 hours (of which 9,350 were on type)

Last 90 days - 220 hours

Last 28 days - 76 hours Information Source: Aircraft Accident Report Form submitted by the operator and further AAIB investigation Synopsis During descent into London Heathrow Airport a strong smell of fumes was apparent in the cockpit and the cabin. The crew actioned the appropriate checklist and the aircraft landed at Heathrow without further event. The aircraft was returned to service after engineering work. On the next flight the aircraft returned to stand due to fumes in the cabin having taxied for takeoff. After further engineering work the aircraft was again returned to service. The aircraft then flew once more without incident but on the return flight there were several indications of overheating in the left engine. The subsequent engineering work identified a hole in the left engine’s combustor case, which resulted in the engine being changed. A replacement engine was installed and there were no further fume events. History of the flight The aircraft was on a scheduled flight from Houston Intercontinental Airport, USA, to Heathrow Airport. The co-pilot was the pilot flying, the commander was pilot monitoring. During the initial cruise descent inbound to Heathrow, about an hour before landing, there was a strong smell of fumes in the flight deck. This was quickly followed by reports from the cabin crew of fumes in the front and rear of the passenger cabin. The relief first

52 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018

AAIB Bulletin: 9/2018 G-VIIJ EW/G2017/11/13 officer1 entered the cabin to check the intensity of the fumes there. The Smoke, Fire or Fumes checklist was actioned and the co-pilot donned his oxygen mask first, followed, after an increase in intensity, by the commander, and the relief first officer upon his return to the flight deck. While the checklist was being actioned reports of fumes continued in the cabin with no change in intensity in the flight deck. The pilots decided to continue to Heathrow and transmitted an urgency message to ATC. A NITS2 brief was then made to the cabin service manager. A short time later, haze was reported at Door 2 Left, so the Smoke Removal checklist was actioned with little appreciable reduction in the intensity of the fumes. The aircraft subsequently completed an uneventful autoland at Heathrow and, after an inspection of the aircraft by the RFFS, the aircraft taxied to stand and the passengers disembarked normally. Subsequent events On 15 November 2017, at the beginning of the aircraft’s next intended flight, an oily smell became apparent as the left engine was started, and the aircraft returned to stand. Subsequent engineering work included the replacement of the APU and various components in the aircraft’s air conditioning system. However, during ground run checks fumes were again identified and the left engine identified as the source. The engine was checked in accordance with the Fault Isolation Procedure for ‘oil fumes / smoke in the cabin’ but, based upon the description of the event, the procedure for ‘fuel fumes / smoke in the cabin’ was not considered to be applicable. Inspections of the left engine’s compressors showed no evidence of oil. The left engine bleed air supply was isolated at the Pressure Regulating and Shut-Off Valve and the aircraft completed an uneventful flight to Seattle with the valve locked closed in accordance with the Master Minimum Equipment List on 18 November. The following day, as the aircraft climbed through 8,000 ft after departing Seattle for Heathrow, the crew were alerted to a left engine overheat. Actions were taken in accordance with the Quick Reference Handbook and the pilots consulted the operator’s maintenance control at Heathrow using a satellite phone. Engine EGT and other parameters were normal, and it was concluded that the warning was spurious, so the flight continued to its destination. Examination of the aircraft after landing identified ‘sooting’, heat damage and a hole in the engine combustion chamber case, just aft of one of the fuel nozzles. The engine was removed pending further investigation by its manufacturer. Since the engine change the aircraft has operated without any further fume events. Footnote 1 There were three pilots on this flight; the commander and first officer who were sat in the pilots’ seats, and a ‘relief first officer’, who sat on the ‘jump seat’ behind the centre consol. 2 NITS stands for Nature [of the emergency], Intentions, Time [available before landing] and Special instructions.

53 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018

AAIB Bulletin: 9/2018 G-VIIJ EW/G2017/11/13 Fuel nozzle installation The GE90 engine has 30 fuel nozzles that provide fuel to the combustor. The nozzles are attached to the engine casing using bolts and each nozzle has two ‘swirler’ assemblies. These ensure proper mixing of the fuel and air in the combustor.  The swirler assembly includes a ferrule and retainer.  The retainer captures the ferrule, which floats inside the swirler assembly.  The swirler assembly is welded to the combustor dome assembly. Engine investigation The engine manufacturer established that a swirler retainer had detached because the weld had broken. The loose retainer eventually chafed through the fuel nozzle and the resultant fuel spray ignited, burning through the combustion chamber case. This caused an overheat indication that was successfully managed by the crew during the flight from Seattle. The cause of the retainer detaching could not be established but extensive analysis and testing discounted the possibility of loose bolts or a weld deficiency; weld repairs were permissible but no such repair had been embodied on the failed component. Fault Isolation Manual The Boeing 777 Fault Isolation Manual defines the procedures to diagnose faults in service. At the time the incident occurred, the appropriate Fault Isolation Procedure consisted of two steps, depending if the fumes were associated with oil or fuel. If the fumes were associated with fuel, the engine fuel nozzles would be inspected for carbon contamination, which “would identify unusual combustor damage before more significant consequential damage occurs”. If the fumes were associated with oil, there was no requirement to inspect the fuel nozzles. In the case of G-VIIJ, the fumes were attributed to oil, so the fuel nozzles were not inspected. Safety actions The engine manufacturer stated that this was the first reported event in the history of the GE90’s approximately 24 million operating hours. The cause of the failure was not determined but the engine and airframe manufacturers have instigated the following safety actions: As a precautionary measure, all swirler repair schemes will be deleted from the engine overhaul manuals. The Fault Isolation Procedure for smoke or fumes in the cabin has been amended. If the engine is identified to be the source of fumes or smoke, the revised procedure includes a requirement to inspect the fuel nozzles irrespective of whether the fumes are believed to be associated with oil or fuel.

FD06624 ｜ 2018_英国_aaib-investigation-to-bulldog-series-120-model-1210-g-bhxb__Bulldog_Series_120_Model_1210.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

131 © Crown copyright 2018 All times are UTC AAIB Bulletin: 3/2018 G-BHXB EW/G2017/09/15 ACCIDENT Aircraft Type and Registration: Bulldog Series 120 Model 1210, G-BHXB No & Type of Engines: 1 Lycoming IO-360-A1B6 piston engine Year of Manufacture: 1980 (Serial no: BH120/408) Date & Time (UTC): 24 September 2017 at 1550 hrs Location: Embelton, Northumberland Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Damage to propeller, engine, nose landing gear, engine cowling and fuselage. Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 55 years Commander’s Flying Experience: 18,758 hours (of which 6 were on type)

Last 90 days - 198 hours

Last 28 days - 68 hours Information Source: Aircraft Accident Report Form submitted by the pilot and additional enquiries made by the AAIB Prior to his departure from Eshott, Northumberland on a test flight, following a prolonged period of engine maintenance, the pilot visually confirmed that he had sufficient fuel for 2 hours and 45 minutes. However, at 2,500 ft amsl, having been airborne for approximately 1 hour and 35 minutes, the engine lost power and, despite repeated attempts, could not be restarted. During this time, the pilot confirmed that all engine controls, fuel and ignition selections were correct and noted that each fuel tank had indicated 1/3 full. The pilot, wearing a full harness, was uninjured during the subsequent forced landing, but the aircraft sustained damage to the nose landing gear, engine and propeller. The pilot reported that the engineering organisation, who attended the accident site to recover the aircraft, confirmed that the fuel tanks had run dry. He considered that, as the flight involved running in the engine at various power settings and durations, the fuel depleted more quickly than he had calculated. The aircraft was not fitted with a fuel flow meter. Safety message The UK CAA’s publication CAP1535, The Skyway Code, published in September 2017 details the importance of having a good working knowledge of your aircraft’s fuel burn at different power settings, as well as warning that the fuel gauges in most types of General Aviation aircraft are not very accurate and should not be considered a reliable indicator of fuel level.

FD06625 ｜ 2018_英国_aaib-investigation-to-cessna-152-g-bkaz__Cessna_152_G-BKAZ_01-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

10 © Crown copyright 2018 AAIB Bulletin: 1/2018 G-BKAZ EW/G2017/09/05 ACCIDENT Aircraft Type and Registration: Cessna 152, G-BKAZ No & Type of Engines: 1 Lycoming O-235-L2C piston engine Year of Manufacture: 1979 (Serial no: 152-82832) Date & Time (UTC): 14 September 2017 at 1500 hrs Location: Perth Aerodrome, Perthshire Type of Flight: Training Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Propeller strike, engine frame and firewall distortion Commander’s Licence: Student pilot Commander’s Age: 34 years Commander’s Flying Experience: 61 hours (of which 60 were on type)

Last 90 days - 38 hours

Last 28 days - 11 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis A student pilot had carried out a short solo cross-country flight and returned to Perth Aerodrome. Just prior to touchdown the aircraft drifted slightly off the centre line, which the pilot attempted to correct but the aircraft landed heavily and bounced. During the landing the aircraft sustained damage to the propeller, engine frame and firewall. History of the flight A student pilot had completed a short solo cross-country flight and was returning to Perth Aerodrome. He carried out an overhead join and as he turned onto finals it started to rain which reduced the visibility. He continued with his approach for landing. However, just prior to touchdown, a crosswind caused the aircraft to drift off the centre line, which he tried to correct. The aircraft then landed heavily and bounced. The pilot taxied the aircraft back to the parking area but noted whilst taxiing, that the rudder “was not operating properly”. It became apparent the aircraft had sustained a propeller strike and damage had been caused to the engine frame and firewall. Discussion The pilot was of the opinion that the wind direction had changed in the “last moments” of his final approach and that “a sudden windshear” unexpectedly increased his rate of descent resulting in a touchdown sooner than he expected.

11 © Crown copyright 2018 AAIB Bulletin: 1/2018 G-BKAZ EW/G2017/09/05 His instructor had flown twice with the student on the same day including a circuit in a “stiff” crosswind which he considered the student had handled well. The instructor had no doubts about the student’s ability to carry out the flight as planned and had briefed him on the possibilities of variable wind conditions and localised showers. The instructor was of the view that the propeller strike and frame damage had occurred after the bounced landing.

FD06626 ｜ 2018_英国_aaib-investigation-to-cessna-f172h-skyhawk-g-awux__Cessna_F172H_Skyhawk_G-AWUX_10-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

36 © Crown copyright 2018 All times are UTC AAIB Bulletin: 10/2018 G-AWUX EW/G2018/04/12 ACCIDENT Aircraft Type and Registration: Cessna F172H Skyhawk, G-AWUX No & Type of Engines: 1 Continental Motors Corp O-300-D piston engine Year of Manufacture: 1968 (Serial no: 577) Date & Time (UTC): 19 April 2018 at 1338 hrs Location: 3 miles southwest of Perranporth airfield, Cornwall Type of Flight: Private Persons on Board: Crew -1 Passengers - None Injuries: Crew - 1 (Minor) Passengers - N/A Nature of Damage: Damage to propeller, nosewheel, cowling, left wing strut and tailplane Commander’s Licence: Private Pilot’s Licence Commander’s Age: 80 years Commander’s Flying Experience: 186 hours (of which 108 were on type)

Last 90 days - 0 hours

Last 28 days - 0 hours Information Source: Aircraft Accident Report Form submitted by the pilot and further enquiries by the AAIB Synopsis When applying full power, following a descent at idle power there was a sudden bang and heavy vibration. The vibration eased on reducing power but increased again as power was applied. The pilot declared a MAYDAY and initiated a forced landing. At 50 ft, the pilot realised that his selected field was unsuitable so he veered left and landed in a harrowed field. The wheels dug in and the aircraft flipped inverted. The cause of the engine problem could not be determined. History of the flight The pilot carried out power checks and then departed from Perranporth Airfield on a local flight. He levelled off at 2,200 ft and headed west in clear air and VMC conditions. He could see a broken cloud layer 800 ft below him over the coast moving in from the southwest. After reaching the coast north of St Agnes, he tracked southbound along the coastline before deciding to return to Perranporth to avoid needing to fly below the incoming cloud layer. He selected idle power and started a descending left turn onto a south-easterly heading. When he reached 1,200 ft (QFE) he decided to level off and applied full power. He reported that on applying power there was a “an explosive bang and heavy, violent

37 © Crown copyright 2018 All times are UTC AAIB Bulletin: 10/2018 G-AWUX EW/G2018/04/12 vibration and shuddering”. He immediately selected idle power and the shuddering eased but the vibration continued at a reduced but still severe level. When he tried to increase the power the vibration worsened to the point where it was difficult to read the flight instruments and hold the yoke, with no perceived benefit in reducing height loss. He re-selected idle power, made a MAYDAY call and started to prepare for a forced landing. The terrain to his right and behind him was mainly heathland, and ahead of him were many small walled fields. He lined up to land on a long narrow grass field but at about 50 ft he noticed stone hedges across its width, so he veered left towards a harrowed field. On touchdown the wheels dug in, the nosewheel was ripped off, and the aircraft nosed over onto its back. The pilot was able to vacate the aircraft via the passenger door. The pilot could not recall whether he had selected the carburettor heat on prior to his descent from 2,200 ft, but he stated that he normally did so. Engine examination The engine was a Continental O-300-D which has six cylinders and a carburettor. As of 18 December 2017 it had accumulated 1,397 hours since last overhaul. A maintenance engineer examined the engine at the accident site. The was no external damage to the engine apart from the carburettor, which had broken off. The oil level was in the normal operating range and there were no oil leaks. The engineer turned the propeller by hand and felt six compressions; he then activated the starter motor and the engine turned normally. He stated that the Continental O-300 series of engines were prone to carburettor ice due to the carburettor’s narrow throat and high gas-speed induction system. An insurance loss adjustor subsequently examined the engine after the aircraft had been moved from the site. He confirmed the oil level and that the engine turned over on the starter motor with “no abnormal sounds or mechanical interference”. The exhaust and exhaust manifold were firmly attached. He removed all six upper spark plugs and they all had a layer of dark soot which is indicative of the engine running over-rich. He stated that he believed it was a short term over-rich condition as the electrode insulators were not completely covered in soot. Meteorology About 10 minutes after the accident the temperature and dewpoint at Newquay (8 nm north‑east of Perranporth) were 14°C and 11°C respectively. An upper air sounding for Camborne (11 nm south-west of Perranporth) measured a temperature and dewpoint of 9.8°C and 9.2°C respectively at 2,000 ft, and 11°C and 10.5°C at 1,000 ft. These conditions placed the risk of carburettor icing as ‘serious icing - any power setting’ according to CAA Safety Sense Leaflet No 14, ‘Piston Engine Icing’. Analysis The engine examinations carried out by an engineer and the loss adjustor did not reveal any mechanical defects that would explain the heavy vibration reported by the pilot.

38 © Crown copyright 2018 All times are UTC AAIB Bulletin: 10/2018 G-AWUX EW/G2018/04/12 The meteorological conditions were conducive to carburettor icing and according to a maintenance engineer the engine type was prone to carburettor ice. If the pilot had forgotten to select carburettor heat before reducing the engine power to idle prior to the descent, then carburettor ice was more likely to form. Carburettor ice formation results in a restriction of airflow and causes the engine to run rich; there was evidence from the spark plugs that the engine was running rich. A rich-running engine typically leads to rough running and can cause the engine to stop. The symptoms reported by the pilot of severe vibration are not typical of carburettor ice; however, most aircraft engines with carburettors are four-cylinder engines, whereas this was a six-cylinder engine, so it is possible that the symptoms would be different. The sudden bang might have been caused by detonation in the exhaust system due to incomplete combustion in the cylinders from an over-rich mixture. It is also possible that there was a fault with the engine, possibly related to the valves, that only a full engine teardown would reveal.

FD06627 ｜ 2018_英国_aaib-investigation-to-cessna-r172k-hawk-xp-g-xpii__Cessna_R172K_Hawk_XP_G-XPII_02-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

60 © Crown copyright 2018 AAIB Bulletin: 2/2018 G-XPII EW/G2017/11/07 ACCIDENT Aircraft Type and Registration: Cessna R172K Hawk XP, G-XPII No & Type of Engines: 1 Continental Motors Corp IO-360-KB piston engine Year of Manufacture: 1979 (Serial no: R172-3071) Date & Time (UTC): 4 November 2017 at 1415 hrs Location: Nottingham City Airport Type of Flight: Training Persons on Board: Crew - 2 Passengers - 1 Injuries: Crew - None Passengers - 1 (Minor) Nature of Damage: Engine frame and firewall distorted, creasing of left outer wing and skin damage to lower forward fuselage Commander’s Licence: Private Pilot’s Licence Commander’s Age: 58 years Commander’s Flying Experience: 691 hours (of which 82 were on type)

Last 90 days - 15 hours

Last 28 days - 7 hours Information Source: Aircraft Accident Report Form submitted by the pilot A qualified pilot was receiving instruction on flying from the right seat and the first approach to land resulted in a go-around because the aircraft was too high and too slow. During the latter part of the second circuit, the airspeed fluctuated and the instructor prompted the pilot several times when he saw the speed reducing towards the targeted minimum. At 20-30 feet and with a low power setting, the pilot began to flare, causing the aircraft to decelerate further and then sink. The instructor took control but was unable to prevent the aircraft from striking the ground heavily and bouncing before the landing was completed. After the flight, the aircraft was found to be damaged and the pilot undergoing training stated that she had difficulty in monitoring the airspeed indicator from the right seat. The instructor assessed that the pilot was unaware the aircraft was high and slow at the beginning of the landing flare, because of being unfamiliar with flying from this seat.

FD06628 ｜ 2018_英国_aaib-investigation-to-creasey-rj-easy-raider-j2-2-2-g-cbkf__Creasey_RJ_Easy_Raider_J2.2_2.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

75 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-CBKF EW/G2018/04/02 ACCIDENT Aircraft Type and Registration: Creasey RJ Easy Raider J2.2(2), G-CBKF No & Type of Engines: 1 Jabiru 2200A piston engine Year of Manufacture: 2002 (Serial no: BMAA/HB/202) Date & Time (UTC): 8 April 2018 at 1730 hrs Location: Coombs Farm, Goodleigh, Devon Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Damage to the right wing, right landing gear and propeller Commander’s Licence: National Private Pilot’s Licence Commander’s Age: 55 years Commander’s Flying Experience: 182 hours (of which 14 were on type)

Last 90 days - 14 hours

Last 28 days - 4 hours Information Source: Aircraft Accident Report Form submitted by the pilot The pilot was returning to a private field and selected a short level area, located at the top of a 20° upslope and orientated into the wind, on which to land. On approach, he selected the first stage of flap, as he intended to fly parallel with the upslope, and returned his left hand to the throttle. However, when the pilot reduced power just prior to landing, he realised that he had in fact been holding the pitch trim control, which was identical in shape and size to the throttle but positioned just inboard (Figure 1). Having passed over his landing area, he flew a go-around, but the aircraft stalled when trying to clear a row of trees situated at the edge of the field and fell vertically into the wooded area. The pilot, who was wearing a full harness, sustained no injury and turned off the fuel, ignition and electrical systems before exiting the aircraft.

76 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-CBKF EW/G2018/04/02 Figure 1 Pitch trim and throttle controls

FD06629 ｜ 2018_英国_aaib-investigation-to-europa-g-mime__Europa_G-MIME_04-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

24 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018

AAIB Bulletin: 4/2018 G-MIME EW/C2017/09/06 ACCIDENT Aircraft Type and Registration: Europa, G-MIME No & Type of Engines: 1 Rotax 912 ULS piston engine Year of Manufacture: 2001 (Serial no: PFA 247-12850) Date & Time (UTC): 28 September 2017 at 1500 hrs Location: Grove Farm, Wolvey, Warwickshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - 1 (Fatal) Passengers - 1 (Fatal) Nature of Damage: Aircraft destroyed Commander’s Licence: National Private Pilot’s Licence Commander’s Age: 55 Commander’s Flying Experience: 546 hours (of which 48 were on type)

Last 90 days - 12 hours

Last 28 days - 1 hour Information Source: AAIB Field Investigation Synopsis The aircraft landed a significant distance down the runway at Grove Farm and was unable to stop before the end. The aircraft passed through a hedge and caught fire before coming to rest in the field beyond the end of the runway. Although both the pilot and passenger survived the accident, both subsequently died of the burns they sustained. History of the flight The pilot and passenger arrived at Grove Farm, where the aircraft was kept in a hangar, just after 1400 hrs. Witnesses stated that the purpose of the flight was to fly over a local site where both the pilot and passenger were working. There were no witnesses to the preparation or flight of the aircraft. It was picked up by radar for the first time at 1443 hrs and for the last time at 1445 hrs, and the radar track indicated that it took off from Runway 29, flew a circuit and made an approach back to Runway 29. Just after 1500 hrs witnesses saw the pilot and passenger in the yard of the farm on which the strip is located; both were severely burnt. The aircraft had passed through the hedge at the end of Runway 29 after landing and come to rest in the field beyond. It was severely disrupted and had suffered significant damage from fire. Both the pilot and passenger subsequently died of the burns they sustained.

25 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018

AAIB Bulletin: 4/2018 G-MIME EW/C2017/09/06 Accident site The aircraft wreckage was located close to the western end of the runway. It had overshot the runway, passed through a thick, four-feet high hedge and a shallow ditch before coming to rest approximately 10 m past the hedge (Figures 1 and 2). Evidence indicated that the aircraft was on the ground and turning slightly left when it contacted the hedge. As a result, the right wingtip contacted the hedge before the left wingtip and this slewed the aircraft back more in line with the runway centreline. The internally mounted flap drive crosstube and its hinge attachments were found close to the hedge suggesting they had become detached as the aircraft passed through the hedge; the first signs of fire were visible on the ground in the vicinity. The engine and firewall forward section of the fuselage remained upright but the remainder of the aircraft was found inverted and the fuselage was substantially disrupted in the cockpit area; both doors were present. A post-impact fire, which burnt for over 30 minutes, consumed or severely damaged large parts of the aircraft including almost all the fuselage and empennage, but also the inboard parts of the wings and flaps. The engine cowlings and engine were also severely damaged by the fire. All three blades of the propeller had broken off and were found close to the main wreckage; the nature of their damage and location indicated they were not under power when the aircraft passed through the hedge. Figure 1 General view of accident site from the end of the runway through the hedge

26 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018

AAIB Bulletin: 4/2018 G-MIME EW/C2017/09/06 Figure 2 General overhead view of the accident site (from AAIB UAS) The runway was examined and it was in good condition with short grass and a reasonably firm surface. A touchdown mark from the single mainwheel was found close to the centre line of the runway approximately 73 m from the start of the runway (Figure 3). It indicated the aircraft had made a firm touchdown after which it became airborne again. Although there were more ground markings approaching the hedge, the subsequent touchdown point could not be identified. Touchdown mark Figure 3 View in direction of landing (from AAIB UAS)

27 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018

AAIB Bulletin: 4/2018 G-MIME EW/C2017/09/06 Recorded information None of the aircraft’s avionics survived the post-accident fire and no aircraft recorded data was recovered; however, a limited amount of radar data was recorded that tracked the aircraft in a left-hand circuit for Runway 29. Transponder Mode C altitude information, corrected to the QNH of 1017 hPa and the runway elevation of 380 ft, indicated that the circuit was flown at a height of 485 ±50 ft aal (Figure 4). Figure 4 Circuit ground track from radar data Aircraft information General The Europa is an amateur built side by side two-seat light aircraft of conventional layout and composite construction. It is available with either a tricycle undercarriage or as a mono‑wheel version with a single mainwheel, tailwheel and outriggers on the wings. It is sold in kit form and, in the UK, its construction is overseen by the Light Aircraft Association (LAA) through a network of approved inspectors. Once inspections and flight tests confirm the aircraft has been completed to the required standard, a Permit to Fly can be issued. G-MIME was completed as a mono-wheel version in 2001 and had since flown approximately 500 hours. The accident pilot purchased the aircraft from its second owners in May 2016.

28 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018

AAIB Bulletin: 4/2018 G-MIME EW/C2017/09/06 Engine This aircraft was fitted with the recommended Rotax 912 ULS engine with an optional carburettor heat system modification which used hot coolant from the cooling system to heat the carburettor bodies and thereby prevent carburettor ice formation. The electrically controlled variable-pitch propeller was driven via the engine’s reduction gearbox. Fuel system The fuel tank was fitted in the fuselage behind the seats and was saddle-shaped to fit around the pitch and flap control push rods. The two sides of the tank were configured to provide a main tank of approximately 60 litres and a reserve tank of approximately 8 litres. In 2003, this aircraft had been fitted with an approved modification which installed two electric fuel pumps in parallel instead of the normal single electric fuel pump in series with a mechanical engine driven fuel pump. The system also included a feature which provided an automatic changeover of the fuel supply to the reserve tank in the event of a loss of fuel pressure from the main fuel tank feed. Because of this modification, the LAA had agreed that a fuel vapour vent return line was not required as this system design and installation, which had been validated by testing, mitigated the risk of fuel vapour formation. This modification also approved the replacement of some flexible fuel pipes with stainless steel corrugated pipes. The aircraft did not have water drain valves fitted to the fuel tank outlets but did have a gascolater1 in the fuel supply line to the engine. The aircraft was being operated using E5 MOGAS2 which required inspection and certification documents to approve its use. Electrical system A system consisting of a battery and an integral engine generator provided electrical power for the aircraft. The battery was located behind the cockpit area along with an external power connection socket. Various cables, switches and circuit breakers were installed to distribute the electrical power. Relevant maintenance history The aircraft had been issued with a Permit to Fly and the date of expiry of its Certificate of Validity was 21 October 2017. The aircraft, engine and variable-pitch propeller logbooks were inspected and contained records of the regular maintenance and inspection work that were required. Footnote 1 A drainable filter and water collector. 2 E5 MOGAS is regular forecourt unleaded petrol which meets EN228 Standard and can contain up to 5% ethanol.

29 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018

AAIB Bulletin: 4/2018 G-MIME EW/C2017/09/06 Inspections and a test flight relating to the renewal of the Certificate of Validity had been undertaken during September 2017 but the completed form had not been submitted to the LAA. The LAA inspector who carried out the Annual Inspection reported that the aircraft was “nice and well looked after.” No inspection and certification documents approving the use of E5 MOGAS could be located. Aircraft examination Due to the extent and severity of the post-accident fire, the extent of any inspection was limited as most components had been consumed or were melted by the fire; mainly steel parts survived along with the core of the engine and the outer portions of the wings. The remains of the engine were taken to the UK Agent for inspection. The engine core was disassembled and inspected. No anomalies were identified that would have affected the performance of the engine. Inspection of the engine ancillary components, such as the ignition system or fuel system carburettors, was not possible as they were too severely damaged by the fire. The propeller was inspected and found to be in the fine pitch position. This is the normal position for takeoff and landing. Survivability Both the pilot and passenger survived the accident but suffered extensive burns in the subsequent fire which was not survivable. The pilot The pilot undertook some flying training in 1980 and 1981, resumed training in 1999 and gained a PPL(A) in 2000. Much of his experience had been gained on microlights with the conversion to the faster and heavier Europa aircraft being within the previous 14 months. At the time of the accident, he was operating under the privileges of an NPPL(A). He was familiar with operating a microlight from Grove Farm but less so in the Europa, although his conversion to the aircraft included a visit to the strip with an instructor before he moved the aircraft there permanently. The instructor commented that he felt the pilot had adapted well to the Europa and to operating it from short strips. According to witnesses who knew the pilot and had flown with him from Grove Farm, he tended to have the radio in the aircraft tuned to Coventry Airport Air Traffic Control (ATC) to obtain local weather and traffic information. On the day of the accident, however, he did not contact Coventry ATC, and no distress call was heard on any frequency. Toxicology The results of the Forensic Toxicology Report on the pilot were negative except for drugs consistent with his medical treatment after the accident. The test for carbon monoxide poisoning was also negative.

30 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018

AAIB Bulletin: 4/2018 G-MIME EW/C2017/09/06 Airfield information Grove Farm is a grass farm strip orientated 110°/290°M which is 350 m long and at an elevation of 380 ft amsl. Circuits are flown at 500 ft agl. Airfield guides include a warning about a 4 ft hedge on approach to Runway 11 (departure end of Runway 29). This is a substantial hedge made up mainly of hardwood species such as hawthorn. There are numerous large trees close to the strip which do not interfere with the approach directly but, with a southerly wind, might generate some turbulence or wind effects on short finals to Runway 29. Weight and balance The investigation could not confirm how much fuel was loaded on G-MIME and therefore could not calculate the actual weight and balance of the aircraft. The maximum takeoff and landing weight of the aircraft is 621 kg. It was possible to estimate the minimum takeoff weight of the aircraft on the day of the accident as follows. The aircraft empty weight was 392 kg, and the combined weight of the two occupants was 189 kg. A reasonable minimum fuel load for the intended flight would have been 30 litres (22 kg) (including a 30-minute reserve). Although the actual fuel load could not be verified, these figures suggested that the aircraft weight would have been close to its maximum. Aircraft performance The length of the strip at Grove Farm was adequate for the Europa at maximum operating weight, allowing for the performance factors recommended for landing in Civil Aviation Authority (CAA) General Aviation Safety Sense Leaflet 7c – ‘Aeroplane Performance’ (15% for dry grass and a further 43% as a safety margin). Meteorology There are no weather reporting facilities at Grove Farm. Birmingham International Airport is 15 nm to the west and was reporting a southerly wind of 8 kt, with visibility greater than 10 km, few cloud above 3,000 ft aal and a temperature of 18°C. The QNH was reported as 1017 hPa. Images from a police helicopter that attended the scene shortly after the accident indicated that the wind speed and direction were similar to those at Birmingham and perpendicular to the runway at Grove Farm. Analysis The aircraft passed through a hedge at the end of Runway 29 on landing at Grove Farm strip and caught fire immediately. Ground marks showed that the aircraft touched down some distance from the beginning of the runway and bounced before touching down again with insufficient distance to stop before the hedge. The ground marks indicated that the aircraft was on the ground at the end of the runway and evidence from the propeller indicated the engine was at low power. As the aircraft

31 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018

AAIB Bulletin: 4/2018 G-MIME EW/C2017/09/06 passed through the hedge and the shallow ditch beyond, the fuselage was disrupted, particularly in the area behind the cockpit. This most likely caused damage to the fuel system that allowed fuel to escape which was then ignited by a spark from the damaged electrical system. There were no witnesses to the preparation or flight of the aircraft and no distress calls were heard on the radio. The technical examination was limited by the severity and extent of the post-accident fire but, within these limitations and after a review of the maintenance documentation, no anomalies that may have contributed to the accident were identified. The aircraft was eligible for approval to use E5 MOGAS fuel, but the inspections and checks of the fuel system required for approval had not been completed. These verify that the fuel system design and installation is compatible with the use of E5 MOGAS to avoid issues associated with its use such as chemical compatibility of components, vapour locking, carburettor icing and water absorption. Carburettor icing was considered unlikely during the accident flight because the aircraft had a permanent carburettor heat system fitted. It could not be determined whether the other issues associated with this type of fuel had an adverse effect on the accident flight. It was not determined why the pilot decided to fly a circuit before attempting to land rather than completing the local flight as intended. He had significant experience of operating into the strip and would have been familiar with the need to touch down close to the beginning of the runway. A technical fault, or a change of plan for some other undetermined reason may have led to the pilot’s decision to immediately return to land and, if so, this distraction might have contributed to the touchdown point being significantly further down the runway than intended. However, no cause for such a distraction was identified during the investigation. It is likely that there was turbulence in the final stages of the approach caused by the southerly wind crossing the trees immediately south of the Runway 29 threshold. It is possible that this affected the aircraft’s touchdown point. Conclusion The aircraft took off from Runway 29 at Grove Farm with a pilot and passenger on board who, according to witnesses, intended to fly into the local area. After takeoff, for a reason that was not determined, the aircraft was immediately positioned for an approach to land. The aircraft touched down beyond the threshold of the runway, bounced and touched down again with insufficient distance to stop before a hedge at the end of the runway. It passed through the hedge, caught fire and came to rest in the field beyond. Although both the pilot and passenger survived the accident, they subsequently died of the burns they sustained.

32 © Crown copyright 2018 All times are UTC AAIB Bulletin: 4/2018

AAIB Bulletin: 4/2018 G-MIME EW/C2017/09/06 Safety actions/Recommendations The aircraft was eligible to use E5 MOGAS, but no evidence could be found to show that the inspections and checks of the fuel system required for approval had been completed.  Although it could not be determined whether the type of fuel being used was a contributory factor, this is the second recent accident where there was no evidence of the correct procedures being followed to approve the use of E5 MOGAS3.  The LAA agreed during discussions with the AAIB that it would remind all owners, via a Safety Spot article in their members magazine, of the importance of correctly following the published procedures to approve the use of E5 MOGAS in their aircraft.  This article was published in the January 2018 edition. Footnote 3 See report into the accident to Europa, G-NDOL in AAIB Bulletin 11/2017.

FD06630 ｜ 2018_英国_aaib-investigation-to-hk36-tc-super-dimona-g-fmka__HK36_TC_Super_Dimona_G-FMKA_12-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

48 © Crown copyright 2018 All times are UTC AAIB Bulletin: 12/2018 G-FMKA EW/C2017/07/01 ACCIDENT Aircraft Type and Registration: HK36 TC Super Dimona, G-FMKA No & Type of Engines: 1 Rotax 912-A3 piston engine Year of Manufacture: 2000 (Serial no: 36.672) Date & Time (UTC): 13 July 2017 at 1830 hrs Location: Near Brimslade Farm, Wiltshire Type of Flight: Training Persons on Board: Crew - 2 Passengers - None Injuries: Crew - 2 (Fatal) Passengers - N/A Nature of Damage: Destroyed Commander’s Licence: Airline Transport Pilot’s Licence and EASA Private Pilot’s Licence Commander’s Age: 57 years Commander’s Flying Experience: 18,200 hours

Last 90 days - 266 hours

Last 28 days - 40 hours Information Source: AAIB Field Investigation Synopsis The purpose of the flight was for the aircraft owner to undergo a biennial refresher training flight with an instructor to revalidate his class ratings. The aircraft was seen to be manoeuvring at low level shortly before it departed from controlled flight. It struck the ground in a near vertical attitude on farmland. Both pilots were fatally injured and the aircraft was destroyed. There was insufficient evidence available to determine conclusively the cause of the loss of control, but it was possibly as a result of a power-on stall. History of the flight The owner of G-FMKA was undertaking a biennial refresher training flight with an instructor for the purposes of revalidating his class ratings. On the day of the accident flight, the owner flew the aircraft solo from Nympsfield, where the aircraft was based, to Draycot, arriving around 1745 hrs. The instructor had flown on three other instructional flights from Draycot earlier that day, after which he was asked to conduct this flight. The accident flight was the first time that the instructor had flown in a Super Dimona. Shortly before the flight, the instructor and owner were seen in discussion; however, the content of their discussion is unknown. The precise planned content of the flight could not be established, except that the intended length of flight was one hour.

49 © Crown copyright 2018 All times are UTC AAIB Bulletin: 12/2018 G-FMKA EW/C2017/07/01 A witness at Draycot observed what appeared to him to be normal control and engine run-up checks on the aircraft; this included operation of the airbrakes. The aircraft took off from Draycot at 1810 hrs and was seen to depart to the south, towards Marlborough. The airfield had a radio, but no RT calls were received from the aircraft and none were expected. At approximately 1820 hrs, what is believed to be the accident aircraft was seen over Marlborough by a witness who held a PPL. He stated that he thought the aircraft was at around 1,000 ft agl and heading south. The engine could be heard running, the aircraft was in wings-level flight and all appeared normal. Shortly thereafter, the aircraft was seen manoeuvring in the vicinity of the accident site by several other eyewitnesses. All of the witnesses felt that their attention was drawn to the aircraft because it was much lower than expected. The witnesses, who were widely dispersed, also reported hearing engine noises. Some witnesses described the engine noise increasing in the latter stages of the flight. There was a consistent view that the aircraft was in a left turn in the latter stages of flight. The closest witnesses to the accident site described the aircraft as being perhaps only 100 ft agl as it passed their house, approximately 400 metres from the accident site, and believed it was going to land. Another witness described the aircraft as “spinning around one wing and looked very nose‑down” before his view was obscured by trees. The accident site was surrounded by tall trees on three sides and none of the witnesses saw the aircraft hit the ground. The accident site was located approximately 7 miles from Draycot (Figure 1). Figure 1 Accident geography

50 © Crown copyright 2018 All times are UTC AAIB Bulletin: 12/2018 G-FMKA EW/C2017/07/01 Witnesses described impact noises, followed by a small cloud of dust or smoke. Several witnesses made calls to the emergency services at approximately 1830 hrs. Witnesses who went to the accident site saw a small fire in the wreckage which then spread to the field’s barley crop. Workers from the nearby farm used farm machinery to cut a firebreak to limit the spread of the fire. The two occupants had suffered fatal injuries. Accident site The accident site was in a gently sloping crop field near Brimslade Farm, to the south of Marlborough. This was one of several large fields in the area. The ground impact marks indicated that the aircraft had struck the ground in an extreme nose-down attitude whilst travelling at considerable speed vertically downwards. The impact speed was such that the engine section was buried back to the bulkhead. An extensive post-crash fire had occurred, made more intense by combustion of the crop. Emergency service crews were still periodically damping down fire in the wreckage approximately 4 hours after the accident. Site aerial imagery An aerial survey of the accident site (Figure 2) was carried out using the AAIB’s camera‑equipped drone. This revealed impact markings created by the leading edges of the wings which formed symmetrical arcs centred at the point where the engine was buried. The pronounced curvature of the arcs indicated that the wings were experiencing considerable upwards bending at the point of impact. Measurements of the wing deflection were supplied to the aircraft manufacturer for analysis. Aircraft performance According to the analysis by the aircraft manufacturer, to produce the degree of upwards wing bending indicated by the ground impact marks, the aircraft would have to have been subjected to a positive acceleration approaching 9 g. It was the aircraft manufacturer’s opinion that such loads could not be achieved without an elevator control input. Recorded information A ‘Flymap L’ (GPS-based flight planning and navigation unit) was recovered from the accident site; however, it was damaged such that no data could be recovered from its internal memory. The aircraft was not detected by radar, suggesting that it was flying at an altitude below the lower line-of-sight height limit for the radar heads closest to the route flown. For the radar heads of Clee Hill to the north and Bovingdon and Heathrow to the east, this means that the aircraft was probably no higher than 1,500 ft amsl (about 1,000 ft agl).

51 © Crown copyright 2018 All times are UTC AAIB Bulletin: 12/2018 G-FMKA EW/C2017/07/01 Figure 2 Aerial photo of accident site (white arrows indicated curved impact marks from wing leading edges; red arrow indicates engine impact location) Aircraft information The HK36 TC series Super Dimona (Figure 3) is certificated by the EASA as a touring motor glider (TMG). It is manufactured predominantly from glass reinforced plastic (GRP) and has conventional pitch, roll and yaw controls and upper wing surface airbrakes. The two‑bladed propeller can be operated in a constant speed mode when the engine is supplying power, or may be feathered to minimise drag when the aircraft is gliding. The aircraft can be de‑rigged for storage or ground transport. The ailerons, elevator and airbrakes are operated by tubular steel push-pull rods, eye-end fittings, bellcranks and torque tubes. Most of the tubular push-pull rods are of a standard diameter and wall thickness, and most eye-ends are of a standard pattern. The rudder is cable operated.

52 © Crown copyright 2018 All times are UTC AAIB Bulletin: 12/2018 G-FMKA EW/C2017/07/01 A metal fuel tank is positioned behind the cabin area and a shelf is situated in the cabin behind the two pilot seats and above the tank. Figure 3 HK36 TC Super Dimona (photo courtesy of Diamond Aircraft) Super Dimona stall characteristics Section 3.4 of the HK36 TC flight manual contains the following information regarding the aircraft’s stall characteristics: ‘3.4.1 BEHAVIOR WITH POWER OFF Under all loading conditions, air brakes applied or retracted, wings level flight or banked flight, the HK 36 TC goes through a horizontal stall. The ailerons keep their effectiveness even with maximum elevator deflection. A partial loss of positive control in the stick and pedals, buffeting, and pitch angle of 20° to 30° occur during this condition. NOTE During the horizontal stall, lAS rises to approximately 85 km/h (46 kts / 53 mph). 3.4.2 BEHAVIOR WITH POWER ON See behavior with power off. Only at 50 % to 100 % power, wings level flight, and maximum rearward center of gravity, the airplane may perform a stall dive over the left or right wing after entering the horizontal stall if the control stick is pulled even further.

53 © Crown copyright 2018 All times are UTC AAIB Bulletin: 12/2018 G-FMKA EW/C2017/07/01 3.4.3 RECOVERY The horizontal stall can be terminated immediately by relaxing the force on the elevator control. NOTE If the airplane performs a stall dive, immediately relax the force on the elevator control and pull out the airplane smoothly. If the stick is pulled further, the airplane may start to spin.

• Altitude loss resulting from stationary horizontal stall described above:

approximately 10 - 20 m-(33 - 65 ft.).

• Altitude loss resulting from stall dive over a wing:

approximately 40 m (130 ft).’ Aircraft maintenance and utilisation At the time of the accident G-FMKA was in possession of an Airworthiness Review Certificate, (ARC), issued following an annual inspection. The ARC was dated 7 April 2017, valid until 27 June 2018. At the time of issue, the aircraft had carried out 1,015 hours total flying. The annual inspection would have required de-rigging of the aircraft and removal of the seats to gain access to flying controls and various other components. It is known that the aircraft was normally hangered in a rigged state. From the owner’s flying logbook it was established that the aircraft had flown a further 10.6 hours since the ARC was issued. Aircraft examination Examination carried out both at the accident site and following recovery of the wreckage to the AAIB revealed that the fire had consumed most of the matrix material of the composite structure. Consequently, much of the remaining mass of glass-fibres previously forming the structure could not be identified as to their original location in the aircraft. In particular, a combination of impact forces and fragmentation together with fire had destroyed the fuselage between the engine bulkhead and the wing carry-through box. The metal fuel tank was totally disrupted. Amongst items that were identifiable at the impact site were: both wingtips, the bulk of the tailplane and elevator, including both tailplane tips, the fin and rudder and the inboard section of the left aileron, incorporating the most inboard of the hinges. With the exception of the outboard length of the left aileron and a portion of the elevator, all control surfaces were accounted for at the accident site. The outboard section of the left aileron, beyond the operating bell crank, was not identified and an outboard section of the elevator appeared to have been destroyed by the fire. This had come to rest beneath the rear fuselage which sustained an intense fire for a lengthy period.

54 © Crown copyright 2018 All times are UTC AAIB Bulletin: 12/2018 G-FMKA EW/C2017/07/01 The severely burnt remains of the two wings were found in a relative position consistent with having been correctly attached at impact. Examination of the flying control tubes and bell cranks within the structure of each wing revealed no evidence of pre-impact failure. The extent of disruption of the fuselage, particularly in the area beneath the seats, made it impractical to carry out an effective examination of the control operating mechanism in that area. Numerous lengths of tubing terminated in fractures having the characteristics of compressive buckling preceding final overload failure (ie consistent with impact disruption.) No specific evidence of pre-impact failure of the flying controls was found anywhere during the wreckage examination, although the extent of disruption of the midships section of the fuselage structure, the impact distortion of control tubes and the large numbers of fractures of those tubes and threaded portions of eye-ends in that section made it impossible to conclusively state that no pre-impact failure was present. Examination of the propeller hub showed that the pitch change mechanism was seized in a position consistent with being in the normal powered flight range rather than in the feathered position appropriate to gliding flight. The seizure of the pitch change mechanism appeared to be the result of impact distortion of pitch change bearings or parts of that mechanism having occurred in the sequence during which the wooden blades had been sheared off at their root attachments. It was concluded that the seized position of the propeller hub components was at or very close to the flight pitch setting at impact. During the examination the remains of a walking pole were found amongst the wreckage. As the fuel quantity on board the aircraft was unknown, the aircraft’s centre of gravity could not be determined. Meteorology Based on Met Office information, the weather was generally fine with an estimated wind of 250° at 15 kt. Weather radar imagery from around the time of the accident indicated that conditions were dry, with light to moderate showers to the east of the area. Biennial refresher training EASA Part-FCL paragraph FCL.740.A Revalidation of class and type ratings — aeroplanes, states that, for SEP1 and TMG class ratings, the applicant shall: ‘(i) within the 3 months preceding the expiry date of the rating, pass a proficiency check in the relevant class in accordance with Appendix 9 to this Part with an examiner;’ Footnote 1 Single-engine piston.

55 © Crown copyright 2018 All times are UTC AAIB Bulletin: 12/2018 G-FMKA EW/C2017/07/01 or based on previous experience by: ‘(ii) within the 12 months preceding the expiry date of the rating, complete 12 hours of flight time in the relevant class, including: — 6 hours as PIC, — 12 take-offs and 12 landings, and — refresher training of at least 1 hour of total flight time with a flight instructor (FI) or a class rating instructor (CRI). Applicants shall be exempted from this refresher training if they have passed a class or type rating proficiency check, skill test or assessment of competence in any other class or type of aeroplane.’ When applicants hold both a single-engine piston aeroplane-land class rating (denoted as SEP (land)) and a TMG rating, they may complete these requirements in ‘either class or a combination thereof, and achieve revalidation of both ratings.’ Apart from being ‘exempted from this refresher training if they have passed a class or type rating proficiency check, skill test or assessment of competence in any other class or type of aeroplane’, the regulations do not provide any guidance material (GM) or acceptable means of compliance (AMC) to support these requirements and specifically what should be covered in the refresher training. The content and structure of the training flight (so the instructor is pilot in command) is, therefore, at the discretion of and agreed between the pilot and instructor, but typically includes exercises such as stall recovery and practice forced landings. Personnel Aircraft owner The owner had commenced his flying on gliders in 1992. Over the next 7 years he accumulated nearly 300 hours gliding, in 350 flights. He then began training on SEP (land) aircraft. He gained his Private Pilot’s Licence in 1999 and flew various aircraft types. In May 2006 he underwent an SLMG2 conversion and purchased G-FMKA. In June 2014, he passed his TMG licence skills test. From 2006, he appeared to have flown almost exclusively in G-FMKA. At the time of the accident, his total powered flying experience amounted to just over 700 hours, together with a total of approximately 415 hours and over 400 flights on gliders. The owner had flown more than 12 hours in the preceding 12 months and so he only required a minimum of 1 hour of instructional flight to revalidate his licence. Footnote 2 Self Launching Motor Glider.

56 © Crown copyright 2018 All times are UTC AAIB Bulletin: 12/2018 G-FMKA EW/C2017/07/01 Instructor The instructor was a former military fast jet pilot and a current commercial airline pilot. His total flying experience amounted to approximately 18,200 hours. He had recently completed his training as a civilian Flight Instructor (FI) on SEP (land) aircraft which included a supervised period of 100 hrs of instructional flying. In the preceding 28 days he flew various SEP types, including his own Cirrus SR22. The instructor did not hold a TMG class rating. Licensing requirements Although they may appear outwardly similar in many ways, TMGs such as the Super Dimona have somewhat different flight characteristics from the more common SEP (land) class of aircraft. There are also operational differences; for example, TMGs are equipped with airbrakes or spoilers, whereas SEP aircraft are not. Licensing regulations require pilots who wish to fly TMGs to hold a TMG class rating, which requires specific training to be completed. To instruct on TMG aircraft, an instructor must hold a TMG class rating. It is a requirement of the EASA Part-FCL regulations that an instructor holds a class rating for the class of aircraft for which instruction is being given. The owner had conducted his previous biennial refresher training in 2015, in G-FMKA, at the same flying training school where the instructor had completed his FI training. This refresher training was conducted with the Chief Flying Instructor of the school, who did not hold a TMG class rating. The similarity between the TMG and SEP classes of aircraft has led some to believe, incorrectly, that possession of a valid SEP (land) class rating also entitles them to fly TMG class aircraft. The AAIB raised the issue with the CAA, who agreed to publish safety information to flight instructors to clarify the requirements for instruction on TMG class aircraft. Medical and pathological information The post-mortem reports for the pilot and instructor cited the cause of death as multiple injuries. Within the limited examination possible, there was no natural disease identified to cause or contribute to death. Survivability The aircraft struck the ground at high speed in a steep nose-down attitude. The post‑mortem examinations of the pilots indicated that the scale of injuries resulting from the impact were not survivable.

57 © Crown copyright 2018 All times are UTC AAIB Bulletin: 12/2018 G-FMKA EW/C2017/07/01 Analysis Engineering aspects The vertical nature of the flight path of the aircraft at impact, coupled with the elevator input required to create the 9 g impression in the ground, is consistent with the aircraft having been beyond the vertical shortly before ground contact. All extremities of the aircraft were identified at the accident site, indicating that no in-flight structural failure had occurred. With the exception of the outboard length of the left aileron and a portion of the elevator, all control surfaces were identified at the accident site. Since the attached section of the left aileron incorporated only one short hinge, it would be logical to expect the whole of the aileron to have separated as two independent items if the surface had failed in flight, rather than only the outboard section separating leaving the inboard section as found in the wreckage attached by a single short hinge at its inboard end. Hence there is little doubt that both ailerons were attached and complete at the time of the impact. The absence of the outboard section of the elevator in an identifiable state is explicable since that length appears to have come to rest beneath the rear fuselage which burned for a sustained period after the impact and required frequent damping down by fire and rescue services for at least four hours after the accident. The identified section of elevator ended in an extremely fire damaged termination. The complete rudder was also identified in the wreckage. This evidence is therefore consistent with all the flying control surfaces being attached and complete when the aircraft struck the ground. The impact damage and subsequent fire made it impractical to determine whether any pre-accident defect was present in the flying control system. The roll controls within each wing were free from such defects, but the same could not be conclusively stated about those sections within the fuselage. The extent of bending deflection of the wing structure, evident from the aerial survey, however, can only have been achieved by a functioning pitch control system with the control stick being moved forcefully backward. This is consistent with the pitch control being fully operable and one of the occupants operating the controls. The most likely initial location for the walking pole found in the aircraft wreckage was on the shelf behind the two pilot seats. The confined space within the cockpit, particularly when carrying two occupants, would preclude the carriage of the pole elsewhere within the aircraft. It is difficult to envisage a plausible scenario whereby the pole could have interfered with the operation of the aircraft’s controls. Operational aspects The planned content of the flight is unknown, except that its intended duration was one hour. As it was a refresher training flight as part of the pilot’s revalidation of his SEP (land) and TMG class ratings, the content was at the discretion and agreement of both the pilot and instructor.

58 © Crown copyright 2018 All times are UTC AAIB Bulletin: 12/2018 G-FMKA EW/C2017/07/01 The aircraft was seen heading south from Draycot at about 1,000 ft agl. Shortly thereafter, it was manoeuvring and turning left near the accident site at a much lower altitude that had drawn witnesses’ attention. For the aircraft to have been so low, either there was a problem, or a planned manoeuvre was being conducted. If there was a problem with the aircraft, no radio call was made to indicate as such. It is possible that a practice forced landing was being conducted and there were several suitable fields available in the vicinity. The aircraft was observed in what is believed to be powered, controlled flight until the last few seconds. One witness described what could be construed as the aircraft entering a spin, just before he lost sight of it. It is improbable that the extreme aircraft attitude was a result of intentional pilot action, as such a manoeuvre at low height would carry a very high level of risk. Therefore, it is probable that the situation arose because of a departure from controlled flight. The power-off stall characteristics of the Super Dimona are benign; however, the power-on stall is different, and in certain circumstances the aircraft ‘may perform a stall dive over the left or right wing’. A power-on stall would appear to be the most likely explanation for the sudden loss of control and resultant unusual attitude. The weather in the area of the accident flight was clear and dry with no low cloud and light winds. It is therefore unlikely that any meteorological event affected the flight. According to the EASA Part-FCL regulations, the instructor was not qualified to be pilot in command or give instruction on TMG class aircraft such as the Super Dimona as he did not hold a TMG class rating. Conclusion The aircraft departed from controlled flight at low altitude, possibly from a power-on stall, for reasons which could not be determined conclusively. There was no evidence of a pre-existing problem with the flight controls, but the possibility could not be fully excluded. The ground impact marks suggested that an attempt to regain control of the aircraft was made, but there was insufficient height available in which to complete a recovery. Safety action The CAA has agreed to issue advice to remind flying instructors of the requirement to hold a valid TMG class rating if they intend to exercise their flight instructor privileges on this class of aircraft.

FD06631 ｜ 2018_英国_aaib-investigation-to-hph-glasflugel-304-es-g-gsgs__HPH_Glasflugel_304_eS_G-GSGS_09-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

18 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 ACCIDENT Aircraft Type and Registration: HPH Glasflugel 304 eS, G-GSGS No & Type of Engines: 1 LZ Design D.O.O FES-HPH-M100 brushless electric motor Year of Manufacture: 2016 (Serial no: 059-MS) Date & Time (UTC): 10 August 2017 at 1121 hrs Location: Parham Airfield, West Sussex Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Fire damage to FES1 batteries and FES battery compartment Commander’s Licence: British Gliding Association Gliding Certificate Commander’s Age: 55 years Commander’s Flying Experience: 314 hours (of which 25 were on type)

Last 90 days - 9 hours

Last 28 days - 7 hours Information Source: AAIB Field Investigation Synopsis During a normal touchdown following an uneventful flight, the glider’s forward FES lithium polymer battery ignited due to an electrical arcing event. The pilot was unaware that the glider was on fire and the battery continued to burn, generating smoke and fumes which entered the cockpit during the latter stages of the landing roll. The pilot was not injured and the fire was extinguished using foam retardant, although the glider’s fuselage battery box and surrounding structure were extensively damaged by the fire. A comprehensive investigation of the failed battery did not identify the cause of the electrical arcing event. The AAIB published a Special Bulletin, S3/2017, in September 2017 that contained three Safety Recommendations relating to the provision of fire warning systems in FES-equipped sailplanes. As a result of this investigation the sailplane manufacturer and FES system manufacturer have implemented a number of safety actions including modifications intended to prevent recurrence, or to mitigate the effects of a battery fire. Footnote 1 Front Electric Sustainer, a battery-powered electrical propulsion system for powered sailplanes.

19 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 History of the flight The pilot had fully charged both Front Electric Sustainer (FES) batteries on 4 August 2017, after which they were disconnected from the chargers for storage. He installed them in the glider on the morning of 10 August, with the intention of flying the glider that afternoon. He initiated the FES battery self-checking procedure before conducting a daily inspection of the glider, after which the self-checking procedure had completed with no faults indicated on the FES Control Unit (FCU). He then fitted the FES battery compartment cover and applied tape around the edges of the cover. The pilot conducted a ground run of the FES propeller, which operated normally. He then switched the Power Switch off, and also turned the FCU off, which was contrary to his normal practice of leaving the FCU switched on. The pilot launched from Parham Airfield by aerotow at 1021 hrs and flew in ridge lift for a period of 38 minutes before encountering a rain shower. He decided to use the FES propulsion system and turned the Power Switch on. He then noticed that the FCU was switched off, so he switched the FCU on without moving the Power Switch position2. After waiting a few seconds for the FCU green LEDs to show that the FES propulsion system was available, the pilot operated the FES motor which responded normally and operated for 4 minutes. The pilot did not recall observing any fault messages on the FCU during the motor operation. After stopping the FES motor the pilot noticed that the propeller did not realign itself correctly against the nose of the glider. The pilot had experienced this problem previously and did not consider it to be a significant issue, so he did not attempt to realign the propeller. He switched the Power Switch off, leaving the FCU switched on and continued in soaring flight for a further 1 hour 15 minutes before positioning the glider to land on grass Runway 04 at Parham Airfield. The circuit was flown normally to a smooth touchdown, however at the moment of touchdown the pilot heard an unexpected noise. As the glider slowed during the ground run, the pilot smelled burning and the cockpit filled with smoke that was moving forward from behind his head. The pilot did not report observing any warning messages or illuminated LEDs on the FCU, although his attention was drawn outside the cockpit during landing. He vacated the cockpit normally, without injury, and observed that the FES battery compartment cover was missing and that smoke, followed shortly by flames, was coming from the battery compartment (Figure 1). The airfield fire truck arrived promptly and an initial attempt was made to extinguish the fire using a CO2 gaseous extinguisher, but this proved unsuccessful. Aqueous film-forming foam (AFFF) retardant was then sprayed into the FES battery compartment and the fire was extinguished. Footnote 2 The FCU User Manual and HPH304 eS Flight Manual both state that the FCU should be switched on at all times that the sailplane is in flight, with the Power Switch only switched on when the pilot wishes to operate the FES propulsion system. The FES system manufacturer stated that despite this departure from approved procedures, the sequence that the FCU and Power Switch were turned on in this event would not affect the operation of the FES propulsion system.

20 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 Figure 1 Fire in the FES battery compartment following the landing roll The FES battery compartment cover was found close to the glider’s touchdown point. The cover’s rear carbon fibre catch was fractured, consistent with an upward load acting on the inside of the cover. The cover did not exhibit any overheating damage. Aircraft information The HPH Glasflugel 304 S is a single-seat flapped sailplane of 18 m wingspan, constructed from composite materials with a retractable mainwheel. The 304 eS is a powered variant, capable of self-sustaining flight using a FES propulsion system (Figure 2) consisting of the following components: ● ● One 23 kW brushless electric motor installed in the nose of the sailplane, with a foldable two-bladed propeller ● ● One motor controller ● ● Two ‘GEN2’ 58 V battery packs, connected in series, each with an internal Battery Management System (BMS) ● ● One FES control unit (FCU) instrument, mounted in the instrument panel, displaying FES system monitoring information and a motor throttle knob ● ● One LXUI box with a shunt, for current and voltage measurements

21 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 ● ● One FES connecting circuit (FCC) box ● ● One Power Switch, to provide a 12 V power supply to the battery contactor, which connects the FES battery packs to the motor controller. It also provides a 12 V power supply to the motor controller ● ● One DC-DC converter to convert FES battery pack voltage to 12 V, to power the avionics and components of the FES system requiring a 12 V supply (battery contactor, cooling fans, LXUI box and FCC box) Figure 2 FES system installation in the HPH Glasflugel 304 eS powered sailplane (courtesy HPH Spol. S.r.o.) The HPH Glasflugel 304 eS powered sailplane has an European Aviation Safety Agency (EASA) Restricted Type Certificate (RTC), number EASA.A.030. The sailplane does not have an unrestricted Type Certificate as the FES engine and propeller are not EASA Type Certified in their own right, and are therefore considered part of the sailplane for certification purposes3. There are no operational restrictions related to the RTC. The FES propulsion system is also installed in two other powered sailplanes that hold EASA RTCs – the Schempp-Hirth Flugzeugbau Discus-2c FES (EASA.A.050) and the Sportinė Aviacija LAK-17B FES (EASA.A.083). In addition, there are a number of other powered sailplanes equipped with the FES propulsion system currently operating on EASA Permits to Fly, that are part-way through the EASA Type Certification process. The FES propulsion system is also installed in two commercially-available Regulation (EC) No 216/2008 Annex II microlights – the Alisport Silent 2 Electro, and the Albastar AS13.5m FES. These aircraft are not subject to EASA airworthiness regulations and may operate in the UK under the Single Seat Deregulation (SSDR) airworthiness exemption from the Air Navigation Order (ANO). Footnote 3 EASA Part 21.A.23 (c)(2).

22 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 The AAIB is also aware of a number of other FES-equipped Regulation (EC) No 216/2008 Annex II microlights, produced as modifications to existing sailplane designs that are currently in operation. These include two Pipistrel Apis 15M M FES sailplanes operating in the UK under SSDR regulations and one Diana 2 Versvs FES sailplane operating in Italy on an ENAC Permit to Fly. In addition, one FES-ASW-27 operates in the USA under FAA Experimental Category regulations. Battery pack description The ‘GEN2’ FES battery packs are removable for charging remotely from the sailplane. Each battery pack is built up from 14 Kokam Superior Lithium Polymer Battery (SLPB) cells, connected in series and contained within a carbon fibre battery box with a machined aluminium alloy cover plate/heatsink (Figure 3). The inside of the battery box has layers of glass fibre to prevent the battery cells from contacting the carbon fibre case, which is electrically conductive. The maximum total voltage for each battery pack is 58.3 V, giving a maximum voltage of 116.6 V for the assembly of both battery packs connected in series. An integral battery management system (BMS) controls the charging and discharging of the individual cells to balance the cell voltages and also provides over- and under-voltage protection. The capacity of each SLPB cell is 41 Ampere-hours (Ah), providing a total capacity for each battery pack of 2.1 kWh, or 4.2 kWh for both battery packs connected together. Each battery pack has a mass of 15.7 kg. The SLPB cells, part number SLPB100216216H, are lithium-ion polymer battery cells with a carbon-coated copper sheet anode (negative electrode) and a lithium nickel manganese cobalt oxide (NMC) coated aluminium sheet cathode (positive electrode). The cells have a gel electrolyte consisting of a solution of lithium hexafluorophosphate in an organic solvent. The cell contents are contained in a sealed pouch consisting of layers of polypropylene, aluminium foil and nylon-PET4. The anodes and cathodes are terminated with two tab-style connectors at the top of the battery cell. The cell tabs are connected together by pairs of connector plates; the upper plate is manufactured from brass and the lower plate from stainless steel, with the tab sandwiched between the plates. Each connector plate pair is assembled with four screws; the lower connector plate has threaded holes to accept the screws. The battery cells are retained within the battery case by a measured amount of clear silicone, poured into the case in liquid form during battery assembly and subsequently cured to form a semi-rigid support to the cells. The battery packs are connected together with power cables. To prevent incorrect connection, the positive terminal has a 10.3 mm diameter connecting pin and the negative terminal has an 8.0 mm diameter connecting pin. Footnote 4 Nylon-PET is a mixture of nylon and polythene terephthalate (PET).

23 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 Figure 3 FES battery assembly FCU description The FCU is an instrument installed in the instrument panel that informs the pilot of the status of the FES propulsion system via a display screen (Figure 4). A rotary throttle knob is provided at the bottom of the FCU that controls the power delivered to the propeller during powered flight. The rotary knob may also be pushed to confirm warning messages displayed on the FCU screen. Coloured LEDs on the FCU instrument are used to confirm the FES system status and alert the pilot of system warning messages. Two levels of warnings are provided5: ● ● YELLOW warning: This is first level of warning, which means that the pilot needs to be aware of the parameter indicated in the warning message and to manage the suggested solution to solve the problem. YELLOW warnings indicate that there is no immediate danger. The top ‘ALARM’ LED appears as a continuous red light. The LED and warning message on screen are confirmed by pressing the throttle knob. ● ● RED warning: This is the second level of alarm, which means that the pilot has to manage the solution of the indicated problem immediately. The top ‘ALARM’ LED appears as a flashing red light. The warning message on the screen is confirmed by pressing the throttle knob, but the flashing top LED persists whilst the fault condition is present. Red warning messages may be recalled by pressing the throttle knob. Footnote 5 Note that following the G-GSGS accident, the FCU caution and warning system was re-designed as described at the end of this report.

24 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 Figure 4 FCU main screen (courtesy LZ design d.o.o.) In a fault scenario where multiple warning messages are generated, the pilot is not aware of how many messages are present until all have been confirmed by pressing the throttle knob. Warning messages are displayed in the order they were generated and red messages, including the change in the ALARM LED indication from a steady red to a flashing red illumination, are not prioritised over yellow warning messages. In this accident, the FCU did not record any data or fault messages and therefore it is not known which messages were displayed to the pilot of G-GSGS during the battery fire event. The FES system designer confirmed however that for the configuration G-GSGS was in when the event occurred (Power Switch off, propeller not rotating), the following warning messages may have been generated, Table 1. Table 1 Possible FCU warning messages during the G-GSGS FES battery fire event The first two warnings are generated when the FCU senses a temperature difference between the two FES battery packs. The third warning occurs when the temperature of

25 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 either FES battery pack exceeds 75°C and each message is reliant on data sent from a functioning BMS of a FES battery pack. Apart from alerting the pilot to a battery pack temperature exceeding 75°C, the FCU does not provide any indication of a fire occurring in the FES battery compartment. As the FES battery compartment is behind the pilot within the fuselage, a pilot cannot see such a fire if it occurs. The warning messages may also be confusing to the pilot as the required pilot action refers to reducing or stopping the FES motor, when the motor is not in operation. Aircraft examination The origin of the fire was the forward FES battery; its battery box was ruptured along the rear left corner and the battery assembly was heavily fire damaged (Figure 5). The rear battery box suffered from external fire damage although the internal components were only slightly damaged and the cells remained charged. Figure 5 Fire damage to the forward FES battery The FES battery compartment was heavily fire damaged with burning of the composite material’s resin on the internal faces of the battery compartment and around the external cut-out in the upper fuselage skin. The top edge of the removable access panel that forms the front panel of the battery compartment (Figure 6) was also burned on its forward face and the FES electrical components in the equipment bay between the cockpit and the battery compartment were covered in soot deposits, demonstrating that the battery compartment had not contained all of the smoke and fumes released by the FES battery fire.

26 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 Figure 6 Fire damage to the FES battery compartment front access panel (left image, looking forwards), and to the forward face of the front access panel (right image, looking aft) The electrical cable glands in the left side of the front bulkhead of the battery compartment remained intact. The main 325 A power fuse was intact, as were fuses on the instrument panel. The DC-DC converter, installed in the battery compartment forward of the FES batteries, was externally fire damaged but when inspected it was apparent that the damage had been caused by external heating of the DC-DC converter during the fire. No evidence of overheating or fire damage internally within the DC-DC converter case was observed. Other information The pilot reported that in January 2017 one of the FES battery packs from G-GSGS fell from his car onto a paved surface through a vertical distance of around 0.2 m. There was no sign of damage to the battery pack following this event. The pilot did not record the serial number of this battery pack and therefore it is not possible to determine whether this pack was the battery that caught fire during the landing at Parham Airfield. Other FES battery fire events The AAIB became aware of the occurrence of two other FES battery fire events; one event occurred before the G-GSGS battery fire and the other afterwards. The first event occurred at Benesov Airport in the Czech Republic on 27 May 2017. An HPH 304 eS powered sailplane, registration OK-6634, was de-rigged for storage in its trailer with both

27 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 FES battery packs installed and connected together in the sailplane. This was contrary to an instruction in the sailplane’s Flight Manual, which required the connecting cable between the FES battery packs to be removed after landing. The FES battery packs remained charged to approximately 80% capacity after the flight that day. The FES Power Switch was off, as were the avionics master switch and FCU switch. The fire, which occurred approximately four hours after the sailplane had landed, started in the forward FES battery pack, causing significant damage to the battery compartment. The pilot of this sailplane had reported running over a “hard bump” during the latter stages of the landing roll, but apart from this the flight was unremarkable and no signs of heat emission were present when the sailplane was de-rigged and placed in the trailer after the flight. The serial number of the battery pack involved in the fire was 103-A, produced on 25 October 2016. The third event occurred at the Chicago Glider Club Gliderport, Minooka, Illinois in the United States on 2 December 20176. A Schempp-Hirth Discus 2c FES powered sailplane, registration N930DE, was being prepared for its second flight following delivery from the manufacturer, with the battery packs fully charged and the FCU switched on. As the connecting cable was inserted to connect the two FES batteries together, white smoke was seen to emanate from the battery compartment. The connecting cable was removed but the smoke emission continued, becoming thicker and following a “bang” noise from the battery compartment, black smoke and flames were observed coming from the rear FES battery. Fire-fighting was attempted using powder fire extinguishers, which were successful in supressing the flames and black smoke, although the white smoke continued. The flames and black smoke recurred shortly thereafter in a cycle repeated over approximately 20 minutes and the contents of eight powder fire extinguishers were used in the fire-fighting effort. The batteries were later removed from the sailplane, revealing that the epoxy material of the rear battery’s case, and the battery contents, had been largely consumed in the fire. The sailplane had been recently delivered to the owner and the FES battery packs installed in the sailplane had only been used in flight once by him. The owner stated that the battery packs had not been mishandled and had only been subjected to two charging cycles whilst in his possession. The serial number of the rear battery pack was 133-A, produced on 16 May 2017. As neither of the above battery fires occurred whilst the gliders involved were in operation, neither event was subject to an ICAO Annex 13 air safety investigation in the respective State of occurrence. Despite this limitation, the AAIB has liaised closely with both sailplane manufacturers and the FES system manufacturer to gather information on both events, in support of the G-GSGS investigation. Footnote 6 This event occurred after EASA issued Emergency AD 2017-0167-E on 6 September 2017, requiring modification of the FES battery packs before further flight of the Discus 2c FES. The FAA however did not issue an AD mandating similar safety action for US-registered aircraft. FAA regulations only require owner/ operators of US-registered aircraft to comply with the requirements of ADs issued by the FAA.

28 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 Tests and research Investigation of the G-GSGS failed battery The fire-damaged battery from G-GSGS, serial number 080-A, was received in a dismantled state following an initial examination by the battery manufacturer and the British Gliding Association. The battery remains were subjected to detailed visual and microscopic examination. The battery exhibited swelling of the individual cells and rupture of the outer case along the rear left corner. The glass fibre isolation layer on the rear wall of the battery case was found to be delaminated and detached from the case. The isolation layer on the right side of the battery has also partially delaminated, with some glass fibre sheets adhered to the battery top cover and some sheets still attached to the case wall. Visual examination of the individual cells showed that the pouches of each cell were split along all edges. A localised hot-spot was observed between cells 5 and 6 on the upper edge of the cells in between the electrode tabs (Figures 7 and 8). The hot-spot was observed on the cell pouches and a number of the internal sheet electrodes were also exposed. The hot-spot did not appear to penetrate the whole cell pack thickness. Figure 7 Localised hot-spot between cells 5 and 6 apparent during initial disassembly of the battery (courtesy British Gliding Association) Figure 8 Localised hot-spot between cells 5 and 6 (courtesy QinetiQ)

29 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 Examination of the hot-spot at cell 6 revealed localised melting of both the aluminium cathode and copper anode electrode sheets (Figure 9) indicating that the temperature at the hot-spot had exceeded 1,085°C, the melting point of copper. The presence of solidified molten copper was further confirmed by examination of the hot-spot location using a scanning electron microscope, and energy dispersive X-ray analysis of the molten copper deposits. Figure 9 Localised hot-spot at cell 6, with solidified molten copper present (courtesy QinetiQ) When cell 5 was disassembled, a radiating pattern of combustion-deposit ‘beachmarks’ was apparent, originating at the hot-spot (Figure 10). This indicated that ignition of the cell’s gel polymer electrolyte had begun at the hot-spot location before burning downwards through the cell. Detailed examination of the hot-spot sites did not reveal the presence of any foreign objects at these locations. There was no evidence of ‘welding’ of the individual cell electrodes; the cell packs appeared to be fused together with combustion products, most likely the gel electrolyte residues. Examination of the lower stainless steel cell connector plates showed a burr present on a number of the drilled and threaded holes, on the lower surface of the plates (Figure 11). The visual examination also showed the potential formation of swarf from these burrs.

30 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 Figure 10 Combustion front ‘beachmarks’ evident on cell 5 electrodes (courtesy QinetiQ) Figure 11 Thread-cutting swarf present on the lower surface of the connector bars (courtesy QinetiQ)

31 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 AAIB battery cell abuse testing In order to create an internal short circuit within a battery cell under controlled conditions, the AAIB conducted a series of tests in which fully charged cells were penetrated with a 2.0 mm diameter steel nail. The nail, which was ground to a sharp point at both ends, was positioned between two cells and the cells were then moved together until the nail penetrated the cells. The testing showed that the nail initially penetrated only one of the cells and that shortly after cell penetration occurred, electrical arcing took place with ejection of sparks from the penetrated cell pouch due to the internal short circuit of that cell’s electrode (Figure 12). The electrical arcing was immediately followed by rapid inflation of the cell pouch and the ejection of light grey smoke, followed shortly by flames. The fire continued for approximately two minutes until the gel electrolyte polymer, which was the main fuel source involved in the fire, was fully consumed. Figure 12 Electrical arcing following cell penetration Examination of the steel nail after the tests showed that it had melted in the initial electrical arcing event, indicating that the temperature generated during the arcing was in excess of 1,400°C. The cell electrodes at the penetration site had a hole of larger size than the nail diameter, the edges of which were formed from solidified molten electrode material, consistent with the melting of the electrodes during the arcing event. The remaining copper and aluminium electrodes were relatively intact, demonstrating that the temperature reached during the combustion of the cell’s gel electrolyte was relatively cool compared to the electrical arcing temperature. A pattern of combustion ‘beachmarks’ originating at the nail penetration site was observed (Figure 13) these were similar to those observed in the fire-damaged battery from G-GSGS.

32 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 Figure 13 Combustion beachmarks from AAIB cell penetration tests CT scanning results from samples of the FES battery fleet In view of the potential for release of metal debris into the battery packs from the connector plates, the internal condition of 11 FES battery packs were subjected to CT7 X-ray examination. The selection of the batteries for examination was partly based on their manufacturing date, to provide a representative sample across a range of battery production. Table 2 Findings from battery CT-scanning Footnote 7 Computed Tomography is an X-ray scanning technique in which X-ray images are computer-processed to produce individual ‘slice’ images through an object.

33 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 The CT scans identified features consistent with metallic debris present in seven out of the 11 batteries examined. An eighth battery contained an 8.0 mm non-metallic foreign object within the battery assembly but on disassembly this was revealed to be a plastic tool that had been left in the battery following disassembly of the battery pack by its owner. The CT scan of battery pack 080-B, the rear battery pack from G-GSGS, contained one metallic object lying between two cells at the top of the pack (Figure 14). This object was beneath the silicone layer indicating that the foreign object has been present when the battery pack was assembled. The battery pack was disassembled and the metallic object was recovered. The object was a piece of metal swarf, 2 mm in length, with a distinctive curved shape consistent with the swarf generated during the thread-cutting process of the connector plates. Figure 14 Metallic swarf debris within battery pack 080-B (courtesy QinetiQ) Battery cell vibration testing In order to determine whether the presence of metal swarf between the battery cells could lead to penetration of the cell pouch material, the AAIB carried out vibration testing. An assembly of two SLPB100216216H cells was held within a fixture to simulate a portion of an assembled FES battery, with the cells bonded to the fixture using silicone sealant and restrained across the cell faces, but otherwise free to move relative to one another. The cell fixture could be mounted in one of two positions, such that the axis of applied vibration of the cells was either vertical to or lateral to the cells; this was to simulate vertical or lateral cell vibrations of the battery as mounted in an aircraft.

34 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 The cell fixture was mounted on a milling machine bed on a linear bearing allowing displacement along the machine bed axis only (Figure 15). The cell fixture was connected via a pushrod to a crank pin mounted in a boring bar head in the milling machine spindle. The eccentricity of the driving crank pin was adjusted to achieve the desired peak-to-peak amplitude displacement of the cell fixture of 2.5 mm for the frequency range 5 – 15 Hz, and 1.0 mm for 15 – 40Hz8. Using the variable spindle speed on the milling machine, the cell fixture could be vibrated across a frequency range of 1 – 40 Hz. Laser displacement sensors were used to measure the relative displacements between the cells within the cell fixture. Figure 15 Cell vibration testing equipment The first set of tests were conducted without any swarf present between the cells. The frequency of the applied vibration was increased in 5 Hz steps between 5 Hz and 40 Hz, and where resonances were noted, additional tests were performed at the resonant frequencies. With the cells vibrated in the vertical axis, simulating the most likely oscillatory loading axis in a glider during landing and takeoff ground rolls, resonant frequencies were noted at 18.8 Hz and 22.8 Hz. No signs of fire, smoke or unusual odours were noted during these tests. The cells were then vibrated in the horizontal axis for 30 minutes at Footnote 8 This frequency-amplitude vibration schedule is defined in RTCA/DO-160G ‘Environmental Conditions and Test Procedures for Airborne Equipment’ and is the vibration schedule specified in EUROCAE/DO-311 ‘Minimum Operational Performance Standards for Rechargeable Lithium Battery Systems’.

35 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 a resonant frequency of 20 Hz and again no abnormalities were noted with either cell during the test. Once testing was complete the cells were removed from the cell fixture and subjected to detailed visual examination, which confirmed that no external damage was evident to the surface of either cell. A second test was conducted with 3.0 mm lengths of steel swarf inserted between the cells (Figure 16). The cells were vibrated in the horizontal axis for 30 minutes at a resonant frequency of 20 Hz, during which there were no signs of fire, smoke or unusual odours. Following this test, the cell fixture was disassembled and it was noted that there had been migration of the swarf within the cell fixture and some fretting of the cell pouch material due to contact with the swarf, but the fretting depth had not exceeded the pouch thickness and no electrolyte had been released. Figure 16 Cell pouch fretting during vibration testing with metal swarf present A third vibration test with metal swarf present between the cells was carried out for 30 minutes at a resonant frequency of 28 Hz, with vibration in the horizontal axis. This test resulted in similar cell pouch fretting as observed in the second test, with no fire, smoke or unusual odours detected. Certification requirements Aircraft-level requirements The HPH Glasflugel 304 eS was certified by EASA in November 2016 to EASA Certification Specifications for Sailplanes and Powered Sailplanes (CS-22 (Amendment 2)). The sailplane’s Type Certificate also included compliance with Special Condition SC-22.2014‑01 ‘Installation of electric propulsion units in powered sailplanes’ which contained additional airworthiness requirements for all components of the electric propulsion system, including the batteries and their installation in the sailplane.

36 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 The Special Condition contained the following requirements for the batteries: ‘CS 22.963 Batteries or other energy storage devices (a) The suitability and reliability of batteries or other energy storage devices shall be proved due to experience or tests. (b) Characteristics of the energy storage devices, including failure modes (e.g. thermal runaway, expansion, explosion, toxic emission) should be identified. Battery cells and other subcomponents of the system should be assembled and installed minimizing the effects of failures.’ The Special Condition also included Guidance Material for CS 22.963(a): ‘GM CS 22.963(a): Battery cells should be qualified according to accepted standards (e.g. EUROCAE/DO311, UN T 38.39).’ The installation of the batteries in the sailplane was also covered by this Special Condition in CS 22.967, including the following: ‘CS 22.967 Installation of energy storage devices (d) Each energy storage device shall be installed to minimize the effects of the failure mode identified under CS 22.963. Design precautions might

include:

Providing the crew with the relevant information allowing to take proper

actions (e.g. temperature or pressure monitoring),

Mitigating the effect of thermal runaway or fire, and ensuring the

surrounding structure might be able to withstand the thermal loads,

Designing the compartment for the battery in order to cope with overpressure or expansion.’ Battery requirements The battery cells were qualified to UN T 38.3 by the cell manufacturer. In order to achieve UN T 38.3 certification, 60 individual cells were subjected to tests including altitude simulation, thermal testing, vibration, shock, external short circuit, impact and forced discharge. UN T 38.3 test requirements may be applied to individual cells, or to assembled batteries. It is typically used to qualify battery cells for shipment under Dangerous Goods transport requirements. The alternative battery qualification standard included in the CS 22.963(a) Guidance Material is EUROCAE/DO311 ‘Minimum Operational Performance Standards for Footnote 9 United Nations Recommendations on the Transport of Dangerous Goods, Manual of Tests and Criteria, Section 38.3, Amendment 2, 2001.

37 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 Rechargeable Lithium Battery Systems’. This qualification standard is applicable to assembled batteries and contains additional test requirements compared to UN T 38.3. DO311 is a common qualification requirement for large lithium batteries forming part of the electrical systems in EASA CS- 23 normal, utility, aerobatic, and commuter category aircraft and EASA CS-25 Transport Category aircraft. The UN T 38.3 qualification at the individual cell level was accepted by EASA as proof of compliance against CS 22.963(a) for the assembled FES battery system in the HPH 304eS sailplane. Analysis Cause of the battery fire event The G-GSGS battery fire started in the forward FES battery due to an electrical arcing event that occurred at the top of cells 5 and 6, as evidenced by melted copper and aluminium cell electrodes. The available evidence suggests that the electrical arcing began when the glider touched down during a normal landing. The temperature reached in the electrical arcing event exceeded 1,085°C and probably exceeded 1,400°C, based on the results of AAIB tests. The release of pressurised combustible gas from the forward battery caused over-pressurisation of the glider’s battery compartment, leading to the detachment of the battery compartment cover. Once the battery’s gel electrolyte had ignited, the fire continued to burn and consumed all of the electrolyte and also ignited the glider’s composite structure, until the fire was extinguished by the application of AFFF foam retardant. There was no remaining evidence of what had caused the battery fire to start. No metallic foreign objects were observed at the electrical arcing site, however the high temperatures generated during the arcing event would have probably melted a metallic foreign object if one had been present. Investigation of intact FES batteries revealed the presence of metallic foreign objects within the battery assemblies on 7 of the 11 battery packs investigated. Most of these metallic objects were less than 1.0 mm in length, although metallic objects up to 4.0 mm in length were detected. One battery pack was disassembled as part of the investigation which revealed that a 2.0 mm long metallic object was a piece of metal swarf, probably produced as part of the thread-forming operation on one of the battery’s stainless steel lower connector plates. The location of this metal swarf, which was beneath a silicone layer, showed that it was present during the battery manufacturing process. The vibration testing conducted by the AAIB showed that whilst cell pouch fretting did occur due to the presence of swarf within a battery assembly, the fretting was not severe enough to cause the swarf to penetrate the cell pouch and cause an internal short circuit within a cell.

38 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 Fire containment In the accident to G-GSGS, the smoke and fumes generated by the battery fire were not contained within the battery compartment, and entered the cockpit due to fire damage of the forward battery compartment bulkhead. This bulkhead was constructed of composite materials which ignited once the battery had begun to burn. Apart from this failure, the remainder of the battery compartment structure remained intact and prevented the fire from spreading further within the fuselage. Cockpit warning systems The pilot reported that he did not recall observing any warning messages on the FCU display. As the FCU did not record which messages were displayed during the battery fire event, it was not possible to confirm whether any messages were displayed. Based on the FCU system logic, it is likely that battery temperature and voltage warning messages were generated, but by this time the glider had landed and the pilot’s attention was drawn to controlling the glider during the landing roll. The design of the FCU caution and warning system was such that had a battery fire occurred during flight, the sequence of messages would not have alerted the pilot to the presence of a battery fire and some of the warning messages may have been confusing. It would also have been necessary to manually scroll through the list of warning messages, without the ability to recall warnings which had been viewed. The other FES battery fires The other two FES battery fires that have occurred to date are different to the G-GSGS event. Both fires occurred whilst the sailplanes were stationary, and therefore vibration of the FES battery involved in each fire does not appear to be the initiating event for the battery fire, unlike the G-GSGS event. The N930DE battery fire (in the USA) occurred when the battery link cable was inserted, electrically connecting the two FES batteries together in series and allowing a small current to flow between the batteries due to the current draw of the DC-DC converter. The OK-6634 battery fire (in the Czech Republic) occurred more than four hours after the glider had landed, when the glider was stationary and de-rigged in its trailer. The battery link cable remained installed, contrary to the flight manual instructions, again allowing a small current to flow from the FES batteries due to the current draw of the DC-DC converter. The causes of both fires have not been determined, although the effects of the fires were similar to the G-GSGS event in that the fire consumed the affected FES battery and did not spread to the second FES battery. In each case the thermal effects of the fire were largely contained within the battery compartment.

39 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 Battery certification procedures The battery certification procedures used to qualify the FES battery system relied on the demonstration of compliance against the requirements of UN T 38.3 at the individual cell level, rather than at the assembled battery level. This certification approach is contrary to that applied by EASA and the FAA for larger (Part 23 and Part 25) aircraft, where the assembled battery as a system is subjected to the more stringent certification requirements contained within EUROCAE/DO311. The reliance on UN T 38.3 at the cell-level only was accepted by EASA following comments received during the Notice of Proposed Rulemaking process that resulted in the issue of Special Condition SC-22.2014-01 ‘Installation of electric propulsion units in powered sailplanes’, published in 2014. In particular, the EASA position articulated in SC-22.2014.01 recognised that whilst: ‘Lithium Polymer batteries have specific failure and operational characteristics that could affect the safety of those battery installations and cause hazards to safety, on the other hand it is understood that the characteristics of existing [two‑stroke piston engine] propulsion systems have contributed to quite a number of accidents and electric propulsion systems with a simple and reliable start procedure can improve safety significantly10.’ As it has not been possible to identify whether the G-GSGS battery fire event originated within a particular battery cell, or occurred due to a physical or electrical anomaly between two cells forming part of the battery assembly, it is unclear in this case whether certification of the battery assembly to a more stringent set of regulations by EASA would have prevented the battery fire. Conclusion During a normal touchdown following an uneventful flight, the glider’s forward FES lithium polymer battery ignited due to an electrical arcing event. The pilot was unaware that the glider was on fire and the battery continued to burn, generating smoke and fumes which entered the cockpit during the latter stages of the landing roll. The pilot was not injured and the fire was extinguished using foam retardant, although the glider’s fuselage battery box and surrounding structure was extensively fire-damaged. A detailed examination of the forward FES battery did not determine the cause of the battery fire. The G-GSGS battery fire was the second of three such FES battery fires that have occurred to date. A survey of other FES batteries from the in-service fleet revealed the presence of metallic debris in a significant proportion of those batteries examined. Vibration testing conducted by the AAIB showed that the presence of metallic debris can cause battery cell pouch fretting although this was not sufficiently severe to cause an internal short circuit and electrical arcing. Footnote 10 Special Condition SC-22.2014-01 ‘Installation of electric propulsion units in powered sailplanes’.

40 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 As a result of this investigation the sailplane manufacturer and FES system manufacturer have implemented a number of safety actions intended to prevent recurrence, or to mitigate the effects of a battery fire should such a fire occur. Safety actions Fire detection systems At an early stage in the investigation, the AAIB made the following three Safety Recommendations relating to fire detection systems in Special Bulletin S3/2017, published in September 2017: Safety Recommendation 2017-018 It is recommended that the European Aviation Safety Agency (EASA) requires that all powered sailplanes, operating under either an EASA Restricted Type Certificate, or an EASA Permit to Fly, and fitted with a Front Electric Sustainer (FES) system, are equipped with a warning system to alert the pilot to the presence of a fire or other hazardous condition in the FES battery compartment. Safety Recommendation 2017-019 It is recommended that Alisport Srl modifies the Silent 2 Electro microlight to incorporate a warning system to alert the pilot to the presence of a fire or other hazardous condition in the Front Electric Sustainer (FES) battery compartment. Safety Recommendation 2017-020 It is recommended that Albastar d.o.o. modifies the AS13.5m Front Electric Sustainer (FES) microlight to incorporate a warning system to alert the pilot to the presence of a fire or other hazardous condition in the FES battery compartment. In response to these Safety Recommendations, the affected FES-equipped sailplanes have been modified with an independent warning system to alert the pilot to the presence of a fire in the FES battery compartment. Battery and sailplane improvements The HPH 304 eS sailplane manufacturer has replaced the composite battery compartment forward bulkhead with a stainless steel bulkhead to improve the fire-resistance of the bulkhead in the event of a battery compartment fire. The internal surfaces of the battery compartment are now painted in an intumescent fireproof paint finish. The existing fleet of FES batteries was withdrawn from use and is currently being refurbished to a new design standard, to which new production batteries

41 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-GSGS EW/C2017/08/01 are also being produced. The new design standard includes replacement of the battery case with a stronger glass fibre case, constructed using high- temperature resin, that has been demonstrated in testing to remain structurally intact during a battery fire. The new battery case also features an impact label that permanently records if the battery has been subjected to a shock loading of 50g or more, to allow the battery to be withdrawn from use for inspection if subjected to abuse. The new FES battery features additional nomex-mylar insulation between the cells and an increased quantity of silicone encapsulation of the battery cells to prevent foreign objects from falling between the cells. The edges of the battery cells pouches are covered in an electrically-insulating tape to prevent electrical discharge of the cell should the cell pouch seal fail. The stainless steel battery cell connector plates have been replaced with anodized aluminium plates which have been demonstrated not to eject machining swarf from screw threads when the connector screws are inserted during assembly. Sailplanes equipped with the FES system also now feature a pressure-relief valve in the battery compartment cover, designed to allow the cover to remain attached to the sailplane in the event of over-pressurisation of the battery compartment should a battery fire occur. FCU caution and warning system changes The FCU caution and warning system has been redesigned such that red warnings are prioritised over lower-level yellow warning messages. Different audio warning tones now accompany red and yellow warning messages. All warning messages are recorded in the FCU’s non-volatile memory for recall during operation and certain warning messages are recorded for subsequent fault investigation. Battery certification requirements An Electric Propulsion Working Group has been established including experts from the OSTIV11 Sailplane Development Panel, EASA, certain sailplane manufacturers and the manufacturer of the FES system. This group will review the existing EASA battery certification requirements and to coordinate research activities in electric propulsion integration in powered sailplanes, including battery fire detection and containment. Footnote 11 Organisation Scientifique et Technique International du Vol á Voile / International Scientific and Technical Soaring Organisation.

FD06632 ｜ 2018_英国_aaib-investigation-to-jabiru-ul-450-g-judd__Jabiru_Ul-450_G-JUDD_11-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

125 © Crown copyright 2018 All times are UTC AAIB Bulletin: 11/2018 G-JUDD EW/G2018/07/37 ACCIDENT Aircraft Type and Registration: Jabiru Ul-450, G-JUDD No & Type of Engines: 1 Jabiru 2200A piston engine Year of Manufacture: 2000 (Serial no: PFA 274A-13570) Date & Time (UTC): 16 July 2018 at 15:10 hrs Location: Clench Common Airfield, Wiltshire Type of Flight: Training

Persons on Board: Crew - 2 Passengers - 1 Injuries: Crew - None Passengers - None Nature of Damage: Nose leg failure, damage to lower cowl and firewall Commander’s Licence: National Private Pilot’s Licence Commander’s Age: 64 years Commander’s Flying Experience: 12,508 hours (of which 272 were on type)

Last 90 days - 128 hours

Last 28 days - 40 hours Information Source: Aircraft Accident Report Form submitted by the pilot The aircraft was being flown by a student on conversion training with an experienced instructor. The student had completed several landings during the flight and was making a further approach on Runway 26 with a light wind down the runway. As the aircraft touched down it bounced, and the instructor told the student to maintain the attitude and allow the aircraft to touch down again. Despite attempting to maintain the attitude, on the second touchdown the aircraft landed flat on all three undercarriage legs and the nose leg failed. The aircraft lower cowls, firewall and nose leg were damaged. The instructor commented that, in hindsight, he felt should have taken control and gone around from the bounce.

FD06633 ｜ 2018_英国_aaib-investigation-to-jetstream-4100-g-majc__Jetstream_4100_G-MAJC_07-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

55 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 G-MAJC EW/G2017/10/06 ACCIDENT Aircraft Type and Registration: Jetstream 4100, G-MAJC No & Type of Engines: 2 Garrett Airesearch TPE331-14GR-807H turboprop engines Year of Manufacture: 1992 (Serial no: 41005) Date & Time (UTC): 16 October 2017 at 0835 hrs Location: Hawarden Airport, Chester Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 3 Passengers - 9 Injuries: Crew - None Passengers - 1 (Minor) Nature of Damage: Damage to right propeller and right overwing emergency escape hatch Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 42 years Commander’s Flying Experience: 5,000 hours (of which 450 were on type)

Last 90 days - 150 hours

Last 28 days - 52 hours Information Source: Aircraft Accident Report Form submitted by the pilot and addtiional enquiries by the AAIB Synopsis During a descent into Hawarden Airport, at around FL150, the flight crew noticed a burning smell. Oxygen masks were donned, a MAYDAY was declared and an expedited approach was carried out to land on Runway 22. The crew experienced some difficulty in communication, both internal and external, while using their oxygen masks. After landing the aircraft was taxied clear of the runway, brought to a stop, and an emergency evacuation was carried out. The burning smell was as a result of smoke and dust carried in the atmosphere from North Africa and Iberia. The report highlights safety action taken by the operator in relation to its procedures, and other agencies in relation to the promulgation of information in unusual meteorological circumstances such as these. History of the flight The flight crew reported for duty at 0600 hrs at Leeds Bradford Airport. When they reported they were advised that their original schedule had been changed. Another company aircraft was unavailable due to a technical problem so the crew were to position their aircraft to Bristol International Airport and then operate a sector to Hawarden with passengers.

56 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 G-MAJC EW/G2017/10/06 The aircraft had been parked overnight on the apron at Leeds. The commander reviewed the technical log and noted there were no open entries; however, when he went through the pre-flight checklist, he noticed that the standby battery charge was low. An engineer was called to the aircraft to assist, he advised that after a period with ground power attached the battery would re-charge. The crew continued to prepare the aircraft for flight. The commander reported afterwards that he had felt rushed and that there had not been time to complete a pre-flight briefing with the cabin crew member. The co-pilot was the pilot flying (PF) for the sector to Bristol. The flight was uneventful and the aircraft landed and was shut down on the apron. The commander requested a ground power unit be connected to the aircraft, but none was available. The passengers boarded and the aircraft departed at 0800 hrs, approximately 30 minutes behind the normal schedule. The commander was the PF. The 0820 hrs METAR at Hawarden was: surface wind from 150° at 12 kt, visibility 6,000 m, showers in the vicinity, cloud broken at 900 ft, temperature 16°C dewpoint 15°C and pressure 1008 hPa. The descent checks and approach briefing for Runway 22 had been completed and the aircraft was descending through FL150 to the south of Hawarden when the flight crew started to notice a burning smell. It appeared to them that the smell was coming from the air vents on the flight deck. They donned their oxygen masks and attempted to verify communication between themselves, but found it difficult because of high noise levels coming through the cockpit speakers. The co-pilot declared a MAYDAY to ATC, advising of a burning smell and their intention to continue to land at Hawarden. The commander contacted the cabin crew member on the interphone. She was hardly able to hear his message but understood that they were carrying out an emergency descent and went to check and secure the cabin. When he contacted her again she could not hear any of the message so she entered the flight deck. The commander gave her an emergency briefing, using the ‘NITS’ mnemonic (Nature, Intentions, Time, Special instructions), advising her that the aircraft would be landing in 10 minutes and to standby for instructions after landing. The noise levels through the cockpit speaker remained high and when the commander spoke or attempted a transmission there was a strong feedback signal. The approach and landing on Runway 22 was completed and the commander taxied the aircraft clear of the runway, turning north onto adjacent Taxiway ‘D’, and brought it to a stop. He did not know if he could contact the cabin crew member and was uncertain of the conditions in the passenger cabin, so he decided an emergency evacuation should be carried out. He shut down the engines and made a PA announcement to the cabin to initiate the emergency evacuation. After the commander made the evacuation announcement to the cabin, the engines continued to operate at idle power for 8 seconds before they started to run down; the propellers continued turning for a further 40 seconds. The forward cabin door and the two mid-cabin over wing emergency exits were opened by the passengers. The right over wing exit door was dropped

57 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 G-MAJC EW/G2017/10/06 to the ground behind the wing and blown forwards by the wind into the still rotating right propeller. The aft cabin exit door was opened by the cabin crew member; it fell to the ground and was blown rearwards by the propeller wash from the right engine (Figure 1). Figure 1 Aircraft evacuation The passengers exited the aircraft and, once they had checked the cabin was clear, the crew followed. The RFFS were in attendance and assisted with the passenger management. There was one minor injury. A timeline of the evacuation is provided at Table 1. Time (s) Event 00 Aircraft turns onto Taxiway ‘D’ 15 Aircraft stopped 22 Over wing exits opened 49 All passengers off aircraft 63 Propellers stop turning 73 All crew off aircraft Table 1 Evacuation timeline Recorded information The CVR was replayed at the AAIB and contained a record of the event. The recording indicated that both pilots were wearing their oxygen masks and had their interphones selected, which caused high noise levels during intake and exhalation of breath. Feedback whistle was also evident when the commander adjusted or removed his mask and when he attempted some transmissions. Video recordings of the outside of the aircraft during the passenger evacuation were available for the investigation.

58 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 G-MAJC EW/G2017/10/06 Aircraft information Communication Selection and control of audio received and transmitted by each pilot is through on-side Audio Control Panels (ACP). VHF, interphone and passenger address selections are made by means of push button switches which deselect the previous selection. To select the oxygen mask microphone a mic-mask switch on the Audio Control Panel (ACP) is selected to mask. When an ACP is selected to mask audio to the cockpit speaker is activated and cannot be turned off. A switch on each control column can be selected to tx, off or ic. After pressing tx the switch will spring back to off, whereas if ‘ic’ is pressed it will remain selected until a different selection is made. Engine shut down procedures For a normal engine shut down at the end of a flight the engine stop buttons are pressed. This operates the fuel purging system and, when the rpm reduces to 50%, the power levers are moved to the reverse position. In an emergency evacuation the engines are shut down by moving the Condition Levers to the feather/fuel shutoff position, see Emergency Evacuation Checklist (Figure 2).

Figure 2 Emergency Evacuation Checklist The aircraft manufacturer was not able to provide details of the time differential between the two methods for engine shut down to be achieved.

59 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 G-MAJC EW/G2017/10/06 Emergency evacuation procedures The Jetstream 41 aircraft has a single cabin entry door with integral airstairs located on the forward left side of the fuselage. Two over-wing emergency escape doors are located either side of the cabin and there is a single service door on the aft right side of the fuselage. All these can be used as exits in the event of an emergency evacuation. The Operator’s Operations Manual (OM) guidance for emergency evacuation advised that the Emergency Evacuation Checklist (Figure 2) should be performed as a memory action, the OM included the additional information: ‘It is essential to have the engines shut down prior to the start of an evacuation. Consequently, the call on the PA to evacuate must only be made when it is considered safe to commence the procedure.’ Aircraft examination The aircraft was inspected at the Operator’s maintenance facility and damage was found to three separate areas. The right-hand overwing emergency exit door had been struck by the right-hand propeller, causing damage to both. The right hand rear emergency exit door was damaged by contact with the taxiway surface. Meteorology On 13 October 2017 the UK Met Office Environment Monitoring and Response Centre (EMARC) noted on satellite imagery a quantity of dust which had lifted from the Sahara Desert and was tracking towards the UK, carried by strong southerly winds on the eastern side of ex-hurricane Ophelia. This air also picked up and carried quantities of smoke from a series of forest fires on the Iberian Peninsula. By 16 October this air reached the UK and was concentrated into a denser layer by the cold front associated with Ophelia. The Met Office forecasts for 0900 hrs 16 October 2017, separately for dust and biomass burning, are reproduced at Figures 3a and 3b.

Other information Multiple events of smoke and fumes During 16 and 17 October the AAIB received 32 notifications of Smoke/Fume events affecting aircraft in UK airspace and the UK CAA received in excess of 60 Mandatory Occurrence Reports (MOR). Of the 32 events reported to the AAIB, smoke/fumes were initially detected by flight and cabin crew members at altitudes from between 2,000 ft and FL200. The earliest event appears to have been around 0622 hrs on 16 October in the vicinity of Liverpool at FL130; the aircraft returned to land at Liverpool. Subsequently there were clusters of affected aircraft in the Channel Islands, Liverpool/ Manchester area and, in the afternoon of 16 October, around London Heathrow. During the afternoon of 16 October London Heathrow appended a message to their ATIS, alerting arriving and departing crews of the possibility of their encountering smoke while airborne. The majority of the aircraft affected either returned to land at the point of departure or expedited their existing approaches, although two aircraft continued en route after initially reporting a

60 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 G-MAJC EW/G2017/10/06

Figure 3a 16 October 2017 forecast Dust Aerosols for 0900 hrs Figure 3b 16 October 2017 forecast Biomass Burning Aerosols for 0900 hrs

61 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 G-MAJC EW/G2017/10/06 problem. Nearly all flight crews declared either PAN or MAYDAY and most used oxygen masks. Of these several reported experiencing difficulty when using the on board masks/goggles, some with vision through the goggles and some with interphone and radio communications. On 16 October, different Air Navigation Service Provider (ANSP) units received multiple reports of fumes on the flight deck and of aircraft making precautionary or emergency landings. A Met Office meteorologist, based at National Air Traffic Services (NATS) headquarters, was contacted by NATS personnel when they became aware that smoke and fumes were affecting numbers of aircraft. The enquiry was passed on to the Met Office and initially a general, but not aviation specific, press report was issued. Later the report was undated to include information about the altitudes at which smoke/dust was present. Analysis Meteorological situation The smoke/fume event took place on G-MAJC early on the morning of 16 October 2017, and before it was recognised that other aircraft were similarly affected. However, later in the day when there was evidence of significant numbers of aircraft reporting smoke and fumes, there was no co-ordinated dissemination of this information. Smoke and fumes on an aircraft create a high level of stress for the flight crew and any additional information is likely to be beneficial. Flight crews experiencing a smoke/fumes event would still be required to complete the abnormal procedures, but with the benefit of an understanding of the likely cause. Communication The flight crew had difficulty in communicating between themselves and with the cabin crew member because of high levels of breathing noise and occasional feedback whistle. This created a distraction, increased their workload and meant that the commander did not feel well informed about the conditions in the passenger cabin. The reason for the breathing noise was the sustained selection of interphone. The reason for the feedback whistle was not determined but it appeared to be generated from the commander’s side and be associated with times when he removed or adjusted his mask or attempted transmissions. Evacuation procedure The commander’s lack of information as to the conditions prevailing in the passenger cabin led him to initiate an emergency evacuation as soon as the aircraft came to a stop. During the emergency it is likely that the flight crew were operating under high levels of stress and, as a result, the evacuation procedure was rushed and checklist actions not completed. This led to the passengers evacuating the aircraft unescorted while the propellers were still turning, with an associated risk to themselves. Three of the four emergency exits are behind the wing and thus the possibility of walking into a propeller is reduced. However, the forward exit presents a high risk to personnel, especially when there is no crew member in attendance. The operator recognises this by requiring the engines to be shut down and the propellers confirmed to have stopped

62 © Crown copyright 2018 All times are UTC AAIB Bulletin: 7/2018 G-MAJC EW/G2017/10/06 rotation before an evacuation is initiated. The combined rundown time for the engine and the propellers, as demonstrated in this case, may be in excess of 40 seconds. Safety action In December 2017 a review of the smoke and fume events on 16 and 17 October was held by the UK CAA together with representatives from NATS and the Met Office. The Met Office advised that accurate forecasting of such phenomena is problematic because it is hard to forecast the extent and height at which the smoke is likely to be present due to the difficulty in accurately locating the fires. Met Office systems allow a SIGMET to be issued that contains smoke related information and, although it is not compliant with the ICAO format or existing templates, a test showed that it was compatible with NATS’s systems. In future a SIGMET will be issued when NATS informs the Met Office there is significant smoke in the atmosphere that is affecting aircraft operations. ANSPs are responsible for notifying the Met Office of any pilot reports of unusual phenomena affecting flight, but not at present for notifying the UK CAA.

Work is being undertaken to see whether a ‘Securité’ message broadcast on 121.500 MHz could be used to promulgate a safety message concerning smoke in the UK FIR. The participants agreed to ensure that suitable escalation and inter-agency coordination procedures are put in place to improve the promulgation of such unusual events in the future. The operator conducted its own internal investigation into the event and identified safety recommendations and actions. The operator decided to: Provide enhanced training on use of oxygen masks including a video of mask donning procedures. Provide a list of approved headset types shown to be compatible with the aircraft communication systems. Review and amend the passenger emergency briefing to include a warning about the danger of rotating propellers. Incorporate a similar type of event into the company training programme. Bulletin Correction The third and fifth items from the above safety actions section (commencing ‘Met Office systems’ and ‘Work is being undertaken’) were omitted from the original report prior to printing. The items were added to the online version of the report prior to publication on 12 July 2018.

FD06634 ｜ 2018_英国_aaib-investigation-to-jetstream-4100-g-majc__Jetstream_4100_G-MAJC_Correction_08-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

47 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-MAJC EW/G2017/10/06 BULLETIN CORRECTION Aircraft Type and Registration: Jetstream 4100, G-MAJC Date & Time (UTC): 16 October 2017 at 0835 hrs Location: Hawarden Airport Information Source: Aircraft Accident Report Form AAIB Bulletin No 7/2018, page 62 refers In the original report, two items of safety action were omitted: Met Office systems allow a SIGMET to be issued that contains smoke related information and, although it is not compliant with the ICAO format or existing templates, a test showed that it was compatible with NATS’s systems. In future a SIGMET will be issued when NATS informs the Met Office there is significant smoke in the atmosphere that is affecting aircraft operations. Work is being undertaken to see whether a ‘Securité’ message broadcast on 121.500 MHz could be used to promulgate a safety message concerning smoke in the UK FIR. The above safety items were added to the online version prior to publication.

FD06635 ｜ 2018_英国_aaib-investigation-to-kolb-firefly-g-cepn__Kolb_FireFly_G-CEPN_03-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

89 © Crown copyright 2018 All times are UTC AAIB Bulletin: 3/2018 G-CEPN EW/C2017/06/02 ACCIDENT Aircraft Type and Registration: Kolb FireFly, G-CEPN No & Type of Engines: 1 Fuji Robin 330 piston engine Year of Manufacture: 2007 (Serial no: FF05.4.00048) Date & Time (UTC): 20 June 2017 at 0920 hrs Location: Near Newell Lane, Luffenhall, Hertfordshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 (Fatal) Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 71 years Commander’s Flying Experience: 5,215 hours (of which 342 were on type)

Last 90 days - 0 hours

Last 28 days - 0 hours Information Source: AAIB Field Investigation Synopsis Shortly after takeoff, approximately one mile from the runway, the aircraft was seen to enter a steep descending left turn from which it did not recover before striking the ground vertically. Analysis of CCTV footage confirmed that, immediately before the final manoeuvre, the aircraft’s speed was above the predicted stall speed. The investigation was unable to identify any defect which would have prevented the aircraft from responding normally to the pilot’s control inputs. History of the flight The pilot drove to Cottered Airfield with the aircraft on a trailer on the morning of the accident flight. There were no witnesses to his arrival at the airfield, to rigging the aircraft or taking off from the airfield. The aircraft took off from Runway 25 and after flying for less than a mile, was seen by local witnesses and on CCTV to enter a steep descending left turn and impact the ground vertically. The pilot was fatally injured. Accident site Police body camera footage confirmed that, when the Police arrived at the accident site, the aircraft was in a steep nose-down attitude. The emergency services had rotated the aircraft onto its landing gear prior to the arrival of the AAIB.

90 © Crown copyright 2018 All times are UTC AAIB Bulletin: 3/2018 G-CEPN EW/C2017/06/02 Recorded information The final 4 seconds of the accident flight had been captured by a CCTV system installed on a house approximately 400 m from the accident site. The imagery showed the aircraft entering the camera’s field of view for 1.5 seconds in straight and level flight. The aircraft was then observed to roll sharply to the left and enter a steep dive from which it did not recover before striking the ground. Based on known measurements it was possible to calculate that, immediately before the initiation of the left roll, the aircraft was flying at a height of approximately 120 ft agl with a groundspeed of between 38 and 46 mph. Aircraft details The Kolb FireFly is a high-wing ‘unregulated’ ultralight/microlight aircraft. The aircraft is an American design with an open cockpit and was intended for amateur construction. The forward fuselage is mainly constructed of steel tubing, which is mated to an aluminium tail boom. The structure of the wings, horizontal stabiliser and tail fin are of aluminium tubing, covered with fabric. The wings are quick-folding for ease of storage and transportation. The FireFly is fitted with a single engine mounted between the wings which powers a pusher propeller through a belt-driven reduction gear system. The aircraft design was intended to meet the limited requirements of the ‘FAR Part 103’ federal regulations in the USA for ‘Ultralight Aircraft’, which would mean the aircraft would not need to be registered and the pilot would not require a licence. Figure 1 Kolb FireFly

91 © Crown copyright 2018 All times are UTC AAIB Bulletin: 3/2018 G-CEPN EW/C2017/06/02 Around 2007, the CAA developed regulations, ‘Single Seat De-Regulated (SSDR)’, which were similar to those in the United States, allowing aircraft such as G-CEPN to operate without requiring a certificate of airworthiness or permit-to-fly. A pilot is still required to hold a licence for the class and the aircraft is registered. In 2013 this category was extended, to include all single-seat microlights within certain weight restrictions.

Since the aircraft are sold in kit form for construction by amateurs, there are no flight instruction manuals produced by the kit manufacturer. Each aircraft will perform differently due to the individual nature of the build. G-CEPN was the first FireFly imported into the UK and was test flown for a magazine article. This article listed the stall speed for the aircraft at the time of the test flight as 27 mph. This speed would be in agreement with the information published by the manufacturer which states: ‘It is very responsive and light on the controls, yet is not twitchy or sensitive. The FireFly also has gentle stall characteristics. Upon entering a stall from straight and level flight, there is some sink which precedes the stall. Continuing into the stall, there will be a gentle break at about 30 mph and the nose will drop. The aircraft gains speed and resumes flying with a reduction of stick back pressure.’ Maintenance history

The aircraft had been built in 2007 and had been fitted with a Hirth F33 engine. In November 2011, after 48 flying hours, the engine had been replaced with a Fuji Robin 330. The last entry in the aircraft’s log book was made in July 2013, at 199 flying hours, when the aircraft suffered an in-flight loss of the propeller and the reduction-gear system, reported in AAIB Bulletin 1/2014. In addition to the log book, the pilot recorded aircraft maintenance activity in a note book. The last dated entry in the note book was 11 March 2017, maintenance notes continued after this entry but were not annotated with dates. The notes suggested that the pilot monitored engine and airframe performance and carried out routine maintenance tasks. A review of the pilot’s log books suggests that the aircraft had accumulated approximately 370 flying hours at the time of this event. Aircraft examination Examination of the aircraft showed that both wings exhibited leading edge compression, the main mounting structure for the left wing had fractured during the impact and the left wing spar had fractured approximately 1 m from the wing root. The rear section of the engine mounting structure had failed and both propeller blades had shattered at approximately 30% of the blade span; the internal metal spar of one of the blades was exposed and had been bent in a direction opposite to the direction of propeller rotation. The fuel tank, which had been removed by the emergency services, was approximately 25% full of fuel. The damage to the wing mounting structure prevented confirmation of aileron control continuity on site but the continuity of the rudder and elevator controls was confirmed. It was also confirmed that all the pins and bolts used to secure the wings to the fuselage were in place and secure.

92 © Crown copyright 2018 All times are UTC AAIB Bulletin: 3/2018 G-CEPN EW/C2017/06/02 It was not possible to carry out any investigation of the aircraft’s instrumentation due to impact damage. Examination of the aileron control circuit confirmed that it had been correctly rigged but the universal joint within the control circuit had fractured and the centre block was missing, Figure 2. Centre block Pins Forks Figure 2 Example of a universal joint Evidence of mechanical damage and deformation of the joint forks and pin locating holes was observed on the remaining sections of the joint, showing that the centre block was in place at the time of the impact with the ground. Examination of the left wing spar failure and the fuselage wing and engine mounting structure confirmed that all the failures were as a result of structural overload. The engine was disassembled and no evidence of a defect or failure was identified. Inspection of the carburettors confirmed that fuel was present in the carburettor bowls and there was no evidence of a defect which would have prevented normal operation. Meteorology Luton Airport lies 13 nm south west of Cottered Airfield, and Stansted Airport lies 13 nm south east. Both were reporting light easterly winds, with no cloud, good visibility and a temperature of 24°C. Airfield information Cottered Airfield is a 500 m grass strip on a farm. The pilot was familiar with the airfield and the local area. He stored his aircraft at home, rigging and de-rigging each time at the airfield. Pilot information The pilot had been flying microlight aircraft for many years and had extensive experience on a number of different types. Up to the flight of 20 June 2017 he had not flown for some months, due to technical issues with the aircraft as well as personal reasons. As his class rating for microlights had been issued prior to 1 February 2008, he was not required to have any flights with an instructor to renew his rating by experience. There was no record of him having flown any dual flights since he received his licence in 1990.

93 © Crown copyright 2018 All times are UTC AAIB Bulletin: 3/2018 G-CEPN EW/C2017/06/02 A post-mortem examination was carried out on the pilot by a pathologist. It reported no evidence of underlying disease and concluded that the pilot had died from multiple injuries. Toxicology tests revealed no evidence of any substance that could have contributed to the event. Analysis With no witnesses to the arrival of the pilot at the airfield, his rigging or takeoff, it was not possible to establish the pilot’s intentions for this flight. He appears not to have flown for over six months, so he was out of recent flying practice, but it is not known whether this was a factor in the event. There was no evidence of a pre-impact failure of the aircraft’s structure and there was no evidence of a defect within the engine which would have prevented its normal operation. The damage to the propeller blades was consistent with them hitting the ground whilst rotating under power. The damage observed to the universal joint within the aileron control circuit was consistent with the joint being correctly connected at impact. No defects were observed within the aircraft’s controls which would have prevented the aircraft responding to the pilot’s control inputs and there was no evidence of an in-flight structural failure. Conclusion The investigation did not find any evidence of a defect with the aircraft which would have prevented the aircraft responding to control inputs. The pathology did not indicate that the pilot had suffered an incapacitation and although he had not flown recently it is not known if this lack of recent experience was a factor in this event. Analysis of the CCTV imagery showed that, immediately before the final manoeuvre, the aircraft was flying at an airspeed greater than its predicted stalling speed. It is highly unlikely, therefore, that a stall or spin entry was a factor in this event. It is therefore not known why the aircraft departed from what appeared, from the CCTV imagery, to be level and controlled flight.

FD06636 ｜ 2018_英国_aaib-investigation-to-morane-saulnier-rallye-150st-g-bdwh__Morane_Saulnier_Rallye_150ST_G.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

96 © Crown copyright 2018 All times are UTC AAIB Bulletin: 11/2018 G-BDWH EW/G2018/08/20 ACCIDENT Aircraft Type and Registration: Morane Saulnier Rallye 150ST, G-BDWH No & Type of Engines: 1 Lycoming O-320-E2A piston engine Year of Manufacture: 1976 (Serial no: 2697) Date & Time (UTC): 21 August 2018 at 1247 hrs

Location: Blackpool Corner, Dorset Type of Flight: Private

Persons on Board: Crew - 2 Passengers - None Injuries: Crew - 2 Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 77 years Commander’s Flying Experience: 700 hours

Last 90 days - 6 hours

Last 28 days - 1 hour Information Source: Aircraft Accident Report Form submitted by the pilot and further enquiries by the AAIB Synopsis An uncontained fire, from a fuel leak, started in the aircraft’s engine compartment shortly after the aircraft had departed Pymore Farm airstrip on a flight to Dunkeswell Airfield. The aircraft was flying over an area of small fields in undulating terrain, and the pilot’s approach to his selected field resulted in an overshoot. The aircraft collided with a hedge in the resulting forced landing, and despite being injured, both occupants were able to vacate the aircraft. The aircraft was destroyed in the accident. The source of the fuel leak within the engine compartment was not established due to fire and impact damage of the fuel system components. History of the flight The pilot had intended to fly the aircraft from Pymore Farm airstrip, Dorset, to Dunkeswell Airfield in Devon with a passenger, who also held a PPL(A). The aircraft had not undergone any recent maintenance activity and the previous six-month check had been completed in April 2018. The pilot had last flown the aircraft on 22 July 2018, during which it had performed normally. After checking the fuel quantity in the wing fuel tanks, which totalled approximately 56 litres of AVGAS 100LL fuel, he conducted a daily inspection of the aircraft without noting any abnormalities. The engine start, pre-departure and run-up checks were completed normally and the aircraft took off and climbed to an altitude of approximately 1,200 ft. Weather conditions were good, with no low cloud and a visibility in excess of 10 km.

97 © Crown copyright 2018 All times are UTC AAIB Bulletin: 11/2018 G-BDWH EW/G2018/08/20 Approximately five minutes after takeoff the pilot noticed smoke entering the cabin from beneath the instrument panel. He unlatched the canopy and slid it open slightly to vent the smoke. The pilot recalled that the engine instruments displayed readings consistent with normal operation of the engine. Suspecting an electrical fire, he switched the electrical master switch off, and about this time the engine stopped but the propeller continued to windmill. The pilot switched the fuel selector valve from the right tank to the left tank, but the engine did not restart; he could not recall whether he then switched the fuel valve off. The aircraft was flying above an undulating area of small fields and woodland and the pilot selected a field to land in but was too high and had to overshoot towards a solar farm that lay beyond his selected field. The aircraft was too low to clear the solar farm into another field beyond and the aircraft landed within the solar farm complex, avoiding contact with the solar panels and a sub-station building but colliding with the boundary hedge (Figure 1). A witness who saw the accident confirmed that it was on fire during the final stages of the flight. The pilot and his passenger were injured in the accident but managed to extract themselves from the aircraft, with the passenger providing assistance to the pilot. The aircraft continued to burn until the fire was extinguished by the emergency services. Figure 1 Accident location (courtesy Google Earth) Accident site and wreckage examination The aircraft touched down shortly before the boundary hedge with a very short ground roll that was consistent with the aircraft flying at, or close to, the stall prior to touchdown (Figure 2). The AAIB conducted an examination of the wreckage prior to its recovery in order to try to establish the cause of the fire.

98 © Crown copyright 2018 All times are UTC AAIB Bulletin: 11/2018 G-BDWH EW/G2018/08/20 Figure 2 Accident site The majority of the fuselage and the engine compartment had been severely damaged by the fire. The crankcase had partially melted, exposing the sump and no oil remained in the engine. The remains of the engine compartment fuel hoses and their connections to the electric boost pump, engine-driven fuel pump and carburettor were identified in the wreckage, however fire-damage prevented assessment of their condition and security prior to the fire. It was observed that the fuel hose between the engine-driven fuel pump and the carburettor had detached from the carburettor, although this may have occurred during the ground impact. The right wing’s fuel tank had ruptured in the ground impact and no fuel remained within the tank. The left wing’s fuel tank had remained intact and 28 litres of AVGAS 100LL were recovered from it. Analysis The normal operation of the engine prior to the start of the fire, including the oil temperature and pressure indications, indicates that the fuel source for the fire was likely to be leaking fuel rather than oil from the engine. The engine continued to run for a short period after the first signs of smoke from the fire, which is consistent with fuel being drawn from the carburettor float bowl despite a leak elsewhere in the engine’s fuel system. The engine’s hot exhaust system would have provided sufficient heating of any leaking fuel to allow its auto-ignition in the absence of any other ignition sources. Damage to the engine’s fuel system sustained during the fire and accident impact prevented identification of the source of the leaking fuel.

99 © Crown copyright 2018 All times are UTC AAIB Bulletin: 11/2018 G-BDWH EW/G2018/08/20 The pilot was faced with a hazardous situation whilst flying over an area of small fields in undulating terrain. Once it became clear that he was overshooting his chosen field, his remaining landing options were limited. The aircraft’s low airspeed at impact minimised the resulting deceleration during the collision with the solar park boundary hedge, probably limiting the extent of the injuries sustained by the pilot and his passenger. Conclusion Leaking fuel within the aircraft’s engine compartment led to an uncontained fire shortly after the aircraft had departed Pymore Farm airstrip. The aircraft was damaged in the resulting forced landing, and the pilot and passenger both sustained injuries but were able to vacate the aircraft after the accident. The cause of the fuel leak was not established.

FD06637 ｜ 2018_英国_aaib-investigation-to-piper-pa-28rt-201-cherokee-arrow-iv-g-bhay__Piper_PA-28RT-201_Cherok.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

3 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 ACCIDENT Aircraft Type and Registration: Piper PA-28RT-201 Cherokee Arrow IV, G-BHAY No & Type of Engines: 1 Lycoming IO-360-C1C6 piston engine Year of Manufacture: 1979 (Serial no: 28R-7918213) Date & Time (UTC): 11 September 2017 at 0956 hrs Location: Wolferton, Norfolk Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - 1 (Fatal) Passengers - 1 (Fatal) Nature of Damage: Engine front fuselage, wings and landing gear severely disrupted Commander’s Licence: Private Pilot’s Licence Commander’s Age: 58 years Commander’s Flying Experience: 1,129 hours (of which 406 were on type)

Last 90 days - 15 hours

Last 28 days - 10 hours Information Source: AAIB Field Investigation Synopsis The aircraft was en route from London Southend Airport to Newcastle International Airport. Over the Wash, the pilot reported that the aircraft’s engine was rough running and he turned towards the coast, during which time the engine failed. During the forced landing it is likely that the aircraft stalled and then struck a berm (the old sea wall) with a high rate of descent. The pilot and his passenger were fatally injured. Whilst it could not be positively determined why the aircraft stalled, the investigation revealed that the aircraft’s engine had not been maintained according to the manufacturer’s instructions whilst it was not used for long periods and parked outside. History of the flight Background information The aircraft had been based at Newcastle International Airport and the pilot flew it via France to Menorca, Spain, in July 2017. In September 2017, the pilot and passenger flew the aircraft back from Menorca, through France, bound for Newcastle. On 10 September they landed at London Southend Airport after the pilot decided to divert, due to inclement weather, en route to Newcastle and elected to stay overnight.

4 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 Accident flight On 11 September 2017 the pilot planned to continue from Southend to Newcastle. Prior to departure the occupants were seen to take about an hour preparing the aircraft. The aircraft took off at 0908 hrs. At 0953 hrs, when the aircraft was over the Wash after crossing the Norfolk coast, the pilot transmitted a mayday to the Distress and Diversion Cell (D&D) on 121.5 MHz, stating he had a “very rough running engine,” that the aircraft was at 3,300 ft amsl, descending, and he would turn south towards RAF Marham. A short time later he transmitted “that’s smoke now i think we’ve got an electrical fire…”. About one minute later he transmitted “engine has failed”. At this point the aircraft was at about 1,400 ft amsl and D&D informed the pilot the aircraft was 13.5 nm from RAF Marham, to which the pilot replied he would not make it. The controller suggested Great Massingham 9 nm away but the pilot replied he would not make that either and, as the aircraft was passing 1,200 ft amsl, he added “it’s gonna be a field”. This was the last transmission received from the aircraft and was 30 seconds before the last radar contact. Figure 1 shows some of the radio transmissions relative to the radar track. Figure 1 View looking to the west of last seven minutes of the radar track (altitudes are Mode C ±50 ft, corrected to the QNH 988 hPa) The aircraft was witnessed at low level just prior to the accident. One witness, about 0.3 nm north-north-west of the accident site, stated that he saw the aircraft flying at about 300 ft agl in a southerly direction over farmland. At the time, he was not aware of any engine noise. When the aircraft was close to the berm (the old sea wall), at about 40 ft agl, he saw it “drop vertically” and disappear from his view.

5 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 Another witness, who was working in a field about 0.25 nm south-west of the accident site, stated that he first saw the accident aircraft at a low altitude, flying in about a southerly direction towards the old sea wall. The aircraft had its landing gear down and the propeller was not turning as one blade was stationary, pointing vertically up. When it was about twice the height of the trees on the old sea wall, the aircraft “turned right and stalled”. The nose dropped quickly and the aircraft struck the berm. All the witnesses commented that the weather was fine, with the wind strong, from the west. The accident site was about 2.5  m south-west of Snettisham, Norfolk. Two of the witnesses were at the scene quickly and administered first aid to the occupants. Police and paramedics arrived soon after, as did an air ambulance helicopter and a Coastguard helicopter. However, the occupants were declared deceased at the scene. Meteorology An aftercast produced by the Met Office stated that there was a deep area of low pressure centred over the northern North Sea with strong winds on its southern and southwestern flanks. The forecast low-level winds valid for 1200 hrs across East Anglia and the Wash were expected to be from 260° at 30 kt at 1,000 ft amsl and from 260° at 35 kt at 2,000 ft amsl. Observations from RAF Marham at 0950 hrs and Norwich Airport at 1020 hrs recorded wind from 230° at 14 to 23 kt with some gusts higher.  Marham recorded FEW clouds at 1,900 ft aal, SCATTERED clouds at 2,700 ft aal and BROKEN clouds at 3,500 ft aal.  At both airfields the visibility was greater than 10 km and the QNH was 988 hPa. The aircraft was on approximately a southerly track as it flew back towards the coast. A surface wind from 230° at 15 kt, would give an airspeed about 12 kt greater than the ground speed calculated from the radar returns. Medical information Post-mortem examinations were carried out on the pilot and passenger by a consultant histopathologist who concluded that both died as a result of multiple injuries sustained in the accident. Toxicology test for drugs and alcohol for the pilot were negative and a level of 1.9% of carboxyhaemoglobin was recorded. A review of the reports at the RAF Centre of Aviation Medicine concurred that the injuries sustained by the pilot and passenger were consistent with decelerations sustained by the aircraft impacting the ground and, given the level of carboxyhaemoglobin recorded, it was unlikely that they had been exposed to excess carbon monoxide prior to their deaths.

6 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 Aircraft’s information manual The ‘Piper Arrow IV Information Manual’ states in the ‘ENGINE POWER LOSS IN FLIGHT’ checklist ‘trim for 79 KIAS’. It also states in the section titled ‘STALLS’: ‘An approaching stall is indicated by a stall warning horn which is activated between five and ten knots above the stall speed [58 to 63 KIAS]… The gross weight stalling speed of the Arrow IV with power off and full flaps is 53 KIAS. With flaps up this speed is increased 6 KTS...’ Recorded information Radar returns from the aircraft were recorded for the flight starting shortly after takeoff from Southend and stopping when the aircraft was about 0.25 nm from the accident site. The returns included height information (rounded to the nearest 100 ft) and indicated that the cruise altitude for the flight was about 4,300 ft amsl. A composite radar track of the last 17 minutes of flight from the Cromer and Debden radar heads is shown in Figure 2 and an expanded plot of the final phase is shown in Figure 1. Figure 2 Portion of radar track of G-BHAY – final 17 minutes

7 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 The aircraft crossed the coastline at 0951:30 hrs and started to descend 30 seconds later. After a further 1 minute 17 seconds (about 3 nm from the coastline crossing) the pilot made the MAYDAY radio transmission (RTF) to D&D (Figure 1). The pilot then commenced a 180° turn to the left1 during which he passed his MAYDAY message and reported the aircraft’s altitude as 3,300 ft. He completed the message about halfway through the turn, as the sound from the engine (recorded on the RTF) became distinctively rough sounding. The aircraft had descended about 600  ft since the initial MAYDAY call. At 0954  hrs, with the aircraft now on a reciprocal heading, the pilot changed the radar transponder Mode A squawk to 77002. He then turned the aircraft further to the left towards the nearest point on the coastline, which he crossed 90 seconds later, at about 1,800 ft amsl. At this point he reported the “engine has failed”, before turning onto a southerly track parallel to the coastline. This was just over five minutes since the aircraft started descending over the Wash and about 2.5 minutes after the initial MAYDAY call. The aircraft continued to descend with the pilot making a RTF transmission at 0956:45 hrs stating that he was “passing one thousand two hundred feet now” and that “it’s gonna be a field”. The last radar return was at 0957:23 hrs with the aircraft at about 500 ft amsl, 0.25 nm to the north of the eventual accident site. The average descent rate during the descent from 4,300 ft was about 700 ft/min and groundspeed averaged over the last minute was 60 kt. Aircraft description The Piper PA-28RT Cherokee Arrow IV is a four-seat, all-metal, low-wing, single-engine aeroplane fitted with a ‘T’ tailplane and retractable tricycle landing gear. The aircraft has conventional flying controls, mechanical trim in the elevator and rudder systems and three-position trailing edge flaps, operated mechanically by a floor-mounted lever in the cockpit. The stall warning system consists of a small pivoted tab, on the leading edge of the left wing, which moves upwards with the onset of stall and sets off an electrical warning buzzer in the cockpit. The landing gear is retracted by an electrohydraulic system, with hydraulic pressure supplied by an electric pump in the rear fuselage. The landing gear is operated by a two‑position toggle lever in the cockpit, next to the engine and propeller controls, and below are three landing gear status indicators. There was a landing gear automatic extension system originally included on the PA-28RT models but in G-BHAY this feature had been removed. Footnote 1 At this point, the coastline closest to the aircraft was behind and to its right at less than 2 nm. 2 7700 is the code to indicate to ATC that the aircraft is in distress. It shows ATC and other radar listening stations that an aircraft is in difficulties and enables position and altitude information to be seen.

8 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 The aircraft is fitted with a Lycoming IO-360-C1C6 four-cylinder piston engine, normally aspirated with mechanical fuel injection and driving a two-blade constant speed propeller. The cylinders are numbered one to four3 and the lubricating oil pump is driven directly from the end of the crankshaft. There are two overhead valves per cylinder, opened by rockers and push rods and closed by dual concentric springs. There is a single camshaft driven by the crankshaft through the first stage of the accessory gear train and hydraulic tappets and followers lift the push rods. The crankshaft is a single piece forging, carried on three main white metal bearings and oilways through the crankshaft enable the delivery of oil to the big‑end bearings. There is a centrifugal bobweight damper between the No 3 and No 4 big‑end bearings. Engine lubrication is by a wet-sump system with a capacity of up to eight quarts of engine oil, six quarts being considered the normal level shown on a calibrated dip stick. Oil pressure is generated by the single-stage gear pump and oil is drawn from the bottom of the sump and delivered by the pump through a cartridge filter into the galleries and drillings within the crankcase to distribute it around the engine. Oil to lubricate the main and big-end bearings is delivered through the main bearing webs in the crankcase and the pistons and cylinders are spray-lubricated from jets beneath each cylinder. Oil from the camshaft lifters passes along the pushrod tubes into the rocker boxes to lubricate the rockers valves and springs and used oil from the rocker boxes drains through external tubes into the sump. Used oil from the crankshaft, pistons and cylinders drains directly back into the sump. The engine has aluminium alloy pistons, each fitted with two piston rings and an oil control ring. The oil control ring consists of a dual-rail bevelled edge ring, backed by a continuous coil spring. There are four oil drain holes, spaced around the oil control ring grove through the piston skirt. The engine drives a two-blade variable pitch constant speed propeller. The pitch control of the blades is by a piston and spring assembly which uses engine oil metered through a mechanical governor driven by the accessory gearbox on the rear of the engine. Propeller rpm is set by a lever next to the throttle in the cockpit. The ignition system consists of two engine-driven magnetos and two spark plugs per cylinder. Ignition and the magnetos are controlled by a four-position key switch in the cockpit. Maintenance history The aircraft had a comprehensive set of maintenance records and journey log and had a valid Airworthiness Review Certificate scheduled to expire on 18 March 2018 following its annual inspection on 14 March 2017. The last entry in the journey log was on 13 August 2017 and showed 31 hours remaining to its 50-hour check. The aircraft had been owned by a syndicate since 1987 and was usually kept in a hangar at Newcastle International Airport, maintained on behalf of the syndicate by an aircraft Footnote 3 The No 1 and No 2 cylinders are on the front right and left side of the engine and the No 3 and No 4 cylinders are on the rear right and left side of the engine.

9 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 maintenance company based at Carlisle. The aircraft log book shows that it had been flown by only two different people, with most of the flying by the accident pilot. Only one flight (in October 2015) was recorded in the journey log between January 2015 and October 2016. The aircraft had been parked outside at Newcastle, some 9 nm from the sea, from November 2015 to July 2016, including a prolonged period of inclement weather during December 2015. It is not known whether measures were taken to prevent deterioration to the aircraft or its engine during the long period of parking. The annual maintenance requirements during the period of inactivity of October 2015 to October 2016 had not been carried out. On 10 October 2016, the aircraft was authorised for a single ferry flight from Newcastle to Carlisle for the now-overdue annual maintenance inspection, this flight was recorded in the journey log as 20 minutes. The aircraft was then stored in a hangar at Carlisle and eventually underwent its most recent annual maintenance inspection, during March 2017. Annual inspection The March 2017 annual inspection was carried out in accordance with CAP 766 Light Aircraft Maintenance Programme. This included an engine oil and filter change and the engine was recorded as running on Aero Castrol 80+. An engine compression check was carried out and all the four cylinders were found to be satisfactory (‘73 or 74 over 80’), within the limits laid down by the engine manufacturer. There were no defects recorded in the documentation during the annual inspection. When the aircraft was released to service it was recorded as having accumulated 4,881:30 airframe hours, 1,065:45 engine hours and the propeller overhaul had zeroed its flying hours. The engine was last overhauled on 26 May 20044 and had thus consumed just over 50% of its 2,000-hour overhaul life at the time of the accident. Aircraft usage since the annual inspection After the March 2017 annual inspection, all the flying recorded in the log was by the accident pilot and included flights over several days through France, arriving in Menorca on 12 July 2017. The journey from Newcastle to Menorca was via Le Touquet, Fleres, La Roche-sur-Yon and Carcassonne and totalled a flying time of 10 hours and 45 minutes. Whilst flying to Carcassonne, the pilot encountered a landing gear problem whereby it did not satisfactorily indicate locked down. After visual confirmation with ATC he landed safely and then flew on to Menorca with the gear down. In Menorca, he had three replacement landing gear microswitch assemblies shipped and a local aircraft mechanic replaced the microswitches on the left and right main landing gears. Three 45-minute flights were recorded whilst the aircraft was in Menorca, between 17 July and 13 August 2017. Footnote 4 The time between overhauls may be carried out on a calendar 12 year or 2,000 flying hours basis. The operator/owner can decide to apply either. The majority of engines are overhauled on a flying hours basis but require regular inspections and checks to ensure serviceability as they often take more than 12 years to accrue 2,000 flying hours.

10 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 Engine anti-deterioration measures The engine contains ferrous and non-ferrous alloys; the external surfaces have anti‑corrosion treatments such as paint or metallic plating, the internal surfaces in general rely on the properties of the lubricating oil for protection. However, many of the internal surfaces are subjected to heat and corrosive products during the combustion process which are kept at bay by additives within the oil. When the engine stops running the internal surfaces and components are left with a coating of oil but if the engine is not run for a period this coating becomes less effective, especially if an engine is subjected to a moisture-laden environment. Ferrous components such as the cylinder liners, crankshaft and connecting rods can develop surface corrosion in the form of rust. In areas where there may be more reactive deposits from the combustion process, such as the cylinder liners, surface corrosion may develop into pitting corrosion. There are methods to prevent deterioration by a process known as ‘inhibiting’ and the engine manufacturer, Lycoming, issued specific guidance on this in Service Letter Number L180B, dated 13 November 2001. Accident site The accident site was on private agricultural land towards the top of a berm (the old sea wall) which formed part of the secondary inland sea defences on the north Norfolk coast. There was a line of coniferous trees to the west of the accident site, visible in Figure 3; these were about 25 ft high.

Figure 3 Accident site

11 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 The pilot was found in the left front seat and his passenger in the right front seat and the aircraft was upright on a northerly heading, complete except for the upper engine cowling which had detached during the impact and landed nearby. The windscreen had fragmented and the fuselage distorted in the severe vertical deceleration, so that the door frames and roof section were cut and folded back by the emergency services to release the pilot and passenger. The landing gear had been in the down position but the nose gear had been forced back up into its bay by the impact. The right main landing gear had been forced rearwards and detached from the wing whilst the left had remained attached but was also distorted rearwards. One of the propeller blades was intact and the other blade had bent backwards under the nose of the aircraft. The propeller showed no signs of rotating when the aircraft hit the ground. There were no ground marks behind the aircraft and the only ground marks apparent were within the ‘footprint’ of the aircraft which were only visible after the aircraft was lifted during recovery. Both wing tanks contained fuel and approximately 40 imp gal (48 US gal) were drained from the fuel tanks at the accident site. The top of the engine was exposed and the crankcase had a large hole near the base of the No 4 cylinder, exposing the remains of the No 4 piston connecting rod. Figure 4 shows the damage to the crankcase. Figure 4 Crankcase damage The battery was damaged and was disconnected and made safe at the accident site. The ignition master key had bent and was found on the cockpit floor; the key switch was damaged but appeared to be in the both position.

12 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 The pilot and passenger were wearing three-point safety harnesses which had been cut by the emergency services during the rescue operation. The safety harness webbing, attachment points and buckles were intact and in good condition. The luggage bay included items used in the care and maintenance of the aircraft, with a plastic storage box carrying nine 1-litre plastic engine oil containers. Four were labelled Total Aero DM 15W50 and five were labelled AeroShell W15W-50, all labelled in French. The four Total containers were empty. Three microswitch assemblies were found in one of the flight bags with associated paperwork, two in a used condition and one still in its manufacturer’s packaging. After the initial examination the wings were removed to enable recovery to the AAIB headquarters for more detailed examination. Aircraft examination Structure Detailed examination showed that the rudder, tailplane and elevator were attached correctly and relatively undamaged but that the area beneath the engine and cockpit around the fire wall was crushed and severely buckled upwards and rearwards by the vertical deceleration when the aircraft struck the berm. The entire underside of the fuselage was covered in engine oil and oil was still seeping from fuselage skin joints and seams. Figure 5 shows the condition of the forward underside of the fuselage and Figure 6 shows oil seeping from the fuselage skin joints.

Figure 5 Forward underside of the fuselage

13 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 Figure 6 Oil seeping from the fuselage skin joints Flying controls There was continuity of the pitch and yaw flying controls up to the instrument panel although the elevator controls had detached from the yoke shaft linkages due to the disruption of the firewall and cockpit floor. The elevator trim wheel position indicator showed a down (dn) trim setting. There was no evidence of any disconnection or restriction of the controls in flight and marks between the flaps and wings made during the impact, and the linkage and lever positions, showed that two stages of flap had been set. Cockpit and instruments The nature of the impact meant that little extra useful information could be extracted from the cockpit instruments, except for the barometric altimeter setting of 987 hPa. None of the circuit breakers had tripped. The aircraft systems master switches were consistent with an interrupted engine-out forced landing: battery master switches on, fuel pump off, landing and anti-collision lights on and the pitot heat off. The transponder ‘squawk’ was set at 7700. The stall circuit breaker was correctly set and there was electrical continuity to the warning buzzer. The stall tab fitted to the left wing leading edge was undamaged and correctly opened and closed the circuit when tested. The buzzer was removed and bench tested and was found to operate correctly. There was no evidence of fire within the aircraft or in any of its components and systems.

14 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 Survivability The lack of ground marks behind the aircraft at the accident site and relatively flat impact with the ground suggest the aircraft was rapidly brought to a stop by the berm. Although the pilot and passenger were wearing their harnesses they received fatal injuries due to the rapid vertical deceleration as the aircraft hit the ground and the structural deformation of the cockpit area and the proximity of solid objects, such as the control yoke and instrument panel. Propeller and engine examination The propeller examined showed that, apart from the bent blade, the propeller was in an ‘as new’ condition which reflected its low usage since its recent overhaul and there was no indication of pre-impact damage. The engine was examined externally prior to strip down. The equipment fitted to the rear of the engine and accessory gearbox, and the fuel system components, were in good condition except some impact damage when the aircraft struck the ground. The spark plugs were removed and examined. The No 1 and No 2 cylinder pairs of spark plugs were heavily carbon-contaminated, with thick granular carbon. The No 2 cylinder pair of spark plugs had no visible gap between the electrodes. In contrast, the No 3 and No 4 cylinder pairs of spark plugs were clean, with insulators and electrodes light grey-brown in appearance, indicative of a normal ignition process. The oil dip stick was not in contact with any oil and was dry. The underside of the sump was covered in a film of engine oil, although there were no obvious signs of leakage or weeping joints around the engine. However, as observed at the accident site, the crankcase had a large hole in its upper surface through which could be seen the remains of the No 4 connecting rod big-end. There was also sign of a partial rupture near the camshaft forward end where a piece of debris had become trapped between one of the cam lobes and the crankcase. The internal crankcase web above the sump had also been holed by debris impact. The crankshaft was in one piece and but showed signs of rubbing and discolouration due to excessive heat on the rear main journal, the No 4 crankpin and the No 2 crankpin. There were also debris impact marks on the surfaces of the No 3 and No 4 crankpin surfaces. Figure 7 shows the overheated condition of the No 4 crankpin. The camshaft, pushrods and valve gear were undamaged. However, the hydraulic lifters and followers near the crankcase hole had been ejected and were found loose in the engine bay. In addition, several of the other cam followers were damaged because of debris impact. When the engine was disassembled approximately one quart of lubricating oil was found within the engine lubrication system, heavily contaminated with ferrous and non-ferrous metallic debris. The oil pump was undamaged, free to rotate and could produce an oil flow. The filter was intact and the element not blocked, although it contained fine debris. The oil pick-up strainer gauze tube within the sump was completely blocked with metallic debris along its length.

15 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 Figure 7 No 4 crankpin condition Cylinder, piston and connecting rod examination The No 1 and No 2 cylinder liners had linear scoring within the piston-swept area. There was heavier localised scoring where debris had been picked up on the piston skirt and small areas of pitting corrosion were present in both cylinders, were smoothed by the action of the piston and oil control rings. The pitting corrosion was more prevalent in the No 2 cylinder and heavier pitting corrosion was present at the top of both cylinders, outside the piston‑swept area. Figure 8 shows the corrosion in the No 2 cylinder. The piston skirts were heavily scored on their lower surfaces5 due to debris entrapment. All the piston rings were in place but were jammed in their grooves by distortion from the scoring and the No 2 oil control ring was clogged with oily sludge and was slightly distorted. Significant evidence of ‘blow-by’ was present on both the No1 and No 2 piston skirts, with associated carbon build-up around the piston crowns. The connecting rods were still attached to the crankshaft but were dry of oil and showed evidence of excessive heat, with the big-end bearings starting to disintegrate. Footnote 5 In a horizontally opposed engine such as in the case the pistons are considered to present an upper and lower surface to the cylinders.

16 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 Figure 8 An example of the pitting corrosion in the No 2 cylinder By contrast the No 3 and No 4 pistons were in better condition and had stopped in their respective cylinders when their big ends detached from the crankshaft. There was no evidence of blow-by and no scoring of the piston skirts. However, the underside of the pistons was covered in multiple debris strike marks and the No 3 connecting rod was bent and twisted and its half-cap, end bolts and bearing shells pulverised. The No 4 connecting rod and associated parts had similar damage and fragments of the No 3 and No 4 bearings had evidence of excessive heating and swaging whilst under load. Figure 9 shows the condition of the pistons and damage to the connecting rods. Figure 9 Pistons and connecting rods

17 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 Analysis Operational aspects The aircraft approached the coastline west of Snettisham, Norfolk, about 2 nm north of the accident site, at about 1,800 ft amsl. The last radar return was at about 500 ft amsl and 0.25 nm to the north of the accident site. The aircraft’s ground speed during the last few radar returns was about 60 kt. The wind recorded at Marham and Norwich was from 230° at 14 to 23 kt with some higher gusts. As the aircraft flew on a southerly track, the airspeed would have been about 12 kt greater than the ground speed; around 72 kt. Whilst this was less than the published recommended glide speed of 79 kt, it was 13 kt above the ‘clean stall’ speed of 59 kt and 19 kt above the ‘full flaps’ stall speed. The witness evidence, that the aircraft was subsequently seen to stall before impacting the ground, was consistent with the ground impact, with high vertical deceleration and low forward speed. It could not be determined when or why the aircraft’s airspeed reduced further, towards the stall speed, but as the wind recorded was also gusting by up to an additional 10 kt, the aircraft could have stalled partly due to a decrease in its airspeed due to the windshear caused by the gusty wind conditions. As the master switches were on, the aircraft’s stall warning buzzer should have sounded. Given the stressful situation the pilot was in it is possible that he did not hear it or did not hear it in time to respond correctly. Additionally, given the low height at which the aircraft was seen to stall, the pilot may have been reluctant to attempt a recovery, by pitching the aircraft down, as he may have been conscious of the vicinity of trees to the west along the berm and wanted to attempt to clear them before lowering the nose. Witnesses stated that they saw the aircraft with the landing gear lowered before the accident. Examination of the aircraft after the accident found that ‘Flaps 2’ was selected, and appeared to be trimmed for this configuration, the battery master switches were on and the fuel pump was off. Given these facts, it is reasonable to believe that the pilot had secured the aircraft for a forced landing and chosen a field in which to complete it before the accident. However, it could not be determined which field he intended to land in. Had he turned the shorter distance back towards land, right rather than left, this would have given him more height and time over land with which to make his field choice. He may have turned left as he was sitting in the left seat; this was the more instinctive direction from the left seat and the land was easier to see from this seat. Carboxyhaemoglobin levels and lack of evidence in the aircraft indicate that, despite the pilot’s report to ATC, there was no fire. The pilot may have thought this due to fumes entering the cabin through the aircraft’s ventilation system when the engine was failing. Engineering It is clear from the evidence that the engine suffered a catastrophic failure which led to its eventual stoppage.

18 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 The No 1 and No 2 pistons show significant exhaust ‘blow-by’ and contamination of the oil control rings and this led to the severe fouling of the No 2 cylinder spark plugs. This was probably the point where the pilot detected the engine rough running and prompted his mayday call. It is known that blow-by can cause pressurisation of the crankcase which in turn causes oil to be ejected from the breather. The breather exit tube is situated behind the nose landing gear bay on the underside of the aircraft and excessive oil loss through the breather tends to cover the area behind the breather and be carried by the airflow rearwards, consistent with the oil-soaked fuselage underside in this case. As the oil was lost, the temperature of the remaining oil started to rise and this, along with the reduced quantity, meant that lubrication of the main and big-end bearings degraded. It is possible the oil pressure drop had an additional effect on the propeller, causing its pitch to ‘hunt’ against the main spring in the blade pitch mechanism; this would have manifested itself as an engine pulsation exacerbating the roughness of the engine running experienced by the pilot. From the rough running report to engine stop was about 2.5 minutes, heard in the background of the ATC recordings. At some point the big-end bearings started liberating wear debris and the evidence indicates that this was happening whilst the oil pump was attempting to draw oil from the sump, explaining the almost total clogging of the oil pick-up strainer with bearing material. This would cause a worsening effect on the bearings as the oil pump struggled to maintain pressure and flow. In general, big-end bearings are the first to suffer as a lubricating system starts to fail. In this case, the No 4 big-end loosened as its bearing overheated, disintegrated and induced stresses in the half-cap bolts, which failed, allowing the connecting rod to detach from the crankshaft. This allowed the connecting rod free to flail as the engine continued to run for its last few seconds, with the No 4 big-end half-cap, bolts and bearing remains becoming caught up in the bobweight damper sweeping them around between it and the No 3 big-end and connecting rod, causing it to disintegrate. The No 4 connecting rod eventually forced its way out of the crankcase and the engine stopped. It is noted that in similar engine failure cases in the past, AAIB experience suggests that the No 4 piston, cylinder and associated components are usually the first to degrade and suffer damage. Initiating conditions Between November 2015 and July 2016 the aircraft was parked outside at Newcastle International Airport, nine miles from the sea and in inclement weather conditions. There is no evidence that the engine had been inhibited during the aircraft’s period of inactivity and it is likely that corrosion took hold during this period. This was evident in the No 1 and No 2 cylinder walls, with localised pitting corrosion at the top of the cylinder and within the piston-swept area. The engine manufacturer’s Service Letter (Number L180B, dated 13 November 2001) is clear on the actions to be taken to prevent engine deterioration and notes that active corrosion can occur in a short period of time.

19 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 The subsequent annual check, in March 2017, included a compression check, within acceptable limits. Although this is considered a good indication of cylinder, piston ring and valve interaction, it does not necessarily show how well the oil control ring is performing or whether the piston and oil control rings, or the cylinder walls, are starting to deteriorate. There is no requirement to visually check the internal surfaces of the cylinders and pistons at an annual check, so the corrosion would remain undetected and the compression test result would not give cause for concern. The journey log shows that from October 2015 to March 2017, only 20 minutes were recorded as having been flown. From March 2017, the journey log showed 18 hours and 40 minutes up to 13 August 2017. If the pilot flew a similar route back through France as he had flown outbound, it is possible that an additional 10 hours was accrued, taking the total hours since the annual inspection to approximately 29 hours. Taking this usage pattern into account, it is likely that most of the deterioration around the No 1 and No 2 pistons and cylinders occurred since the annual inspection in March 2017. Oil consumption Discussions with the maintenance organisation suggest that it was usual for this pilot to be well prepared and to carry extra tools, spares, fluids and personal equipment in the aircraft. Four empty oil containers were found in the aircraft but there was no record as to when the oil was replenished and, based on 4 litres over 29 hours, an oil consumption rate of about 0.13 litres per hour is reasonable over that period. However, engine oil consumption tends to increase as an engine deteriorates and it is likely that this was the case in this engine. Staff at the maintenance organisation also suggested that the pilot was particular in his preparations for flight and that it is unlikely that the pilot would have taken off from Southend without the oil dip stick showing at least the recommended level of six quarts in the sump. It is not known whether the pilot had to replenish the oil at Southend to achieve that level but it means that five quarts were lost during the 40 minute flight from Southend to the point where the engine stopped. This suggests a rapidly increasing degradation of the engine during this flight and this degradation may have started before he landed at Southend, without having yet become apparent to the pilot. Reported smoke in the cockpit Despite the report of smoke in the cockpit made during the radio transmission, no evidence of fire could be found in the aircraft. It is therefore likely the smoke was due to overheated oil fumes or smoke exiting the engine through the crankcase breach, filling the engine bay and then surrounding the nose of the aircraft before being drawn into the cabin ventilation and heating system. Conclusion The accident was likely the result of the aircraft stalling at a low height from which there was insufficient height to recover, during an attempted forced landing following a catastrophic engine failure.

20 © Crown copyright 2018 All times are UTC AAIB Bulletin: 8/2018 G-BHAY EW/C2017/09/03 The engine failure was due to oil loss caused by damage and premature wear to the oil control rings. The engine had been inactive for several months, and probably had not been inhibited in accordance with the manufacturers guidance, leading to the formation of corrosion within the engine.

FD06638 ｜ 2018_英国_aaib-investigation-to-piper-pa-28rt-201-n2136e__Piper_PA-28RT-201_N2136E_01-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

21 © Crown copyright 2018 AAIB Bulletin: 1/2018 N2136E EW/G2017/07/20 ACCIDENT Aircraft Type and Registration: Piper PA-28RT-201, N2136E No & Type of Engines: 1 Lycoming IO-360-C1C6 piston engine Year of Manufacture: 1978 (Serial no: 28R-7918002) Date & Time (UTC): 22 July 2017 at 1350 hrs Location: Sandtoft Airfield, Lincolnshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 3 Injuries: Crew - None Passengers - None Nature of Damage: Extensive Commander’s Licence: Private Pilot’s Licence Commander’s Age: 56 years Commander’s Flying Experience: 791 hours (of which 236 were on type)

Last 90 days - 10 hours

Last 28 days - 3 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis The aircraft suffered an electrical failure after the electrically actuated landing gear had been selected down but was still in transit. The aircraft landed with the landing gear unlocked. History of the flight Approximately 45 minutes into a local flight from Sandtoft Airfield, a passenger became unwell and the pilot initiated a return to land. The pilot was in radio contact with Sandtoft and informed them of his intention to make a straight-in approach to Runway 23. Approximately five miles from the airfield, landing checks were initiated, the landing gear was selected down and, two to three seconds later, the aircraft lost all electrical power. The pilot checked the circuit breakers, which were all in. He was concerned that any faulty electrical circuit may still be live and could cause a fire. He could see Sandtoft and elected to continue with his plan even though the radio had stopped working following the power failure. There were no gear down light indications but the landing gear lever was in the down position. The approach was normal until the propeller struck the ground after which the aircraft slid to a halt on the runway. The electrical master switch was set to off and the fuel set to cut-off before the aircraft stopped. The four occupants evacuated without injury. The landing gear is electrically actuated and it is most probable that it had not locked down before the failure occurred. The fault was traced to a faulty Battery Master switch.

FD06639 ｜ 2018_英国_aaib-investigation-to-rans-s6-es-coyote-ii-g-bysn__Rans_S6-ES_Coyote_II_G-BYSN_05-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

86 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-BYSN EW/G2017/10/02 ACCIDENT Aircraft Type and Registration: Rans S6-ES Coyote II, G-BYSN No & Type of Engines: 1 Rotax 912-UL piston engine Year of Manufacture: 1999 (Serial no: PFA 204-13459) Date & Time (UTC): 8 October 2017 at 0850 hrs Location: Over Farm, Tewkesbury, Gloucestershire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - None Passengers - None Nature of Damage: Extensive fire damage Commander’s Licence: Private Pilot’s Licence Commander’s Age: 66 years Commander’s Flying Experience: 499 hours (of which 36 were on type)

Last 90 days - 12 hours

Last 28 days - 12 hours Information Source: Aircraft Accident Report Form submitted by the pilot The aircraft, with the pilot and a passenger aboard, was taking off from a grass strip near Over, Gloustershire. There was a light crosswind from the left and the grass was damp. Pre-flight inspection and engine power checks were normal. On takeoff the aircraft accelerated normally and at approximately 42 mph IAS the pilot initiated rotation. He described the rotation as “slightly heavier” than usual. As the aircraft lifted off, the pilot felt the aircraft lose momentum and turn markedly to the left, taking the aircraft over the ploughed field to the left of the runway. The pilot, not wanting to put the nose down over the ploughed field, applied full right rudder to turn back towards the runway but as he did this the right wing dropped and the wing tip contacted the ground. The aircraft came to rest on the left side of the runway and fire was seen at the front of the engine cowling. The pilot and passenger exited the aircraft unaided with only minor injuries. The aircraft was substantially damaged by the fire. The pilot believes that the engine suffered a power loss during rotation which led to the left wing stall, and subsequently the application of the right rudder then caused the right wing to stall. Due to the fire damage it was not possible to determine why the engine lost power. The aircraft was approximately 4% above its maximum takeoff weight. This would have reduced the stall margin giving the pilot very little time to react to any loss of power.

FD06640 ｜ 2018_英国_aaib-investigation-to-robinson-r44-raven-g-ctfl-and-robinson-r44-raven-g-hynd__Robinson_R4.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

61 © Crown copyright 2018 All times are UTC AAIB Bulletin: 10/2018 G-CTFL and G-HYND EW/G2018/05/07 ACCIDENT Aircraft Type and Registration: 1) Robinson R44 Raven, G-CTFL

2) Robinson R44 Raven, G-HYND No & Type of Engines: 1) 1 Lycoming O-540-F1B5 Piston Engine

2) 1 Lycoming O-540-F1B5 Piston Engine Year of Manufacture: 1) 2008 (Serial no: 1912)

2) 2016 (Serial no: 2433) Date & Time (UTC): 5 May 2018 at 1125 hrs Location: Cumbernauld Airport, North Lanarkshire Type of Flight: 1) Training

2) Training

Persons on Board: 1) Crew - 1 Passengers - 2

2) Crew - 1 Passengers - 3 Injuries: 1) Crew - None Passengers - None

2) Crew - None Passengers - None Nature of Damage: 1) Extensive

2) Main rotor blade damaged Commander’s Licence: 1) Commercial Pilot’s Licence

2) Commercial Pilot’s Licence Commander’s Age: 1) 42 years

2) 58 years Commander’s Flying Experience: 1) 913 hours (of which 226 were on type)

Last 90 days - 54 hours

Last 28 days - 21 hours

2) 6,846 hours (of which 1,705 were on type)

Last 90 days - 62 hours

Last 28 days - 13 hours Information Source: Aircraft Accident Report Forms submitted by the pilots, recorded CCTV and radio transmissions and further enquiries by the AAIB Synopsis After lifting to a hover, the pilot of Robinson R44, G-CTFL reversed his helicopter, unaware that a second Robinson R44, G-HYND, had landed behind his position and was being shut down. One of G-HYND’s rotor blades collided with G-CTFL’s engine housing, startling the pilot of G-CTFL, with the result that he lost control, and the helicopter struck the ground several times before coming to rest in a tail-down attitude, next to a parked Robinson R22. Safety action has been taken by the helicopter operator to improve the helipad arrangement, procedures and RFFS response.

62 © Crown copyright 2018 All times are UTC AAIB Bulletin: 10/2018 G-CTFL and G-HYND EW/G2018/05/07 History of the flight Robinson R44 G-CTFL had its rotors turning, prior to departing Cumbernauld for a trial lesson flight, when another helicopter of the same type, G-HYND, returned from a sightseeing flight. Because both helipads at the eastern end of the airport were occupied, the pilot of G-HYND landed on a grass area behind G-CTFL and then stated on the Air/Ground radio frequency “Golf November Delta secure on the ground complete”. The helicopter on the northern of the two helipads was a Robinson R22, which had recently flown and, shortly after G-HYND landed, the crew of the R22 walked in front of G-CTFL towards the helicopter operator’s buildings. It was evident from recordings of the Air/Ground radio frequency that, one minute after the last radio transmission from G-HYND, the pilot of G-CTFL obtained the latest airfield information, but he was not alerted to the presence of another R44 which was parked on the grass. After acknowledging the airfield information, the pilot of G-CTFL announced “Golf Foxtrot Lima lifting from the eastern helipad to Alpha”. The pilot of G-CTFL stated that he was restricted from moving forwards and right onto Taxiway A, because of the position of the parked R22 helicopter and because of a stationary Cessna aircraft, which was in front of him and facing away with its propeller turning (Figure 1). There was a second light aircraft parked to the left of the Cessna and he did not wish to disturb these aircraft with his helicopter’s downwash. The pilot knew that, when he boarded his helicopter, the area to the rear was clear and he had no recollection of hearing any radio transmissions from G-HYND, so he was not aware of its position and was not expecting another helicopter to be parked there. After lifting to the hover, the pilot decided to move rearwards and then taxi behind the R22. He did not turn his helicopter to check that the area to his rear was clear before reversing, because of the proximity of the R22 on his right and because he did not wish to turn his tail left towards the buildings, where some spectators had assembled. Figure 1 Approximate aircraft disposition in the vicinity of Apron A, at the eastern end of Cumbernauld Airport, before G-CTFL moved

63 © Crown copyright 2018 All times are UTC AAIB Bulletin: 10/2018 G-CTFL and G-HYND EW/G2018/05/07 CCTV recordings showed that G-CTFL lifted before moving slowly rearwards and slightly to the right, with its skids approximately 6 ft above the ground. The main rotor blades of G-HYND were still turning slowly and, as G-CTFL approached, one of them struck the engine housing of the hovering helicopter, below the tailboom on the left side. The pilot of G-CTFL heard a bang and recalled that his helicopter pitched nose-up and right, so he made a forward cyclic control input to return towards the helipad and lowered the collective lever. He then realised the helicopter was pitching nose-down so he moved the cyclic stick aft, but the tail struck the ground, before the helicopter bounced forward off its skids, towards the R22. The pilot stated that he reacted by making a left cyclic stick input, but that the rotor blades then struck the ground and the helicopter vibrated violently, so he lowered the collective lever fully. G-CTFL landed heavily in a nose-up attitude, near the R22, with its tail resting on the ground (Figure 2). After the helicopter stopped moving, the pilot made the engine and electric switches safe, applied the rotor brake and vacated using his door on the left side. Another of the helicopter operator’s employees approached the right side of the helicopter, opened the doors and helped the student pilot and the passenger to escape. Figure 2 G-CTFL after the accident, facing towards Apron A, with the R22 visible behind, on the northern helipad, and with loose debris in the foreground The pilot of G-HYND had turned off his radio and had removed his headset while his rotor blades slowed. After writing post-flight notes, he looked up and saw G-CTFL moving towards him. He attempted to turn his radio on and replace his headset, so that he could warn the other pilot but, before achieving this, he observed one of his rotor blades strike the left side of G-CTFL’s engine bay. The impact did not seem to affect his own helicopter and his passengers appeared uninjured so, when the rotor blades stopped rotating, they all disembarked normally. CCTV recordings of the collision showed that G-CTFL pitched rapidly to approximately 45º nose-down but initially maintained its height above the ground, while moving away from

64 © Crown copyright 2018 All times are UTC AAIB Bulletin: 10/2018 G-CTFL and G-HYND EW/G2018/05/07 G-HYND, and towards the helipad. As it approached the pad it descended and the nose pitched up, the tail struck the grass and the rear of both skids hit the concrete. This caused G-CTFL to bounce approximately two feet from the ground, into a nose-down attitude, while the tail turned anti-clockwise towards the R22. Next, G-CTFL impacted the ground heavily, orientated at 90º to the pad, with the left skid hitting first and the helicopter then rolling onto its right skid and pitching nose-up until the tail struck the ground near the R22. G-CTFL now bounced a second time, its tail turned quickly clockwise and the helicopter rolled left until the main rotor blades struck the concrete pad. Finally, G-CTFL struck the ground between the two landing pads with its tail on the grass and close to the R22. The rotor blades stopped turning 33 seconds later. During the accident sequence, the CCTV recording showed debris being thrown several metres across the surrounding area, with some falling onto Apron A. Approximately three minutes after the accident, the pilot of the Cessna aircraft taxied via Taxiway A to another position at the airport, for refuelling, after advising the Air/Ground operator of his intention.

The Cessna’s pilot later recalled that he was aware the helicopter’s “undercarriage” had collapsed but he did not observe the accident or see any debris, so had not considered the potential for his aircraft to have been damaged. With hindsight, he realised that he could have shut down and inspected his aircraft but, as he was not departing for a flight, he thought that with the situation under control, it would be best if he moved away. He assumed the taxiway was safe to use, as he had watched a Rescue and Fire Fighting Services (RFFS) vehicle being driven along it before he taxied. RFFS response The operator of Cumbernauld Airport had agreed that the helicopter operator would provide RFFS in respect of all associated helicopter operations and consequently the helicopter operator’s own RFFS vehicle was available. This was situated outside the hangar, a few metres from the accident site, but the only trained RFFS personnel available were the pilots from the R22 and from G-HYND. Another employee was the first to reach the accident site and he saw no evidence of leaking fuel when he assisted the passengers to escape. Subsequently the R22 pilot reached the scene and determined there was no fire risk, so the operator’s RFFS vehicle was not employed. The airport’s Air/Ground radio operator activated the airport crash alarm. He was also trained for RFFS duties and, when he did not see the helicopter operator’s RFFS vehicle deploy, he passed his radio task to somebody else, and drove the airport’s RFFS vehicle to the accident site. He estimated that he arrived within two minutes of the accident, to find that the helicopter’s occupants had escaped, without injury, and that the helicopter operator did not believe there was a fire risk, so the local emergency services were not alerted. Helicopter operator’s investigation The helicopter operator conducted an internal investigation which concluded that the accident could have been avoided if the pilot of G-CTFL had turned the tail of his aircraft and visually checked the area behind. The operator considers such a lookout turn to be a

65 © Crown copyright 2018 All times are UTC AAIB Bulletin: 10/2018 G-CTFL and G-HYND EW/G2018/05/07 standard procedure before a helicopter is moved rearwards, but the pilot felt constrained from moving the tail of his helicopter left by the presence of spectators. However, the CCTV recordings showed nobody on the roadway or grass area immediately to the left of G-CTFL and the helicopter operator believed the tail could have been moved left, leaving a 5 m safety margin from any people or obstructions. According to the helicopter operator, it was not unusual for helicopters to reverse from the southern helipad, if the other pad was occupied and Apron A congested. The helicopter operator reported that its checklist for the R44 shutdown procedure does not clearly specify when the avionics should be switched off, so it was not unusual that the pilot of G-HYND had switched the radio off and removed his headset once the engine had stopped but with the rotors still turning. Helicopter operator’s safety actions As a result of the accident, the following safety actions have been taken by the helicopter operator: ● ● The northern helipad was extended eastwards by 12  m, so a parked helicopter is further from the apron, leaving space for other helicopters to move between the parked helicopter and the apron. ● ● The prepared grass area east of the helipads has been extended, to ensure helicopters parked there can remain well clear of the pads. ● ● A mirror has been placed at the corner of the hangar, to assist pilots using either helipad see any activity to their rear. ● ● The helicopter operator no longer permits helicopters to reverse from the helipads. ● ● The helicopter operator’s safety team is due to review the procedure for turning off the avionics systems while a Robinson R44 is being shut down. ● ● A review of the RFFS response to this accident has led to several changes being instigated. These are intended to ensure that two appropriately trained employees are available, on the ground, at all times there is helicopter activity and that fire-fighting equipment can be readily accessed by these employees. Airport operator’s report An investigation by the airport operator established that immediately after the accident it would have been best to close the airport until appropriate inspections of the manoeuvring area and Apron A had been completed. Scrutiny of the airport’s emergency procedures following this accident highlighted some ambiguities and the operator undertook to review and revise the relevant guidance as necessary.

66 © Crown copyright 2018 All times are UTC AAIB Bulletin: 10/2018 G-CTFL and G-HYND EW/G2018/05/07 AAIB comment The collision between the two helicopters occurred because the pilot of G-CTFL was not aware of G-HYND’s position. However, the damage to G-CTFL did not appear to immediately effect the operation of its engine or flying controls. The pilot of G-CTFL stated that he recalled his helicopter pitching nose-up and he made a forward cyclic input in response, but CCTV showed that after hitting G-HYND’s rotor blade, G-CTFL pitched nose-down. An excessive nose-down attitude ensued, close to the ground, before recovery action appears to have been initiated and the nose began to pitch up. However, the helicopter was now descending towards the helipad and, as the nose pitched up, the tail struck the ground and initiated the impact sequence. It is likely that the pilot of G-CTFL was startled by the unexpected collision with the other helicopter. The ‘startle effect’1 is likely to have impaired his ability to comprehend the situation and also his psychomotor skills, leading to his loss of control. When the helicopter operator’s employees responded to the accident they did not take any fire fighting equipment to the scene, so it was fortuitous that there was no outbreak of fire before all the helicopters’ occupants escaped. As a result, emergency response procedures have been changed, but this accident highlights the need to regularly review such procedures. Footnote 1 Startle is defined in the Federal Aviation Authority’s Advisory Circular 120-111 of 2015 as ‘an uncontrollable, automatic muscle reflex, raised heart rate, blood pressure, etc., elicited by exposure to a sudden, intense event that violates a pilot’s expectations.’ An overview of the ‘startle effect’ and details of reference material can be found on the SKYbrary website at https://www.skybrary.aero/index.php/Startle_Effect (accessed September 2018)

FD06641 ｜ 2018_英国_aaib-investigation-to-rotorsport-uk-cavalon-g-ckyt__Rotorsport_UK_Cavalon_G-CKYT_12-24.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Accident

Aircraft Type and Registration: Rotorsport UK Cavalon, G-CKYT No & Type of Engines: 1 Rotax 914-UL piston engine Year of Manufacture: 2018 (Serial no: RSUK/CVLN/027) Date & Time (UTC): 12 November 2020 at 1250 hrs Location: Farmland between Avoch and Munlochy, Black Isle Type of Flight: Solo training flight Persons on Board: Crew - 1 Passengers - None

Injuries: Crew - 1 (Fatal) Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: Student private pilot Commander’s Age: 67 years Commander’s Flying Experience: 117 hours (of which 46 were on type)

Last 90 days - 20 hours

Last 28 days - 6 hours Information Source: AAIB Field investigation Synopsis A solo student pilot was on a local general handling flight when the rotor head of the gyroplane he was flying, separated from the fuselage in flight. The separation was caused by a structural overload failure from exposure to dynamic flight loads, judged to be due to a specific sequence of aircraft manoeuvres. The gyroplane was found to have been correctly released to service. There were no maintenance issues identified relevant to the accident. A number of operational factors were considered and it was likely that the pilot inadvertently allowed the aircraft to enter a low g flight regime close to, or potentially exceeding, that prohibited by the Cavalon Pilot’s Operating Handbook. The accident highlighted limitations in the design, testing, manufacture and operating limits for the Cavalon and Cavalon Pro gyroplane types. Based on an assessment of the requirements within BCAR Section T, these limitations could be relevant to other gyroplane types certified to this standard. The investigation also highlighted issues with gyroplane training material regarding the awareness of rotor load factor by pilots. Four Safety Recommendations have been made to address these issues.

2 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 History of the flight The student pilot arrived at Inverness Airport at 0850 hrs on the morning of the accident to prepare for a dual check flight with his instructor, followed by a solo flight as part of his PPL training. The student first completed a 20-minute check flight with his instructor, flying one circuit and a practice aborted takeoff, which the instructor considered were flown well. The instructor then briefed the student for a solo flight in the operator’s training area over the Black Isle, 4 nm to the north of Inverness. The instructor reported that he had not given the student specific exercises to fly but had directed him to fly around the training area to gain more experience of handling the gyroplane. The student took a short break while staff from the training school refuelled the gyroplane and added ballast1. The student then took off at 1020 hrs, returning to Inverness at 1140 hrs. The flight went without incident and the student was reported as being very pleased with his achievement. The student made no adverse comments about either the flight or the wind conditions encountered. He was scheduled to fly another solo flight on the following day, but the forecast winds were due to be out of limits for solo students. His instructor instead offered him the opportunity to fly a further solo exercise that afternoon as the weather conditions were assessed by him to remain suitable for a student solo. After a short break, the student reported that he was not fatigued and was ready to fly again. He discussed the content of the sortie with his instructor, which was to repeat the previous flight around the Black Isle. The student then refuelled the gyroplane and booked out with ATC for the flight. The gyroplane took off from Runway 23 at Inverness Airport at 1237 hrs with a clearance to climb not above 2,000 ft until coordinated with radar. At 1240 hrs the student was instructed to contact Inverness Radar, which he did, reporting that he was at Chanonry Point at 1,800 ft and requested a Basic Service (Figure 1). Footnote 1 For a description of the ballast, refer to the Weight and Balance section.

3 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Chanonry Point 1,800 ft radio call Munlochy Bay Inverness Airport take-off at 1237 hrs RH turn near Avoch Figure 1 Accident flight track from GNSS ATC confirmed the request for a Basic Service, informing the student that there were no level restrictions and passed him relevant traffic information. The gyroplane turned onto a westerly track towards Avoch and at 1243 hrs was informed of another aircraft to his west routing from Munlochy Bay to Inverness Airport. The student reported that he was visual with the aircraft. The gyroplane then completed an orbit to the north of Avoch before routing in a south- easterly direction towards the Moray Firth coastline. The first witness to see the gyroplane in the area (location 1 - Figure 2) described hearing a marked increase in engine noise that prompted him to look up. He reported seeing a gyroplane moving in a south-westerly direction. At approximately the same time, a witness at location 2 reported seeing a gyroplane flying in a similar direction but did not consider there was anything unusual about it. The gyroplane then flew parallel to the Black Isle coastline in a south-westerly direction before turning north-west to follow the Munlochy Bay inlet. Two witnesses in this area (location 3 - Figure 2) reported hearing an engine alternating between high and low revving sounds, and “spluttering”, but neither reported seeing an unusual flightpath. As the gyroplane continued on a north-westerly track, witnesses at locations 4 to 8 reported hearing unusual sounds that drew their attention. They variously described the sounds as an engine “roaring as if at full revs” and “spluttering as if an engine was failing”. Witnesses at location 8 reported hearing a “very loud mechanical noise, which sounded like a metal crunch”, and a “loud mechanical cracking noise”.

4 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The eyewitnesses at locations 2 and 3 reported seeing the gyroplane again a few minutes after they had initially seen it, describing it now in a fast, erratic and steep descent. This was a similar description to those given by witnesses 4 to 8 who had looked up at the gyroplane on hearing an unusual sound. One of the witnesses at location 3 reported seeing the rotor blades detach as the aircraft descended. The witnesses at location 8 also reported seeing the main rotor blades spinning off the gyroplane and landing about 30 m from where they were standing. Some of the witnesses then saw the gyroplane hit the ground and catch fire. At about 1250 hrs, around the time the eyewitnesses reported seeing the gyroplane descending erratically, there was a short open mic transmission2 on the Inverness approach frequency. At about the same time the controller lost radar contact with the gyroplane. The controller tried to establish radio communication but received no response. He alerted colleagues in the Tower and asked them to look in the direction of the last recorded contact to check if they could see the gyroplane. They reported seeing black smoke rising in the area but could not specifically identify which side of the Moray Firth it was coming from. Several onlookers made calls to the emergency services, and local community emergency responders arrived on scene at approximately 1305 hrs, quickly followed by paramedics and a doctor. The first responders stated that they could not access the aircraft due to the intensity of the fire which was extinguished shortly afterwards on the arrival of the fire service. Accident site Figure 2 Witness locations in relation to ground track of gyroplane Footnote 2 An open mic transmission happens when a press-to-transmit button is held, or the radio transmission unit is stuck on transmit, and no intentional communication is passed.

5 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Accident site The fuselage was located in a field approximately 150 m west of farm buildings and was surrounded by smaller items, which had been released when the fuselage initially struck the ground. The rotor head and blades had detached from the fuselage together and were located in an adjacent field to the fuselage, some 65 m south-south-east of the same farm buildings. Two ground marks from the leading edge of each blade striking the ground were positioned at an obtuse angle to each other. A trail of small items of wreckage stretched from the location of the detached rotor head east-north-east for approximately 500 m across farmland and into the garden of a private residence (Figure 3). These items of wreckage consisted of sections of the right door of the aircraft, along with the tip of one of the propeller blades. N Main fuselage Rotor head and blades Wreckage trail Figure 3 Wreckage location Recorded information The aircraft was captured by the Inverness radar head throughout the accident flight, recordings of which were made available by Inverness ATC. ATC also made available recordings of radio transmissions between ATC and the aircraft. The gyroplane was fitted with a transponder capable of transmitting Mode C altitude3, but this information was not recorded by the radar. Reasons for this could not be established, but it is possible to switch off Mode C altitude on this transponder. A review of the radar data from a previous flight of G-CKYT on 7 November 2020 also confirmed no Mode C altitude had been recorded. The gyroplane was fitted with a number of avionics components but, due to the impact and post- crash fire, they all sustained significant damage. The only onboard device from which data could be recovered was a Garmin GDL 50 portable ADS-B receiver. This device was fitted to receive traffic data via ADS-B which was then transmitted to the cockpit display to allow the pilot to view traffic information on a moving map. Footnote 3 Mode C altitude is that sensed by the transponder and transmitted to the nearest 100 ft.

6 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 To determine aircraft position, the device included a GNSS receiver and a pressure altitude sensor. This information was recorded to the device as a track log, once per second, which was more accurate and at a higher sampling rate than the recorded radar data. Data in this track log included time, position, altitude, and a derived vertical speed, groundspeed and track. This device was positioned on the coaming above the instrument panel and attached to the aircraft’s power supply. Despite suffering impact damage, the device was successfully downloaded at the AAIB and contained a track log which was from the accident flight. There were no other flights recorded. The data recovered did not contain any GNSS accuracy information such as the number of satellites in view at the time. G-CKYT previous flight The flight prior to the accident flight lasted approximately 1 hour 20 minutes. Figure 4 shows the radar ground track of this flight in which the student took off from Inverness then travelled around the Black Isle in an anticlockwise direction. Inverness Airport 1020 hrs – takeoff 1133 hrs - landing Munlochy Bay Accident site Figure 4 Radar data showing G-CKYT flight track prior to the accident flight The radar was only recorded every four seconds and has a significantly lower position accuracy than the GNSS data. However, it was possible to show that a number of left and right orbits were performed throughout the flight, including one over Munlochy Bay, two in the region of Avoch and four mid-downwind prior to landing.

7 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Accident flight The GNSS device only contained one recording which was for the accident flight and provided more detailed flight path information than the radar data. The pressure altitude recorded by this device used a reference pressure of 1013 hPa which was corrected to the Inverness QNH at the time of 1001 hPa. When comparing the recorded altitude to the elevation of the Inverness runway, the recorded pressure altitude was within 20 ft. GNSS altitude was also recorded and was within 30 ft of the airfield elevation. After takeoff, the GNSS altitude was consistently lower than the pressure altitude but within 13-95 ft. Analysis of the recorded pressure altitude over time revealed that it was not smooth and fluctuated even when the aircraft was in level flight. The GNSS altitude was smoother than the pressure altitude and despite an offset, followed the same trend as the pressure altitude. Radar data showed the presence of a light aircraft, a Grumman AA-5, transiting through the area of the accident a few minutes prior to G-CKYT. It was enroute to Inverness from the north and, when passing over Munlochy Bay at 1244 hrs, was descending through an altitude of about 1,900 ft. Derived parameters An estimate of the airspeed was calculated using surface wind conditions at Inverness Airport and those at 1,000 ft and 2,000 ft amsl (see Meteorology section). The reported wind at 2,000 ft amsl was 30 kt from the south-west which had a notable effect on the difference between ground and airspeed. A simple estimate of bank angle was calculated using aircraft airspeed and rate of turn, assuming a level and coordinated turn. The vertical speed parameter recorded on the GNSS device correlated well with the rate of change of GNSS altitude. The rate of change of this vertical speed provided an estimate of the vertical acceleration. This is only the acceleration in the vertical direction in m/s2 which can also be expressed as a fraction of normal gravitational acceleration, or g (9.81 m/s2). Accident flight data The recovered GNSS track (Figure 1) was similar to the recorded radar track. Figure 5 shows the GNSS data parameters with respect to time for the whole flight. Takeoff commenced at 1237:15 hrs followed by a right turn. Just over three minutes later, the pilot made a radio transmission to Inverness Radar for a Basic Service, stating he was at 1,800 ft. At the time, the data showed the aircraft climbing through a pressure altitude of 1,700 ft (GNSS altitude 1,624 ft) at an airspeed of 64 mph.

8 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 5 G-CKYT GNSS flight parameters The aircraft continued towards the Black Isle, climbing to a maximum altitude of 1,860 ft before turning left to towards Avoch. When just under a mile from Avoch, ATC advised G-CKYT of another aircraft routing towards Munlochy Bay, returning to Inverness Airport. The pilot replied that he was “visual with the light aircraft”. Turn north of Avoch One minute later, at 1244:30 hrs, G-CKYT was overhead Avoch and commenced a turn to the right at a pressure altitude of 1,540 ft and approximate airspeed of 73 mph. During the turn, bank angle was estimated at approximately 30° with the pressure altitude fluctuating and progressively decreasing over 1 minute 22 seconds to 1,347 ft at the end of the right turn. Airspeed during the turn reduced to approximately 50 mph before increasing to 92 mph by the end of the turn (a total loss in the turn of 193 ft and increase of 19 mph). Vertical speed fluctuated in the turn, reaching a descent rate of up to 1,000 ft/min and as the turn was completed, the aircraft was descending at approximately 500 ft/min with an increasing airspeed.

9 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The aircraft then turned to the left and tracked towards the coast before turning into Munlochy Bay (Figure 1). Its airspeed reduced and the aircraft climbed progressively to approximately 1,900 ft amsl. Remainder of the flight At 1249:20 hrs, when overhead the northern shore of Munlochy Bay, the aircraft commenced a turn to the left (Figure 6). 2,000 ft Wind: 225/30 1249:20 start of left turn Main wreckage Rotor head and blades 1249:46 first radio transmission Bank angle ~45° Figure 6 G-CKYT final ground track (Google Earth) The turn started at a pressure altitude of 1,870 ft (GNSS altitude 1,799 ft) and airspeed of 73 mph. For the first 16 seconds of the turn, the estimated bank angle increased and remained at between approximately 35-40° to the left. During this time, the vertical speed fluctuated, at one point reaching a descent of 782 ft/min (Points A to B, Figure 7).

10 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 7 G-CKYT flight parameters Towards the end of the left turn, at 1249:40 hrs, the estimated bank angle had increased to approximately 45° (point C). At this time, the aircraft was at a pressure altitude of 1,788 ft (GNSS altitude 1,732 ft), an airspeed of 60 mph and climbing at 278 ft/min. After this time, the vertical speed started to reduce. Over the next seven seconds, the vertical speed decreased progressively, from +278 ft/min to -3,195 ft/min. From 1249:42 hrs (point D), the vertical speed became negative (-102 ft/min), signifying the start of a descent. Three seconds later, the calculated aircraft track showed completion of the left turn while at a pressure altitude of 1,783 ft (GNSS altitude 1,700 ft) and an airspeed of 66 mph, but was then descending at 1,390 ft/min. At 1249:46 hrs, the calculated aircraft track showed the aircraft then entering a right turn (point E) while still descending, but now at a pressure altitude of 1,761 ft (GNSS altitude 1,669 ft), an airspeed of 70 mph and descending at 2,107 ft/min.

11 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Radio transmission at 1249:46 hrs At the same time, a transmission was recorded on the Inverness Approach frequency. The source of the transmission could not be confirmed as coming from G-CKYT, but appeared to be a radio transmission which lasted a fraction of a second. There were two further transmissions at 1249:48 hrs and 1249:49 hrs, lasting 0.5 seconds and 7 seconds respectively. The transmissions contained primarily a high-pitched frequency with no intelligible speech. An analysis was performed, comparing these transmissions with those from earlier in the flight. Previous recordings included clear audio signatures of the aircraft propeller, a lower level of background noise and clear speech. The transmissions from 1249:46 hrs differed, with no evidence of the propeller audio signature and a much higher level of background noise. No conclusive information could be drawn from these radio transmissions. Last part of the recording The GNSS and pressure altitudes had been similar throughout the flight, apart from GNSS altitude consistently being lower than the pressure altitude. In the final minute, the GNSS altitude was within between 48-92 ft of the pressure altitude with a similar trend. At 1249:47 hrs (Point F, Figure 7, one second after the first of the radio transmissions), the recorded pressure and GNSS altitudes began to diverge. The derived rate of descent from the GNSS altitude at this time was 3,195 ft/min. The pressure altitude indicated a reversal from descent to climb within one second (a derived vertical speed change of -1,368 ft/min to +1,494 ft/min). Such a change is not possible in this aircraft so the pressure altitude from this point was considered to be inaccurate. Low confidence in the accuracy of the data beyond this time meant detailed analysis of the recorded data after 1249:47 hrs was not considered reliable. At 1249:49 hrs, the recording of position and GNSS altitude was the same as that for one second later. Potential reasons for this are discussed below but it is indicative of a loss in accuracy of the device. Despite the loss in accuracy of the device, the recording continued. Position and GNSS altitude data from 1249:47 hrs showed a continued descent towards the location of the aircraft wreckage. The final recorded data point was at 1249:55 hrs. Vertical Acceleration Between 1249:40 hrs and 1249:46 hrs, the aircraft vertical speed reduced. The rate at which this reduced is a measure of how fast the aircraft was accelerating vertically, with respect to the recorded GNSS altitude. Figure 7 shows the derived vertical acceleration (g) and that the trend towards the end of the valid data was for a decreasing vertical acceleration. As there were no accuracy metrics in the GNSS download, it is difficult to ascertain a tolerance on the calculated figures. However, using different calculation methods gives a difference of approximately ±0.1 g.

12 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 GNSS accuracy From 1249:47 hrs, inaccuracies were noted in the GNSS device recording. These included a divergence between the pressure and GNSS altitudes, significant reversal of the pressure altitude value and a double recording of position/GNSS altitude recording. There was no GNSS accuracy data recorded by the device which could help explain this. The accuracy of the device in determining position and GNSS altitude depends on a number of factors. If the GNSS antenna is obscured, the number of satellites in view may be reduced and the accuracy of the recorded position and GNSS altitude will be affected. Sensing of pressure altitude is performed by a pressure sensor in the device which is affected by the location of the device. If there is a sudden pressure change, the pressure sensor reading (and recorded pressure altitude) will be affected. In previous investigations, the AAIB has encountered erroneous position and altitude data recovered from GNSS devices when aircraft have been in unusual attitudes and, as a result, the aircraft has a shielding effect on the device antenna. Erroneous GNSS data is not unusual during an accident sequence. For the GNSS device fitted to G-CKYT, if the number of satellites in view reduces, the track log will continue to be recorded, albeit with a lower position and altitude accuracy. This would be seen in the track log as either unusual positions, GNSS altitudes, or both. If the GNSS signal is lost completely then the device used an algorithm to predict the ongoing position and GNSS altitude for a period of time. This prediction, based on its previous flightpath, allows a continuation of the position reporting and recording in the event of an intermittent signal loss. This predictive tracking is also known as ‘coasting’ and during testing of another Garmin GDL 50, this coasting function was confirmed and occurred for up to 20 seconds. As there were no accuracy measures recorded, the difference between an accurate track, coasted track and one affected by a reduced satellite count could not be distinguished. Aircraft information G-CKYT was a Rotorsport UK Cavalon gyroplane. This was a UK imported version of the AutoGyro Cavalon, manufactured in Germany. The Cavalon is a side-by-side, two seat gyroplane, with an aerodynamically shaped composite fuselage and fully enclosed cockpit. It has a non-retractable, tricycle landing gear and a tailplane attached by a curved tail boom, which provides clearance for the propeller. The tailplane has a horizontal stabiliser and three vertical fins, of which the largest centre fin is equipped with a rudder. The aircraft is powered by a Rotax piston engine, which in the case of G-CKYT was a 914 UL fitted with a turbo. The engine is located at the rear of the fuselage and drives a three-blade composite IVO pusher propeller, which rotates anticlockwise (when viewed from the rear). The gyroplane has an 8.4 m diameter teetering rotor, located at the top of a mast to provide clearance from the propeller. The fuselage mass is approximately 529 kg at maximum weight4. Footnote 4 The rotor head and rotor blades together weigh approximately 31 kg.

13 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The top of the fuselage composite structure forms the lower half of the rotor mast. A stainless steel box section tube is bolted to this by two fixing bolts to form the top half of the mast. The steel section also provides the attachments to support the routing of the flying controls and pre-rotor drive shaft, which is then connected to the rotor head. This section of the mast is covered by an aerodynamic fairing (Figure 8). The rotor head fitted to G-CKYT was a Mark III head (referred to as Rotorkopf III), which was the latest iteration of the design introduced in 2018, and was common to the AutoGyro MTO Sport, Calidus and Cavalon Pro models. The complete rotor head is formed by several individual components attached to an aluminium ‘rotor bridge’ structure. The rotor bridge locates the main rotor bearing to which the rotating components, namely the pre-rotator ring gear and the aluminium teeter tower and rotor pivot bolt, are fitted, secured by the main rotor bolt. The two rotor blades are joined together by a centre section and attached by the rotor pivot bolt to the teeter tower, with the main mass of the blades hanging below the pivot point formed by the rotor pivot bolt. Bracket plates bolted on to either side of the rotor bridge are in turn secured to a gimbal block laterally by a single pitch pivot bolt and washers, allowing the rotor head to tilt up and down around the pitch axis, relative to the gimbal block. The gimbal block is bolted longitudinally to side plates welded to the front and back faces of the top of the rotor mast by a roll pivot bolt and washers. This allows the combined rotor bridge and gimbal block to rotate from side to side around the roll axis. Flying control and trim connections attach at the rear of the rotor bridge to control pitch and to a bracket which extends to the left side (viewed from the rear) of the rotor bridge to control roll (Figure 9). The manufacturer’s design drawing designates a 65 mm long, 10 mm diameter stainless steel bar is fitted into locating holes in the side plates on the mast below the roll bolt holes and is welded in place on the exterior surfaces of the plates. The manufacturer confirmed the thickness of these plates should nominally be 5 mm. Only the internal width dimension between the side plates (52.0 + 0.5 mm) is specified on the manufacturer’s drawing. With a nominal plate thickness of 5 mm this would result in the bar extending between 1.5 and 1.25 mm beyond the external faces of the side plates on either side, though any variation in the thickness of the side plates could reduce this further. The drawing specifies an all- round fillet weld on the external face only. It does not give a dimension for the throat, but specifies the use of a 2 mm, 1.4576 steel electrode. The weld requirement is the same on both side plates of the mast. When the mast and gimbal block are assembled, the bar on the mast locates in a channel along the bottom of the gimbal block (Figure 10). When the gimbal block rotates in roll around the roll pivot bolt by approximately 8° in either direction, the respective side of the channel contacts the roll stop bar to act as a limit stop. The manufacturer advised this control stop feature was only intended for use on the ground.

14 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Lower section formed by top of composite fuselage, with two fixing bolts to attach the upper mast section. Upper section of mast formed by steel tube surrounded by fairings, with mast attachments supporting flying controls and pre-rotator shaft. Top of mast shows welded side plates, roll bolt holes and roll stop bar. Rotor head showing teeter tower, pivot bolt and ring gear, attached to the rotor bridge via the main bearing. Figure 8 Mast and rotor head arrangement (original image courtesy of manufacturer)

15 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Teeter tower and rotor pivot bolt Pre-rotator ring gear Gimbal block Pitch bolt Roll bolt Pitch flying control connection Pre-rotator drive shaft attachment Rotor bridge Figure 9 Rotor head components (original image courtesy of manufacturer) B A C Figure 10 Gimbal block: A – rear, showing roll bolt hole and roll stop channel. B – right side, showing pitch bolt hole. C – bottom, showing roll stop channel and grub screw hole

16 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Gyroplane Operation A gyroplane achieves lift and directional control through a free turning rotor. The rotor operates in autorotation spinning freely as a result of air flowing up through the blades with the aircraft being propelled by an engine-driven propeller. This is in contrast to a helicopter which relies on an engine to turn the blades and draw air from above. Aerodynamic forces acting on the rotor blades during autorotation keep the rotor turning, as well as creating lift to keep the gyroplane airborne. The forces acting on a gyroplane in flight are lift, weight, thrust and drag. Lift is derived from the rotor, which also produces a drag force. The lift component of rotor force acts vertically in straight and level flight whilst the drag component acts rearwards. Drag forces also act on the fuselage which, when combined with the rotor drag, give the total drag of the aircraft.

Thrust acts forward and is provided by an engine typically driving a pusher propeller. This acts directly through the airframe, rather than through the rotor system as on a helicopter. Changes in thrust are used to control airspeed and to compensate for changes in the lift and drag components of the rotor force caused by aircraft manoeuvring. To manoeuvre the gyroplane in pitch and roll, the entire rotor is manually rotated about the pitch and roll pivot bolts respectively, with control connections from the pilot’s control stick to the rotor bridge to enable this. Moving the control stick forwards and backwards rotates the rotor bridge around the pitch pivot bolt. Moving the stick from side to side rotates it around the roll pivot bolt. In a banked turn, due to the angle of the rotor plane (relative to horizontal) a proportion of the rotor force generated acts horizontally resulting in a turn. The greater the bank angle, the greater the proportion that acts horizontally and the less there is acting vertically. Pulling back on the stick increases the total amount of lift force generated by the rotor, but this also increases drag. Increased drag is countered by the pilot increasing engine power to increase the thrust from the propeller. During a turn, the pilot must use a combination of backstick and increased thrust to maintain airspeed and altitude. Increasing bank angle requires increasing thrust until a bank angle is potentially reached where all available power is required. Any further increase in bank would then result in either a loss of airspeed or altitude. As a result of the control arrangement, the entire weight of the fuselage hangs directly from the roll pivot bolt and is free to rotate laterally like a pendulum. This rotation is not damped and there is no artificial control force system to moderate the pilot’s control inputs. In a level turn, the centrifugal force acting horizontally outwards from the centre of the turn causes the fuselage to swing upwards, pivoting around the roll pivot bolt, until the mast is at approximately 90° to the plane of the rotor5. Reversing the roll angle, will cause it to rotate around the roll pivot bolt in the opposite direction. Footnote 5 This reaction is actually the result of inertia but is perceived to be a force with respect to the fuselage.

17 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Lift forces generated by the rotor disc during dynamic operation of the rotor effectively act through the rotor pivot bolt and teeter tower and down into the rotor head and gimbal block. The rotors do not contact the teeter stops when the rotor rpm remains within the normal operating rpm range. Movement of the rotor head bridge through flying control inputs changes the angle of the rotor disc without stop contact occurring. The roll control input is offset from the rotor bridge by a bracket, to reduce the control force magnitude required to overcome the aerodynamic and gyroscopic forces generated by the rotor in normal flight. In the air, the lift force opposes the weight of the fuselage. Changes in the balance of these forces dictate whether the gyroplane climbs or descends and the rate at which this vertical speed varies. Load factor The load factor (n) is simply defined as lift divided by weight. For a gyroplane, this is the actual load on the rotor head and mast at any point, divided by the normal load or gross weight. When a gyroplane flies in a constant altitude turn, maintaining level flight, the load supported by the rotor blades is greater than the total weight of the gyroplane. The steeper the bank angle is, the greater the load supported by the rotor and the greater the load factor. Load factor is non-dimensional, but is often expressed relative to the perceived force (weight) under normal gravitational acceleration or 1 g. For example, a turn which results in a load factor of 2 might also be described as a 2 g turn. Figure 11 Load factor increase with bank angle

18 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 To overcome this additional load factor, the gyroplane must produce more lift by increasing the airflow through the rotor. If additional engine power is not available to achieve this, the gyroplane will descend. The load factor change is relatively small in turns up to 30° but increases more rapidly as the bank angle increases above this (Figure 11). Load factor is also affected by the gyroplane climbing and descending. An increase in vertical acceleration results in a load factor greater than 1. Conversely if the vertical acceleration of the aircraft reduces below that normally experienced due to gravity, this can result in the load factor reducing below 1, reaching zero5F6 or even becoming negative (Figure 12). This reduction results in the gyroplane’s rotor ‘unloading’ or creating a reduced force compared to normal flight at or above 1 g. Figure 12 Load variation with vertical flight profile compared to 1 g flight Reduction in rotor loading can result in a reduction in rotor rpm, altitude and directional control. With a teetering rotor head, if rotor rpm drops too low it can also cause the blade flap angle to increase to a level where the blades contact the teeter limit stops. The adverse effects of unloading the rotor become more pronounced the closer the load factor is to zero, when they can become catastrophic. When calculating load factor, the flight profile of the gyroplane must be considered in all three dimensions as, for example, the load may reduce in the vertical plane due to a reduction in vertical acceleration but increase in the horizontal plane while flying a turn. Footnote 6 Zero g or below is commonly referred to as ‘weightlessness’.

19 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Engine torque induced fuselage rotation (Torque Roll) The force generated by an operating engine to turn the drive shaft and propeller also produces an equal and opposite force. If the engine and propeller rotate anticlockwise (viewed from the rear) this produces a clockwise torque on the engine body in operation. As the engine is fixed in the airframe on a gyroplane, this results in the fuselage rotating clockwise around the roll pivot bolt, which is perceived by the pilot as a right roll, even though the rotor may be horizontal and the control stick is initially centred. The engine manufacturer quotes the torque produced by the engine at various power settings. Typically, the highest torque is generated when the engine is at maximum power and rpm. This is the case for the Rotax engines fitted in the Cavalon. In normal operation the pilot can counter the induced rotation with an opposite roll control input. Aircraft certification The accident aircraft was a Cavalon model, approved as a Permit to Fly aircraft by the CAA. Permit annual checks and continued airworthiness were overseen by the Light Aircraft Association, under delegation from the CAA. The Cavalon design was originally approved by the UK CAA as compliant with British Civil Airworthiness Requirements (BCAR) Section T (CAP643), issue 4. BCAR Section T, covering light gyroplanes, was introduced in 1995 and originally based on Section S (microlight design), with various amendments to address issues specific to gyroplanes. As such, it is a less complex set of requirements compared to those intended to support a full Type Design and Certificate of Airworthiness level of certification. Given the limited total operating hours and relatively small number of aircraft designed to BCAR Section T requirements, compared to other design regulations, they have not been revised as frequently or as extensively. The CAA advised the investigation that BCAR Section T had been developed as a response to the very high accident rate seen on early gyroplane designs. They stated that it had continued to evolve since the original issue, drawing on other codes such as EASA CS-VLA, CS-VLR and CS-27. They highlighted that it was the first gyroplane design code in the world and is generally considered as the definitive standard for certification. The foreword for Section T states that gyroplanes which have been shown to comply with BCAR Section T will only be eligible for a Permit to Fly. The manufacturer went on to develop the Cavalon Pro for use in a commercial capacity which required the individual aircraft to have a Certificate of Airworthiness. This was agreed by the CAA based on the original certification work for the Permit to Fly Cavalon, along with the demonstration of compliance to changes in issue 5 of Section T, and additional requirements detailed in Certification Review Item (CRI) E-01. Demonstration of compliance by the manufacturer with the additional requirements was subsequently confirmed by the CAA. This allows a Certificate of Airworthiness to be issued for individual aircraft, permitting them to be used for commercial aerial work in the UK. The manufacturer marketed the Cavalon Pro as being ‘compliant with CAA requirements for a UK Standard Category Certificate of Airworthiness’, with which ‘the aircraft is permitted to undertake any paid aerial

20 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 work for which it is equipped and approved, and where a Certificate of Airworthiness is required, especially in Europe. Examples of such work include air taxi, carriage of goods, surveying, police and fire service duties, and much more.’ The manufacturer then elected to comply with issue 5 and CRI E-01 for all Cavalon models to standardise manufacture. BCAR Section T has several requirements regarding structural strength. These include T305, T307, T337, T339 and T547b. The wording of requirement T337 was amended by CRI E-01 to reduce the static strength requirements to: ‘The gyroplane must be designed such that- a) i) The gyroplane’s rotor must be designed for a positive limit manoeuvring load factor of +3.0, at all forward speeds from zero to the Maximum Design Speed VD. ii) The rest of the gyroplane must be designed for positive and negative limit manoeuvring load factors of +3.0 and –0·5, respectively, at all forward speeds from zero to the Maximum Design Speed VD’. The means of compliance stated in the manufacturer’s Certification Report for T337 was Calculation/Analysis and Laboratory Test. Along with compliance statements, this was the same for all the structural strength regulations. The laboratory test carried out to demonstrate compliance to T337 was a ground-based flight load simulation test, which statically loaded the airframe vertically to simulate the effective weight of the aircraft at 560 kg MTOW and +37 load factor. For practical reasons the test did not simulate the negative part of the requirement. It was argued by the manufacturer that, as the structural strength of the components was the same in either direction, the positive load factor test adequately addressed a load factor of -0.5 as well. This was accepted by the CAA who agreed that the test demonstrated compliance with both parts of the regulation. No flight test activity was conducted to formally demonstrate compliance with T337 or any of the other structural regulations8. Some flight testing was done to determine the highest g load likely to be achieved in operation by flying tight, steeply banked turns. This only explored the positive g load part of the envelope. Given the inherent risks associated with prolonged low to negative g flight, this area of the operating envelope was not intentionally explored during any of the general handling flight tests. The manufacturer advised that during the assessment of minimum airspeed for level flight (Vmin), the gyroplane can momentarily experience less than 1 g as the gyroplane drops below Vmin and descends. The actual g load, if measured, during this test was not provided to the investigation. The section of the Cavalon Certification Flight Test Summary report relating to general controllability requirements (T143) noted that in normal [≥1 g] flight ‘the turbo engine produces some limited torque roll if suddenly engaged.’8F9 Footnote 7 The test was done to demonstrate the earlier requirement standard of 500 kg at +3.5 g which was a more severe test. 8 As stated in RSUK0405 Iss. 1 Cavalon Revised Certification Report. 9 The Rotax 914 and 915 engines are fitted with a turbo and are both engine options on the Cavalon.

21 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Requirement T675 addresses the need for control system stops and states: ‘a) Each control system must have stops that positively limit the range of motion of the pilot’s controls. … Each stop must be able to withstand any loads corresponding to the design conditions for the control system.’ The Type Approval Data Sheet (TADS) issued by the CAA for the Cavalon identifies several prohibited manoeuvres for the gyroplane, it states: ‘(G) Prohibited Manoeuvres: Aerobatic manoeuvres are prohibited. Manoeuvres involving a deliberate reduction in normal ‘g’ shall be avoided. Flight in icing conditions is prohibited (not placarded). Flight in strong gusty winds or wind velocities of more than 45 mph (40 kt) is prohibited (not placarded)’. Product conformity and airworthiness An aircraft design is defined by a set of controlled design drawings for every component or assembly which is bespoke to that aircraft. Collectively these represent the baseline standard which has been approved by the certification process of the overall aircraft. To maintain the same standard of airworthiness in production aircraft, each component or assembly manufactured must conform to its drawing for it to be installed on an operational aircraft. Minor quality lapses and variations can be accepted, providing these have been assessed as acceptable from a safety and functionality perspective and this is documented by an approved quality exemption. If the components are fitted to a new aircraft on the manufacturer’s assembly line, then a statement of conformity is issued to the customer for the aircraft as a whole, indicating that each of the individual components and assemblies making up the overall aircraft conform to their respective design drawings. For non-EASA or non-Part 21 aircraft in the UK, components must be supplied with a UK CAA Approved Certificate, which contains a statement of conformity by the manufacturer, that the part conforms to the approved design drawing or details any exemptions or variations. The maintenance provider must confirm this documentation is present before they can fit the component and declare the aircraft serviceable again. Aircraft examination A post-impact fire in the fuselage section resulted in severe fire damage to the structure, with only peripheral sections and components made from high melting point metals surviving. These items included most of the engine, the majority of the propeller blades, parts of the landing gear, the rotor mast and some of the flying control cables and connections. Loose ballast material and the remains of a ballast container were found in the main wreckage, however, the level of damage meant it was not possible to determine the position of the ballast at impact. The nose gear wheel and various small items of structure, such as broken plexiglass, were thrown clear of the fuselage and were not affected by the fire.

22 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The rotor head and blades were located separately from the fuselage. One of the blades had been heavily bent and deformed at the blade root where it was bolted to the centre joining section. There were other small marks and distortions along the length of both blades. The most significant of these was a small puncture hole just over a centimetre long. The edges of the hole were pushed inwards from the outside surface of the blade. Adjacent to this, in a diagonal pattern between the hole and the blade leading edge, were many small marks with red and black colour transfer consistent with the paint on the propeller blades. The centre section exhibited impact marks on both sides from contact with the teeter stops (Figure 13). The mark was more significant on one side than the other, but both were superficial and there was no plastic deformation of the blade surface material or the stops. On the rotor head itself, all the connections to the flying controls had failed at the ‘eye end’ connectors. The pre-rotator drive shaft was disconnected at a join in the drive shaft. The bracket connecting the roll controls to the rotor head was bent backwards and had failed along most of the weld line between the body of the bracket and its mounting plate. The gimbal block had failed where two cracks joined. One ran vertically through the roll bolt hole and down the length of the block. The other fracture surface ran horizontally through the centre of the pitch bolt hole for half the width of the gimbal block until it met the vertical fracture surface. The pitch bolt was retained in place and secured the largest section of the gimbal block to the rotor head (Figure 13). The other smaller section of gimbal block was missing and despite an extensive search, could not be located on the accident site or the surrounding fields. Figure 13 Rotor head showing gimbal block failure, rotor blade deformation and teeter stop contact mark

23 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The roll bolt remained fitted to the top of the mast section. The roll stop bar in the mast had deformed to become curved, rather than straight (Figure 14). Figure 14 Deformation of mast roll stop bar (with roll pivot bolt removed) Figure 15 Detailed inspection of the roll stop bar end welds

24 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Detailed inspection of the mast welds showed witness marks on both external faces of the mast. The manufacturer subsequently stated that these were machining marks, where a flat surface was machined during manufacture to accommodate the washers used in the assembly of the pivot bolt. The inspection also indicated that cracks were present in the weld on both sides (Figure 15). Laboratory inspection The rotor bridge, gimbal block and mast were removed from the wreckage and sent for metallurgical analysis. Detailed inspection of the gimbal block showed evidence of additional cracks at one end of the block. There was also a curved indentation in the side wall at each end of the channel that acted as a roll stop (Figure 16). The extent of the missing material is shown in Figure 17. Figure 16 Additional cracks and deformation of the gimbal block

25 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 17 Extent of missing material from the gimbal block (shown inverted relative to its installed orientation) Analysis of the gimbal block material properties confirmed that it was machined from extruded T4 aluminium alloy, as specified by the component drawing. The direction of extrusion of the original material was along the roll axis (Figure 17), which was demonstrated by the elongated shape of the grains in this direction. Hardness testing conducted in a number of positions on the block all gave values consistent with the specification for this material. EDX spectrum analysis10 was carried out, which also confirmed that the alloy composition was within the tolerances of the specification. Visual analysis of the fracture surfaces showed that the vertical fracture was the primary crack as it extended past the point where it was joined by the horizontal fracture surface (Figure 18). Inspection using a Scanning Electron Microscope (SEM) confirmed that all the fracture surfaces were the result of a single continuous overload, with no evidence of fatigue present. Analysis of the failed flight control attachments confirmed they had also failed in overload. Footnote 10 Use of x-rays to determine which chemical elements are present and to what extent within the test sample.

26 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 18 Image showing the vertical fracture surface extending past the horizontal fracture The side plates which attached the gimbal block to the rotor bridge on both sides were significantly distorted and the bolt holes were elongated. The bolts and bracket attaching the front brake pad assembly to the gimbal block were also distorted, indicating a rotational force on the gimbal block (Figure 19). Figure 19 Images of the distorted brake pad bracket and bolts indicating a rotational force

27 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 A CT11 scan was carried out on the mast, which confirmed the extent of the roll stop bar distortion and the distortion from vertical of the side plates which supported the bar and the roll pivot bolt. The orientation of the bend in the bar was consistent with the indent marks on the gimbal block. It also showed that the end welds fixing the roll stop bar in the side plates were surface welds on the exterior of the plates, with very little penetration into the plate material. The welds on both sides of the plate had failed or on one side the weld may not have extended across the hole in the plate originally (Figure 20). Figure 20 CT scan showing the distortion of the bar and side plates, the shallow weld size and weld failure on both sides CT scans of the mast also showed the extent that the roll stop bar extended beyond the external face of the mast side plates. This was confirmed as 1.5 mm on the forward side and 1.3 mm on the aft (Figure 21). Footnote 11 Computerised Tomography combines multiple x-ray image ‘slices’ through a component to create a 3-D model of the interior of the structure.

28 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 21 CT scan measurement of roll stop bar extension beyond the mast side plates

Previous incidents The manufacturer confirmed that the distinctive conical indentations present on the side of the roll stop channel of the accident gimbal block and bending of the roll stop bar had been seen previously. The manufacturer provided samples of gimbal blocks from reported ground- based accidents which had resulted in similar deformation, but not the cracking or complete failure of the block. The manufacturer was not able to provide details of the gyroplanes from which these gimbal blocks had been removed, so it was not possible to determine if the accidents had been independently investigated or the specific circumstances of the incidents which caused the damage. However, as the manufacturer stated that they were ground-based events, it is most likely the damage had resulted from either dynamic rollover of the fuselage or low rotor rpm blade sailing issues during the takeoff roll. Fuel After the first flight of the day a member of the operator’s staff refuelled G-CKYT with 40 l of motor gasoline, bringing the total to 60 l, providing an endurance of 3 hours of flight. Following the second flight of the day the student refuelled the gyroplane with a further 20 l. Based on the known history of the flights it is estimated that there were 50 l12 of fuel onboard at departure for the accident flight. This was sufficient for an endurance of 2.5 hours. Footnote 12 36kg at a specific gravity of 0.72 kg/m3.

29 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Weight and balance The Pilot’s Operating Handbook (POH) contained the following note about the use of ballast: ‘Pilots in the right hand seat weighing less than 65 kg must carry corresponding ballast during solo operation (which may be located in the baggage compartment, around the occupant in a form such as sheet lead under the seat cushion, or securely restrained on the second seat).’ The student weighed more than 65 kg, but the training school routinely used ballast to minimise the lateral attitude change of the aircraft when the left seat was not occupied on solo student flights. Ballast was added to the gyroplane for both solo flights undertaken by the student on the day of the accident. This was described as a jerrycan filled with sand weighing 35 kg strapped onto the front left seat, and a sandbag weighing 15 kg, also filled with sand, placed on the cockpit floor in the space behind the left seat. G-CKYT had a recorded basic empty mass of 326 kg. The calculated take off mass, including the mass of the pilot, fuel and ballast, was approximately 512 kg. The MTOM permitted is 560 kg. The distribution of weight in the gyroplane was within the limits defined in the POH for weight and balance calculations. Aircraft limitations The Cavalon POH contains the following limitations: Air Speed Marking VNE Never Exceed Speed Red radial 195km/h (120mph) VB 130km/h (max design speed for strong gusty conditions) Yellow arc 130 – 195 km/h (80- 120mph) Recommended manoeuvring speed range Green arc 30 - 130 km/h (20- 80mph) Yellow arc 0 – 30 km/h (0- 20mph) Figure 22 Cavalon POH - Section 2.4 - Airspeed Limitations and Instrument Markings In addition, the structural load factors were defined as: ‘2.7.3 Demonstrated Structural Load Factors Demonstrated positive load factor (500 kg)............................................. + 3.5 g

30 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Demonstrated negative load factor (500 kg) – structural limit...................... - 1 g Demonstrated positive load factor (560 kg)............................................. + 3.0 g Demonstrated negative load factor (560 kg) – structural limit................... - 0.5 g Important note: the indication of a demonstrated negative load factor represents a structural limit only. In flight, the limitations (see 2.9) have to be respected at all times.’ The POH provides the following notes and warnings for manoeuvres: ‘Section 2 - Limitations 2.1 General WARNING Positive G load on the rotor must be maintained during all flight manoeuvres. Do not perform any manoeuvres resulting in the sensation of feeling light or near weightless. 2.9 Kinds of Operation Aerobatic flight is prohibited! NOTE Manoeuvres involving bank angles of more than 60° are considered to be aerobatic flight. Low-G manoeuvres are prohibited! WARNING Any manoeuvre resulting in a low-G (near weightless) condition can result in a catastrophic loss of lateral/roll control in conjunction with rapid main rotor RPM decrease. Always maintain adequate load on the rotor and avoid aggressive forward control input performed from level flight or following a pull up.’ In a later section entitled ‘Safety Tips’, the following advice is provided: ‘Low-G Avoidance Never push the control stick forward to descend or to terminate a pull-up (as you would in an airplane). This may produce a low-G (near weightless) condition which can result in a situation with reduced or lost lateral roll control and significant loss of main rotor RPM. Always reduce power to initiate a descent.’

31 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The manufacturer and the CAA were requested to clarify what specific ‘g’ represented a limit beyond which operation of the gyroplane was explicitly prohibited. They stated it was not possible to provide a specific figure. Identifying low g Despite these warnings in the POH describing the need to avoid situations where the rotor head becomes significantly unloaded, there was no qualifying information on what these terms represented. A number of phrases were used to describe this including ‘low g’, ‘near weightless’ and ‘sensation of feeling light or near weightless’. It also describes the need to maintain ‘adequate load’ on the rotor. Enquiries were made with the Royal Air Force Centre of Aviation Medicine (RAFCAM) about a pilot’s ability to perceive low g. This revealed it is likely that a pilot could detect a change from + 1 g to + 0.5 g, and probably even a change from + 1 g to + 0.8 g. However, RAFCAM stated that there is no trial evidence to support this and there is no evidence in medical literature of studies having been conducted in this area.  It was further suggested that if the change was from greater than 1 g, or occurring in turbulent conditions, then it is likely that it would be more difficult for a pilot to identify the transition point to less than 1 g. Typical values of vertical acceleration during climbing and descending were not available from the aircraft flight tests. Meteorology On the morning of the accident, the forecast wind speed aloft was 20 kt at 1,000 ft and 30 kt at 2,000 ft from the south-west. The METARs at Inverness Airport recorded at 1020 hrs and 1250 hrs reported the surface wind as 220° at 8 kt and 230° at 7 kt respectively. Between these observations the maximum windspeed recorded was 11 kt. The TAF published at 1100 hrs reported that between 1200 hrs and 2100 hrs the surface wind would be from 220° at 12 kt, with a 30% probability from 1500 hrs of a temporary increase to 17 kt, gusting 27 kt. With only light winds down the runway, the instructor assessed the weather to be suitable to send his student on solo sorties and regarded the wind speeds of 20 to 30 kt at height as acceptable and ‘not challenging’. The wind strength was below the Environmental Limitation in the POH of a maximum wind speed or gust intensity of 40 kt. An aftercast of the area provided by the Met Office showed Inverness and the surrounding area to be in benign conditions between frontal systems at the time of the accident. From local observations, the wind conditions were shown to be as or lighter than those forecast. Local wind reports were of south to south-westerly with varying wind speeds from 4 to 11 kt at Inverness, 11 to 15 kt at Lossiemouth (46 km north-east) and 11 to 20 kt at Tain (30 km north). There was satellite evidence of mountain wave activity from the Grampian Hills with modest activity at 6,000 ft above the surface. Given the terrain and the forecast mountain wave activity, varying wind speeds were expected. There was no rainfall and visibility was good. Between the surface and 5,000 ft there were only FEW amounts of cloud, with any broken layers above 5,000 ft.

32 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The pilot of the Grumman AA-5 flying in the area shortly before the time of accident reported that there were no gusts or turbulence when he transited the Black Isle and described the weather as ‘suitable for normal flying’. Gyroplane licensing and training regulation Responsibility for gyroplane operations had historically been delegated by the CAA to the British Rotorcraft Association (BRA). In 2012 the CAA appointed their first Flight Operations Inspector with specific responsibility for gyroplane operations. This was in response to a recognised lack of relevant in-house experience of gyroplane operations within the CAA. In 2013 the CAA formed the gyroplane Panel of Examiners, consisting of established industry experts, taking over responsibility for gyroplane operations from the BRA. This included establishing the minimum skill levels for all aspects of PPL gyroplane training and ongoing training standardisation. It comprised three senior gyroplane flying instructors and examiners, meeting biannually chaired by the CAA. Additionally, the group hosted an annual conference of gyroplane instructors to discuss training standards. Standards set by the Panel are reviewed by the CAA before approval is granted and they are included in CAA Standards Document 44: Gyroplane Licensing. This defines the standards to be applied for the training of UK licensed gyroplane pilots after 01 July 2012. To obtain a Private Pilot’s Licence for gyroplanes, PPL(G), a pilot must complete a training course with a CAA certified flight instructor entitled to instruct on gyroplanes. Training must follow the gyroplane syllabus published by the CAA in Standards Document 44. Instructor information The instructor gained his instructor’s qualification, FI(G), with restricted privileges13 12F in 2015 and achieved an unrestricted status in April 2017. He had delivered over 1,000 hrs of dual instruction and became qualified to deliver training to flight instructors in August 2020. He operated from a flying school, which was an Approved Training Organisation (ATO) for the delivery of fixed wing training, as the sole qualified gyroplane instructor. Oversight of his gyroplane training standards was achieved through the triennial revalidation of the instructor’s training qualification, conducted by an examiner who sat on the Panel of Examiners. The instructor managed and documented the progress of students by an online application. In the ‘Pilot’s Logbook’ section, students could view the objective of each lesson, including a list of key topics covered by the instructor. It also contained comments from instructors and provided an option for students to add their own comments. Footnote 13 An instructor holding a FI(G) with restrictions requires the supervision of an individual holding an FI(G) without restriction.

33 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Student pilot information The student started training towards a PPL (aeroplane) in August 2014. He achieved 71 hours flying experience but in January 2018 stopped flying for medical reasons. He then decided to gain a PPL on a gyroplane and started his flying training in September 2019, undertaking all his instruction on G-CKYT. The student was assessed as a confident, diligent, and able student, who presented no supervisory concerns to his instructor. He demonstrated transferable knowledge from his previous fixed wing experience which conferred benefits in the initial phase of the course. However, when developing the skills for takeoff and landing his progress was reported to be of a standard expected for most students. This was attributed to the significant differences in the flying techniques used in gyroplanes and fixed wing aircraft. Following a period of consolidation of these gyroplane techniques, he undertook his first solo flight on 6 November 2020, six days prior to the accident, which was conducted without incident. He did not undertake any further flights until the day of the accident. Gyroplane training syllabus CAA Standards Document 44 included a training syllabus largely developed independently by one of the members of the Panel of Examiners and approved by the CAA. This was used by the operator in training the student and comprised 38 lessons arranged into eight phases. The syllabus differs from fixed wing training in that the gyroplane student is not expected to be ready to fly solo until after lesson 31. This is attributed to the level of difficulty of gaining proficiency in the techniques for takeoff and landing. The licensing requirement for gyroplanes is a minimum of 40 hours of instruction of which 10 must be supervised solo. Up to the accident flight, the student had achieved 45 hours dual instruction and 1 hour 45 minutes solo. Lesson 23: Higher bank angle level turns and turning in relation to ground reference features The objective of this lesson was to teach a student how to maintain airspeed, height and balanced flight during turns using up to 45° angle of bank, and how to turn around a point on the ground maintaining a constant distance from it. The angle of bank is assessed visually by reference to a horizon reference line taped onto the windscreen. The manoeuvre requires the application of significant back pressure on the control stick to prevent the gyroplane’s nose from dropping and up to near full power to maintain airspeed. For turns around a point on the ground, in order to maintain a constant distance from the point, the student has to compensate for drift caused by the wind. This is achieved by varying the angle of bank during the turn. The student’s instructor stated that in his experience bank angles of 45° or greater required ‘application of full throttle (5,600 rpm) and significant back pressure on the control stick’. He stated that in comparison to this, initiating a turn using approximately 30° angle of bank at 60 to 70 mph with 4,800 rpm set, would require an increase in engine power of approximately 200 rpm during the turn and some back pressure on the control stick to maintain height and speed.

34 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The student conducted lesson 23 on 29 July 2020 and consolidated the technique on 5 November 2020 during pre-solo practice with his instructor. The instructor noted in the student’s training record after the flight on 29 July that the student required ‘more focus on the horizon reference line during the exercise, and less focus on the point we are turning around’ and cautioned him, ‘Don’t go too far on the high bank turns’. The student added the comment: ‘fun high bank turns, but easy to go too far’. The training record contained no further entries regarding high bank angle turns. The instructor reported that while turns using up to 45° angle of bank should be well within the skills of a pilot by solo stage, students would normally be expected to use a maximum of 30° angle of bank when flying solo unless specifically briefed. The instructor reported that he had not given the student specific exercises to fly but had directed him to fly around the training area to gain more experience of handling the gyroplane. His expectation was that the student would not use more than 30° angle of bank, but this was not explicitly briefed to the student. Lesson 24: avoiding, recognising and recovery from unusual attitudes During this lesson students were taught to be able to understand why unusual attitudes14 occur, how to recognise them and how to safely recover the gyroplane back to controlled flight. A particular manoeuvre taught was the recovery from a descending steep banked turn, also referred to as a ‘spiral dive’. This was taught by the operator in two forms: a ‘slow’ spiral dive at a manoeuvre entry speed of approximately 40 mph, and a ‘fast’ spiral dive at approximately 70 mph. The instructor would place students into the manoeuvre using up to 30° angle of bank, with the student following through on the controls, then hand over control to the student to recover to straight and level flight using the following technique:

● Reduce power.

● Select a level attitude in the order of roll, pitch then yaw.

● Maintain a level attitude until the rotor rpm reduces back to the normal level for cruise conditions.

● Once rotor rpm is stable, increase power to a cruise setting and continue flight. The student received training in this technique on 13 March 2020 and again on 29 July

1. On both occasions they were flown over Munlochy Bay. The instructor informed the

AAIB that students were not permitted to practise this technique when flying solo before they gained their pilot’s licence. The instructor stated that he would not expect the descent rate to exceed about 1,000 ft/ min when a student properly recognised and recovered from the unusual attitude as taught, before it developed into a spiral dive. Footnote 14 An unusual attitude is an unintentional, unanticipated, or extreme aircraft attitude.

35 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The instructor further commented that as part of the lesson on climbing and descending turns, the bank angle is incrementally increased which can result in a significant increase in descent rate up to 1,500 ft/min. He stated descent rates above 1,500 ft/min were in any case unusual in normal gyroplane operations but descent rates of up to about 2,000 ft/min may be achievable in a spiral dive if the nose is lowered to increase airspeed as part of the manoeuvre. He stated that 2,000 ft/min was considered safe and within the ability of most instructors but is ‘pretty extreme’ and ‘not something that would ever be performed by a student’. NPPL skills test accuracy The instructor stated that for the NPPL skills test the relevant tolerances for flying accuracy during normal manoeuvres were:

● Airspeed: ±5 kt.

● Altitude or height: ±100 ft. Training for avoiding low g Standards Document 44 Standards Document 44 contains the syllabuses for all gyroplane licences, including instructors and examiners. In the section on the General Flying Test for the award of a PPL(G), it states: ‘The syllabus lists all the items which should be covered during training and which may be examined during the Flight Test. The applicant will be required to demonstrate a satisfactory standard of knowledge and handing in all items included in the Flight Test.’ However, there was no guidance provided on the need to teach or examine recognising and avoiding low and negative g flight profiles. In contrast, the awareness of the hazards of low g is included in the syllabus of theoretical knowledge for a PPL(H)15 and in the UK CAA Helicopter Flight Examiner Manual16. The instructor The instructor reported that he discussed the subject of low and negative g throughout the PPL(G) course, including reference to video footage of historic gyroplane accidents. Documentary evidence provided to the AAIB indicated that the emphasis during training was placed on avoiding pushing the control stick forward too quickly or abruptly during manoeuvres, and the avoidance of over-controlling. This reflected warnings and advice contained in the manufacturer’s POH. Footnote 15 CAP1340: Alternative Means of compliance 1 FCL210; FCL215 Syllabus of theoretical knowledge for the PPL(H), October 2015. 16 UK CAA Helicopter Flight Examiner Manual, Version 1, 23/04/2021.

36 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Neither source covered the potential for a transient reduction in the load factor below 1, hence unloading of the rotor, during a turn-reversal manoeuvre. Medical information While undergoing training on aeroplanes, the student held an EASA Class Two medical. His last EASA Class Two medical examination was on 30 December 2016, at which he had an Operational Safety Pilot (OSL) restriction17 added due to a medical condition. This medical condition subsequently caused him to stop flying. Medical records indicated that the student then received successful treatment for his condition. On 1 September 2020, on the commencement of his gyroplane training, the student presented a Pilot Medical Declaration of fitness to fly signed by his General Practitioner (GP) and dated 12 December 2019. The Pilot Medical Declaration is appropriate for pilots flying an aircraft less than 2,000 kg MTOM. The student provided this declaration on CAA Form SRG 1204, although this went out of use after 25 August 2016 being replaced by an online declaration which does not require a doctor’s countersignature. However, the declaration and GP’s countersignature affirmed that the student met an appropriate medical fitness standard that was acceptable to the CAA. Post-mortem examination did not reveal any evidence of medical incapacitation. The impact forces were assessed as not survivable. Assessment of point of failure from the wreckage trail The recorded GNSS path up to 1249:47 hrs, wreckage location and estimated wind conditions were used to help estimate the approximate point of the rotor head failure (Figure 23). The gyroplane had sufficient height that the lightweight, low inertia debris released during the failure sequence was blown downwind to form a long wreckage trail roughly half a kilometre long. The wind direction at 2,000 ft was estimated by the Met Office but corresponds well to the direction of the wreckage trail. The gyroplane had a groundspeed of at least 70 mph during this period, so the debris would have travelled diagonally forward18 from the point of release. This gives some indication of when the failure must have occurred and is consistent with the period immediately before the data became unreliable. Once the rotor had departed the fuselage, physical evidence from the wreckage shows a rotor blade contacted the propeller, stopping the engine; there was now no other means of influencing the flight trajectory and the fuselage would have fallen ballistically. Given its significant weight and inertia compared to the small debris released at the same time as the rotor head, although it would have been affected by the prevailing wind, it would have maintained its forward speed and fallen faster, reducing the extent of the change in direction and distance it travelled. Footnote 17 This limitation is added to a medical certificate when a pilot is considered to be at increased risk of incapacitation compared to his/her peer group. The holder of the medical certificate must always fly with a safety pilot. 18 Forward relative to the approximate direction of travel at the point of failure.

37 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 2,000 ft Wind: 225/30 Aircraft GNSS track (1s intervals) Wreckage trail 1249:40 1249:47 Main wreckage Rotor head Figure 23 Image showing wreckage trail and prevailing wind direction relative to the GNSS flightpath Tests and research DLR gyroplane flight performance modelling The German national aeronautics and space research centre (DLR) were contacted to assist the investigation based on their extensive knowledge of gyroplane performance modelling and flight testing. The DLR have created an accurate data model of gyroplane flight characteristics, which has been validated by flight testing with an instrumented airframe. The gyroplane on which they based the model and which was subsequently used for flight test validation of the data was an AutoGyro Cavalon. The DLR model was used to simulate a period of reduced g during a turn. This included a number of assumptions which were not taken from the accident flight data but considered a similar typical scenario.

38 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The simulation used assumed parameters of an engine torque of 100 Nm (approximately 75% power), a rotor head roll control angle increasing above 4° and a reducing vertical acceleration (nz) below 1 g. This resulted in a fuselage angle at the rotor head roll pivot bolt (xi_RH) that reaches the maximum available (-8°) in the geometry of the rotor head control system at around 0.3 g. Practically this would result in the roll stop bar on the mast coming into contact with the left side of the gimbal block channel. The time taken for the fuselage angle to reach the maximum available is proportional to the rate at which the vertical acceleration reduces and will vary with increased engine torque, as shown by the top graphs in Figure 24. A faster reduction in vertical acceleration, or a greater torque figure, would result in a faster response at the roll pivot bolt. The torque and rate of vertical acceleration change chosen for the modelling were arbitrary and not taken from the accident flight data, as was the resulting time of 8 secs to reach -8° limit. The bottom left graph shows that although the rotor rpm reduces as the vertical acceleration reduces, it remains within the normal operating limits for the gyroplane, as stated in the POH, of 200-550 rpm. Figure 24 DLR modelling predicting an induced roll angle of the fuselage due to engine torque during flight conditions below 1 g The DLR also provided a static calculation tool for the Cavalon. This allows an assessment, under static conditions, of approximately how much roll control angle input is required at the roll pivot bolt to counter the engine torque induced rotation. In normal 1 g or above flight,

39 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 where the vertical acceleration results in a force acting against that induced by the engine torque, this requires only a small amount of counter control input. However, as the vertical acceleration reduces, the effects of engine torque can become significant and result in the fuselage rotating clockwise (viewed from the rear) about the roll pivot bolt in the gimbal block. Based on the calculation tool, for a Cavalon configured to the same assumed weight and balance as G-CKYT and the engine operating at full power, if the vertical acceleration drops to approximately 0.5 g, then the maximum available opposite roll input may be required to counter the torque of the engine, resulting in possible contact between the mast roll stop bar and the gimbal block. If the vertical acceleration drops below 0.5 g, there would be insufficient control authority to counter the induced rotation without increasing the contact force on the gimbal block. In dynamic operation, if the fuselage is already rotating clockwise about the pivot bolt, reducing the clearance between the gimbal block and the roll stop bar, this could in theory lead to contact occurring at vertical accelerations above 0.5 g. For example, at 0.6 g, if just over one degree of fuselage rotation past the neutral position is present, the required control input to counter the engine torque may result in contact. The DLR modelling and calculation tool only provide an approximate indicator of the likelihood of contact between the gimbal block and roll stop bar but highlight the significance of vertical acceleration, engine power and whether the aircraft is manoeuvring. The DLR calculations confirm that the vertical acceleration can theoretically be above the subjective POH limitations of ‘near weightless’ or ‘low g’ when contact with the roll stop bar occurs. However, the recorded data from the accident flight did not have sufficient parameters to allow the exact circumstances resulting in contact during the accident flight to be confirmed. Mast interface In order to assess the geometry of the mast interface found on G-CKYT, a new production mast was purchased directly from the manufacturer for comparison. This mast had not been used in operation. It was CT scanned to determine the interface dimensions and weld penetration on the roll stop bar. Figure 25 shows that the internal distance between the side plates is 52.2 mm, which was within the drawing tolerance. It also confirmed that the side plates were flat and aligned at 90° to the roll stop bar, which was straight, but the bar measured 62.5 mm, rather than the specified 65 mm.

40 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 25 CT scan of new production mast top Measurements taken from the scan showed that the roll stop bar at its highest points extended beyond the external face of the side plates by 1.4 mm on the aft side and 0.8 mm on the forward side, although the measurement dropped significantly away from the peak. The weld depth at its deepest penetration was 1.99 mm and 1.45 mm respectively on each side, but this also varied significantly across its diameter (Figure 26).

41 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 26 CT scan of new production mast top showing the roll stop bar weld (aft side - top images, forward side - bottom images) According to the design drawing dimensions, for a nominal plate width of 5 mm, the roll stop bar should extend between 1.5 mm and 1.25 mm, depending on manufacturing tolerances.

42 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The mast arrived with an existing witness mark on the side plates. The manufacturer confirmed that these were machine marks, where the faces and weld had been machined flat during manufacture to accommodate the washers fitted during assembly of the roll pivot bolt. (Figure 27). Figure 27 As received part showing damage to weld Assessment of the roll stop bar welds The strength of a fillet weld is based on the throat size (a), shown in Figure 28 as the distance between the two red arrows on the left. The strength can be increased by using a deep penetration weld shown on the right of Figure 28, which increases the size of the throat (a). Figure 28 Weld definitions The throat dimension can’t be easily measured on a finished weld, but it can be estimated using the leg length (z) shown in Figure 28. For an isosceles triangle (equal leg lengths), the throat is approximately 0.7 of the leg length (a ≈ 0.7z). European welding standards EN ISO15614-1 state that where the drawing doesn’t specify weld size, for plate material between 3 and 30 mm thick, the minimum throat size should be 0.5t (where t = minimum plate material thickness) or at least 3 mm to achieve a full strength weld.

43 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 For the roll stop bar and side plate of thickness 5 mm this would give a minimum leg size of 4.3 mm. In order to measure this, the roll stop bar would need to extend at least 4.3 mm from the external face of the side plates. The CT scans show that on one side of the new production mast the bar only extended 0.8 mm at its highest point, this would give a theoretical best-case throat thickness of 0.6 mm. In reality, the height was not consistent across the width of the bar, tapering to less than half this height at the edges of the bar. The CT scans showed that the penetration of the weld reached 0.7 mm at its greatest, but as the extension height tapered across the radius of the bar, it did not significantly improve the throat size. As such, the weld was less than a third of the recommended size. The welds could, therefore, only be considered as ‘tack’ welds used to hold the bar in position, rather than full strength welds designed to carry load. As the mast on G-CKYT was the same, this was considered a consistent feature of production rather than a single quality lapse. The manufacturer was requested to confirm whether they considered that the accident mast and the production mast supplied for testing conformed to the approved design drawing for the component and whether there was any intention to change the manufacturing process to address the findings of the investigation. In response, the manufacturer stated that the gimbal block channel was not expected to contact the roll stop bar in flight and was only intended to act as a control stop on the ground. As such, the welded joint was not anticipated to carry significant load and did not need to be a full strength weld. They considered that there was a lack of evidence, based on their experience gained from the large number of other aircraft currently in service, that a change was required. They did however state they will review the entire mast welding process as part of their product improvement programme. Gimbal block testing to failure A rig test of an assembled mast and gimbal block was commissioned using nC2 engineering consultants at the University of Southampton. The test was designed to apply a load to the side of the gimbal block roll channel, by rotating the mast until the roll stop bar on the mast made contact with the block, then continuing to move the mast to increase the load until the gimbal block failed. To achieve this a test rig was designed to attach the gimbal block to a high load hydraulic press, with a roller cradle to hold the mast and keep the point of load approximately in the same place as it moved (Figure 29). The new production, unused mast and gimbal block were configured with accessory components to be as representative to normal operation as possible. To understand how the loads were transferred through the gimbal block and mast assembly and how the structure responded, four rosette strain gauges were applied on the mast along the box section and two on either side of both of the side plates. One gauge was placed on the roll stop bar, thirteen were fitted to the gimbal block, including the roll channel. One rosette gauge was fitted to each of the brackets attaching the gimbal block to the test fixture. The output of these gauges was logged and also displayed on a screen in real time to identify when the various components started to deform and ultimately fail during the test. The applied force data from the hydraulic test machine was also recorded.

44 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 29 Images of the test machine, test configuration and installed test piece with instrumentation Test conduct Below explosive/ballistic levels, the speed at which the load is applied does not significantly change the way the material reacts. Whilst significantly slower than a flight manoeuvre would have occurred, a speed of 5 mm per minute was chosen to allow time to assess the response of the block and mast assembly during the test and stop if necessary. The force being applied by the hydraulic press was continuously monitored during the test to ensure the test was progressing to plan. At one point in the test, one of the side brackets on the mast (not associated with the test) came into contact with the loading cradle. The test was stopped while the mast was repositioned and then restarted at the same point. Further into the test a loud crack indicated that the gimbal block had started to fail and eventually the load dropped off significantly indicating that load shedding had occurred. As the mast rotated around the roll bolt pivot continuously through the test, the vertical force readings from the test machine were resolved into a load and moment applied at the point of contact between the roll stop bar and the gimbal block. This raw data is shown in Figure 30.

45 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 30 Raw data test results showing the resolved force (blue) and moment acting on the gimbal block (black) The test showed that the gimbal block failed under a moment of 1,500 Nm. Post-test inspection Inspection of the components following the test showed that the roll stop bar had plastically deformed, matching the profile seen on the accident mast. CT scans of the mast following the test confirmed that the bar had deformed slightly more than the accident mast, with the displacement from straight at the centre measuring 3.3 mm compared to 2.5 mm on the accident mast. The side plates were deformed outwards similar to the accident mast and the roll stop bar welds had failed on both sides, producing the same large gaps between the bar and the plate locating hole on the concave side of the bar (Figure 31).

46 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 31 Plastic deformation of the roll stop bar post-test (top) compared with the accident mast (bottom) The gimbal block had also failed in a similar manner to the accident block, though as the force applied was only in the horizontal plane, only the vertical cracks were present. However, they were located in the same positions and had progressed to similar extents. Figure 32 shows this by highlighting the same cracks with the same-coloured arrows. It also shows the identical indentation marks and distortion left on the side of the channel by the roll stop bar.

47 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 32 Cracks in the gimbal block post-test compared to the same cracks seen on the accident gimbal block The brackets holding the gimbal block to the test rig had also deformed in a similar manner to the ones from the accident, with the same elongation of the bolt holes. The brake block assembly also showed the same rotational distortion. Load analysis Assessment of the load at which the damage occurred to each component was calculated based on the data from the strain gauges. The roll stop bar started to plastically deform under a moment or torque of 300 Nm. A theoretical calculation for the bar material shape

48 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 and strength indicated that a simply supported beam (not fixed at either end) would start to yield at a load of 7.7 kN or 140 Nm of torque in this application. This demonstrated that the welds restrained the bar to some extent. However, the theoretical calculation for a fully supported beam (completely held at both ends) shows it would have sustained 90 kN or 1,620 Nm before it yielded in plastic deformation. The indentations formed on the side of the gimbal block channel where the roll stop bar was in contact with it, resulted from a torque of 1,500 Nm or an 83 kN load being applied. Due to the distortion of the bar, this was effectively transmitted as a point load of approximately 41.5 kN on each end of the roll stop bar. If this load was applied to the gimbal block material with a Brinell Hardness test indenter, it would result in spherical dents of diameter 7 mm. The sizes of the indentations on the gimbal block were 5 mm at the forward end and 6 mm at the aft end. This shows a similar order of magnitude. The difference in size can be explained by the fact that the bar was continuing to bend under load, resulting in the maximum point of stress continuously moving and the load increasingly acting tangentially to the block, unlike the indenter which applies a constant, perpendicular load. The widest parts of the indentations on the accident gimbal block were obscured by secondary damage, so it was not possible to do a direct comparison. The gimbal block failed at an applied load of 83 kN during the test. A theoretical calculation based on the material thicknesses at the crack locations and the quoted Ultimate Tensile Strength (UTS) of the material, suggest that this load should have been 91 kN or 1,642 Nm. Possible reasons for the discrepancy are:

● Features of the gimbal block, such as the grub screw hole acting as a stress raiser.

● A reduction in the UTS due to the material grain orientation used in the gimbal block.19

● The radii of the gimbal block corners acting as stress raisers. Test conclusion The results from the test showed that the load transfer through the gimbal block was quite complex, but that the test closely replicated the damage to the gimbal block retrieved from the wreckage of G-CKYT. Although only torque loads transferred through contact between the mast roll stop bar and the gimbal block were applied during the test, the damage seen on the gimbal block, support plates and mast, demonstrated that this contact had also occurred during the accident sequence. Footnote 19 The gimbal block is extruded aluminium, which gives a longitudinal grain orientation. The maximum UTS is achieved in this direction. In the transverse direction (90° to the grain) the UTS typically reduces by 15-20%.

49 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Analysis Physical and eyewitness evidence confirmed the rotor head of G-CKYT separated in flight, causing the fuselage to fall to the ground in a non-survivable accident. The impact resulted in a post-crash fire, following ignition of the highly flammable fuel released by the disruption of the fuselage structure. The investigation centred on determining the cause of the separation. There was no evidence of the pilot suffering any in-flight incapacitation. He had already completed two flights that morning, the preceding flight lasting over an hour. Despite this, the student had rested between flights and had not displayed any signs of fatigue to his instructor. The instructor assessed the weather conditions as suitable for the student’s solo flights, with only light winds along the runway at Inverness Airport. The instructor regarded winds aloft to be ‘not challenging’ while the Met Office described the conditions as ‘benign’ in their aftercast. The possible temporary increase in wind speed reported in the TAF was not due to occur until after the student’s return. The forecast wind speed aloft was not considered a problem by the instructor who had considerable experience operating in the area. The student had made no adverse comments on his return from his previous flight, not long before, and there was no evidence of the conditions causing him a problem. The pilot of the aircraft that had flown through the same area as the gyroplane over Black Isle only shortly before the accident, and at a similar altitude, had also reported smooth flying conditions. Due to the disruption caused by the impact, it was not possible to determine whether the ballast had shifted during the flight. Equally, it was not possible to determine whether during the accident sequence the pilot had reverted to fixed wing flying techniques. Whilst both are possible, it is considered that these and the other operational factors are unlikely to have directly contributed to the accident. The investigation determined the aircraft had been correctly released to service with no contributory maintenance issues identified.

Gimbal block failure sequence A rig test conducted by the investigation applied a load to the left side of the gimbal block roll stop channel, by rotating the mast about the roll pivot bolt until the roll stop bar pressed against it. As the force with which the bar pressed against the gimbal block was increased, the welds locating the roll stop bar in the mast side plates failed. This allowed the ends of the bar to move, which meant the roll stop bar now started to bend. As a consequence of this change in shape, the loading on the gimbal block changed from being evenly distributed along the length of the roll stop bar, to being focussed on the two contact points at each end. This significantly concentrated the load, resulting in indentation marks forming in the aluminium of the gimbal block. As the load continued to increase, cracks started to form in the block and at a load of 83 kN (1,500 Nm torque applied at the mast) the block was no longer able to resist the applied force.

50 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Laboratory analysis of the failed rotor head components identified very characteristic damage to the gimbal block, including indentations and distortion on the left side (looking forward) of the roll stop channel and vertical and horizontal fractures through the body of the block. Detailed inspection of these fracture surfaces confirmed they were caused by continuous overload from an applied force greater than the UTS of the material. The roll stop bar on the mast was also distorted and the welds attaching it to the mast side plates had failed on both sides. In addition, the support brackets between the block and bridge, and those which held the brake block, showed twisting deformation resulting from a torque load. The damage to the gimbal block and mast from the test closely matched that seen on the accident gimbal block and mast. The differences were considered to be due to the fact that the test was stopped before complete fracture of the block (for safety reasons) and that only the torque (or rotational) load component from contact between the mast roll stop bar and the gimbal block was applied during the test. The indentations, deformation and fracture damage seen on the gimbal block, the twisting deformation of the support plates, and the deformation of the mast support plates, welds and roll stop bar, all demonstrated that the same contact between the roll stop bar and the gimbal block had occurred during the accident sequence. The damage also demonstrated that the resulting loads had been the likely cause of the vertical crack features seen on both the accident and rig test blocks. While there would almost certainly have been a difference in the rate at which the load was applied between the accident flight and the rig test, this would not have affected the response of the material and as such could be discounted. In flight, the gyroplane fuselage hangs from the roll pivot bolt fitted to the gimbal block. This also applies a vertical component to the force on the gimbal block equal to the weight of the fuselage (Figure 33). The damage to the accident gimbal block showed both vertical and horizontal fracture surfaces, with the vertical cracks occurring first, as seen in the rig test. Analysis of the fracture surfaces confirmed the overload had occurred during a single continuous event. As the cross-sectional area of the block carrying the weight of the fuselage was reduced by the vertical cracks during the accident flight, the horizontal cracks also formed due to overload. These cracks joined together resulting in a section of the gimbal block breaking off (Figure 33), allowing the rotor to detach from the fuselage. The separation of the rotor head was therefore caused by a structural failure of the gimbal block from exposure to dynamic flight loads during a single event.

51 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Figure 33 Simple illustration of the final failure sequence of the gimbal block Flight sequence north of Avoch The student performed a turn north of Avoch prior to tracking towards Munlochy Bay. Radar data from the previous flight also shows that the student performed a number of orbits both to the left and right throughout the flight. The turn north of Avoch was at an estimated bank angle of 30° which was considered by the instructor to be a ‘normal’ turn. However, during the turn, the airspeed fluctuated between approximately 50 and 92 mph and the altitude reduced by 193 ft. Vertical speed also fluctuated, reaching up to 1,000 ft/min and, as the turn was completed, the aircraft was descending at approximately 500 ft/min with an increasing airspeed. This indicated that the student was having difficulty keeping the aircraft level and at a constant airspeed, which may not be considered unusual for a student pilot. However, his training record did not indicate that he had a history of issues with the accuracy of his flying, and it is possible that the student may not have been attempting to maintain specific parameters as closely as might be the case with an instructor on board. Flight sequence leading to failure The wreckage trail identified an approximate point by which time the rotor head must have already detached from the mast. This was around the time when the recorded data recovered from the GNSS became unreliable. Immediately prior to this, the student pilot had performed a turn which started at an estimated bank angle of 35-40° to the left, but then increased up to approximately 45°. From the instructor’s comments, 45° was considered to be a ‘steep turn’. While the bank angle was an estimate, it confirms this turn ended steeper than the earlier turn to the right over Avoch and likely required the application of significant backstick to prevent the nose dropping. This would have increased drag, requiring more engine power to maintain height, probably close to full power. These inputs required coordination to achieve a level turn.

52 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The instructor had not explicitly briefed the student to use only up to 30° angle of bank and had formed the expectation that he would limit himself to this. The instructor believed that this limitation was implicit in his briefings to ‘fly around the Black Isle’ to gain more experience of handling the gyroplane. During the final left turn, the recorded data shows that the student pilot had allowed a rate of descent to develop in the initial part of the turn, which was then reversed to a moderate climb. As the turn continued, the vertical speed in the climb reduced, possibly due to the student pilot relaxing the back pressure on the control stick in anticipation of rolling out of the turn. Just before the structural failure, the aircraft rolled from a left turn directly into a right turn which would have resulted in the fuselage starting to swing from the right to the left (viewed from behind). By this stage, a recorded instantaneous rate of descent of nearly 1,500 ft/min had developed which was above the rate by which the student would have previously recovered during training and by which the instructor would have expected recovery action to have been taken. The student’s training record indicated that he actively participated in the training feedback process and demonstrated an awareness of the importance of flying within the POH guidance. A level turn, if flown accurately, should not in itself have been hazardous and there was no evidence to suggest the student would deliberately choose to enter a manoeuvre that would result in a high descent rate or low g. It is therefore considered likely that the sequence of manoeuvres inducing a high rate of descent was an inadvertent result of the pilot’s difficulty in maintaining a level turn. The recorded rate of descent continued to increase, reaching approximately 3,200 ft/min two seconds later; a higher descent rate than would be achievable in normal operation. Given the final position of the fuselage, the recorded track data and the limitations in rate of descent achievable for an intact Cavalon, the investigation determined that the very high rate of descent seen in the data, if accurate, most likely occurred after the rotor became detached. Failure sequence It was not possible to determine the exact point of failure of the rotor head but, based on the recorded data, from 1249:43 hrs onwards the vertical acceleration was decreasing below 1 g as the aircraft rolled from the left into the right turn. The combination of reducing bank angle and reducing vertical acceleration identified by this analysis suggests that the rotor head was unloaded enough for a few seconds as the pilot transitioned between left and right roll manoeuvres to initiate the sequence of reactions which likely resulted in critical contact between the gimbal block and the roll stop bar. Though not identical, given the variation in assumptions used, the accident sequence was consistent with the DLR’s theoretical modelling. This demonstrated that even with vertical accelerations above ‘near weightless’, the torque from an engine at high power causes an induced rotation of the fuselage clockwise about the roll pivot bolt to the extent that there is insufficient roll authority to correct it.

53 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 When the gyroplane transitioned between the left and right roll, the fuselage would have swung across with significant momentum. The torque induced rotation of the fuselage would probably have felt to the pilot like an uncommanded roll to the right, likely triggering an instinctive left roll input to counter it. This input would have changed the angle of the rotor relative to the horizontal. The lift and gyroscopic force and the weight of the rotor assembly opposing it effectively acts at the rotor pivot bolt which is a fixed distance away from the roll pivot bolt. The gyroscopic forces, the horizontal component of the lift and the weight vector would therefore create a moment around the roll pivot bolt and thus the contact point between the gimbal block and the roll stop bar. This would act to oppose the moment created by the fuselage rotating in the opposite direction, driven by the engine torque and inertia. This would likely have resulted in an impact between the bar and the gimbal block channel sufficient to generate the force required to cause the block to fracture, as confirmed during testing (Figure 34). 2) Transition from left to right turn, combined with the effect of high engine torque in low g, caused the fuselage to swing the other way. 1) Sustained left turn (viewed from behind) caused the fuselage to swing to 90° to the rotor 3) Control input back to the left reduced the clearance from the roll stop bar to the side of the channel and created an opposing moment, as the fuselage swung across with high momentum in a descent, resulting in contact. Figure 34 Response of the fuselage to the roll reversal inputs Blade flapping It is possible under very low to zero g conditions that the rotor rpm can reduce to the extent that blade flapping occurs leading to contact between the blades and the teeter stop as the blade flaps downwards on the retreating side. If this is allowed to continue it can reach the stage where loss of control of the rotor head occurs. However, this level of blade flapping is more typically experienced on the ground when the rotor rpm starts off low before decaying further. There were superficial marks on the accident rotor blades showing that contact with the teeter stops had occurred, however they were different on each blade which is inconsistent with blade flapping and there was no plastic deformation of the blade surface, or the teeter stops. They were, however, consistent with other damage on the blades which occurred as they hit the ground following release from the gyroplane. Given that rotor rpm increases during a steeply banked turn, and the period of low g in question was very brief, it is also unlikely that it had reduced sufficiently as the rotor unloaded to make blade flapping a factor in this accident. This is reflected in the DLR modelling which shows that even over a period

54 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 of 8 seconds below 1 g and reducing to a minimum of 0.3 g, the rotor rpm does not drop outside of the normal operating range. As with normal operation the forces generated by the rotor react through the rotor pivot bolt without requiring contact of the teeter stops. Roll stop bar welds The manufacturer stated that the roll stop bar and gimbal block were not intended to come into contact in flight and as such the welds on the roll stop bar were not designed to carry any significant load. However, the welds inspected were generally of poor quality with regard to size, shape and consistency. The design drawing for the mast assembly specified a fillet weld, but did not specify the throat size of the weld required. As such, there was no consistency in the strength of the weld and no easily measurable quality inspection criteria which could be applied to the welds during production without conducting x-ray inspections20. None of the welds inspected on the accident or test mast met the basic requirements for the definition of a fillet weld and could not meet the minimum fillet weld throat size recommended by the European welding standards, because the roll stop bar length was specified to be too short by the design. The roll stop bar on the mast supplied for testing did not meet the drawing requirements for the bar length and the production process required part of the weld to be intentionally machined away to accommodate the washers on the roll pivot bolt, further reducing its strength. While not causal to the accident, a key element of the failure sequence of the gimbal block was the failure of the welds holding the roll stop bar in position. Rather than being structural welds, they effectively just located the bar in position and failed under a relatively low load. Theoretical analysis showed that had full strength welds been used, they would have remained intact under a much greater load, the roll stop bar would then not have started to deform at a low load, maintaining an even distribution in the load transferred to the gimbal block and allowing the combined structure to support a load greater than that which failed the block in the practical test. While it was not possible to determine the exact load that was experienced by the gimbal block and mast during the accident, it can be stated that had full strength welds been present, the capacity to withstand contact loads between the gimbal block and the roll stop bar would have been greater, providing an increased safety margin in the event of unintended contact. Contact between roll stop bar and gimbal block in flight The conical impressions on the side of the gimbal block channel resulting from contact with the roll stop bar seen on the accident block, had also been seen previously in several takeoff accidents on this gyroplane type. Although the reasons for contact in these scenarios were different from the accident flight, it appears the consequences of the contact were not investigated any further. The manufacturer stated that contact was not intended to occur in flight and as such there was no requirement to consider it or design the structure to be strong enough to resist it. This approach is supported by the wording of the relevant certification requirement T675, which only requires the control stop to withstand loads intentionally applied by the control system design. Footnote 20 X-ray inspections were not used as part of the production process.

55 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Roll control inputs under normal circumstances are small and within the 8° of clearance available. Equally under normal rotor load factor (≥1) the fuselage would rotate perpendicular to the rotor in a turn, maintaining the clearance rather than being subject to engine torque induced rotation in the opposite direction. This investigation showed that there is a transition point where contact can result. The lack of any previous record of other complete failures of the gimbal block would suggest the degree of contact between the roll stop bar and gimbal block which resulted in the accident was unusual. Contact between the gimbal block and roll stop bar whilst airborne was not considered during the design of this type of rotor head. A minimum threshold force is required to leave a permanent impression in the gimbal block material if contact does occur. There is no inspection requirement in place to capture in-flight contact events, and inspection of the gimbal block is only routinely conducted after a ground contact. Damage to the gimbal block, if found during generic maintenance, would likely result in the gimbal block being rejected. However, there are no specific inspection criteria in the maintenance programme, or as the result of an in-flight event, targeted at finding gimbal block damage, identifying and recording the fact it had occurred in flight. Thus, there is no record of the reason for replacement of damaged gimbal blocks that would provide supporting evidence on the frequency of in-flight occurrences. As such, there was no evidence available to the investigation, other than the accident flight, to confirm under what exact circumstances contact to any extent could occur in flight on gyroplanes fitted with the Rotorkopf III design. The small control angle range of 8° and the undamped, free rotation of the fuselage around the roll pivot bolt means that, other than through the actions of the pilot, there is nothing to prevent contact occurring. Yet there is no means of indicating to the pilot how much margin to contact remains, nor any warning for the pilot of when contact is occurring. The manufacturer stated that they did not design the mast and gimbal block interface to be able to withstand a specific contact force because they did not anticipate contact would occur in flight. However, there is no supporting data to assess what safety margin from contact (if any) is provided during flight within the approved envelope, what manoeuvres flown with what parameters could result in inadvertent contact, or what loads on the gimbal block could result from contact if it does occur. As such, it was not possible to assess whether the manufacturer’s approach was reasonable. Additionally, there is no specific requirement within BCAR Section T which addresses whether unintended control stop contact should be anticipated in flight nor what level of load the structure should withstand, if the possibility of unintended contact cannot be definitively excluded. Based on the evidence available to the investigation, it appears that the manufacturer’s approach to the issue of contact has been accepted by the airworthiness authorities without comprehensive supporting evidence. The investigation has determined that this accident likely resulted from a flight manoeuvre which was initially within the approved envelope of the gyroplane but then, likely inadvertently, resulted in a vertical acceleration of less than 1 g. This led to induced torque rotation from the engine which, combined with a reversal of the roll direction, resulted in catastrophic contact between the gimbal block and the roll stop bar.

56 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 The negative load factor element of the structural requirements was not demonstrated by test, but was based on a theoretical assessment of a simple assumed load path. Whilst the POH prohibits conducting low g manoeuvres, it doesn’t specify the exact margin below 1 g where the risk of damage exists. The POH quotes structural limits of -1 g and -0.5 g but emphasises the need to respect the in-flight operating limits at all times. The in-flight limits are, however, not specific and refer only to ‘low g’ and ‘near weightlessness’. This may lead a pilot to assume the stated structural limits provide a safe margin with regard to the risk of component failure. Operating within these limits also relies on the pilot’s ability to assess g without reference to a suitable indication or warning system, neither of which are installed on the aircraft. The investigation found no supporting research data to determine how accurately a pilot can sense g values less than 1 g to support this approach. Mitigation of risk of contact There are typically three generic risk mitigation routes which are used within aviation, either individually or in combination. These are:

1. Operational limitations.
2. Structural design and testing.
3. A safety case based on probability of occurrence demonstrating a failsafe

design. Applying these to the specific issue of contact between the gimbal block and the roll stop bar would require the following: 1) Publishing evidence based, detailed and specific operational limitations, including an appropriate safety margin, which if observed will ensure damaging contact does not occur, and providing the necessary indication or warning system to ensure pilots can accurately operate within those limitations. This approach will also require a supporting training syllabus and guidance material to increase awareness of how to conduct approved manoeuvres within the published limits and the correct recovery techniques to avoid unintended exceedances. 2) Defining limit and ultimate loads for the gimbal block and mast, using an appropriate safety factor and based on the highest dynamic loads which can be encountered from any level of contact between the roll stop bar and gimbal block resulting from manoeuvres within the approved flight envelope. This should take account of inadvertent contact which can be reasonably foreseen from conducting approved flight manoeuvres with a defined margin of handling error or inaccuracy. All components should be designed and tested to demonstrate that they meet these defined load requirements without permanent deformation in the case of limit load or without failure for ultimate load.

57 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 3) Compilation of a system safety assessment which demonstrates that based on supporting evidence the probability of occurrence of catastrophic contact between the gimbal block and the roll stop bar is extremely improbable and does not result from a single cause, and that hazardous contact is extremely remote. However, option three is based on the common certification regulation 1309 found across both EASA and FAA certification requirements for fixed and rotary wing aircraft. It is typically used for assessing the reliability of system operation but can take account of the structural implications of a failure of that system. Given that there is nothing in the control system or operating limitations to prevent contact with the control stops and no supporting evidence that contact cannot occur under normal operation, such contact cannot be considered a failure of the system. Requirement 1309 is also not included or referenced in BCAR Section T. This effectively precludes option 3 as an appropriate mitigation in this case. When this accident was discussed with the CAA, they stated that their preference was to avoid pilots operating in any flight phase where contact with the roll stops could occur. This is a valid approach to mitigate the risk of structural failure, but as highlighted in paragraph 1) above, it requires limits to be well defined, identifiable by the pilot in flight with relevant training provided. The investigation recognises that this issue may not be unique to the Rotorkopf III rotor head and may affect a number of other gyroplane designs with a simple roll pivot rotor head design. However, as the accident occurred to a gyroplane fitted with the Rotorkopf III rotor head, a recommendation relating to this specific rotor head is appropriate. To ensure that actions to mitigate the risk of contact are both independently assessed as adequate and mandated where appropriate, the following recommendation is made to the UK CAA as the regulator responsible for continued airworthiness of all models of gyroplanes fitted with the Rotorkopf III certified under BCAR Section T. Safety Recommendation 2024-017 It is recommended that the Civil Aviation Authority introduces mitigations to reduce, as far as reasonably practicable, the risk of a catastrophic failure resulting from contact between the gimbal block and the roll stop bar on all gyroplanes fitted with the Rotorkopf III rotor head and those of similar design. In order to address similar risks which may exist in other gyroplane designs submitted for certification in the future the following Safety Recommendations is made: Safety Recommendation 2024-018 It is recommended that the Civil Aviation Authority reassess the requirements and acceptable means of compliance in BCAR Section T for issuing approvals to gyroplanes, in light of the failure mode identified from the dynamic loading of the gyroplane rotor head in flight, to ensure manufacturers demonstrate to an acceptable level, through appropriate test and/or analysis, mitigation of the risk of catastrophic structural failure from dynamic loads in flight.

58 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Pilot training and awareness The investigation highlighted the criticality of pilot awareness of the load factor being applied to the rotor during all flight manoeuvres. Training is an essential element of building this awareness, however, the investigation also identified that there was no relevant guidance for gyroplane instructors and examiners in Standards Document 44. Therefore, to ensure standardisation of training delivery and examination of the subject of low g manoeuvres in gyroplanes, the following Safety Recommendation is made to the CAA. Safety Recommendation 2024-019 It is recommended that the Civil Aviation Authority publishes guidance on the subject of rotor load factor during flight manoeuvres for the theoretical training and testing of pilots undertaking the gyroplane PPL syllabus and the gyroplane instructor and examiner qualifications. Certification G-CKYT was certified as a permit aircraft, which has the lowest level of airworthiness design validation and as such is subject to commensurate limitations on its operation. Given historical issues around the safety of gyroplane designs, for use in the UK, the Cavalon was required to comply with certification requirements specified in BCAR Section T. The introduction to BCAR Section T is clear that it is only intended for use in certifying permit aircraft, and this is reflected in the relatively simple specification and compliance requirements it contains. This was typified by structural requirement T337, which only required the consideration of limited vertical static loads and the use of a simple static test to demonstrate compliance. This contrasts with the testing and analysis which models the more complex real-world dynamic response and associated complex structural loads necessary to obtain a full type design approval under EASA CS-23 or CS-27. However, in the case of the Cavalon Pro, BCAR Section T was also used as the basis for issuing a Certificate of Airworthiness, which allows the aircraft to be used for commercial work. This change in purpose normally increases the analysis and testing requirements imposed on a design and would typically be associated with more stringent and demanding certification compliance requirements. For the Cavalon Pro this did result in some additional compliance requirements added through CRI E-01, but structurally the Cavalon Pro is the same design as the basic Cavalon, and no additional compliance testing was required to certify it. The manufacturer stated that they extensively compared the requirements in BCAR Section T with those of EASA CS-VLR, which is used to issue Certificates of Airworthiness on very light helicopters. The CAA and the manufacturer presented a case that a comparison with the requirements of EASA CS-VLR is a more appropriate benchmark, given the size and weight of the gyroplane. However, EASA CS-VLR is also a simplified airworthiness code used for certifying light helicopters which are primarily used for leisure and pilot training activities only. As the Cavalon Pro is intended for commercial use, a comparison with EASA CS-27 or CS-23 is considered more appropriate.

59 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 This accident demonstrated that catastrophic structural failure could occur from flight loads which are encountered inadvertently by the pilot, because such scenarios were not adequately defined and analysed during the certification process, due to the simplified requirements of BCAR Section T. The investigation considered that this represents a safety concern for aircraft intended for commercial operations. As such, the following Safety Recommendation is made: Safety Recommendation 2024-020 It is recommended that the Civil Aviation Authority reassess the certification and acceptable means of compliance requirements for issuing Certificates of Airworthiness to gyroplanes intended to be used for commercial operations, to ensure manufacturers demonstrate, through appropriate test and analysis, mitigation of the risk of catastrophic structural failure from dynamic loads to a level comparable with equivalent Certificate of Airworthiness aircraft certified to design regulations such as Certification Specifications 23 and 27. Component conformity The investigation identified differences between the approved design drawing and components released for service on both the accident mast and the mast supplied by the manufacturer for testing.  These differences related to the roll stop bar length and installation welds.  It is a fundamental airworthiness requirement that production parts conform to the drawing which defines the approved certification standard.  Non-conforming parts must either be rejected by a manufacturing quality control inspection or have an appropriate production permit or concession documented before they are released to service.  There was no evidence identified that either was the case for these components inspected as part of the investigation.  The manufacturer responded that they did not consider the issue to be an airworthiness concern. As this finding was not determined to be causal to the accident, and was based on examination of only two masts, it was considered outside the scope of the investigation to assess whether non-conforming parts had been released to service and what airworthiness risk that may pose.  Assessing the implications of this finding and any necessary mitigation falls within the oversight role of the relevant airworthiness authorities.  For gyroplanes certified and manufactured to UK requirements, design and manufacturing oversight is the responsibility of the CAA. Conclusion The accident occurred when the gyroplane rotor head separated from the mast in flight. Forensic analysis of the failed gimbal block and mast confirmed that the separation was caused by a structural overload failure of the gimbal block from a single continuous exposure to dynamic flight loads.

60 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Testing and analysis of a new production mast and gimbal block closely replicated damage seen on the accident mast and gimbal block, demonstrating that the same contact between the roll stop bar on the mast and the side of the channel on the gimbal block had occurred during the accident. Factual evidence from the accident site and recorded data, together with engineering and operational analysis, allowed the investigation to identify that this contact sequence, and the loads resulting from it, most likely occurred because of the difficulty experienced by the student pilot in consistently flying a level turn to the left, followed by a reversal to the right. This inadvertently resulted in a vertical acceleration below 1 g, briefly unloading the rotor and allowing an unopposed rotation of the fuselage around the roll pivot bolt due to the torque of the engine. Modelling and analysis have shown that contact with the roll stops can occur with this specific sequence of manoeuvres in a flight regime above the ‘low g’ or ‘near weightlessness’ limits defined in the POH. The gyroplane was found to have been correctly released to service with no maintenance issues identified relevant to the accident. A number of operational factors were considered and it was likely that the pilot inadvertently allowed the aircraft to enter a low g flight regime close to, or potentially exceeding, that prohibited by the Cavalon POH. Whilst fully compliant with BCAR Section T regulations, the accident highlighted limitations in the design, testing, manufacture and operating limitations for the Cavalon and Cavalon Pro gyroplane types. These limitations are also likely to be relevant to other gyroplane types certified to this standard. The investigation also highlighted issues with the gyroplane training material regarding the awareness of rotor load factor by pilots. Four Safety Recommendations have been made to address these issues. Safety Recommendations Safety Recommendation 2024-017 It is recommended that the Civil Aviation Authority introduces mitigations to reduce, as far as reasonably practicable, the risk of a catastrophic failure resulting from contact between the gimbal block and the roll stop bar on all gyroplanes fitted with the Rotorkopf III rotor head and those of similar design. Safety Recommendation 2024-018 It is recommended that the Civil Aviation Authority reassess the requirements and acceptable means of compliance in BCAR Section T for issuing approvals to gyroplanes, in light of the failure mode identified from the dynamic loading of the gyroplane rotor head in flight, to ensure manufacturers demonstrate to an acceptable level, through appropriate test and/or analysis, mitigation of the risk of catastrophic structural failure from dynamic loads in flight.

61 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Safety Recommendation 2024-019 It is recommended that the Civil Aviation Authority publishes guidance on the subject of rotor load factor during flight manoeuvres for the theoretical training and testing of pilots undertaking the gyroplane PPL syllabus and the gyroplane instructor and examiner qualifications. Safety Recommendation 2024-020 It is recommended that the Civil Aviation Authority reassess the certification and acceptable means of compliance requirements for issuing Certificates of Airworthiness to gyroplanes intended to be used for commercial operations, to ensure manufacturers demonstrate, through appropriate test and analysis, mitigation of the risk of catastrophic structural failure from dynamic loads to a level comparable with equivalent Certificate of Airworthiness aircraft certified to design regulations such as Certification Specifications 23 and 27. Bundesstelle für Flugunfalluntersuchung (BFU) comments Standard 6.3 of Annex 13 to the Convention on International Civil Aviation provides that the State conducting the investigation shall send a copy of the draft Final Report to all States that participated in the investigation, inviting their significant and substantiated comments on the report as soon as possible. If the State conducting the investigation receives comments within the period stated in the transmittal letter, it shall either amend the draft Final Report to include the substance of the comments received or, if desired by the State that provided comments, append the comments to the Final Report. The BFU, representing the state of design and manufacture, provided comment on the draft Final Report. The BFU Accredited Representative, stated that in their opinion the failure of the rotor was a direct consequence of a complete and unrecoverable loss of control of the gyroplane. As such, the flight loads which resulted in the failure were outside of the design requirements and neither the current design of the Cavalon nor the certification regulations require amendment as a result of this accident. They stated that in their opinion the loss of control of the gyroplane was a result of the actions of the pilot. Several adjustments were made to the report as a result of comments received during the consultation process. However, the investigation did not find evidence indicating a complete and unrecoverable loss of control before the catastrophic failure of the rotorhead, and so this point of disagreement is appended to the Final Report.

62 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CKYT AAIB-27031 Appendix - BFU statement Published: 7 November 2024.

FD06642 ｜ 2018_英国_aaib-investigation-to-silence-twister-g-jinx__Silence_Twister_G-JINX_05-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

36 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 ACCIDENT Aircraft Type and Registration: Silence Twister, G-JINX No & Type of Engines: 1 Ulpower UL260iSA piston engine Year of Manufacture: 2013 (Serial no: LAA 329-15102) Date & Time (UTC): 14 May 2017 at 1330 hrs Location: MOD Abingdon, Oxfordshire Type of Flight: Commercial operation Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 (Serious) Passengers - N/A Nature of Damage: Aircraft and engine severely damaged Commander’s Licence: Private Pilot’s Licence Commander’s Age: 49 years Commander’s Flying Experience: 1,154 hours (of which 259 were on type)

Last 90 days - 15 hours

Last 28 days - 13 hours Information Source: AAIB Field Investigation Synopsis During a formation aerobatics display of a pair of aircraft at MOD Abingdon the engine of the number 2 aircraft lost power and then stopped in flight. The subsequent attempted forced landing onto the runway at Abingdon was unsuccessful. The investigation found that the engine seized following the loss of its oil during the accident flight. Several safety actions have been taken by the engine manufacturer, the owner, and the Light Aircraft Association. History of the flight The accident aircraft was the following or ‘number 2’ aircraft1 in a formation of two Silence Twisters that were scheduled to fly a formation aerobatic display at the Abingdon Air and Country Show, at MOD Abingdon, Oxfordshire. The two aircraft flew from their base in Buckinghamshire and landed at Abingdon prior to their display. During the preparation for the display, the pilot of G-JINX checked the engine’s oil quantity and found it was indicating full. Footnote 1 Aircraft flying in formation may be numbered according to their position in the formation. The formation leader is number ‘1’ and subordinate aircraft are numbered ‘2’ onwards.

37 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 As the aircraft from the previous display positioned to land, the two Silence Twisters took off in formation, and were cleared to commence their display by the display controller once these aircraft had landed. At the time the weather was fine with wind from 260° at 12 kt. Runway 18 was in use with the western side of the runway established as the 150 m crowd line2 (Figure 1). The first few minutes of the display proceeded without incident. However, the accident pilot became aware that G-JINX’s engine appeared to have been underperforming during the ‘barrel’ rolls that formed the second manoeuvre in the display sequence, and transmitted to the leader to reduce power slightly because he was unable to maintain the correct formation position. 150 metre line Crowd line Figure 1 Overview of MOD Abingdon Airfield Footnote 2 150 m is the minimum distance from the crowd line that display aircraft, with a MTOM less than 1,200 kg and speed less than 150 KIAS, are permitted to fly, in accordance with CAP 403.

38 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 After the next manoeuvre, a stall turn, the leader transmitted “are you going to be ok…you’re a bit low” to which the accident pilot replied “i am very low on energy here” followed a few seconds later by “i’ve got a problem, i’m landing off this [manoeuvre]”. At this point G-JINX was downwind, about half way along Runway 18, approximately 200  ft  aal and 200  m displaced from the runway’s centreline. The pilot then converted the aircraft’s remaining excess speed to height and momentarily turned left, to try to displace the aircraft further away from the runway. Whilst the engine was still running the pilot commenced a tight descending right turn to align with the runway. During the turn the engine stopped. The aircraft struck the grass to the east of the runway, with its landing gear and flaps retracted, in a wings-level and slightly nose-down attitude. The aircraft bounced and slid to a halt. The formation leader, who was unaware of the accident, continued with the display. Figure 2 G-JINX after accident (Picture courtesy of Peter Thomas) The display controller declared an aircraft accident and sent all on-site rescue resources to the scene, the first arriving within 50 seconds of the aircraft coming to a halt. The pilot was found slumped forward in the cockpit unconscious. The RFFS could not find a way to open the canopy and, as the pilot’s head was very close to the canopy, did not want to break it. The pilot then regained consciousness and opened the canopy from the inside. He was subsequently lifted out of the aircraft and taken to hospital where it was discovered he had sustained serious injuries. Accident pilot’s comments The pilot of the accident aircraft commented that the difference in performance between the two aircraft, that he experienced during the barrel rolls and the quarter clover, was not unusual. He had experienced comparable differences, with some difficulties staying in position, during previous displays. He added that it is a “subtle art” to remain in close formation given that the aircraft’s engine has 107 hp.

39 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 The pilot commented that he made a “quick scan” of the engine instrument after the barrel rolls, when he was not close to the leader, and during the time that he closed back into the correct position before the next manoeuvre, noting that all engine parameters were within limits. However, he became aware he had an engine problem during the stall turn. At the end of this manoeuvre the engine was still turning and producing power, and despite a brief glance at the instruments, the pilot did not notice any engine warnings. He added it was possible he may have missed any warnings during the ‘glance’, as most of his attention was outside of the cockpit as he subsequently concentrated on the landing the aircraft. Having elected to discontinue the display the pilot made a quick assessment of potential landing options. However, given his low height and proximity to the runway, and with no suitable options ahead or to the left (ie away from the crowd) due to wooded areas and villages, he elected to attempt to land on the runway. At that point the engine was still turning but its power was reducing rapidly. The pilot believed the engine stopped about 2 to 3 seconds before the impact. The pilot recalled that he flew a tighter turn than he would have wished due to the limited lateral offset available to line up with the runway and the presence of the crowd line beyond. He commented that there is an imperative placed upon display pilots not to breach the separation distances from the crowd. Aircraft information General The Twister is classed as a ‘Group A’ aircraft and the basis for its design approval is the EASA Certification Specification for Very Light Aeroplanes (CS-VLA). A Type Approval (TADS 329) was issued by the Light Aircraft Association (LAA). G-JINX was registered on 14 October 2011 and was operated on a CAA Permit to Fly administrated by the LAA. The last Certificate of Validity was issued on 6 April 2017 and was valid until 5 April 2018. Aircraft The Twister is a single-seat, low-wing aircraft fitted with conventional flying controls, a retractable landing gear and flaps. The aircraft is constructed from honeycomb composites, reinforced with carbon and glass fibre, and incorporates a cockpit safety cell manufactured from Kevlar. The aircraft has a safe load factor of +6/-4g at the maximum takeoff weight at a manoeuvre speed of 98 kt. The pilot sits in a reclined position on an energy absorbing seat cushion and is secured by a four-point harness and a separate lap strap. Canopy The aircraft is equipped with a one-piece bubble canopy hinged along the right side. The canopy is unlatched by operating a white handle on the left side of the cockpit (Figure 3). To jettison the canopy, the white handle must be operated at the same time as a second black handle on the right side of the cockpit, which removes the pins from the canopy hinges (Figure 4).

40 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 Figure 3 White canopy opening handle Figure 4 Black canopy jettison handle There are no canopy opening or jettison handles on the outside of the cockpit; however, it can be unlatched by reaching through the small ventilation window and operating the white handle (Figure 5). There were no instructions visible from outside the cockpit explaining how the canopy is opened.

41 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 Figure 5 Opening the canopy from outside of the cockpit The CAA advised that the Certification Specifications (CS) for Very Light Aeroplanes (CS‑VLA) may be considered as guidance for the Silence Twister. Article 807 refers to emergency exits, Article 1541 to markings and placards, and Article 1555 to control markings: ‘CS-VLA 807, Emergency exits (b) The opening system must be designed for simple and easy operation. It must function rapidly and be designed so that it can be operated by each occupant strapped in his seat, and also from outside the cockpit… CS-VLA 1541, markings and placards General (b) Each marking and placard … (1) Must be displayed in a conspicuous place … CS-VLA 1555, control markings (d) When an emergency exit is provided in compliance with CS-VLA 807, each operating control must be red. The placards must be near each control and must clearly indicate its method of operation.’ The cockpit and canopy on the Twister is similar to that used on sailplanes, which are required to conform to CS-22. Article 22.780 details the colour markings and arrangement of the cockpit controls and specifies that the canopy operating handle should be white and the jettison handle red. It also states that if the opening and jettison handle are combined in one handle then the colour must be red. The Silence Twister is not required to conform to these specifications.

42 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 Avionics G-JINX was one of three aircraft built from a kit by the current owner and was fitted with a Dynon Avionics EFIS-D10A (Electronic Flight Information System) ADAHRS3 that incorporated the engine and fuel sensors, and EMS-D10 (Engine Monitoring System) that incorporated the engine and fuel sensors. The EMS constantly monitors several parameters and displays the value as a number and position on a digital gauge. When the parameter is within the normal operating range the needle, or indicator on the digital gauge, will be in the green range. If the parameter is outside of the normal operating range then a yellow or red alert will be generated. This is indicated to the pilot by the background to the numerical value flashing yellow or red. The red alert is also accompanied by a red message across the bottom of the screen. The EMS was capable of producing an audio alert to the pilot, through the intercom, but this function was not enabled at the time. Display smoke G-JINX was fitted with a tank, located behind the pilot’s seat, which contained the oil that was injected into the exhaust pipe during the display to produce smoke. Engine - general G-JINX was fitted with a 107 HP, UL260iSA four cylinder, air cooled, four stroke piston engine and a two blade fixed pitch propeller. The UL260iSA is a modified version of the UL260iS engine developed for use in aerobatic aircraft. The cylinders are numbered as shown in Figure 6 with cylinders 3 and 4 at the rear of the engine. Figure 6 Numbering of engine cylinders Footnote 3 Air Data, Attitude and Heading Reference System.

43 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 The engine is equipped with a dual electronic ignition and a multi-point fuel injection system controlled by an Electronic Engine Management System (EEMS). Prior to the accident involving G-JINX, the engine operating manual stated that the engine was permitted to run on unleaded automotive fuel (MOGAS) with a minimum octane rating of 98 RON, or AVGAS 100LL if the specified fuel was not available. The engine operating manual stated that the UL260iS variants can be run at the maximum power setting of 107 hp at 3,300 rpm for five minutes, and for an unlimited period at the maximum continuous power setting of 95 hp at 2,800 rpm. The engine manufacturer advised the AAIB that providing the other engine parameters are within limits, the engine can be operated at the maximum power setting beyond the specified limit of five minutes. Engine – aerobatic variant The UL260iSA engine is a modified version of the UL260iS engine where changes have been made to the engine casing, oil sump and oil ‘pick-up’ system to allow the engine to be flown inverted for extended periods. The owner of G-JINX worked with the engine manufacturer in developing the aerobatic variant of the engine and was the first customer to fit this variant to his aircraft. At the time of the accident, several hundred UL260iS engines and between12 and 15 UL260iSA engines were in service. The owner of G-JINX had four aerobatic engines which he rotated between his three Twister aircraft that he used for the aerobatic displays. The engine fitted to G-JINX had completed 676 engine hours and was thought to be the fleet leader. The other three engines had accumulated 198 hours, 523 hours, and 540 hours respectively. Engine – oil system The engine oil system is equipped with two oil inlet pipes, with one pipe fitted at the top and one fitted at the bottom of the engine. Both pipes are connected to an ‘inverted oil valve’, which consists of a valve body with three ports and two steel balls kept apart by a spring. Gravitational forces act on the steel balls, which move against the springs to uncover and close the oil inlets at the top and bottom of the engine. The inlet pipe at the bottom of the engine is fitted to a swivel coupling, which can rotate rearwards by 60˚ and forward by 30˚, to ensure that the mouth of one of the inlet pipes is always submerged as the pitch attitude of the aircraft changes. The oil breather system incorporates an oil separator tank which is connected by flexible inlet breather pipes to the top and bottom of the engine. A separator tank is also connected to the engine exhaust by the exit breathe pipe. A valve within the separator tank, operated by gravitational forces, opens and closes the inlet breather valves depending on the attitude of the aircraft. Oil collected by the separator is retained in its tank and the air is discharged through the exit breather pipe to the engine exhaust. The owner reported that it is normal for a small amount of oil to be discharged into the exhaust when the aircraft transitions from erect to inverted flight. The engine oil is cooled by an external oil cooler mounted at the front of the engine. The minimum and maximum oil levels for the engine are 2.5 and 3.5 litres. The normal oil

44 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 pressure depends on the oil temperature, but should be between 30 and 75 psi. The engine operating manual states that the engine should not be operated if the oil pressure is below 14.5 psi. On G-JINX, the owner had set the EMS to generate warnings when the oil pressure was between 20 and 27 psi (yellow warning) and below 20 psi (red warning). Engine – cooling The engine is cooled by ambient air and engine oil. Ambient air is directed through two inlets at the front of the engine cowling and is guided by ducts over the cylinder heads and the upper part of the cylinders. At an engine speed of 3,000 rpm, the oil flows through the engine at approximately 24 litres per minute. This oil is directed to the crankshaft, camshaft, and rocker arms to provide lubrication and cooling. The oil leaving the crankshaft and conrod bearings is directed to the bottom of the pistons where a mist of oil is created that lubricates the piston walls and cylinder bores. The manufacturer advised that it is not unusual for the two rear cylinders (numbers 3 and 4) to run slightly hotter than the front cylinders. Flight manual The aircraft’s flight manual states that the minimum speed with flaps retracted is 44 kt (Vs). It also states the following in the section on emergency procedures: ‘Emergency landing with stopped engine

1. Airspeed 65 kts
2. Make Mayday radio call
3. Fuel selector valve closed
4. Ignition off
5. Lower the undercarriage (if landing area is uneven or soft, land with

undercarriage retracted)

1. Flaps as necessary (30° is recommended)
2. Main switch off (when landing is absolutely certain)’

Aircraft examination The aircraft and engine were initially examined by the AAIB at the owner’s workshop after he had moved the aircraft, with the permission of the AAIB, from the accident site. The engine was dismantled under the supervision of the AAIB and returned to the manufacturer for a more detailed examination. Aircraft The airframe and wings were damaged during the impact; however, the canopy, cockpit area and fuel system remained intact. There was sufficient fuel in each of the two fuel tanks

45 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 for the aircraft to have completed the flight. Both electric fuel pumps operated normally, the fuel was clear and there was no evidence of debris in the gascolator. The EEMS, EFIS, and EMS operated normally when electrical power was applied to the aircraft. The outlet pipe from the display smoke oil tank fractured during the accident allowing oil to leak into the cockpit area. Engine The oil cooler had been damaged during the accident and the owner reported that the engine oil had leaked out subsequently. When the AAIB examined the engine, the oil level did not register on the dipstick. There was no evidence of an external oil leak other than from the oil cooler. The engine could not be rotated by hand. Externally there was no obvious damage other than to the oil cooler and propeller. On removing the cylinder heads it was discovered that the No 3 piston had been badly damaged and a significant section had broken away (Figure 7). There was no evidence of detonation or cracking of the piston. The inside of the cylinder was dry, and marks on the side of the piston and inside of the cylinder bores indicated that the piston had seized in the cylinder. The piston rings and scraper had all been damaged. The remaining three cylinders were also dry and there was damage to the sides of all the pistons and cylinders indicating that the pistons had expanded and had started to ‘grab’ the side of the cylinder. Figure 7 Damage to No 3 piston and cylinder The spark plugs, piston and cylinder heads were a light grey in colour indicating that the

46 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 engine management control system and spark plugs had operated correctly. The connecting rod bearing shells showed signs of wear and slight damage. The piston pins and conrods all had a blue tint which is an indication of overheating. The cooling vanes adjacent to the cylinder head securing bolts were slightly distorted, which normally indicates that the cylinder has overheated. A thorough examination of the oil system was carried out. The oil pump drive was intact, the pump was free to rotate, the filter was clean, and there were no blockages in any of the oilways or pipes. The amount of oil in the breather separator tank was not excessive. As far as could be ascertained, all the oil system components operated satisfactorily and the AAIB could identify no path for the oil to have been lost from the engine other than through the breather system or past the damaged No 3 piston. In summary, the damage to the engine was consistent with a loss of lubrication, and cooling, which resulted in the pistons expanding and seizing in the cylinders. Maintenance Based on information from the owner, the accident flight met the description in Article 11 of the Air Navigation Order as being non-commercial. Therefore, it was acceptable for the aircraft to be used for public air displays while operating on a Permit to Fly and being maintained in an airworthy condition. The LAA offers advice to its members as to how this might be accomplished by the use of their Generic Maintenance Schedule to help owners produce a tailored maintenance schedule. While the UL260iS engine had a recommended Time Between Overhaul (TBO) of 1,500  hours / 12 years, the manufacturer had introduced an initial TBO of 250 hours / 4 years for the aerobatic version of the engine, the UL260iSA. The engine fitted to G-JINX had experienced several faults during its service history, which seemed to increase in frequency after the aircraft sustained an airborne propeller strike at 464 engine hours (Table 1). The maintenance to correct these faults was carried out by the owner, who was an LAA inspector and authorised to inspect this work and sign the Permit Maintenance Release. The manufacturer informed the AAIB that the same design of piston was used in all of its high compression engines4 and it was only aware of the one occurrence of a piston cracking. On 5 March 2016 the manufacturer advised the owner of G-JINX to replace the pistons every 250 hours on aircraft used for aerobatic flights. Footnote 4 Around 400 high compression engines had been delivered at the time of the accident.

47 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 Engine Hours Date Event 0 2009 The engine, manufactured as a UL260iS variant, was fitted to G-RIOT. 225 July 2010 A larger oil cooler was fitted to the engine by the owner. 286 Oct 2010 The engine was returned to the manufacture for conversion to the aerobatic version, UL260iSA. 292 July 2011 The engine was returned to the manufacturer for a new, modi­ fied, crankshaft to be fitted. 404 July 2012 The compressions on #3 and #4 cylinders were found to be low. The owner replaced both cylinder heads and the #3 cylinder. 464 Aug 2013 The engine was returned to the manufacturer for an inspection following an airborne propeller strike, while fitted to G-ZWIP, and then fitted to G-JINX. 483 May 2014 The #1 piston was found cracked. The piston and cylinder were replaced by owner. 530 July 2014 The owner found a suspect crack on the #4 piston. The #2, #3, #4 pistons and cylinders were replaced as a precaution by the owner. A subsequent inspection by the manufacturer found no evidence of a crack on the #4 piston. 530 July 2014 The engine was examined by the manufacturer following the suspected cracked piston. 533 Sep 2015 The oil temperature was reported to be high, but within limits, during a transit flight. The thermostat in the oil cooler was re­ placed. 609 July 16 The compressions on all four cylinders were found to be low. All four cylinder heads were replaced by the owner. 676 Nov 16 The compressions on the #1 and #3 cylinders were found to be low. Both cylinder heads were replaced by the owner. 683 May 17 The engine seized in flight while the aircraft was flying an aerobatic display. Table 1 Service history of engine fitted to G-JINX Recorded information The EMS and EFIS were recovered from the aircraft and their memory downloaded. The EMS memory contained engine data such as oil temperature and pressure, engine rpm and cylinder head temperatures (CHT), recorded approximately every 10 seconds. The EFIS memory contained flight data such as altitude, airspeed, pitch attitude and heading, also recorded approximately every 10 seconds.

48 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 Figure 8 shows flight data from the EFIS starting as the aircraft descended to the start the display sequence and ending with the aircraft on the ground. EFIS times have been adjusted to align them with EMS. Figure 8 shows when the oil pressure dropped below 20 psi (generating an EMS low pressure warning – also plotted with engine rpm from EMS), the point in the flight where G-JINX performs a stall turn and when (based on timing from video evidence) it struck the ground 32 seconds later. Figure 8 EFIS recorded flight data – accident flight

49 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 From video evidence, the right turn and descent to ground impact took 12 seconds, so are not evident in the EFIS data because of the low data sampling rate. However, the turn was through about 180° initially at 65 kt airspeed at about 250 ft aal. During the first half of the turn the bank angle was held at about 45° without significant height loss. The aircraft then began to descend as the bank angle increased and the nose dropped (Figure 9). At just under 60 ft aal the airspeed had reduced to 46 kt, after which the wings were levelled and the nose was raised to a slightly nose-down attitude at impact. Figure 9 G-JINX shortly before ground impact (Picture courtesy of Peter Thomas) Figure 10 shows relevant engine data from the EMS. It indicates that the time between the increase in engine speed (time 33030, which corresponded to the start of the takeoff roll), and the low oil pressure warning was 4.8 minutes. During this period, as the oil temperature increased and the oil pressure decreased, engine rpm varied around 2,800 rpm (maximum continuous) and peaked briefly at 3,151  rpm. The CHTs also increased with the No 3 cylinder operating between 20 and 30ºF hotter than the hottest of the other three cylinders (cylinder No 4). After approximately 4 minutes, the oil pressure had decreased to 30 psi. It then continued to decrease below 20 psi, generating the low pressure warning and reaching zero one minute later. The engine continued to rotate for a further 1.5 minutes.

50 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 Figure 10 EMS recorded engine data - accident flight Data from the accident flight was compared with data from a previous flight during which the aircraft flew the same display routine (Figure 11). The engine rpm, oil pressure, oil temperature and CHT profiles (including the hotter running No 3 cylinder) were similar on both flights until five  minutes after the start of the takeoff roll, when both oil pressures decreased to below 30 psi. During the earlier display flight there was then a 2.5 minute period in which the oil pressure fluctuated between 16 and 30  psi, causing the low oil pressure warning to activate six times.

51 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02

Figure 11 EMS recorded engine data - previous display flight Engine data from the display flights was also compared with data from the aircraft when it was in cruising flight (Figure 12), during which oil pressure was 43(±2) psi and the oil temperature was stable at 175º F (the lower end of the normal range). The CHTs were also approximately 30º F cooler, with the No 3 cylinder again running hotter by about 20º F.

52 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 Figure 12 EMS recorded engine data - earlier cruise flight In total the EMS recorded data for 13 flights. During the 12 flights prior to the accident flight, there were no indications that the engine had operated outside its approved limits.

53 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 Analysis Operational aspects The pilot of the accident aircraft commented that the relative lack of performance compared with the other aircraft, experienced during the first part of the display, was not unusual and that he had experienced comparable differences, with some difficulties staying in formation, before. Accordingly, this lack of performance alone did not provide an indication that the aircraft’s engine was malfunctioning or about to fail. Formation aerobatic flying involves a high level of concentration, in which the following aircraft pilot’s attention must be focussed mainly outside the cockpit. The pilot did not notice the low oil pressure either during the display or the forced landing probably due to the limited internal visual cues and the absence of an audible warning. When the pilot made the decision to discontinue the display the aircraft was at about 200 ft aal, downwind but close to Runway 18, and with limited opportunities to land ahead or to the left in the obstructed countryside beyond the aerodrome boundary. Having committed to landing on the runway, the pilot climbed initially and turned left to provide manoeuvring distance from the runway. He then flew a tight right turn, attempting to roll out on the runway’s extended centreline without overflying the crowd line. However, due to the aircraft’s low altitude and a crosswind from the west, he was unable to complete the manoeuvre. The aircraft flew through the runway centreline and struck the grass a few metres to the east of the runway whilst still descending. The EFIS data indicates that 12 seconds before ground impact, as the aircraft began the turn to the right, the airspeed was approximately 65 kt, which is the speed stated in the flight manual to be flown in the event of ‘Emergency landing with a stopped engine’. During the first half of the turn this airspeed would have reduced as height was maintained. Halfway around the turn, as the bank angle increased and the nose dropped, the aircraft accelerated towards the ground and continued to do so until shortly before impact. However, the recorded speed at approximately 60 ft agl was 46 kt, at which there would have been limited opportunity to reduce the rate of descent, but he was able to level the wings before impact. Engineering General The engineering evidence indicates that the engine operated normally until part way through the flying display when it seized due to a lack of lubrication and cooling. A comparison of the data downloaded from the EMS with a video of the accident flight showed that the engine stopped approximately 7 minutes after the start of the takeoff run. There were no indications to warn the pilot that there was a problem with the engine, other than the low oil pressure discrete which operated for about 2.5 minutes before the engine stopped. All the other engine parameters were similar to those recorded during a previous display flight. There was no evidence from the previous 12 flights recorded in the EMS that the engine had operated outside its approved limits.

54 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 Engine seizure The engine cylinder heads are mainly cooled by air, and the pistons and cylinders by oil. During an aerobatic flight the engine is often not only operating at a higher power setting, but the airflow into the engine will vary depending on the manoeuvre. While the engine oil system has been designed for aerobatic operations, the manufacturer advised that it might not be able to provide oil at the suction side of the pump during the full range of aerobatic manoeuvres, particularly when the engine experiences negative g. During the previous display flight the oil pressure reduced to 16 psi, which is considerably lower than the minimum of 40 psi seen in the cruise, but just above the minimum allowable operating pressure of 14.5 psi. A reduction in the oil supply might not initially be detected by an increase in the CHT or generate any engine warnings; however, the reduction in oil cooling could result in the pistons overheating, expanding, and with the lack of lubrication on the cylinder walls, starting to ‘grab’. This could damage the pistons and ultimately cause the engine to seize. While the pilot reported that there was sufficient oil in the engine at the start of the flight, the internal damage to the engine indicated that it had been operating for a short time without adequate oil cooling and lubrication. However, following the accident flight the oil system was assessed as serviceable and there was no evidence that oil could have been lost in flight other than through the exhaust system. Because oil was being injected into the exhaust system to produce smoke during the flying display, a loss of engine oil by this route would not be detected visually from the ground. The amount of oil in the breather separator tank was not excessive; however, the possibility that one of the breather inlet valves stuck open, allowing crankcase pressure to blow the oil into the exhaust, could not be excluded. It is also possible that the oil leaked past the No 3 cylinder piston. There was no evidence of cracking on the damaged No 3 cylinder piston; the damage was assessed as consistent with the piston overheating and expanding in the cylinder. It is possible that the damage to this piston accumulated over several flights, with a sudden failure, sufficient to cause the loss of oil, occurring during the accident flight. However, given the level of damage to the piston and cylinder it was not possible to establish if this was the case. The maintenance history of the engine indicates that the engine had experienced numerous problems following the propeller strike that occurred at 464 engine hours. The No 3 cylinder had been operating at CHT approximately 20º F higher than the other cylinders, which the manufacturer advised was normal and within acceptable limits. It was not possible to determine if the other maintenance issues were coincidental or if they indicated a problem resulting from the propeller strike.

55 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 Survivability The Twister aircraft is unusual among light aircraft in incorporating a cockpit safety cell of Kevlar composite construction. This feature, combined with the reclined seating position, energy absorbing cushions and the absence of sharp protrusions in the area of the head, probably contributed to the survivability of this accident. Canopy opening The emergency services reported difficulty in gaining access to the unconscious pilot as they did not know how to open the canopy and were concerned that they would further injure him if they tried to break it. The canopy of the Silence Twister is not required to conform to the CS-VLA. Safety actions Engine The engine manufacturer advised the AAIB that it would introduce processes to monitor the condition of UL260iSA engines in regular aerobatic use, including: ● ● Installing additional temperature sensors in the cylinder walls. ● ● Regularly downloading and reviewing the data from the Dynon EMS-D10. ● ● The return of the engine to the manufacturer after a number of aerobatic displays for a full strip and examination. The manufacturer stated that it intended to issue an amendment to the engine manuals recommending that: ● ● The engine oil level should be between 4 and 4.5 litres prior to the start of an aerobatic display. ● ● A Teflon based additive should be added to the oil. ● ● Maintenance activities such as removing cylinder heads and replacing cylinders should be carried out by technicians approved by the manufacturer. Canopy opening Following the accident to G-JINX, the LAA amended its Technical Leaflet 2.11 ‘Aircraft Placards, Labels and Registration Marks’ to include the following: ‘When not otherwise obvious, the external and internal latches on cockpit doors and canopies should be clearly identified by labels or markings sufficiently prominent to be seen in an emergency. In the event of an accident, even a few seconds saved by first responders in rescuing the crew may be critical to a positive outcome, especially where there is the threat of fire. Each normal and emergency exit operating control should be red in colour. Suitable placards

56 © Crown copyright 2018 All times are UTC AAIB Bulletin: 5/2018 G-JINX EW/C2017/05/02 should be near each control and should be designed to clearly indicate its method of operation, especially to a non-aviation person. Where any special procedure must be followed to gain entry, this should be described, for example ‘to open canopy in an emergency, reach into cockpit through ventilator aperture and press red button. Canopy hinged on right hand side.’ Following the accident, the owner fixed labels to the outside of his other two Silence Twister aircraft explaining how the canopy is opened from the outside. EMS audio alert The aircraft owner stated he would consider enabling the EMS intercom audio alert function. Conclusion The engine operated normally until part way through the flying display when it seized due to a lack of lubrication and cooling. The available low oil pressure indications were not sufficient to alert the pilot before the engine seized. The subsequent forced landing resulted in impact sufficient to cause damage to the aircraft and serious injury to the pilot. Emergency responders were delayed by the absence of instructions, visible from outside the cockpit, explaining how the canopy could be opened. However, energy absorbing cushions and the safety cell construction of the cockpit contributed to the pilot’s survival.

FD06643 ｜ 2018_英国_aaib-investigation-to-slingsby-t67b-firefly-g-blpi__Slingsby_T67B_Firefly_G-BLPI_09-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

70 © Crown copyright 2018 All times are UTC AAIB Bulletin: 9/2018 G-BLPI EW/G2018/07/15 ACCIDENT Aircraft Type and Registration: Slingsby T67B Firefly, G-BLPI No & Type of Engines: 1 Lycoming O-235-N2A piston engine Year of Manufacture: 1984 (Serial no: 2016) Date & Time (UTC): 4 July 2018 at 1500 hrs Location: RAF Wyton, Huntingdon, Cambridgeshire Type of Flight: Training Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Nose landing gear, fuselage, cowling and propeller damage; engine shock-loaded Commander’s Licence: Student Commander’s Age: 25 years Commander’s Flying Experience: 13 hours (of which 13 were on type)

Last 90 days - 13 hours

Last 28 days - 5 hours Information Source: Aircraft Accident Report Form submitted by the pilot and additional video evidence After completing several successful touch-and-go landings with his instructor, the student was flying solo on a circuit consolidation flight. He reported that the aircraft hit a bump on the runway and that the second touchdown resulted in the nosewheel detaching. The propeller struck the ground and the aircraft came to rest on the runway. The instructor reported that the approach appeared normal, but the aircraft became airborne momentarily just after touchdown. He stated that the nose pitched down and the nosewheel detached when it hit the runway. A video of the accident showed that the aircraft bounced twice before pitching nose-down and striking the runway nosewheel-first. The student reported that the event “happened extremely quickly” and he was unable to recall his exact actions. He stated that the aircraft struck the ground and the nosewheel detached before he could initiate a go-around.

FD06644 ｜ 2018_英国_aaib-investigation-to-thruster-t600n-450-g-ccuz__Thruster_T600N_450_G-CCUZ_11-18.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

133 © Crown copyright 2018 All times are UTC AAIB Bulletin: 11/2018 G-CCUZ EW/G2018/08/16 ACCIDENT Aircraft Type and Registration: Thruster T600N 450, G-CCUZ No & Type of Engines: 1 Jabiru 2200A piston engine Year of Manufacture: 2004 (Serial no: 0044-T600N-102) Date & Time (UTC): 18 August 2018 at 1150 hrs Location: Foston, Lincolnshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - 1 (Minor) Passengers - 1 (Minor) Nature of Damage: Aircraft destroyed Commander’s Licence: Commercial Pilot’s Licence Commander’s Age: 48 years Commander’s Flying Experience: 1,740 hours (of which 106 were on type)

Last 90 days - 17 hours

Last 28 days - 1 hour Information Source: Aircraft Accident Report Form submitted by the pilot and inquiries made by the AAIB Synopsis The aircraft was taking off from Foston Airfield when the engine lost power and caused the aircraft to descend. The pilot was faced with limited choices for a forced landing, so used a nearby Leylandii hedge as an energy absorber. After the aircraft came to a stop, the pilot and his passenger were able to vacate the aircraft having sustained minor injuries. The aircraft was severely damaged in the accident. The was no evidence of a mechanical failure within the engine. However, a build-up of soot within the engine suggests it had been running with an overly rich fuel air ratio, which, in most circumstances, would result in a reduction of power. History of the flight The pilot had been contracted to carry out some instructional work for a syndicate based at Foston Airfield. After discussion with the aircraft owner, it was agreed that the pilot would conduct a short type-refamiliarisation flight in the left seat, with another pilot in the right seat. The start was uneventful, however, the pilot observed that the rpm gauge appeared to be under reading and noted that this would require rectification. He also observed the magneto test did not appear to result in an rpm drop, but when he reduced the throttle and carried out a dead-cut1 check, the magnetos were isolating normally. Footnote 1 A dead-cut check ensures that each magneto can be isolated by earthing the circuit. This check is usually carried out as part of the engine shutdown checks to ensure the ignition does not remain live when the engine is stopped.

134 © Crown copyright 2018 All times are UTC AAIB Bulletin: 11/2018 G-CCUZ EW/G2018/08/16 Content to continue, he then carried out a high-power taxi along the runway before back tracking to position ready for takeoff. The pilot accelerated the aircraft along the runway and became airborne at about 35 kt, approximately 150-200 m along the 418 m runway. He then set a climb attitude and speed of 55 kt with an estimated rate of climb of 400-600 ft/min. As the aircraft passed the end of the runway, thought by the pilot to be at about 100 ft agl, there was a loss of thrust and the climb stagnated. The pilot decreased the climb speed to 45 kt, established a reduced rate of climb and altered his course slightly to the right, where there was gap in a row of nearby houses. However, there was then a further loss of thrust and the aircraft commenced a rapid descent. The pilot prepared for a forced landing but was aware his options were limited by the houses, their gardens and a large Leylandii hedge. With little choice, he decided to try to stall the aircraft to “pancake” onto the hedge. This he did, hitting the hedge just below the top. There was a loud bang and the aircraft came to a stop. The aircraft was extensively damaged but the pilot and passenger were able to vacate the aircraft unaided having suffered minor injuries. Engineering investigation The aircraft was fitted with a Jabiru 2200A four-cylinder horizontally-opposed piston engine. The engine controls consist of a throttle and choke. The carburettor mixture is set during the engine maintenance tuning procedures on the ground and is not adjustable from within the cockpit. Ignition is by two solid-state magnetos with two side-by-side spark plugs per cylinder. At the request of the AAIB the engine was examined to establish the cause of the loss of power. No faults were found with the ignition, carburation or choke systems. A cylinder compression check was carried out and it was found that one of the exhaust valves had a slight leak, although this did not have any significant effect on the cylinder concerned. Overall, the compression in all the cylinders was within manufacturer’s limits. The was no evidence of a mechanical failure within the engine. However, there was a build-up of carbon soot within the cylinders, exhausts and spark plug electrodes. Observations made by the pilot Prior to the flight the pilot discussed recent maintenance carried out on the aircraft with one of its owners and reviewed its documentation. Overall, he considered all in order and the aircraft to be in a good maintenance state with, in his opinion, some minor non-urgent details which could be addressed in due course. There was no pilot’s operating handbook, so the pilot used his own notes by which to configure and start the aircraft. The pilot recalls the start as being normal and the engine “started easily”. He noted the rpm gauge apparent under-read and the difficulty in carrying out the magneto drop check. To satisfy himself that the magnetos were working correctly he carried out the ‘dead-cut’. In addition to verify that all was well, and to assist in familiarising himself with the aircraft, he carried out a full power taxi along the runway followed by a back‑track before lining up and taking off.

135 © Crown copyright 2018 All times are UTC AAIB Bulletin: 11/2018 G-CCUZ EW/G2018/08/16 After getting airborne, as the power loss started to manifest itself, the pilot described how “it dawned on me that I had very limited options, I chose the least worst, the hedge”. He also described how he adjusted the airspeed to 45 kt “the best glide speed”. His flying experience meant that at no stage did he consider turning the aircraft back towards the airfield. He steered the aircraft about 30° to the hedge line, intersecting it from the left. In the pilot’s opinion choosing the hedge as an energy absorber, and the fact he and his passenger were wearing four-point safety harnesses, prevented more serious injuries or a worse outcome. Other evidence A video of the aircraft taking off showed the initial climb during which the engine can be clearly heard. Although at first the climb appears normal, and was as described by the pilot, as the aircraft passes over the end of the runway the aircraft stops climbing and eventually starts to descend. The engine tone appears to change slightly just before the aircraft stops climbing and there appears to be a short burst of misfiring during the descent. At this point the video stops. Based on the video, in particular the aircraft dimensions when compared with features on the ground, the aircraft appears to be lower than the pilot’s estimation as the aircraft passed over the end of the runway, possibly as low as 60 ft agl. Discussion with a third party, familiar with the engine and its installation in Thruster aircraft, described the rpm indication system as being relatively simple. Crankshaft rotational speed is sensed by a Hall-effect sensor which drives a small gauge. It was also suggested that experience has found that these gauges can be unreliable. Their experience also suggests that the rpm change, when carrying out a magneto drop test, is low, between 10 and 30 rpm. Analysis The rapid onset of events meant the pilot had no time to understand what was causing the power loss, so just concentrated on landing the aircraft. From the video evidence the height of the aircraft as the engine lost power can be estimated and this supports the fact he had very little time in which to react. As he said, faced with limited options “the hedge was the least worse option”. The type of hedge along with the four-point harnesses probably prevented a worse outcome in this accident. The pilot had not attempted to turnback towards the airfield. AAIB experience, during numerous previous investigations, has found that there is a high risk of loss of control during a turnback in engine power loss situations. In many cases this has resulted in accidents with fatal injuries. There is no evidence of a component failure or malfunction which could have led to the power loss. However, the heavy ‘sooting’ of the cylinders, plugs and exhausts suggests an overly-rich fuel air mixture, such as could have been caused by carburettor settings or by running the engine with the choke set. The pilot was sure that he had opened the

136 © Crown copyright 2018 All times are UTC AAIB Bulletin: 11/2018 G-CCUZ EW/G2018/08/16 choke after his engine starting process but, in the stressful circumstances of the accident, he could not exactly recall the aircraft configuration. The rpm gauge under reading and the magneto drop test are not likely to have caused the loss of power. In the Jabiru engine the rpm drop is very small, maybe as little as 10 to 30 rpm. This is because the two spark plugs are close together in the cylinder head, so the ignition points to set off the flame front are close together. In other engines, where the plugs are opposite each other, two separate flame fronts are initiated and this has a greater effect on the rpm when one plug ceases to spark. Therefore, the loss of one spark in the Jabiru engine has less effect on the ignition characteristics, thus the effect on rpm is less marked. Not having a reliable rpm gauge meant that magneto drop test was not clearly discernible. The reduced ability to monitor the rpm may have also influenced an assessment of whether the engine was achieving full power. Conclusion There was no evidence of a component failure or malfunction that could have led to the engine power loss. The build-up of soot within the engine suggests it had been running with an overly rich fuel air ratio, which, in most circumstances, would cause a reduction of power. This resulted in the aircraft not being able to sustain a satisfactory climb and then descend. The pilot was left with no practical choice other than to carry out a forced landing, the severity of which was somewhat reduced by the hedge and the four-point harnesses he and his passenger were wearing. The decision not to turnback probably also reduced the risk of a more serious outcome.

FD06645 ｜ 2018_英国_aaib-special-bulletin-s1-2018-on-agusta-aw169-g-vskp__S1-2018_G-VSKP.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

AAIB Bulletin S1/2018 SPECIAL Farnborough House Berkshire Copse Road Aldershot, Hants GU11 2HH Tel: 01252 510300 Fax: 01252 376999 www.aaib.gov.uk This Special Bulletin contains facts which have been determined up to the time of issue. It is published to inform the aviation industry and the public of the general circumstances of accidents and serious incidents and should be regarded as tentative and subject to alteration or correction if additional evidence becomes available. © Crown copyright 2018 ACCIDENT Aircraft Type and Registration: Agusta AW169, G-VSKP No & Type of Engines: 2 Pratt & Whitney Canada PW210A turboshaft engines Year of Manufacture: 2016 (Serial no: 69018) Location King Power Stadium, Leicester Date & Time (UTC): 27 October 2018 at 1937 hrs Type of Flight: Private Persons on Board: Crew - 1 Passengers - 4 Injuries: Crew - 1 (Fatal) Passengers - 4 (Fatal) Nature of Damage: Aircraft destroyed Commander’s Licence: Airline Transport Pilot’s Licence (A and H) Commander’s Age: 53 years Commander’s Flying Experience:

To be confirmed Last 90 days - 40 hours Last 28 days - 7 hours

Information Source: AAIB Field Investigation The investigation The accident occurred at 19371 hours on 27 October 2018. This Special Bulletin is published to provide preliminary information gathered from the site investigation, subsequent technical investigation, recorded data, and other sources. Footnote 1 All times in this bulletin are UTC and have been taken from a variety of sources which have yet to be fully correlated. All times quoted should be taken as approximate at this stage.

AAIB Special Bulletin: S1/2018 G-VSKP EW/C2018/10/04 2 © Crown copyright 2018 In accordance with established international arrangements, the Agenzia Nazionale per la Sicurezza del Volo (ANSV) of Italy, representing the State of Design and Manufacture of the helicopter, appointed an Accredited Representative (Accrep) to participate in the investigation. The Accrep is supported by advisers from the helicopter manufacturer. The Transportation Safety Board of Canada, representing the State of Design and Manufacture for the helicopter’s engines, has also appointed an Accrep. Experts have been appointed by the Aircraft Accident Investigation Committee of Thailand and the State Commission on Aircraft Accidents Investigation of Poland. The European Aviation Safety Agency (EASA), the UK Civil Aviation Authority (CAA) and the helicopter operator are also assisting the AAIB.

History of the flight The helicopter took off on its first flight of the day from Fairoaks Airport, Surrey, at 1340 hrs on Saturday 27 October 2018. The pilot and one passenger were on board. At 1404 hrs the helicopter landed at London Heliport (Battersea) where three additional passengers boarded. The helicopter then lifted off from Battersea at 1414 hrs and flew to the Belvoir Drive Training Ground, Leicester, landing at 1459 hrs. The helicopter was shut down at the training ground and all persons on board went to the King Power Stadium, Leicester. The pilot and one passenger returned to the training ground at 1837 hrs and at 1844 hrs the helicopter lifted off, with two persons on board, for the short flight to the King Power Stadium, 1 nm to the north. The approach to the King Power Stadium was made from a southerly direction. After landing, the helicopter parked on the centre circle of the pitch, on a north-easterly heading, and was shut down at 1847 hrs. The pilot and passenger left the helicopter. Between 1900 hrs and 1930 hrs the pilot and four passengers boarded the helicopter for a flight to London Stansted Airport. The helicopter started up at 1934 hrs and at 1937 hrs it lifted from the centre circle, yawed 15° left and moved forward a few metres. The helicopter then began a climb on a rearward flight path2 while maintaining a northerly heading. Gear retraction started as it passed through a height of approximately 320 ft. The climb then paused. Heading changes consistent with the direction of pedal movements were recorded initially, then the helicopter entered an increasing right yaw contrary to the pilot’s left pedal command. The helicopter reached a radio height3 of approximately 430 ft before descending with a high rotation rate. The helicopter struck the ground in an approximately upright position on a stepped concrete surface, with the landing gear retracted, and rolled onto its left side. The helicopter was rapidly engulfed in an intense post-impact fire. Stadium staff and emergency services were quickly at the scene but were not able to gain access to the helicopter because of the intensity of the fire. Footnote 2 A planned procedure. 3 Height determined by a radar altimeter system on the aircraft.

AAIB Special Bulletin: S1/2018 G-VSKP EW/C2018/10/04 3 © Crown copyright 2018 Weather At the time of the accident the weather was clear with good visibility and no cloud below 1,000 ft. The general wind direction was north-westerly with a strength of 10 to 12 kt at the surface and around 25 to 30 kt at 1,000 ft. Wreckage The aircraft came to rest on an area of land adjacent to the football stadium car park. The post-impact fire resulted in substantial damage to the predominantly composite structure of the helicopter. Several sections of the airframe were almost completely consumed by the fire and large sections of the remaining fuselage suffered significant loss of structural integrity. The wreckage was recovered to the AAIB’s facilities in Hampshire, where detailed forensic assessment of the helicopter’s structure and systems is ongoing. Safety action The manufacturer of the helicopter has issued Alert Service Bulletin (ASB) 169-120 for AW169 helicopters, giving instructions for a precautionary inspection of the tail rotor control assembly on all helicopters in the global fleet. The manufacturer also issued ASB 189-213 for AW189 helicopters, which have a similar tail rotor control system. These inspections have been mandated by the EASA, in its capacity as the regulator responsible for the type design approval of the AW169 and AW189. Airworthiness Directive 2018-0241-E has been issued to accomplish this. Ongoing investigation The cause of the apparent loss of yaw control has yet to be determined. Investigation of the tail rotor control system is being carried out as a priority. The AAIB investigation will also continue to conduct a comprehensive examination of the helicopter wreckage, recovery and analysis of recorded data from the Combined Voice and Flight Data Recorder (CVFDR), aircraft systems and other sources, and an assessment of the operation, maintenance, design and manufacture of the aircraft. The AAIB will report any significant developments as the investigation progresses. Published 14 November 2018. AAIB investigations are conducted in accordance with Annex 13 to the ICAO Convention on International Civil Aviation, EU Regulation No 996/2010 and The Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 2018. The sole objective of the investigation of an accident or incident under these Regulations is the prevention of future accidents and incidents. It is not the purpose of such an investigation to apportion blame or liability. Accordingly, it is inappropriate that AAIB reports should be used to assign fault or blame or determine liability, since neither the investigation nor the reporting process has been undertaken for that purpose. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and is not used in a derogatory manner or in a misleading context.

FD06646 ｜ 2018_英国_aircraft-accident-report-aar-1-2018-g-wnsr-28-december-2016__AAR_1-2018_G-WNSR_Hi_Res.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

AIRCRAFT ACCIDENT REPORT 1/2018 Report on the accident to Sikorsky S-92A, G-WNSR West Franklin wellhead platform, North Sea on 28 December 2016 AAIB Air Accidents Investigation Branch

AIRCRAFT ACCIDENT REPORT 1/2018 Air Accidents Investigation Branch Report on the accident to Sikorsky S-92A, G-WNSR West Franklin wellhead platform, North Sea On 28 December 2016 This investigation has been conducted in accordance with Annex 13 to the ICAO Convention on International Civil Aviation, EU Regulation No 996/2010 and The Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 1996. The sole objective of the investigation of an accident or incident under these Regulations is the prevention of future accidents and incidents. It is not the purpose of such an investigation to apportion blame or liability. Accordingly, it is inappropriate that AAIB reports should be used to assign fault or blame or determine liability, since neither the investigation nor the reporting process has been undertaken for that purpose.

ii © Crown Copyright 2018 Printed in the United Kingdom for the Air Accidents Investigation Branch This report contains facts which have been determined up to the time of publication. This information is published to inform the aviation industry and the public of the general circumstances of accidents and serious incidents. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and it is not used in a derogatory manner or in a misleading context. Published 22 March 2018

iii © Crown Copyright 2018 Department for Transport Air Accidents Investigation Branch Farnborough House Berkshire Copse Road Aldershot Hampshire GU11 2HH March 2018 The Right Honourable Chris Grayling Secretary of State for Transport Dear Secretary of State I have the honour to submit the report on the circumstances of the accident to Sikorsky S-92A, registration G-WNSR at West Franklin wellhead platform, North Sea on 28 December 2016.

Yours sincerely Crispin Orr Chief Inspector of Air Accidents

Intentionally left blank

v Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Contents © Crown Copyright 2018 Contents Contents Introduction...................................................................................................................... 1 Summary........................................................................................................................... 2 Factual information.......................................................................................................... 5 1.1 History of the flight........................................................................................... 5 1.1.1 Background....................................................................................... 5 1.1.2 Pre-flight maintenance....................................................................... 5 1.1.3 Pre-flight planning.............................................................................. 7 1.1.4 First sector......................................................................................... 7 1.1.5 Accident sector.................................................................................. 7 1.1.6 Notification of the accident................................................................ 8 1.2 Injuries to persons........................................................................................... 9 1.3 Damage to helicopter...................................................................................... 9 1.4 Other damage.................................................................................................. 9 1.5 Personnel information.................................................................................... 10 1.5.1 Commander..................................................................................... 10 1.5.2 Co-pilot............................................................................................ 10 1.5.3 Flight crew interviews.......................................................................11 1.5.3.1 Commander...................................................................11 1.5.3.2 Co-pilot...........................................................................11 1.5.4 Licensed engineers......................................................................... 12 1.5.5 Passenger statements..................................................................... 12 1.6 Aircraft information.............................................................................................. 13 1.6.1 General............................................................................................ 13 1.6.2 Helicopter general description......................................................... 13 1.6.3 Helicopter structure......................................................................... 14 1.6.4 Landing gear.................................................................................... 14 1.6.5 Power plants and transmission........................................................ 14 1.6.6 Main rotor (MR) and tail rotor (TR) assemblies............................... 15 1.6.7 Flying controls................................................................................. 15 1.6.8 TR servo.......................................................................................... 16 1.6.9 Trim, Automatic Flight Control System (AFCS) and Stability

Augmentation System (SAS)........................................................... 18 1.6.10 Four-axis flying control interconnections......................................... 19 1.6.11 Maintenance history........................................................................ 19 1.6.11.1 TRPCS history.............................................................. 20 1.6.11.2 Oil sampling history....................................................... 20 1.6.12 Emergency procedures................................................................... 21

vi Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Contents © Crown Copyright 2018 Contents 1.7 Meteorological information............................................................................ 22 1.8 Aids to navigation.......................................................................................... 22 1.9 Communications............................................................................................ 22 1.10 Aerodrome information.................................................................................. 22 1.10.1 Elgin PUQ helideck.......................................................................... 23 1.10.2 West Franklin helideck..................................................................... 23 1.11 Recorded information.................................................................................... 24 1.11.1 Introduction...................................................................................... 24 1.11.2 Flight data........................................................................................ 24 1.11.2.1 Elgin PUQ yaw event and lift off.................................... 24 1.11.2.2 West Franklin landing.................................................... 26 1.11.3 Helicopter Vibration Health Monitoring............................................ 28 1.11.3.1 VHM regulatory requirements....................................... 28 1.11.3.2 VHM alert threshold philosophy.................................... 29 1.11.4 HUMS configuration on the S-92A................................................... 32 1.11.4.1 Mechanical diagnostics................................................. 33 1.11.4.2 Ground station software mechanical diagnostics.......... 33 1.11.4.3 TGB bearing energy analysis software......................... 34 1.11.5 Operator’s internal HUMS procedures............................................ 35 1.11.5.1 Operator’s HUMS download procedure........................ 35 1.11.5.2 G-WNSR HUMS download........................................... 36 1.11.5.3 Operator internal HUMS training................................... 41 1.11.5.4 Interrogating HUMS time-history strip charts................ 41 1.11.5.5 Sikorsky Ground-Based Application (SGBA)................ 42 1.12 Wreckage and impact information................................................................. 44 1.12.1 Helideck........................................................................................... 44 1.12.2 Initial helicopter examination on the helideck.................................. 45 1.12.3 Examination at maintenance base.................................................. 45 1.12.4 Examination by the manufacturer.................................................... 46 1.12.4.1 TRPCS bearing............................................................. 46 1.12.4.2 Tail rotor gearbox.......................................................... 46 1.12.4.3 TR servo........................................................................ 47 1.13 Medical and pathological information............................................................ 48 1.14 Fire ............................................................................................................... 48 1.15 Survival aspects............................................................................................ 48 1.16 Tests and research........................................................................................ 48 1.16.1 Engineering..................................................................................... 48 1.16.1.1 Immediate action........................................................... 48 1.16.1.2 Inspection feedback and subsequent actions............... 49 1.16.1.3 Results.......................................................................... 50

vii Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Contents © Crown Copyright 2018 Contents 1.16.2 Recorded data mining..................................................................... 51 1.16.2.1 HUMS............................................................................ 51 1.16.2.2 Operational indicators................................................... 51 1.17 Organisational and management information................................................ 52 1.18 Additional information.................................................................................... 52 1.18.1 AAIB Special Bulletin (SB)............................................................... 52 1.18.2 Previous similar events.................................................................... 52 1.18.3 Engineering shift patterns................................................................ 53 1.18.4 Significance of HUMS in previous accidents................................... 55 1.18.5 Royal Navy WS-61 Sea King HUMS............................................... 55 1.19 Useful or effective investigation techniques.................................................. 56 2 Analysis................................................................................................................. 57 2.1 Introduction.................................................................................................... 57 2.2 Operational aspects....................................................................................... 59 2.2.1 Conduct of the flight......................................................................... 59 2.2.2 RFM and Emergency Checklist procedures.................................... 60 2.2.3 Plan continuation bias..................................................................... 60 2.3 Engineering analysis..................................................................................... 61 2.3.1 Cause of the uncommanded yaw on the Elgin PUQ....................... 62 2.3.2 Potential bearing lubrication problems............................................ 63 2.3.3 Bearing loading and environment.................................................... 64 2.3.4 Servo damage................................................................................. 64 2.3.5 Returned TRPCS assemblies.......................................................... 65 2.3.6 Summary of engineering analysis................................................... 66 2.3.7 Additional safety actions.................................................................. 66 2.3.8 Helideck resilience........................................................................... 66 2.4 HUMS data analysis on the S-92.................................................................. 67 2.4.1 Human machine interface................................................................ 67 2.4.2 SGBA GS software.......................................................................... 69 2.5 Licensed engineer human performance........................................................ 69 2.5.1 Introduction...................................................................................... 69 2.5.2 Environment.................................................................................... 69 2.5.3 Prospective memory........................................................................ 70 2.5.3.1 Causes of prospective memory failure in the engineer... 70 2.5.4 Mutual reinforcement....................................................................... 71 2.6 Timeliness of VHM data................................................................................. 72 2.6.1 Maximum interval between downloads............................................ 72 2.6.2 Timeliness of VHM alerts................................................................. 72 2.6.3 Acquisition of VHM data.................................................................. 73

viii Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Contents © Crown Copyright 2018 Contents 2.6.4 Download and analysis of VHM data............................................... 74 2.6.5 Promulgating VHM data.................................................................. 74 2.7 Strengthening the safety barriers.................................................................. 75 3 Conclusions.......................................................................................................... 77 3.1 Findings......................................................................................................... 77 3.2 Causal factors................................................................................................ 79 3.3 Contributory factors....................................................................................... 79 4 Safety Recommendations.................................................................................... 81 4.1 Safety Recommendations............................................................................. 81 4.2 Summary of safety actions............................................................................ 81 Appendices Appendix A – Tail rotor malfunctions and associated emergency procedures applicable at the time of the event Appendix B – Elgin Helideck Landing Area Certificate, Helideck Information Plate and Temporary Limitations Notice 15-2016 Appendix C – West Franklin Helideck Landing Area Certificate and Helideck Information Plate Appendix D – Sikorsky Temporary Revision 45-03 Appendix E – Sikorsky All Operators Letter CCS-ALL-AOL-17-0008 dated 24 March 2017 Appendix F – Sikorsky All Operators Letter CCS-92-AOL-16-0019 dated 31 December 2016 Appendix G – Sikorsky ASB 92-64-011 dated 10 January 2017 Appendix H – FAA Airworthiness Directive AD 2017-02-51 dated 13 January 2017 Appendix J – Sikorsky ASB 92-64-012 dated 16 May 2017

ix Glossary of Abbreviations Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Glossary of abbreviations GLOSSARY OF ABBREVIATIONS USED IN THIS REPORT AAD Advanced Anomaly Detection AAIB Air Accidents Investigation Branch AD Airworthiness Directive AFCS Automatic Flight Control System AMC Acceptable Means of Compliance AMM Aircraft Maintenance Manual ANO Air Navigation Order APU Auxiliary power unit ASB Alert Service Bulletin ºC, F Celsius, Fahrenheit º/s degrees per second CAA Civil Aviation Authority CCU Cockpit Control Unit CI Condition Indicator CSI Controlled Service Introduction CVFDR Cockpit voice and flight data recorder EASA European Aviation Safety Agency FAA Federal Aviation Administration ft feet GS Ground Station HDA Helideck Assistant HDWG Heliport Design Working Group HHMAG Helicopter Health Monitoring Advisory Group HLO Helicopter Landing Officer HMI Human Machine Interface hPa hectopascal hrs hours (clock time as in 1200 hrs) HUMS Health and Usage Monitoring System ICAO International Civil Aviation Organization IFR Instrument flight rules IMD Integrated mechanical diagnosis KIAS knots indicated airspeed kg kilogram(s) kHz kilohertz kt knot(s) lb pound(s) m metre(s) MB Megabyte MGB Main gearbox min minute(s) mm millimetres MOB Main operating base MOR Mandatory Occurrence Report MPFR Multi-Purpose Flight Recorder MR Main rotor nm nautical mile(s) NTSB National Transportation Safety Board OBS On-Board System OEM Original equipment manufacturer ppm parts per million PTFE Polytetrafluoroethylene PUQ Process Utilities Quarters RFM Rotorcraft Flight Manual RT Radiotelephony RVHMWG Rotorcraft VHM Working Group SAS Stability Augmentation System SB Special Bulletin SGBA Sikorsky Ground-Based Application SOAP Spectrometric Oil Analysis Programme TAN Total acid number TBO Time Between Overhaul TCH Type Certificate Holders TGB Tail rotor gearbox TR Tail rotor TRPCS Tail rotor pitch change shaft TSN Time Since New VFR Visual Flight Rules VHF Very High Frequency VHM Vibration Health Monitoring

Intentionally left blank

1 Introduction and Summary Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Introduction and Summary Air Accidents Investigation Branch Aircraft Accident Report No: 1/2018 Registered Owner and Operator: CHC Scotia Ltd Aircraft Type: Sikorsky S-92A Nationality: British Registration: G-WNSR Location of accident: West Franklin wellhead platform, North Sea Latitude: N 56° 57’ 47” Longitude: E 001° 48’ 22” Date & Time: 28 December 2016 at 0844 hrs (All times in this report are UTC) Introduction The Air Accidents Investigation Branch (AAIB) became aware of the accident during the morning of 5 January 2017. In exercise of his powers, the Chief Inspector of Air Accidents ordered an investigation into the accident to be carried out in accordance with the provisions of Regulation EU 996/2010 and the UK Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 1996. In accordance with established international arrangements, the National Transportation Safety Board (NTSB) of the USA, representing the State of Design and Manufacture of the helicopter, appointed an Accredited Representative to participate in the investigation, supported by advisers from the helicopter manufacturer and the Federal Aviation Administration (FAA). The helicopter operator, the European Aviation Safety Agency (EASA) and the UK Civil Aviation Authority (CAA) also assisted the AAIB. The sole objective of the investigation of an accident or incident under these Regulations is the prevention of accidents and incidents. It shall not be the purpose of such an investigation to apportion blame or liability.

2 Introduction and Summary Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Introduction and Summary Summary The helicopter was being operated from Aberdeen on a contract on behalf of an offshore oil and gas company. On 27 December 2016, during a flight on the day prior to the accident, the Health and Usage Monitoring System (HUMS) recorded vibration data which contained a series of exceedences related to the tail rotor pitch change shaft (TRPCS) bearing. Routine maintenance was carried out overnight which included a download and preliminary analysis of the HUMS data. Whilst an anomaly for tail rotor gearbox (TGB) bearing energy was detected by the maintenance engineer, the exceedences were not identified, in part, due to the way they were presented in the analysis tool; the helicopter was released to service without further investigation. On 28 December 2016, during the first sector of the day, the HUMS recorded further exceedences but these were not scheduled to be downloaded and reviewed until the helicopter returned to Aberdeen; there was no method in place for either the flight crew or maintenance personnel to be made aware of these further exceedences until then. During lift off on the second sector, the helicopter suffered an uncommanded right yaw through 45° and the flight crew re-landed. The helicopter was again lifted into the hover and responded normally to the controls, so the event was attributed to a wind effect and the helicopter departed en route. The five-minute flight to the West Franklin wellhead platform was uneventful but, in the latter stages of landing, yaw control was lost completely and the helicopter yawed to the right. The crew landed the helicopter expeditiously, but heavily, on the helideck. The helicopter continued to rotate to the right and the crew closed the throttles before it came to rest near the edge of the helideck having turned through approximately 180°. There were no injuries. The investigation determined that the TRPCS bearing had degraded and failed. As a consequence, the tail rotor pitch change servo was damaged resulting in uncommanded and uncontrolled inputs being made to the tail rotor (TR). The manner in which the servo was damaged had not been previously identified. The investigation identified the following causal factors to the loss of yaw control: ● The TRPCS bearing failed for an undetermined reason. ● The TRPCS bearing failure precipitated damage to the tail rotor pitch control servo.

3 Introduction and Summary Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Introduction and Summary The investigation identified the following contributory factors: ● Impending failure of the TRPCS bearing was detected by HUMS but was not identified during routine maintenance due to human performance limitations and the design of the HUMS Ground Station (GS) Human Machine Interface (HMI). ● The HUMS GS software in use at the time had a previously-unidentified and undocumented anomaly in the way that data could be viewed by maintenance personnel. The method for viewing data recommended in the manufacturer’s user guide was not always used by maintenance personnel. Despite being unable to determine the exact cause of the bearing failure, the helicopter manufacturer has identified and introduced a number of changes intended to reduce the risk of a recurrence including: introducing HUMS software with enhanced diagnostic capabilities and improved user interfaces, tighter control of bearing manufacturing and assembly tolerances, consistency in lubricating grease quality and its application, and in‑service temperature monitoring. In this report, the AAIB makes two Safety Recommendations concerning the timeliness of acquiring, accessing, analysing and promulgating Vibration Health Monitoring (VHM) data, to enhance the usefulness of VHM data for the timely detection of an impending failure.

Intentionally left blank

5 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information Factual information 1.1 History of the flight 1.1.1 Background The helicopter was being operated on a contract on behalf of an offshore oil and gas company. Regular flights are scheduled for personnel working in the offshore oil and gas industry to and from the offshore installations. Helicopters depart from Aberdeen and typically fly over water to an installation’s helideck. For any given flight1, multiple sectors may be flown between the offshore installations before the helicopter returns to Aberdeen; turnarounds on the helidecks are normally performed with the rotors running. A helicopter may carry out several such flights in a day, and accumulate total daily flight times in excess of ten hours. The flight, AZ21N, was from Aberdeen to the Elgin-Franklin Offshore Field in the North Sea. The first sector was planned to take passengers to the Elgin Process Utilities Quarters (PUQ). The second sector was transferring personnel to the West Franklin wellhead platform, an unmanned installation, for a temporary stay. The helicopter was then due to return to the Elgin PUQ without passengers, before embarking further passengers for a return sector to Aberdeen. 1.1.2 Pre-flight maintenance The helicopter was in a hangar during the night of 27-28 December 2016 for a scheduled maintenance programme which included a download of the HUMS data from the previous flights. On the evening of 27 December 2016, G-WNSR was placed in the charge of a licensed engineer, hereinafter referred to as Engineer A. Prior to working on G-WNSR, Engineer A carried out a daily maintenance check on another helicopter which was already in the hangar. He carried out this work package between 1530 hrs and 1700 hrs. Then, at approximately 1700 hrs, he received a call from Police Scotland regarding an attempted break-in to his garage near his residence in Aberdeen. He was given permission to leave work and meet the police officer on the case at his home address. During this meeting, the police reported that Engineer A appeared upset and showed signs of distress. On return to work one hour later, he said nothing in particular about the incident and his colleagues assumed the matter had been closed. The shift supervisor then allocated Engineer A to G-WNSR to carry out post‑flight maintenance, a 50-hourly check and a HUMS download and review. He was 1 In this report the term ‘a flight’ is used for a series of sectors between start up and shutdown.

6 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information provided with another type rated engineer to assist him with the hangar work. Engineer A’s normal routine was to carry out the HUMS download and review the HUMS data first, complete the required scheduled maintenance and then physically check that any safety critical parts of the servicing work had been carried out. Only then would he complete the electronic documentation and paperwork to release the helicopter back to service. He did this in case the HUMS data review influenced any other work required on the helicopter. Engineer A extracted the HUMS PCMCIA data card (Data Card) from the helicopter and uploaded the card’s data on to the helicopter’s HUMS Ground Station (GS) situated in an office next to the shift control room. His assistant started the various other tasks on the helicopter and was not involved in the HUMS data analysis. Engineer A completed the analysis using the main diagnostics software tool and found no abnormalities. He then completed the additional diagnostic tools on the HUMS GS designed to detect abnormalities for particular components or sub-systems of the drive train. One of these was for the tail rotor gearbox (TGB) bearing energy, the graph of which did not appear normal to him in that the red horizontal line, indicating the threshold for an alert to be generated, was low down on the y-axis (Figure 9). He had never seen an exceedence before and so was used to the line being near the top with the HUMS data points below, but he was aware, from his HUMS training, that the tools automatically rescaled the axes to display all of the available data. After a short while attempting to understand why this line was in an unusual position, he brought this to the attention of a colleague, another licensed engineer (Engineer B), who was working on another HUMS GS nearby. Thinking it was probably indicating an exceedence they attempted to zoom in on the graph to identify the magnitude of the exceedence; however, after multiple attempts they could not get the zoom function to work, making them think that the scaling could also be due to a ‘software glitch’. Engineer B returned to his own task and thought no more about it. However, Engineer A was uncomfortable with the abnormality and made a mental note to draw it to the attention of his supervisor later, prior to completing the electronic documentation and release to service. He then completed the scheduled maintenance and physical check of the servicing work on G-WNSR by which time most of that evening’s work on the other helicopters was also nearing completion. At about 2345 hrs, he returned to the G-WNSR HUMS GS and completed the electronic documentation and paperwork before releasing G-WNSR back to service. He had, however, forgotten to inform his supervisor of the abnormality with the red line on HUMS related to TGB bearing energy. At about 0100 hrs on 28 December he went off shift and went home.

7 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.1.3 Pre-flight planning The accident occurred on the second sector of the four-sector flight from Aberdeen to the Elgin-Franklin Offshore Field in the North Sea (Figure 1). The weather conditions were suitable for the flight and the pre-flight planning carried out at Aberdeen was routine. The flight crew reported at 0600 hrs; the helicopter commander was designated as the handling pilot for the first two sectors. 1.1.4 First sector The first sector from Aberdeen to the Elgin PUQ was uneventful. The reported wind at the Elgin helideck prior to the approach was from 220° at 20 kt. The approach was made from the east on a track of 270°, passing close to a jack‑up rig positioned temporarily to the east of the Elgin helideck. The helicopter landed on a heading of 270°. The passengers disembarked and sufficient fuel was uplifted for the remaining sectors including the return to Aberdeen. Aberdeen West Franklin x Elgin PUQ x x Figure 1 Flight track from Aberdeen to the Elgin PUQ and West Franklin platform 1.1.5 Accident sector The helicopter, with nine passengers on-board, started to lift off from the Elgin PUQ helideck on a heading of 270°. As it lifted, it yawed unexpectedly to the right through 45°. The commander applied full left yaw pedal, checked the rotation and landed back onto the deck. He told the co-pilot that he used full left pedal but was turning right and both commented that “it shouldn’t do that.” The commander lifted off again to check for the correct response to the flight controls; after lift off he applied additional left yaw pedal and the helicopter responded and turned to the left; all control responses appeared normal.  The crew briefly discussed what happened and commented on the

8 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information wind direction; the commander described the event as “very strange” and “very very strange” and the co-pilot concurred. They continued the departure and climbed to 500 ft on course towards the West Franklin wellhead platform, 3.3 nm to the south. The Helicopter Landing Officer (HLO) and two Helideck Assistants (HDA) on the Elgin helideck observed the lift off, yaw and subsequent touchdown. They watched as the helicopter lifted off again and turned left, commenting that it had appeared to drift backwards with the tail coming close to the handrail on the northern edge of the helideck, before it climbed and flew away to the south. En route the crew further discussed the event, the commander saying: “i thought there was something wrong with the tail rotor there.” The co-pilot confirmed with the commander that full left pedal had been used and commented “well it’s a bit strange because with anything the nose should have come left……we’ve got the wind off to the left”. There was no time for further discussion and the co-pilot contacted the Elgin radio operator and checked the West Franklin helideck status; the HLO confirmed the helideck was available. The helicopter made a normal approach and deceleration to the West Franklin and crossed over the edge of the helideck. At approximately 4 ft above the helideck, it yawed rapidly to the right, reaching a maximum rate of 30° per second. At the same time it rolled 20° to the left, at which point the left main landing gear contacted the helideck. It continued to yaw to the right on its left mainwheels and nosewheels before the right mainwheels contacted the surface. The co-pilot closed the throttles before the helicopter came to rest on a heading of 041°, having rotated through 187°. The crew shut down and secured the helicopter. After the helicopter was made secure, the co-pilot responded to a transmission from the Elgin radio operator and confirmed that everyone on-board was okay, but that there was a TR malfunction and the helicopter was unserviceable. The crew and passengers then disembarked; there were no injuries. 1.1.6 Notification of the accident Regulation (EU) No 996/2010 of The European Parliament and of The Council of 20 October 2010 on the Investigation and Prevention of Accidents and Incidents in Civil Aviation, Article 9, provides an obligation to notify accidents and serious incidents:

9 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information ‘Any person involved who has knowledge of the occurrence of an accident or serious incident shall notify without delay the competent safety investigation authority of the State of Occurrence thereof.’2 The accident occurred on 28 December 2016; the helicopter operator raised a Mandatory Occurrence Report (MOR) and transmitted it to the UK CAA the same day. The AAIB became aware of media reports about the event during the morning of 5 January 2017. A copy of the MOR was requested from the CAA and, when it had been reviewed, a Field Investigation was initiated. The helideck operator, although aware of the event, was not at the time aware that they also held a responsibility for reporting the accident to the AAIB. A notification process was not included in their procedures. Since the accident, the ‘Helicopter Occurrence - Communication Process’ procedures for their UK operations have been revised to include a requirement to report an accident or serious incident to the AAIB. 1.2 Injuries to persons Injuries Crew Passengers Other Fatal 0 0 0 Serious 0 0 0 Minor/None 2 9 0 1.3 Damage to helicopter The helicopter sustained minor visible damage which consisted of a small dent, approximately 80 mm long, to the left side outer mainwheel outer rim; the main landing gear was undamaged. Despite the dent, the left side outer mainwheel tyre remained inflated. There was no other visible evidence of external damage to the helicopter. However, later examination revealed damage to the TR pitch control servo (TR servo) and TRPCS bearing. 1.4 Other damage The helideck surface sustained minor damage to its surface consisting of tyre scuff marks and a small dent within which the aluminium surface had split (Figure 18). 2 The competent safety investigation authority for the United Kingdom is the AAIB.

10 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.5 Personnel information 1.5.1 Commander Age: 58 years Licence: Airline Transport Pilot’s Licence (H) Aircraft Rating: AS332/EC225/SK92 Licence Proficiency Check: Valid to 31 August 2017 Medical Certificate: Valid to 13 January 2018 Flying Experience: Total all types - 8,785 hours

On type - 243 hours

Last 90 days - 169 hours

Last 28 days - 54 hours

Last 24 hours - 3 hours

Previous rest period 18 hours 40 mins The commander had been employed by the operator for 11 years. He flew the AS332 and the EC 225 helicopters on North Sea operations until August 2016 when he completed a type conversion to the S-92A helicopter. He had flown to the Elgin PUQ and the West Franklin on other occasions. 1.5.2 Co-pilot Age: 37 years Licence: Airline Transport Pilot’s Licence (H) Aircraft Rating: EC135/SK92 Licence Proficiency Check: Valid to 30 June 2017 Medical Certificate: Valid to 24 May 2017 Flying Experience: Total all types - 4,490 hours

On type - 1,400 hours

Last 90 days - 134 hours

Last 28 days - 47 hours

Last 24 hours - 5 hours

Previous rest period 17 hours 05 mins The co-pilot joined the operator in May 2014 and completed conversion training to the S-92A in June 2014. He had flown to the Elgin PUQ and the West Franklin on other occasions.

11 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.5.3 Flight crew interviews 1.5.3.1 Commander The commander reported that, on departure from the Elgin helideck, he had lifted out of wind (crosswind from the left) into the hover. He commented that a wind from the left is less favourable for the S-92A and that, on lift off, the helicopter felt as though it was being buffeted, which he attributed as due possibly to the effect of being near the edge of the helideck. He felt the helicopter turning to the right, used full left pedal to correct it and then landed back on the helideck. He reported that he had discussed with the co-pilot what happened and put it down to an effect of the buffeting wind. He lifted the helicopter back into the hover and turned to the left to face into wind; it all felt normal. He then positioned forward to the edge of the deck and departed towards the West Franklin. On approach, as the helicopter crossed over the edge of the West Franklin helideck from the north, he needed to use an increasing amount of left pedal. Then suddenly the helicopter yawed right and, even with full left pedal, he could not stop it so he ‘dived’ onto the helideck. He commented that it had felt uncontrollable immediately, and was unlike the earlier yaw event on the Elgin when he had felt he was able to maintain control. 1.5.3.2 Co-pilot The co-pilot noted that the approach to the Elgin PUQ helideck could be tricky due to the other installations nearby, together with the position of the helideck and superstructure. He commented that the wind could roll up onto the helideck and may also come round from behind. He reported that the approach from the east and the landing were both normal. The yaw on lift off from the Elgin he perceived as being through about 20°, and which he thought may have been as a result of a misjudgement of the wind conditions. He reported that the approach to the West Franklin had appeared normal until the helicopter yawed to the right and the commander made an exclamation and put the helicopter down. The rotation to the right continued after touchdown and he was concerned that the helicopter might fall off the helideck; he was on the outside of the turn and unable to see the edge. Therefore, he delayed closing the throttles until after he was sure they were safely on the deck. After a short delay to regain his composure, he responded to a call from the Elgin radio operator.

12 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.5.4 Licensed engineers Engineer A held a valid Part 66, A and B1 licence with an S-92 type rating and authorisation certificate issued by the operator. He joined the operator in January 2015 as a helicopter maintenance engineer with previous single and multi-engine gas turbine helicopter experience. After joining, he underwent the operator’s multi-point competency check which he completed and was signed off in July 2015. During his initial training, he carried out a Human Factors Refresher Course and in September 2015, he successfully completed the S-92 Integrated Mechanical Diagnostics Health and Usage Monitoring System (IMD‑HUMS) course. Following the accident, at about 1500 hrs on 28 December 2016, Engineer A was contacted by the operator’s managerial staff and informed that G-WNSR had suffered a serious TR problem in-flight, as it was about to land, and was now unserviceable on a gas platform. He was asked to come in to work as soon as possible to discuss the matter. This he did and whilst on the journey to work, he realised what the problem might be and its relationship to the abnormality with the energy tool he had seen the night before. He arrived at work upset and distressed, realising his mistake, recalling that he had completely forgotten to inform his supervisor of the HUMS graph anomaly the night before as he had intended. He immediately informed the managerial staff what had happened but could offer no explanation as to why the matter had ‘slipped his mind’. Engineer B also held a Part 66, A and B1 licence with an S-92 type rating. 1.5.5 Passenger statements The nine passengers provided statements concerning their recollection of events during the flight. Eight passengers commented on the first attempt at takeoff from the Elgin, describing variously a “snatch”, “veer”, “tilt”, “swing”, “cant”, and “loss of control” before re-landing. With the exception of a passenger who occupied the rear seat in the cabin, the passengers described the subsequent lift off and flight as normal until just before landing on the West Franklin when they noticed “rocking”, a “loss of control” and a “hard” landing. The passenger at the rear of the cabin had heard and felt a ‘”knock” from somewhere behind him when the helicopter was in the hover after the second lift off from the Elgin and on several occasions during the sector to the West Franklin.

13 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.6 Aircraft information 1.6.1 General Manufacturer: Sikorsky Type: S-92A Aircraft Serial No: 920250 Year of manufacture: 2014 Number and type of engines: 2 General Electric Co CT7-8A turboshaft engines Total airframe hours: 1,776 hours Total airframe landings: 2,012 landings Airworthiness Review Certificate: Valid to 27 April 2017 1.6.2 Helicopter general description The Sikorsky S-92A is a twin-engine multi-mission large utility helicopter of metal and composite construction. The helicopter’s maximum certified weight is 12,020 kg. It is designed to carry up to 19 passengers and is certified for dual‑pilot VFR and IFR, day and night operations. As well as passenger transport, the S-92A is designed to carry out cargo, external lift, medevac and search and rescue operations. At the time of the accident G-WNSR (Figure 2) was configured for 19 passengers. Figure 2 G-WNSR (photograph courtesy of CHC Scotia Ltd)

14 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.6.3 Helicopter structure The fuselage is aluminium monocoque construction strengthened by stringers and longerons. The upper areas of the helicopter, cowlings, fairings and cockpit nose structure are of lightweight composite construction. 1.6.4 Landing gear The helicopter is fitted with retractable landing gear consisting of double-wheel air/oil shock absorbers. The main landing gear is installed in the sponsons each side of the fuselage just aft of the cabin area, and the castering nosewheel within a wheel bay beneath the cockpit. The main landing gear struts are fitted with a frangible panel at the top of the outer cylinder. If the vertical landing loads exceed the shock absorbing capability of the air/oil component within the strut, the inner cylinder is designed to rupture the frangible panel, absorbing additional energy in the process. The landing gear is fitted with forged aluminium alloy split-rim wheels with pneumatic tubeless tyres. The main and nose landing gears are aluminium cross-shaped forgings with their pivot points located at the ends of the arms of the cross-piece. The cross‑pieces are reinforced by bracing struts extending at a 45° angle from the top of the strut down to the end of the cross-piece at the pivot point. The cross‑pieces’ length is quite large in proportion to the length of the main gear struts to give the pivot points at the end of the cross-pieces a mechanical advantage when absorbing lateral landing loads. The landing gear is extended and retracted by hydraulic actuators powered from the utility hydraulic system. The actuators also have a nitrogen charge emergency blow-down system built in. The nosewheel is non-steerable but its design allows for a 360° caster and has a damper fitted to prevent nosewheel shimmy during taxiing. Differential braking and TR thrust are used to steer the helicopter during taxiing. The lower castering section of the nose landing gear is fitted with tow bar linkages for ground handling. 1.6.5 Power plants and transmission The helicopter is powered by two General Electric Co CT7-8A turboshaft engines delivering 2,520 HP connected to the main rotor gearbox (MGB) via two input modules which contain the primary reduction gearboxes and freewheel units. The TR drive shaft is in four sections supported by hanger bearings and flexible couplings. An intermediate gearbox is connected between the third and fourth section of the shaft. It reduces the shaft rpm and changes the plane of

15 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information rotation. The fourth section of the shaft drives the TGB located at the top of the TR pylon. Shaft rpm is further reduced by the TGB which is canted at 20° and produces a small percentage of the lift component. The TGB contains its own lubricating oil and is splash-lubricated by rotation of its internal components. The TRPCS bearing is lubricated on assembly by grease held in place and separated from the gearbox oil by polytetrafluoroethylene (PTFE) seals which are held in place by snap rings. The TGB oil has a 625‑hour life which can be extended by 100% providing a Spectrometric Oil Analysis Programme (SOAP) sampling process is in place. The TRPCS has a 1,250‑hour life at which point it is removed and returned to the original equipment manufacturer (OEM) for rework. 1.6.6 Main rotor (MR) and tail rotor (TR) assemblies The MR system consists of four blades attached to a fully articulated MR hub. The rotor head assembly consists of a titanium hub which incorporates blade dampers, blade retention yokes, elastomeric bearings, droop stops and flap restrainers. The rotor head is also fitted with a vibration absorber which works in conjunction with an active vibration cancellation system. The MR blades are of a composite construction around a graphite and fibreglass structural spar. A Nomex honeycomb core is wrapped in a fibreglass skin. Mesh lightning protection is built-in and the leading edges are protected by titanium and nickel anti-abrasion strips. The TR hub consists of a titanium head fitted with four TR blades of graphite and fibreglass construction. The blade assembly includes an inboard torque tube section, an outboard aerofoil section and pitch horn. The head is fitted with a four-arm pitch change beam connected to the TRPCS that imparts pitch changes into the blades via links to the pitch horns of each blade. The hub and blades are a bearing-less fully rigid system with pitch change of the blade being accomplished by the twisting of a specially-designed graphite flexbeam within the blade enclosed within a torque tube and cuff. The flexbeam also reacts flapping and dragging loads and is supported within the torque tube and cuff by elastomeric bearings. The torque tube carries the twisting loads into the blade from the pitch horn. 1.6.7 Flying controls The cyclic and collective flying control systems consist of a series of rods, levers and bellcranks which transmit pilot and co-pilot inputs into a mixing unit. Outputs from the mixing unit are transmitted to the MR and TR hydraulic servos via rods and cables. The MR forward, left and right servos consist of tandem

16 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information independent hydraulic actuators powered by the No 1 and No 2 hydraulic systems, and are mounted on the MGB and connected to the swashplate. The swashplate fixed and rotating star assembly transmits inputs into the MR blade pitch change rods. Yaw outputs from the mixing unit are transmitted via cables along the top of the tail cone and into the TR pylon to the TR servo attached to the back of the TGB. The linear non-rotating inputs from the servo are transferred into the rotating TRPCS bearing assembly and from there out to the TR pitch change beam. The yaw cable system inputs are translated into a push-pull to the valves on the TR servo by a TR quadrant. A system of opposing springs is built into the quadrant which allow a continuous and normal response to yaw pedal inputs in the event of one of the cables breaking. In the unlikely event of both cables failing, the helicopter will not respond to yaw inputs, but a spring built into the TR servo will set a TR thrust condition which will allow trimmed flight between 30 to 150 KIAS depending on atmospheric conditions and gross weight. 1.6.8 TR servo The TR servo is attached to the TGB and imparts linear inputs into the rotating TR four-arm pitch change beam via the TRPCS (Figure 3) within the bore of the TR crown wheel shaft. Figure 3 TRPCS The non-rotating servo output rod is connected to the rotating portion of the TRPCS by a double row self-aligning barrel bearing. Each race of the bearing consists of a set of barrel-shaped rollers running on inner and outer races inclined outwards from each other. This allows push and pull loads to be imparted into the TRPCS. The outer races are mounted in a phosphor bronze carrier which engages in grooves cut into the crown wheel shaft to ensure that Servo connection eye end (Transit protective cover fitted) Bronze guide bushing (engages with slots in the TR shaft) Outer end, TR pitch-change beam engagement splines

17 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information the pitch change beam rotates with the TR crown wheel shaft and stays in alignment with its corresponding blade. The dynamic interaction between the inner and outer races and the rollers and their cages is complex. Ideally, the path the rollers follow in the races and the alignment of each roller should be geometrically perfect. However, in practice the rollers are allowed, by virtue of including some end float, to move axially and laterally within their cage and follow slightly differing paths in their races. The barrel-shaped curved surface of the roller creates differing diameters from the middle of the roller outwards towards each end. The inner and outer race surfaces are curved to match the shape of the roller which naturally causes it to follow its track. Despite this, if a roller runs slightly out of track or oscillates, micro-skidding can occur as the varying diameters present differing circumferential speeds between the roller and its race. In the worst case, constant skidding can lead to sustained heating in the roller or race, lubricant damage and eventual bearing degradation. The TRPCS bearing location within a TGB cross-section is shown in green in Figure 4. Figure 4 TGB cross-section Helicopter left turn is pulling direction

18 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information The TR servo consists of two pistons on the same shaft, each piston being powered independently by the No 1 and No 2 hydraulic systems. Inputs from the yaw control system act on a ‘walking beam’ which is mounted on a pivot on the outer end of the servo piston shaft. The walking beam is y-shaped and connected to two servo valves, one for each hydraulic system, which are operated simultaneously on movement of the walking beam. Yaw inputs cause the walking beam to pivot and, in turn, this movement opens the servo valves to allow hydraulic pressure to the servo pistons. The servo moves inwards or outwards, depending on the yaw direction required, and carries with it the walking beam pivot. On cessation of the input from the yaw system the pivot location effectively transfers to the control rod connection, leaving the piston shaft to continue to move until the servo valves are recentralised by the walking beam. Figure 5 shows the TR servo and walking beam assembly. The range of movement of the servo is approximately 3.5 inches (89 mm). The servo piston assembly is prevented from rotating by means of a tab which engages with an anti-rotation slot on the outer casing of the servo. Clevis connection to TRPCS No1 and No2 control valve levers Walking beam Yaw input TRG attachment flange Centering mechanism Feedback pivot Anti rotation slot Figure 5 TR servo walking beam and valve linkages 1.6.9 Trim, Automatic Flight Control System (AFCS) and Stability Augmentation System (SAS) The helicopter is equipped with a four-axis trim system to improve the in-flight handling qualities and allow for hands-off flying. Electromechanical trim motors are fitted to the yaw, pitch, roll and collective flying control runs above the cockpit and have full-range authority to move the control rods. During operation they are part of the outer loop control system so the pilot’s flight controls move in harmony with trim inputs. In addition, SAS servos are fitted to the control runs between the trim motors and the mixer unit. There are two sets of hydraulic SAS servos for each axis and they are electrically controlled by two separate processors within the AFCS computer. The SAS servos are part of the inner

19 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information loop control system so the cyclic and collective controls in the cockpit do not move during operation. In addition, boost servos are fitted to each set of SAS servos to reduce the force required to move the controls through the servo units and limit feedback. 1.6.10 Four-axis flying control interconnections The mixing unit reduces the pilot workload by automatically compensating for collective, yaw, pitch and roll secondary effects to the various combinations of control inputs as follows: ● ● Collective to pitch - Compensates for MR downwash over the stabiliser and applies a forward pitch input as the collective is increased. ● ● Collective to yaw - Provides a proportional anti-torque control input to the TR to increase the pitch of the TR blades as the collective is raised. ● ● Collective to roll - Imparts a left roll input to the MR with increased collective to counter the drift tendency. ● ● Yaw to pitch - Compensates for the increases in the vertical TR thrust component due to its 20° in-built cant. It applies a nose-up pitch to prevent the nose-down resultant with left pedal input. 1.6.11 Maintenance history G-WNSR was maintained, in accordance with the manufacturer’s recommendations and authorised Aircraft Maintenance Manual (AMM), by the operator as a Part 145 organisation. G-WNSR’s Technical Log recorded all of the recent maintenance and servicing work carried out. The relevant activity on the TR and associated components was as follows: The TRPCS Pt No 92358-06303-042, Serial Number B063-00403, was installed in June 2016 at 1,227 airframe hours to replace the originally-fitted life-expired shaft. During this work, the output shaft seal was found to be worn and was replaced at the same time. The majority of subsequent work carried out on the TGB, TR servo and TRPCS was routine servicing and inspection. A package of work commenced on 8 October 2016 at 1,568 airframe hours. The TGB lubricating oil sight glass was dirty, to the extent that the oil level could not be determined, so the transparency was replaced. Additionally, the inspection found the TR servo eye end, connected to the TRPCS bearing,

20 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information to be worn. The TR servo assembly was replaced to rectify the problem. A borescope inspection was carried out eight flying hours after installation and there was no recorded abnormality. On the evening of 27 December, post-flight inspections and a routine 50-hourly check were carried out on G-WNSR (paragraph 1.1.2 refers). 1.6.11.1 TRPCS history TRPCS Serial Number B063-00403 was originally fitted new to S-92A Serial Number 920241 (G-WNSL) on 9 April 2014. It was removed for overhaul on 6 December 2015 having accrued 1,231.43 hours Time Since New (TSN) of its 1,250-hour overhaul life. It was overhauled by the manufacturer and released to service on 21 April 2016. It was fitted to G-WNSR on 25 June 2016 at 1,227 airframe hours. The TRPCS had a routine 250-hour inspection at 1,571.83 airframe hours and at the time of the accident had accrued 548 hours Time Since Overhaul (TSO), a total of 1,779.45 hours TSN. 1.6.11.2 Oil sampling history The lubricating oil in the TGB of G-WNSR was subject to SOAP, although this was not required by the helicopter manufacturer. The TRPCS bearing is pre‑greased and not washed by the TGB lubricating oil unless the bearing seals are damaged. Therefore SOAP would not be expected to detect a defect within the bearing. Although a SOAP report contains a lot of detailed information, the operator was using only the oil viscosity, total acid number (TAN) and water content results, in accordance with the procedure set out in AMM Task 65-22-00-200-001. This was to ensure the oil condition did not compromise the authorised extension of the oil in-service life from 625 hours to 1,250 hours. The SOAP results were produced on a printout chart detailing the constituents of the oil and the metallic content in parts per million (ppm). There were four samples taken since the TRPCS, Serial Number B063-00403, was fitted. The first of these was a routine sample taken on 27 June 2016 at 1,232.40 airframe hours, about five hours after the TRPCS had been fitted. This sample was normal other than the copper content had triggered an Advanced Warning3, annotated red, on the printout with a figure of 5.3 ppm. 3 The ‘trigger’ thresholds are based on a comparison of the various constituent levels recorded in the data set against this gearbox’s previous figures and those of the other gearboxes in the fleet.

21 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information The second sample was taken at 1,568 airframe hours on 8 October 2016. The copper had returned to below-threshold levels at 0.7 ppm, but this time the silver content had risen and triggered an Advanced Warning with 3.2 ppm. In addition, the magnesium content had also risen and triggered an Early Warning, annotated amber, at 3.0 ppm. The third sample was taken on 18 October 2016. Although the flying hours at the time the sample was taken are not recorded, it appears to coincide with a TGB oil change and the level sight glass replacement two days earlier. The results of this sample showed the silver content had dropped to normal, but the copper content had risen again to trigger an Advanced Warning at 6.0 ppm. The magnesium content had risen further to 6.8 ppm and also triggered an Early Warning, annotated amber. The fourth sample was taken after the accident and triggered Advanced Warnings for the majority of the metallic constituents with iron, copper, silver and silicon at very high levels. For example, the iron content had risen approximately 20 times its normal level and silver approximately 40 times its normal level. The first three sample results for oil viscosity, TAN and water content showed the oil to be within the limits set out in the AMM, however the fourth sample taken after the accident showed that whilst the oil viscosity and TAN remained in limits the water content had risen out of limits. 1.6.12 Emergency procedures TR malfunctions and associated emergency procedures are referenced in the manufacturer’s Rotorcraft Flight Manual (RFM). Symptoms of an ‘uncommanded sharp right yaw’ or ‘yaw/spin’, not responsive to pedal inputs, are described for two malfunctions: ‘LOSS OF TAIL ROTOR THRUST IN FORWARD FLIGHT’ and ‘LOSS OF TAIL ROTOR THRUST IN A HOVER’. The actions required in a hover are to hold level, move the throttles to the stop position and use collective pitch to cushion the landing. Symptoms described for ‘TAIL ROTOR CONTROL SYSTEM MALFUNCTIONS’ are: binding or restricted pedal movement or little or no response to inputs, and procedures are provided to manage the failure as a fixed pitch condition. A failure mode resulting in a complete loss of control of the TR, as experienced during the landing on the West Franklin, is not addressed. The operator’s Emergency Checklist provided emergency procedures related to the TR. There were no references to ‘uncommanded sharp right yaw’ but there were references to ‘uncontrolled yaw’ entitled: ‘TAIL ROTOR DRIVE FAILURE’ and ‘TAIL ROTOR CONTROL FAILURE IN HOVER’. Both failures required an immediate landing; the ‘TAIL ROTOR DRIVE FAILURE’ actions equated to the RFM actions for ‘LOSS OF TAIL ROTOR THRUST IN A HOVER’.

22 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information In June 2017, the operator published revised titles, symptoms and procedures related to TR malfunctions in its Emergency Checklist. The titles and symptoms now more closely reflect those in the RFM. The associated procedures differ from those in the RFM and reflect the operator’s preferences for its specific operations in the offshore environment. The pertinent RFM and Emergency Checklist extracts are shown in Appendix  A. 1.7 Meteorological information The meteorological observation from the Elgin PUQ before G-WNSR landed on the Elgin was: surface wind from 220° at 20 kt, visibility 10 km or greater, broken cloud at 2,200 ft, temperature 8°C, dewpoint 3°C and pressure 1038 hPa. No lightning activity was recorded in the area. An Emergency Response and Rescue Vessel was on station for the landing on the West Franklin and reported the following weather conditions: wind from 250° at 20 kt to 25 kt, sea 2.5 m, sky overcast and visibility 10 nm. 1.8 Aids to navigation Not applicable. 1.9 Communications The Elgin PUQ helideck was manned and had radiotelephony (RT) communications which were recorded. The West Franklin helideck was not manned and operations there were overseen by the Elgin radio operator via a video link and RT communication. 1.10 Aerodrome information The Elgin installation is a manned platform designed to receive and process hydrocarbons from the West Franklin and Elgin wellheads before it is piped ashore. The West Franklin gas platform is an unmanned wellhead natural gas extraction facility in the Elgin field oil and gas area of the North Sea, situated 125  nm east of Aberdeen. The West Franklin platform stands in 93 m of water and is 3.3 nm away from the Elgin PUQ platform. At the time of the accident, there were two jack-up rigs positioned alongside the Elgin Wellhead Platforms: the Galaxy 1 and Prospector 5, detailed in Temporary Limitations Notice 15‑2016.

23 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.10.1 Elgin PUQ helideck The Elgin PUQ is a jack-up rig of steel construction, standing in 93 m of water and is situated 128 nm east of Aberdeen. It is connected to the Elgin wellhead platform by a 90 m long bridge. It is fitted with a Category ‘F’ (fixed) aluminium helideck supported on an aluminium frame designed for helicopter operations with aircraft up to maximum all up weight of 15 tonnes. The helideck is 51 m above the water and is circular in shape marked out to give a landing spot ‘D’ (MR diameter) value of 22.8 m. It is fitted with safety netting and has a helicopter refuelling and power supply capability. Its Helicopter Landing Area Certificate was valid on 28 December 2016 and was renewed on 9 January 2017 in accordance with CAP 437. There are notes on the certificate which draw attention to possible turbulence from the turbine exhaust and exhaust stack and to the presence of various fixtures and fittings around the edge of the helideck. It also makes note of a parking area extending from the south‑east sector of the helideck on which shuttle aircraft or containers may be situated. The Helideck Landing Area Certificate, Helideck Information Plate and Temporary Limitations Notice 15-2016 are shown in Appendix B. 1.10.2 West Franklin helideck The platform is predominantly of steel construction and is fitted with an aluminium helideck supported on an aluminium frame designed for helicopter operations with aircraft up to maximum all up weight of 12.8 tonnes. The helideck is 43 m above the water, octagonal in shape and is marked out to give a landing spot ‘D’ value of 21 m. It is fitted with safety netting around its edges. The landing spot is marked out with a flush lighting system built into the helideck surface. The aluminium surface of the helideck also has parallel rows of serrated ridges attached which are approximately 2 mm high to provide a non-slip surface over the helideck. The flight deck is certified in accordance with CAP 437 with a valid Helicopter Landing Area Certificate issued on 14 November 2016. The helideck is fitted with a remotely controlled firefighting capability. The platform is fitted with a crane designed for heavy maintenance operations and has reach to the flight deck when required. Although unmanned, the platform is fitted with shelter, communications and provisions for use in the event of personnel having to remain on the platform for prolonged periods, ie overnight. The Helideck Landing Area Certificate and Helideck Information Plate are shown in Appendix C.

24 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.11 Recorded information 1.11.1 Introduction G-WNSR was equipped with a Curtiss-Wright (Penny & Giles) Multi-Purpose Flight Recorder (MPFR), which recorded over 45 hours of data and 2 hours of audio, covering the period up to and including the accident. The audio recordings include the commander and co-pilot’s communications, radio transmissions, passenger announcements and audio from the cockpit area microphone. G-WNSR was also equipped with a HUMS to meet the EASA VHM regulatory requirements. The HUMS data provided snapshots of the health of components in the helicopter’s drive train for the period up to and including the accident flight. CCTV recordings from both helidecks were also reviewed to corroborate witness evidence. 1.11.2 Flight data The MPFR data indicated that G-WNSR lifted off from Aberdeen at 0722 hrs and touched down on the Elgin PUQ at 0820 hrs. It stayed on the Elgin with rotors running before lifting off briefly into the hover (yaw event) at 0842:50 hrs and departed en route about 30 seconds later for the five-minute flight to the West Franklin platform, where it touched down at 0848 hrs. 1.11.2.1 Elgin PUQ yaw event and lift off Figure 6 is a plot of the salient flight data parameters for the Elgin yaw event and lift off for the transit to West Franklin, starting with the helicopter on the helideck. In summary, the data indicates the following: UTC (hh:mm:ss) Event 08:42:47 Left pedal input made (helicopter on helideck – heading 270°). 08:42:49 Helicopter lifts off, rolls left and yaws right. 08:42:52 Full left pedal input, helicopter yawing 10°/s to the right. 08:42:53 Peak yaw rate of 12.5°/s recorded. 08:42:55 Collective reduced (then helicopter back on helideck – heading now 315° having yawed right 45°). 08:43:08.5 Collective lever starts to raise. 08:43:18 Helicopter lifts to hover and starts to yaw left. 08:43:20.5 Helicopter departs (for transit to West Franklin).

25 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information Figure 6 Salient parameters during the Elgin yaw event and lift off for transit to the West Franklin

26 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.11.2.2 West Franklin landing Figure 7 is a plot of the salient flight data parameters for the landing on the West Franklin platform starting with the helicopter manoeuvring over the helideck just prior to touchdown. Note that the flight recorder does not record data associated with the use or status of the landing gear wheel brakes. In summary, the data indicates the following: UTC (hh:mm:ss) Event 08:47:44 Yaw rate nominally zero with left pedal held at half pedal. 08:47:47 Left pedal input reduced and helicopter starts to yaw left. 08:47:49 Half left pedal input made but helicopter starts veering to the right and rolling to the left – helicopter heading 214°. 08:47:50 Max right yaw rate of 30°/s recorded before reducing as max left pedal inputs made. 08:47:50.2 Helicopter touches down (on left landing gear) rolled 13° to left – maximum left roll of 20° recorded less than half a second later. 08:47:52 Helicopter touches down on right landing gear - yaw rate about 20°/s with max left pedal inputs still being made. 08:47:55 Left pedal inputs reduce. 08:47:57 Pedals are nominally zero - right yaw rate reduces. 08:47:58 Rotor speed starts to reduce. 08:48:01.5 End of recorded data – helicopter final heading of 041° having rotated through 187° since loss of yaw control.

27 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information Figure 7 Recorded flight data for the West Franklin landing

28 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.11.3 Helicopter Vibration Health Monitoring Helicopters, unlike fixed wing aircraft, fly by virtue of a mechanical system rather than a structure. As such, the mechanism has a number of single load paths that form the rotor and transmission system, that make them potentially more vulnerable to catastrophic failures. VHM was introduced nearly 30 years ago to provide an automatic means of monitoring the health of these mechanical components. A HUMS is the application of VHM in an operational context providing data for trend analysis and condition-based maintenance. 1.11.3.1 VHM regulatory requirements On 1 June 1999, the CAA issued Additional Airworthiness Directive 001‑05‑99 that made the installation and use of VHM mandatory for UK registered helicopters issued with a Certificate of Airworthiness in the transport category and having a maximum approved seating configuration of more than nine. The acceptable means of compliance with 001-05-99 was originally specified in Civil Aviation Publication (CAP) 693; however, this did not give detailed guidance for VHM system design in order to achieve effective health monitoring. The CAA replaced 001-05-99, a design regulation, with a requirement in the Air Navigation Order (ANO), thus making the requirement for VHM an operational requirement. Accordingly, this moved the responsibility for compliance with VHM regulations from the Type Certificate Holders (TCH) to the operators. CAP 753 ‘Helicopter Vibration Health Monitoring’, introduced in September 2010, became the acceptable means of compliance with the new operational requirement. Following their formation in 2003, the EASA reviewed the requirements for VHM. They concluded that the National Aviation Authorities should, where necessary, introduce national VHM requirements for ‘demanding’ operations, such as those operations in the North Sea. More recently and presently only applicable to new VHM system designs, the publication of EASA CS-29 (Certification Specifications for Large Rotorcraft) Amendment 3 dated December 2012, introduced CS 29.1465 Vibration Health Monitoring into the regulation. The requirement was developed by an EASA/FAA/Industry Rotorcraft VHM Working Group (RVHMWG) picking up on work that had been started by the Helicopter Health Monitoring Advisory Group (HHMAG). The requirement is, however, unique to CS-29 and does not feature in the FAA’s equivalent regulations for large rotorcraft, FAR-29.

29 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information EASA issued a Notification of a Proposal to issue a Certification Memorandum (CM-S-012) on 9 November 2017 that will require operators to verify that VHM system performance is compliant with an appropriate standard, where required for SPA.HOFO.155 (Helicopter Offshore Operations). For the S-92A the VHM requirements are met by the use of HUMS. 1.11.3.2 VHM alert threshold philosophy Gradual wear and degradation of the helicopter’s principal mechanical systems is detected through Condition Indicators (CIs) which are calculated from data from vibration sensors on critical areas such as the rotors, engines, gearboxes and drive shafts. VHM requires the design organisation to set threshold values for each CI above which an alert is generated. Whilst the thresholds need to be set above the normal vibration levels, if they are set too low then the rate of false alarms can result in an unacceptable maintenance burden. It is normal for the HUMS manufacturer or TCH to review and, if necessary, revise the threshold levels, and introduce new alerts, as a result of knowledge gained from statistical analysis of vibration levels across the fleet. The guidance to operators given in CAP 753 states that the period between the successful download and assessment of any primary VHM indicator, used for monitoring the engine and rotor drive system components, should not exceed 25 flying hours. This interval is reduced to ten flying hours for components or indicators that require ‘close monitoring’ where, for example, an indicator value has exceeded a ‘maintenance action’ threshold or shows signs which warrant increased attention. As previously stated, ten flying hours is not atypical of a complete day’s flying for North Sea helicopter operations. The Acceptable Means of Compliance (AMC) to CS 29.1465 states in paragraph n. (Performance Criteria) that: ‘(1) Signal Acquisition The applicant for VHM system certification should specify the rate of acquisition of data sets for defect diagnostics in consistent flight regimes. As a target, the total data set acquired in a flight should be sufficient for complete and reliable diagnostics to be produced for every flight above a defined duration in stabilised conditions. As a minimum, at least the data set for all components should be

30 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information automatically obtained on each flight of greater than 30 minutes in stabilised conditions without the need for in-flight pilot action. For operations which do not contain periods of stabilised operation of greater than 30 minutes, alternative procedures need to be incorporated to ensure that the total data set is recorded within a specified number of flying hours related to the minimum adequate frequency of data collection determined under AMC 29.1465(e)(2), and in any case no longer than 25 flying hours. Where subsystem performance is critical or relied upon to achieve the quoted defect probability of detection or False Alert rate, such as sensor accuracy, dynamic range or bandwidth, then this should be quoted.’ Specifically, the AMC to 29.1465(e)(2) states in bullet (ii) that: ‘The data acquired from the vibration should be automatically gathered in specifically defined regimes at an appropriate rate and quantity for VHM signal processing to produce robust data for defect detection.’ The AMC to CS 29.1465 paragraph n. then continues: ‘(2) Data transfer and Storage Capability The VHM defect status data should be capable of being downloaded during rotors running turnarounds.

All the data sets acquired should be stored until successfully transferred to the Ground-Based System. The storage capacity should not be less than 25 flying hours. The applicant should describe the maximum interval between data downloads for which the system memory capacity is not exceeded. In the event that a complete data set is not recorded, the data transfer process should be capable of downloading a partial data set to the Ground-Based System. In such a case, the ground station should alert maintenance personnel of a missing maintenance log or that the data set provided is incomplete.

31 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information (3) VHM Alert generation and fault detection performance The Alert and Alarm generation processing should be designed to achieve a claimed probability of detection that is acceptable to the Agency for each component defect being monitored. Processing to isolate False Alerts and False Alarms should not result in an unacceptable workload. Also this processing should not compromise the verification and validating evidence of claimed defect detection performance. This workload should be assessed prior to completion of the Controlled Service Introduction (CSI) phase.’ In the note to Section g of the AMC to CS 29.1465, it also states that: ‘The fixed or learnt thresholds for each individual health monitoring indicator may have a limited capability to detect incipient failures in a timely manner.  This is because the process for threshold setting is sometimes a compromise between increasing sensitivity and incurring a higher risk of false alarms, or reducing sensitivity, which will delay the point at which a rising indicator value will trigger an alert.   In-service experience has shown that MGB component fatigue failures can propagate from initiation to failure in a relatively short period of time, thus the use of fixed thresholds alone may not provide a timely indication of impending failure.  One characteristic that can often provide an earlier indication of anomalous behaviour is the rate of change of a health monitoring indicator, and automatic trend detection software has been developed and shown to be effective.  Another method, commonly referred to as Advanced Anomaly Detection (AAD) combines numerous indicators into multi-dimensional parameters, whereby simultaneous changes of multiple indicators can provide increased confidence of the anomalous behaviour at an earlier point in the failure process.’ CAA Paper ‘2011/01 Intelligent Management of Helicopter Vibration Health Monitoring Data’ defines Advanced Anomaly Detection (AAD) as an approach that detects abnormalities in rotor drive system components by comparison of multiple downloaded health monitoring parameters with prepared multi‑parameter models of normality for these components. It also provides diagnostic information on the monitoring parameters causing abnormal indications. The multi-parameter models of normality represent the statistical dependencies between monitoring parameters and are based on experience across multiple aircraft within a fleet. The approach incorporates methods to

32 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information ensure that any unknown abnormalities within this experience do not prevent the detection of similar abnormalities. Models are to be periodically refined based on increasing fleet experience. The use of alert thresholds for individual CIs or the anomalous behaviour based on multiple CIs are all attempts to generate warnings as early as possible. However, other factors affect the timeliness of these warnings: how often a sensor is sampled during a flight, how long it takes to process data, how frequently the data is downloaded, how soon it is checked for exceedences and any delay in passing on exceedence information to the relevant people for it be acted upon. A 2012 CAA paper ‘2012/01 Application of AAD to Tail Rotor HUMS Data’, which reported on a study to demonstrate the application of AAD methods developed and successfully applied to HUMS transmission data (CAA paper 2011/01), recognised the importance of timeliness when new techniques such as AAD were able to detect a failure with little warning. It concluded that: ‘Using AAD it is possible to detect tail rotor defects in Vibration Health Monitoring (VHM) data, but warnings are unlikely to be much in advance of the end of the flight preceding the ‘failure’ flight. On-board, post-flight indications would therefore be required for such a scheme to be effective.’ 1.11.4 HUMS configuration on the S-92A On the S-92A the HUMS forms part of the commercially available IMD-HUMS4 that provides the following functions: ● ● Built-In Tests (BITs) ● ● Mechanical Diagnostics ● ● Usage Monitoring ● ● Exceedence / Event / Alert-Monitoring ● ● Engine Vibration Monitoring ● ● Rotor Track and Balance ● ● Engine Shaft Balancing The IMD-HUMS consists of two distinct sub-systems: the On-Board System (OBS) and the Ground Station (GS). At the time of the accident, the operator was using the IMD software on its GSs. The helicopter manufacturer had released new GS software, called the Sikorsky Ground-Based Application (SGBA), in May 2015 and this was being evaluated by the operator; however, 4 IMD-HUMS was developed by the Goodrich Corporation (and the US Navy), and selected by the Sikorsky Aircraft Corporation in 2001 to be fitted as standard equipment on the S-92.

33 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information the maintenance manual revision to support the software was yet to be released. The differences in functionality between the IMD and SGBA software are discussed later in this report. The OBS collects and records aircraft information on a per-flight basis. Data is then transferred from the OBS to the GS using a Data Card. The GS is then used to analyse the collected data and to maintain a detailed operational history of the helicopter. The percentage of the Data Card used is continuously displayed on the HUMS page of the helicopter’s Multi-Function Display, and when less than 2 MB of free space remains (equivalent to about 12 minutes of data), an exceedence is generated, prompting the crew to replace the Data Card. This is the only exceedence that the HUMS will display during flight. 1.11.4.1 Mechanical diagnostics The S-92A HUMS User Guide states that the goal of the mechanical diagnostics function is to enable a transition from time-based maintenance to condition‑based maintenance by acquiring vibration data from dynamic components and other monitored systems. The system is designed to collect data snapshots automatically on the ground, in the hover and in the cruise, without any aircrew input, during all flights for specified gearbox and flight regime combinations (provided the helicopter remains within the flight regime for the duration of each acquisition). It also includes a manual mode that enables pilot-initiated data collection which is either ‘prompted’ (where the pilot, in conjunction with OBS prompts, explicitly selects the gearbox group of interest and then enters, and maintains, the desired flight condition and initiates data capture - if the flight condition is not maintained, the OBS will abort the acquisition), or ‘forced’ (where the pilot again initiates an acquisition; however, in contrast to the prompted mode, the OBS completes the data acquisition regardless of the flight regime). Data from the TR sensor is captured automatically during cruise flight (and > 60 kt) where the helicopter needs to be maintained in a steady state condition for a minimum of ten seconds. The processing of this data takes about 1.5 minutes to complete before the system captures and processes data from other sensors. A full rotation of data capture and processing, when in the cruise, takes about eight minutes and is therefore suitable for trend analysis and detection of the gradual wear and degradation of components over time but not for capturing transient events. 1.11.4.2 Ground station software mechanical diagnostics The mechanical diagnostics functions of the IMD GS software (used by the operator at the time of the accident) provide a means for viewing data collected

34 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information from individual drive train sensors and to provide a colour-coded health indicator to provide an indication of change in the drive train components and provide assistance for troubleshooting if a significant change occurs. The green ‘normal’ range is based on a priori measurements of known, healthy components; the yellow ‘warning’ range denotes components that exhibit mechanical diagnostic characteristics that differ from the known, healthy components, and the red ‘alarm’ range denotes anomalous components that have markedly different mechanical diagnostic characteristics. Within each range, the absolute value of the health indicator is secondary to the trend of the health indicator. The IMD GS software has summary ‘debrief’ pages that list each flight for the selected helicopter for which HUMS data has been uploaded onto the GS. By selecting each flight, line by line, exceedences for the selected flight are then displayed which can then be viewed in detail in time-history strip charts by selecting the exceedence. The GS also includes diagnostic tools in addition to those in the main IMD GS software, in the form of standalone tools, run separately on the GS, to analyse and/or detect (1) TR blade pivot bearing retainer disbonding, (2) TGB bearing energy, and (3) main gearbox cracks. These diagnostic tools are selected via the standalone IMD-HUMS ToolBar (Figure 8), which requires the HUMS raw data files already installed on the GS to be uploaded into the ToolBar to be processed. The resulting CI time-history charts are then individually inspected for exceedences – these are not automatically displayed as an alert. Figure 8 IMD-HUMS ToolBar 1.11.4.3 TGB bearing energy analysis software The TGB bearing energy analysis software is a standalone tool accessed via the IMD-HUMS ToolBar. It is intended to help assess the condition of the TGB’s two input and output bearings as well as the TRPCS bearing assembly. This tool was developed and introduced in 2007 following degradation of a bearing believed to be due to foreign object debris. The software uses data recorded by the HUMS from the existing TGB accelerometers and provides additional means of monitoring the condition of the TGB through changes in its vibration signature. The diagnostic tool responds to any defect in the TGB that manifests itself in the 15-20 kHz frequency range.

35 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information The TGB bearing energy CI is generated by computing the average 15‑20 kHz energy for the selected helicopter since its last maintenance date. This date is important since removing/replacing the TGB, the pitch change shaft assembly, or the TGB accelerometer can change the absolute value of the CI. The 15‑20 kHz energy is then normalized by the calculated helicopter-specific mean. This normalized energy is referred to as the CI ratio. The CI ratio is then plotted as a trend history with reference to a baseline for the helicopter that is nominally 1.0. The baseline data consists of 200 points that provides a baseline characteristic that is unique for that helicopter and from which an alert limit threshold is generated (if the 200 points have not been acquired no limit threshold will be calculated and the tool displays ‘Insufficient Data’ on the trend history). In order to speed up the acquisition of the initial baseline data, pilots can manually initiate data acquisition. The limit threshold for the CI ratio is 1.75 of the baseline; however, for users of the SGBA GS software prior to the accident, the threshold was raised from 1.75 to 2.5 following a review in 2015 of the tool and process improvements to remove a high number of false alerts5. In January 2017, following the accident to G-WNSR, the threshold was reduced to 1.75 for SGBA users, and hence in line with the IMD GS software; manufacturer’s Temporary Revision No 45-03 dated 10 January 2017 refers (Appendix D). 1.11.5 Operator’s internal HUMS procedures 1.11.5.1 Operator’s HUMS download procedure At the time of the accident, the procedure was for the Data Card to be removed and downloaded every time the helicopter returned to a main operating base (MOB) for the HUMS data to be reviewed before the helicopter’s release to service. The operator also limited the time between download (and review) to a maximum of five flying hours. If planned operations were such the flying time could exceed five hours, the crew would carry a card reader to enable them to download the data themselves and then forward the data to the MOB for review. If the helicopter was planned for a detachment or shutdown offshore, its GS laptop would be taken offshore too. At the MOB it was the responsibility of a licensed engineer, signing for the flight, to transfer the data onto the GS and make a preliminary analysis of the data to look for trends and establish if any alerts had been generated. Had any alerts been generated, the engineer would inform the operator’s base in Norway who were, at the time, responsible for the operator’s S-92A HUMS global support. HUMS technical support was continuously available to the engineering staff through the HUMS Support team. 5 These false alerts had been caused by a now-resolved manufacturing process issue.

36 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information At the end of each day, the HUMS data was automatically sent to the operator’s base in Norway, for it to be reviewed the following day. It was also automatically sent to the manufacturer who were responsible for continued development and support of HUMS for the worldwide S-92A fleet. The documented procedures included a HUMS flowchart that should be followed by the licensed engineer which first required the engineer to confirm the alert status on the IMD GS software before proceeding with the IMD‑HUMS ToolBar. However, the operator’s own investigation into this accident identified that the flowchart omitted two items concerning the ToolBar, one of which was to conduct a review of the TGB bearing energy CI. The TGB bearing energy CI was not subject to ‘close monitoring’. 1.11.5.2 G-WNSR HUMS download Engineer A, who was responsible for the maintenance on G-WNSR on 27 December 2016, transferred the HUMS data from the helicopter onto the GS after the final flight of the day. He then made his preliminary analysis of the data firstly using the main IMD GS software. He established that no thresholds had been exceeded and all of the mechanical diagnostics were green. He then ran the IMD-HUMS ToolBar, during which he and Engineer B, were unsuccessful in zooming in on the TGB bearing energy CI ratio chart to identify and confirm the exceedences. Figure 9 shows the time-history chart as presented to Engineers A and B, when they visually inspected the TGB bearing energy CI ratio (this figure has been recreated, using the original data, for the purposes of this accident report). Note that the x-axis automatically scales to show the complete time-history since last TGB maintenance date, which for G-WNSR was 6 October 2016, and the y-axis automatically scales from zero to the full range of CI ratio values. However, had either of the licensed engineers successfully zoomed in on the day’s flight, the exceedences would have been clearly visible (see Figure 10 for a recreated zoomed-in version of the original data) with the highest and final exceedence being just over 17 compared to the alert limit threshold of 1.75.

37 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information Figure 9 Recreated TGB bearing energy CI ratio time-history chart

Figure 10 Recreated TGB bearing energy CI ratio time-history chart zoomed to last flight on 27 December 2016

38 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information When, on the morning of 28 December 2016, the operator’s S-92A HUMS global support team in Norway reviewed the HUMS data for 27 December, the exceedences in the TGB bearing energy CI ratio were detected. At 1311 hrs they contacted the operator in Aberdeen, only to be told that the helicopter was currently on the West Franklin platform. Figure 11 shows the TGB bearing energy CI ratio relative to the flight data for the third and final flight (comprising three sectors) on 27 December 2016 (during which the exceedences occurred), showing the various flight conditions at which data from the TGB accelerometers was acquired. The first exceedence (a single point) occurred just over an hour into the first sector of the third flight, about 45 minutes before landing. The next exceedences occurred during the last hour of the third sector back to the MOB at Aberdeen. Figure 11 TGB bearing energy CI ratio and recorded data for third flight on 27 December 2016

39 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information In summary, the helicopter was operational (with rotors turning) for a total of 10.4 hours on 27 December 2016 and the first exceedence occurred after 6.9 of these operational hours. It was a further 3.5 operational hours before the helicopter returned to its MOB for the HUMS data to be downloaded and hence the first opportunity (which was missed) for the operator to become aware of the exceedence. During these 3.5 hours the helicopter landed twice (but did not shut down) – the first after about 0.7 hours and the second after a further 0.6 hours before returning to the MOB. After G-WNSR was recovered following the accident on the West Franklin, the HUMS data for 28 December 2016 was downloaded. Figure 12 shows the TGB bearing energy CI ratio for this flight and indicates that during the first leg (from Aberdeen to the Elgin PUQ) 12 sets of data were acquired of which the last nine resulted in TGB bearing energy CI ratio exceedences. Figure 12 TGB bearing energy CI ratio and recorded data for the flight on 28 December 2016

40 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information As the Elgin event did not happen during the cruise phase of the flight, no data from the TGB sensor was captured, nor was any during the short sector to the West Franklin. Figure 13 shows a graphical representation of the flight schedule for G-WNSR for the two weeks leading up to the accident. During this period, G-WNSR flew on nine of these days, two of which contained two flights with a daily total operational time of over 10 hours. The timing of the exceedences concerning these flights is indicated. 0 1 2 3 4 5 6 7 8 9 10 11 12 0 1 2 3 4 5 6 7 8 9 10 11 12 DAILY CUMULATIVE OPERATIONAL HOURS DAILY CUMULATIVE OPERATIONAL HOURS Flight 1 (airborne) Flight 2 (airborne) Flight 3 (airborne) Exceedence Takeoff/Landing Figure 13 G-WNSR operating history for previous two weeks Figure 14 combines the operating histories for the last two days to form a timeline beginning with the start of operations on 27 December 2016, with the first exceedence highlighted at 6.9  operational hours and the accident 5 operational hours (about 4 flying hours) later. 0 1 2 3 4 5 6 7 8 9 10 11 12 0 1 2 3 4 5 6 7 8 9 10 11 12 CUMULATIVE OPERATIONAL HOURS Flight 1 (airborne) Flight 2 (airborne) Flight 3 (airborne) Exceedence Takeoff/Landing

|27/12/2016

|28/12/2016 6.9 hours from start of operations to first exceedence 5.0 hours from first exceedence to accident Figure 14 G-WNSR operating history for the two days prior to the accident

41 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.11.5.3 Operator internal HUMS training Training for line engineers on the use of HUMS is given over three days at the end of their line training. The HUMS training, given to the operator’s line engineers worldwide, was provided by an external contractor. The material presented during the HUMS training for the S-92A includes the manufacturer’s HUMS User Guide for the S-92A (SA S92A-HUM-000 – most recent revision was dated 30 December 2012). 1.11.5.4 Interrogating HUMS time-history strip charts The manufacturer’s HUMS User Guide describes the specific user commands to zoom in or out of the data presented in the time-history strip charts. These commands are applicable to the strip charts in the main IMD GS software as well as the IMD-HUMS ToolBar. For zooming it states: ‘(a) Position the cursor over the portion of the graph you wish to enlarge. (b) Click and hold the left mouse button and drag the magnifier box (faint white outline) down and right over the region to be enlarged. (c) Release the mouse button to display the area inside the magnifier box. (d) Continue to Zoom in on the desired area of the graph. The entire graph will be enlarged but the area of interest will remain in view. (e) Once the graph has been zoomed to the desired size, the entire graph may be viewed by holding the right mouse button down and dragging the graph left and right or up and down.’ To undo zoom it states: ‘(a) Position the cursor in the lower right of the graph, and while holding the left mouse button down, drag the cursor to the upper left and release. The graph will return to its normal size.’ Although the command is to drag the magnifier box down and right over the region to be enlarged, for strip charts in the main IMD GS software, dragging up and right also has the same effect. Similarly, the undo zoom, which requires the user to select any point on the strip chart and drag the resulting box up and left, also works dragging the box down and left. However, for strip charts in the IMD-HUMS ToolBar and several sub-functions within the IMD

42 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information GS software, only dragging down and right will zoom (as per the user guide); the three remaining combinations each undo zoom. These additional zoom and undo zoom commands are not discussed in either the HUMS User Guide or any training material. Early on in the investigation, the manufacturer was made aware of the differences in the zoom functionality within the main IMD GS software and the standalone IMD-HUMS ToolBar and the possibility of confusion this offered for users of the IMD software. 1.11.5.5 Sikorsky Ground-Based Application (SGBA) In May 2015, Sikorsky issued their own GS HUMS software called the SGBA for use with S-92A and S-76D helicopters. This (and the corresponding user guide) was made available to operators of these helicopters to trial; however, the relevant S-92A maintenance manual revisions were not issued until March 2017. The operator of G-WNSR had been trialling the SGBA since 2015 in order to develop their knowledge of the application and be able to transfer to it at the earliest opportunity after the release of the maintenance manual revision. Meanwhile, the licensed engineers continued to use the existing IMD GS software and IMD-HUMS ToolBar. Like the IMD GS software, the SGBA was designed to analyse, process, and compile flight data into useful information for the maintenance crew, logistics team, operations department, and engineering support. The SGBA, however, introduced many enhanced features such as enhanced diagnostics capabilities, and improved user interfaces such as colour-coded visual indicators to highlight inspection requirements. As an example, Figure 15 shows the Tail Gearbox Bearing Energy Tool for G-WNSR with the TGB bearing energy CI ratio together with two additional CIs, related to the TRPCS bearing. One key difference is that the first page (Figure 16) automatically presented to the user gives a summary of all CI exceedences and alerts to be actioned in accordance with the AMM, including those which previously, using the IMD GS software, required manual interrogation. To promote the enhanced features available in the SGBA, the helicopter manufacturer issued an All Operators Letter CCS-ALL-AOL-17-0008 dated 24 March 2017 (Appendix E) to inform users of the IMD software that: (1) the IMD software would be ‘rendered obsolete’ in the near future, (2) the maintenance manual revisions were released on 9 March 2017 to support customers transitioning from the IMD software to SGBA,

43 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information (3) highlighted some of the enhanced features of the SGBA, and (4) reminded users of the approved zoom and undo zoom commands for interrogating time-history strip charts.

Figure 15 SGBA Tail Gearbox Bearing Energy Analysis Tool

Figure 16 SGBA initial page highlighting exceedences and alerts

44 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.12 Wreckage and impact information 1.12.1 Helideck Yaw control was lost at about 4 ft above the helideck. The helicopter then descended with a left rolling moment. The left main landing gear contacted the helideck first and was canted over which presented the outer edge of the wheel rim to the helideck. This resulted in a dent in the top layer of the helideck approximately 150 mm long, part of which was an 80 mm cut which penetrated the helideck surface. The cut matched the distortion in the wheel rim. Figures 17 and 18 show the rim distortion and helideck damage. Black rubber scuff marks were also made on the helideck surface consistent with the tyre scrubbing during the rotation of the helicopter in the accident sequence. Figure 17 Left outer wheel rim distortion (courtesy of CHC Scotia Ltd) Figure 18 Helideck damage (courtesy of CHC Scotia Ltd)

45 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.12.2 Initial helicopter examination on the helideck The crew carried out an initial examination of the helicopter whilst on the helideck. The helicopter showed no outward signs of damage apart from distortion to the outer rim of the left outer mainwheel. The tyre was seated in its rim and had remained inflated. The crew were asked, by maintenance control, to carry out a “full and free” yaw pedal check. They did this by starting the APU to energise the hydraulics and cycled the yaw pedals through their full range of motion whilst observing the TR. The results were indeterminate and the situation precluded further diagnosis at that stage. Subsequently, a team of the operator’s engineers arrived by boat and the helicopter was lifted by crane from the helideck and transported by sea back to its maintenance base at Aberdeen. 1.12.3 Examination at maintenance base Further examination of the helicopter was then carried out at the maintenance base with the assistance of the manufacturer. Without hydraulic power applied it was found that the yaw pedals moved easily. Further inspection found the TR servo piston was broken at the point where the walking beam pivot bar is attached leaving the walking beam pivot in a loose and unrestrained condition. However, the control input eye end was correctly connected to the walking beam and to both the first and second stage servo control valves. The centring spring between the two control valve linkages was also correctly connected. The TR servo was removed and a disassembly of the TRPCS revealed severe damage to the TRPCS bearing. The bearing showed evidence of overheating and discolouration, a partial friction welding of the rollers, cages and inner race with the outer races loose and heavily scored. The PTFE seals and snap rings were not evident. There was no lubricant present in the bearing. Figure 19 shows the bearing on removal. Figure 19 TRPCS bearing from G-WNSR

46 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information The TGB, TR hub and blades were examined in situ and no outward signs of damage found. All of the TR related components were removed from the helicopter and the TGB, TRPCS and servo were returned to the manufacturer for forensic analysis. 1.12.4 Examination by the manufacturer The components were examined in stages at the manufacturer’s facility in the USA and the examination was overseen by NTSB, FAA and AAIB representatives. 1.12.4.1 TRPCS bearing The TRPCS bearing was severely damaged and was no longer a viable bearing. The outer races on both sides of the bearing had been subject to intense heat and were discoloured. The roller tracks were heavily scored and pitted with none of the smooth hardened surfaces remaining intact. Some roller cage material was also dispersed around the surfaces of the roller tracks. All of the barrel-shaped rollers were present and were welded to the inner races along with the remains of their cages. The rollers were also flat sided. The roller set nearest the servo linkage (the inside bearing) exhibited the most damage and the rollers had lost approximately half their diameter. The outer rollers, nearest the TR, had flat sided to a lesser extent and were still recognisable as barrel rollers. The wear in the inner and outer races and the distortion of the rollers and cages, allowed at least a 0.5 inch (12.5 mm) linear play or looseness in the bearing. There was no hydrocarbon component (the lubricant) of the grease present on or within the bearing. However, there was a residue of the grease thickening agent present within the remains of the bearing but not enough for useful forensic analysis. 1.12.4.2 Tail rotor gearbox The TR gearbox casing, input and output shafts showed no evidence of external damage and were free from leakage. The gearbox was disassembled and the internal components examined. The bearings, shafts, input pinion and crown wheel were undamaged with no discernible signs of wear. The TRPCS guide grooves within the output shaft were also undamaged although there were small amounts of an unidentified deposit within the bore and at the ends of the TRPCS guide grooves. Samples of the deposits were sent for further analysis and were found to be wear products from the phosphor bronze carrier.

47 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.12.4.3 TR servo An external visual examination was carried out. The servo appeared to be in a good overall condition with the exception of a fracture of the primary piston within the secondary piston sleeve. A cross-section of the servo primary and secondary pistons and cylinder with the location of the fracture is shown in Figure 20. A functional test under hydraulic pressure could not be carried out due to the damage on the primary piston. There was no evidence of hydraulic leakage and the walking beam, servo valves and body were undamaged. The anti-rotation tab showed evidence of wear on both sides with a corresponding witness mark within the anti-rotation plate slot. The servo was disassembled as far as possible; however, the inboard face of the primary piston head was tight against the gland seal and could not be moved. Remnants of seal material were present in the vicinity of the outboard piston face. There were signs that the primary piston had been rotating within its cylinder evidenced by rotational scoring on the bore of the cylinder. This scoring was approximately 35 mm from the housing face (TGB mounting flange) and extended along the bore, in the piston retraction direction, by approximately 18 mm. Rotational marks were also present on the contact surface between the primary and secondary pistons. The clevis assembly, which attaches the primary piston to the TRPCS bearing, could not be removed despite the application of a 350 lb ft torque. Residual hydraulic fluid within the servo appeared normal. The primary piston which had parted within the secondary piston tube, was removed and sectioned for metallurgical examination. The surfaces were examined under a scanning electron microscope which revealed evidence of smearing and shear overload, consistent with a ductile overload in torsion. Primary piston failure location Figure 20 Servo cross-section and fracture location (courtesy of Sikorsky)

48 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.13 Medical and pathological information Not applicable. 1.14 Fire Not applicable. 1.15 Survival aspects All persons on-board a helicopter operating offshore in the North Sea area are required to be current in Helicopter Underwater Escape Training. Survival suits and associated equipment are required to be worn. Whilst flying operations are carried out on the West Franklin platform a safety boat is positioned nearby to respond to a helicopter ditching or man overboard situation. 1.16 Tests and research 1.16.1 Engineering 1.16.1.1 Immediate action After the components had been removed from G-WNSR and examined, the manufacturer issued an All Operators Letter (AOL) CCS-92-AOL-16-0019 (Appendix F) on 31 December 2016 drawing attention to the event with the details as they were understood at the time. In particular it drew attention to the importance of the HUMS Tail Gearbox Bearing Energy Tool in understanding the condition of the TRPCS bearing. As the investigation progressed and as the sequence of events leading to the bearing failure became clearer, the manufacturer issued an ASB to all operators on 10 January 2017. ASB 92‑64‑011 (Appendix G), supported by an FAA Airworthiness Directive (AD) 2017-02‑51 (Appendix H) dated 13 January 2017, gave instructions to establish the condition of the TRPCS bearing assemblies in service and action to be taken should the airworthiness of a bearing be in doubt. Concurrent with the issue of ASB 92-64-011, the manufacturer published Temporary Revision 45-03 which required operators to use HUMS GS software to review, on a reduced flight hour interval, the TGB energy analysis CIs for any alert conditions. The AD required action to be taken on the TRPCS bearing assembly before next flight. It reinforced the ASB technical instructions to all S-92A operators to remove and inspect the TRPCS bearings. If the bearing did not rotate freely, sounded rough or chattered, was leaking grease, or had metallic particles present, or had nicked or damaged PTFE seals, the assembly

49 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information should be rejected and immediately returned to the manufacturer. In addition, the AD required bearings that showed none of these issues could remain in service with a repeat 10-hourly borescope inspection programme to inspect the condition of the PTFE seals and snap rings. The helicopter operator also introduced a number of measures to further strengthen the ability to detect impending bearing degradation. These included: a review of all HUMS data to ensure no anomalies, fleet-wide borescope inspections and a requirement for HUMS to be serviceable before flight. The operator also reviewed their HUMS processes and analytical procedures, correcting the omission in the documentation of the use of the IMD-HUMS ToolBar analysis tools. They also introduced a requirement for an additional assurance check to be carried out by a second licensed engineer prior to releasing the helicopter to service. 1.16.1.2 Inspection feedback and subsequent actions TRPCS bearings which were deemed unsatisfactory to continue in service were returned to the manufacturer. In total, by April 2017, 19 shafts were removed for further evaluation from 253 helicopters reporting ASB compliance, out of the global fleet of 275. The reasons for these removals were as follows: ● ● 10 shafts removed due to a HUMS Bearing Energy CI ratio exceeding a revised limit of 1.75 ● ● 4 shafts removed due to physical inspection identifying ratchet/rough bearing condition ● ● 5 shafts removed due to visual indications The manufacturer devised a rigorous non-destructive inspection process and applied it to each of the received bearings to ensure that no evidence was lost by disassembly and the bearings were assessed in their in-service condition. This test regime was devised to establish several important factors. A visual examination was carried out to confirm any observations made by the operator rejecting the TRPCS and to identify anything abnormal. Particular attention was paid to the condition of the seals and snap rings for signs of leakage of the grease, the presence of debris or evidence of wear. The phosphor bronze guide lugs were also examined for signs of abnormal loading or wear pattern from the TGB output shaft. The components in the TRPCS assembly are made to a close tolerance and therefore can be assumed to not vary in weight between individual assemblies. Any variation in TRPCS weight would be attributed to the amount of grease

50 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information present in the bearings. Thus, the amount of grease present can be deduced from an accurate weighing of the TRPCS assembly. An end float measurement, carried out at room temperature, showed how much play was present within the inner and outer races of the bearing. The allowable end float or play was a minimum of 0.002 inch (0.0508 mm) to a maximum of 0.005 inch (0.127 mm). On completion of the initial inspections, the TRPCS assembly was mounted in a specially constructed spin rig based on a TGB and hub assembly. The TRPCS was then run whilst the rig control programme subjected the bearing to the forces and loads experienced in service. The TRPCS was then disassembled and the bearings inspected. As a control, life-expired TRPCS assemblies awaiting rework were also put through the same test regime. 1.16.1.3 Results The majority of TRPCS assemblies were returned due to a slight ‘notchiness’ or stiffness when a ‘by hand’ examination was carried out during AD compliance inspections. All returned TRPCS assemblies were in a good overall condition and none exhibited the degraded condition of the TRPCS removed from G-WNSR. The test results were varied. None of the assemblies showed any serious outward signs of impending failure or abnormal wear. All TRPCS weights confirmed the presence of grease within the bearings albeit in varying quantities. Some of the tight or notchy bearings had no end float, whilst other bearings were within limits. Of the 19 TRPCS removals, 18 bearings did not exhibit unusual or advanced wear or degradation, but one bearing exhibited roller wear and unusual indications on the outer race. During spin testing, the average or normal temperature was around 240°F (115°C) peaking at around 300°F (150°C) in some cases. All TRPCS assemblies tested in this way showed no signs of further degradation or impending failure. However, it was found that some of the TRPCS bearings ran hotter than had been previously assumed or expected. During this process an unsuccessful attempt was also made to deliberately cause a TRPCS bearing to fail on a life-expired TRPCS. To understand further the running temperature of the TRPCS bearing in service, the manufacturer developed a small temperature sensing plug which could be fitted in the bore of the TGB output shaft next to the bearing. It consisted

51 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information of a set of four temperature sensitive pads which change colour depending on the temperature experienced. This plug was issued to all operators on 9  March  2017 under ASB 92-64-012 (Appendix J). Information received back from the operators suggested the running temperatures were between 320°F (160°C) and 340°F (171°C) on newer bearings. It was also found that in some cases these higher temperatures drop by approximately 40°F (22°C) over a period of 25 hours. The temperature profiling of the TRPCS bearing resulted in two shafts being sequentially removed from one helicopter. As a result, the manufacturer requested the removal of the TRPCS, TGB and servo from this helicopter6 as a whole assembly for further analysis. The helicopter manufacturer has worked with the bearing manufacturer to identify and implement a number of improvements to the bearing manufacturing process. An improved end play measuring tool has been introduced to carry out more accurate measurement and bearing setting up during assembly. The grease is now drawn from sealed cartridges and injected into the races using a syringe to ensure a more consistent quantity and distribution. The bearing is also now weighed before and after grease application. Throughout this activity the manufacturer has issued regular updates to all operators of the S-92A to keep them informed of the steps taken to ensure the continued airworthiness of the TRPCS bearings. 1.16.2 Recorded data mining 1.16.2.1 HUMS Following the accident, the manufacturer performed a review of the S-92A fleet HUMS data to determine if modifying the TGB bearing energy CI ratio exceedence threshold, or applying new techniques, would enable additional prognostics for the HUMS Tail Gearbox Bearing Energy Tool. When retrospectively applied to the HUMS data from G-WNSR, modifying the threshold did not provide any earlier warning than the existing four flying hours. However, a review of other CIs that focused on the TRPCS bearing, and the development of new algorithms, extended the warning to just over 16 flying hours. These features have now been incorporated into SGBA. 1.16.2.2 Operational indicators The helicopter manufacturer reviewed data from the 11 liftoffs of G-WNSR, prior to the event on the Elgin, to determine whether there was any pre-accident evidence of a degradation that could be identified through the flying controls and 6 This helicopter was flying extended range sectors relative to the rest of the fleet.

52 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information thus provide some warning to flight crews. The pedal and collective positions recorded at the point at which weight-on-wheels indicated liftoff were analysed; no trend of increasing use of left pedal prior to the event was apparent. Data for in-flight pedal position for other helicopters in the fleet during a typical offshore sector were also reviewed and no outstanding trend was apparent. Additionally, the helicopter manufacturer reviewed their archive of flight data records to determine whether it is an unusual event for a pilot to use full pedal travel in flight. The analysis showed that the use of full pedal was very rare but had occurred in each of the previous events of TRPCS bearing failure (see paragraph 1.18.2). Conclusions from the review were that this cue is available to flight crew prior to bearing failure, but is indicative of a bearing that is already in an advanced state of degradation. Thus, the use of full pedal travel could indicate a need for prompt action to abort a flight and the helicopter manufacturer is considering whether changes to the RFM could be introduced. 1.17 Organisational and management information During the investigation AAIB inspectors visited the operator’s maintenance facility and met some of the engineers on the staff. The hangar, shift offices and crew-room were spacious, calm and well-organised; maintenance plans and shift routines were clearly promulgated. 1.18 Additional information 1.18.1 AAIB Special Bulletin (SB) The AAIB published Special Bulletin S1/2017: ‘Sikorsky S-92A, G-WNSR, loss of yaw control on landing at West Franklin platform, North Sea, 28 December 2016’ to provide initial information concerning the event and to highlight initial safety actions. The SB was published on 11 January 2017 and the safety actions presented within the SB are detailed later in this report. 1.18.2 Previous similar events During the preliminary work to identify the cause of the TRPCS bearing failure, a review was carried out to see whether there had been any similar previous events. In 2007, a bearing was found to have degraded as a result of foreign object debris. This resulted in issue of ASB 92-64-002 and ASB 92-64-003 (mandated by FAA AD2007-17-05 and EAD 2016-24-51 respectively) which required a once-only borescope inspection. Several additional actions were put in place and led to the introduction of a 1,250-hour Time Between Overhaul (TBO), improvements in the manufacturing process and to the seal assembly on the

53 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information bearing, and introduced a bearing installation tool. It was also of significance that the HUMS Tail Gearbox Bearing Energy Tool was developed and introduced by the manufacturer as a direct result of this event. During the remedial work conducted into the above event, a partial or full seizure of the TRPCS bearing applying torque to the servo piston was considered. It was anticipated that should this happen, the servo would fail in the threaded portion of the clevis. In September 2016, a newly manufactured bearing failed within two hours of installation. This was caused by incorrect end play set up during assembly which led to a tight bearing. The bearing manufacturer introduced an improved bearing clamping and measurement procedure during assembly. An additional end play inspection was also introduced during overhaul. In November 2016, ASB 92-64-009 was published which detailed a once-only inspection for improper end play on TRPCS assemblies with bearings less than 80 airframe hours since overhaul. This did not apply to G-WNSR because, by that date, its TRPCS had accrued 350 airframe hours since installation. As a result of G-WNSR’s accident the manufacturer reviewed the previous events and concluded that, for the 2007 event, there was no objective evidence to prove the cause was a foreign object in the bearing. The manufacturer now considers it more likely that the 2007 event was related to the bearing being assembled too ‘tight’, as identified in the later events. In November 2016, it was found that the TGB storage process risked flooding the bearing with gearbox lubricating oil with the potential to dilute the grease. ASB 92-64-010 was issued to identify helicopters which had been subjected to long term storage procedures. Any TRPCS bearing found to have been fitted to a helicopter that had been in long term storage was replaced as a precautionary measure. The storage procedure was modified accordingly. The TRPCS from G-WNSR had not been in storage and therefore this ASB did not apply. 1.18.3 Engineering shift patterns The operator’s maintenance shift patterns are designed to make the most efficient use of manpower over ‘long-days’ matched to a comprehensive routine helicopter maintenance plan. It also retains the flexibility to react to unplanned rectification work on a fleet of 15 S-92A helicopters. The manpower is divided into two main sections ‘X’ and ‘Y’ then sub-divided into early and late shifts to achieve the long working day. In addition, two small teams cover the night period.

54 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information The ‘X’ and ‘Y’ main sections work a rotating system of four days on, four days off, six days on, four days off, four days on, and six days off. The shift pattern for December 2016 is shown in Figure 21 and the daily early, late and night shift pattern in Figure 22. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 December 2016 Y X Figure 21 December 2016 shift pattern TIME (hhmm) LATE NIGHT EARLY (Mon-Sun) (Mon-Thu) (Fri-Sun) (Mon-Thu) (Fri-Sun) Figure 22 Daily shift pattern There was reduced flying over the Christmas period, so the shift supervisors had carefully planned and programmed the maintenance work so that no staff were required to work on Christmas Day or Boxing Day. Engineer A was part of the shift section that was on a six-day sequence of ‘lates’ which had started on 23 December 2016 and was due to finish on 28  December  2016. After the stand down on 25 and 26 December, staff returned to their normal routine on 27 December. However, Engineer A was scheduled for an additional stand down on 28 December and therefore was not required for work that day. Engineer A’s shift pattern is shown in Figure 23. Following the two stand down days, he worked from 1500 hrs on 27 December 2016 to approximately 0100 hrs on 28 December 2016.

55 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 22 23 24 25 26 27 28 29 December 2016 (off shift) (off shift) STAND DOWN STAND DOWN X (lates) (lates) (off shift) (off shift) STAND DOWN STAND DOWN X (lates) (lates) STAND DOWN Figure 23 Licensed Engineer A’s shift pattern 1.18.4 Significance of HUMS in previous accidents The investigation of the accidents to Eurocopter EC225 LP Super Pumas G-REDW and G-CHCN7 resulted in the provision of a flight deck indication for an exceedence of a specific HUMS CI. For both accidents, a CI was found, at 4.62 and 4.75 flying hours for G-REDW and G-CHCN respectively, to be capable of detecting an impending failure of the bevel gear vertical shaft in the MGB, but within the operator’s existing download and review interval of 10 flying hours of the HUMS data. As a result, it was determined that the CI trend should be monitored over a shorter period of elapsed time. Interim measures were introduced for a HUMS download interval of up to a maximum of four flying hours. The helicopter manufacturer subsequently introduced a flight deck indication for an exceedence of this specific CI, removing the requirement for a four-hour download and review interval. The investigation report also noted that for the HUMS configuration on the EC225 LP, the acquisition cycle for one complete set of samples of data from CI sensors typically lasted between 30 and 40 minutes. 1.18.5 Royal Navy WS-61 Sea King HUMS The Westland WS-61 Sea King helicopters operated by the Royal Navy are equipped with a combined HUMS and cockpit voice and flight data recorder (CVFDR) system (compared to the standalone HUMS on the S-92). The system includes a Cockpit Control Unit (CCU), to display HUMS/CVFDR alert information and other HUMS information, which can be configured to display exceedence alerts on landing as well as be interrogated in- flight by the crew. The exceedence alerts are limited to rotor track and balancing, airframe, engine or flight exceedence limits, and only indicate that a threshold has been exceeded (ie not the value of the exceedence). Transmission exceedences are processed and identified by the GS and therefore not available to crew via the CCU. The CCU allows a HUMS 7 AAIB Report 2/2014 https://assets.publishing.service.gov.uk/media/5422fbaaed915d1374000833/2- 2014_G-REDW_and_G-CHCN.pdf

56 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information validity check to be performed by the flight crew as part of the pre-flight procedure, and maintenance personnel must be consulted before departure if there are any new or unknown ‘failures’. The system is not designed to be used as an in-flight diagnostic tool. 1.19 Useful or effective investigation techniques Not applicable.

57 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis 2 Analysis 2.1 Introduction The helicopter suffered a loss of yaw control when landing on the West Franklin platform. The crew were able to put down immediately on the helideck, although without directional control. If the loss of yaw control had occurred at an earlier stage of the flight, the helicopter would most likely have made an uncontrolled descent into the North Sea. Strip examination of the components revealed that the loss of yaw control was the result of damage to the TR pitch control servo, which had been brought about after a significant failure of the TRPCS bearing. HUMS had provided an alert of the impending bearing failure the day prior to the accident flight, but this was not identified by the maintenance engineers. To provide assurance of safe flight a series of safety barriers are in place which are designed to prevent the catastrophic loss of an aircraft. On this occasion most of the barriers were breached and it was fortuitous that the final component failure occurred when the helicopter was in the landing phase above the helideck, in a position from which, despite the loss of control, the commander could immediately lower the collective and land. Figure 24 is a schematic representation of the applicable safety barriers.

MANUFACTURE CERTIFICATION LOSS OF AIRCRAFT DETECTION AND REPORTING OF ABNORMAL OPERATION DETECTION OF IMPENDING FAILURE FAILSAFE DESIGN MAINTENANCE AND HUMS FLIGHT CREW CHANCE SAFETY BARRIERS Figure 24 Schematic representation of the applicable safety barriers

58 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis Design and certification During the certification process, the manufacturer and certifying authority must perform a design assessment to ensure that the transmission system functions safely over the full range of conditions for which certification is sought. This must include a detailed failure analysis to identify all failures that will prevent continued safe flight or landing. It must also identify the means to minimise the likelihood and effect of their occurrence. The aim through the design is to reduce the risk of component or system failure to a probability of 10-6 or less (categorised as ‘very remote’). Certification of the design must consider component wear and tear and its effect on the risk of failure. To mitigate against the potential for failure in service, a proactive monitoring or pre-failure capture and maintenance scheme must be derived to ensure a high level of reliability. A failsafe system or structure is designed to consider a component or part failing or malfunctioning such that it does not overload or cause other critical systems and structures to malfunction, lose control or integrity in turn. Maintenance and HUMS HUMS is a means of meeting the VHM regulatory requirements of CS 29.1465, applicable to applicants requesting certification of a VHM system, such as helicopter operations in the North Sea. HUMS was originally designed to monitor the health of mechanical components that form the rotor and transmission system within an operational context, providing data for trend analysis and condition-based maintenance, for which it has proved very effective. It was not intended to detect imminent in-service component failures; however, thirty years of experience and development has demonstrated the potential for it to be used in this way. Operators and manufacturers are placing more reliance on the additional assurance HUMS gives for continued airworthiness, and the download and analysis of HUMS data is often a necessary step on each return to base, and before the helicopter is released back into service. Flight crew The flight crew role in this context is to observe the aircraft and report on its serviceability; pilots may be able to detect changes in performance or behaviour at an early stage, prior to a component failure. However, their ability to do so effectively is subject to the limitations and constraints of human performance.

59 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis Chance Chance can sometimes play a part in the avoidance and/or mitigation of the consequences of accidents and serious incidents. 2.2 Operational aspects 2.2.1 Conduct of the flight The flight crew were not aware of the recorded HUMS exceedences as there was no indication on the flight deck of the helicopter. The flight progressed uneventfully until the first attempt at takeoff from the Elgin PUQ. The manufacturer’s review of historic data to determine whether there may have been any preliminary cues to the flight crew through an increasing bias of the yaw control positions showed that nothing would have been apparent. Therefore, there was no in-flight indication to the crew of the impending bearing failure, before the landing on the Elgin. On lift off from the Elgin helideck the helicopter yawed right through 45°, an unusual event. The commander’s intuitive reaction, when the first attempt at takeoff was unsuccessful, was to try again so, after a short exchange about the event with the co-pilot, he lifted the helicopter back into a hover and turned to the left into wind. It now responded normally to his control inputs so he was reassured, as was the co-pilot, who thought the yaw event had occurred because of a misjudgement in a variable wind. Neither pilot considered that there was anything mechanically wrong with the helicopter, thus the departure continued. The evidence of the degraded state of the bearing which led to the subsequent failure of the TRPCS suggests that this first yaw event was related to the bearing degradation. The manufacturer’s retrospective analysis of yaw pedal positions showed that the use of full left yaw pedal could provide an indicator of advanced bearing degradation for flight crews. The flight crew, without the benefit of this information, tried to find a reasonable explanation for the yaw and considered that it arose because of local wind conditions and associated turbulence. The commander’s expectation was that the helicopter could be more awkward to handle in a left crosswind. The co-pilot’s expectation was that the Elgin PUQ helideck could be ‘tricky’ due to the other installations and the position of the helideck and superstructure, creating a wind rolling up onto the deck or coming round from behind. Both factors could have influenced their acceptance of wind effect as an explanation for the unusual yaw.

60 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis 2.2.2 RFM and Emergency Checklist procedures This mode of failure of the TR system was not anticipated by the manufacturer and there was no RFM procedure to deal specifically with this malfunction. The RFM made reference to a loss of TR thrust with symptoms of ‘uncommanded sharp right yaw, unresponsive to pedal inputs, (‘sharp right yaw/spin’ in a hover); the associated actions required the helicopter to land immediately and shutdown. The operator’s Emergency Checklist included a procedure with similar actions entitled: ‘TAIL ROTOR CONTROL FAILURE IN THE HOVER’. However, this did not reference ‘uncommanded right yaw’ as a failure indication but stated that an ‘uncontrolled yaw’ would require an immediate landing. The operator’s procedure ‘TAIL ROTOR DRIVE FAILURE’ referenced the indication ‘uncontrollable yaw to the right’; the checklist actions for this failure would also have resulted in an immediate landing and shutdown. The crew did not review Emergency Checklist procedures after the uncommanded right yaw at the Elgin as they did not consider the possibility of a technical malfunction. If a technical malfunction had been diagnosed and Emergency Checklist items actioned, it is considered unlikely that the crew would have continued with the flight. 2.2.3 Plan continuation bias The flight crew’s uncertainty over what had happened during the unusual yaw event on liftoff from the Elgin was not a sufficiently strong stimulus to change their original plan to depart for the West Franklin. However, the evidence of their continuing discussion suggests that, although they departed en route, they had not yet reached a satisfactory explanation for the event. The decision to continue is an example of a plan continuation bias, which is the unconscious tendency to go ahead with the original plan despite changing conditions. This type of cognitive bias works to obscure subtle cues of changing circumstances.1 The sector to the West Franklin was short, only five minutes, and the flight crew’s focus quickly changed from the earlier event on the Elgin, to the forthcoming approach and landing on the West Franklin. During the landing, the commander, who probably had a heightened awareness following the Elgin event, sensed a similar unusual yaw to the right and was quick to respond, putting in additional left pedal to try to counter the yaw and partly lowering the collective. However, all yaw control of the helicopter was lost and it yawed to 1 Dismukes, R. K., Berman, B., and Loukopoulos, L. L. (2007) The Limits of Expertise: Rethinking Pilot Error and the Causes of Airline Accidents. Ashgate, Hampshire, UK.

61 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis the right and rolled left before the left mainwheels hit the helideck. The rate of yaw suggests that the TR thrust was substantially different to the yaw pedal demand, making the helicopter uncontrollable in yaw with a secondary effect in roll. The commander lowered the collective fully and maintained a full left yaw pedal input as the helicopter settled on the helideck, still rotating to the right. Brake parameters were not recorded so the status of the brakes is unknown but the helicopter came to a stop having turned through approximately 180°. After the event the co-pilot immediately diagnosed a TR malfunction, as evidenced by his response to the Elgin radio operator after the helicopter was shut down. 2.3 Engineering analysis The HUMS Tail Gearbox Bearing Energy Tool shows bearing degradation over a very short period of time. The first exceedence was picked up at five operating hours prior to the accident. Figure 25 shows that the bearing degradation produced inconsistent vibration levels which suggests the bearing did not follow a gradually increasing wear pattern leading to eventual failure. Figure 25 Extract from Figure 12 - TGB bearing energy CI ratio for third flight on 27 December 2016 The TRPCS bearing had been in service for 548 hours of its 1,250-hour life and had no recorded HUMS exceedences until five operational hours prior to its failure. This implies that there was a significant change in the bearing condition to cause the first exceedence and the bearing deteriorated rapidly thereafter. The evidence on the bearing shows that it had undergone severe overheating whilst under load. The damage was too extreme to leave evidence of the traditional initiators of a bearing failure such as spalling, hard object contamination, cage failure or corrosion. However, those forms of bearing failure tend generally to develop slowly and produce gradually increasing but low level HUMS exceedences over a longer period of time.

62 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis The possibility of damage from within the TGB was considered, but this seems unlikely due to the absence of damage to the components in close proximity to the bearing, such as the TR shaft guide bushing. The TGB lubricating oil SOAP analysis of the routine samples taken prior to the accident show inconsistent rises in some of the metallic elements within the oil, but are inconclusive as indicators of impending bearing failure. The sample taken after the accident shows, unsurprisingly, a major metallic contamination of the lubricating oil resulting from the complete disintegration of the seals and bearing structure whilst the TGB’s shafts and gears were rotating under load. It is also possible that the bearing lubrication itself failed. If this was the case, it appears that conditions within the lubrication system of the bearing were such that an apparently normal bearing (which had run for half of its TBO and not generated any HUMS exceedences) suddenly started to produce significant HUMS exceedences and failed within a very short running time. The bearing is a sealed self-lubricating component. Its rollers and races are surrounded in grease retained in the bearing by PTFE dust seals and covers. The grease is applied when the bearing is assembled by the OEM and is not disturbed until the 1,250-hour life on the TRPCS has been accrued. Providing that the correct type and quantity of grease is applied, the bearing should be trouble free during its TBO and beyond. 2.3.1 Cause of the uncommanded yaw on the Elgin PUQ The uncommanded yaw event on the Elgin PUQ occurred during the lift off phase of the sector; therefore, no HUMS vibration data for the TGB were sampled at that time. However, the HUMS TGB bearing energy CI exceedence timeline prior to this event suggests that the TRPCS bearing was then at an advanced stage of degradation. The dynamics of the interaction between the TRPCS bearing, servo and TGB shaft are difficult to quantify. However, there are two main features which are likely to cause unpredictability in the inputs to the TR. As the servo attempted to push or pull the TRPCS via the bearing there would have been a considerable drag in the bearing as the degraded rollers and races made contact. This is likely to have imparted a torque back into the servo piston as a result. This increased dragging torque would have manifested itself as an additional load on the guide bushing, the TGB output shaft and on the lugs within the anti-rotation slot on the servo. The magnitudes of these loads are not known, but it is possible that they were enough to affect the movement of the servo piston as it responded to yaw inputs from the mixer unit and AFCS. Even though the servo can impart a considerable force into the

63 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis TRPCS, significant resistance felt against the servo piston may at least slow its movement. Furthermore, it may also have led to the servo stalling under load, resulting in wind‐up of the cable system. The combination of cable wind‐up and bearing free play due to wear may lead to a larger discrepancy between pedal position and actual TR blade angle (or thrust). In addition, the degraded bearing had at least 0.5 inch (12.5 mm) linear play or looseness. As a consequence, the servo piston could have moved up to 0.5 inch with no resulting effect on the TRPCS and thus the TR itself. When considered against the range of movement of the servo in normal circumstances, the 0.5 inch linear play in a normal 3.5 inches (89 mm) of movement represents a reduction in the total range of travel of approximately 15%. Both aspects would have affected the servo’s feedback loop and manifested themselves as jerky or clumsy movements as the servo tried to achieve, and make corrections to, the required position. 2.3.2 Potential bearing lubrication problems There are recognised to be two main problems regarding the application of grease in a bearing: either over-greasing or conversely, under-greasing. If a bearing is over-greased, it can, under some circumstances, cause a bearing to overheat. The reason for this is that the grease can become clogged and may not stir around whilst the bearing is rotating and so becomes over-worked, heated and then oxidises. It then starts to degrade in the high-load areas and the heat generation in those areas increases leading to further degradation of the grease, a complete loss of lubrication and eventual bearing failure. However, over-greasing will have an effect quite early in the bearing life and may manifest itself in the purging of discoloured grease past the bearing seals. The borescope inspection eight flying hours after installation of the TRPCS showed no abnormalities. This and the fact that the bearing achieved half its TBO suggests over-greasing was not a factor in this bearing failure. Under-greasing of the bearing can also result in premature failure. In this case heat is also generated, but for different reasons. The grease may not be able to cover all of the surfaces within the bearing leading to metal-to-metal contact. This will result in accelerated wear, heat build-up and premature bearing failure. It is also possible for a bearing to become under-greased during operation. It is normal for bearing grease to deplete during use and this is usually for two reasons: mechanical loss where there is a slight but constant seepage from race seals, or by gradual evaporation of the oil within the grease to leave a disproportionate amount of thickener. This is not always catastrophic; it is

64 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis possible for a lightly loaded bearing to lose most of its grease and continue to operate correctly albeit with raised noise and vibration. Although the hydrocarbon element of the grease was not present, forensic examination showed the presence of remnants of the thickening agent used in the grease. No meaningful data or conclusion, other than that grease had originally been present in the bearing, could be drawn. 2.3.3 Bearing loading and environment The TRPCS bearing is designed to carry varying thrust loads from a non-rotating component to a rotating component. The orientation of the barrel rollers and races mean that each bearing is under compression from either a pull or a push from the servo. If the servo extends, the bearing race nearest the servo takes a higher proportion of the load. If the servo retracts, the same occurs on the race furthest from the servo. During operation, when the TR is at its neutral setting with no input from the TR servo, both races are relatively lightly loaded. When a yaw input is made (left induces a pull and right induces a push from the servo) the corresponding race of the bearing takes the load. The load increases proportionally to a maximum when the TR is at full pitch as the servo acts against the flexbeams within each blade. When the servo moves back to neutral the bearing load reduces and, for high rates of movement, may even act on the opposite side of the bearing. The dynamic interaction between the inner and outer races and the rollers and their cages is complex. As described earlier, the bearing rollers are allowed, by virtue of including some end float, to move axially and radially within their cage. The scoring found in one bearing from the 19 TRPCS removals, was attributed to having been assembled too tightly; however, improved control of end play tolerance has subsequently been introduced by the manufacturer. The TRPCS bearing is not under a constant load, the inner and outer races sustain varying push and pull loads for varying periods of time as the servo reacts to inputs from the pilot, mixer unit and other automatic systems. Although varying push and pull loads may tend to produce roller movement out of track, it should not be detrimental in this type of bearing in this application. 2.3.4 Servo damage The failure of the bearing components created a torsional drag and ultimately led to the TRPCS ‘back driving’ the servo piston. Initially, as the bearing became less effective, it imparted a significant torque into the servo piston as shown by the evidence on the anti-rotation guide lugs. This torque was variable and, as continual yaw control inputs were made, the bearing condition worsened.

65 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis This eventually led to a snatch torque being applied to the piston which then failed at the outer end of the primary piston within the secondary piston sleeve. This had the effect of disconnecting the walking beam feedback pivot to allow unrestrained and random inputs to the servo control valves. Consequently, the now-rotating servo piston could move in and out of its cylinder making unpredictable pitch change inputs to the TR via the now severely damaged TRPCS and loose bearing. Loss of TR control is a risk which was considered during certification of the helicopter. The certification process considered a TR which had either ‘frozen’ at a particular pitch setting or had returned to, and stuck at, its neutral pitch. The mitigation of this risk was based on the helicopter being flown with sufficient forward speed to counter any torque effects and to carry out a running landing. The loss of TR scenarios involved the servo either not receiving inputs or failing to respond to control inputs. The work carried out to rectify the first bearing failure event in 2007 also considered a disconnection between the TRPCS and the servo piston, and considered a partial or full seizure of the TRPCS bearing applying torque to the servo piston. It was anticipated that should this happen, the servo would fail in the threaded portion of the clevis where it connects directly to the TRPCS (Figure 26). This would leave the now-disconnected, but hydraulically-driven, piston attached to the helicopter yaw control system and therefore in a relatively safe condition, albeit with the servo piston moving in and out, colliding with the remains of the clevis and its eye end. Anticipated failure location Figure 26 Anticipated servo failure location 2.3.5 Returned TRPCS assemblies None of the TRPCS assemblies rejected by operators in accordance with the AD and ASB exhibited the same degradation as the bearing removed from G-WNSR. Furthermore, despite rigorous testing under load in the spin rig the manufacturer was unable to reproduce bearing failures.

66 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis 2.3.6 Summary of engineering analysis The damage to the TRPCS bearing has destroyed any evidence that would have identified the initiating cause of the bearing failure. However, during the failure sequence, bearing lubrication broke down drastically. It may be that loss of lubrication was the initiating cause but, as with the evidence of the possible mechanical failure mechanisms in this bearing, any evidence of this has been destroyed. Despite extensive attempts, the manufacturer could not reproduce the bearing failure. This leads to the conclusion that the failure was because of undetermined factors which occurred within this particular bearing assembly. However, the manufacturer’s analysis indicates, based on the testing during this investigation, that during the 2007 bearing event, reduced or no end play (causing tightness in the bearing) may have been the significant factor. The exact end play of the bearing assembly fitted to G-WNSR at manufacture is not known but bearing tightness cannot be discounted as a factor. Had the HUMS exceedence generated by the TRPCS bearing been detected, the bearing would have been replaced before the helicopter was released to service. 2.3.7 Additional safety actions Notwithstanding being unable to determine the exact cause of the bearing failure, the manufacturer has carefully analysed all the results and findings from the ASB and AD and the temperature sensing feedback. From this the manufacturer has been able to focus on all aspects of the bearing design, manufacture and assembly and has identified and implemented improvement in a number of areas. These improvements include the design and structure of the bearing races, precise control of the lubricant quality and quantity, and the dimensional tolerances allowable and achieved during assembly. In addition, the temperature profile of the TRPCS bearings in service is now better understood and can be used to influence the bearing design, maintenance and life policy. 2.3.8 Helideck resilience Minor damage was caused to the surface of the helideck during the accident. The overall support structure of the helideck was unaffected and in this case, it would seem the helicopter presented a very high and very localised loading into the surface of the helideck in the form of a ‘knife edge’ created by the wheel rim. The angle was such that although the tyre wall would have deformed sideways it was not enough to break the rim seal to cause deflation of the tyre. It is possible that a momentary rim seal break occurred but then the tyre pressure instantly re-seated the tyre and maintained the seal.

67 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis The support structure, when combined with the surface material, give the crashworthiness or energy absorption capabilities of the helideck, as demonstrated in this case. The helicopter descended rapidly from about four feet (1.22 m), the landing gear compressed, the deck material distorted (dented) locally and then split within the area of the dent. Each ‘step’ in the process absorbed energy which in turn meant the support structure probably experienced no more than the loads imparted by the S-92A in a normal but firm landing. The helideck requirements are set out in CAP 437 and take into consideration various normal and abnormal scenarios likely to take place during helicopter operations. The worst case assumption in CAP 437 is a single engine landing with a heavy helicopter. Unexpected scenarios are not specifically described but are considered within the overall deck strength overload allowance. Therefore, something like a loss of control leading to a roll-over is taken into consideration by the strength factors in the design being multiples of the helicopter type maximum weight. The helideck resilience did not adversely affect the outcome of this accident, in other words, its damage did not make the situation worse or cause injury or loss of life, and so was not considered further in this investigation. However, the Helideck Certification Agency will bring this case to the attention of the CAA and the ICAO Heliport Design Working Group (HDWG) to consider whether the assumptions used in the regulations remain valid in the light of this accident. 2.4 HUMS data analysis on the S-92 2.4.1 Human machine interface The analysis of vibrational HUMS data currently relies on the use of software running on a GS that has access to the helicopter’s complete HUMS data history. The software is an inherent and critical part of the HUMS but it still requires a human to be ‘in the loop’ to inspect and make decisions based on what the software is telling them. This interaction between the system and user is, therefore, fallible and dependent on the design of the Human Machine Interface (HMI) for ease of use and ability to reduce the risk of failure due to human performance. The HMI for the S-92 HUMS was the IMD GS software. This was first developed in 2001 and had grown in its capability to the extent that additional functionality, such as the TGB bearing energy analysis, could not be supported by the original IMD GS software and had to be made part of a standalone IMD-HUMS ToolBar, still installed on the GS, but run independently of the main IMD GS software. This meant that the HMI at the time of the accident comprised two independent parts that, due to variations in design, differed from each other in how they were

68 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis used and how they provided information to the user. The crucial difference between the standalone ToolBar and the main IMD GS software was the fact the IMD-HUMS ToolBar did not inform the user that exceedences were present, but instead relied on the user to visually inspect the CIs for exceedences. The use of the standalone IMD-HUMS ToolBar was taught during the operator’s HUMS training of licensed engineers and routinely used by them when analysing the HUMS data from the S-92A helicopters. This was despite the omission of a step in the flowchart within the operator’s documented HUMS S-92A download procedures. This omission was identified by the operator during their investigation of this accident and an updated HUMS manual was released within a month of the accident. As part of the visual inspection of the CIs in the IMD-HUMS ToolBar, the user was able to zoom in and out. The method documented in the software user guide, and taught during training, worked on both the main software and standalone tool. However, a second method (differing only in the direction that the rectangle was made for selecting the region of interest to be zoomed in) that worked on main IMD GS software had the opposite effect on the IMD-HUMS ToolBar and several sub-functions within the IMD GS software. Therefore, any attempt to zoom in using this method, which was neither documented nor taught, resulted in zooming fully out, or no effect if fully zoomed out already. The largest exceedence of the TGB bearing energy CI ratio on 27 December 2016 was 970% greater than the alert limit threshold (just over 17 compared to 1.75) and followed one of slightly less magnitude 23 minutes earlier. These would have been evident on initial inspection of the data only by the fact that the y-axis would have automatically rescaled and expanded to fit all the data on the plot, and the red alert threshold line, normally near the top of the plot, would have been much closer to the bottom. The x-axis, also automatically rescaled and expanded to fit all the CI ratio data since the last TGB maintenance date of 6 October 2016, 82 days earlier. As these two large exceedences happened in the last hour of these 82 days (so taking up less than 0.05% of the x-axis), the exceedences were hardly visible on the right hand edge of the plot. Although the repositioning of the red alert threshold line attracted the attention of the licensed engineer, the unsuccessful attempts to zoom in on the data by two licensed engineers prompted them to attribute the unfamiliar look of the data plot to a software glitch. Nevertheless, Engineer A made a mental note to draw this anomaly to the attention of his supervisor later. Since this accident, the manufacturer has raised awareness of the standard procedure for the zoom function amongst the users of this software.

69 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis 2.4.2 SGBA GS software Since May 2015, the manufacturer had made available to operators of S-92 helicopters their own GS HUMS software called SGBA. The operator of G-WNSR made the decision to trial SGBA and had been doing so since 2015 to develop a knowledge and understanding of the software, with a view to transferring to it at the earliest opportunity given that the relevant S-92A maintenance manual revisions were yet to be issued. Some of the key benefits of the SGBA were that the functionality of the standalone IMD-HUMS ToolBar was incorporated into the software, and that a summary of all CI exceedences and alerts were presented to the user automatically once the HUMS data had been uploaded. It also introduced many features such as enhanced diagnostics and colour-coded visual indicators to highlight inspection requirements. Following release of the maintenance manual, and to promote uptake of SGBA with its improved analytical features and user interface, the manufacturer has notified operators of the intention to discontinue the older IMD software. 2.5 Licensed engineer human performance 2.5.1 Introduction The safety intervention designed to identify a problem with a safety critical component failed for two reasons. This was mainly due to an HMI problem with the HUMS TGB bearing energy tool and its zoom facility. This was then compounded by human factors, in particular an individual forgetting to carry out a simple but important intended action. During discussions after the accident, Engineer A used the well-known phrase it ‘slipped my mind’. This is a very familiar predicament and has been a factor of many accidents and incidents in the past. In this particular case, the evidence suggests two different issues that came together which led to him forgetting to carry out an intended action despite a ‘mental note’ being made. 2.5.2 Environment The AAIB observed, during a visit to the operator’s maintenance facility, that the hangar, shift offices and crew-room were spacious, calm and well-organised with shift routines and personnel availability clearly promulgated. The two supervisors had produced a shift routine over the Christmas period which meant the workforce was not too disrupted and could have quality downtime on Christmas Day and Boxing Day. These observations suggested a supportive, well-organised work environment where positive action is taken to keep external stresses and distractions to a minimum. Engineer A appears to have suffered a failure of his prospective memory. This is a common phenomenon and is more likely to happen in a stressful, chaotic

70 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis and noisy environment. However, in this case, the environment in the offices and hangar offered minimal adverse distraction and so was not considered to be a factor. 2.5.3 Prospective memory Prospective memory is a form of memory that involves remembering to perform a planned action or recall a planned intention at some future point in time. It is used when a non-urgent task or sequence of tasks, which are already underway, become disrupted by a distraction and have to be resumed later. A failure of prospective memory is then a risk and can lead to steps being missed out in the original task or it not being completed at all. The reasons why prospective memory is used are varied: it is often because of a constraint on a task or the need for other factors to be in place to carry out the action or task. The common method is the mental note, “I must remember to.....” and this might be sub-vocalised2. Prospective memory is susceptible to failure, usually due to distraction; for example, being absorbed in a task or where something else is competing for attention to the extent that the mental note is lost. The absence of a specific physical reminder leaves a reliance on the ‘mental note’ which is fallible. A specific reminder such as a strategically placed post-it note or a phone alert can ‘trip’ the memory into recalling the task to be done. If for some reason the prompt or trigger is deferred or there is an interruption or distraction, the prospective memory can further decay over time. The intention to carry out a task or action then becomes forgotten unless a significant and very prominent prompt is experienced. 2.5.3.1 Causes of prospective memory failure in the engineer In this case, Engineer A had an idea why the HUMS chart had rescaled and decided to address it later. Accordingly, he made his mental note with a plan to discuss the abnormality with his supervisor before closing the aircraft documentation. However, he forgot and the causes for this were probably two‑fold. Firstly, it was apparent that this individual was conscientious and took his airworthiness responsibility seriously. This was demonstrated by his normal method of work: he always started with the HUMS download, then he would go into the hangar and personally double-check the safety critical areas on the helicopter prior to panel closure. He would have given his full attention to this action as he was absorbed in a task he considered important and therefore this subconsciously moved the mental note further from the short term memory. 2 Sub-vocalisation is a term used to describe the silent speech which is often carried out whilst reading but may be used when committing something to memory, eg “I must remember to……”.

71 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis Secondly, the effect on him of the attempted break-in and his reaction to the police was an aggravating factor. It is known that being a victim of crime can adversely affect people in a variety of ways3. In this case he was observed to be upset and show signs of distress, which is a normal reaction. It can also preoccupy a person’s mind, although this may not be constant, it can arise in quieter moments or when reminded by another seemingly unrelated situation. In this case it is possible that the experience with the attempted break-in and the police was dormant at the back of the engineer’s mind throughout the evening. However, as he was starting to think about going off shift it is possible that the thought of returning home reminded him of the stressful experience earlier and this now began competing for his attention. This meant that his mental note to speak to the supervisor, which may have already been usurped by his physical double-checking of the helicopter, was now ‘pushed aside’ again by the reminder of his earlier experience. During the morning and early afternoon before he went on shift and during his subsequent interview with the AAIB, he made no mention of having been engaged on any tiring activities. Although there is no evidence of fatigue, the shift was winding down late in the evening, so fatigue may also have been a minor contributory factor. The loss of a mental note is not always permanent and may be brought back to mind by a prompt which may or may not be related. There was no work on G-WNSR which needed to be handed over to the oncoming night shift, so there was no handover discussion. Thus, there was no step-by‑step description of the helicopter technical status which would probably have prompted the engineer into remembering the HUMS anomaly. As time moved on, the mental note was forgotten until he was given the information about G-WNSR the next day. The mental note was recalled from his memory, leaving him with the uncomfortable realisation that he had forgotten to mention the HUMS matter the night before. 2.5.4 Mutual reinforcement The discussion between Engineer A and Engineer B tried to make sense of the exceedence line. They made several attempts to use the zoom function to look at a suspected data peak in more detail. Despite having no other evidence of a problem with the HUMS analysis tools, in the absence of visible reasons for the exceedence line position and unsuccessful attempts to zoom in for the detail, they both concluded there was a problem with the software. The fact that both drew this conclusion is likely to have been due to their shared experience whilst at the G-WNSR’s GS. Their discussion re-enforced their 3 Dinisman, T. & Moroz, A. (2017). Victim Support – Understanding Victims of Crime – The impact of crime and support needs. London: VS.

72 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis conclusion and confirmed their mutually-held theory that it was an unknown software problem. In this case, they had an expectation that an exceedence had occurred as indicated by the axis rescale. Their expectation was for the zoom function to allow the peak to be visible by causing the rescale and the exceedence to be clearly identified. Instead, they interpreted the failure of the software to zoom as being due to the fact that there was no peak to reveal and therefore no exceedence. Nevertheless, Engineer A still had misgivings about the anomaly and resolved to follow it up later. 2.6 Timeliness of VHM data 2.6.1 Maximum interval between downloads The AMC to CS 29.1465 currently requires operators to specify a maximum interval between HUMS data downloads. It must not exceed the system memory capacity (which must be a minimum of 25 flying hours). CAA guidance material (CAP 753) specifies that the interval should not exceed 25 flying hours and that this is reduced to 10 hours for components or indicators that require ‘close monitoring’. CAP 753 also states that 10 flying hours is not atypical of a day’s flying for North Sea operations. The operator of G-WNSR had procedures which were more stringent and had reduced the interval to a maximum of five flying hours between downloads. It had provisions in place, through the use of card readers or repositioning the GS laptop computer, for occasions when the helicopter would not be able to return to a main operating base before the 5-hour limit expired. 2.6.2 Timeliness of VHM alerts Given the existing HUMS procedures in place by the operator, there were opportunities to capture the failure of the TRPCS bearing before it resulted in the accident. The first detected exceedence of the TGB bearing energy CI was five operational hours before the accident. The HUMS data was downloaded 3.5 operational hours after this initial exceedence, when the helicopter returned its main operating base at Aberdeen at the end of that day’s flying, but the opportunity to detect the impending bearing failure was missed. Overnight, the HUMS data was routinely and automatically sent to the operator’s base in Norway; however, their general review of the data was made on the morning of the accident flight when G-WNSR was already airborne, and by the time they had established that exceedences had occurred, the bearing had already failed. A typical flying day for North Sea operations may exceed 10 operational hours duration during which multiple landings are often made, many of them not at a main operational base. This is more than twice the time between first exceedence

73 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis and the bearing failure and also exceeds the initial‑exceedence‑to‑failure time seen for G-CHCN (4.75 flying hours) and G-REDW (4.62 flying hours). The UK requirement of a maximum time interval between HUMS downloading (and analysis) of 25 flying hours means that failures of this nature could go undetected for several days before the next download (and analysis) is conducted. The operator’s procedures for a maximum time of five flying hours is more stringent than the UK requirements and more likely to detect these types of failures; however, even this reduced interval was in excess of the four flying hours between G-WNSR’s first detected exceedence and bearing failure. Had the exceedence happened at the beginning of the first flight of the day or at the start of a flight following a scheduled download, it would not have been detected before the bearing failed. For an impending and potentially catastrophic failure to be detectable, but for this information to remain unknown to flight crews and maintainers for a significant period, is unacceptable; a more timely method of acquiring, accessing, analysing and promulgating the data needs to be devised and implemented. 2.6.3 Acquisition of VHM data The current method of sampling VHM vibration data from multiple sensors is to take data snapshots by sampling and processing the data of each sensor in turn. Continuous monitoring is not necessarily required to provide effective detection. The AMC to CS 29.1465 prescribes that as a minimum for flights of greater than 30 minutes in stabilised conditions, at least one data set for all the sensors is obtained.  If these stabilised conditions cannot be met then the data set should be acquired ‘at an appropriate rate and quantity for the VHM signal processing to produce robust data for defect detection’. Most of the time is spent in processing the data. For example, sensor data used by the TGB bearing energy CI is sampled for a minimum of 10 seconds and takes about 1.5 minutes to process. It is also one of a number of sensors that are sampled during the cruise phase of flight, and the total time taken to sample data and process the data from all of these sensors is about eight minutes. This means that the individual sensor data available equates to only about 2% of the time in the cruise. In reality it is less than this as data is only sampled if the helicopter is in a steady state condition. This limitation also exists for other sensors collected in other phases of flight such as the hover. Therefore, for the other 98% of the time on the S-92, potential opportunities to detect individual CI exceedences are being missed, and the opportunity for a much earlier indication of an impending and potentially catastrophic failure is lost.

74 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis Therefore, the following Safety Recommendation is made: Safety Recommendation 2018-006 It is recommended that the European Aviation Safety Agency commission research into the development of Vibration Health Monitoring data acquisition and processing, with the aim of reducing the data set capture interval prescribed in the Acceptable Means of Compliance to CS 29.1465 and thereby enhancing the usefulness of VHM data for the timely detection of an impending failure. 2.6.4 Download and analysis of VHM data A typical North Sea flying day contains multiple landings and, as an example, advantage could be taken of time on the ground to download HUMS data. The technology to automatically download data wirelessly from aircraft already exists and is routinely used with fixed wing aircraft for Flight Data Monitoring and Flight Operations Quality Assurance purposes at the conclusion of a flight. In addition to downloading data whilst on the ground, larger commercial transport aircraft use VHF radio or satellite communications to transmit and receive data whilst the aircraft is in flight. Once data has been downloaded, modern VHM software, such as SGBA, can identify exceedences and generate alerts automatically. It is recognised that human intervention will still be required to carry out maintenance action at a later stage for any alerts generated. 2.6.5 Promulgating VHM data With improvements through automatic downloads, analysis and alert generation, significant benefit would be gained by providing this vital safety information to the flight crew of the helicopter so that they can take timely action, as deemed appropriate, to safeguard the helicopter and its occupants. More timely indications to the crew are possible via a cockpit HUMS-pilot interface. For example, in-cockpit HUMS CIs were implemented because of the investigations into the EC225 accidents to G-CHCN and G-REDW to remove a requirement for a maximum of four flying hours between HUMS downloads (and analysis). The HUMS philosophy applied to some UK military helicopter fleets appears more proactive compared to civil operations in that certain exceedences can be displayed and interrogated in the cockpit by the crew and form part of the post-flight and pre-flight procedures. The CAA (paper 2012/01) also recognised the importance of more timely indications to the crew, concluding that ‘on-board, post-flight indications’ are needed to make new technologies, that are able to detect impending failures, effective.

75 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis 2.7 Strengthening the safety barriers In this event, most of the safety barriers were breached and it was only by chance that the outcome was not more severe. The design and certification had not foreseen the unusual mechanism of the TRPCS failure and, although the HUMS had detected an impending problem, that barrier, which required an engineer to correctly interrogate the software to display the exceedence, failed due to the limitations of human performance and the design of the HUMS GS HMI. In the future there may well be other flight critical components in helicopters which fail as a result of unanticipated circumstances, some of these may be detectable in advance by HUMS. The final barrier could have been that of flight crew intervention. However, they too have human performance limits and, as they had no knowledge of, or access to, the detected HUMS exceedences, an opportunity to discontinue the flight was lost. The potential cue of full left pedal travel had not previously been identified by the manufacturer and a review is being undertaken to determine whether this information should be incorporated in the RFM. The investigation identified that had HUMS exceedence data been available on the helicopter in near real-time, the flight crew would have had at least two pre-departure opportunities to safely abort the flight. Additionally, should G-WNSR have had such a capability, it is considered likely that, after the initial incident and re-land on the Elgin, the flight crew would have made use of it and that it would have informed their judgement as to whether to depart for the West Franklin. Furthermore, given the circumstances of this event and the short timescale over which the problem developed, providing flight crews with a simple means to establish the health and serviceability of their helicopter whilst away from a maintenance base could be the only effective barrier remaining to prevent an accident. Therefore, the following Safety Recommendation is made: Safety Recommendation 2018-007 It is recommended that the European Aviation Safety Agency amend the regulatory requirements to require that Vibration Health Monitoring data gathered on helicopters is analysed in near real‑time, and that the presence of any exceedence detected is made available to the flight crew on the helicopter; as a minimum, this information should be available at least before takeoff and after landing.

Intentionally left blank

77 Conclusions Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 3 - Conclusions 3 Conclusions 3.1 Findings

The helicopter was equipped with HUMS and its use by the operator as part of its maintenance programme satisfied the regulatory requirements for helicopter VHM.

The operator’s HUMS procedures stipulated a maximum of five flying hours between HUMS downloads rather than the maximum of 25 flying hours required by the UK Regulations, but even this reduced interval would not necessarily provide timely warning of impending TRPCS bearing failure.

The IMD GS software was in two distinct parts that had different interface characteristics for identifying and alerting exceedences to the user which led to a situation whereby an exceedence was missed.

Checks of the TGB bearing energy CI were routinely carried out by the maintenance personnel despite the omission of this step in the flowchart within the operator’s documented HUMS S-92A download procedures.

The HUMS detected a failing TRPCS bearing.

The time between detectable degradation of the bearing by HUMS and failure of the bearing was four flying hours.

Due to an anomaly in the way that exceedences are viewed in the main IMD GS software and the GS ToolBar by maintenance personnel, coupled with the limitations in human performance, the HUMS exceedence was not identified during routine maintenance and the helicopter was released to service.

By the time that the HUMS data was reviewed by a second organisation the TRPCS bearing had already failed.

The pilots were properly licensed, qualified and sufficiently rested to conduct the flight.

There was no in-flight indication to the crew of the impending bearing failure before the landing on the Elgin.

78 Conclusions Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 3 - Conclusions

During the departure from the Elgin helideck, the helicopter did not respond as expected to the commander’s yaw pedal inputs, including the use of full left yaw pedal. Following a satisfactory check of the yaw control response, this was attributed to a wind effect and the final opportunity to terminate the flight was missed. However, it was established during the investigation that the event was due to the degraded condition of the TRPCS bearing.

A review of the historic S-92 fleet data by the manufacturer established that the use of full yaw pedal is a rare event in flight.

The TRPCS bearing failed whilst the helicopter was in flight.

The TRPCS bearing failure precipitated damage to the TR servo. This damage manifested itself during the landing on the West Franklin helideck.

The TR servo primary piston fractured within the secondary piston sleeve and not, as previously anticipated, in the threaded portion of the clevis.

The fracture of the servo primary piston disconnected the feedback pivot of the walking beam, resulting in loss of control of the TR servo.

The flight crew reacted expeditiously to an uncontrollable yaw whilst landing on the West Franklin helideck.

The helideck surface was punctured during the abnormal landing, but this did not adversely affect the outcome of this accident.

There were no injuries.

If the loss of yaw control had occurred at an earlier stage of the flight, the helicopter would most likely have made an uncontrolled descent into the North Sea.

The helicopter operator filed an MOR with the CAA on the day of the accident. However, when further evidence became available as to the seriousness of the event, it was not reported to the AAIB as it should have been.

The helideck operator was unaware of their responsibility to report an accident to the AAIB.

The TRPCS bearing was too badly damaged to determine the reason for its failure.

79 Conclusions Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 3 - Conclusions

Additional inspections on in-service TRPCSs were introduced and, as a result, a number were returned to the manufacturer for further investigation. Of those bearings, 18 did not exhibit unusual or advanced wear or degradation, but one exhibited roller wear and unusual indications on the outer race.

Despite extensive and prolonged testing of the returned TRPCSs, the manufacturer could not reproduce a TRPCS bearing failure.

The current VHM regulatory requirements for the maximum interval between data downloads (and analysis) are ineffective for detection of imminent in-service component failures.

The yaw event on the Elgin was not captured by HUMS.

The low frequency of data capture from individual VHM sensors means that, for the majority of the time, they are not utilised and opportunities to detect problems are missed. 3.2 Causal factors The investigation identified the following causal factors to the loss of yaw control: ● ● The TRPCS bearing failed for an undetermined reason. ● ● The TRPCS bearing failure precipitated damage to the tail rotor pitch control servo. 3.3 Contributory factors The investigation identified the following contributory factors: ● ● Impending failure of the TRPCS bearing was detected by HUMS but was not identified during routine maintenance due to human performance limitations and the design of the HUMS Ground Station Human Machine Interface. ● ● The HUMS Ground Station software in use at the time had a previously-unidentified and undocumented anomaly in the way that data could be viewed by maintenance personnel. The method for viewing data recommended in the manufacturer’s user guide was not always used by maintenance personnel.

Intentionally left blank

81 Safety Recommendations © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 4 - Safety Recommmedations 4 Safety Recommendations 4.1 Safety Recommendations The following Safety Recommendations have been made: Safety Recommendation 2018-006 It is recommended that the European Aviation Safety Agency commission research into the development of Vibration Health Monitoring data acquisition and processing, with the aim of reducing the data set capture interval prescribed in the Acceptable Means of Compliance to CS 29.1465 and thereby enhancing the usefulness of VHM data for the timely detection of an impending failure. Safety Recommendation 2018-007 It is recommended that the European Aviation Safety Agency amend the regulatory requirements to require that Vibration Health Monitoring data gathered on helicopters is analysed in near real‑time, and that the presence of any exceedence detected is made available to the flight crew on the helicopter; as a minimum, this information should be available at least before takeoff and after landing. 4.2 Summary of safety actions AAIB Special Bulletin The AAIB published Special Bulletin S1-2017 which provided the initial facts of this investigation. The Special Bulletin and this report present the following safety actions: Safety action by the helicopter operator The operator subsequently introduced a number of measures to further strengthen the ability to detect impending bearing degradation. These included: a review of all HUMS data to ensure no anomalies, fleet-wide borescope inspections and a requirement for HUMS to be serviceable before flight. The operator also reviewed their HUMS processes and analytical procedures, correcting the omission in the documentation of the use of the IMD‑HUMS ToolBar analysis tools. They also introduced a requirement for an additional assurance check to be carried out by a second licensed engineer prior to releasing the helicopter to service.

82 Safety Recommendations © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 4 - Safety Recommmedations Safety action by the helicopter manufacturer On 31 December 2016 the helicopter manufacturer issued to all operators an ‘All Operators Letter’ (AOL), CCS-92-AOL-16-0019, which described the event. It emphasised the use of the HUMS Tail Gearbox Bearing Energy Tool, provided on the ground station, to detect a TRPCS bearing that is experiencing degradation, and recommended that this tool was utilised as often as reasonably possible. ASB 92-64-011 was issued by the manufacturer on 10 January 2017 and introduced a once-only inspection of the TRPCS and bearing assembly for ratcheting, binding, or rough turning. It also called for a review of the HUMS Tail Gearbox Bearing Energy Tool. The manufacturer recommended that compliance was essential and to be accomplished prior to the next flight from a maintenance facility; three flight hours are allowed in order to return directly to a maintenance facility. The once-only inspection was mandated by FAA Airworthiness Directive (FAA AD) 2017-02-51 issued on 13 January 2017 and added a requirement to carry out a 10-hourly borescope inspection of the bearing in situ until further notice. Concurrent with the release of ASB 92-64-011, the manufacturer published Temporary Revision 45-03 to require operators to use S-92A HUMS ground station software to review Tail Rotor Gearbox energy analysis CIs for alert conditions on a reduced flight hour interval. CIs in excess of published alert levels required inspection of the pitch change shaft and bearing. The manufacturer developed a temperature sensing plug which could be retrofitted to in-service TRPCSs to establish fleet-wide trends. The temperature sensing plug installation was carried out under the authority of ASB 92-64-012, issued on 9 March 2017 with a scheduled compliance date of 13 April 2017. On 24 March 2017 the manufacture issued All Operators Letter CCS-ALL-AOL-17-0008 to remind users of the IMD software of the approved zoom and undo zoom commands for interrogating the HUMS CI data. It also informed users that the IMD software would be obsolete in the near future and that the maintenance manual revisions for the SGBA were now available. The helicopter manufacturer has worked with the bearing manufacturer to identify and implement a number of improvements

83 Safety Recommendations © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 4 - Safety Recommmedations to the bearing manufacturing process. An improved end play measuring tool has been introduced in order to carry out more accurate measurement and bearing setting up during assembly. The grease is now drawn from sealed cartridges and injected into the races using a syringe to ensure a more consistent distribution. The bearing is also now weighed before and after grease application. Safety action by the helideck operator Since the accident the ‘Helicopter Occurrence - Communication Process’ procedures for the helideck operator’s UK operations have been revised to include a requirement to report an accident or serious incident to the AAIB. Helideck certification safety action The Helideck Certification Agency will bring this case to the attention of the CAA and the ICAO HDWG to consider whether the assumptions used in the regulations remain valid in the light of this accident.

Intentionally left blank

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix A 85 Appendix A Tail rotor malfunctions and associated emergency procedures applicable at the time of the event RFM emergency procedures related to ‘uncommanded yaw’. 11.1 LOSS OF TAIL ROTOR THRUST IN FORWARD FLIGHT Symptoms: Uncommanded sharp right yaw, unresponsive to pedal inputs. Action:

Enter autorotation.

Maintain 80 to 100 KIAS.

LDG GEAR – DOWN.

Throttles – STOP prior to touchdown. 11.2 LOSS OF TAIL ROTOR THRUST IN A HOVER Symptoms: Uncommanded sharp right yaw/spin, unresponsive to pedal inputs. Action:

Hold the aircraft in level attitude, attempt to achieve zero groundspeed and drift in a low hover.

Throttles – STOP (5 to 10 feet).

Collective – Increase to cushion landing. After ground contact:

Lower collective to minimum.

Apply wheel brakes.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix A 86 Appendix A (Cont) Emergency Checklist references to ‘uncontrolled yaw’.    

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix A 87 Appendix A (Cont)  

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix B 88 Appendix B Elgin Helideck Landing Area Certificate, Helideck Information Plate and Temporary Limitations Notice 15-2016

HELICOPTER LANDING AREA CERTIFICATE

Copyright HCA

Elgin PUQ

The above named helideck has been inspected in accordance with CAP 437, BSL D 5-1, and HCA requirements for Offshore Helidecks.

The helideck has been found suitable for helicopter operations subject to:

Such non-compliances and restrictions as may be listed below; and,

Authorization by the helicopter operator. Wind (T°) Kts Limitation /Comment • • 015-055

• • 0-15 Platform • Possible turbulence from Turbine Exhaust and Exhaust Stack • Table 1 (T) for all operations due to anti turbulence panels.

Non Compliance 210° Handrail @ 1.1m South East sector (Parking area) Securing eyes for NDB aerial attached to Perimeter net supports 300mm above deck level 5:1 Anti turbulence panels around outboard perimeter Misc Shuttle Aircraft or Containers may be in Parking Area, check clearance from SLA.

Valid for helicopters with:

Maximum ‘D’ value: ‘D’ = 22.8

Maximum take-off weight:

‘t’ = 15.0

This certification shall remain in force until (unless previously revoked or suspended)

10th January 2017

Notes:

This certificate is non-transferable.

The certificate holder is responsible for ensuring that the helideck, its environs and related equipment are at all times fit for purpose and that the helideck crew are suitably qualified, equipped and trained in the exercise of their duties.

This certificate shall cease to be valid if:  Changes of ownership or name of installation/vessel are made without notification to the HCA.  Changes to the helideck, its environs and/or related equipment are made without prior agreement of the HCA.  Levels of Helideck crew qualifications/competency are not maintained to the levels described in the UKOOA Guidelines for Management of Offshore Helidecks or suitable alternative standards.

Any proposed changes are to be accompanied by drawings in plan and elevation with photographs where possible, particularly when such changes concern:  Modification to installation/vessel physical characteristics within the 150°, 210° and 180° falling gradient obstacle protected surfaces; and/or structural modifications to other areas of the installation/vessel that may affect or alter the airflow or turbulence experienced over the helideck 5 The Norwegian 1.25D requirement is only relevant to vessels constructed ( keel laid ) after 1 January 2008. Alex Knight

Date: 27th September 2016

Helideck Certification Agency

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix B 89 Appendix B (Cont)

HELIDECK INFORMATION PLATE

HELIDECK Elev 166 ft VAR 3 W POSITION N57.00.7 E001.50.2

Elgin PUQ HEIGHT OF INSTALLATION: 509 HIGHEST OBSTACLE WITHIN 5NM: Top of Rig VHF

NDB EGN 421.5 Issue Date 09 Dec 2014 FUELLING INSTALLATION: Yes STARTING EQUIPTMENT: Yes Operating Company

Total Issued By

Helideck Certification Agency (Norway 1.25D - ‘D’ = ) HELIDECK D value: 22.8 P/R/H Category: F Max Weight: 15.0

Wind (T°) Kts Limitation /Comment • • 015-055

• • 0-15 Platform • Possible turbulence from Turbine Exhaust and Exhaust Stack • Due to turbulence panels AS332 - Hover with nose wheel near to deck edge - Nil limitation S76 - Table 1 (T) Other types - TBA

Non Compliance 210° Handrail @ 1.1m South East sector (Parking area) Securing eyes for NDB aerial attached to Perimeter net supports 300mm above deck level 5:1 Anti turbulence panels around outboard perimeter Misc Shuttle Aircraft or Containers may be in Parking Area, check clearance from SLA.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix B 90 Appendix B (Cont)

HLL Temporary Limitations Notice

Form 09 Rev 00

Apr 09

TO: ALL PILOTS DATE: 9 May 2016 TLN NUMBER: 15 - 2016

SUBJECT: Galaxy 1 and Prospector 5 Rigs alongside Elgin Wellhead Platforms

Comments The Galaxy 1 and Prospector 5 Jack-up rigs will be repositioning at the Elgin Wellhead Platform. The Galaxy 1 will be stationed on the south side of the Elgin WHPA and the Prospector 5 will be stationed on the north side of the Elgin WHPB as per the diagram below. As an interim measure and until such time as FDM Turbulence analysis has been completed the following restrictions are to be applied when operating to the Galaxy 1 and Prospector 5 Heli-deck.

Please ensure that you remain compliant with PC2E and PC2DLE as applicable.

Photo/Dwg Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix C 91 Appendix C West Franklin Helideck Landing Area Certificate and Helideck Information Plate

HELICOPTER LANDING AREA CERTIFICATE

Copyright HCA

West Franklin

The above named helideck has been inspected in accordance with CAP 437, BSL D 5-1, and HCA requirements for Offshore Helidecks.

The helideck has been found suitable for helicopter operations subject to:

Such non-compliances and restrictions as may be listed below; and,

Authorization by the helicopter operator. Wind (T°) Kts Limitation /Comment

NUI • Circle and H lights fitted

Non Compliance

Valid for helicopters with:

Maximum ‘D’ value: ‘D’ = 21

Maximum take-off weight:

‘t’ = 12.8

This certification shall remain in force until (unless previously revoked or suspended)

09/09/2017

Notes:

This certificate is non-transferable.

The certificate holder is responsible for ensuring that the helideck, its environs and related equipment are at all times fit for purpose and that the helideck crew are suitably qualified, equipped and trained in the exercise of their duties.

This certificate shall cease to be valid if:  Changes of ownership or name of installation/vessel are made without notification to the HCA.  Changes to the helideck, its environs and/or related equipment are made without prior agreement of the HCA.  Levels of Helideck crew qualifications/competency are not maintained to the levels described in the UKOOA Guidelines for Management of Offshore Helidecks or suitable alternative standards.

Any proposed changes are to be accompanied by drawings in plan and elevation with photographs where possible, particularly when such changes concern:  Modification to installation/vessel physical characteristics within the 150°, 210° and 180° falling gradient obstacle protected surfaces; and/or structural modifications to other areas of the installation/vessel that may affect or alter the airflow or turbulence experienced over the helideck 5 The Norwegian 1.25D requirement is only relevant to vessels constructed ( keel laid ) after 1 January 2008. Alex Knight

Date: 14/11/2016

Helideck Certification Agency

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix C (Cont) Appendix C 92

HELIDECK INFORMATION PLATE

HELIDECK Elev 140 ft VAR 4° W POSITION N 56.57.47 –E 001.48.22

West Franklin HEIGHT OF INSTALLATION: 204 HIGHEST OBSTACLE WITHIN 5NM: Check VHF Tr 122.325 Log 129.7 NDB

Issue Date 14 Nov 2016 FUELLING INSTALLATION: No STARTING EQUIPMENT: No Operating Company

Total Issued By

Helideck Certification Agency HELIDECK D value: 21.0m P/R/H Category: F Max Weight: 12.8 t

No photo available

Wind (T°) Kts Limitation /Comment

NUI • Circle and H lights fitted

Non Compliance

Nil

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix D 93 Appendix D Sikorsky Temporary Revision 45-03 MAINTENANCE MANUAL, SA S92A-AMM-000 TEMPORARY REVISION NO. 45-03

FILING INSTRUCTIONS: Insert in Task 45-45-10-710-001, HUMS Displayed Exceedances and Associated Maintenance Actions, immediately following page 163/164, dated Nov 30/16.

SUBJECT: Review of Tail Gear Box (TGB) Bearing Energy HUMS Tool

This temporary revision adds new Section 11. Review of TGB Bearing Energy HUMS Tool to Task 45-45-10- 710-001, HUMS Displayed Exceedances and Associated Maintenance Actions, dated Nov 30/16.

MANUAL CHANGES:

In Task 45-45-10-710-001, HUMS Displayed Exceedances and Associated Maintenance Actions, dated Nov 30/16, add new Section 11. Review of TGB Bearing Energy HUMS Tool as follows:

• Review of Tail Gear Box (TGB) Bearing Energy HUMS Tool.

A. The following review shall be performed as follows: NOTE: A functioning TGB mechanical diagnostic function of the HUMS is required.

(1) If using IMD and TGB energy analysis software contained in the standalone software tool for the S- 92 HUMS GS, a review shall be accomplished every three (3) flight hours. (2) If using Sikorsky Ground Based Application (SGBA) TGB bearing energy tool version released prior to January 10, 2017, a review shall be accomplished every three (3) flight hours. (3) If using SGBA TGB bearing energy tool version released on or after January 10, 2017, a review shall be accomplished every six (6) flight hours. (4) If customer seeks extension to six (6) flight hours and are using methods one (1) or two (2) above contact Aircraft on Ground (AOG) Center at 1-800-WINGED-S or Email: sikorsky.aog@lmco.com. B. For users with Integrated Mechanical Diagnostics (IMD) bearing energy tool, review the HUMS Tail Gear Box Bearing Energy Tool per the HUMS user guide, SA S92A-HUM-000, Chapter 11.4 with the following exceptions:

(1) A condition indicator (CI) exceedance of 1.75 for any one data point shall require inspection per AMM Task 64-22-03-290-001 “Off AC Inspection of TR PCS Bearing Assembly”, steps A.(6)(j) thru A.(6)(o) and contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com . Submit any findings to local Sikorsky FSR. C. For users with the SGBA HUMS Toolbar, review the HUMS Tail Gearbox Bearing Energy Tool per the Sikorsky Ground Based Application (SGBA) Users Guide, SA S92A-GBA-000, Chapter 15.5 with the following additions:

WARNING: THIS DOCUMENT, OR AN EMBODIMENT OF IT IN ANY MEDIA, DISCLOSES INFORMATION WHICH IS PROPRIETARY, IS THE PROPERTY OF SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES, IS AN UNPUBLISHED WORK PROTECTED UNDER APPLICABLE COPYRIGHT LAWS, AND IS DELIVERED ON THE EXPRESS CONDITION THAT IT IS NOT TO BE USED, DISCLOSED, REPRODUCED, IN WHOLE OR IN PART (INCLUDING REPRODUCTION AS A DERIVATIVE WORK), OR USED FOR MANUFACTURE FOR ANYONE OTHER THAN SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES WITHOUT ITS WRITTEN CONSENT, AND THAT NO RIGHT IS GRANTED TO DISCLOSE OR SO USE ANY INFORMATION CONTAINED HEREIN. ALL RIGHTS RESERVED. ANY ACT IN VIOLATION OF APPLICABLE LAW MAY RESULT IN CIVIL AND CRIMINAL PENALTIES. 45-45-10 Page 1 of 4 Jan 10/17

Temporary Revision 45-03 WARNING ‒ This document contains technical data subject to the EAR. Authorization is required prior to providing this technical data to any company, entity, person, or destination. EAR Export Classification: ECCN EAR99

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix D 94 Appendix D (Cont) MAINTENANCE MANUAL, SA S92A-AMM-000 WARNING: A CI RATIO GREATER THAN 1.75 WILL NOT AUTOMATICALLY DISPLAY AS AN ALERT.

(1) This automated TGB Bearing Energy Analysis software consists of the following four steps: (a) The 15-20 kHz energy data for a specific helicopter tail number is extracted from the HUMS Ground Station Software (GSS) Raw Data Files (RDFs). This 15-20 kHz energy is referred to as a CI. (b) The average 15-20 kHz energy is computed for that helicopter tail number since the last maintenance date. This date is important, since removing/replacing the TGB, the pitch change shaft assembly, or the TGB accelerometer can change the absolute value of the CI. (c) The 15-20 kHz energy is normalized by the helicopter-specific mean. This normalized energy is referred to as the “CI ratio”. The intent of the software is create a baseline for the helicopter that is nominally at 1.0. The baseline data consists of 200 points. If 200 points have not been collected since the last maintenance date the tool will indicate “Insufficient Data”. (d) The trend history for the normalized energy is plotted for each specific tail number. The limit threshold for this normalized data is 1.75. NOTE: The current alert limit display of 2.5 should not be used and will be updated in the next release. The 1.75 alert limit exceedance will not automatically display as an alert until the next release. NOTE: See Figure 129 for example of exceedance requiring maintenance inspection. Note data prior to exceedance is nominally centered around 1.0 indicating good baseline data. (2) A condition indicator (CI) exceedance of 1.75 for any one data point shall require inspection per AMM Task 64-22-03-290-001 “Off AC Inspection of TRPCS Bearing Assembly”, steps A.(6)(j) thru A.(6)(o) and contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com . Submit any findings to local Sikorsky FSR.

WARNING: THIS DOCUMENT, OR AN EMBODIMENT OF IT IN ANY MEDIA, DISCLOSES INFORMATION WHICH IS PROPRIETARY, IS THE PROPERTY OF SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES, IS AN UNPUBLISHED WORK PROTECTED UNDER APPLICABLE COPYRIGHT LAWS, AND IS DELIVERED ON THE EXPRESS CONDITION THAT IT IS NOT TO BE USED, DISCLOSED, REPRODUCED, IN WHOLE OR IN PART (INCLUDING REPRODUCTION AS A DERIVATIVE WORK), OR USED FOR MANUFACTURE FOR ANYONE OTHER THAN SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES WITHOUT ITS WRITTEN CONSENT, AND THAT NO RIGHT IS GRANTED TO DISCLOSE OR SO USE ANY INFORMATION CONTAINED HEREIN. ALL RIGHTS RESERVED. ANY ACT IN VIOLATION OF APPLICABLE LAW MAY RESULT IN CIVIL AND CRIMINAL PENALTIES. 45-45-10 Page 2 of 4 Jan 10/17

Temporary Revision 45-03 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix D 95 Appendix D (Cont) MAINTENANCE MANUAL, SA S92A-AMM-000

Figure 129. Example of Recorded Exceedence of TRPCS that Requires Maintenance. WARNING: A CI RATIO GREATER THAN 1.75 WILL NOT AUTOMATICALLY DISPLAY AS AN ALERT. NOTE: The 1.75 limit may be manually defined as a threshold. WARNING: THIS DOCUMENT, OR AN EMBODIMENT OF IT IN ANY MEDIA, DISCLOSES INFORMATION WHICH IS PROPRIETARY, IS THE PROPERTY OF SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES, IS AN UNPUBLISHED WORK PROTECTED UNDER APPLICABLE COPYRIGHT LAWS, AND IS DELIVERED ON THE EXPRESS CONDITION THAT IT IS NOT TO BE USED, DISCLOSED, REPRODUCED, IN WHOLE OR IN PART (INCLUDING REPRODUCTION AS A DERIVATIVE WORK), OR USED FOR MANUFACTURE FOR ANYONE OTHER THAN SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES WITHOUT ITS WRITTEN CONSENT, AND THAT NO RIGHT IS GRANTED TO DISCLOSE OR SO USE ANY INFORMATION CONTAINED HEREIN. ALL RIGHTS RESERVED. ANY ACT IN VIOLATION OF APPLICABLE LAW MAY RESULT IN CIVIL AND CRIMINAL PENALTIES. 45-45-10 Page 3 of 4 Jan 10/17

Temporary Revision 45-03 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix D 96 Appendix D (Cont)

Temporary Revision 45-03 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix E 97 Appendix E Sikorsky All Operators Letter CCS-ALL-AOL-17-0008 dated 24 March 2017 Lockheed Martin Proprietary Information

Lockheed Martin Proprietary Information

This document does not contain any export controlled technical data. S-92® and S-76D™ are registered trademarks of Sikorsky, a Lockheed Martin Company. Sikorsky, a Lockheed Martin Company 6900 Main Street P.O. Box 9729 Stratford, Connecticut 06615-9129

March 24, 2017 CCS-ALL-AOL-17-0008

To: All S-92® and S-76D™ Operators All Service Centers All Field Service Representatives Attention: Aviation Director Chief of Maintenance Chief Helicopter Pilot Subject: IMD Software Ref: (A) HUMS Users Guide for Sikorsky Helicopter Model S-92A, SA S92A-HUM-000 (B) HUMS Users Guide for Sikorsky Helicopter Model S-76D, SA S76D-HUM-000 (C) Sikorsky Ground Based Application (SGBA) Users Guide for Sikorsky Helicopter Models S-92 AND S-76D, SA S92A-GBA-000

The S-92 and S-76D Health and Usage Monitoring System ground stations have 2 software versions available for use by our operators: Integrated Mechanical Diagnostics (IMD); and, Sikorsky Ground Based Application (SGBA). SGBA software was released with the intention to render the original IMD ground station software obsolete in the near future.

Sikorsky released S-92 maintenance manual revisions March 9, 2017 to support customers fully transitioning from IMD to SGBA. There are many enhanced features of SGBA, including enhanced diagnostics capabilities and improved user interfaces. The following figures depict some of the enhancements in SGBA, including color-keyed visual indicators that highlight inspection requirements.

This AOL is issued to follow up on findings from the December 2016 S-92 Tail Rotor Pitch Change Shaft incident and is not connected to the tragic accident involving a Search & Rescue S-92 in Ireland earlier this month (reference CCS-92-AOL-17-0012, S-92 Helicopter Accident Notification).

The importance of technicians easily and consistently identifying any (potential) anomaly using the HUMS ground station software is clear – the aim of this AOL is to support success in this area. It has been noted that when the IMD HUMS Toolbar or strip charts display a large number of data

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix E (Cont) Appendix E 98 Lockheed Martin Proprietary Information Lockheed Martin Proprietary Information 2 points, the data becomes compacted and some data points may potentially be obscured on the right side of the graph. This may result in a rapidly rising trend being less readily apparent to the technician reviewing the data. IMD HUMS Toolbar and strip charts are presented based on user selected parameters, and by default, are set up to display Parameter(s) versus Time, with the unit of time set to Calendar. The parameter scales are automatically generated based on the magnitude of the largest and smallest parameters within the Time range. The most recent data will be presented near or aligned with the right frame of the strip chart report. In cases where the displayed parameter has trended above a threshold only in the most recent flight records, the magnitude of the recent data may not be apparent without zooming in to view the data with a reduced timescale. In this latter case threshold or alert levels will be biased towards the bottom of the parameter scale in direct relation to the magnitude of the maximum parameter. The following figure illustrates the conditions described above: most recent data presented near or aligned with right frame; expanded parameter scale; and, alert reference line biased towards bottom of chart. IMD software permits zooming in and out with specific commands described in Chapter 9.1 of the HUMS User Guide referenced above and reproduced below. A. Zoom Note: Only works on unstacked graphs (a) Position the cursor over the portion of the graph you wish to enlarge. (b) Click and hold the left mouse button and drag the magnifier box (faint white outline) down and right over the region to be enlarged (See following figure). 1 2 3 This page does not contain export controlled technical data

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix E (Cont) Appendix E 99 Lockheed Martin Proprietary Information Lockheed Martin Proprietary Information 3 (c) Release the mouse button to display the area inside the magnifier box. (See following figure). (d) Continue to Zoom in on the desired area of the graph. The entire graph will be enlarged but the area of interest will remain in view. (e) Once the graph has been zoomed to the desired size, the entire graph may be viewed by holding the right mouse button down and dragging the graph left and right or up and down. B. Undo Zoom (a) Position the cursor in the lower right of the graph, and while holding the left mouse button down, drag the cursor to the upper left and release. The graph will return to its normal size. Several IMD functions enable alternate Zoom and undo Zoom commands, including vibration diagnostics (vibe data) interface, RTB interface, and TR Bearing Energy Analysis tool. These functions permit Undo This page does not contain export controlled technical data

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix E (Cont) Appendix E 100 Lockheed Martin Proprietary Information Lockheed Martin Proprietary Information 4 Zoom commands to also be entered by selecting data from Lower-Right to Upper-Left and Lower-Left to Upper-Right & Upper-Right to Lower-Left. Sikorsky recommends that all technicians analyzing S-92 or S-76 aircraft HUMS data using the IMD software use standardized procedures to Zoom (see section A above) and Undo Zoom (see section B above) function to ensure effective post-flight data analysis. Routinely zoom in on the very latest data, to ensure that any parameter trend deviation is readily identifiable. Further, Sikorsky encourages all operators to promptly transition to the SGBA ground station, in advance of IMD obsolescence. Sikorsky will continue to update only SGBA software with new advanced diagnostic tools. Please contact your Sikorsky Field Service Representative with any questions that you may have on this topic. Very truly yours, Timothy Fox Chief Engineer Sikorsky, a Lockheed Martin Company This page does not contain export controlled technical data

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix F 101 Appendix F Sikorsky All Operators Letter CCS-92-AOL-16-0019 dated 31 December 2016

Sikorsky 6900 Main Street P.O. Box 9729 Stratford, Connecticut 06615-9129

December 31, 2016 CCS-92-AOL-16-0019

To: All S-92® Operators All Service Centers All Field Service Representatives Attention: Aviation Director Chief of Maintenance Chief Helicopter Pilot

Subject: Follow Up: S-92 Aircraft Incident Notification

As previously notified, Sikorsky is offering additional information to our operators regarding the S-92 event on December 28. The technical issue that resulted in the helicopter unscheduled landing on an oil and gas installation platform in the North Sea has been identified as a loss of tail rotor authority.

The condition involved a degradation of the Tail Rotor Pitch Change Shaft (TRPCS) bearing. Although the failure condition presents a loss of control authority, it does not result in a loss of tail rotor drive or tail rotor thrust. Initial review of the actions taken by the crew indicate that appropriate standard emergency procedure was used, which resulted in the safe landing without any injuries to passengers or crew.

The specific root cause determination is in the early stages of investigation, and the components involved are en route to our facility in Connecticut for detailed laboratory analysis. The aircraft did not otherwise experience significant damage and is expected to be returned to service following replacement of the affected components.

We note that two recent Alert Service Bulletins were issued regarding the TRPCS (ASB-92-64-009 and ASB-92-64-010, issued in Nov and Dec 2016 respectively). A review of the information confirms that neither of the ASB’s were applicable to this particular TRPCS. The bearing design has proven to be a highly reliable component in the more than one million fleet hours of global S-92 service. Regardless of their impact on the recent event, Sikorsky recommends all operators ensure compliance to the two Alert Service Bulletins listed above.

Additionally, Sikorsky continues to work with the operator on reviewing data obtained from our on- board Health and Usage Monitoring System (HUMS). The parametric and vibration data is being reviewed from this occurrence to determine if any operational improvements can be made. We remind our operators that the HUMS data from each S-92 helicopter should be processed regularly through the available Groundstation, and that all available HUMS Mechanical Diagnostic Tools should be used as often as reasonably possible. Many of our operators have reported success in utilizing Diagnostic Tools more frequently, such as prior to every departure from the aircraft base. Sikorsky developed these tools for use as part of successful maintenance programs, and recommends their use as often as reasonably possible.

Sikorsky recommends specific emphasis on utilization of the HUMS Tail Gearbox Bearing Energy Tool. This Tool will detect a PCS bearing that is experiencing degradation. The Tail Gearbox Energy Tool should be processed through the available Groundstation as often as reasonably possible.

Sikorsky will be planning an operator Webcast shortly to discuss this matter. We will further communicate findings if the investigation reveals any safety or airworthiness issues that affect the S-92 helicopter fleet.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 102 Appendix G Sikorsky ASB 92-64-011 dated 10 January 2017 ATA 64-22-03 ONE-TIME INSPECTION S-92® HELICOPTER ALERT SERVICE BULLETIN NOTICE TO ALL PERSONS RECEIVING THIS DOCUMENT: WARNING: THIS DOCUMENT, OR AN EMBODIMENT OF IT IN ANY MEDIA, DISCLOSES INFORMATION WHICH IS PROPRIETARY, IS THE PROPERTY OF SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES, IS AN UNPUBLISHED WORK PROTECTED UNDER APPLICABLE COPYRIGHT LAWS, AND IS DELIVERED ON THE EXPRESS CONDITION THAT IT IS NOT TO BE USED, DISCLOSED, REPRODUCED, IN WHOLE OR IN PART (INCLUDING REPRODUCTION AS A DERIVATIVE WORK), OR USED FOR MANUFACTURE FOR ANYONE OTHER THAN SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES WITHOUT ITS WRITTEN CONSENT, AND THAT NO RIGHT IS GRANTED TO DISCLOSE OR SO USE ANY INFORMATION CONTAINED HEREIN. ALL RIGHTS RESERVED. ANY ACT IN VIOLATION OF APPLICABLE LAW MAY RESULT IN CIVIL AND CRIMINAL PENALTIES. S-92® IS A REGISTERED TRADEMARK OF SIKORSKY AIRCRAFT CORPORATION. ASB 92-64-011 Basic Issue ▪January 10/17 SUBJECT: TAIL ROTOR – Tail Rotor Pitch Change Shaft Bearing Assembly – One-Time Inspection of Tail Rotor Pitch Change Shaft (TRPCS) and Bearing Assembly for Ratcheting, Binding, or Rough Turning Section 1. PLANNING INFORMATION A. Effectivity All S-92A model helicopters with TRPCS assembly (92358-06303-041 and/or - 042) installed, including spares, delivered as of the issue date of this Alert Service Bulletin (ASB). B. Purpose To provide instructions for a one-time inspection of TRPCS and bearing assembly for ratcheting, binding, or rough turning. C. Description Helicopter records and log cards are reviewed. Helicopter is prepared for maintenance. TRPCS and bearing assembly is removed from helicopter and inspected, including spares. Tail Gear Box (TGB) bearing energy HUMS tool is reviewed. If TRPCS and bearing assembly fails inspection, it is returned to Sikorsky Commercial Inc. (SCI) for evaluation, and replaced with a serviceable TRPCS and bearing assembly. If TRPCS and bearing assembly passes inspection, reinstall TRPCS and bearing assembly. TGB Bearing Energy Tool maintenance date shall not be updated or reset. Helicopter is returned to service. Sikorsky Aircraft Corporation 6900 Main Street P.O. Box 9729 Stratford, Connecticut 06615-9129 (203) 386-4000 Page 1 of 8 WARNING ‒ This document contains technical data subject to the EAR. Authorization is required prior to providing this technical data to any company, entity, person, or destination. EAR Export Classification: ECCN EAR99

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 103 Appendix G (Cont) S-92 ALERT ASB 92-64-011 SERVICE BULLETIN Basic Issue ▪January 10/17 ATA 64-22-03 ONE-TIME INSPECTION Section 1. PLANNING lNFORMATION (Continued) D. Compliance Compliance is essential. The instructions outlined herein shall be accomplished prior to next flight originating from a maintenance facility, not to exceed 30 days from the issue date of this ASB. • If TRPCS and bearing assembly was manufactured, repaired or overhauled after November 2, 2016, the instructions outlined Section 3., step C.(1) shall be accomplished within ten (10) flight hours. • If helicopter(s) is not at a maintenance facility, three (3) flight hours are allowed in order to return directly to a maintenance facility. If three (3) hours are not sufficient, contact Sikorsky Aircraft Customer Service Engineering at 1-800- WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com for further guidance. • Helicopter(s) involved in emergency services operation, contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com for guidance regarding compliance time extension for the inspections herein. • If the instructions outlined in Section 3., step C.(1) were accomplished within the previous three (3) flight hours, they do not need to be repeated. E. Approval Inspection item. F. Manpower (Estimated) Task No. of Men No. of Hours Man-Hours* Removal of Tail Rotor Pitch Beam 1 1.0 1.0 Removal of Tail Rotor Servo 2 1.0 2.0 Removal of TRPCS 1 1.0 1.0 Do TRPCS and Bearing Assembly Inspection 1 1.0 1.0 Installation of TRPCS and Bearing Assembly 1 1.0 1.0 Installation of Tail Rotor Servo 2 2.0 4.0 Installation of Tail Rotor Pitch Beam 1 1.0 1.0 Total Man-Hours 11.0 *Estimate does not include time required to prepare helicopter or return it to flight status. G. Tooling None. Page 2 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 104 Appendix G (Cont) ASB 92-64-011 S-92 ALERT Basic Issue ▪ January 10/17 SERVICE BULLETIN ATA 64-22-03 ONE-TIME INSPECTION Section 1. PLANNING lNFORMATION (Continued) H. Weight and Balance Not affected. I. Electrical Load Data Not affected. J. Software Load Data Not changed. K. References (1) ASB 92-64-009, One-Time Inspection of Tail Rotor Pitch Change Shaft (TRPCS) and Bearing Assembly for Improper Axial Play, latest revision. (2) HUMS User Guide, SA S92A-HUM-000, Chapter 11.4 (15). (3) Maintenance Manual, SA S92A-AMM-000, Task 64-22-03-290-001. (4) Maintenance Manual, SA S92A-AMM-000, Tasks 64-22-03-900-001/-002. (5) Maintenance Manual, SA S92A-AMM-000, Tasks 67-32-01-900-001/-002. (6) Sikorsky Ground Based Application (SGBA) Users Guide, S92A-GBA-000, Chapter 15. L. Publications Affected Temporary Revision 45-03 against Maintenance Manual, SA S92-AMM-000, Task 45-45-10-710- 01, is issued concurrently with this ASB. M. Attachment None. Section 2. MATERIAL INFORMATION A. Basis for Material Data Per helicopter. B. Bill of Material New Part No. Qty Key Word Old Part No. Instructions/ Disposition 978008 1 GASK-O-SEAL 978008 (1)(2) Page 3 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 105 Appendix G (Cont) S-92 ALERT ASB 92-64-011 SERVICE BULLETIN Basic Issue ▪January 10/17 ATA 64-22-03 ONE-TIME INSPECTION Section 2. MATERIAL INFORMATION (Continued) (1) For part availability and lead time requirements contact your Customer Service Representative at SCI. Submit a no-cost purchase order referencing this ASB number and the helicopter serial number(s) on which these parts will be used. This will allow SCI and the operator to track shipment and receipt of parts. Orders will be accepted by letter, telephone, facsimile (FAX) or through the SCI website: www.HSIUS.com. For prompt shipment, reference address of each shipping destination. Direct your order to: Sikorsky Aircraft Corporation Commercial Systems and Services Mailstop K100 124 Quarry Road Trumbull, CT 06611 U.S.A. Attn: Account Service Manager FAX: (203) 416-4291, Telephone: (203) 416-4000 https://customerportal.sikorsky.com (2) A one-time re-use of Gask-O-Seal (978008) is permissible if replacement is not available. (Refer to Section 3, step C.(1)(a)). C. Consumable Material None. Section 3. ACCOMPLISHMENT INSTRUCTIONS A. Review helicopter records and log cards to determine if TRPCS and bearing assembly was manufactured, repaired, or overhauled on or after November 2, 2016. B. Prepare helicopter for maintenance: (1) Turn off all helicopter electrical and hydraulic power. (2) Engage rotor brake. NOTE: If stand-alone bearing energy analysis software is being used, the HUMS maintenance date associated with the TRPCS and bearing assembly shall not be updated or reset, even upon removal and installation of the TRPCS bearing assembly. (Refer to HUMS User Guide, SA S92A-HUM-000, Chapter 11.4, Section C, step 12). C. Remove TRPCS and bearing assembly. (Refer to Maintenance Manual, SA S92A-AMM-000, Task 64-22-03-900-001). TO PREVENT ELECTRICAL SHOCK OF PERSONNEL OR POSSIBLE DAMAGE TO HELICOPTER COMPONENTS, MAKE SURE TO TURN OFF ALL ELECTRICAL POWER. Page 4 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 106 Appendix G (Cont) ASB 92-64-011 S-92 ALERT Basic Issue ▪ January 10/17 SERVICE BULLETIN ATA 64-22-03 ONE-TIME INSPECTION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) NOTE: For further guidance on any questionable inspection results, contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com. (1) Perform inspection of TRPCS and bearing assembly, including spares. (Refer to Maintenance Manual, SA S92A-AMM-000, Task 64-22-03-290-001, steps A.(6)(j) through A.(6)(o)). (a) Contact Customer Service Program Manager if any TRPCS and bearing assemblies fail inspection. Submit any findings to local Sikorsky FSR. Rejected parts shall be returned to Sikorsky for evaluation with the reason for failure clearly identified. NOTE: A one-time re-use of Gask-O-Seal (978008) is permissible if replacement is not available and inspection criteria is met. (b) If no damage, cuts, tears, or distortion is found on Gask-O-Seal (978008), proceed to step (2). (c) If damage, cuts, tears, or distortion is found on Gask-O-Seal (978008), replace with new Gask-O-Seal. (Refer to Maintenance Manual, SA S92A-AMM-000, Tasks 67- 32-01-900-001/-002). NOTE: If HUMS data isn’t available for review, contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr- sik@lmco.com. (2) Review TGB bearing energy HUMS tool per HUMS User Guide, SA S92A-HUM-000, Chapter 11.4, not applicable to spare TRPCS bearing assemblies. Compliance can be accomplished via the legacy HUMS toolbar or the integrated Sikorsky Ground Based Application (SGBA) toolbar. (a) For users with stand-alone bearing energy analysis software, review the HUMS Tail Gear Box Bearing Energy Tool per the HUMS user guide, SA S92A-HUM-000, Chapter 11.4 with the following exceptions: 1. A condition indicator (CI) exceedance of 1.75 for any one data point shall require inspection per Maintenance Manual, SA S92A-AMM-000, Task 64-22- 03-290-001, steps A.(6)(j) thru A.(6)(o) and contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr- sik@lmco.com. (b) For integrated SGBA HUMS toolbar, refer to Sikorsky Ground Based Application (SGBA) Users Guide, S92A-GBA-000, Chapter 15 with the following additions: 1. This automated TGB Bearing Energy Analysis software consists of the following four steps: a The 15-20 kHz energy data for a specific helicopter tail number is extracted from the HUMS Ground Station Software (GSS) Raw Data Files (RDFs). This 15-20 kHz energy is referred to as a CI. Page 5 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 107 Appendix G (Cont) S-92 ALERT ASB 92-64-011 SERVICE BULLETIN Basic Issue ▪January 10/17 ATA 64-22-03 ONE-TIME INSPECTION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) b The average 15-20 kHz energy is computed for that helicopter tail number since the last maintenance date. This date is important, since removing/replacing the TGB, the pitch change shaft assembly, or the TGB accelerometer can change the absolute value of the CI. c The 15-20 kHz energy is normalized by the helicopter -specific mean. This normalized energy is referred to as the “CI ratio”. The intent of the software is create a baseline for the helicopter that is nominally at 1.0. The baseline data consists of 200 points. If 200 points have not been collected since the last maintenance date the tool will indicate “Insufficient Data”. d The trend history for the normalized energy is plotted for each specific tail number. The limit threshold for this normalized data is 1.75. 2. A CI exceedance of 1.75 for any one data point shall require inspection per Maintenance Manual, SA S92A-AMM-000, Task 64-22-03-290-001, steps A.(6)(j) thru A.(6)(o) and contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr- sik@lmco.com. D. Install serviceable TRPCS and bearing assembly. (Refer to Maintenance Manual, SA S92A- AMM-000, Task 64-22-03-900-002). E. Make sure the TGB mechanical diagnostic function of the HUMS is functioning. F. Review and incorporate the newly established recurring review of TGB bearing energy HUMS tool into the helicopter’s maintenance plan. (Refer to Temporary Revision 45-03 against Maintenance Manual, SA S92-AMM-000, Task 45-45-10-710-01). G. Return helicopter to service. A CI RATIO GREATER THAN 1.75 WILL NOT AUTOMATICALLY DISPLAY AS AN ALERT. Page 6 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 108 Appendix G (Cont) ASB 92-64-011 S-92 ALERT Basic Issue ▪ January 10/17 SERVICE BULLETIN ATA 64-22-03 ONE-TIME INSPECTION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) EXAMPLE OF RECORDED EXCEEDANCE OF TRPCS THAT REQUIRES MAINTENANCE WARNING: A CI RATIO GREATER THAN 1.75 WILL NOT AUTOMATICALLY DISPLAY AS AN ALERT. NOTE: The 1.75 limit may be manually defined as a threshold. FIGURE 1 Page 7 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 109 Appendix G (Cont) S-92 ALERT ASB 92-64-011 SERVICE BULLETIN Basic Issue ▪January 10/17 ATA 64-22-03 ONE-TIME INSPECTION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) H. Record of compliance: (1) Make helicopter logbook entries to show compliance with this ASB as follows: (a) Make helicopter level logbook entry on form SA7343-15 (Aircraft ASB Release Signoff). (b) Make component log card entries on forms SA7343-22 (Aircraft Component Log Cards) and the PCS and bearing assembly SA7343-21 (Component Log Cards). (2) Make an appropriate electronic compliance entry in the E-Notification section at www.Sikorsky360.com. Refer to User Guide located on the www.Sikorsky360.com/E- Notification Search page. (3) Upon compliance with this ASB, complete and return the following compliance record card by mail, fax, or scan and e-mail. Page 8 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 110 Appendix G (Cont) (Fold over and tape closed) SIKORSKY AIRCRAFT CORPORATION FACSIMILE NUMBER (817) 762-9715 EMAIL ADDRESS: product_safety.gr-sik@lmco.com ATTENTION: Gr-SIK, Product_Safety SIKORSKY AIRCRAFT CORPORATION (Fold Up to Arrows) IMPORTANT NOTICE Upon COMPLIANCE with the attached ASB, Sikorsky requests your cooperation in completing and returning this ENTIRE PAGE by MAIL, FAX, or scan & EMAIL. Please fill in the requested information at the bottom of the page, so we may maintain proper records documenting the configuration of your aircraft. This information is useful when determining configuration and effectivity of issues affecting fielded aircraft. This request is in keeping with our policy to assure that our customers receive the latest information applicable for the maintenance of your aircraft. Thank you. ALERT SERVICE BULLETIN:

Compliance Record Card TITLE: ___________________________________________________________________

OWNER/OPERATOR: _____________________________________________________ SUBMITTED BY: ___________________________ DATE: ____________________ FOLLOWING SERIAL NUMBERS ARE NOT AFFECTED BY THIS ASB ASB HAS BEEN COMPLIED WITH ON HELICOPTER SERIAL NUMBERS:

No. 92-64-011 TAIL ROTOR – Tail Rotor Pitch Change Shaft Bearing Assembly – One-Time Inspection of Tail Rotor Pitch Change Shaft (TRPCS) and Bearing Assembly for Ratcheting, Binding, or Rough Turning This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 111 Appendix G (Cont) No Postage Necessary BUSINESS REPLY MAIL FIRST-CLASS MAIL PERMIT NO. 432 BRIDGEPORT CT POSTAGE WILL BE PAID BY ADDRESSEE SIKORSKY AIRCRAFT CORPORATION Commercial Systems and Services Mailstop K100 124 QUARRY ROAD TRUMBULL, CT 06611 U.S.A.

ATTENTION: Gr-SIK, Product_Safety Please complete the form on the reverse side and FAX to FACSIMILE NUMBER (817) 762-9715 Or scan and email to: EMAIL ADDRESS: product_safety.gr-sik@lmco.com or fold and return ENTIRE form to Sikorsky Aircraft Corporation This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix H 112 Appendix H FAA Airworthiness Directive AD 2017-02-51 dated 13 January 2017 1 FAA Aviation Safety EMERGENCY AIRWORTHINESS DIRECTIVE www.faa.gov/aircraft/safety/alerts/ DATE: January 13, 2017 AD #: 2017-02-51 This Emergency Airworthiness Directive (Emergency AD) 2017-02-51 is being sent to owners and operators of Sikorsky Aircraft Corporation (Sikorsky) Model S-92A helicopters. Background This Emergency AD was prompted by three reports of operators losing tail rotor (TR) control caused by a failed tail rotor pitch change shaft (TRPCS) assembly bearing. Following the first two reports, the FAA issued and subsequently published as a final rule Emergency AD 2016-24-51 (81 FR 95425, December 28, 2016). That AD applies to Sikorsky Model S-92A helicopters with a TRPCS assembly that has less than 80 hours time-in-service (TIS) with bearings that were manufactured prior to November 3, 2016. Emergency AD 2016-24-51 is intended to address an unsafe condition with low-time bearings by requiring removal of TRPCS assemblies that have less than 5 hours TIS and one-time inspections for certain conditions. Actions Since Emergency AD 2016-24-51 Was Issued Since Emergency AD 2016-24-51 was issued, a third report of an S-92A helicopter losing TR control was reported, and a preliminary investigation determined that the bearing failed despite having more than 80 hours TIS. We have determined that the unsafe condition can exist on TRPCS bearings regardless of hours TIS. Therefore, this Emergency AD applies to all TRPCS assemblies. This Emergency AD requires a one-time visual inspection and a repetitive borescope inspection of the TRPCS assembly bearing. The repetitive inspection is intended to detect bearing deterioration. The actions in this Emergency AD are intended to detect a binding bearing, prevent loss of TR control, and possible loss of control of the helicopter. FAA’s Determination We are issuing this Emergency AD because we evaluated all the relevant information and determined the unsafe condition described previously is likely to exist or develop in other products of the same type design. Related Service Information We reviewed Sikorsky Alert Service Bulletin 92-64-011, Basic Issue, dated January 10, 2017 (ASB). The ASB describes procedures for inspecting the TRPCS and bearing assemblies for ratcheting, binding, and rough turning. The ASB also specifies periodic review of the health and usage monitoring system (HUMS) tail gearbox bearing energy tool. Emergency AD Requirements This Emergency AD requires, before further flight, removing the TRPCS assembly and inspecting the bearing. If the bearing does not rotate freely; the bearing sounds rough or chatters; there is any purged grease with metal particles; a nick or dent; or if there is a cut, tear, or distortion in

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix H 113 Appendix H (Cont) 2 the bearing seal, before further flight, replacing the TRPCS assembly is required. This Emergency AD also requires, within 10 hours TIS, and thereafter at intervals not to exceed 10 hours TIS, inspecting the TRPCS assembly with a borescope. If the white Teflon seal or snap ring is missing, or if there is a rip, tear, or heat damage on the seal or if there is no gap in the snap ring, replacing the TRPCS assembly is required before further flight. Differences Between This Emergency AD and the Service Information This Emergency AD requires repetitive borescope inspections of the TRPCS; the ASB does not. The ASB specifies that operators review HUMS data in addition to the one-time inspection and specifies contacting Sikorsky if any discrepancies are found; this Emergency AD does not. Interim Action We consider this Emergency AD to be an interim action. If final action is later identified, we might consider further rulemaking then. Authority for this Rulemaking Title 49 of the United States Code specifies the FAA’s authority to issue rules on aviation safety. Subtitle I, Section 106, describes the authority of the FAA Administrator. “Subtitle VII, Aviation Programs,” describes in more detail the scope of the Agency’s authority. We are issuing this rulemaking under the authority described in “Subtitle VII, Part A, Subpart III, Section 44701, General requirements.” Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action. Adoption of the Emergency Airworthiness Directive (AD) We are issuing this Emergency AD under 49 U.S.C. Sections 106(g), 40113, and 44701 according to the authority delegated to me by the Administrator. 2017-02-51 Sikorsky Aircraft Corporation: Directorate Identifier 2017-SW-003-AD. (a) Applicability This Emergency AD applies to Sikorsky Aircraft Corporation (Sikorsky) Model S-92A helicopters, certificated in any category, with a tail rotor pitch change shaft (TRPCS) assembly part number (P/N) 92358-06303-041 or P/N 92358-06303-042 installed. (b) Unsafe Condition This Emergency AD defines the unsafe condition as a binding TRPCS bearing. This condition could result in loss of tail rotor (TR) control and possible loss of control of the helicopter. (c) Effective Date This Emergency AD is effective upon receipt.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix H 114 Appendix H (Cont) 3 (d) Compliance You are responsible for performing each action required by this Emergency AD within the specified compliance time unless it has already been accomplished prior to that time. (e) Required Actions (1) Before further flight, unless already done, remove the TRPCS assembly and inspect the SB2310 angular contact bearing for free rotation, purged grease with metal particles, a nick or a dent, and any cut, tear, or distortion on the bearing seal. If the bearing does not rotate freely; the bearing sounds rough or chatters; there is any purged grease with metal particles; a nick or dent; or if there is a cut, tear, or distortion in the bearing seal, before further flight, replace the TRPCS assembly. (2) Within 10 hours time-in-service (TIS), unless already done within the last 10 hours TIS, and thereafter at intervals not to exceed 10 hours TIS, on the TR side of the TRPCS bearing, remove the plug from the end of the TRPCS, insert the borescope into the TRPCS, and determine whether the white Teflon seal and snap ring are installed. If the white Teflon seal or snap ring is missing, or if there is a rip, tear, or heat damage on the seal or if there is no gap in the snap ring, before further flight replace the TRPCS assembly. (f) Alternative Methods of Compliance (AMOCs) (1) The Manager, Boston Aircraft Certification Office, FAA, may approve AMOCs for this Emergency AD. Send your proposal to: Blaine Williams, Aerospace Engineer, Boston Aircraft Certification Office, Engine & Propeller Directorate, 1200 District Avenue, Burlington, Massachusetts 01803; telephone (781) 238-7161; email blaine.williams@faa.gov. (2) For operations conducted under a 14 CFR part 119 operating certificate or under 14 CFR part 91, subpart K, we suggest that you notify your principal inspector, or lacking a principal inspector, the manager of the local flight standards district office or certificate holding district office, before operating any aircraft complying with this Emergency AD through an AMOC. (g) Additional Information (1) For further information contact: Blaine Williams, Aerospace Engineer, Boston Aircraft Certification Office, Engine & Propeller Directorate, 1200 District Avenue, Burlington, Massachusetts 01803; telephone (781) 238-7161; email blaine.williams@faa.gov. (2) For a copy of the service information referenced in this Emergency AD, contact: Sikorsky Aircraft Corporation, Customer Service Engineering, 124 Quarry Road, Trumbull, CT 06611; telephone 1-800-Winged-S or 203-416-4299; email: wcs_cust_service_eng.gr-sik@lmco.com.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix H 115 Appendix H (Cont) 4 (h) Subject Joint Aircraft Service Component (JASC) Code: 6720 Tail Rotor Control System. Issued in Fort Worth, Texas, on January 13, 2017. Lance T. Gant, Manager, Rotorcraft Directorate, Aircraft Certification Service.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 116 Appendix J Sikorsky ASB 92-64-012 dated 16 May 2017 ASB 92-64-012 Revision C – May 16, 2017 TRANSMITTAL Alert Service Bulletin (ASB) 92-64-012 dated March 9, 2017 has been revised. This page accompanies revision C, dated May 16, 2017. ASB 92-64-012C dated May 16, 2017 supersedes revision B of ASB 92-64-012, dated April 13, 2017. Text changes are indicated by a vertical line in the outer margin of the page. Illustration changes are indicated by a vertical line next to the figure title. INSTRUCTIONS TO OPERATORS: For operators that have complied with ASB 92-64-012 revision B, no further action is required. Operators that have not complied with ASB 92-64-012 revision B must comply with revision C in its entirety. HIGHLIGHTS OF THIS REVISION: COMPLIANCE Revised TRPCS part number. Added TRPCS that that were repaired. PUBLICATIONS AFFECTED Revised publications affected to none.

Page 1 of 1 WARNING ‒ This document contains technical data subject to the EAR. Authorization is required prior to providing this technical data to any company, entity, person, or destination. EAR Export Classification: ECCN 9E991

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 117 Appendix J (Cont)

Page 1 of 15 ATA 64-22-03 ONE-TIME INSTALLATION S-92® HELICOPTER ALERT SERVICE BULLETIN NOTICE TO ALL PERSONS RECEIVING THIS DOCUMENT: WARNING: THIS DOCUMENT, OR AN EMBODIMENT OF IT IN ANY MEDIA, DISCLOSES INFORMATION WHICH IS PROPRIETARY, IS THE PROPERTY OF LOCKHEED MARTIN CORPORATION AND/OR ITS SUBSIDIARIES, IS AN UNPUBLISHED WORK PROTECTED UNDER APPLICABLE COPYRIGHT LAWS, AND IS DELIVERED ON THE EXPRESS CONDITION THAT IT IS NOT TO BE USED, DISCLOSED, REPRODUCED, IN WHOLE OR IN PART (INCLUDING REPRODUCTION AS A DERIVATIVE WORK), OR USED FOR MANUFACTURE FOR ANYONE OTHER THAN LOCKHEED MARTIN CORPORATION AND/OR ITS SUBSIDIARIES WITHOUT ITS WRITTEN CONSENT, AND THAT NO RIGHT IS GRANTED TO DISCLOSE OR SO USE ANY INFORMATION CONTAINED HEREIN. ALL RIGHTS RESERVED. ANY ACT IN VIOLATION OF APPLICABLE LAW MAY RESULT IN CIVIL AND CRIMINAL PENALTIES. S-92® IS A REGISTERED TRADEMARK OF SIKORSKY AIRCRAFT CORPORATION. ASB 92-64-012 March 9/17 Revision C ▪ May 16/17 SUBJECT: TAIL ROTOR – Tail Rotor Pitch Change Shaft Bearing Assembly – Installation of Temperature Indicator Plug Section 1. PLANNING INFORMATION A. Effectivity S-92A model helicopters with serial numbers 920006 through 920302. B. Purpose To provide instructions to install temperature indicator plug. C. Background A temperature indicator plug was designed to be installed in the inner diameter of the Tail Rotor Pitch Change Shaft (TRPCS) bearing as a method to visually inspect for a bearing that is operating at higher temperature than normal. The intent of the temperature indicator plug is to help identify bearings that are degrading. D. Description TRPCS log card is reviewed. Helicopter is prepared for maintenance. Temperature Indicator Plug is installed. Helicopter is returned to service. E. Compliance Compliance is essential.  TRPCS (92358-06303-041, or -042) that were last overhauled, repaired, or fabricated new (not yet overhauled) prior to February 28, 2017, as noted on the component maintenance record, shall comply with this Alert Service Bulletin (ASB) no later than April 13, 2017. Sikorsky Aircraft Corporation 6900 Main Street P.O. Box 9729 Stratford, Connecticut 06615-9129 (203) 386-4000 WARNING ‒ This document contains technical data subject to the EAR. Authorization is required prior to providing this technical data to any company, entity, person, or destination. EAR Export Classification: ECCN 9E991

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 118 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 2 ATA 64-22-03 ONE-TIME INSTALLATION Section 1. PLANNING lNFORMATION (Continued)  TRPCS (92358-06303-041, or -042) that were last overhauled, repaired, or fabricated new (not yet overhauled) on or after February 28, 2017, as noted on the component maintenance record, with more than 100 flight hours (Time Since New (TSN)/Time Since Overhaul (TSO)/Time Since Repair (TSR) as applicable), shall comply with this ASB no later than April 13, 2017.  TRPCS (92358-06303-041, or -042) that were last overhauled, repaired, or fabricated new (not yet overhauled) on or after February 28, 2017, as noted on the component maintenance record, with less than 100 flight hours (TSN/TSO/TSR as applicable), shall install temperature indicator plug no later than 100 flight hours (TSN/TSO/TSR of the TRPCS (92358-06303-041, or -042), as applicable). F. Approval The design change specified by this document is FAA approved in accordance with the applicable requirements of United States Federal Aviation Regulations 14 CFR Part 29. FAA approval constitutes EASA and Transport Canada approval under the terms of current bilateral agreement procedures. G. Manpower (Estimated) Task No. of Men No. of Hours Man-Hours* Removal of Retaining Ring and Plug. 1 0.25 0.25 Installation of Temperature Indicator Plug 1 0.50 0.50 Inspection of Temperature Indicator Plug for Proper Seating 1 0.25 0.25 Re-Installation of Plug and Retaining Ring 1 0.25 0.25 Total Man-Hours

1. 25

*Estimate does not include time required to prepare helicopter or return it to flight status.

H. Tooling Qty Nomenclature Part No. Source 1 Tool Kit, Pitch Change Shaft 92700-10391-041 (1)

Made up of:

1 Installation Rod Assembly 92700-10391-042

1 Gage Mount Assembly 92700-10391-043

1 Handle 92700-10391-103

1 Dial Indicator 711FSZ

1 Dead Blow Hammer 57-530

1 Non-Bright, White, Flashlight Commercially available or equivalent (2) This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 119 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 3 ATA 64-22-03 ONE-TIME INSTALLATION Section 1. PLANNING lNFORMATION (Continued) Qty Nomenclature Part No. Source 1 Orfit Tool Kit WE301K (2)

(1) Tools are available at no cost during the compliance period of this ASB to predetermined locations to support the current fleet. Tools shall be available after the compliance period at standard Sikorsky Commercial Inc. (SCI) rates. For tools availability and lead time requirements contact your Customer Service Representative at SCI. Submit a no-cost purchase order referencing this ASB number and the helicopter serial number(s) on which these tools will be used. This will allow SCI and the operator to track shipment and receipt of tools. Orders will be accepted by letter, telephone, facsimile (FAX) or through the SCI website: www.HSIUS.com. For prompt shipment, reference address of each shipping destination. Direct your order to: Sikorsky Aircraft Corporation Commercial Systems and Services Mailstop K100 124 Quarry Road Trumbull, CT 06611 U.S.A. Attn: Account Service Manager FAX: (203) 416-4291, Telephone: (203) 416-4000 3TU3TU3TUhttps://customerportal.sikorsky.com U3T3T3 (2) Available through normal supply channels. I. Weight and Balance None. J. Electrical Load Data Not applicable. K. Software Load Data Not applicable. L. References (1) Temporary Revision 45-07 against Maintenance Manual, SA S92A-AMM-000, Task 45-45- 10-710-001. (2) Temporary Revision 45-08 against Maintenance Manual, SA S92A-AMM-000, Task 45-45- 11-710-001.

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 120 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 4 ATA 64-22-03 ONE-TIME INSTALLATION Section 1. PLANNING lNFORMATION (Continued) M. Publications Affected None. N. Attachment None. Section 2. MATERIAL INFORMATION A. Basis for Material Data Per helicopter. B. Bill of Material New Part No. Qty Nomenclature Old Part No. Instructions/ Disposition 92358-06134-041 1 TEMPERATURE INDICATOR PLUG

(1) AS3209-029 1 PACKING AS3209-029 (2)

(1) Parts are available at no cost during the compliance period of this ASB. Parts shall be available after the compliance period at standard Sikorsky Commercial Inc. (SCI) rates. For part availability and lead time requirements contact your Customer Service Representative at SCI. Submit a no-cost purchase order referencing this ASB number and the helicopter serial number(s) on which these parts will be used. This will allow SCI and the operator to track shipment and receipt of parts. Orders will be accepted by letter, telephone, facsimile (FAX) or through the SCI website: www.HSIUS.com. For prompt shipment, reference address of each shipping destination. Direct your order to: Sikorsky Aircraft Corporation Commercial Systems and Services Mailstop K100 124 Quarry Road Trumbull, CT 06611 U.S.A. Attn: Account Service Manager FAX: (203) 416-4291, Telephone: (203) 416-4000 3TU3TU3TUhttps://customerportal.sikorsky.com U3T3T3 (2) Available through normal supply channels.

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 121 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 5 ATA 64-22-03 ONE-TIME INSTALLATION Section 2. MATERIAL INFORMATION (Continued) C. Consumable Material

Qty Nomenclature Part No. Source A/R Corrosion Preventative Cor-Ban 27L or equivalent (1) A/R Lubricating Oil DOD-PRF-85734 or equivalent (1) A/R Lubricating Oil Ultrachem or equivalent (1) A/R Lubricating Oil Boelube® or equivalent (1)

(1) Available through normal supply channels. Section 3. ACCOMPLISHMENT INSTRUCTIONS A. Review TRPCS log card: (1) If bearing (SB2310) is in the Serial Number (S/N) 0087 to 0101 range, contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com. (2) If bearing (SB2310) is not in the S/N 0087 to 0101 range, proceed to next step. B. Prepare helicopter for maintenance:

(1) Turn off all helicopter electrical and hydraulic power. (2) Engage rotor brake. C. Remove plug to gain access to the interior of the TRPCS and bearing assembly as follows: (1) Remove retaining ring (M2742630142D) securing plug (92358-06610-101) in TRPCS. (Refer to Figures 1 and 2). OBSERVE ALL CAUTIONS AND WARNINGS ON CONTAINERS WHEN USING CONSUMABLES. WHEN APPLICABLE, WEAR NECESSARY PROTECTIVE GEAR DURING HANDLING AND USE. IF A CONSUMABLE IS FLAMMABLE OR EXPLOSIVE, MAKE CERTAIN CONSUMABLE AND ITS VAPORS ARE KEPT AWAY FROM HEAT, SPARK AND FLAME. MAKE CERTAIN FIREFIGHTING EQUIPMENT IS READILY AVAILABLE PRIOR TO USE. FOR ADDITIONAL INFORMATION ON TOXICITY, FLASHPOINT AND FLAMMABILITY OF CHEMICALS, CONSULT YOUR MEDICAL DEPARTMENT OR THE MANUFACTURER OF THE CONSUMABLE. TO PREVENT ELECTRICAL SHOCK OF PERSONNEL OR POSSIBLE DAMAGE TO HELICOPTER COMPONENTS, MAKE SURE TO TURN OFF ALL ELECTRICAL POWER. This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 122 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 6 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) (2) Remove plug (92358-06610-101) and packing (AS3209-029) from TRPCS. (3) Visually inspect packing (AS3209-029) for tears or excessive stretching and reuse if no tears or excessive stretching are present. D. Install temperature indicator plug (92358-06134-041) as follows: NOTE: The 180°F temperature dot is pre-tripped to provide a visual comparison of when a dot is tripped. (Refer to Figure 3 for an example). (1) Visually inspect temperature indicator plug (92358-06134-041) to verify that three (3) indicator dots are not tripped. If any of the three (3) temperature dots are found tripped, contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com. (2) Thread temperature indicator plug (92358-06134-041) onto installation rod assembly (92700-10391-042) until threads bottom on installation rod shoulder. (Refer to Figure 4). NOTE: Make sure no corrosion preventative compound (Cor-Ban 27L or equivalent) is applied to face of temperature indicator plug (92358-06134-041) with temperature dots. (3) Apply light coat of corrosion preventative compound (Cor-Ban 27L or equivalent) on temperature indicator plug (92358-06134-041). (Refer to Figure 5). (4) Apply light coat of lubricating oil (DOD-PRF-85734, Ultrachem, Boelube® or equivalent) on gage mount assembly (92700-10391-043) o-rings. (5) Gently position installation rod assembly (92700-10391-042), temperature indicator plug (92358-06134-041), and gage mount assembly (92700-10391-043) inside TRPCS. Firmly seat gage mount assembly against shaft end face. (Refer to Figure 6). (6) Using installation rod assembly (92700-10391-042), insert temperature indicator plug (92358-06134-041) into inner diameter of TRPCS bearing bore by hand, until resistance is felt. (7) Measure distance from end of installation rod assembly (92700-10391-042) to gage mount assembly (92700-10391-043) and record value as “Pre-Installation Measurement.” (Refer to Figure 7).

(8) Using provided dead blow hammer (57-530), gently tap installation rod assembly (92700- 10391-042) to drive temperature indicator plug (92358-06134-041) into bore of TRPCS bearing. (Refer to Figure 8).

TOO MUCH IMPACT COULD RESULT IN DAMAGE TO BEARING. This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 123 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 7 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

(9) Measure distance from end of installation rod assembly (92700-10391-042) to gage mount assembly (92700-10391-043) and record as “Post-Installation Measurement.” Subtract “Post-Installation Measurement” from “Pre-Installation Measurement.” (Refer to Figure 7). (a) If value is less than 0.180 inch, repeat step (8) until measurement is achieved. (b) If value is greater than or equal to 0.180 inch, proceed to next step. (10) Using handle (92700-10391-103), rotate installation rod assembly (92700-10391-042) counter-clockwise to unthread from temperature indicator plug (92358-06134-041). (Refer to Figure 9). (11) Remove installation rod assembly (92700-10391-042). (12) Remove gage mount assembly (92700-10391-043). (13) Using a non-bright, white, flashlight (commercially available or equivalent), inspect TRPCS for foreign object debris (FOD), and remove if found. (Refer to Figure 10). E. Re-install plug as follows (Refer to Figure 11): (1) If previously installed packing was found torn or excessively stretched, install new packing (AS3209-029) on plug (92358-06610-101) using Orfit tool kit (WE301K). (2) Install plug (92358-06610-101) and packing (AS3209-029) in TRPCS. (Refer to Figures 1 and 11). (3) Secure plug (92358-06610-101) in TRPCS with retaining ring (M2742630142D). F. Review and incorporate applicable changes to recurring review of tail gear box bearing energy HUMS tool into the helicopters maintenance plan. (Refer to Temporary Revision 45-07 against Maintenance Manual, SA S92A-AMM-000 Task 45-45-10-710-001 or Temporary Revision 45-08 against Maintenance Manual, SA S92-AMM-000, Task 45-45-11-710-001). G. Return helicopter to service. This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 124 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 8 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

TAIL ROTOR PITCH CHANGE SHAFT PLUG FIGURE 1 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 125 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 9 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

REMOVAL OF PLUG FIGURE 2

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 126 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 10 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

TEMPERATURE DOTS FIGURE 3

INSTALLATION ROD ASSEMBLY INSTALLED ON TEMPERATURE INDICATOR PLUG FIGURE 4 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 127 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 11 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

LOCATIONS TO APPLY CORROSION PREVENTATIVE FIGURE 5

INSTALLATION OF TEMPERATURE INDICATOR PLUG FIGURE 6 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 128 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 12 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

TEMPERATURE INDICATOR PLUG INSTALLATION MEASUREMENT FIGURE 7

TEMPERATURE INDICATOR PLUG SEATING FIGURE 8

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 129 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 13 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

UN-THREAD INSTALLATION ROD ASSEMBLY FIGURE 9

INSPECT PCS BORE FIGURE 10

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 130 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 14 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

INSTALLATION OF PLUG FIGURE 11

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 131 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 15 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) H. Record of compliance: (1) Make helicopter logbook entries to show compliance with this ASB as follows: (a) Make helicopter level logbook entry on form SA7343-15 (Aircraft ASB and CSN Release Signoff). (b) When ASB modifies a component that can be removed from this helicopter: 1. Make component log card entries on forms SA7343-22 (Aircraft Component Log Cards) and SA7343-21 (Component Log Cards), as applicable. 2. If a component modified by this ASB does not have a log card and the ASB does not create one, then annotate compliance on the next higher assembly that the component belongs to which does have a log card. NOTE: If access to www.Sikorsky360.com is unavailable, complete attached ALERT SERVICE BULLETIN COMPLIANCE RECORD CARD and return it to Sikorsky Aircraft Corporation. (2) Make an appropriate electronic compliance entry in the E-Notification section at www.Sikorsky360.com. Refer to User Guide located on the www.Sikorsky360.com/E- Notification Search page. This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 132 Appendix J (Cont) (Fold over and tape closed) SIKORSKY AIRCRAFT CORPORATION FACSIMILE NUMBER (817) 762-6715 EMAIL ADDRESS: product_safety.gr-sik@lmco.com ATTENTION: Gr-SIK, Product_Safety SIKORSKY AIRCRAFT CORPORATION (Fold Up to Arrows) IMPORTANT NOTICE Upon COMPLIANCE with the attached ASB, Sikorsky requests your cooperation in completing and returning this ENTIRE PAGE by MAIL, FAX, or scan & EMAIL. Please fill in the requested information at the bottom of the page, so we may maintain proper records documenting the configuration of your aircraft. This information is useful when determining configuration and effectivity of issues affecting fielded aircraft. This request is in keeping with our policy to assure that our customers receive the latest information applicable for the maintenance of your aircraft. Thank you. ALERT SERVICE BULLETIN:

Compliance Record Card TITLE: ___________________________________________________________________

OWNER/OPERATOR: _____________________________________________________ SUBMITTED BY:

DATE:

FOLLOWING SERIAL NUMBERS ARE NOT AFFECTED BY THIS ASB ASB HAS BEEN COMPLIED WITH ON HELICOPTER SERIAL NUMBERS:

No. 92-64-012C TAIL ROTOR – Tail Rotor Pitch Change Shaft Bearing Assembly – Installation of Temperature Indicator Plug This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 133 Appendix J (Cont) No Postage Necessary BUSINESS REPLY MAIL FIRST-CLASS MAIL PERMIT NO. 432 BRIDGEPORT CT POSTAGE WILL BE PAID BY ADDRESSEE SIKORSKY AIRCRAFT CORPORATION Commercial Systems and Services Mailstop K100 124 QUARRY ROAD TRUMBULL, CT 06611 U.S.A. ATTENTION: Gr-SIK, Product_Safety Please complete the form on the reverse side and FAX to FACSIMILE NUMBER (817) 762-6715 Or scan and email to: EMAIL ADDRESS: product_safety.gr-sik@lmco.com or fold and return ENTIRE form to Sikorsky Aircraft Corporation This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Intentionally left blank

Unless otherwise indicated, recommendations in this report are addressed to the appropriate regulatory authorities having responsibility for the matters with which the recommendation is concerned. It is for those authorities to decide what action is taken. In the United Kingdom the responsible authority is the Civil Aviation Authority, CAA House, 45-49 Kingsway, London WC2B 6TE or the European Aviation Safety Agency, Postfach 10 12 53, D-50452 Koeln, Germany.

AIRCRAFT ACCIDENT REPORT 1/2018 G-WNSR Aircraft Accident Report 1/2018 Report on the accident to Sikorsky S-92A, G-WNSR West Franklin wellhead platform, North Sea On 28 December 2016

FD06647 ｜ 2018_英国_aircraft-accident-report-aar-1-2018-g-wnsr-28-december-2016__AAR_1-2018_G-WNSR_Lo_Res.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

AIRCRAFT ACCIDENT REPORT 1/2018 Report on the accident to Sikorsky S-92A, G-WNSR West Franklin wellhead platform, North Sea on 28 December 2016 AAIB Air Accidents Investigation Branch

AIRCRAFT ACCIDENT REPORT 1/2018 Air Accidents Investigation Branch Report on the accident to Sikorsky S-92A, G-WNSR West Franklin wellhead platform, North Sea On 28 December 2016 This investigation has been conducted in accordance with Annex 13 to the ICAO Convention on International Civil Aviation, EU Regulation No 996/2010 and The Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 1996. The sole objective of the investigation of an accident or incident under these Regulations is the prevention of future accidents and incidents. It is not the purpose of such an investigation to apportion blame or liability. Accordingly, it is inappropriate that AAIB reports should be used to assign fault or blame or determine liability, since neither the investigation nor the reporting process has been undertaken for that purpose.

ii © Crown Copyright 2018 Printed in the United Kingdom for the Air Accidents Investigation Branch This report contains facts which have been determined up to the time of publication. This information is published to inform the aviation industry and the public of the general circumstances of accidents and serious incidents. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and it is not used in a derogatory manner or in a misleading context. Published 22 March 2018

iii © Crown Copyright 2018 Department for Transport Air Accidents Investigation Branch Farnborough House Berkshire Copse Road Aldershot Hampshire GU11 2HH March 2018 The Right Honourable Chris Grayling Secretary of State for Transport Dear Secretary of State I have the honour to submit the report on the circumstances of the accident to Sikorsky S-92A, registration G-WNSR at West Franklin wellhead platform, North Sea on 28 December 2016.

Yours sincerely Crispin Orr Chief Inspector of Air Accidents

Intentionally left blank

v Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Contents © Crown Copyright 2018 Contents Contents Introduction...................................................................................................................... 1 Summary........................................................................................................................... 2 Factual information.......................................................................................................... 5 1.1 History of the flight........................................................................................... 5 1.1.1 Background....................................................................................... 5 1.1.2 Pre-flight maintenance....................................................................... 5 1.1.3 Pre-flight planning.............................................................................. 7 1.1.4 First sector......................................................................................... 7 1.1.5 Accident sector.................................................................................. 7 1.1.6 Notification of the accident................................................................ 8 1.2 Injuries to persons........................................................................................... 9 1.3 Damage to helicopter...................................................................................... 9 1.4 Other damage.................................................................................................. 9 1.5 Personnel information.................................................................................... 10 1.5.1 Commander..................................................................................... 10 1.5.2 Co-pilot............................................................................................ 10 1.5.3 Flight crew interviews.......................................................................11 1.5.3.1 Commander...................................................................11 1.5.3.2 Co-pilot...........................................................................11 1.5.4 Licensed engineers......................................................................... 12 1.5.5 Passenger statements..................................................................... 12 1.6 Aircraft information.............................................................................................. 13 1.6.1 General............................................................................................ 13 1.6.2 Helicopter general description......................................................... 13 1.6.3 Helicopter structure......................................................................... 14 1.6.4 Landing gear.................................................................................... 14 1.6.5 Power plants and transmission........................................................ 14 1.6.6 Main rotor (MR) and tail rotor (TR) assemblies............................... 15 1.6.7 Flying controls................................................................................. 15 1.6.8 TR servo.......................................................................................... 16 1.6.9 Trim, Automatic Flight Control System (AFCS) and Stability

Augmentation System (SAS)........................................................... 18 1.6.10 Four-axis flying control interconnections......................................... 19 1.6.11 Maintenance history........................................................................ 19 1.6.11.1 TRPCS history.............................................................. 20 1.6.11.2 Oil sampling history....................................................... 20 1.6.12 Emergency procedures................................................................... 21

vi Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Contents © Crown Copyright 2018 Contents 1.7 Meteorological information............................................................................ 22 1.8 Aids to navigation.......................................................................................... 22 1.9 Communications............................................................................................ 22 1.10 Aerodrome information.................................................................................. 22 1.10.1 Elgin PUQ helideck.......................................................................... 23 1.10.2 West Franklin helideck..................................................................... 23 1.11 Recorded information.................................................................................... 24 1.11.1 Introduction...................................................................................... 24 1.11.2 Flight data........................................................................................ 24 1.11.2.1 Elgin PUQ yaw event and lift off.................................... 24 1.11.2.2 West Franklin landing.................................................... 26 1.11.3 Helicopter Vibration Health Monitoring............................................ 28 1.11.3.1 VHM regulatory requirements....................................... 28 1.11.3.2 VHM alert threshold philosophy.................................... 29 1.11.4 HUMS configuration on the S-92A................................................... 32 1.11.4.1 Mechanical diagnostics................................................. 33 1.11.4.2 Ground station software mechanical diagnostics.......... 33 1.11.4.3 TGB bearing energy analysis software......................... 34 1.11.5 Operator’s internal HUMS procedures............................................ 35 1.11.5.1 Operator’s HUMS download procedure........................ 35 1.11.5.2 G-WNSR HUMS download........................................... 36 1.11.5.3 Operator internal HUMS training................................... 41 1.11.5.4 Interrogating HUMS time-history strip charts................ 41 1.11.5.5 Sikorsky Ground-Based Application (SGBA)................ 42 1.12 Wreckage and impact information................................................................. 44 1.12.1 Helideck........................................................................................... 44 1.12.2 Initial helicopter examination on the helideck.................................. 45 1.12.3 Examination at maintenance base.................................................. 45 1.12.4 Examination by the manufacturer.................................................... 46 1.12.4.1 TRPCS bearing............................................................. 46 1.12.4.2 Tail rotor gearbox.......................................................... 46 1.12.4.3 TR servo........................................................................ 47 1.13 Medical and pathological information............................................................ 48 1.14 Fire ............................................................................................................... 48 1.15 Survival aspects............................................................................................ 48 1.16 Tests and research........................................................................................ 48 1.16.1 Engineering..................................................................................... 48 1.16.1.1 Immediate action........................................................... 48 1.16.1.2 Inspection feedback and subsequent actions............... 49 1.16.1.3 Results.......................................................................... 50

vii Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Contents © Crown Copyright 2018 Contents 1.16.2 Recorded data mining..................................................................... 51 1.16.2.1 HUMS............................................................................ 51 1.16.2.2 Operational indicators................................................... 51 1.17 Organisational and management information................................................ 52 1.18 Additional information.................................................................................... 52 1.18.1 AAIB Special Bulletin (SB)............................................................... 52 1.18.2 Previous similar events.................................................................... 52 1.18.3 Engineering shift patterns................................................................ 53 1.18.4 Significance of HUMS in previous accidents................................... 55 1.18.5 Royal Navy WS-61 Sea King HUMS............................................... 55 1.19 Useful or effective investigation techniques.................................................. 56 2 Analysis................................................................................................................. 57 2.1 Introduction.................................................................................................... 57 2.2 Operational aspects....................................................................................... 59 2.2.1 Conduct of the flight......................................................................... 59 2.2.2 RFM and Emergency Checklist procedures.................................... 60 2.2.3 Plan continuation bias..................................................................... 60 2.3 Engineering analysis..................................................................................... 61 2.3.1 Cause of the uncommanded yaw on the Elgin PUQ....................... 62 2.3.2 Potential bearing lubrication problems............................................ 63 2.3.3 Bearing loading and environment.................................................... 64 2.3.4 Servo damage................................................................................. 64 2.3.5 Returned TRPCS assemblies.......................................................... 65 2.3.6 Summary of engineering analysis................................................... 66 2.3.7 Additional safety actions.................................................................. 66 2.3.8 Helideck resilience........................................................................... 66 2.4 HUMS data analysis on the S-92.................................................................. 67 2.4.1 Human machine interface................................................................ 67 2.4.2 SGBA GS software.......................................................................... 69 2.5 Licensed engineer human performance........................................................ 69 2.5.1 Introduction...................................................................................... 69 2.5.2 Environment.................................................................................... 69 2.5.3 Prospective memory........................................................................ 70 2.5.3.1 Causes of prospective memory failure in the engineer... 70 2.5.4 Mutual reinforcement....................................................................... 71 2.6 Timeliness of VHM data................................................................................. 72 2.6.1 Maximum interval between downloads............................................ 72 2.6.2 Timeliness of VHM alerts................................................................. 72 2.6.3 Acquisition of VHM data.................................................................. 73

viii Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Contents © Crown Copyright 2018 Contents 2.6.4 Download and analysis of VHM data............................................... 74 2.6.5 Promulgating VHM data.................................................................. 74 2.7 Strengthening the safety barriers.................................................................. 75 3 Conclusions.......................................................................................................... 77 3.1 Findings......................................................................................................... 77 3.2 Causal factors................................................................................................ 79 3.3 Contributory factors....................................................................................... 79 4 Safety Recommendations.................................................................................... 81 4.1 Safety Recommendations............................................................................. 81 4.2 Summary of safety actions............................................................................ 81 Appendices Appendix A – Tail rotor malfunctions and associated emergency procedures applicable at the time of the event Appendix B – Elgin Helideck Landing Area Certificate, Helideck Information Plate and Temporary Limitations Notice 15-2016 Appendix C – West Franklin Helideck Landing Area Certificate and Helideck Information Plate Appendix D – Sikorsky Temporary Revision 45-03 Appendix E – Sikorsky All Operators Letter CCS-ALL-AOL-17-0008 dated 24 March 2017 Appendix F – Sikorsky All Operators Letter CCS-92-AOL-16-0019 dated 31 December 2016 Appendix G – Sikorsky ASB 92-64-011 dated 10 January 2017 Appendix H – FAA Airworthiness Directive AD 2017-02-51 dated 13 January 2017 Appendix J – Sikorsky ASB 92-64-012 dated 16 May 2017

ix Glossary of Abbreviations Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Glossary of abbreviations GLOSSARY OF ABBREVIATIONS USED IN THIS REPORT AAD Advanced Anomaly Detection AAIB Air Accidents Investigation Branch AD Airworthiness Directive AFCS Automatic Flight Control System AMC Acceptable Means of Compliance AMM Aircraft Maintenance Manual ANO Air Navigation Order APU Auxiliary power unit ASB Alert Service Bulletin ºC, F Celsius, Fahrenheit º/s degrees per second CAA Civil Aviation Authority CCU Cockpit Control Unit CI Condition Indicator CSI Controlled Service Introduction CVFDR Cockpit voice and flight data recorder EASA European Aviation Safety Agency FAA Federal Aviation Administration ft feet GS Ground Station HDA Helideck Assistant HDWG Heliport Design Working Group HHMAG Helicopter Health Monitoring Advisory Group HLO Helicopter Landing Officer HMI Human Machine Interface hPa hectopascal hrs hours (clock time as in 1200 hrs) HUMS Health and Usage Monitoring System ICAO International Civil Aviation Organization IFR Instrument flight rules IMD Integrated mechanical diagnosis KIAS knots indicated airspeed kg kilogram(s) kHz kilohertz kt knot(s) lb pound(s) m metre(s) MB Megabyte MGB Main gearbox min minute(s) mm millimetres MOB Main operating base MOR Mandatory Occurrence Report MPFR Multi-Purpose Flight Recorder MR Main rotor nm nautical mile(s) NTSB National Transportation Safety Board OBS On-Board System OEM Original equipment manufacturer ppm parts per million PTFE Polytetrafluoroethylene PUQ Process Utilities Quarters RFM Rotorcraft Flight Manual RT Radiotelephony RVHMWG Rotorcraft VHM Working Group SAS Stability Augmentation System SB Special Bulletin SGBA Sikorsky Ground-Based Application SOAP Spectrometric Oil Analysis Programme TAN Total acid number TBO Time Between Overhaul TCH Type Certificate Holders TGB Tail rotor gearbox TR Tail rotor TRPCS Tail rotor pitch change shaft TSN Time Since New VFR Visual Flight Rules VHF Very High Frequency VHM Vibration Health Monitoring

Intentionally left blank

1 Introduction and Summary Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Introduction and Summary Air Accidents Investigation Branch Aircraft Accident Report No: 1/2018 Registered Owner and Operator: CHC Scotia Ltd Aircraft Type: Sikorsky S-92A Nationality: British Registration: G-WNSR Location of accident: West Franklin wellhead platform, North Sea Latitude: N 56° 57’ 47” Longitude: E 001° 48’ 22” Date & Time: 28 December 2016 at 0844 hrs (All times in this report are UTC) Introduction The Air Accidents Investigation Branch (AAIB) became aware of the accident during the morning of 5 January 2017. In exercise of his powers, the Chief Inspector of Air Accidents ordered an investigation into the accident to be carried out in accordance with the provisions of Regulation EU 996/2010 and the UK Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 1996. In accordance with established international arrangements, the National Transportation Safety Board (NTSB) of the USA, representing the State of Design and Manufacture of the helicopter, appointed an Accredited Representative to participate in the investigation, supported by advisers from the helicopter manufacturer and the Federal Aviation Administration (FAA). The helicopter operator, the European Aviation Safety Agency (EASA) and the UK Civil Aviation Authority (CAA) also assisted the AAIB. The sole objective of the investigation of an accident or incident under these Regulations is the prevention of accidents and incidents. It shall not be the purpose of such an investigation to apportion blame or liability.

2 Introduction and Summary Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Introduction and Summary Summary The helicopter was being operated from Aberdeen on a contract on behalf of an offshore oil and gas company. On 27 December 2016, during a flight on the day prior to the accident, the Health and Usage Monitoring System (HUMS) recorded vibration data which contained a series of exceedences related to the tail rotor pitch change shaft (TRPCS) bearing. Routine maintenance was carried out overnight which included a download and preliminary analysis of the HUMS data. Whilst an anomaly for tail rotor gearbox (TGB) bearing energy was detected by the maintenance engineer, the exceedences were not identified, in part, due to the way they were presented in the analysis tool; the helicopter was released to service without further investigation. On 28 December 2016, during the first sector of the day, the HUMS recorded further exceedences but these were not scheduled to be downloaded and reviewed until the helicopter returned to Aberdeen; there was no method in place for either the flight crew or maintenance personnel to be made aware of these further exceedences until then. During lift off on the second sector, the helicopter suffered an uncommanded right yaw through 45° and the flight crew re-landed. The helicopter was again lifted into the hover and responded normally to the controls, so the event was attributed to a wind effect and the helicopter departed en route. The five-minute flight to the West Franklin wellhead platform was uneventful but, in the latter stages of landing, yaw control was lost completely and the helicopter yawed to the right. The crew landed the helicopter expeditiously, but heavily, on the helideck. The helicopter continued to rotate to the right and the crew closed the throttles before it came to rest near the edge of the helideck having turned through approximately 180°. There were no injuries. The investigation determined that the TRPCS bearing had degraded and failed. As a consequence, the tail rotor pitch change servo was damaged resulting in uncommanded and uncontrolled inputs being made to the tail rotor (TR). The manner in which the servo was damaged had not been previously identified. The investigation identified the following causal factors to the loss of yaw control: ● The TRPCS bearing failed for an undetermined reason. ● The TRPCS bearing failure precipitated damage to the tail rotor pitch control servo.

3 Introduction and Summary Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Introduction and Summary The investigation identified the following contributory factors: ● Impending failure of the TRPCS bearing was detected by HUMS but was not identified during routine maintenance due to human performance limitations and the design of the HUMS Ground Station (GS) Human Machine Interface (HMI). ● The HUMS GS software in use at the time had a previously-unidentified and undocumented anomaly in the way that data could be viewed by maintenance personnel. The method for viewing data recommended in the manufacturer’s user guide was not always used by maintenance personnel. Despite being unable to determine the exact cause of the bearing failure, the helicopter manufacturer has identified and introduced a number of changes intended to reduce the risk of a recurrence including: introducing HUMS software with enhanced diagnostic capabilities and improved user interfaces, tighter control of bearing manufacturing and assembly tolerances, consistency in lubricating grease quality and its application, and in‑service temperature monitoring. In this report, the AAIB makes two Safety Recommendations concerning the timeliness of acquiring, accessing, analysing and promulgating Vibration Health Monitoring (VHM) data, to enhance the usefulness of VHM data for the timely detection of an impending failure.

Intentionally left blank

5 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information Factual information 1.1 History of the flight 1.1.1 Background The helicopter was being operated on a contract on behalf of an offshore oil and gas company. Regular flights are scheduled for personnel working in the offshore oil and gas industry to and from the offshore installations. Helicopters depart from Aberdeen and typically fly over water to an installation’s helideck. For any given flight1, multiple sectors may be flown between the offshore installations before the helicopter returns to Aberdeen; turnarounds on the helidecks are normally performed with the rotors running. A helicopter may carry out several such flights in a day, and accumulate total daily flight times in excess of ten hours. The flight, AZ21N, was from Aberdeen to the Elgin-Franklin Offshore Field in the North Sea. The first sector was planned to take passengers to the Elgin Process Utilities Quarters (PUQ). The second sector was transferring personnel to the West Franklin wellhead platform, an unmanned installation, for a temporary stay. The helicopter was then due to return to the Elgin PUQ without passengers, before embarking further passengers for a return sector to Aberdeen. 1.1.2 Pre-flight maintenance The helicopter was in a hangar during the night of 27-28 December 2016 for a scheduled maintenance programme which included a download of the HUMS data from the previous flights. On the evening of 27 December 2016, G-WNSR was placed in the charge of a licensed engineer, hereinafter referred to as Engineer A. Prior to working on G-WNSR, Engineer A carried out a daily maintenance check on another helicopter which was already in the hangar. He carried out this work package between 1530 hrs and 1700 hrs. Then, at approximately 1700 hrs, he received a call from Police Scotland regarding an attempted break-in to his garage near his residence in Aberdeen. He was given permission to leave work and meet the police officer on the case at his home address. During this meeting, the police reported that Engineer A appeared upset and showed signs of distress. On return to work one hour later, he said nothing in particular about the incident and his colleagues assumed the matter had been closed. The shift supervisor then allocated Engineer A to G-WNSR to carry out post‑flight maintenance, a 50-hourly check and a HUMS download and review. He was 1 In this report the term ‘a flight’ is used for a series of sectors between start up and shutdown.

6 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information provided with another type rated engineer to assist him with the hangar work. Engineer A’s normal routine was to carry out the HUMS download and review the HUMS data first, complete the required scheduled maintenance and then physically check that any safety critical parts of the servicing work had been carried out. Only then would he complete the electronic documentation and paperwork to release the helicopter back to service. He did this in case the HUMS data review influenced any other work required on the helicopter. Engineer A extracted the HUMS PCMCIA data card (Data Card) from the helicopter and uploaded the card’s data on to the helicopter’s HUMS Ground Station (GS) situated in an office next to the shift control room. His assistant started the various other tasks on the helicopter and was not involved in the HUMS data analysis. Engineer A completed the analysis using the main diagnostics software tool and found no abnormalities. He then completed the additional diagnostic tools on the HUMS GS designed to detect abnormalities for particular components or sub-systems of the drive train. One of these was for the tail rotor gearbox (TGB) bearing energy, the graph of which did not appear normal to him in that the red horizontal line, indicating the threshold for an alert to be generated, was low down on the y-axis (Figure 9). He had never seen an exceedence before and so was used to the line being near the top with the HUMS data points below, but he was aware, from his HUMS training, that the tools automatically rescaled the axes to display all of the available data. After a short while attempting to understand why this line was in an unusual position, he brought this to the attention of a colleague, another licensed engineer (Engineer B), who was working on another HUMS GS nearby. Thinking it was probably indicating an exceedence they attempted to zoom in on the graph to identify the magnitude of the exceedence; however, after multiple attempts they could not get the zoom function to work, making them think that the scaling could also be due to a ‘software glitch’. Engineer B returned to his own task and thought no more about it. However, Engineer A was uncomfortable with the abnormality and made a mental note to draw it to the attention of his supervisor later, prior to completing the electronic documentation and release to service. He then completed the scheduled maintenance and physical check of the servicing work on G-WNSR by which time most of that evening’s work on the other helicopters was also nearing completion. At about 2345 hrs, he returned to the G-WNSR HUMS GS and completed the electronic documentation and paperwork before releasing G-WNSR back to service. He had, however, forgotten to inform his supervisor of the abnormality with the red line on HUMS related to TGB bearing energy. At about 0100 hrs on 28 December he went off shift and went home.

7 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.1.3 Pre-flight planning The accident occurred on the second sector of the four-sector flight from Aberdeen to the Elgin-Franklin Offshore Field in the North Sea (Figure 1). The weather conditions were suitable for the flight and the pre-flight planning carried out at Aberdeen was routine. The flight crew reported at 0600 hrs; the helicopter commander was designated as the handling pilot for the first two sectors. 1.1.4 First sector The first sector from Aberdeen to the Elgin PUQ was uneventful. The reported wind at the Elgin helideck prior to the approach was from 220° at 20 kt. The approach was made from the east on a track of 270°, passing close to a jack‑up rig positioned temporarily to the east of the Elgin helideck. The helicopter landed on a heading of 270°. The passengers disembarked and sufficient fuel was uplifted for the remaining sectors including the return to Aberdeen. Aberdeen West Franklin x Elgin PUQ x x Figure 1 Flight track from Aberdeen to the Elgin PUQ and West Franklin platform 1.1.5 Accident sector The helicopter, with nine passengers on-board, started to lift off from the Elgin PUQ helideck on a heading of 270°. As it lifted, it yawed unexpectedly to the right through 45°. The commander applied full left yaw pedal, checked the rotation and landed back onto the deck. He told the co-pilot that he used full left pedal but was turning right and both commented that “it shouldn’t do that.” The commander lifted off again to check for the correct response to the flight controls; after lift off he applied additional left yaw pedal and the helicopter responded and turned to the left; all control responses appeared normal.  The crew briefly discussed what happened and commented on the

8 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information wind direction; the commander described the event as “very strange” and “very very strange” and the co-pilot concurred. They continued the departure and climbed to 500 ft on course towards the West Franklin wellhead platform, 3.3 nm to the south. The Helicopter Landing Officer (HLO) and two Helideck Assistants (HDA) on the Elgin helideck observed the lift off, yaw and subsequent touchdown. They watched as the helicopter lifted off again and turned left, commenting that it had appeared to drift backwards with the tail coming close to the handrail on the northern edge of the helideck, before it climbed and flew away to the south. En route the crew further discussed the event, the commander saying: “i thought there was something wrong with the tail rotor there.” The co-pilot confirmed with the commander that full left pedal had been used and commented “well it’s a bit strange because with anything the nose should have come left……we’ve got the wind off to the left”. There was no time for further discussion and the co-pilot contacted the Elgin radio operator and checked the West Franklin helideck status; the HLO confirmed the helideck was available. The helicopter made a normal approach and deceleration to the West Franklin and crossed over the edge of the helideck. At approximately 4 ft above the helideck, it yawed rapidly to the right, reaching a maximum rate of 30° per second. At the same time it rolled 20° to the left, at which point the left main landing gear contacted the helideck. It continued to yaw to the right on its left mainwheels and nosewheels before the right mainwheels contacted the surface. The co-pilot closed the throttles before the helicopter came to rest on a heading of 041°, having rotated through 187°. The crew shut down and secured the helicopter. After the helicopter was made secure, the co-pilot responded to a transmission from the Elgin radio operator and confirmed that everyone on-board was okay, but that there was a TR malfunction and the helicopter was unserviceable. The crew and passengers then disembarked; there were no injuries. 1.1.6 Notification of the accident Regulation (EU) No 996/2010 of The European Parliament and of The Council of 20 October 2010 on the Investigation and Prevention of Accidents and Incidents in Civil Aviation, Article 9, provides an obligation to notify accidents and serious incidents:

9 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information ‘Any person involved who has knowledge of the occurrence of an accident or serious incident shall notify without delay the competent safety investigation authority of the State of Occurrence thereof.’2 The accident occurred on 28 December 2016; the helicopter operator raised a Mandatory Occurrence Report (MOR) and transmitted it to the UK CAA the same day. The AAIB became aware of media reports about the event during the morning of 5 January 2017. A copy of the MOR was requested from the CAA and, when it had been reviewed, a Field Investigation was initiated. The helideck operator, although aware of the event, was not at the time aware that they also held a responsibility for reporting the accident to the AAIB. A notification process was not included in their procedures. Since the accident, the ‘Helicopter Occurrence - Communication Process’ procedures for their UK operations have been revised to include a requirement to report an accident or serious incident to the AAIB. 1.2 Injuries to persons Injuries Crew Passengers Other Fatal 0 0 0 Serious 0 0 0 Minor/None 2 9 0 1.3 Damage to helicopter The helicopter sustained minor visible damage which consisted of a small dent, approximately 80 mm long, to the left side outer mainwheel outer rim; the main landing gear was undamaged. Despite the dent, the left side outer mainwheel tyre remained inflated. There was no other visible evidence of external damage to the helicopter. However, later examination revealed damage to the TR pitch control servo (TR servo) and TRPCS bearing. 1.4 Other damage The helideck surface sustained minor damage to its surface consisting of tyre scuff marks and a small dent within which the aluminium surface had split (Figure 18). 2 The competent safety investigation authority for the United Kingdom is the AAIB.

10 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.5 Personnel information 1.5.1 Commander Age: 58 years Licence: Airline Transport Pilot’s Licence (H) Aircraft Rating: AS332/EC225/SK92 Licence Proficiency Check: Valid to 31 August 2017 Medical Certificate: Valid to 13 January 2018 Flying Experience: Total all types - 8,785 hours

On type - 243 hours

Last 90 days - 169 hours

Last 28 days - 54 hours

Last 24 hours - 3 hours

Previous rest period 18 hours 40 mins The commander had been employed by the operator for 11 years. He flew the AS332 and the EC 225 helicopters on North Sea operations until August 2016 when he completed a type conversion to the S-92A helicopter. He had flown to the Elgin PUQ and the West Franklin on other occasions. 1.5.2 Co-pilot Age: 37 years Licence: Airline Transport Pilot’s Licence (H) Aircraft Rating: EC135/SK92 Licence Proficiency Check: Valid to 30 June 2017 Medical Certificate: Valid to 24 May 2017 Flying Experience: Total all types - 4,490 hours

On type - 1,400 hours

Last 90 days - 134 hours

Last 28 days - 47 hours

Last 24 hours - 5 hours

Previous rest period 17 hours 05 mins The co-pilot joined the operator in May 2014 and completed conversion training to the S-92A in June 2014. He had flown to the Elgin PUQ and the West Franklin on other occasions.

11 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.5.3 Flight crew interviews 1.5.3.1 Commander The commander reported that, on departure from the Elgin helideck, he had lifted out of wind (crosswind from the left) into the hover. He commented that a wind from the left is less favourable for the S-92A and that, on lift off, the helicopter felt as though it was being buffeted, which he attributed as due possibly to the effect of being near the edge of the helideck. He felt the helicopter turning to the right, used full left pedal to correct it and then landed back on the helideck. He reported that he had discussed with the co-pilot what happened and put it down to an effect of the buffeting wind. He lifted the helicopter back into the hover and turned to the left to face into wind; it all felt normal. He then positioned forward to the edge of the deck and departed towards the West Franklin. On approach, as the helicopter crossed over the edge of the West Franklin helideck from the north, he needed to use an increasing amount of left pedal. Then suddenly the helicopter yawed right and, even with full left pedal, he could not stop it so he ‘dived’ onto the helideck. He commented that it had felt uncontrollable immediately, and was unlike the earlier yaw event on the Elgin when he had felt he was able to maintain control. 1.5.3.2 Co-pilot The co-pilot noted that the approach to the Elgin PUQ helideck could be tricky due to the other installations nearby, together with the position of the helideck and superstructure. He commented that the wind could roll up onto the helideck and may also come round from behind. He reported that the approach from the east and the landing were both normal. The yaw on lift off from the Elgin he perceived as being through about 20°, and which he thought may have been as a result of a misjudgement of the wind conditions. He reported that the approach to the West Franklin had appeared normal until the helicopter yawed to the right and the commander made an exclamation and put the helicopter down. The rotation to the right continued after touchdown and he was concerned that the helicopter might fall off the helideck; he was on the outside of the turn and unable to see the edge. Therefore, he delayed closing the throttles until after he was sure they were safely on the deck. After a short delay to regain his composure, he responded to a call from the Elgin radio operator.

12 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.5.4 Licensed engineers Engineer A held a valid Part 66, A and B1 licence with an S-92 type rating and authorisation certificate issued by the operator. He joined the operator in January 2015 as a helicopter maintenance engineer with previous single and multi-engine gas turbine helicopter experience. After joining, he underwent the operator’s multi-point competency check which he completed and was signed off in July 2015. During his initial training, he carried out a Human Factors Refresher Course and in September 2015, he successfully completed the S-92 Integrated Mechanical Diagnostics Health and Usage Monitoring System (IMD‑HUMS) course. Following the accident, at about 1500 hrs on 28 December 2016, Engineer A was contacted by the operator’s managerial staff and informed that G-WNSR had suffered a serious TR problem in-flight, as it was about to land, and was now unserviceable on a gas platform. He was asked to come in to work as soon as possible to discuss the matter. This he did and whilst on the journey to work, he realised what the problem might be and its relationship to the abnormality with the energy tool he had seen the night before. He arrived at work upset and distressed, realising his mistake, recalling that he had completely forgotten to inform his supervisor of the HUMS graph anomaly the night before as he had intended. He immediately informed the managerial staff what had happened but could offer no explanation as to why the matter had ‘slipped his mind’. Engineer B also held a Part 66, A and B1 licence with an S-92 type rating. 1.5.5 Passenger statements The nine passengers provided statements concerning their recollection of events during the flight. Eight passengers commented on the first attempt at takeoff from the Elgin, describing variously a “snatch”, “veer”, “tilt”, “swing”, “cant”, and “loss of control” before re-landing. With the exception of a passenger who occupied the rear seat in the cabin, the passengers described the subsequent lift off and flight as normal until just before landing on the West Franklin when they noticed “rocking”, a “loss of control” and a “hard” landing. The passenger at the rear of the cabin had heard and felt a ‘”knock” from somewhere behind him when the helicopter was in the hover after the second lift off from the Elgin and on several occasions during the sector to the West Franklin.

13 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.6 Aircraft information 1.6.1 General Manufacturer: Sikorsky Type: S-92A Aircraft Serial No: 920250 Year of manufacture: 2014 Number and type of engines: 2 General Electric Co CT7-8A turboshaft engines Total airframe hours: 1,776 hours Total airframe landings: 2,012 landings Airworthiness Review Certificate: Valid to 27 April 2017 1.6.2 Helicopter general description The Sikorsky S-92A is a twin-engine multi-mission large utility helicopter of metal and composite construction. The helicopter’s maximum certified weight is 12,020 kg. It is designed to carry up to 19 passengers and is certified for dual‑pilot VFR and IFR, day and night operations. As well as passenger transport, the S-92A is designed to carry out cargo, external lift, medevac and search and rescue operations. At the time of the accident G-WNSR (Figure 2) was configured for 19 passengers. Figure 2 G-WNSR (photograph courtesy of CHC Scotia Ltd)

14 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.6.3 Helicopter structure The fuselage is aluminium monocoque construction strengthened by stringers and longerons. The upper areas of the helicopter, cowlings, fairings and cockpit nose structure are of lightweight composite construction. 1.6.4 Landing gear The helicopter is fitted with retractable landing gear consisting of double-wheel air/oil shock absorbers. The main landing gear is installed in the sponsons each side of the fuselage just aft of the cabin area, and the castering nosewheel within a wheel bay beneath the cockpit. The main landing gear struts are fitted with a frangible panel at the top of the outer cylinder. If the vertical landing loads exceed the shock absorbing capability of the air/oil component within the strut, the inner cylinder is designed to rupture the frangible panel, absorbing additional energy in the process. The landing gear is fitted with forged aluminium alloy split-rim wheels with pneumatic tubeless tyres. The main and nose landing gears are aluminium cross-shaped forgings with their pivot points located at the ends of the arms of the cross-piece. The cross‑pieces are reinforced by bracing struts extending at a 45° angle from the top of the strut down to the end of the cross-piece at the pivot point. The cross‑pieces’ length is quite large in proportion to the length of the main gear struts to give the pivot points at the end of the cross-pieces a mechanical advantage when absorbing lateral landing loads. The landing gear is extended and retracted by hydraulic actuators powered from the utility hydraulic system. The actuators also have a nitrogen charge emergency blow-down system built in. The nosewheel is non-steerable but its design allows for a 360° caster and has a damper fitted to prevent nosewheel shimmy during taxiing. Differential braking and TR thrust are used to steer the helicopter during taxiing. The lower castering section of the nose landing gear is fitted with tow bar linkages for ground handling. 1.6.5 Power plants and transmission The helicopter is powered by two General Electric Co CT7-8A turboshaft engines delivering 2,520 HP connected to the main rotor gearbox (MGB) via two input modules which contain the primary reduction gearboxes and freewheel units. The TR drive shaft is in four sections supported by hanger bearings and flexible couplings. An intermediate gearbox is connected between the third and fourth section of the shaft. It reduces the shaft rpm and changes the plane of

15 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information rotation. The fourth section of the shaft drives the TGB located at the top of the TR pylon. Shaft rpm is further reduced by the TGB which is canted at 20° and produces a small percentage of the lift component. The TGB contains its own lubricating oil and is splash-lubricated by rotation of its internal components. The TRPCS bearing is lubricated on assembly by grease held in place and separated from the gearbox oil by polytetrafluoroethylene (PTFE) seals which are held in place by snap rings. The TGB oil has a 625‑hour life which can be extended by 100% providing a Spectrometric Oil Analysis Programme (SOAP) sampling process is in place. The TRPCS has a 1,250‑hour life at which point it is removed and returned to the original equipment manufacturer (OEM) for rework. 1.6.6 Main rotor (MR) and tail rotor (TR) assemblies The MR system consists of four blades attached to a fully articulated MR hub. The rotor head assembly consists of a titanium hub which incorporates blade dampers, blade retention yokes, elastomeric bearings, droop stops and flap restrainers. The rotor head is also fitted with a vibration absorber which works in conjunction with an active vibration cancellation system. The MR blades are of a composite construction around a graphite and fibreglass structural spar. A Nomex honeycomb core is wrapped in a fibreglass skin. Mesh lightning protection is built-in and the leading edges are protected by titanium and nickel anti-abrasion strips. The TR hub consists of a titanium head fitted with four TR blades of graphite and fibreglass construction. The blade assembly includes an inboard torque tube section, an outboard aerofoil section and pitch horn. The head is fitted with a four-arm pitch change beam connected to the TRPCS that imparts pitch changes into the blades via links to the pitch horns of each blade. The hub and blades are a bearing-less fully rigid system with pitch change of the blade being accomplished by the twisting of a specially-designed graphite flexbeam within the blade enclosed within a torque tube and cuff. The flexbeam also reacts flapping and dragging loads and is supported within the torque tube and cuff by elastomeric bearings. The torque tube carries the twisting loads into the blade from the pitch horn. 1.6.7 Flying controls The cyclic and collective flying control systems consist of a series of rods, levers and bellcranks which transmit pilot and co-pilot inputs into a mixing unit. Outputs from the mixing unit are transmitted to the MR and TR hydraulic servos via rods and cables. The MR forward, left and right servos consist of tandem

16 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information independent hydraulic actuators powered by the No 1 and No 2 hydraulic systems, and are mounted on the MGB and connected to the swashplate. The swashplate fixed and rotating star assembly transmits inputs into the MR blade pitch change rods. Yaw outputs from the mixing unit are transmitted via cables along the top of the tail cone and into the TR pylon to the TR servo attached to the back of the TGB. The linear non-rotating inputs from the servo are transferred into the rotating TRPCS bearing assembly and from there out to the TR pitch change beam. The yaw cable system inputs are translated into a push-pull to the valves on the TR servo by a TR quadrant. A system of opposing springs is built into the quadrant which allow a continuous and normal response to yaw pedal inputs in the event of one of the cables breaking. In the unlikely event of both cables failing, the helicopter will not respond to yaw inputs, but a spring built into the TR servo will set a TR thrust condition which will allow trimmed flight between 30 to 150 KIAS depending on atmospheric conditions and gross weight. 1.6.8 TR servo The TR servo is attached to the TGB and imparts linear inputs into the rotating TR four-arm pitch change beam via the TRPCS (Figure 3) within the bore of the TR crown wheel shaft. Figure 3 TRPCS The non-rotating servo output rod is connected to the rotating portion of the TRPCS by a double row self-aligning barrel bearing. Each race of the bearing consists of a set of barrel-shaped rollers running on inner and outer races inclined outwards from each other. This allows push and pull loads to be imparted into the TRPCS. The outer races are mounted in a phosphor bronze carrier which engages in grooves cut into the crown wheel shaft to ensure that Servo connection eye end (Transit protective cover fitted) Bronze guide bushing (engages with slots in the TR shaft) Outer end, TR pitch-change beam engagement splines

17 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information the pitch change beam rotates with the TR crown wheel shaft and stays in alignment with its corresponding blade. The dynamic interaction between the inner and outer races and the rollers and their cages is complex. Ideally, the path the rollers follow in the races and the alignment of each roller should be geometrically perfect. However, in practice the rollers are allowed, by virtue of including some end float, to move axially and laterally within their cage and follow slightly differing paths in their races. The barrel-shaped curved surface of the roller creates differing diameters from the middle of the roller outwards towards each end. The inner and outer race surfaces are curved to match the shape of the roller which naturally causes it to follow its track. Despite this, if a roller runs slightly out of track or oscillates, micro-skidding can occur as the varying diameters present differing circumferential speeds between the roller and its race. In the worst case, constant skidding can lead to sustained heating in the roller or race, lubricant damage and eventual bearing degradation. The TRPCS bearing location within a TGB cross-section is shown in green in Figure 4. Figure 4 TGB cross-section Helicopter left turn is pulling direction

18 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information The TR servo consists of two pistons on the same shaft, each piston being powered independently by the No 1 and No 2 hydraulic systems. Inputs from the yaw control system act on a ‘walking beam’ which is mounted on a pivot on the outer end of the servo piston shaft. The walking beam is y-shaped and connected to two servo valves, one for each hydraulic system, which are operated simultaneously on movement of the walking beam. Yaw inputs cause the walking beam to pivot and, in turn, this movement opens the servo valves to allow hydraulic pressure to the servo pistons. The servo moves inwards or outwards, depending on the yaw direction required, and carries with it the walking beam pivot. On cessation of the input from the yaw system the pivot location effectively transfers to the control rod connection, leaving the piston shaft to continue to move until the servo valves are recentralised by the walking beam. Figure 5 shows the TR servo and walking beam assembly. The range of movement of the servo is approximately 3.5 inches (89 mm). The servo piston assembly is prevented from rotating by means of a tab which engages with an anti-rotation slot on the outer casing of the servo. Clevis connection to TRPCS No1 and No2 control valve levers Walking beam Yaw input TRG attachment flange Centering mechanism Feedback pivot Anti rotation slot Figure 5 TR servo walking beam and valve linkages 1.6.9 Trim, Automatic Flight Control System (AFCS) and Stability Augmentation System (SAS) The helicopter is equipped with a four-axis trim system to improve the in-flight handling qualities and allow for hands-off flying. Electromechanical trim motors are fitted to the yaw, pitch, roll and collective flying control runs above the cockpit and have full-range authority to move the control rods. During operation they are part of the outer loop control system so the pilot’s flight controls move in harmony with trim inputs. In addition, SAS servos are fitted to the control runs between the trim motors and the mixer unit. There are two sets of hydraulic SAS servos for each axis and they are electrically controlled by two separate processors within the AFCS computer. The SAS servos are part of the inner

19 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information loop control system so the cyclic and collective controls in the cockpit do not move during operation. In addition, boost servos are fitted to each set of SAS servos to reduce the force required to move the controls through the servo units and limit feedback. 1.6.10 Four-axis flying control interconnections The mixing unit reduces the pilot workload by automatically compensating for collective, yaw, pitch and roll secondary effects to the various combinations of control inputs as follows: ● ● Collective to pitch - Compensates for MR downwash over the stabiliser and applies a forward pitch input as the collective is increased. ● ● Collective to yaw - Provides a proportional anti-torque control input to the TR to increase the pitch of the TR blades as the collective is raised. ● ● Collective to roll - Imparts a left roll input to the MR with increased collective to counter the drift tendency. ● ● Yaw to pitch - Compensates for the increases in the vertical TR thrust component due to its 20° in-built cant. It applies a nose-up pitch to prevent the nose-down resultant with left pedal input. 1.6.11 Maintenance history G-WNSR was maintained, in accordance with the manufacturer’s recommendations and authorised Aircraft Maintenance Manual (AMM), by the operator as a Part 145 organisation. G-WNSR’s Technical Log recorded all of the recent maintenance and servicing work carried out. The relevant activity on the TR and associated components was as follows: The TRPCS Pt No 92358-06303-042, Serial Number B063-00403, was installed in June 2016 at 1,227 airframe hours to replace the originally-fitted life-expired shaft. During this work, the output shaft seal was found to be worn and was replaced at the same time. The majority of subsequent work carried out on the TGB, TR servo and TRPCS was routine servicing and inspection. A package of work commenced on 8 October 2016 at 1,568 airframe hours. The TGB lubricating oil sight glass was dirty, to the extent that the oil level could not be determined, so the transparency was replaced. Additionally, the inspection found the TR servo eye end, connected to the TRPCS bearing,

20 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information to be worn. The TR servo assembly was replaced to rectify the problem. A borescope inspection was carried out eight flying hours after installation and there was no recorded abnormality. On the evening of 27 December, post-flight inspections and a routine 50-hourly check were carried out on G-WNSR (paragraph 1.1.2 refers). 1.6.11.1 TRPCS history TRPCS Serial Number B063-00403 was originally fitted new to S-92A Serial Number 920241 (G-WNSL) on 9 April 2014. It was removed for overhaul on 6 December 2015 having accrued 1,231.43 hours Time Since New (TSN) of its 1,250-hour overhaul life. It was overhauled by the manufacturer and released to service on 21 April 2016. It was fitted to G-WNSR on 25 June 2016 at 1,227 airframe hours. The TRPCS had a routine 250-hour inspection at 1,571.83 airframe hours and at the time of the accident had accrued 548 hours Time Since Overhaul (TSO), a total of 1,779.45 hours TSN. 1.6.11.2 Oil sampling history The lubricating oil in the TGB of G-WNSR was subject to SOAP, although this was not required by the helicopter manufacturer. The TRPCS bearing is pre‑greased and not washed by the TGB lubricating oil unless the bearing seals are damaged. Therefore SOAP would not be expected to detect a defect within the bearing. Although a SOAP report contains a lot of detailed information, the operator was using only the oil viscosity, total acid number (TAN) and water content results, in accordance with the procedure set out in AMM Task 65-22-00-200-001. This was to ensure the oil condition did not compromise the authorised extension of the oil in-service life from 625 hours to 1,250 hours. The SOAP results were produced on a printout chart detailing the constituents of the oil and the metallic content in parts per million (ppm). There were four samples taken since the TRPCS, Serial Number B063-00403, was fitted. The first of these was a routine sample taken on 27 June 2016 at 1,232.40 airframe hours, about five hours after the TRPCS had been fitted. This sample was normal other than the copper content had triggered an Advanced Warning3, annotated red, on the printout with a figure of 5.3 ppm. 3 The ‘trigger’ thresholds are based on a comparison of the various constituent levels recorded in the data set against this gearbox’s previous figures and those of the other gearboxes in the fleet.

21 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information The second sample was taken at 1,568 airframe hours on 8 October 2016. The copper had returned to below-threshold levels at 0.7 ppm, but this time the silver content had risen and triggered an Advanced Warning with 3.2 ppm. In addition, the magnesium content had also risen and triggered an Early Warning, annotated amber, at 3.0 ppm. The third sample was taken on 18 October 2016. Although the flying hours at the time the sample was taken are not recorded, it appears to coincide with a TGB oil change and the level sight glass replacement two days earlier. The results of this sample showed the silver content had dropped to normal, but the copper content had risen again to trigger an Advanced Warning at 6.0 ppm. The magnesium content had risen further to 6.8 ppm and also triggered an Early Warning, annotated amber. The fourth sample was taken after the accident and triggered Advanced Warnings for the majority of the metallic constituents with iron, copper, silver and silicon at very high levels. For example, the iron content had risen approximately 20 times its normal level and silver approximately 40 times its normal level. The first three sample results for oil viscosity, TAN and water content showed the oil to be within the limits set out in the AMM, however the fourth sample taken after the accident showed that whilst the oil viscosity and TAN remained in limits the water content had risen out of limits. 1.6.12 Emergency procedures TR malfunctions and associated emergency procedures are referenced in the manufacturer’s Rotorcraft Flight Manual (RFM). Symptoms of an ‘uncommanded sharp right yaw’ or ‘yaw/spin’, not responsive to pedal inputs, are described for two malfunctions: ‘LOSS OF TAIL ROTOR THRUST IN FORWARD FLIGHT’ and ‘LOSS OF TAIL ROTOR THRUST IN A HOVER’. The actions required in a hover are to hold level, move the throttles to the stop position and use collective pitch to cushion the landing. Symptoms described for ‘TAIL ROTOR CONTROL SYSTEM MALFUNCTIONS’ are: binding or restricted pedal movement or little or no response to inputs, and procedures are provided to manage the failure as a fixed pitch condition. A failure mode resulting in a complete loss of control of the TR, as experienced during the landing on the West Franklin, is not addressed. The operator’s Emergency Checklist provided emergency procedures related to the TR. There were no references to ‘uncommanded sharp right yaw’ but there were references to ‘uncontrolled yaw’ entitled: ‘TAIL ROTOR DRIVE FAILURE’ and ‘TAIL ROTOR CONTROL FAILURE IN HOVER’. Both failures required an immediate landing; the ‘TAIL ROTOR DRIVE FAILURE’ actions equated to the RFM actions for ‘LOSS OF TAIL ROTOR THRUST IN A HOVER’.

22 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information In June 2017, the operator published revised titles, symptoms and procedures related to TR malfunctions in its Emergency Checklist. The titles and symptoms now more closely reflect those in the RFM. The associated procedures differ from those in the RFM and reflect the operator’s preferences for its specific operations in the offshore environment. The pertinent RFM and Emergency Checklist extracts are shown in Appendix  A. 1.7 Meteorological information The meteorological observation from the Elgin PUQ before G-WNSR landed on the Elgin was: surface wind from 220° at 20 kt, visibility 10 km or greater, broken cloud at 2,200 ft, temperature 8°C, dewpoint 3°C and pressure 1038 hPa. No lightning activity was recorded in the area. An Emergency Response and Rescue Vessel was on station for the landing on the West Franklin and reported the following weather conditions: wind from 250° at 20 kt to 25 kt, sea 2.5 m, sky overcast and visibility 10 nm. 1.8 Aids to navigation Not applicable. 1.9 Communications The Elgin PUQ helideck was manned and had radiotelephony (RT) communications which were recorded. The West Franklin helideck was not manned and operations there were overseen by the Elgin radio operator via a video link and RT communication. 1.10 Aerodrome information The Elgin installation is a manned platform designed to receive and process hydrocarbons from the West Franklin and Elgin wellheads before it is piped ashore. The West Franklin gas platform is an unmanned wellhead natural gas extraction facility in the Elgin field oil and gas area of the North Sea, situated 125  nm east of Aberdeen. The West Franklin platform stands in 93 m of water and is 3.3 nm away from the Elgin PUQ platform. At the time of the accident, there were two jack-up rigs positioned alongside the Elgin Wellhead Platforms: the Galaxy 1 and Prospector 5, detailed in Temporary Limitations Notice 15‑2016.

23 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.10.1 Elgin PUQ helideck The Elgin PUQ is a jack-up rig of steel construction, standing in 93 m of water and is situated 128 nm east of Aberdeen. It is connected to the Elgin wellhead platform by a 90 m long bridge. It is fitted with a Category ‘F’ (fixed) aluminium helideck supported on an aluminium frame designed for helicopter operations with aircraft up to maximum all up weight of 15 tonnes. The helideck is 51 m above the water and is circular in shape marked out to give a landing spot ‘D’ (MR diameter) value of 22.8 m. It is fitted with safety netting and has a helicopter refuelling and power supply capability. Its Helicopter Landing Area Certificate was valid on 28 December 2016 and was renewed on 9 January 2017 in accordance with CAP 437. There are notes on the certificate which draw attention to possible turbulence from the turbine exhaust and exhaust stack and to the presence of various fixtures and fittings around the edge of the helideck. It also makes note of a parking area extending from the south‑east sector of the helideck on which shuttle aircraft or containers may be situated. The Helideck Landing Area Certificate, Helideck Information Plate and Temporary Limitations Notice 15-2016 are shown in Appendix B. 1.10.2 West Franklin helideck The platform is predominantly of steel construction and is fitted with an aluminium helideck supported on an aluminium frame designed for helicopter operations with aircraft up to maximum all up weight of 12.8 tonnes. The helideck is 43 m above the water, octagonal in shape and is marked out to give a landing spot ‘D’ value of 21 m. It is fitted with safety netting around its edges. The landing spot is marked out with a flush lighting system built into the helideck surface. The aluminium surface of the helideck also has parallel rows of serrated ridges attached which are approximately 2 mm high to provide a non-slip surface over the helideck. The flight deck is certified in accordance with CAP 437 with a valid Helicopter Landing Area Certificate issued on 14 November 2016. The helideck is fitted with a remotely controlled firefighting capability. The platform is fitted with a crane designed for heavy maintenance operations and has reach to the flight deck when required. Although unmanned, the platform is fitted with shelter, communications and provisions for use in the event of personnel having to remain on the platform for prolonged periods, ie overnight. The Helideck Landing Area Certificate and Helideck Information Plate are shown in Appendix C.

24 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.11 Recorded information 1.11.1 Introduction G-WNSR was equipped with a Curtiss-Wright (Penny & Giles) Multi-Purpose Flight Recorder (MPFR), which recorded over 45 hours of data and 2 hours of audio, covering the period up to and including the accident. The audio recordings include the commander and co-pilot’s communications, radio transmissions, passenger announcements and audio from the cockpit area microphone. G-WNSR was also equipped with a HUMS to meet the EASA VHM regulatory requirements. The HUMS data provided snapshots of the health of components in the helicopter’s drive train for the period up to and including the accident flight. CCTV recordings from both helidecks were also reviewed to corroborate witness evidence. 1.11.2 Flight data The MPFR data indicated that G-WNSR lifted off from Aberdeen at 0722 hrs and touched down on the Elgin PUQ at 0820 hrs. It stayed on the Elgin with rotors running before lifting off briefly into the hover (yaw event) at 0842:50 hrs and departed en route about 30 seconds later for the five-minute flight to the West Franklin platform, where it touched down at 0848 hrs. 1.11.2.1 Elgin PUQ yaw event and lift off Figure 6 is a plot of the salient flight data parameters for the Elgin yaw event and lift off for the transit to West Franklin, starting with the helicopter on the helideck. In summary, the data indicates the following: UTC (hh:mm:ss) Event 08:42:47 Left pedal input made (helicopter on helideck – heading 270°). 08:42:49 Helicopter lifts off, rolls left and yaws right. 08:42:52 Full left pedal input, helicopter yawing 10°/s to the right. 08:42:53 Peak yaw rate of 12.5°/s recorded. 08:42:55 Collective reduced (then helicopter back on helideck – heading now 315° having yawed right 45°). 08:43:08.5 Collective lever starts to raise. 08:43:18 Helicopter lifts to hover and starts to yaw left. 08:43:20.5 Helicopter departs (for transit to West Franklin).

25 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information Figure 6 Salient parameters during the Elgin yaw event and lift off for transit to the West Franklin

26 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.11.2.2 West Franklin landing Figure 7 is a plot of the salient flight data parameters for the landing on the West Franklin platform starting with the helicopter manoeuvring over the helideck just prior to touchdown. Note that the flight recorder does not record data associated with the use or status of the landing gear wheel brakes. In summary, the data indicates the following: UTC (hh:mm:ss) Event 08:47:44 Yaw rate nominally zero with left pedal held at half pedal. 08:47:47 Left pedal input reduced and helicopter starts to yaw left. 08:47:49 Half left pedal input made but helicopter starts veering to the right and rolling to the left – helicopter heading 214°. 08:47:50 Max right yaw rate of 30°/s recorded before reducing as max left pedal inputs made. 08:47:50.2 Helicopter touches down (on left landing gear) rolled 13° to left – maximum left roll of 20° recorded less than half a second later. 08:47:52 Helicopter touches down on right landing gear - yaw rate about 20°/s with max left pedal inputs still being made. 08:47:55 Left pedal inputs reduce. 08:47:57 Pedals are nominally zero - right yaw rate reduces. 08:47:58 Rotor speed starts to reduce. 08:48:01.5 End of recorded data – helicopter final heading of 041° having rotated through 187° since loss of yaw control.

27 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information Figure 7 Recorded flight data for the West Franklin landing

28 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.11.3 Helicopter Vibration Health Monitoring Helicopters, unlike fixed wing aircraft, fly by virtue of a mechanical system rather than a structure. As such, the mechanism has a number of single load paths that form the rotor and transmission system, that make them potentially more vulnerable to catastrophic failures. VHM was introduced nearly 30 years ago to provide an automatic means of monitoring the health of these mechanical components. A HUMS is the application of VHM in an operational context providing data for trend analysis and condition-based maintenance. 1.11.3.1 VHM regulatory requirements On 1 June 1999, the CAA issued Additional Airworthiness Directive 001‑05‑99 that made the installation and use of VHM mandatory for UK registered helicopters issued with a Certificate of Airworthiness in the transport category and having a maximum approved seating configuration of more than nine. The acceptable means of compliance with 001-05-99 was originally specified in Civil Aviation Publication (CAP) 693; however, this did not give detailed guidance for VHM system design in order to achieve effective health monitoring. The CAA replaced 001-05-99, a design regulation, with a requirement in the Air Navigation Order (ANO), thus making the requirement for VHM an operational requirement. Accordingly, this moved the responsibility for compliance with VHM regulations from the Type Certificate Holders (TCH) to the operators. CAP 753 ‘Helicopter Vibration Health Monitoring’, introduced in September 2010, became the acceptable means of compliance with the new operational requirement. Following their formation in 2003, the EASA reviewed the requirements for VHM. They concluded that the National Aviation Authorities should, where necessary, introduce national VHM requirements for ‘demanding’ operations, such as those operations in the North Sea. More recently and presently only applicable to new VHM system designs, the publication of EASA CS-29 (Certification Specifications for Large Rotorcraft) Amendment 3 dated December 2012, introduced CS 29.1465 Vibration Health Monitoring into the regulation. The requirement was developed by an EASA/FAA/Industry Rotorcraft VHM Working Group (RVHMWG) picking up on work that had been started by the Helicopter Health Monitoring Advisory Group (HHMAG). The requirement is, however, unique to CS-29 and does not feature in the FAA’s equivalent regulations for large rotorcraft, FAR-29.

29 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information EASA issued a Notification of a Proposal to issue a Certification Memorandum (CM-S-012) on 9 November 2017 that will require operators to verify that VHM system performance is compliant with an appropriate standard, where required for SPA.HOFO.155 (Helicopter Offshore Operations). For the S-92A the VHM requirements are met by the use of HUMS. 1.11.3.2 VHM alert threshold philosophy Gradual wear and degradation of the helicopter’s principal mechanical systems is detected through Condition Indicators (CIs) which are calculated from data from vibration sensors on critical areas such as the rotors, engines, gearboxes and drive shafts. VHM requires the design organisation to set threshold values for each CI above which an alert is generated. Whilst the thresholds need to be set above the normal vibration levels, if they are set too low then the rate of false alarms can result in an unacceptable maintenance burden. It is normal for the HUMS manufacturer or TCH to review and, if necessary, revise the threshold levels, and introduce new alerts, as a result of knowledge gained from statistical analysis of vibration levels across the fleet. The guidance to operators given in CAP 753 states that the period between the successful download and assessment of any primary VHM indicator, used for monitoring the engine and rotor drive system components, should not exceed 25 flying hours. This interval is reduced to ten flying hours for components or indicators that require ‘close monitoring’ where, for example, an indicator value has exceeded a ‘maintenance action’ threshold or shows signs which warrant increased attention. As previously stated, ten flying hours is not atypical of a complete day’s flying for North Sea helicopter operations. The Acceptable Means of Compliance (AMC) to CS 29.1465 states in paragraph n. (Performance Criteria) that: ‘(1) Signal Acquisition The applicant for VHM system certification should specify the rate of acquisition of data sets for defect diagnostics in consistent flight regimes. As a target, the total data set acquired in a flight should be sufficient for complete and reliable diagnostics to be produced for every flight above a defined duration in stabilised conditions. As a minimum, at least the data set for all components should be

30 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information automatically obtained on each flight of greater than 30 minutes in stabilised conditions without the need for in-flight pilot action. For operations which do not contain periods of stabilised operation of greater than 30 minutes, alternative procedures need to be incorporated to ensure that the total data set is recorded within a specified number of flying hours related to the minimum adequate frequency of data collection determined under AMC 29.1465(e)(2), and in any case no longer than 25 flying hours. Where subsystem performance is critical or relied upon to achieve the quoted defect probability of detection or False Alert rate, such as sensor accuracy, dynamic range or bandwidth, then this should be quoted.’ Specifically, the AMC to 29.1465(e)(2) states in bullet (ii) that: ‘The data acquired from the vibration should be automatically gathered in specifically defined regimes at an appropriate rate and quantity for VHM signal processing to produce robust data for defect detection.’ The AMC to CS 29.1465 paragraph n. then continues: ‘(2) Data transfer and Storage Capability The VHM defect status data should be capable of being downloaded during rotors running turnarounds.

All the data sets acquired should be stored until successfully transferred to the Ground-Based System. The storage capacity should not be less than 25 flying hours. The applicant should describe the maximum interval between data downloads for which the system memory capacity is not exceeded. In the event that a complete data set is not recorded, the data transfer process should be capable of downloading a partial data set to the Ground-Based System. In such a case, the ground station should alert maintenance personnel of a missing maintenance log or that the data set provided is incomplete.

31 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information (3) VHM Alert generation and fault detection performance The Alert and Alarm generation processing should be designed to achieve a claimed probability of detection that is acceptable to the Agency for each component defect being monitored. Processing to isolate False Alerts and False Alarms should not result in an unacceptable workload. Also this processing should not compromise the verification and validating evidence of claimed defect detection performance. This workload should be assessed prior to completion of the Controlled Service Introduction (CSI) phase.’ In the note to Section g of the AMC to CS 29.1465, it also states that: ‘The fixed or learnt thresholds for each individual health monitoring indicator may have a limited capability to detect incipient failures in a timely manner.  This is because the process for threshold setting is sometimes a compromise between increasing sensitivity and incurring a higher risk of false alarms, or reducing sensitivity, which will delay the point at which a rising indicator value will trigger an alert.   In-service experience has shown that MGB component fatigue failures can propagate from initiation to failure in a relatively short period of time, thus the use of fixed thresholds alone may not provide a timely indication of impending failure.  One characteristic that can often provide an earlier indication of anomalous behaviour is the rate of change of a health monitoring indicator, and automatic trend detection software has been developed and shown to be effective.  Another method, commonly referred to as Advanced Anomaly Detection (AAD) combines numerous indicators into multi-dimensional parameters, whereby simultaneous changes of multiple indicators can provide increased confidence of the anomalous behaviour at an earlier point in the failure process.’ CAA Paper ‘2011/01 Intelligent Management of Helicopter Vibration Health Monitoring Data’ defines Advanced Anomaly Detection (AAD) as an approach that detects abnormalities in rotor drive system components by comparison of multiple downloaded health monitoring parameters with prepared multi‑parameter models of normality for these components. It also provides diagnostic information on the monitoring parameters causing abnormal indications. The multi-parameter models of normality represent the statistical dependencies between monitoring parameters and are based on experience across multiple aircraft within a fleet. The approach incorporates methods to

32 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information ensure that any unknown abnormalities within this experience do not prevent the detection of similar abnormalities. Models are to be periodically refined based on increasing fleet experience. The use of alert thresholds for individual CIs or the anomalous behaviour based on multiple CIs are all attempts to generate warnings as early as possible. However, other factors affect the timeliness of these warnings: how often a sensor is sampled during a flight, how long it takes to process data, how frequently the data is downloaded, how soon it is checked for exceedences and any delay in passing on exceedence information to the relevant people for it be acted upon. A 2012 CAA paper ‘2012/01 Application of AAD to Tail Rotor HUMS Data’, which reported on a study to demonstrate the application of AAD methods developed and successfully applied to HUMS transmission data (CAA paper 2011/01), recognised the importance of timeliness when new techniques such as AAD were able to detect a failure with little warning. It concluded that: ‘Using AAD it is possible to detect tail rotor defects in Vibration Health Monitoring (VHM) data, but warnings are unlikely to be much in advance of the end of the flight preceding the ‘failure’ flight. On-board, post-flight indications would therefore be required for such a scheme to be effective.’ 1.11.4 HUMS configuration on the S-92A On the S-92A the HUMS forms part of the commercially available IMD-HUMS4 that provides the following functions: ● ● Built-In Tests (BITs) ● ● Mechanical Diagnostics ● ● Usage Monitoring ● ● Exceedence / Event / Alert-Monitoring ● ● Engine Vibration Monitoring ● ● Rotor Track and Balance ● ● Engine Shaft Balancing The IMD-HUMS consists of two distinct sub-systems: the On-Board System (OBS) and the Ground Station (GS). At the time of the accident, the operator was using the IMD software on its GSs. The helicopter manufacturer had released new GS software, called the Sikorsky Ground-Based Application (SGBA), in May 2015 and this was being evaluated by the operator; however, 4 IMD-HUMS was developed by the Goodrich Corporation (and the US Navy), and selected by the Sikorsky Aircraft Corporation in 2001 to be fitted as standard equipment on the S-92.

33 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information the maintenance manual revision to support the software was yet to be released. The differences in functionality between the IMD and SGBA software are discussed later in this report. The OBS collects and records aircraft information on a per-flight basis. Data is then transferred from the OBS to the GS using a Data Card. The GS is then used to analyse the collected data and to maintain a detailed operational history of the helicopter. The percentage of the Data Card used is continuously displayed on the HUMS page of the helicopter’s Multi-Function Display, and when less than 2 MB of free space remains (equivalent to about 12 minutes of data), an exceedence is generated, prompting the crew to replace the Data Card. This is the only exceedence that the HUMS will display during flight. 1.11.4.1 Mechanical diagnostics The S-92A HUMS User Guide states that the goal of the mechanical diagnostics function is to enable a transition from time-based maintenance to condition‑based maintenance by acquiring vibration data from dynamic components and other monitored systems. The system is designed to collect data snapshots automatically on the ground, in the hover and in the cruise, without any aircrew input, during all flights for specified gearbox and flight regime combinations (provided the helicopter remains within the flight regime for the duration of each acquisition). It also includes a manual mode that enables pilot-initiated data collection which is either ‘prompted’ (where the pilot, in conjunction with OBS prompts, explicitly selects the gearbox group of interest and then enters, and maintains, the desired flight condition and initiates data capture - if the flight condition is not maintained, the OBS will abort the acquisition), or ‘forced’ (where the pilot again initiates an acquisition; however, in contrast to the prompted mode, the OBS completes the data acquisition regardless of the flight regime). Data from the TR sensor is captured automatically during cruise flight (and > 60 kt) where the helicopter needs to be maintained in a steady state condition for a minimum of ten seconds. The processing of this data takes about 1.5 minutes to complete before the system captures and processes data from other sensors. A full rotation of data capture and processing, when in the cruise, takes about eight minutes and is therefore suitable for trend analysis and detection of the gradual wear and degradation of components over time but not for capturing transient events. 1.11.4.2 Ground station software mechanical diagnostics The mechanical diagnostics functions of the IMD GS software (used by the operator at the time of the accident) provide a means for viewing data collected

34 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information from individual drive train sensors and to provide a colour-coded health indicator to provide an indication of change in the drive train components and provide assistance for troubleshooting if a significant change occurs. The green ‘normal’ range is based on a priori measurements of known, healthy components; the yellow ‘warning’ range denotes components that exhibit mechanical diagnostic characteristics that differ from the known, healthy components, and the red ‘alarm’ range denotes anomalous components that have markedly different mechanical diagnostic characteristics. Within each range, the absolute value of the health indicator is secondary to the trend of the health indicator. The IMD GS software has summary ‘debrief’ pages that list each flight for the selected helicopter for which HUMS data has been uploaded onto the GS. By selecting each flight, line by line, exceedences for the selected flight are then displayed which can then be viewed in detail in time-history strip charts by selecting the exceedence. The GS also includes diagnostic tools in addition to those in the main IMD GS software, in the form of standalone tools, run separately on the GS, to analyse and/or detect (1) TR blade pivot bearing retainer disbonding, (2) TGB bearing energy, and (3) main gearbox cracks. These diagnostic tools are selected via the standalone IMD-HUMS ToolBar (Figure 8), which requires the HUMS raw data files already installed on the GS to be uploaded into the ToolBar to be processed. The resulting CI time-history charts are then individually inspected for exceedences – these are not automatically displayed as an alert. Figure 8 IMD-HUMS ToolBar 1.11.4.3 TGB bearing energy analysis software The TGB bearing energy analysis software is a standalone tool accessed via the IMD-HUMS ToolBar. It is intended to help assess the condition of the TGB’s two input and output bearings as well as the TRPCS bearing assembly. This tool was developed and introduced in 2007 following degradation of a bearing believed to be due to foreign object debris. The software uses data recorded by the HUMS from the existing TGB accelerometers and provides additional means of monitoring the condition of the TGB through changes in its vibration signature. The diagnostic tool responds to any defect in the TGB that manifests itself in the 15-20 kHz frequency range.

35 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information The TGB bearing energy CI is generated by computing the average 15‑20 kHz energy for the selected helicopter since its last maintenance date. This date is important since removing/replacing the TGB, the pitch change shaft assembly, or the TGB accelerometer can change the absolute value of the CI. The 15‑20 kHz energy is then normalized by the calculated helicopter-specific mean. This normalized energy is referred to as the CI ratio. The CI ratio is then plotted as a trend history with reference to a baseline for the helicopter that is nominally 1.0. The baseline data consists of 200 points that provides a baseline characteristic that is unique for that helicopter and from which an alert limit threshold is generated (if the 200 points have not been acquired no limit threshold will be calculated and the tool displays ‘Insufficient Data’ on the trend history). In order to speed up the acquisition of the initial baseline data, pilots can manually initiate data acquisition. The limit threshold for the CI ratio is 1.75 of the baseline; however, for users of the SGBA GS software prior to the accident, the threshold was raised from 1.75 to 2.5 following a review in 2015 of the tool and process improvements to remove a high number of false alerts5. In January 2017, following the accident to G-WNSR, the threshold was reduced to 1.75 for SGBA users, and hence in line with the IMD GS software; manufacturer’s Temporary Revision No 45-03 dated 10 January 2017 refers (Appendix D). 1.11.5 Operator’s internal HUMS procedures 1.11.5.1 Operator’s HUMS download procedure At the time of the accident, the procedure was for the Data Card to be removed and downloaded every time the helicopter returned to a main operating base (MOB) for the HUMS data to be reviewed before the helicopter’s release to service. The operator also limited the time between download (and review) to a maximum of five flying hours. If planned operations were such the flying time could exceed five hours, the crew would carry a card reader to enable them to download the data themselves and then forward the data to the MOB for review. If the helicopter was planned for a detachment or shutdown offshore, its GS laptop would be taken offshore too. At the MOB it was the responsibility of a licensed engineer, signing for the flight, to transfer the data onto the GS and make a preliminary analysis of the data to look for trends and establish if any alerts had been generated. Had any alerts been generated, the engineer would inform the operator’s base in Norway who were, at the time, responsible for the operator’s S-92A HUMS global support. HUMS technical support was continuously available to the engineering staff through the HUMS Support team. 5 These false alerts had been caused by a now-resolved manufacturing process issue.

36 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information At the end of each day, the HUMS data was automatically sent to the operator’s base in Norway, for it to be reviewed the following day. It was also automatically sent to the manufacturer who were responsible for continued development and support of HUMS for the worldwide S-92A fleet. The documented procedures included a HUMS flowchart that should be followed by the licensed engineer which first required the engineer to confirm the alert status on the IMD GS software before proceeding with the IMD‑HUMS ToolBar. However, the operator’s own investigation into this accident identified that the flowchart omitted two items concerning the ToolBar, one of which was to conduct a review of the TGB bearing energy CI. The TGB bearing energy CI was not subject to ‘close monitoring’. 1.11.5.2 G-WNSR HUMS download Engineer A, who was responsible for the maintenance on G-WNSR on 27 December 2016, transferred the HUMS data from the helicopter onto the GS after the final flight of the day. He then made his preliminary analysis of the data firstly using the main IMD GS software. He established that no thresholds had been exceeded and all of the mechanical diagnostics were green. He then ran the IMD-HUMS ToolBar, during which he and Engineer B, were unsuccessful in zooming in on the TGB bearing energy CI ratio chart to identify and confirm the exceedences. Figure 9 shows the time-history chart as presented to Engineers A and B, when they visually inspected the TGB bearing energy CI ratio (this figure has been recreated, using the original data, for the purposes of this accident report). Note that the x-axis automatically scales to show the complete time-history since last TGB maintenance date, which for G-WNSR was 6 October 2016, and the y-axis automatically scales from zero to the full range of CI ratio values. However, had either of the licensed engineers successfully zoomed in on the day’s flight, the exceedences would have been clearly visible (see Figure 10 for a recreated zoomed-in version of the original data) with the highest and final exceedence being just over 17 compared to the alert limit threshold of 1.75.

37 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information Figure 9 Recreated TGB bearing energy CI ratio time-history chart

Figure 10 Recreated TGB bearing energy CI ratio time-history chart zoomed to last flight on 27 December 2016

38 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information When, on the morning of 28 December 2016, the operator’s S-92A HUMS global support team in Norway reviewed the HUMS data for 27 December, the exceedences in the TGB bearing energy CI ratio were detected. At 1311 hrs they contacted the operator in Aberdeen, only to be told that the helicopter was currently on the West Franklin platform. Figure 11 shows the TGB bearing energy CI ratio relative to the flight data for the third and final flight (comprising three sectors) on 27 December 2016 (during which the exceedences occurred), showing the various flight conditions at which data from the TGB accelerometers was acquired. The first exceedence (a single point) occurred just over an hour into the first sector of the third flight, about 45 minutes before landing. The next exceedences occurred during the last hour of the third sector back to the MOB at Aberdeen. Figure 11 TGB bearing energy CI ratio and recorded data for third flight on 27 December 2016

39 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information In summary, the helicopter was operational (with rotors turning) for a total of 10.4 hours on 27 December 2016 and the first exceedence occurred after 6.9 of these operational hours. It was a further 3.5 operational hours before the helicopter returned to its MOB for the HUMS data to be downloaded and hence the first opportunity (which was missed) for the operator to become aware of the exceedence. During these 3.5 hours the helicopter landed twice (but did not shut down) – the first after about 0.7 hours and the second after a further 0.6 hours before returning to the MOB. After G-WNSR was recovered following the accident on the West Franklin, the HUMS data for 28 December 2016 was downloaded. Figure 12 shows the TGB bearing energy CI ratio for this flight and indicates that during the first leg (from Aberdeen to the Elgin PUQ) 12 sets of data were acquired of which the last nine resulted in TGB bearing energy CI ratio exceedences. Figure 12 TGB bearing energy CI ratio and recorded data for the flight on 28 December 2016

40 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information As the Elgin event did not happen during the cruise phase of the flight, no data from the TGB sensor was captured, nor was any during the short sector to the West Franklin. Figure 13 shows a graphical representation of the flight schedule for G-WNSR for the two weeks leading up to the accident. During this period, G-WNSR flew on nine of these days, two of which contained two flights with a daily total operational time of over 10 hours. The timing of the exceedences concerning these flights is indicated. 0 1 2 3 4 5 6 7 8 9 10 11 12 0 1 2 3 4 5 6 7 8 9 10 11 12 DAILY CUMULATIVE OPERATIONAL HOURS DAILY CUMULATIVE OPERATIONAL HOURS Flight 1 (airborne) Flight 2 (airborne) Flight 3 (airborne) Exceedence Takeoff/Landing Figure 13 G-WNSR operating history for previous two weeks Figure 14 combines the operating histories for the last two days to form a timeline beginning with the start of operations on 27 December 2016, with the first exceedence highlighted at 6.9  operational hours and the accident 5 operational hours (about 4 flying hours) later. 0 1 2 3 4 5 6 7 8 9 10 11 12 0 1 2 3 4 5 6 7 8 9 10 11 12 CUMULATIVE OPERATIONAL HOURS Flight 1 (airborne) Flight 2 (airborne) Flight 3 (airborne) Exceedence Takeoff/Landing

|27/12/2016

|28/12/2016 6.9 hours from start of operations to first exceedence 5.0 hours from first exceedence to accident Figure 14 G-WNSR operating history for the two days prior to the accident

41 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.11.5.3 Operator internal HUMS training Training for line engineers on the use of HUMS is given over three days at the end of their line training. The HUMS training, given to the operator’s line engineers worldwide, was provided by an external contractor. The material presented during the HUMS training for the S-92A includes the manufacturer’s HUMS User Guide for the S-92A (SA S92A-HUM-000 – most recent revision was dated 30 December 2012). 1.11.5.4 Interrogating HUMS time-history strip charts The manufacturer’s HUMS User Guide describes the specific user commands to zoom in or out of the data presented in the time-history strip charts. These commands are applicable to the strip charts in the main IMD GS software as well as the IMD-HUMS ToolBar. For zooming it states: ‘(a) Position the cursor over the portion of the graph you wish to enlarge. (b) Click and hold the left mouse button and drag the magnifier box (faint white outline) down and right over the region to be enlarged. (c) Release the mouse button to display the area inside the magnifier box. (d) Continue to Zoom in on the desired area of the graph. The entire graph will be enlarged but the area of interest will remain in view. (e) Once the graph has been zoomed to the desired size, the entire graph may be viewed by holding the right mouse button down and dragging the graph left and right or up and down.’ To undo zoom it states: ‘(a) Position the cursor in the lower right of the graph, and while holding the left mouse button down, drag the cursor to the upper left and release. The graph will return to its normal size.’ Although the command is to drag the magnifier box down and right over the region to be enlarged, for strip charts in the main IMD GS software, dragging up and right also has the same effect. Similarly, the undo zoom, which requires the user to select any point on the strip chart and drag the resulting box up and left, also works dragging the box down and left. However, for strip charts in the IMD-HUMS ToolBar and several sub-functions within the IMD

42 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information GS software, only dragging down and right will zoom (as per the user guide); the three remaining combinations each undo zoom. These additional zoom and undo zoom commands are not discussed in either the HUMS User Guide or any training material. Early on in the investigation, the manufacturer was made aware of the differences in the zoom functionality within the main IMD GS software and the standalone IMD-HUMS ToolBar and the possibility of confusion this offered for users of the IMD software. 1.11.5.5 Sikorsky Ground-Based Application (SGBA) In May 2015, Sikorsky issued their own GS HUMS software called the SGBA for use with S-92A and S-76D helicopters. This (and the corresponding user guide) was made available to operators of these helicopters to trial; however, the relevant S-92A maintenance manual revisions were not issued until March 2017. The operator of G-WNSR had been trialling the SGBA since 2015 in order to develop their knowledge of the application and be able to transfer to it at the earliest opportunity after the release of the maintenance manual revision. Meanwhile, the licensed engineers continued to use the existing IMD GS software and IMD-HUMS ToolBar. Like the IMD GS software, the SGBA was designed to analyse, process, and compile flight data into useful information for the maintenance crew, logistics team, operations department, and engineering support. The SGBA, however, introduced many enhanced features such as enhanced diagnostics capabilities, and improved user interfaces such as colour-coded visual indicators to highlight inspection requirements. As an example, Figure 15 shows the Tail Gearbox Bearing Energy Tool for G-WNSR with the TGB bearing energy CI ratio together with two additional CIs, related to the TRPCS bearing. One key difference is that the first page (Figure 16) automatically presented to the user gives a summary of all CI exceedences and alerts to be actioned in accordance with the AMM, including those which previously, using the IMD GS software, required manual interrogation. To promote the enhanced features available in the SGBA, the helicopter manufacturer issued an All Operators Letter CCS-ALL-AOL-17-0008 dated 24 March 2017 (Appendix E) to inform users of the IMD software that: (1) the IMD software would be ‘rendered obsolete’ in the near future, (2) the maintenance manual revisions were released on 9 March 2017 to support customers transitioning from the IMD software to SGBA,

43 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information (3) highlighted some of the enhanced features of the SGBA, and (4) reminded users of the approved zoom and undo zoom commands for interrogating time-history strip charts.

Figure 15 SGBA Tail Gearbox Bearing Energy Analysis Tool

Figure 16 SGBA initial page highlighting exceedences and alerts

44 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.12 Wreckage and impact information 1.12.1 Helideck Yaw control was lost at about 4 ft above the helideck. The helicopter then descended with a left rolling moment. The left main landing gear contacted the helideck first and was canted over which presented the outer edge of the wheel rim to the helideck. This resulted in a dent in the top layer of the helideck approximately 150 mm long, part of which was an 80 mm cut which penetrated the helideck surface. The cut matched the distortion in the wheel rim. Figures 17 and 18 show the rim distortion and helideck damage. Black rubber scuff marks were also made on the helideck surface consistent with the tyre scrubbing during the rotation of the helicopter in the accident sequence. Figure 17 Left outer wheel rim distortion (courtesy of CHC Scotia Ltd) Figure 18 Helideck damage (courtesy of CHC Scotia Ltd)

45 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.12.2 Initial helicopter examination on the helideck The crew carried out an initial examination of the helicopter whilst on the helideck. The helicopter showed no outward signs of damage apart from distortion to the outer rim of the left outer mainwheel. The tyre was seated in its rim and had remained inflated. The crew were asked, by maintenance control, to carry out a “full and free” yaw pedal check. They did this by starting the APU to energise the hydraulics and cycled the yaw pedals through their full range of motion whilst observing the TR. The results were indeterminate and the situation precluded further diagnosis at that stage. Subsequently, a team of the operator’s engineers arrived by boat and the helicopter was lifted by crane from the helideck and transported by sea back to its maintenance base at Aberdeen. 1.12.3 Examination at maintenance base Further examination of the helicopter was then carried out at the maintenance base with the assistance of the manufacturer. Without hydraulic power applied it was found that the yaw pedals moved easily. Further inspection found the TR servo piston was broken at the point where the walking beam pivot bar is attached leaving the walking beam pivot in a loose and unrestrained condition. However, the control input eye end was correctly connected to the walking beam and to both the first and second stage servo control valves. The centring spring between the two control valve linkages was also correctly connected. The TR servo was removed and a disassembly of the TRPCS revealed severe damage to the TRPCS bearing. The bearing showed evidence of overheating and discolouration, a partial friction welding of the rollers, cages and inner race with the outer races loose and heavily scored. The PTFE seals and snap rings were not evident. There was no lubricant present in the bearing. Figure 19 shows the bearing on removal. Figure 19 TRPCS bearing from G-WNSR

46 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information The TGB, TR hub and blades were examined in situ and no outward signs of damage found. All of the TR related components were removed from the helicopter and the TGB, TRPCS and servo were returned to the manufacturer for forensic analysis. 1.12.4 Examination by the manufacturer The components were examined in stages at the manufacturer’s facility in the USA and the examination was overseen by NTSB, FAA and AAIB representatives. 1.12.4.1 TRPCS bearing The TRPCS bearing was severely damaged and was no longer a viable bearing. The outer races on both sides of the bearing had been subject to intense heat and were discoloured. The roller tracks were heavily scored and pitted with none of the smooth hardened surfaces remaining intact. Some roller cage material was also dispersed around the surfaces of the roller tracks. All of the barrel-shaped rollers were present and were welded to the inner races along with the remains of their cages. The rollers were also flat sided. The roller set nearest the servo linkage (the inside bearing) exhibited the most damage and the rollers had lost approximately half their diameter. The outer rollers, nearest the TR, had flat sided to a lesser extent and were still recognisable as barrel rollers. The wear in the inner and outer races and the distortion of the rollers and cages, allowed at least a 0.5 inch (12.5 mm) linear play or looseness in the bearing. There was no hydrocarbon component (the lubricant) of the grease present on or within the bearing. However, there was a residue of the grease thickening agent present within the remains of the bearing but not enough for useful forensic analysis. 1.12.4.2 Tail rotor gearbox The TR gearbox casing, input and output shafts showed no evidence of external damage and were free from leakage. The gearbox was disassembled and the internal components examined. The bearings, shafts, input pinion and crown wheel were undamaged with no discernible signs of wear. The TRPCS guide grooves within the output shaft were also undamaged although there were small amounts of an unidentified deposit within the bore and at the ends of the TRPCS guide grooves. Samples of the deposits were sent for further analysis and were found to be wear products from the phosphor bronze carrier.

47 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.12.4.3 TR servo An external visual examination was carried out. The servo appeared to be in a good overall condition with the exception of a fracture of the primary piston within the secondary piston sleeve. A cross-section of the servo primary and secondary pistons and cylinder with the location of the fracture is shown in Figure 20. A functional test under hydraulic pressure could not be carried out due to the damage on the primary piston. There was no evidence of hydraulic leakage and the walking beam, servo valves and body were undamaged. The anti-rotation tab showed evidence of wear on both sides with a corresponding witness mark within the anti-rotation plate slot. The servo was disassembled as far as possible; however, the inboard face of the primary piston head was tight against the gland seal and could not be moved. Remnants of seal material were present in the vicinity of the outboard piston face. There were signs that the primary piston had been rotating within its cylinder evidenced by rotational scoring on the bore of the cylinder. This scoring was approximately 35 mm from the housing face (TGB mounting flange) and extended along the bore, in the piston retraction direction, by approximately 18 mm. Rotational marks were also present on the contact surface between the primary and secondary pistons. The clevis assembly, which attaches the primary piston to the TRPCS bearing, could not be removed despite the application of a 350 lb ft torque. Residual hydraulic fluid within the servo appeared normal. The primary piston which had parted within the secondary piston tube, was removed and sectioned for metallurgical examination. The surfaces were examined under a scanning electron microscope which revealed evidence of smearing and shear overload, consistent with a ductile overload in torsion. Primary piston failure location Figure 20 Servo cross-section and fracture location (courtesy of Sikorsky)

48 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 1.13 Medical and pathological information Not applicable. 1.14 Fire Not applicable. 1.15 Survival aspects All persons on-board a helicopter operating offshore in the North Sea area are required to be current in Helicopter Underwater Escape Training. Survival suits and associated equipment are required to be worn. Whilst flying operations are carried out on the West Franklin platform a safety boat is positioned nearby to respond to a helicopter ditching or man overboard situation. 1.16 Tests and research 1.16.1 Engineering 1.16.1.1 Immediate action After the components had been removed from G-WNSR and examined, the manufacturer issued an All Operators Letter (AOL) CCS-92-AOL-16-0019 (Appendix F) on 31 December 2016 drawing attention to the event with the details as they were understood at the time. In particular it drew attention to the importance of the HUMS Tail Gearbox Bearing Energy Tool in understanding the condition of the TRPCS bearing. As the investigation progressed and as the sequence of events leading to the bearing failure became clearer, the manufacturer issued an ASB to all operators on 10 January 2017. ASB 92‑64‑011 (Appendix G), supported by an FAA Airworthiness Directive (AD) 2017-02‑51 (Appendix H) dated 13 January 2017, gave instructions to establish the condition of the TRPCS bearing assemblies in service and action to be taken should the airworthiness of a bearing be in doubt. Concurrent with the issue of ASB 92-64-011, the manufacturer published Temporary Revision 45-03 which required operators to use HUMS GS software to review, on a reduced flight hour interval, the TGB energy analysis CIs for any alert conditions. The AD required action to be taken on the TRPCS bearing assembly before next flight. It reinforced the ASB technical instructions to all S-92A operators to remove and inspect the TRPCS bearings. If the bearing did not rotate freely, sounded rough or chattered, was leaking grease, or had metallic particles present, or had nicked or damaged PTFE seals, the assembly

49 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information should be rejected and immediately returned to the manufacturer. In addition, the AD required bearings that showed none of these issues could remain in service with a repeat 10-hourly borescope inspection programme to inspect the condition of the PTFE seals and snap rings. The helicopter operator also introduced a number of measures to further strengthen the ability to detect impending bearing degradation. These included: a review of all HUMS data to ensure no anomalies, fleet-wide borescope inspections and a requirement for HUMS to be serviceable before flight. The operator also reviewed their HUMS processes and analytical procedures, correcting the omission in the documentation of the use of the IMD-HUMS ToolBar analysis tools. They also introduced a requirement for an additional assurance check to be carried out by a second licensed engineer prior to releasing the helicopter to service. 1.16.1.2 Inspection feedback and subsequent actions TRPCS bearings which were deemed unsatisfactory to continue in service were returned to the manufacturer. In total, by April 2017, 19 shafts were removed for further evaluation from 253 helicopters reporting ASB compliance, out of the global fleet of 275. The reasons for these removals were as follows: ● ● 10 shafts removed due to a HUMS Bearing Energy CI ratio exceeding a revised limit of 1.75 ● ● 4 shafts removed due to physical inspection identifying ratchet/rough bearing condition ● ● 5 shafts removed due to visual indications The manufacturer devised a rigorous non-destructive inspection process and applied it to each of the received bearings to ensure that no evidence was lost by disassembly and the bearings were assessed in their in-service condition. This test regime was devised to establish several important factors. A visual examination was carried out to confirm any observations made by the operator rejecting the TRPCS and to identify anything abnormal. Particular attention was paid to the condition of the seals and snap rings for signs of leakage of the grease, the presence of debris or evidence of wear. The phosphor bronze guide lugs were also examined for signs of abnormal loading or wear pattern from the TGB output shaft. The components in the TRPCS assembly are made to a close tolerance and therefore can be assumed to not vary in weight between individual assemblies. Any variation in TRPCS weight would be attributed to the amount of grease

50 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information present in the bearings. Thus, the amount of grease present can be deduced from an accurate weighing of the TRPCS assembly. An end float measurement, carried out at room temperature, showed how much play was present within the inner and outer races of the bearing. The allowable end float or play was a minimum of 0.002 inch (0.0508 mm) to a maximum of 0.005 inch (0.127 mm). On completion of the initial inspections, the TRPCS assembly was mounted in a specially constructed spin rig based on a TGB and hub assembly. The TRPCS was then run whilst the rig control programme subjected the bearing to the forces and loads experienced in service. The TRPCS was then disassembled and the bearings inspected. As a control, life-expired TRPCS assemblies awaiting rework were also put through the same test regime. 1.16.1.3 Results The majority of TRPCS assemblies were returned due to a slight ‘notchiness’ or stiffness when a ‘by hand’ examination was carried out during AD compliance inspections. All returned TRPCS assemblies were in a good overall condition and none exhibited the degraded condition of the TRPCS removed from G-WNSR. The test results were varied. None of the assemblies showed any serious outward signs of impending failure or abnormal wear. All TRPCS weights confirmed the presence of grease within the bearings albeit in varying quantities. Some of the tight or notchy bearings had no end float, whilst other bearings were within limits. Of the 19 TRPCS removals, 18 bearings did not exhibit unusual or advanced wear or degradation, but one bearing exhibited roller wear and unusual indications on the outer race. During spin testing, the average or normal temperature was around 240°F (115°C) peaking at around 300°F (150°C) in some cases. All TRPCS assemblies tested in this way showed no signs of further degradation or impending failure. However, it was found that some of the TRPCS bearings ran hotter than had been previously assumed or expected. During this process an unsuccessful attempt was also made to deliberately cause a TRPCS bearing to fail on a life-expired TRPCS. To understand further the running temperature of the TRPCS bearing in service, the manufacturer developed a small temperature sensing plug which could be fitted in the bore of the TGB output shaft next to the bearing. It consisted

51 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information of a set of four temperature sensitive pads which change colour depending on the temperature experienced. This plug was issued to all operators on 9  March  2017 under ASB 92-64-012 (Appendix J). Information received back from the operators suggested the running temperatures were between 320°F (160°C) and 340°F (171°C) on newer bearings. It was also found that in some cases these higher temperatures drop by approximately 40°F (22°C) over a period of 25 hours. The temperature profiling of the TRPCS bearing resulted in two shafts being sequentially removed from one helicopter. As a result, the manufacturer requested the removal of the TRPCS, TGB and servo from this helicopter6 as a whole assembly for further analysis. The helicopter manufacturer has worked with the bearing manufacturer to identify and implement a number of improvements to the bearing manufacturing process. An improved end play measuring tool has been introduced to carry out more accurate measurement and bearing setting up during assembly. The grease is now drawn from sealed cartridges and injected into the races using a syringe to ensure a more consistent quantity and distribution. The bearing is also now weighed before and after grease application. Throughout this activity the manufacturer has issued regular updates to all operators of the S-92A to keep them informed of the steps taken to ensure the continued airworthiness of the TRPCS bearings. 1.16.2 Recorded data mining 1.16.2.1 HUMS Following the accident, the manufacturer performed a review of the S-92A fleet HUMS data to determine if modifying the TGB bearing energy CI ratio exceedence threshold, or applying new techniques, would enable additional prognostics for the HUMS Tail Gearbox Bearing Energy Tool. When retrospectively applied to the HUMS data from G-WNSR, modifying the threshold did not provide any earlier warning than the existing four flying hours. However, a review of other CIs that focused on the TRPCS bearing, and the development of new algorithms, extended the warning to just over 16 flying hours. These features have now been incorporated into SGBA. 1.16.2.2 Operational indicators The helicopter manufacturer reviewed data from the 11 liftoffs of G-WNSR, prior to the event on the Elgin, to determine whether there was any pre-accident evidence of a degradation that could be identified through the flying controls and 6 This helicopter was flying extended range sectors relative to the rest of the fleet.

52 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information thus provide some warning to flight crews. The pedal and collective positions recorded at the point at which weight-on-wheels indicated liftoff were analysed; no trend of increasing use of left pedal prior to the event was apparent. Data for in-flight pedal position for other helicopters in the fleet during a typical offshore sector were also reviewed and no outstanding trend was apparent. Additionally, the helicopter manufacturer reviewed their archive of flight data records to determine whether it is an unusual event for a pilot to use full pedal travel in flight. The analysis showed that the use of full pedal was very rare but had occurred in each of the previous events of TRPCS bearing failure (see paragraph 1.18.2). Conclusions from the review were that this cue is available to flight crew prior to bearing failure, but is indicative of a bearing that is already in an advanced state of degradation. Thus, the use of full pedal travel could indicate a need for prompt action to abort a flight and the helicopter manufacturer is considering whether changes to the RFM could be introduced. 1.17 Organisational and management information During the investigation AAIB inspectors visited the operator’s maintenance facility and met some of the engineers on the staff. The hangar, shift offices and crew-room were spacious, calm and well-organised; maintenance plans and shift routines were clearly promulgated. 1.18 Additional information 1.18.1 AAIB Special Bulletin (SB) The AAIB published Special Bulletin S1/2017: ‘Sikorsky S-92A, G-WNSR, loss of yaw control on landing at West Franklin platform, North Sea, 28 December 2016’ to provide initial information concerning the event and to highlight initial safety actions. The SB was published on 11 January 2017 and the safety actions presented within the SB are detailed later in this report. 1.18.2 Previous similar events During the preliminary work to identify the cause of the TRPCS bearing failure, a review was carried out to see whether there had been any similar previous events. In 2007, a bearing was found to have degraded as a result of foreign object debris. This resulted in issue of ASB 92-64-002 and ASB 92-64-003 (mandated by FAA AD2007-17-05 and EAD 2016-24-51 respectively) which required a once-only borescope inspection. Several additional actions were put in place and led to the introduction of a 1,250-hour Time Between Overhaul (TBO), improvements in the manufacturing process and to the seal assembly on the

53 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information bearing, and introduced a bearing installation tool. It was also of significance that the HUMS Tail Gearbox Bearing Energy Tool was developed and introduced by the manufacturer as a direct result of this event. During the remedial work conducted into the above event, a partial or full seizure of the TRPCS bearing applying torque to the servo piston was considered. It was anticipated that should this happen, the servo would fail in the threaded portion of the clevis. In September 2016, a newly manufactured bearing failed within two hours of installation. This was caused by incorrect end play set up during assembly which led to a tight bearing. The bearing manufacturer introduced an improved bearing clamping and measurement procedure during assembly. An additional end play inspection was also introduced during overhaul. In November 2016, ASB 92-64-009 was published which detailed a once-only inspection for improper end play on TRPCS assemblies with bearings less than 80 airframe hours since overhaul. This did not apply to G-WNSR because, by that date, its TRPCS had accrued 350 airframe hours since installation. As a result of G-WNSR’s accident the manufacturer reviewed the previous events and concluded that, for the 2007 event, there was no objective evidence to prove the cause was a foreign object in the bearing. The manufacturer now considers it more likely that the 2007 event was related to the bearing being assembled too ‘tight’, as identified in the later events. In November 2016, it was found that the TGB storage process risked flooding the bearing with gearbox lubricating oil with the potential to dilute the grease. ASB 92-64-010 was issued to identify helicopters which had been subjected to long term storage procedures. Any TRPCS bearing found to have been fitted to a helicopter that had been in long term storage was replaced as a precautionary measure. The storage procedure was modified accordingly. The TRPCS from G-WNSR had not been in storage and therefore this ASB did not apply. 1.18.3 Engineering shift patterns The operator’s maintenance shift patterns are designed to make the most efficient use of manpower over ‘long-days’ matched to a comprehensive routine helicopter maintenance plan. It also retains the flexibility to react to unplanned rectification work on a fleet of 15 S-92A helicopters. The manpower is divided into two main sections ‘X’ and ‘Y’ then sub-divided into early and late shifts to achieve the long working day. In addition, two small teams cover the night period.

54 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information The ‘X’ and ‘Y’ main sections work a rotating system of four days on, four days off, six days on, four days off, four days on, and six days off. The shift pattern for December 2016 is shown in Figure 21 and the daily early, late and night shift pattern in Figure 22. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 December 2016 Y X Figure 21 December 2016 shift pattern TIME (hhmm) LATE NIGHT EARLY (Mon-Sun) (Mon-Thu) (Fri-Sun) (Mon-Thu) (Fri-Sun) Figure 22 Daily shift pattern There was reduced flying over the Christmas period, so the shift supervisors had carefully planned and programmed the maintenance work so that no staff were required to work on Christmas Day or Boxing Day. Engineer A was part of the shift section that was on a six-day sequence of ‘lates’ which had started on 23 December 2016 and was due to finish on 28  December  2016. After the stand down on 25 and 26 December, staff returned to their normal routine on 27 December. However, Engineer A was scheduled for an additional stand down on 28 December and therefore was not required for work that day. Engineer A’s shift pattern is shown in Figure 23. Following the two stand down days, he worked from 1500 hrs on 27 December 2016 to approximately 0100 hrs on 28 December 2016.

55 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information 22 23 24 25 26 27 28 29 December 2016 (off shift) (off shift) STAND DOWN STAND DOWN X (lates) (lates) (off shift) (off shift) STAND DOWN STAND DOWN X (lates) (lates) STAND DOWN Figure 23 Licensed Engineer A’s shift pattern 1.18.4 Significance of HUMS in previous accidents The investigation of the accidents to Eurocopter EC225 LP Super Pumas G-REDW and G-CHCN7 resulted in the provision of a flight deck indication for an exceedence of a specific HUMS CI. For both accidents, a CI was found, at 4.62 and 4.75 flying hours for G-REDW and G-CHCN respectively, to be capable of detecting an impending failure of the bevel gear vertical shaft in the MGB, but within the operator’s existing download and review interval of 10 flying hours of the HUMS data. As a result, it was determined that the CI trend should be monitored over a shorter period of elapsed time. Interim measures were introduced for a HUMS download interval of up to a maximum of four flying hours. The helicopter manufacturer subsequently introduced a flight deck indication for an exceedence of this specific CI, removing the requirement for a four-hour download and review interval. The investigation report also noted that for the HUMS configuration on the EC225 LP, the acquisition cycle for one complete set of samples of data from CI sensors typically lasted between 30 and 40 minutes. 1.18.5 Royal Navy WS-61 Sea King HUMS The Westland WS-61 Sea King helicopters operated by the Royal Navy are equipped with a combined HUMS and cockpit voice and flight data recorder (CVFDR) system (compared to the standalone HUMS on the S-92). The system includes a Cockpit Control Unit (CCU), to display HUMS/CVFDR alert information and other HUMS information, which can be configured to display exceedence alerts on landing as well as be interrogated in- flight by the crew. The exceedence alerts are limited to rotor track and balancing, airframe, engine or flight exceedence limits, and only indicate that a threshold has been exceeded (ie not the value of the exceedence). Transmission exceedences are processed and identified by the GS and therefore not available to crew via the CCU. The CCU allows a HUMS 7 AAIB Report 2/2014 https://assets.publishing.service.gov.uk/media/5422fbaaed915d1374000833/2- 2014_G-REDW_and_G-CHCN.pdf

56 Factual Information Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 1 - Factual information validity check to be performed by the flight crew as part of the pre-flight procedure, and maintenance personnel must be consulted before departure if there are any new or unknown ‘failures’. The system is not designed to be used as an in-flight diagnostic tool. 1.19 Useful or effective investigation techniques Not applicable.

57 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis 2 Analysis 2.1 Introduction The helicopter suffered a loss of yaw control when landing on the West Franklin platform. The crew were able to put down immediately on the helideck, although without directional control. If the loss of yaw control had occurred at an earlier stage of the flight, the helicopter would most likely have made an uncontrolled descent into the North Sea. Strip examination of the components revealed that the loss of yaw control was the result of damage to the TR pitch control servo, which had been brought about after a significant failure of the TRPCS bearing. HUMS had provided an alert of the impending bearing failure the day prior to the accident flight, but this was not identified by the maintenance engineers. To provide assurance of safe flight a series of safety barriers are in place which are designed to prevent the catastrophic loss of an aircraft. On this occasion most of the barriers were breached and it was fortuitous that the final component failure occurred when the helicopter was in the landing phase above the helideck, in a position from which, despite the loss of control, the commander could immediately lower the collective and land. Figure 24 is a schematic representation of the applicable safety barriers.

MANUFACTURE CERTIFICATION LOSS OF AIRCRAFT DETECTION AND REPORTING OF ABNORMAL OPERATION DETECTION OF IMPENDING FAILURE FAILSAFE DESIGN MAINTENANCE AND HUMS FLIGHT CREW CHANCE SAFETY BARRIERS Figure 24 Schematic representation of the applicable safety barriers

58 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis Design and certification During the certification process, the manufacturer and certifying authority must perform a design assessment to ensure that the transmission system functions safely over the full range of conditions for which certification is sought. This must include a detailed failure analysis to identify all failures that will prevent continued safe flight or landing. It must also identify the means to minimise the likelihood and effect of their occurrence. The aim through the design is to reduce the risk of component or system failure to a probability of 10-6 or less (categorised as ‘very remote’). Certification of the design must consider component wear and tear and its effect on the risk of failure. To mitigate against the potential for failure in service, a proactive monitoring or pre-failure capture and maintenance scheme must be derived to ensure a high level of reliability. A failsafe system or structure is designed to consider a component or part failing or malfunctioning such that it does not overload or cause other critical systems and structures to malfunction, lose control or integrity in turn. Maintenance and HUMS HUMS is a means of meeting the VHM regulatory requirements of CS 29.1465, applicable to applicants requesting certification of a VHM system, such as helicopter operations in the North Sea. HUMS was originally designed to monitor the health of mechanical components that form the rotor and transmission system within an operational context, providing data for trend analysis and condition-based maintenance, for which it has proved very effective. It was not intended to detect imminent in-service component failures; however, thirty years of experience and development has demonstrated the potential for it to be used in this way. Operators and manufacturers are placing more reliance on the additional assurance HUMS gives for continued airworthiness, and the download and analysis of HUMS data is often a necessary step on each return to base, and before the helicopter is released back into service. Flight crew The flight crew role in this context is to observe the aircraft and report on its serviceability; pilots may be able to detect changes in performance or behaviour at an early stage, prior to a component failure. However, their ability to do so effectively is subject to the limitations and constraints of human performance.

59 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis Chance Chance can sometimes play a part in the avoidance and/or mitigation of the consequences of accidents and serious incidents. 2.2 Operational aspects 2.2.1 Conduct of the flight The flight crew were not aware of the recorded HUMS exceedences as there was no indication on the flight deck of the helicopter. The flight progressed uneventfully until the first attempt at takeoff from the Elgin PUQ. The manufacturer’s review of historic data to determine whether there may have been any preliminary cues to the flight crew through an increasing bias of the yaw control positions showed that nothing would have been apparent. Therefore, there was no in-flight indication to the crew of the impending bearing failure, before the landing on the Elgin. On lift off from the Elgin helideck the helicopter yawed right through 45°, an unusual event. The commander’s intuitive reaction, when the first attempt at takeoff was unsuccessful, was to try again so, after a short exchange about the event with the co-pilot, he lifted the helicopter back into a hover and turned to the left into wind. It now responded normally to his control inputs so he was reassured, as was the co-pilot, who thought the yaw event had occurred because of a misjudgement in a variable wind. Neither pilot considered that there was anything mechanically wrong with the helicopter, thus the departure continued. The evidence of the degraded state of the bearing which led to the subsequent failure of the TRPCS suggests that this first yaw event was related to the bearing degradation. The manufacturer’s retrospective analysis of yaw pedal positions showed that the use of full left yaw pedal could provide an indicator of advanced bearing degradation for flight crews. The flight crew, without the benefit of this information, tried to find a reasonable explanation for the yaw and considered that it arose because of local wind conditions and associated turbulence. The commander’s expectation was that the helicopter could be more awkward to handle in a left crosswind. The co-pilot’s expectation was that the Elgin PUQ helideck could be ‘tricky’ due to the other installations and the position of the helideck and superstructure, creating a wind rolling up onto the deck or coming round from behind. Both factors could have influenced their acceptance of wind effect as an explanation for the unusual yaw.

60 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis 2.2.2 RFM and Emergency Checklist procedures This mode of failure of the TR system was not anticipated by the manufacturer and there was no RFM procedure to deal specifically with this malfunction. The RFM made reference to a loss of TR thrust with symptoms of ‘uncommanded sharp right yaw, unresponsive to pedal inputs, (‘sharp right yaw/spin’ in a hover); the associated actions required the helicopter to land immediately and shutdown. The operator’s Emergency Checklist included a procedure with similar actions entitled: ‘TAIL ROTOR CONTROL FAILURE IN THE HOVER’. However, this did not reference ‘uncommanded right yaw’ as a failure indication but stated that an ‘uncontrolled yaw’ would require an immediate landing. The operator’s procedure ‘TAIL ROTOR DRIVE FAILURE’ referenced the indication ‘uncontrollable yaw to the right’; the checklist actions for this failure would also have resulted in an immediate landing and shutdown. The crew did not review Emergency Checklist procedures after the uncommanded right yaw at the Elgin as they did not consider the possibility of a technical malfunction. If a technical malfunction had been diagnosed and Emergency Checklist items actioned, it is considered unlikely that the crew would have continued with the flight. 2.2.3 Plan continuation bias The flight crew’s uncertainty over what had happened during the unusual yaw event on liftoff from the Elgin was not a sufficiently strong stimulus to change their original plan to depart for the West Franklin. However, the evidence of their continuing discussion suggests that, although they departed en route, they had not yet reached a satisfactory explanation for the event. The decision to continue is an example of a plan continuation bias, which is the unconscious tendency to go ahead with the original plan despite changing conditions. This type of cognitive bias works to obscure subtle cues of changing circumstances.1 The sector to the West Franklin was short, only five minutes, and the flight crew’s focus quickly changed from the earlier event on the Elgin, to the forthcoming approach and landing on the West Franklin. During the landing, the commander, who probably had a heightened awareness following the Elgin event, sensed a similar unusual yaw to the right and was quick to respond, putting in additional left pedal to try to counter the yaw and partly lowering the collective. However, all yaw control of the helicopter was lost and it yawed to 1 Dismukes, R. K., Berman, B., and Loukopoulos, L. L. (2007) The Limits of Expertise: Rethinking Pilot Error and the Causes of Airline Accidents. Ashgate, Hampshire, UK.

61 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis the right and rolled left before the left mainwheels hit the helideck. The rate of yaw suggests that the TR thrust was substantially different to the yaw pedal demand, making the helicopter uncontrollable in yaw with a secondary effect in roll. The commander lowered the collective fully and maintained a full left yaw pedal input as the helicopter settled on the helideck, still rotating to the right. Brake parameters were not recorded so the status of the brakes is unknown but the helicopter came to a stop having turned through approximately 180°. After the event the co-pilot immediately diagnosed a TR malfunction, as evidenced by his response to the Elgin radio operator after the helicopter was shut down. 2.3 Engineering analysis The HUMS Tail Gearbox Bearing Energy Tool shows bearing degradation over a very short period of time. The first exceedence was picked up at five operating hours prior to the accident. Figure 25 shows that the bearing degradation produced inconsistent vibration levels which suggests the bearing did not follow a gradually increasing wear pattern leading to eventual failure. Figure 25 Extract from Figure 12 - TGB bearing energy CI ratio for third flight on 27 December 2016 The TRPCS bearing had been in service for 548 hours of its 1,250-hour life and had no recorded HUMS exceedences until five operational hours prior to its failure. This implies that there was a significant change in the bearing condition to cause the first exceedence and the bearing deteriorated rapidly thereafter. The evidence on the bearing shows that it had undergone severe overheating whilst under load. The damage was too extreme to leave evidence of the traditional initiators of a bearing failure such as spalling, hard object contamination, cage failure or corrosion. However, those forms of bearing failure tend generally to develop slowly and produce gradually increasing but low level HUMS exceedences over a longer period of time.

62 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis The possibility of damage from within the TGB was considered, but this seems unlikely due to the absence of damage to the components in close proximity to the bearing, such as the TR shaft guide bushing. The TGB lubricating oil SOAP analysis of the routine samples taken prior to the accident show inconsistent rises in some of the metallic elements within the oil, but are inconclusive as indicators of impending bearing failure. The sample taken after the accident shows, unsurprisingly, a major metallic contamination of the lubricating oil resulting from the complete disintegration of the seals and bearing structure whilst the TGB’s shafts and gears were rotating under load. It is also possible that the bearing lubrication itself failed. If this was the case, it appears that conditions within the lubrication system of the bearing were such that an apparently normal bearing (which had run for half of its TBO and not generated any HUMS exceedences) suddenly started to produce significant HUMS exceedences and failed within a very short running time. The bearing is a sealed self-lubricating component. Its rollers and races are surrounded in grease retained in the bearing by PTFE dust seals and covers. The grease is applied when the bearing is assembled by the OEM and is not disturbed until the 1,250-hour life on the TRPCS has been accrued. Providing that the correct type and quantity of grease is applied, the bearing should be trouble free during its TBO and beyond. 2.3.1 Cause of the uncommanded yaw on the Elgin PUQ The uncommanded yaw event on the Elgin PUQ occurred during the lift off phase of the sector; therefore, no HUMS vibration data for the TGB were sampled at that time. However, the HUMS TGB bearing energy CI exceedence timeline prior to this event suggests that the TRPCS bearing was then at an advanced stage of degradation. The dynamics of the interaction between the TRPCS bearing, servo and TGB shaft are difficult to quantify. However, there are two main features which are likely to cause unpredictability in the inputs to the TR. As the servo attempted to push or pull the TRPCS via the bearing there would have been a considerable drag in the bearing as the degraded rollers and races made contact. This is likely to have imparted a torque back into the servo piston as a result. This increased dragging torque would have manifested itself as an additional load on the guide bushing, the TGB output shaft and on the lugs within the anti-rotation slot on the servo. The magnitudes of these loads are not known, but it is possible that they were enough to affect the movement of the servo piston as it responded to yaw inputs from the mixer unit and AFCS. Even though the servo can impart a considerable force into the

63 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis TRPCS, significant resistance felt against the servo piston may at least slow its movement. Furthermore, it may also have led to the servo stalling under load, resulting in wind‐up of the cable system. The combination of cable wind‐up and bearing free play due to wear may lead to a larger discrepancy between pedal position and actual TR blade angle (or thrust). In addition, the degraded bearing had at least 0.5 inch (12.5 mm) linear play or looseness. As a consequence, the servo piston could have moved up to 0.5 inch with no resulting effect on the TRPCS and thus the TR itself. When considered against the range of movement of the servo in normal circumstances, the 0.5 inch linear play in a normal 3.5 inches (89 mm) of movement represents a reduction in the total range of travel of approximately 15%. Both aspects would have affected the servo’s feedback loop and manifested themselves as jerky or clumsy movements as the servo tried to achieve, and make corrections to, the required position. 2.3.2 Potential bearing lubrication problems There are recognised to be two main problems regarding the application of grease in a bearing: either over-greasing or conversely, under-greasing. If a bearing is over-greased, it can, under some circumstances, cause a bearing to overheat. The reason for this is that the grease can become clogged and may not stir around whilst the bearing is rotating and so becomes over-worked, heated and then oxidises. It then starts to degrade in the high-load areas and the heat generation in those areas increases leading to further degradation of the grease, a complete loss of lubrication and eventual bearing failure. However, over-greasing will have an effect quite early in the bearing life and may manifest itself in the purging of discoloured grease past the bearing seals. The borescope inspection eight flying hours after installation of the TRPCS showed no abnormalities. This and the fact that the bearing achieved half its TBO suggests over-greasing was not a factor in this bearing failure. Under-greasing of the bearing can also result in premature failure. In this case heat is also generated, but for different reasons. The grease may not be able to cover all of the surfaces within the bearing leading to metal-to-metal contact. This will result in accelerated wear, heat build-up and premature bearing failure. It is also possible for a bearing to become under-greased during operation. It is normal for bearing grease to deplete during use and this is usually for two reasons: mechanical loss where there is a slight but constant seepage from race seals, or by gradual evaporation of the oil within the grease to leave a disproportionate amount of thickener. This is not always catastrophic; it is

64 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis possible for a lightly loaded bearing to lose most of its grease and continue to operate correctly albeit with raised noise and vibration. Although the hydrocarbon element of the grease was not present, forensic examination showed the presence of remnants of the thickening agent used in the grease. No meaningful data or conclusion, other than that grease had originally been present in the bearing, could be drawn. 2.3.3 Bearing loading and environment The TRPCS bearing is designed to carry varying thrust loads from a non-rotating component to a rotating component. The orientation of the barrel rollers and races mean that each bearing is under compression from either a pull or a push from the servo. If the servo extends, the bearing race nearest the servo takes a higher proportion of the load. If the servo retracts, the same occurs on the race furthest from the servo. During operation, when the TR is at its neutral setting with no input from the TR servo, both races are relatively lightly loaded. When a yaw input is made (left induces a pull and right induces a push from the servo) the corresponding race of the bearing takes the load. The load increases proportionally to a maximum when the TR is at full pitch as the servo acts against the flexbeams within each blade. When the servo moves back to neutral the bearing load reduces and, for high rates of movement, may even act on the opposite side of the bearing. The dynamic interaction between the inner and outer races and the rollers and their cages is complex. As described earlier, the bearing rollers are allowed, by virtue of including some end float, to move axially and radially within their cage. The scoring found in one bearing from the 19 TRPCS removals, was attributed to having been assembled too tightly; however, improved control of end play tolerance has subsequently been introduced by the manufacturer. The TRPCS bearing is not under a constant load, the inner and outer races sustain varying push and pull loads for varying periods of time as the servo reacts to inputs from the pilot, mixer unit and other automatic systems. Although varying push and pull loads may tend to produce roller movement out of track, it should not be detrimental in this type of bearing in this application. 2.3.4 Servo damage The failure of the bearing components created a torsional drag and ultimately led to the TRPCS ‘back driving’ the servo piston. Initially, as the bearing became less effective, it imparted a significant torque into the servo piston as shown by the evidence on the anti-rotation guide lugs. This torque was variable and, as continual yaw control inputs were made, the bearing condition worsened.

65 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis This eventually led to a snatch torque being applied to the piston which then failed at the outer end of the primary piston within the secondary piston sleeve. This had the effect of disconnecting the walking beam feedback pivot to allow unrestrained and random inputs to the servo control valves. Consequently, the now-rotating servo piston could move in and out of its cylinder making unpredictable pitch change inputs to the TR via the now severely damaged TRPCS and loose bearing. Loss of TR control is a risk which was considered during certification of the helicopter. The certification process considered a TR which had either ‘frozen’ at a particular pitch setting or had returned to, and stuck at, its neutral pitch. The mitigation of this risk was based on the helicopter being flown with sufficient forward speed to counter any torque effects and to carry out a running landing. The loss of TR scenarios involved the servo either not receiving inputs or failing to respond to control inputs. The work carried out to rectify the first bearing failure event in 2007 also considered a disconnection between the TRPCS and the servo piston, and considered a partial or full seizure of the TRPCS bearing applying torque to the servo piston. It was anticipated that should this happen, the servo would fail in the threaded portion of the clevis where it connects directly to the TRPCS (Figure 26). This would leave the now-disconnected, but hydraulically-driven, piston attached to the helicopter yaw control system and therefore in a relatively safe condition, albeit with the servo piston moving in and out, colliding with the remains of the clevis and its eye end. Anticipated failure location Figure 26 Anticipated servo failure location 2.3.5 Returned TRPCS assemblies None of the TRPCS assemblies rejected by operators in accordance with the AD and ASB exhibited the same degradation as the bearing removed from G-WNSR. Furthermore, despite rigorous testing under load in the spin rig the manufacturer was unable to reproduce bearing failures.

66 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis 2.3.6 Summary of engineering analysis The damage to the TRPCS bearing has destroyed any evidence that would have identified the initiating cause of the bearing failure. However, during the failure sequence, bearing lubrication broke down drastically. It may be that loss of lubrication was the initiating cause but, as with the evidence of the possible mechanical failure mechanisms in this bearing, any evidence of this has been destroyed. Despite extensive attempts, the manufacturer could not reproduce the bearing failure. This leads to the conclusion that the failure was because of undetermined factors which occurred within this particular bearing assembly. However, the manufacturer’s analysis indicates, based on the testing during this investigation, that during the 2007 bearing event, reduced or no end play (causing tightness in the bearing) may have been the significant factor. The exact end play of the bearing assembly fitted to G-WNSR at manufacture is not known but bearing tightness cannot be discounted as a factor. Had the HUMS exceedence generated by the TRPCS bearing been detected, the bearing would have been replaced before the helicopter was released to service. 2.3.7 Additional safety actions Notwithstanding being unable to determine the exact cause of the bearing failure, the manufacturer has carefully analysed all the results and findings from the ASB and AD and the temperature sensing feedback. From this the manufacturer has been able to focus on all aspects of the bearing design, manufacture and assembly and has identified and implemented improvement in a number of areas. These improvements include the design and structure of the bearing races, precise control of the lubricant quality and quantity, and the dimensional tolerances allowable and achieved during assembly. In addition, the temperature profile of the TRPCS bearings in service is now better understood and can be used to influence the bearing design, maintenance and life policy. 2.3.8 Helideck resilience Minor damage was caused to the surface of the helideck during the accident. The overall support structure of the helideck was unaffected and in this case, it would seem the helicopter presented a very high and very localised loading into the surface of the helideck in the form of a ‘knife edge’ created by the wheel rim. The angle was such that although the tyre wall would have deformed sideways it was not enough to break the rim seal to cause deflation of the tyre. It is possible that a momentary rim seal break occurred but then the tyre pressure instantly re-seated the tyre and maintained the seal.

67 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis The support structure, when combined with the surface material, give the crashworthiness or energy absorption capabilities of the helideck, as demonstrated in this case. The helicopter descended rapidly from about four feet (1.22 m), the landing gear compressed, the deck material distorted (dented) locally and then split within the area of the dent. Each ‘step’ in the process absorbed energy which in turn meant the support structure probably experienced no more than the loads imparted by the S-92A in a normal but firm landing. The helideck requirements are set out in CAP 437 and take into consideration various normal and abnormal scenarios likely to take place during helicopter operations. The worst case assumption in CAP 437 is a single engine landing with a heavy helicopter. Unexpected scenarios are not specifically described but are considered within the overall deck strength overload allowance. Therefore, something like a loss of control leading to a roll-over is taken into consideration by the strength factors in the design being multiples of the helicopter type maximum weight. The helideck resilience did not adversely affect the outcome of this accident, in other words, its damage did not make the situation worse or cause injury or loss of life, and so was not considered further in this investigation. However, the Helideck Certification Agency will bring this case to the attention of the CAA and the ICAO Heliport Design Working Group (HDWG) to consider whether the assumptions used in the regulations remain valid in the light of this accident. 2.4 HUMS data analysis on the S-92 2.4.1 Human machine interface The analysis of vibrational HUMS data currently relies on the use of software running on a GS that has access to the helicopter’s complete HUMS data history. The software is an inherent and critical part of the HUMS but it still requires a human to be ‘in the loop’ to inspect and make decisions based on what the software is telling them. This interaction between the system and user is, therefore, fallible and dependent on the design of the Human Machine Interface (HMI) for ease of use and ability to reduce the risk of failure due to human performance. The HMI for the S-92 HUMS was the IMD GS software. This was first developed in 2001 and had grown in its capability to the extent that additional functionality, such as the TGB bearing energy analysis, could not be supported by the original IMD GS software and had to be made part of a standalone IMD-HUMS ToolBar, still installed on the GS, but run independently of the main IMD GS software. This meant that the HMI at the time of the accident comprised two independent parts that, due to variations in design, differed from each other in how they were

68 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis used and how they provided information to the user. The crucial difference between the standalone ToolBar and the main IMD GS software was the fact the IMD-HUMS ToolBar did not inform the user that exceedences were present, but instead relied on the user to visually inspect the CIs for exceedences. The use of the standalone IMD-HUMS ToolBar was taught during the operator’s HUMS training of licensed engineers and routinely used by them when analysing the HUMS data from the S-92A helicopters. This was despite the omission of a step in the flowchart within the operator’s documented HUMS S-92A download procedures. This omission was identified by the operator during their investigation of this accident and an updated HUMS manual was released within a month of the accident. As part of the visual inspection of the CIs in the IMD-HUMS ToolBar, the user was able to zoom in and out. The method documented in the software user guide, and taught during training, worked on both the main software and standalone tool. However, a second method (differing only in the direction that the rectangle was made for selecting the region of interest to be zoomed in) that worked on main IMD GS software had the opposite effect on the IMD-HUMS ToolBar and several sub-functions within the IMD GS software. Therefore, any attempt to zoom in using this method, which was neither documented nor taught, resulted in zooming fully out, or no effect if fully zoomed out already. The largest exceedence of the TGB bearing energy CI ratio on 27 December 2016 was 970% greater than the alert limit threshold (just over 17 compared to 1.75) and followed one of slightly less magnitude 23 minutes earlier. These would have been evident on initial inspection of the data only by the fact that the y-axis would have automatically rescaled and expanded to fit all the data on the plot, and the red alert threshold line, normally near the top of the plot, would have been much closer to the bottom. The x-axis, also automatically rescaled and expanded to fit all the CI ratio data since the last TGB maintenance date of 6 October 2016, 82 days earlier. As these two large exceedences happened in the last hour of these 82 days (so taking up less than 0.05% of the x-axis), the exceedences were hardly visible on the right hand edge of the plot. Although the repositioning of the red alert threshold line attracted the attention of the licensed engineer, the unsuccessful attempts to zoom in on the data by two licensed engineers prompted them to attribute the unfamiliar look of the data plot to a software glitch. Nevertheless, Engineer A made a mental note to draw this anomaly to the attention of his supervisor later. Since this accident, the manufacturer has raised awareness of the standard procedure for the zoom function amongst the users of this software.

69 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis 2.4.2 SGBA GS software Since May 2015, the manufacturer had made available to operators of S-92 helicopters their own GS HUMS software called SGBA. The operator of G-WNSR made the decision to trial SGBA and had been doing so since 2015 to develop a knowledge and understanding of the software, with a view to transferring to it at the earliest opportunity given that the relevant S-92A maintenance manual revisions were yet to be issued. Some of the key benefits of the SGBA were that the functionality of the standalone IMD-HUMS ToolBar was incorporated into the software, and that a summary of all CI exceedences and alerts were presented to the user automatically once the HUMS data had been uploaded. It also introduced many features such as enhanced diagnostics and colour-coded visual indicators to highlight inspection requirements. Following release of the maintenance manual, and to promote uptake of SGBA with its improved analytical features and user interface, the manufacturer has notified operators of the intention to discontinue the older IMD software. 2.5 Licensed engineer human performance 2.5.1 Introduction The safety intervention designed to identify a problem with a safety critical component failed for two reasons. This was mainly due to an HMI problem with the HUMS TGB bearing energy tool and its zoom facility. This was then compounded by human factors, in particular an individual forgetting to carry out a simple but important intended action. During discussions after the accident, Engineer A used the well-known phrase it ‘slipped my mind’. This is a very familiar predicament and has been a factor of many accidents and incidents in the past. In this particular case, the evidence suggests two different issues that came together which led to him forgetting to carry out an intended action despite a ‘mental note’ being made. 2.5.2 Environment The AAIB observed, during a visit to the operator’s maintenance facility, that the hangar, shift offices and crew-room were spacious, calm and well-organised with shift routines and personnel availability clearly promulgated. The two supervisors had produced a shift routine over the Christmas period which meant the workforce was not too disrupted and could have quality downtime on Christmas Day and Boxing Day. These observations suggested a supportive, well-organised work environment where positive action is taken to keep external stresses and distractions to a minimum. Engineer A appears to have suffered a failure of his prospective memory. This is a common phenomenon and is more likely to happen in a stressful, chaotic

70 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis and noisy environment. However, in this case, the environment in the offices and hangar offered minimal adverse distraction and so was not considered to be a factor. 2.5.3 Prospective memory Prospective memory is a form of memory that involves remembering to perform a planned action or recall a planned intention at some future point in time. It is used when a non-urgent task or sequence of tasks, which are already underway, become disrupted by a distraction and have to be resumed later. A failure of prospective memory is then a risk and can lead to steps being missed out in the original task or it not being completed at all. The reasons why prospective memory is used are varied: it is often because of a constraint on a task or the need for other factors to be in place to carry out the action or task. The common method is the mental note, “I must remember to.....” and this might be sub-vocalised2. Prospective memory is susceptible to failure, usually due to distraction; for example, being absorbed in a task or where something else is competing for attention to the extent that the mental note is lost. The absence of a specific physical reminder leaves a reliance on the ‘mental note’ which is fallible. A specific reminder such as a strategically placed post-it note or a phone alert can ‘trip’ the memory into recalling the task to be done. If for some reason the prompt or trigger is deferred or there is an interruption or distraction, the prospective memory can further decay over time. The intention to carry out a task or action then becomes forgotten unless a significant and very prominent prompt is experienced. 2.5.3.1 Causes of prospective memory failure in the engineer In this case, Engineer A had an idea why the HUMS chart had rescaled and decided to address it later. Accordingly, he made his mental note with a plan to discuss the abnormality with his supervisor before closing the aircraft documentation. However, he forgot and the causes for this were probably two‑fold. Firstly, it was apparent that this individual was conscientious and took his airworthiness responsibility seriously. This was demonstrated by his normal method of work: he always started with the HUMS download, then he would go into the hangar and personally double-check the safety critical areas on the helicopter prior to panel closure. He would have given his full attention to this action as he was absorbed in a task he considered important and therefore this subconsciously moved the mental note further from the short term memory. 2 Sub-vocalisation is a term used to describe the silent speech which is often carried out whilst reading but may be used when committing something to memory, eg “I must remember to……”.

71 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis Secondly, the effect on him of the attempted break-in and his reaction to the police was an aggravating factor. It is known that being a victim of crime can adversely affect people in a variety of ways3. In this case he was observed to be upset and show signs of distress, which is a normal reaction. It can also preoccupy a person’s mind, although this may not be constant, it can arise in quieter moments or when reminded by another seemingly unrelated situation. In this case it is possible that the experience with the attempted break-in and the police was dormant at the back of the engineer’s mind throughout the evening. However, as he was starting to think about going off shift it is possible that the thought of returning home reminded him of the stressful experience earlier and this now began competing for his attention. This meant that his mental note to speak to the supervisor, which may have already been usurped by his physical double-checking of the helicopter, was now ‘pushed aside’ again by the reminder of his earlier experience. During the morning and early afternoon before he went on shift and during his subsequent interview with the AAIB, he made no mention of having been engaged on any tiring activities. Although there is no evidence of fatigue, the shift was winding down late in the evening, so fatigue may also have been a minor contributory factor. The loss of a mental note is not always permanent and may be brought back to mind by a prompt which may or may not be related. There was no work on G-WNSR which needed to be handed over to the oncoming night shift, so there was no handover discussion. Thus, there was no step-by‑step description of the helicopter technical status which would probably have prompted the engineer into remembering the HUMS anomaly. As time moved on, the mental note was forgotten until he was given the information about G-WNSR the next day. The mental note was recalled from his memory, leaving him with the uncomfortable realisation that he had forgotten to mention the HUMS matter the night before. 2.5.4 Mutual reinforcement The discussion between Engineer A and Engineer B tried to make sense of the exceedence line. They made several attempts to use the zoom function to look at a suspected data peak in more detail. Despite having no other evidence of a problem with the HUMS analysis tools, in the absence of visible reasons for the exceedence line position and unsuccessful attempts to zoom in for the detail, they both concluded there was a problem with the software. The fact that both drew this conclusion is likely to have been due to their shared experience whilst at the G-WNSR’s GS. Their discussion re-enforced their 3 Dinisman, T. & Moroz, A. (2017). Victim Support – Understanding Victims of Crime – The impact of crime and support needs. London: VS.

72 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis conclusion and confirmed their mutually-held theory that it was an unknown software problem. In this case, they had an expectation that an exceedence had occurred as indicated by the axis rescale. Their expectation was for the zoom function to allow the peak to be visible by causing the rescale and the exceedence to be clearly identified. Instead, they interpreted the failure of the software to zoom as being due to the fact that there was no peak to reveal and therefore no exceedence. Nevertheless, Engineer A still had misgivings about the anomaly and resolved to follow it up later. 2.6 Timeliness of VHM data 2.6.1 Maximum interval between downloads The AMC to CS 29.1465 currently requires operators to specify a maximum interval between HUMS data downloads. It must not exceed the system memory capacity (which must be a minimum of 25 flying hours). CAA guidance material (CAP 753) specifies that the interval should not exceed 25 flying hours and that this is reduced to 10 hours for components or indicators that require ‘close monitoring’. CAP 753 also states that 10 flying hours is not atypical of a day’s flying for North Sea operations. The operator of G-WNSR had procedures which were more stringent and had reduced the interval to a maximum of five flying hours between downloads. It had provisions in place, through the use of card readers or repositioning the GS laptop computer, for occasions when the helicopter would not be able to return to a main operating base before the 5-hour limit expired. 2.6.2 Timeliness of VHM alerts Given the existing HUMS procedures in place by the operator, there were opportunities to capture the failure of the TRPCS bearing before it resulted in the accident. The first detected exceedence of the TGB bearing energy CI was five operational hours before the accident. The HUMS data was downloaded 3.5 operational hours after this initial exceedence, when the helicopter returned its main operating base at Aberdeen at the end of that day’s flying, but the opportunity to detect the impending bearing failure was missed. Overnight, the HUMS data was routinely and automatically sent to the operator’s base in Norway; however, their general review of the data was made on the morning of the accident flight when G-WNSR was already airborne, and by the time they had established that exceedences had occurred, the bearing had already failed. A typical flying day for North Sea operations may exceed 10 operational hours duration during which multiple landings are often made, many of them not at a main operational base. This is more than twice the time between first exceedence

73 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis and the bearing failure and also exceeds the initial‑exceedence‑to‑failure time seen for G-CHCN (4.75 flying hours) and G-REDW (4.62 flying hours). The UK requirement of a maximum time interval between HUMS downloading (and analysis) of 25 flying hours means that failures of this nature could go undetected for several days before the next download (and analysis) is conducted. The operator’s procedures for a maximum time of five flying hours is more stringent than the UK requirements and more likely to detect these types of failures; however, even this reduced interval was in excess of the four flying hours between G-WNSR’s first detected exceedence and bearing failure. Had the exceedence happened at the beginning of the first flight of the day or at the start of a flight following a scheduled download, it would not have been detected before the bearing failed. For an impending and potentially catastrophic failure to be detectable, but for this information to remain unknown to flight crews and maintainers for a significant period, is unacceptable; a more timely method of acquiring, accessing, analysing and promulgating the data needs to be devised and implemented. 2.6.3 Acquisition of VHM data The current method of sampling VHM vibration data from multiple sensors is to take data snapshots by sampling and processing the data of each sensor in turn. Continuous monitoring is not necessarily required to provide effective detection. The AMC to CS 29.1465 prescribes that as a minimum for flights of greater than 30 minutes in stabilised conditions, at least one data set for all the sensors is obtained.  If these stabilised conditions cannot be met then the data set should be acquired ‘at an appropriate rate and quantity for the VHM signal processing to produce robust data for defect detection’. Most of the time is spent in processing the data. For example, sensor data used by the TGB bearing energy CI is sampled for a minimum of 10 seconds and takes about 1.5 minutes to process. It is also one of a number of sensors that are sampled during the cruise phase of flight, and the total time taken to sample data and process the data from all of these sensors is about eight minutes. This means that the individual sensor data available equates to only about 2% of the time in the cruise. In reality it is less than this as data is only sampled if the helicopter is in a steady state condition. This limitation also exists for other sensors collected in other phases of flight such as the hover. Therefore, for the other 98% of the time on the S-92, potential opportunities to detect individual CI exceedences are being missed, and the opportunity for a much earlier indication of an impending and potentially catastrophic failure is lost.

74 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis Therefore, the following Safety Recommendation is made: Safety Recommendation 2018-006 It is recommended that the European Aviation Safety Agency commission research into the development of Vibration Health Monitoring data acquisition and processing, with the aim of reducing the data set capture interval prescribed in the Acceptable Means of Compliance to CS 29.1465 and thereby enhancing the usefulness of VHM data for the timely detection of an impending failure. 2.6.4 Download and analysis of VHM data A typical North Sea flying day contains multiple landings and, as an example, advantage could be taken of time on the ground to download HUMS data. The technology to automatically download data wirelessly from aircraft already exists and is routinely used with fixed wing aircraft for Flight Data Monitoring and Flight Operations Quality Assurance purposes at the conclusion of a flight. In addition to downloading data whilst on the ground, larger commercial transport aircraft use VHF radio or satellite communications to transmit and receive data whilst the aircraft is in flight. Once data has been downloaded, modern VHM software, such as SGBA, can identify exceedences and generate alerts automatically. It is recognised that human intervention will still be required to carry out maintenance action at a later stage for any alerts generated. 2.6.5 Promulgating VHM data With improvements through automatic downloads, analysis and alert generation, significant benefit would be gained by providing this vital safety information to the flight crew of the helicopter so that they can take timely action, as deemed appropriate, to safeguard the helicopter and its occupants. More timely indications to the crew are possible via a cockpit HUMS-pilot interface. For example, in-cockpit HUMS CIs were implemented because of the investigations into the EC225 accidents to G-CHCN and G-REDW to remove a requirement for a maximum of four flying hours between HUMS downloads (and analysis). The HUMS philosophy applied to some UK military helicopter fleets appears more proactive compared to civil operations in that certain exceedences can be displayed and interrogated in the cockpit by the crew and form part of the post-flight and pre-flight procedures. The CAA (paper 2012/01) also recognised the importance of more timely indications to the crew, concluding that ‘on-board, post-flight indications’ are needed to make new technologies, that are able to detect impending failures, effective.

75 Analysis © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 2 - Analysis 2.7 Strengthening the safety barriers In this event, most of the safety barriers were breached and it was only by chance that the outcome was not more severe. The design and certification had not foreseen the unusual mechanism of the TRPCS failure and, although the HUMS had detected an impending problem, that barrier, which required an engineer to correctly interrogate the software to display the exceedence, failed due to the limitations of human performance and the design of the HUMS GS HMI. In the future there may well be other flight critical components in helicopters which fail as a result of unanticipated circumstances, some of these may be detectable in advance by HUMS. The final barrier could have been that of flight crew intervention. However, they too have human performance limits and, as they had no knowledge of, or access to, the detected HUMS exceedences, an opportunity to discontinue the flight was lost. The potential cue of full left pedal travel had not previously been identified by the manufacturer and a review is being undertaken to determine whether this information should be incorporated in the RFM. The investigation identified that had HUMS exceedence data been available on the helicopter in near real-time, the flight crew would have had at least two pre-departure opportunities to safely abort the flight. Additionally, should G-WNSR have had such a capability, it is considered likely that, after the initial incident and re-land on the Elgin, the flight crew would have made use of it and that it would have informed their judgement as to whether to depart for the West Franklin. Furthermore, given the circumstances of this event and the short timescale over which the problem developed, providing flight crews with a simple means to establish the health and serviceability of their helicopter whilst away from a maintenance base could be the only effective barrier remaining to prevent an accident. Therefore, the following Safety Recommendation is made: Safety Recommendation 2018-007 It is recommended that the European Aviation Safety Agency amend the regulatory requirements to require that Vibration Health Monitoring data gathered on helicopters is analysed in near real‑time, and that the presence of any exceedence detected is made available to the flight crew on the helicopter; as a minimum, this information should be available at least before takeoff and after landing.

Intentionally left blank

77 Conclusions Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 3 - Conclusions 3 Conclusions 3.1 Findings

The helicopter was equipped with HUMS and its use by the operator as part of its maintenance programme satisfied the regulatory requirements for helicopter VHM.

The operator’s HUMS procedures stipulated a maximum of five flying hours between HUMS downloads rather than the maximum of 25 flying hours required by the UK Regulations, but even this reduced interval would not necessarily provide timely warning of impending TRPCS bearing failure.

The IMD GS software was in two distinct parts that had different interface characteristics for identifying and alerting exceedences to the user which led to a situation whereby an exceedence was missed.

Checks of the TGB bearing energy CI were routinely carried out by the maintenance personnel despite the omission of this step in the flowchart within the operator’s documented HUMS S-92A download procedures.

The HUMS detected a failing TRPCS bearing.

The time between detectable degradation of the bearing by HUMS and failure of the bearing was four flying hours.

Due to an anomaly in the way that exceedences are viewed in the main IMD GS software and the GS ToolBar by maintenance personnel, coupled with the limitations in human performance, the HUMS exceedence was not identified during routine maintenance and the helicopter was released to service.

By the time that the HUMS data was reviewed by a second organisation the TRPCS bearing had already failed.

The pilots were properly licensed, qualified and sufficiently rested to conduct the flight.

There was no in-flight indication to the crew of the impending bearing failure before the landing on the Elgin.

78 Conclusions Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 3 - Conclusions

During the departure from the Elgin helideck, the helicopter did not respond as expected to the commander’s yaw pedal inputs, including the use of full left yaw pedal. Following a satisfactory check of the yaw control response, this was attributed to a wind effect and the final opportunity to terminate the flight was missed. However, it was established during the investigation that the event was due to the degraded condition of the TRPCS bearing.

A review of the historic S-92 fleet data by the manufacturer established that the use of full yaw pedal is a rare event in flight.

The TRPCS bearing failed whilst the helicopter was in flight.

The TRPCS bearing failure precipitated damage to the TR servo. This damage manifested itself during the landing on the West Franklin helideck.

The TR servo primary piston fractured within the secondary piston sleeve and not, as previously anticipated, in the threaded portion of the clevis.

The fracture of the servo primary piston disconnected the feedback pivot of the walking beam, resulting in loss of control of the TR servo.

The flight crew reacted expeditiously to an uncontrollable yaw whilst landing on the West Franklin helideck.

The helideck surface was punctured during the abnormal landing, but this did not adversely affect the outcome of this accident.

There were no injuries.

If the loss of yaw control had occurred at an earlier stage of the flight, the helicopter would most likely have made an uncontrolled descent into the North Sea.

The helicopter operator filed an MOR with the CAA on the day of the accident. However, when further evidence became available as to the seriousness of the event, it was not reported to the AAIB as it should have been.

The helideck operator was unaware of their responsibility to report an accident to the AAIB.

The TRPCS bearing was too badly damaged to determine the reason for its failure.

79 Conclusions Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Section 3 - Conclusions

Additional inspections on in-service TRPCSs were introduced and, as a result, a number were returned to the manufacturer for further investigation. Of those bearings, 18 did not exhibit unusual or advanced wear or degradation, but one exhibited roller wear and unusual indications on the outer race.

Despite extensive and prolonged testing of the returned TRPCSs, the manufacturer could not reproduce a TRPCS bearing failure.

The current VHM regulatory requirements for the maximum interval between data downloads (and analysis) are ineffective for detection of imminent in-service component failures.

The yaw event on the Elgin was not captured by HUMS.

The low frequency of data capture from individual VHM sensors means that, for the majority of the time, they are not utilised and opportunities to detect problems are missed. 3.2 Causal factors The investigation identified the following causal factors to the loss of yaw control: ● ● The TRPCS bearing failed for an undetermined reason. ● ● The TRPCS bearing failure precipitated damage to the tail rotor pitch control servo. 3.3 Contributory factors The investigation identified the following contributory factors: ● ● Impending failure of the TRPCS bearing was detected by HUMS but was not identified during routine maintenance due to human performance limitations and the design of the HUMS Ground Station Human Machine Interface. ● ● The HUMS Ground Station software in use at the time had a previously-unidentified and undocumented anomaly in the way that data could be viewed by maintenance personnel. The method for viewing data recommended in the manufacturer’s user guide was not always used by maintenance personnel.

Intentionally left blank

81 Safety Recommendations © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 4 - Safety Recommmedations 4 Safety Recommendations 4.1 Safety Recommendations The following Safety Recommendations have been made: Safety Recommendation 2018-006 It is recommended that the European Aviation Safety Agency commission research into the development of Vibration Health Monitoring data acquisition and processing, with the aim of reducing the data set capture interval prescribed in the Acceptable Means of Compliance to CS 29.1465 and thereby enhancing the usefulness of VHM data for the timely detection of an impending failure. Safety Recommendation 2018-007 It is recommended that the European Aviation Safety Agency amend the regulatory requirements to require that Vibration Health Monitoring data gathered on helicopters is analysed in near real‑time, and that the presence of any exceedence detected is made available to the flight crew on the helicopter; as a minimum, this information should be available at least before takeoff and after landing. 4.2 Summary of safety actions AAIB Special Bulletin The AAIB published Special Bulletin S1-2017 which provided the initial facts of this investigation. The Special Bulletin and this report present the following safety actions: Safety action by the helicopter operator The operator subsequently introduced a number of measures to further strengthen the ability to detect impending bearing degradation. These included: a review of all HUMS data to ensure no anomalies, fleet-wide borescope inspections and a requirement for HUMS to be serviceable before flight. The operator also reviewed their HUMS processes and analytical procedures, correcting the omission in the documentation of the use of the IMD‑HUMS ToolBar analysis tools. They also introduced a requirement for an additional assurance check to be carried out by a second licensed engineer prior to releasing the helicopter to service.

82 Safety Recommendations © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 4 - Safety Recommmedations Safety action by the helicopter manufacturer On 31 December 2016 the helicopter manufacturer issued to all operators an ‘All Operators Letter’ (AOL), CCS-92-AOL-16-0019, which described the event. It emphasised the use of the HUMS Tail Gearbox Bearing Energy Tool, provided on the ground station, to detect a TRPCS bearing that is experiencing degradation, and recommended that this tool was utilised as often as reasonably possible. ASB 92-64-011 was issued by the manufacturer on 10 January 2017 and introduced a once-only inspection of the TRPCS and bearing assembly for ratcheting, binding, or rough turning. It also called for a review of the HUMS Tail Gearbox Bearing Energy Tool. The manufacturer recommended that compliance was essential and to be accomplished prior to the next flight from a maintenance facility; three flight hours are allowed in order to return directly to a maintenance facility. The once-only inspection was mandated by FAA Airworthiness Directive (FAA AD) 2017-02-51 issued on 13 January 2017 and added a requirement to carry out a 10-hourly borescope inspection of the bearing in situ until further notice. Concurrent with the release of ASB 92-64-011, the manufacturer published Temporary Revision 45-03 to require operators to use S-92A HUMS ground station software to review Tail Rotor Gearbox energy analysis CIs for alert conditions on a reduced flight hour interval. CIs in excess of published alert levels required inspection of the pitch change shaft and bearing. The manufacturer developed a temperature sensing plug which could be retrofitted to in-service TRPCSs to establish fleet-wide trends. The temperature sensing plug installation was carried out under the authority of ASB 92-64-012, issued on 9 March 2017 with a scheduled compliance date of 13 April 2017. On 24 March 2017 the manufacture issued All Operators Letter CCS-ALL-AOL-17-0008 to remind users of the IMD software of the approved zoom and undo zoom commands for interrogating the HUMS CI data. It also informed users that the IMD software would be obsolete in the near future and that the maintenance manual revisions for the SGBA were now available. The helicopter manufacturer has worked with the bearing manufacturer to identify and implement a number of improvements

83 Safety Recommendations © Crown Copyright 2018 Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 Section 4 - Safety Recommmedations to the bearing manufacturing process. An improved end play measuring tool has been introduced in order to carry out more accurate measurement and bearing setting up during assembly. The grease is now drawn from sealed cartridges and injected into the races using a syringe to ensure a more consistent distribution. The bearing is also now weighed before and after grease application. Safety action by the helideck operator Since the accident the ‘Helicopter Occurrence - Communication Process’ procedures for the helideck operator’s UK operations have been revised to include a requirement to report an accident or serious incident to the AAIB. Helideck certification safety action The Helideck Certification Agency will bring this case to the attention of the CAA and the ICAO HDWG to consider whether the assumptions used in the regulations remain valid in the light of this accident.

Intentionally left blank

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix A 85 Appendix A Tail rotor malfunctions and associated emergency procedures applicable at the time of the event RFM emergency procedures related to ‘uncommanded yaw’. 11.1 LOSS OF TAIL ROTOR THRUST IN FORWARD FLIGHT Symptoms: Uncommanded sharp right yaw, unresponsive to pedal inputs. Action:

Enter autorotation.

Maintain 80 to 100 KIAS.

LDG GEAR – DOWN.

Throttles – STOP prior to touchdown. 11.2 LOSS OF TAIL ROTOR THRUST IN A HOVER Symptoms: Uncommanded sharp right yaw/spin, unresponsive to pedal inputs. Action:

Hold the aircraft in level attitude, attempt to achieve zero groundspeed and drift in a low hover.

Throttles – STOP (5 to 10 feet).

Collective – Increase to cushion landing. After ground contact:

Lower collective to minimum.

Apply wheel brakes.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix A 86 Appendix A (Cont) Emergency Checklist references to ‘uncontrolled yaw’.    

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix A 87 Appendix A (Cont)  

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix B 88 Appendix B Elgin Helideck Landing Area Certificate, Helideck Information Plate and Temporary Limitations Notice 15-2016

HELICOPTER LANDING AREA CERTIFICATE

Copyright HCA

Elgin PUQ

The above named helideck has been inspected in accordance with CAP 437, BSL D 5-1, and HCA requirements for Offshore Helidecks.

The helideck has been found suitable for helicopter operations subject to:

Such non-compliances and restrictions as may be listed below; and,

Authorization by the helicopter operator. Wind (T°) Kts Limitation /Comment • • 015-055

• • 0-15 Platform • Possible turbulence from Turbine Exhaust and Exhaust Stack • Table 1 (T) for all operations due to anti turbulence panels.

Non Compliance 210° Handrail @ 1.1m South East sector (Parking area) Securing eyes for NDB aerial attached to Perimeter net supports 300mm above deck level 5:1 Anti turbulence panels around outboard perimeter Misc Shuttle Aircraft or Containers may be in Parking Area, check clearance from SLA.

Valid for helicopters with:

Maximum ‘D’ value: ‘D’ = 22.8

Maximum take-off weight:

‘t’ = 15.0

This certification shall remain in force until (unless previously revoked or suspended)

10th January 2017

Notes:

This certificate is non-transferable.

The certificate holder is responsible for ensuring that the helideck, its environs and related equipment are at all times fit for purpose and that the helideck crew are suitably qualified, equipped and trained in the exercise of their duties.

This certificate shall cease to be valid if:  Changes of ownership or name of installation/vessel are made without notification to the HCA.  Changes to the helideck, its environs and/or related equipment are made without prior agreement of the HCA.  Levels of Helideck crew qualifications/competency are not maintained to the levels described in the UKOOA Guidelines for Management of Offshore Helidecks or suitable alternative standards.

Any proposed changes are to be accompanied by drawings in plan and elevation with photographs where possible, particularly when such changes concern:  Modification to installation/vessel physical characteristics within the 150°, 210° and 180° falling gradient obstacle protected surfaces; and/or structural modifications to other areas of the installation/vessel that may affect or alter the airflow or turbulence experienced over the helideck 5 The Norwegian 1.25D requirement is only relevant to vessels constructed ( keel laid ) after 1 January 2008. Alex Knight

Date: 27th September 2016

Helideck Certification Agency

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix B 89 Appendix B (Cont)

HELIDECK INFORMATION PLATE

HELIDECK Elev 166 ft VAR 3 W POSITION N57.00.7 E001.50.2

Elgin PUQ HEIGHT OF INSTALLATION: 509 HIGHEST OBSTACLE WITHIN 5NM: Top of Rig VHF

NDB EGN 421.5 Issue Date 09 Dec 2014 FUELLING INSTALLATION: Yes STARTING EQUIPTMENT: Yes Operating Company

Total Issued By

Helideck Certification Agency (Norway 1.25D - ‘D’ = ) HELIDECK D value: 22.8 P/R/H Category: F Max Weight: 15.0

Wind (T°) Kts Limitation /Comment • • 015-055

• • 0-15 Platform • Possible turbulence from Turbine Exhaust and Exhaust Stack • Due to turbulence panels AS332 - Hover with nose wheel near to deck edge - Nil limitation S76 - Table 1 (T) Other types - TBA

Non Compliance 210° Handrail @ 1.1m South East sector (Parking area) Securing eyes for NDB aerial attached to Perimeter net supports 300mm above deck level 5:1 Anti turbulence panels around outboard perimeter Misc Shuttle Aircraft or Containers may be in Parking Area, check clearance from SLA.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix B 90 Appendix B (Cont)

HLL Temporary Limitations Notice

Form 09 Rev 00

Apr 09

TO: ALL PILOTS DATE: 9 May 2016 TLN NUMBER: 15 - 2016

SUBJECT: Galaxy 1 and Prospector 5 Rigs alongside Elgin Wellhead Platforms

Comments The Galaxy 1 and Prospector 5 Jack-up rigs will be repositioning at the Elgin Wellhead Platform. The Galaxy 1 will be stationed on the south side of the Elgin WHPA and the Prospector 5 will be stationed on the north side of the Elgin WHPB as per the diagram below. As an interim measure and until such time as FDM Turbulence analysis has been completed the following restrictions are to be applied when operating to the Galaxy 1 and Prospector 5 Heli-deck.

Please ensure that you remain compliant with PC2E and PC2DLE as applicable.

Photo/Dwg Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix C 91 Appendix C West Franklin Helideck Landing Area Certificate and Helideck Information Plate

HELICOPTER LANDING AREA CERTIFICATE

Copyright HCA

West Franklin

The above named helideck has been inspected in accordance with CAP 437, BSL D 5-1, and HCA requirements for Offshore Helidecks.

The helideck has been found suitable for helicopter operations subject to:

Such non-compliances and restrictions as may be listed below; and,

Authorization by the helicopter operator. Wind (T°) Kts Limitation /Comment

NUI • Circle and H lights fitted

Non Compliance

Valid for helicopters with:

Maximum ‘D’ value: ‘D’ = 21

Maximum take-off weight:

‘t’ = 12.8

This certification shall remain in force until (unless previously revoked or suspended)

09/09/2017

Notes:

This certificate is non-transferable.

The certificate holder is responsible for ensuring that the helideck, its environs and related equipment are at all times fit for purpose and that the helideck crew are suitably qualified, equipped and trained in the exercise of their duties.

This certificate shall cease to be valid if:  Changes of ownership or name of installation/vessel are made without notification to the HCA.  Changes to the helideck, its environs and/or related equipment are made without prior agreement of the HCA.  Levels of Helideck crew qualifications/competency are not maintained to the levels described in the UKOOA Guidelines for Management of Offshore Helidecks or suitable alternative standards.

Any proposed changes are to be accompanied by drawings in plan and elevation with photographs where possible, particularly when such changes concern:  Modification to installation/vessel physical characteristics within the 150°, 210° and 180° falling gradient obstacle protected surfaces; and/or structural modifications to other areas of the installation/vessel that may affect or alter the airflow or turbulence experienced over the helideck 5 The Norwegian 1.25D requirement is only relevant to vessels constructed ( keel laid ) after 1 January 2008. Alex Knight

Date: 14/11/2016

Helideck Certification Agency

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix C (Cont) Appendix C 92

HELIDECK INFORMATION PLATE

HELIDECK Elev 140 ft VAR 4° W POSITION N 56.57.47 –E 001.48.22

West Franklin HEIGHT OF INSTALLATION: 204 HIGHEST OBSTACLE WITHIN 5NM: Check VHF Tr 122.325 Log 129.7 NDB

Issue Date 14 Nov 2016 FUELLING INSTALLATION: No STARTING EQUIPMENT: No Operating Company

Total Issued By

Helideck Certification Agency HELIDECK D value: 21.0m P/R/H Category: F Max Weight: 12.8 t

No photo available

Wind (T°) Kts Limitation /Comment

NUI • Circle and H lights fitted

Non Compliance

Nil

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix D 93 Appendix D Sikorsky Temporary Revision 45-03 MAINTENANCE MANUAL, SA S92A-AMM-000 TEMPORARY REVISION NO. 45-03

FILING INSTRUCTIONS: Insert in Task 45-45-10-710-001, HUMS Displayed Exceedances and Associated Maintenance Actions, immediately following page 163/164, dated Nov 30/16.

SUBJECT: Review of Tail Gear Box (TGB) Bearing Energy HUMS Tool

This temporary revision adds new Section 11. Review of TGB Bearing Energy HUMS Tool to Task 45-45-10- 710-001, HUMS Displayed Exceedances and Associated Maintenance Actions, dated Nov 30/16.

MANUAL CHANGES:

In Task 45-45-10-710-001, HUMS Displayed Exceedances and Associated Maintenance Actions, dated Nov 30/16, add new Section 11. Review of TGB Bearing Energy HUMS Tool as follows:

• Review of Tail Gear Box (TGB) Bearing Energy HUMS Tool.

A. The following review shall be performed as follows: NOTE: A functioning TGB mechanical diagnostic function of the HUMS is required.

(1) If using IMD and TGB energy analysis software contained in the standalone software tool for the S- 92 HUMS GS, a review shall be accomplished every three (3) flight hours. (2) If using Sikorsky Ground Based Application (SGBA) TGB bearing energy tool version released prior to January 10, 2017, a review shall be accomplished every three (3) flight hours. (3) If using SGBA TGB bearing energy tool version released on or after January 10, 2017, a review shall be accomplished every six (6) flight hours. (4) If customer seeks extension to six (6) flight hours and are using methods one (1) or two (2) above contact Aircraft on Ground (AOG) Center at 1-800-WINGED-S or Email: sikorsky.aog@lmco.com. B. For users with Integrated Mechanical Diagnostics (IMD) bearing energy tool, review the HUMS Tail Gear Box Bearing Energy Tool per the HUMS user guide, SA S92A-HUM-000, Chapter 11.4 with the following exceptions:

(1) A condition indicator (CI) exceedance of 1.75 for any one data point shall require inspection per AMM Task 64-22-03-290-001 “Off AC Inspection of TR PCS Bearing Assembly”, steps A.(6)(j) thru A.(6)(o) and contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com . Submit any findings to local Sikorsky FSR. C. For users with the SGBA HUMS Toolbar, review the HUMS Tail Gearbox Bearing Energy Tool per the Sikorsky Ground Based Application (SGBA) Users Guide, SA S92A-GBA-000, Chapter 15.5 with the following additions:

WARNING: THIS DOCUMENT, OR AN EMBODIMENT OF IT IN ANY MEDIA, DISCLOSES INFORMATION WHICH IS PROPRIETARY, IS THE PROPERTY OF SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES, IS AN UNPUBLISHED WORK PROTECTED UNDER APPLICABLE COPYRIGHT LAWS, AND IS DELIVERED ON THE EXPRESS CONDITION THAT IT IS NOT TO BE USED, DISCLOSED, REPRODUCED, IN WHOLE OR IN PART (INCLUDING REPRODUCTION AS A DERIVATIVE WORK), OR USED FOR MANUFACTURE FOR ANYONE OTHER THAN SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES WITHOUT ITS WRITTEN CONSENT, AND THAT NO RIGHT IS GRANTED TO DISCLOSE OR SO USE ANY INFORMATION CONTAINED HEREIN. ALL RIGHTS RESERVED. ANY ACT IN VIOLATION OF APPLICABLE LAW MAY RESULT IN CIVIL AND CRIMINAL PENALTIES. 45-45-10 Page 1 of 4 Jan 10/17

Temporary Revision 45-03 WARNING ‒ This document contains technical data subject to the EAR. Authorization is required prior to providing this technical data to any company, entity, person, or destination. EAR Export Classification: ECCN EAR99

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix D 94 Appendix D (Cont) MAINTENANCE MANUAL, SA S92A-AMM-000 WARNING: A CI RATIO GREATER THAN 1.75 WILL NOT AUTOMATICALLY DISPLAY AS AN ALERT.

(1) This automated TGB Bearing Energy Analysis software consists of the following four steps: (a) The 15-20 kHz energy data for a specific helicopter tail number is extracted from the HUMS Ground Station Software (GSS) Raw Data Files (RDFs). This 15-20 kHz energy is referred to as a CI. (b) The average 15-20 kHz energy is computed for that helicopter tail number since the last maintenance date. This date is important, since removing/replacing the TGB, the pitch change shaft assembly, or the TGB accelerometer can change the absolute value of the CI. (c) The 15-20 kHz energy is normalized by the helicopter-specific mean. This normalized energy is referred to as the “CI ratio”. The intent of the software is create a baseline for the helicopter that is nominally at 1.0. The baseline data consists of 200 points. If 200 points have not been collected since the last maintenance date the tool will indicate “Insufficient Data”. (d) The trend history for the normalized energy is plotted for each specific tail number. The limit threshold for this normalized data is 1.75. NOTE: The current alert limit display of 2.5 should not be used and will be updated in the next release. The 1.75 alert limit exceedance will not automatically display as an alert until the next release. NOTE: See Figure 129 for example of exceedance requiring maintenance inspection. Note data prior to exceedance is nominally centered around 1.0 indicating good baseline data. (2) A condition indicator (CI) exceedance of 1.75 for any one data point shall require inspection per AMM Task 64-22-03-290-001 “Off AC Inspection of TRPCS Bearing Assembly”, steps A.(6)(j) thru A.(6)(o) and contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com . Submit any findings to local Sikorsky FSR.

WARNING: THIS DOCUMENT, OR AN EMBODIMENT OF IT IN ANY MEDIA, DISCLOSES INFORMATION WHICH IS PROPRIETARY, IS THE PROPERTY OF SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES, IS AN UNPUBLISHED WORK PROTECTED UNDER APPLICABLE COPYRIGHT LAWS, AND IS DELIVERED ON THE EXPRESS CONDITION THAT IT IS NOT TO BE USED, DISCLOSED, REPRODUCED, IN WHOLE OR IN PART (INCLUDING REPRODUCTION AS A DERIVATIVE WORK), OR USED FOR MANUFACTURE FOR ANYONE OTHER THAN SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES WITHOUT ITS WRITTEN CONSENT, AND THAT NO RIGHT IS GRANTED TO DISCLOSE OR SO USE ANY INFORMATION CONTAINED HEREIN. ALL RIGHTS RESERVED. ANY ACT IN VIOLATION OF APPLICABLE LAW MAY RESULT IN CIVIL AND CRIMINAL PENALTIES. 45-45-10 Page 2 of 4 Jan 10/17

Temporary Revision 45-03 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix D 95 Appendix D (Cont) MAINTENANCE MANUAL, SA S92A-AMM-000

Figure 129. Example of Recorded Exceedence of TRPCS that Requires Maintenance. WARNING: A CI RATIO GREATER THAN 1.75 WILL NOT AUTOMATICALLY DISPLAY AS AN ALERT. NOTE: The 1.75 limit may be manually defined as a threshold. WARNING: THIS DOCUMENT, OR AN EMBODIMENT OF IT IN ANY MEDIA, DISCLOSES INFORMATION WHICH IS PROPRIETARY, IS THE PROPERTY OF SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES, IS AN UNPUBLISHED WORK PROTECTED UNDER APPLICABLE COPYRIGHT LAWS, AND IS DELIVERED ON THE EXPRESS CONDITION THAT IT IS NOT TO BE USED, DISCLOSED, REPRODUCED, IN WHOLE OR IN PART (INCLUDING REPRODUCTION AS A DERIVATIVE WORK), OR USED FOR MANUFACTURE FOR ANYONE OTHER THAN SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES WITHOUT ITS WRITTEN CONSENT, AND THAT NO RIGHT IS GRANTED TO DISCLOSE OR SO USE ANY INFORMATION CONTAINED HEREIN. ALL RIGHTS RESERVED. ANY ACT IN VIOLATION OF APPLICABLE LAW MAY RESULT IN CIVIL AND CRIMINAL PENALTIES. 45-45-10 Page 3 of 4 Jan 10/17

Temporary Revision 45-03 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix D 96 Appendix D (Cont)

Temporary Revision 45-03 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix E 97 Appendix E Sikorsky All Operators Letter CCS-ALL-AOL-17-0008 dated 24 March 2017 Lockheed Martin Proprietary Information

Lockheed Martin Proprietary Information

This document does not contain any export controlled technical data. S-92® and S-76D™ are registered trademarks of Sikorsky, a Lockheed Martin Company. Sikorsky, a Lockheed Martin Company 6900 Main Street P.O. Box 9729 Stratford, Connecticut 06615-9129

March 24, 2017 CCS-ALL-AOL-17-0008

To: All S-92® and S-76D™ Operators All Service Centers All Field Service Representatives Attention: Aviation Director Chief of Maintenance Chief Helicopter Pilot Subject: IMD Software Ref: (A) HUMS Users Guide for Sikorsky Helicopter Model S-92A, SA S92A-HUM-000 (B) HUMS Users Guide for Sikorsky Helicopter Model S-76D, SA S76D-HUM-000 (C) Sikorsky Ground Based Application (SGBA) Users Guide for Sikorsky Helicopter Models S-92 AND S-76D, SA S92A-GBA-000

The S-92 and S-76D Health and Usage Monitoring System ground stations have 2 software versions available for use by our operators: Integrated Mechanical Diagnostics (IMD); and, Sikorsky Ground Based Application (SGBA). SGBA software was released with the intention to render the original IMD ground station software obsolete in the near future.

Sikorsky released S-92 maintenance manual revisions March 9, 2017 to support customers fully transitioning from IMD to SGBA. There are many enhanced features of SGBA, including enhanced diagnostics capabilities and improved user interfaces. The following figures depict some of the enhancements in SGBA, including color-keyed visual indicators that highlight inspection requirements.

This AOL is issued to follow up on findings from the December 2016 S-92 Tail Rotor Pitch Change Shaft incident and is not connected to the tragic accident involving a Search & Rescue S-92 in Ireland earlier this month (reference CCS-92-AOL-17-0012, S-92 Helicopter Accident Notification).

The importance of technicians easily and consistently identifying any (potential) anomaly using the HUMS ground station software is clear – the aim of this AOL is to support success in this area. It has been noted that when the IMD HUMS Toolbar or strip charts display a large number of data

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix E (Cont) Appendix E 98 Lockheed Martin Proprietary Information Lockheed Martin Proprietary Information 2 points, the data becomes compacted and some data points may potentially be obscured on the right side of the graph. This may result in a rapidly rising trend being less readily apparent to the technician reviewing the data. IMD HUMS Toolbar and strip charts are presented based on user selected parameters, and by default, are set up to display Parameter(s) versus Time, with the unit of time set to Calendar. The parameter scales are automatically generated based on the magnitude of the largest and smallest parameters within the Time range. The most recent data will be presented near or aligned with the right frame of the strip chart report. In cases where the displayed parameter has trended above a threshold only in the most recent flight records, the magnitude of the recent data may not be apparent without zooming in to view the data with a reduced timescale. In this latter case threshold or alert levels will be biased towards the bottom of the parameter scale in direct relation to the magnitude of the maximum parameter. The following figure illustrates the conditions described above: most recent data presented near or aligned with right frame; expanded parameter scale; and, alert reference line biased towards bottom of chart. IMD software permits zooming in and out with specific commands described in Chapter 9.1 of the HUMS User Guide referenced above and reproduced below. A. Zoom Note: Only works on unstacked graphs (a) Position the cursor over the portion of the graph you wish to enlarge. (b) Click and hold the left mouse button and drag the magnifier box (faint white outline) down and right over the region to be enlarged (See following figure). 1 2 3 This page does not contain export controlled technical data

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix E (Cont) Appendix E 99 Lockheed Martin Proprietary Information Lockheed Martin Proprietary Information 3 (c) Release the mouse button to display the area inside the magnifier box. (See following figure). (d) Continue to Zoom in on the desired area of the graph. The entire graph will be enlarged but the area of interest will remain in view. (e) Once the graph has been zoomed to the desired size, the entire graph may be viewed by holding the right mouse button down and dragging the graph left and right or up and down. B. Undo Zoom (a) Position the cursor in the lower right of the graph, and while holding the left mouse button down, drag the cursor to the upper left and release. The graph will return to its normal size. Several IMD functions enable alternate Zoom and undo Zoom commands, including vibration diagnostics (vibe data) interface, RTB interface, and TR Bearing Energy Analysis tool. These functions permit Undo This page does not contain export controlled technical data

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix E (Cont) Appendix E 100 Lockheed Martin Proprietary Information Lockheed Martin Proprietary Information 4 Zoom commands to also be entered by selecting data from Lower-Right to Upper-Left and Lower-Left to Upper-Right & Upper-Right to Lower-Left. Sikorsky recommends that all technicians analyzing S-92 or S-76 aircraft HUMS data using the IMD software use standardized procedures to Zoom (see section A above) and Undo Zoom (see section B above) function to ensure effective post-flight data analysis. Routinely zoom in on the very latest data, to ensure that any parameter trend deviation is readily identifiable. Further, Sikorsky encourages all operators to promptly transition to the SGBA ground station, in advance of IMD obsolescence. Sikorsky will continue to update only SGBA software with new advanced diagnostic tools. Please contact your Sikorsky Field Service Representative with any questions that you may have on this topic. Very truly yours, Timothy Fox Chief Engineer Sikorsky, a Lockheed Martin Company This page does not contain export controlled technical data

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix F 101 Appendix F Sikorsky All Operators Letter CCS-92-AOL-16-0019 dated 31 December 2016

Sikorsky 6900 Main Street P.O. Box 9729 Stratford, Connecticut 06615-9129

December 31, 2016 CCS-92-AOL-16-0019

To: All S-92® Operators All Service Centers All Field Service Representatives Attention: Aviation Director Chief of Maintenance Chief Helicopter Pilot

Subject: Follow Up: S-92 Aircraft Incident Notification

As previously notified, Sikorsky is offering additional information to our operators regarding the S-92 event on December 28. The technical issue that resulted in the helicopter unscheduled landing on an oil and gas installation platform in the North Sea has been identified as a loss of tail rotor authority.

The condition involved a degradation of the Tail Rotor Pitch Change Shaft (TRPCS) bearing. Although the failure condition presents a loss of control authority, it does not result in a loss of tail rotor drive or tail rotor thrust. Initial review of the actions taken by the crew indicate that appropriate standard emergency procedure was used, which resulted in the safe landing without any injuries to passengers or crew.

The specific root cause determination is in the early stages of investigation, and the components involved are en route to our facility in Connecticut for detailed laboratory analysis. The aircraft did not otherwise experience significant damage and is expected to be returned to service following replacement of the affected components.

We note that two recent Alert Service Bulletins were issued regarding the TRPCS (ASB-92-64-009 and ASB-92-64-010, issued in Nov and Dec 2016 respectively). A review of the information confirms that neither of the ASB’s were applicable to this particular TRPCS. The bearing design has proven to be a highly reliable component in the more than one million fleet hours of global S-92 service. Regardless of their impact on the recent event, Sikorsky recommends all operators ensure compliance to the two Alert Service Bulletins listed above.

Additionally, Sikorsky continues to work with the operator on reviewing data obtained from our on- board Health and Usage Monitoring System (HUMS). The parametric and vibration data is being reviewed from this occurrence to determine if any operational improvements can be made. We remind our operators that the HUMS data from each S-92 helicopter should be processed regularly through the available Groundstation, and that all available HUMS Mechanical Diagnostic Tools should be used as often as reasonably possible. Many of our operators have reported success in utilizing Diagnostic Tools more frequently, such as prior to every departure from the aircraft base. Sikorsky developed these tools for use as part of successful maintenance programs, and recommends their use as often as reasonably possible.

Sikorsky recommends specific emphasis on utilization of the HUMS Tail Gearbox Bearing Energy Tool. This Tool will detect a PCS bearing that is experiencing degradation. The Tail Gearbox Energy Tool should be processed through the available Groundstation as often as reasonably possible.

Sikorsky will be planning an operator Webcast shortly to discuss this matter. We will further communicate findings if the investigation reveals any safety or airworthiness issues that affect the S-92 helicopter fleet.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 102 Appendix G Sikorsky ASB 92-64-011 dated 10 January 2017 ATA 64-22-03 ONE-TIME INSPECTION S-92® HELICOPTER ALERT SERVICE BULLETIN NOTICE TO ALL PERSONS RECEIVING THIS DOCUMENT: WARNING: THIS DOCUMENT, OR AN EMBODIMENT OF IT IN ANY MEDIA, DISCLOSES INFORMATION WHICH IS PROPRIETARY, IS THE PROPERTY OF SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES, IS AN UNPUBLISHED WORK PROTECTED UNDER APPLICABLE COPYRIGHT LAWS, AND IS DELIVERED ON THE EXPRESS CONDITION THAT IT IS NOT TO BE USED, DISCLOSED, REPRODUCED, IN WHOLE OR IN PART (INCLUDING REPRODUCTION AS A DERIVATIVE WORK), OR USED FOR MANUFACTURE FOR ANYONE OTHER THAN SIKORSKY AIRCRAFT CORPORATION AND/OR ITS SUBSIDIARIES WITHOUT ITS WRITTEN CONSENT, AND THAT NO RIGHT IS GRANTED TO DISCLOSE OR SO USE ANY INFORMATION CONTAINED HEREIN. ALL RIGHTS RESERVED. ANY ACT IN VIOLATION OF APPLICABLE LAW MAY RESULT IN CIVIL AND CRIMINAL PENALTIES. S-92® IS A REGISTERED TRADEMARK OF SIKORSKY AIRCRAFT CORPORATION. ASB 92-64-011 Basic Issue ▪January 10/17 SUBJECT: TAIL ROTOR – Tail Rotor Pitch Change Shaft Bearing Assembly – One-Time Inspection of Tail Rotor Pitch Change Shaft (TRPCS) and Bearing Assembly for Ratcheting, Binding, or Rough Turning Section 1. PLANNING INFORMATION A. Effectivity All S-92A model helicopters with TRPCS assembly (92358-06303-041 and/or - 042) installed, including spares, delivered as of the issue date of this Alert Service Bulletin (ASB). B. Purpose To provide instructions for a one-time inspection of TRPCS and bearing assembly for ratcheting, binding, or rough turning. C. Description Helicopter records and log cards are reviewed. Helicopter is prepared for maintenance. TRPCS and bearing assembly is removed from helicopter and inspected, including spares. Tail Gear Box (TGB) bearing energy HUMS tool is reviewed. If TRPCS and bearing assembly fails inspection, it is returned to Sikorsky Commercial Inc. (SCI) for evaluation, and replaced with a serviceable TRPCS and bearing assembly. If TRPCS and bearing assembly passes inspection, reinstall TRPCS and bearing assembly. TGB Bearing Energy Tool maintenance date shall not be updated or reset. Helicopter is returned to service. Sikorsky Aircraft Corporation 6900 Main Street P.O. Box 9729 Stratford, Connecticut 06615-9129 (203) 386-4000 Page 1 of 8 WARNING ‒ This document contains technical data subject to the EAR. Authorization is required prior to providing this technical data to any company, entity, person, or destination. EAR Export Classification: ECCN EAR99

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 103 Appendix G (Cont) S-92 ALERT ASB 92-64-011 SERVICE BULLETIN Basic Issue ▪January 10/17 ATA 64-22-03 ONE-TIME INSPECTION Section 1. PLANNING lNFORMATION (Continued) D. Compliance Compliance is essential. The instructions outlined herein shall be accomplished prior to next flight originating from a maintenance facility, not to exceed 30 days from the issue date of this ASB. • If TRPCS and bearing assembly was manufactured, repaired or overhauled after November 2, 2016, the instructions outlined Section 3., step C.(1) shall be accomplished within ten (10) flight hours. • If helicopter(s) is not at a maintenance facility, three (3) flight hours are allowed in order to return directly to a maintenance facility. If three (3) hours are not sufficient, contact Sikorsky Aircraft Customer Service Engineering at 1-800- WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com for further guidance. • Helicopter(s) involved in emergency services operation, contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com for guidance regarding compliance time extension for the inspections herein. • If the instructions outlined in Section 3., step C.(1) were accomplished within the previous three (3) flight hours, they do not need to be repeated. E. Approval Inspection item. F. Manpower (Estimated) Task No. of Men No. of Hours Man-Hours* Removal of Tail Rotor Pitch Beam 1 1.0 1.0 Removal of Tail Rotor Servo 2 1.0 2.0 Removal of TRPCS 1 1.0 1.0 Do TRPCS and Bearing Assembly Inspection 1 1.0 1.0 Installation of TRPCS and Bearing Assembly 1 1.0 1.0 Installation of Tail Rotor Servo 2 2.0 4.0 Installation of Tail Rotor Pitch Beam 1 1.0 1.0 Total Man-Hours 11.0 *Estimate does not include time required to prepare helicopter or return it to flight status. G. Tooling None. Page 2 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 104 Appendix G (Cont) ASB 92-64-011 S-92 ALERT Basic Issue ▪ January 10/17 SERVICE BULLETIN ATA 64-22-03 ONE-TIME INSPECTION Section 1. PLANNING lNFORMATION (Continued) H. Weight and Balance Not affected. I. Electrical Load Data Not affected. J. Software Load Data Not changed. K. References (1) ASB 92-64-009, One-Time Inspection of Tail Rotor Pitch Change Shaft (TRPCS) and Bearing Assembly for Improper Axial Play, latest revision. (2) HUMS User Guide, SA S92A-HUM-000, Chapter 11.4 (15). (3) Maintenance Manual, SA S92A-AMM-000, Task 64-22-03-290-001. (4) Maintenance Manual, SA S92A-AMM-000, Tasks 64-22-03-900-001/-002. (5) Maintenance Manual, SA S92A-AMM-000, Tasks 67-32-01-900-001/-002. (6) Sikorsky Ground Based Application (SGBA) Users Guide, S92A-GBA-000, Chapter 15. L. Publications Affected Temporary Revision 45-03 against Maintenance Manual, SA S92-AMM-000, Task 45-45-10-710- 01, is issued concurrently with this ASB. M. Attachment None. Section 2. MATERIAL INFORMATION A. Basis for Material Data Per helicopter. B. Bill of Material New Part No. Qty Key Word Old Part No. Instructions/ Disposition 978008 1 GASK-O-SEAL 978008 (1)(2) Page 3 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 105 Appendix G (Cont) S-92 ALERT ASB 92-64-011 SERVICE BULLETIN Basic Issue ▪January 10/17 ATA 64-22-03 ONE-TIME INSPECTION Section 2. MATERIAL INFORMATION (Continued) (1) For part availability and lead time requirements contact your Customer Service Representative at SCI. Submit a no-cost purchase order referencing this ASB number and the helicopter serial number(s) on which these parts will be used. This will allow SCI and the operator to track shipment and receipt of parts. Orders will be accepted by letter, telephone, facsimile (FAX) or through the SCI website: www.HSIUS.com. For prompt shipment, reference address of each shipping destination. Direct your order to: Sikorsky Aircraft Corporation Commercial Systems and Services Mailstop K100 124 Quarry Road Trumbull, CT 06611 U.S.A. Attn: Account Service Manager FAX: (203) 416-4291, Telephone: (203) 416-4000 https://customerportal.sikorsky.com (2) A one-time re-use of Gask-O-Seal (978008) is permissible if replacement is not available. (Refer to Section 3, step C.(1)(a)). C. Consumable Material None. Section 3. ACCOMPLISHMENT INSTRUCTIONS A. Review helicopter records and log cards to determine if TRPCS and bearing assembly was manufactured, repaired, or overhauled on or after November 2, 2016. B. Prepare helicopter for maintenance: (1) Turn off all helicopter electrical and hydraulic power. (2) Engage rotor brake. NOTE: If stand-alone bearing energy analysis software is being used, the HUMS maintenance date associated with the TRPCS and bearing assembly shall not be updated or reset, even upon removal and installation of the TRPCS bearing assembly. (Refer to HUMS User Guide, SA S92A-HUM-000, Chapter 11.4, Section C, step 12). C. Remove TRPCS and bearing assembly. (Refer to Maintenance Manual, SA S92A-AMM-000, Task 64-22-03-900-001). TO PREVENT ELECTRICAL SHOCK OF PERSONNEL OR POSSIBLE DAMAGE TO HELICOPTER COMPONENTS, MAKE SURE TO TURN OFF ALL ELECTRICAL POWER. Page 4 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 106 Appendix G (Cont) ASB 92-64-011 S-92 ALERT Basic Issue ▪ January 10/17 SERVICE BULLETIN ATA 64-22-03 ONE-TIME INSPECTION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) NOTE: For further guidance on any questionable inspection results, contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com. (1) Perform inspection of TRPCS and bearing assembly, including spares. (Refer to Maintenance Manual, SA S92A-AMM-000, Task 64-22-03-290-001, steps A.(6)(j) through A.(6)(o)). (a) Contact Customer Service Program Manager if any TRPCS and bearing assemblies fail inspection. Submit any findings to local Sikorsky FSR. Rejected parts shall be returned to Sikorsky for evaluation with the reason for failure clearly identified. NOTE: A one-time re-use of Gask-O-Seal (978008) is permissible if replacement is not available and inspection criteria is met. (b) If no damage, cuts, tears, or distortion is found on Gask-O-Seal (978008), proceed to step (2). (c) If damage, cuts, tears, or distortion is found on Gask-O-Seal (978008), replace with new Gask-O-Seal. (Refer to Maintenance Manual, SA S92A-AMM-000, Tasks 67- 32-01-900-001/-002). NOTE: If HUMS data isn’t available for review, contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr- sik@lmco.com. (2) Review TGB bearing energy HUMS tool per HUMS User Guide, SA S92A-HUM-000, Chapter 11.4, not applicable to spare TRPCS bearing assemblies. Compliance can be accomplished via the legacy HUMS toolbar or the integrated Sikorsky Ground Based Application (SGBA) toolbar. (a) For users with stand-alone bearing energy analysis software, review the HUMS Tail Gear Box Bearing Energy Tool per the HUMS user guide, SA S92A-HUM-000, Chapter 11.4 with the following exceptions: 1. A condition indicator (CI) exceedance of 1.75 for any one data point shall require inspection per Maintenance Manual, SA S92A-AMM-000, Task 64-22- 03-290-001, steps A.(6)(j) thru A.(6)(o) and contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr- sik@lmco.com. (b) For integrated SGBA HUMS toolbar, refer to Sikorsky Ground Based Application (SGBA) Users Guide, S92A-GBA-000, Chapter 15 with the following additions: 1. This automated TGB Bearing Energy Analysis software consists of the following four steps: a The 15-20 kHz energy data for a specific helicopter tail number is extracted from the HUMS Ground Station Software (GSS) Raw Data Files (RDFs). This 15-20 kHz energy is referred to as a CI. Page 5 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 107 Appendix G (Cont) S-92 ALERT ASB 92-64-011 SERVICE BULLETIN Basic Issue ▪January 10/17 ATA 64-22-03 ONE-TIME INSPECTION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) b The average 15-20 kHz energy is computed for that helicopter tail number since the last maintenance date. This date is important, since removing/replacing the TGB, the pitch change shaft assembly, or the TGB accelerometer can change the absolute value of the CI. c The 15-20 kHz energy is normalized by the helicopter -specific mean. This normalized energy is referred to as the “CI ratio”. The intent of the software is create a baseline for the helicopter that is nominally at 1.0. The baseline data consists of 200 points. If 200 points have not been collected since the last maintenance date the tool will indicate “Insufficient Data”. d The trend history for the normalized energy is plotted for each specific tail number. The limit threshold for this normalized data is 1.75. 2. A CI exceedance of 1.75 for any one data point shall require inspection per Maintenance Manual, SA S92A-AMM-000, Task 64-22-03-290-001, steps A.(6)(j) thru A.(6)(o) and contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr- sik@lmco.com. D. Install serviceable TRPCS and bearing assembly. (Refer to Maintenance Manual, SA S92A- AMM-000, Task 64-22-03-900-002). E. Make sure the TGB mechanical diagnostic function of the HUMS is functioning. F. Review and incorporate the newly established recurring review of TGB bearing energy HUMS tool into the helicopter’s maintenance plan. (Refer to Temporary Revision 45-03 against Maintenance Manual, SA S92-AMM-000, Task 45-45-10-710-01). G. Return helicopter to service. A CI RATIO GREATER THAN 1.75 WILL NOT AUTOMATICALLY DISPLAY AS AN ALERT. Page 6 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 108 Appendix G (Cont) ASB 92-64-011 S-92 ALERT Basic Issue ▪ January 10/17 SERVICE BULLETIN ATA 64-22-03 ONE-TIME INSPECTION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) EXAMPLE OF RECORDED EXCEEDANCE OF TRPCS THAT REQUIRES MAINTENANCE WARNING: A CI RATIO GREATER THAN 1.75 WILL NOT AUTOMATICALLY DISPLAY AS AN ALERT. NOTE: The 1.75 limit may be manually defined as a threshold. FIGURE 1 Page 7 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 109 Appendix G (Cont) S-92 ALERT ASB 92-64-011 SERVICE BULLETIN Basic Issue ▪January 10/17 ATA 64-22-03 ONE-TIME INSPECTION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) H. Record of compliance: (1) Make helicopter logbook entries to show compliance with this ASB as follows: (a) Make helicopter level logbook entry on form SA7343-15 (Aircraft ASB Release Signoff). (b) Make component log card entries on forms SA7343-22 (Aircraft Component Log Cards) and the PCS and bearing assembly SA7343-21 (Component Log Cards). (2) Make an appropriate electronic compliance entry in the E-Notification section at www.Sikorsky360.com. Refer to User Guide located on the www.Sikorsky360.com/E- Notification Search page. (3) Upon compliance with this ASB, complete and return the following compliance record card by mail, fax, or scan and e-mail. Page 8 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 110 Appendix G (Cont) (Fold over and tape closed) SIKORSKY AIRCRAFT CORPORATION FACSIMILE NUMBER (817) 762-9715 EMAIL ADDRESS: product_safety.gr-sik@lmco.com ATTENTION: Gr-SIK, Product_Safety SIKORSKY AIRCRAFT CORPORATION (Fold Up to Arrows) IMPORTANT NOTICE Upon COMPLIANCE with the attached ASB, Sikorsky requests your cooperation in completing and returning this ENTIRE PAGE by MAIL, FAX, or scan & EMAIL. Please fill in the requested information at the bottom of the page, so we may maintain proper records documenting the configuration of your aircraft. This information is useful when determining configuration and effectivity of issues affecting fielded aircraft. This request is in keeping with our policy to assure that our customers receive the latest information applicable for the maintenance of your aircraft. Thank you. ALERT SERVICE BULLETIN:

Compliance Record Card TITLE: ___________________________________________________________________

OWNER/OPERATOR: _____________________________________________________ SUBMITTED BY: ___________________________ DATE: ____________________ FOLLOWING SERIAL NUMBERS ARE NOT AFFECTED BY THIS ASB ASB HAS BEEN COMPLIED WITH ON HELICOPTER SERIAL NUMBERS:

No. 92-64-011 TAIL ROTOR – Tail Rotor Pitch Change Shaft Bearing Assembly – One-Time Inspection of Tail Rotor Pitch Change Shaft (TRPCS) and Bearing Assembly for Ratcheting, Binding, or Rough Turning This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix G 111 Appendix G (Cont) No Postage Necessary BUSINESS REPLY MAIL FIRST-CLASS MAIL PERMIT NO. 432 BRIDGEPORT CT POSTAGE WILL BE PAID BY ADDRESSEE SIKORSKY AIRCRAFT CORPORATION Commercial Systems and Services Mailstop K100 124 QUARRY ROAD TRUMBULL, CT 06611 U.S.A.

ATTENTION: Gr-SIK, Product_Safety Please complete the form on the reverse side and FAX to FACSIMILE NUMBER (817) 762-9715 Or scan and email to: EMAIL ADDRESS: product_safety.gr-sik@lmco.com or fold and return ENTIRE form to Sikorsky Aircraft Corporation This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix H 112 Appendix H FAA Airworthiness Directive AD 2017-02-51 dated 13 January 2017 1 FAA Aviation Safety EMERGENCY AIRWORTHINESS DIRECTIVE www.faa.gov/aircraft/safety/alerts/ DATE: January 13, 2017 AD #: 2017-02-51 This Emergency Airworthiness Directive (Emergency AD) 2017-02-51 is being sent to owners and operators of Sikorsky Aircraft Corporation (Sikorsky) Model S-92A helicopters. Background This Emergency AD was prompted by three reports of operators losing tail rotor (TR) control caused by a failed tail rotor pitch change shaft (TRPCS) assembly bearing. Following the first two reports, the FAA issued and subsequently published as a final rule Emergency AD 2016-24-51 (81 FR 95425, December 28, 2016). That AD applies to Sikorsky Model S-92A helicopters with a TRPCS assembly that has less than 80 hours time-in-service (TIS) with bearings that were manufactured prior to November 3, 2016. Emergency AD 2016-24-51 is intended to address an unsafe condition with low-time bearings by requiring removal of TRPCS assemblies that have less than 5 hours TIS and one-time inspections for certain conditions. Actions Since Emergency AD 2016-24-51 Was Issued Since Emergency AD 2016-24-51 was issued, a third report of an S-92A helicopter losing TR control was reported, and a preliminary investigation determined that the bearing failed despite having more than 80 hours TIS. We have determined that the unsafe condition can exist on TRPCS bearings regardless of hours TIS. Therefore, this Emergency AD applies to all TRPCS assemblies. This Emergency AD requires a one-time visual inspection and a repetitive borescope inspection of the TRPCS assembly bearing. The repetitive inspection is intended to detect bearing deterioration. The actions in this Emergency AD are intended to detect a binding bearing, prevent loss of TR control, and possible loss of control of the helicopter. FAA’s Determination We are issuing this Emergency AD because we evaluated all the relevant information and determined the unsafe condition described previously is likely to exist or develop in other products of the same type design. Related Service Information We reviewed Sikorsky Alert Service Bulletin 92-64-011, Basic Issue, dated January 10, 2017 (ASB). The ASB describes procedures for inspecting the TRPCS and bearing assemblies for ratcheting, binding, and rough turning. The ASB also specifies periodic review of the health and usage monitoring system (HUMS) tail gearbox bearing energy tool. Emergency AD Requirements This Emergency AD requires, before further flight, removing the TRPCS assembly and inspecting the bearing. If the bearing does not rotate freely; the bearing sounds rough or chatters; there is any purged grease with metal particles; a nick or dent; or if there is a cut, tear, or distortion in

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix H 113 Appendix H (Cont) 2 the bearing seal, before further flight, replacing the TRPCS assembly is required. This Emergency AD also requires, within 10 hours TIS, and thereafter at intervals not to exceed 10 hours TIS, inspecting the TRPCS assembly with a borescope. If the white Teflon seal or snap ring is missing, or if there is a rip, tear, or heat damage on the seal or if there is no gap in the snap ring, replacing the TRPCS assembly is required before further flight. Differences Between This Emergency AD and the Service Information This Emergency AD requires repetitive borescope inspections of the TRPCS; the ASB does not. The ASB specifies that operators review HUMS data in addition to the one-time inspection and specifies contacting Sikorsky if any discrepancies are found; this Emergency AD does not. Interim Action We consider this Emergency AD to be an interim action. If final action is later identified, we might consider further rulemaking then. Authority for this Rulemaking Title 49 of the United States Code specifies the FAA’s authority to issue rules on aviation safety. Subtitle I, Section 106, describes the authority of the FAA Administrator. “Subtitle VII, Aviation Programs,” describes in more detail the scope of the Agency’s authority. We are issuing this rulemaking under the authority described in “Subtitle VII, Part A, Subpart III, Section 44701, General requirements.” Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action. Adoption of the Emergency Airworthiness Directive (AD) We are issuing this Emergency AD under 49 U.S.C. Sections 106(g), 40113, and 44701 according to the authority delegated to me by the Administrator. 2017-02-51 Sikorsky Aircraft Corporation: Directorate Identifier 2017-SW-003-AD. (a) Applicability This Emergency AD applies to Sikorsky Aircraft Corporation (Sikorsky) Model S-92A helicopters, certificated in any category, with a tail rotor pitch change shaft (TRPCS) assembly part number (P/N) 92358-06303-041 or P/N 92358-06303-042 installed. (b) Unsafe Condition This Emergency AD defines the unsafe condition as a binding TRPCS bearing. This condition could result in loss of tail rotor (TR) control and possible loss of control of the helicopter. (c) Effective Date This Emergency AD is effective upon receipt.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix H 114 Appendix H (Cont) 3 (d) Compliance You are responsible for performing each action required by this Emergency AD within the specified compliance time unless it has already been accomplished prior to that time. (e) Required Actions (1) Before further flight, unless already done, remove the TRPCS assembly and inspect the SB2310 angular contact bearing for free rotation, purged grease with metal particles, a nick or a dent, and any cut, tear, or distortion on the bearing seal. If the bearing does not rotate freely; the bearing sounds rough or chatters; there is any purged grease with metal particles; a nick or dent; or if there is a cut, tear, or distortion in the bearing seal, before further flight, replace the TRPCS assembly. (2) Within 10 hours time-in-service (TIS), unless already done within the last 10 hours TIS, and thereafter at intervals not to exceed 10 hours TIS, on the TR side of the TRPCS bearing, remove the plug from the end of the TRPCS, insert the borescope into the TRPCS, and determine whether the white Teflon seal and snap ring are installed. If the white Teflon seal or snap ring is missing, or if there is a rip, tear, or heat damage on the seal or if there is no gap in the snap ring, before further flight replace the TRPCS assembly. (f) Alternative Methods of Compliance (AMOCs) (1) The Manager, Boston Aircraft Certification Office, FAA, may approve AMOCs for this Emergency AD. Send your proposal to: Blaine Williams, Aerospace Engineer, Boston Aircraft Certification Office, Engine & Propeller Directorate, 1200 District Avenue, Burlington, Massachusetts 01803; telephone (781) 238-7161; email blaine.williams@faa.gov. (2) For operations conducted under a 14 CFR part 119 operating certificate or under 14 CFR part 91, subpart K, we suggest that you notify your principal inspector, or lacking a principal inspector, the manager of the local flight standards district office or certificate holding district office, before operating any aircraft complying with this Emergency AD through an AMOC. (g) Additional Information (1) For further information contact: Blaine Williams, Aerospace Engineer, Boston Aircraft Certification Office, Engine & Propeller Directorate, 1200 District Avenue, Burlington, Massachusetts 01803; telephone (781) 238-7161; email blaine.williams@faa.gov. (2) For a copy of the service information referenced in this Emergency AD, contact: Sikorsky Aircraft Corporation, Customer Service Engineering, 124 Quarry Road, Trumbull, CT 06611; telephone 1-800-Winged-S or 203-416-4299; email: wcs_cust_service_eng.gr-sik@lmco.com.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix H 115 Appendix H (Cont) 4 (h) Subject Joint Aircraft Service Component (JASC) Code: 6720 Tail Rotor Control System. Issued in Fort Worth, Texas, on January 13, 2017. Lance T. Gant, Manager, Rotorcraft Directorate, Aircraft Certification Service.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 116 Appendix J Sikorsky ASB 92-64-012 dated 16 May 2017 ASB 92-64-012 Revision C – May 16, 2017 TRANSMITTAL Alert Service Bulletin (ASB) 92-64-012 dated March 9, 2017 has been revised. This page accompanies revision C, dated May 16, 2017. ASB 92-64-012C dated May 16, 2017 supersedes revision B of ASB 92-64-012, dated April 13, 2017. Text changes are indicated by a vertical line in the outer margin of the page. Illustration changes are indicated by a vertical line next to the figure title. INSTRUCTIONS TO OPERATORS: For operators that have complied with ASB 92-64-012 revision B, no further action is required. Operators that have not complied with ASB 92-64-012 revision B must comply with revision C in its entirety. HIGHLIGHTS OF THIS REVISION: COMPLIANCE Revised TRPCS part number. Added TRPCS that that were repaired. PUBLICATIONS AFFECTED Revised publications affected to none.

Page 1 of 1 WARNING ‒ This document contains technical data subject to the EAR. Authorization is required prior to providing this technical data to any company, entity, person, or destination. EAR Export Classification: ECCN 9E991

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 117 Appendix J (Cont)

Page 1 of 15 ATA 64-22-03 ONE-TIME INSTALLATION S-92® HELICOPTER ALERT SERVICE BULLETIN NOTICE TO ALL PERSONS RECEIVING THIS DOCUMENT: WARNING: THIS DOCUMENT, OR AN EMBODIMENT OF IT IN ANY MEDIA, DISCLOSES INFORMATION WHICH IS PROPRIETARY, IS THE PROPERTY OF LOCKHEED MARTIN CORPORATION AND/OR ITS SUBSIDIARIES, IS AN UNPUBLISHED WORK PROTECTED UNDER APPLICABLE COPYRIGHT LAWS, AND IS DELIVERED ON THE EXPRESS CONDITION THAT IT IS NOT TO BE USED, DISCLOSED, REPRODUCED, IN WHOLE OR IN PART (INCLUDING REPRODUCTION AS A DERIVATIVE WORK), OR USED FOR MANUFACTURE FOR ANYONE OTHER THAN LOCKHEED MARTIN CORPORATION AND/OR ITS SUBSIDIARIES WITHOUT ITS WRITTEN CONSENT, AND THAT NO RIGHT IS GRANTED TO DISCLOSE OR SO USE ANY INFORMATION CONTAINED HEREIN. ALL RIGHTS RESERVED. ANY ACT IN VIOLATION OF APPLICABLE LAW MAY RESULT IN CIVIL AND CRIMINAL PENALTIES. S-92® IS A REGISTERED TRADEMARK OF SIKORSKY AIRCRAFT CORPORATION. ASB 92-64-012 March 9/17 Revision C ▪ May 16/17 SUBJECT: TAIL ROTOR – Tail Rotor Pitch Change Shaft Bearing Assembly – Installation of Temperature Indicator Plug Section 1. PLANNING INFORMATION A. Effectivity S-92A model helicopters with serial numbers 920006 through 920302. B. Purpose To provide instructions to install temperature indicator plug. C. Background A temperature indicator plug was designed to be installed in the inner diameter of the Tail Rotor Pitch Change Shaft (TRPCS) bearing as a method to visually inspect for a bearing that is operating at higher temperature than normal. The intent of the temperature indicator plug is to help identify bearings that are degrading. D. Description TRPCS log card is reviewed. Helicopter is prepared for maintenance. Temperature Indicator Plug is installed. Helicopter is returned to service. E. Compliance Compliance is essential.  TRPCS (92358-06303-041, or -042) that were last overhauled, repaired, or fabricated new (not yet overhauled) prior to February 28, 2017, as noted on the component maintenance record, shall comply with this Alert Service Bulletin (ASB) no later than April 13, 2017. Sikorsky Aircraft Corporation 6900 Main Street P.O. Box 9729 Stratford, Connecticut 06615-9129 (203) 386-4000 WARNING ‒ This document contains technical data subject to the EAR. Authorization is required prior to providing this technical data to any company, entity, person, or destination. EAR Export Classification: ECCN 9E991

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 118 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 2 ATA 64-22-03 ONE-TIME INSTALLATION Section 1. PLANNING lNFORMATION (Continued)  TRPCS (92358-06303-041, or -042) that were last overhauled, repaired, or fabricated new (not yet overhauled) on or after February 28, 2017, as noted on the component maintenance record, with more than 100 flight hours (Time Since New (TSN)/Time Since Overhaul (TSO)/Time Since Repair (TSR) as applicable), shall comply with this ASB no later than April 13, 2017.  TRPCS (92358-06303-041, or -042) that were last overhauled, repaired, or fabricated new (not yet overhauled) on or after February 28, 2017, as noted on the component maintenance record, with less than 100 flight hours (TSN/TSO/TSR as applicable), shall install temperature indicator plug no later than 100 flight hours (TSN/TSO/TSR of the TRPCS (92358-06303-041, or -042), as applicable). F. Approval The design change specified by this document is FAA approved in accordance with the applicable requirements of United States Federal Aviation Regulations 14 CFR Part 29. FAA approval constitutes EASA and Transport Canada approval under the terms of current bilateral agreement procedures. G. Manpower (Estimated) Task No. of Men No. of Hours Man-Hours* Removal of Retaining Ring and Plug. 1 0.25 0.25 Installation of Temperature Indicator Plug 1 0.50 0.50 Inspection of Temperature Indicator Plug for Proper Seating 1 0.25 0.25 Re-Installation of Plug and Retaining Ring 1 0.25 0.25 Total Man-Hours

1. 25

*Estimate does not include time required to prepare helicopter or return it to flight status.

H. Tooling Qty Nomenclature Part No. Source 1 Tool Kit, Pitch Change Shaft 92700-10391-041 (1)

Made up of:

1 Installation Rod Assembly 92700-10391-042

1 Gage Mount Assembly 92700-10391-043

1 Handle 92700-10391-103

1 Dial Indicator 711FSZ

1 Dead Blow Hammer 57-530

1 Non-Bright, White, Flashlight Commercially available or equivalent (2) This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 119 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 3 ATA 64-22-03 ONE-TIME INSTALLATION Section 1. PLANNING lNFORMATION (Continued) Qty Nomenclature Part No. Source 1 Orfit Tool Kit WE301K (2)

(1) Tools are available at no cost during the compliance period of this ASB to predetermined locations to support the current fleet. Tools shall be available after the compliance period at standard Sikorsky Commercial Inc. (SCI) rates. For tools availability and lead time requirements contact your Customer Service Representative at SCI. Submit a no-cost purchase order referencing this ASB number and the helicopter serial number(s) on which these tools will be used. This will allow SCI and the operator to track shipment and receipt of tools. Orders will be accepted by letter, telephone, facsimile (FAX) or through the SCI website: www.HSIUS.com. For prompt shipment, reference address of each shipping destination. Direct your order to: Sikorsky Aircraft Corporation Commercial Systems and Services Mailstop K100 124 Quarry Road Trumbull, CT 06611 U.S.A. Attn: Account Service Manager FAX: (203) 416-4291, Telephone: (203) 416-4000 3TU3TU3TUhttps://customerportal.sikorsky.com U3T3T3 (2) Available through normal supply channels. I. Weight and Balance None. J. Electrical Load Data Not applicable. K. Software Load Data Not applicable. L. References (1) Temporary Revision 45-07 against Maintenance Manual, SA S92A-AMM-000, Task 45-45- 10-710-001. (2) Temporary Revision 45-08 against Maintenance Manual, SA S92A-AMM-000, Task 45-45- 11-710-001.

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 120 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 4 ATA 64-22-03 ONE-TIME INSTALLATION Section 1. PLANNING lNFORMATION (Continued) M. Publications Affected None. N. Attachment None. Section 2. MATERIAL INFORMATION A. Basis for Material Data Per helicopter. B. Bill of Material New Part No. Qty Nomenclature Old Part No. Instructions/ Disposition 92358-06134-041 1 TEMPERATURE INDICATOR PLUG

(1) AS3209-029 1 PACKING AS3209-029 (2)

(1) Parts are available at no cost during the compliance period of this ASB. Parts shall be available after the compliance period at standard Sikorsky Commercial Inc. (SCI) rates. For part availability and lead time requirements contact your Customer Service Representative at SCI. Submit a no-cost purchase order referencing this ASB number and the helicopter serial number(s) on which these parts will be used. This will allow SCI and the operator to track shipment and receipt of parts. Orders will be accepted by letter, telephone, facsimile (FAX) or through the SCI website: www.HSIUS.com. For prompt shipment, reference address of each shipping destination. Direct your order to: Sikorsky Aircraft Corporation Commercial Systems and Services Mailstop K100 124 Quarry Road Trumbull, CT 06611 U.S.A. Attn: Account Service Manager FAX: (203) 416-4291, Telephone: (203) 416-4000 3TU3TU3TUhttps://customerportal.sikorsky.com U3T3T3 (2) Available through normal supply channels.

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 121 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 5 ATA 64-22-03 ONE-TIME INSTALLATION Section 2. MATERIAL INFORMATION (Continued) C. Consumable Material

Qty Nomenclature Part No. Source A/R Corrosion Preventative Cor-Ban 27L or equivalent (1) A/R Lubricating Oil DOD-PRF-85734 or equivalent (1) A/R Lubricating Oil Ultrachem or equivalent (1) A/R Lubricating Oil Boelube® or equivalent (1)

(1) Available through normal supply channels. Section 3. ACCOMPLISHMENT INSTRUCTIONS A. Review TRPCS log card: (1) If bearing (SB2310) is in the Serial Number (S/N) 0087 to 0101 range, contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com. (2) If bearing (SB2310) is not in the S/N 0087 to 0101 range, proceed to next step. B. Prepare helicopter for maintenance:

(1) Turn off all helicopter electrical and hydraulic power. (2) Engage rotor brake. C. Remove plug to gain access to the interior of the TRPCS and bearing assembly as follows: (1) Remove retaining ring (M2742630142D) securing plug (92358-06610-101) in TRPCS. (Refer to Figures 1 and 2). OBSERVE ALL CAUTIONS AND WARNINGS ON CONTAINERS WHEN USING CONSUMABLES. WHEN APPLICABLE, WEAR NECESSARY PROTECTIVE GEAR DURING HANDLING AND USE. IF A CONSUMABLE IS FLAMMABLE OR EXPLOSIVE, MAKE CERTAIN CONSUMABLE AND ITS VAPORS ARE KEPT AWAY FROM HEAT, SPARK AND FLAME. MAKE CERTAIN FIREFIGHTING EQUIPMENT IS READILY AVAILABLE PRIOR TO USE. FOR ADDITIONAL INFORMATION ON TOXICITY, FLASHPOINT AND FLAMMABILITY OF CHEMICALS, CONSULT YOUR MEDICAL DEPARTMENT OR THE MANUFACTURER OF THE CONSUMABLE. TO PREVENT ELECTRICAL SHOCK OF PERSONNEL OR POSSIBLE DAMAGE TO HELICOPTER COMPONENTS, MAKE SURE TO TURN OFF ALL ELECTRICAL POWER. This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 122 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 6 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) (2) Remove plug (92358-06610-101) and packing (AS3209-029) from TRPCS. (3) Visually inspect packing (AS3209-029) for tears or excessive stretching and reuse if no tears or excessive stretching are present. D. Install temperature indicator plug (92358-06134-041) as follows: NOTE: The 180°F temperature dot is pre-tripped to provide a visual comparison of when a dot is tripped. (Refer to Figure 3 for an example). (1) Visually inspect temperature indicator plug (92358-06134-041) to verify that three (3) indicator dots are not tripped. If any of the three (3) temperature dots are found tripped, contact Sikorsky Aircraft Customer Service Engineering at 1-800-WINGED-S or Email: wcs_cust_service_eng.gr-sik@lmco.com. (2) Thread temperature indicator plug (92358-06134-041) onto installation rod assembly (92700-10391-042) until threads bottom on installation rod shoulder. (Refer to Figure 4). NOTE: Make sure no corrosion preventative compound (Cor-Ban 27L or equivalent) is applied to face of temperature indicator plug (92358-06134-041) with temperature dots. (3) Apply light coat of corrosion preventative compound (Cor-Ban 27L or equivalent) on temperature indicator plug (92358-06134-041). (Refer to Figure 5). (4) Apply light coat of lubricating oil (DOD-PRF-85734, Ultrachem, Boelube® or equivalent) on gage mount assembly (92700-10391-043) o-rings. (5) Gently position installation rod assembly (92700-10391-042), temperature indicator plug (92358-06134-041), and gage mount assembly (92700-10391-043) inside TRPCS. Firmly seat gage mount assembly against shaft end face. (Refer to Figure 6). (6) Using installation rod assembly (92700-10391-042), insert temperature indicator plug (92358-06134-041) into inner diameter of TRPCS bearing bore by hand, until resistance is felt. (7) Measure distance from end of installation rod assembly (92700-10391-042) to gage mount assembly (92700-10391-043) and record value as “Pre-Installation Measurement.” (Refer to Figure 7).

(8) Using provided dead blow hammer (57-530), gently tap installation rod assembly (92700- 10391-042) to drive temperature indicator plug (92358-06134-041) into bore of TRPCS bearing. (Refer to Figure 8).

TOO MUCH IMPACT COULD RESULT IN DAMAGE TO BEARING. This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 123 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 7 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

(9) Measure distance from end of installation rod assembly (92700-10391-042) to gage mount assembly (92700-10391-043) and record as “Post-Installation Measurement.” Subtract “Post-Installation Measurement” from “Pre-Installation Measurement.” (Refer to Figure 7). (a) If value is less than 0.180 inch, repeat step (8) until measurement is achieved. (b) If value is greater than or equal to 0.180 inch, proceed to next step. (10) Using handle (92700-10391-103), rotate installation rod assembly (92700-10391-042) counter-clockwise to unthread from temperature indicator plug (92358-06134-041). (Refer to Figure 9). (11) Remove installation rod assembly (92700-10391-042). (12) Remove gage mount assembly (92700-10391-043). (13) Using a non-bright, white, flashlight (commercially available or equivalent), inspect TRPCS for foreign object debris (FOD), and remove if found. (Refer to Figure 10). E. Re-install plug as follows (Refer to Figure 11): (1) If previously installed packing was found torn or excessively stretched, install new packing (AS3209-029) on plug (92358-06610-101) using Orfit tool kit (WE301K). (2) Install plug (92358-06610-101) and packing (AS3209-029) in TRPCS. (Refer to Figures 1 and 11). (3) Secure plug (92358-06610-101) in TRPCS with retaining ring (M2742630142D). F. Review and incorporate applicable changes to recurring review of tail gear box bearing energy HUMS tool into the helicopters maintenance plan. (Refer to Temporary Revision 45-07 against Maintenance Manual, SA S92A-AMM-000 Task 45-45-10-710-001 or Temporary Revision 45-08 against Maintenance Manual, SA S92-AMM-000, Task 45-45-11-710-001). G. Return helicopter to service. This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 124 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 8 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

TAIL ROTOR PITCH CHANGE SHAFT PLUG FIGURE 1 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 125 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 9 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

REMOVAL OF PLUG FIGURE 2

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 126 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 10 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

TEMPERATURE DOTS FIGURE 3

INSTALLATION ROD ASSEMBLY INSTALLED ON TEMPERATURE INDICATOR PLUG FIGURE 4 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 127 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 11 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

LOCATIONS TO APPLY CORROSION PREVENTATIVE FIGURE 5

INSTALLATION OF TEMPERATURE INDICATOR PLUG FIGURE 6 This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 128 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 12 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

TEMPERATURE INDICATOR PLUG INSTALLATION MEASUREMENT FIGURE 7

TEMPERATURE INDICATOR PLUG SEATING FIGURE 8

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 129 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 13 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

UN-THREAD INSTALLATION ROD ASSEMBLY FIGURE 9

INSPECT PCS BORE FIGURE 10

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 130 Appendix J (Cont) S-92 ALERT ASB 92-64-012 SERVICE BULLETIN Revision C ▪ May 16/17

Page 14 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued)

INSTALLATION OF PLUG FIGURE 11

This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 131 Appendix J (Cont) ASB 92-64-012 S-92 ALERT Revision C ▪ May 16/17 SERVICE BULLETIN

Page 15 ATA 64-22-03 ONE-TIME INSTALLATION Section 3. ACCOMPLISHMENT INSTRUCTIONS (Continued) H. Record of compliance: (1) Make helicopter logbook entries to show compliance with this ASB as follows: (a) Make helicopter level logbook entry on form SA7343-15 (Aircraft ASB and CSN Release Signoff). (b) When ASB modifies a component that can be removed from this helicopter: 1. Make component log card entries on forms SA7343-22 (Aircraft Component Log Cards) and SA7343-21 (Component Log Cards), as applicable. 2. If a component modified by this ASB does not have a log card and the ASB does not create one, then annotate compliance on the next higher assembly that the component belongs to which does have a log card. NOTE: If access to www.Sikorsky360.com is unavailable, complete attached ALERT SERVICE BULLETIN COMPLIANCE RECORD CARD and return it to Sikorsky Aircraft Corporation. (2) Make an appropriate electronic compliance entry in the E-Notification section at www.Sikorsky360.com. Refer to User Guide located on the www.Sikorsky360.com/E- Notification Search page. This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 132 Appendix J (Cont) (Fold over and tape closed) SIKORSKY AIRCRAFT CORPORATION FACSIMILE NUMBER (817) 762-6715 EMAIL ADDRESS: product_safety.gr-sik@lmco.com ATTENTION: Gr-SIK, Product_Safety SIKORSKY AIRCRAFT CORPORATION (Fold Up to Arrows) IMPORTANT NOTICE Upon COMPLIANCE with the attached ASB, Sikorsky requests your cooperation in completing and returning this ENTIRE PAGE by MAIL, FAX, or scan & EMAIL. Please fill in the requested information at the bottom of the page, so we may maintain proper records documenting the configuration of your aircraft. This information is useful when determining configuration and effectivity of issues affecting fielded aircraft. This request is in keeping with our policy to assure that our customers receive the latest information applicable for the maintenance of your aircraft. Thank you. ALERT SERVICE BULLETIN:

Compliance Record Card TITLE: ___________________________________________________________________

OWNER/OPERATOR: _____________________________________________________ SUBMITTED BY:

DATE:

FOLLOWING SERIAL NUMBERS ARE NOT AFFECTED BY THIS ASB ASB HAS BEEN COMPLIED WITH ON HELICOPTER SERIAL NUMBERS:

No. 92-64-012C TAIL ROTOR – Tail Rotor Pitch Change Shaft Bearing Assembly – Installation of Temperature Indicator Plug This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Appendices Air Accident Report: 1/2018 G-WNSR EW/C2016/12/04 © Crown Copyright 2018 Appendix J 133 Appendix J (Cont) No Postage Necessary BUSINESS REPLY MAIL FIRST-CLASS MAIL PERMIT NO. 432 BRIDGEPORT CT POSTAGE WILL BE PAID BY ADDRESSEE SIKORSKY AIRCRAFT CORPORATION Commercial Systems and Services Mailstop K100 124 QUARRY ROAD TRUMBULL, CT 06611 U.S.A. ATTENTION: Gr-SIK, Product_Safety Please complete the form on the reverse side and FAX to FACSIMILE NUMBER (817) 762-6715 Or scan and email to: EMAIL ADDRESS: product_safety.gr-sik@lmco.com or fold and return ENTIRE form to Sikorsky Aircraft Corporation This Document Contains Technical Data Controlled by the EAR. See WARNING and classifications on first page.

Intentionally left blank

Unless otherwise indicated, recommendations in this report are addressed to the appropriate regulatory authorities having responsibility for the matters with which the recommendation is concerned. It is for those authorities to decide what action is taken. In the United Kingdom the responsible authority is the Civil Aviation Authority, CAA House, 45-49 Kingsway, London WC2B 6TE or the European Aviation Safety Agency, Postfach 10 12 53, D-50452 Koeln, Germany.

AIRCRAFT ACCIDENT REPORT 1/2018 G-WNSR Aircraft Accident Report 1/2018 Report on the accident to Sikorsky S-92A, G-WNSR West Franklin wellhead platform, North Sea On 28 December 2016

FD06648 ｜ 2018_英国_annual-safety-review-2018__AAIB_Annual_Safety_Review_Hi_Res.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Annual Safety Review 2018 AAIB Air Accidents Investigation Branch

Air Accidents Investigation Branch Annual Safety Review 2018 AAIB Air Accidents Investigation Branch © Crown Copyright 2019 All rights reserved. Copies of this publication may be reproduced for personal use, or for use within a company or organisation, but may not otherwise be reproduced for publication. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and it is not used in a derogatory manner or in a misleading context. Published 18 April 2019 Enquiries regarding the content of this publication should be addressed to: Air Accidents Investigation Branch Farnborough House Berkshire Copse Road Aldershot Hampshire GU11 2HH. This document is also available in electronic (pdf) format at www.aaib.gov.uk

Air Accidents Investigation Branch Annual Safety Review 2018 iii AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Foreword and Contents Foreword Investigations The AAIB’s purpose is to improve aviation safety by determining the circumstances and causes of accidents and serious incidents, and promoting action to prevent reoccurrence. I am pleased to introduce the AAIB’s 2018 Annual Safety Review which includes information on our activity and the safety action taken or planned, by operators, manufacturers and the aviation authorities, in response to investigations concluded in 2018. The AAIB received 706 occurrence notifications in 2018 and opened 26 field investigations, 9 of which were into fatal accidents in the UK resulting in 16 deaths. A further 221 investigations were opened by correspondence. In addition, the AAIB appointed an accredited representative to 64 overseas investigations, including 23 involving UK registered aircraft. There is a wealth of statistical information in the following pages that highlights the predominant causes of these accidents and serious incidents. Most fatal accidents involved the loss of control in flight of General Aviation aircraft; whereas the majority of serious incidents with Commercial Air Transport were attributed to system/component failure or malfunction. Two formal reports were published in 2018. C-FWGH, was a Boeing 737 which failed to achieve the required takeoff performance due to a critical data entry error. This was the latest in a series of accidents and serious incidents worldwide associated with abnormal takeoff performance and so the AAIB has issued Safety Recommendations to ICAO, the FAA and the EASA on the urgent need to develop takeoff acceleration monitoring systems to address this critical issue. The other formal report concerned G-WNSR, an S-92A helicopter which suffered a loss of yaw control due to failure of the tail rotor pitch change shaft bearing. Fortuitously this occurred when the aircraft was in a low hover and so an expeditious safe landing was possible. This contrasts starkly with the tragic accident at Leicester City Football Stadium involving G-VKSP, an AW169 helicopter, where loss of yaw control at 400 ft had catastrophic consequences. The investigation is ongoing to determine the initiating cause and exact sequence of the failure that resulted in the loss of tail rotor control. In 2018, the AAIB published 31 field investigation reports and made 15 Safety Recommendations including 8 Safety Recommendations of Global Concern (ie regarding a systemic deficiency having a probability of recurrence with significant consequences at a global level and requiring timely action to improve safety). In addition, AAIB reports provided details of 60 significant safety actions taken by manufacturers, operators and regulators to address safety issues identified in AAIB investigations. Details of them all are in the pages that follow, together with updates on the status of all Safety Recommendations made in 2018.

Air Accidents Investigation Branch Annual Safety Review 2018 iv AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Developments The AAIB continues to develop its capabilities and relationships to ensure it is ready for future challenges. I am very grateful to all those who contributed to our Stakeholder Survey in 2018. We greatly valued the feedback and will be using insights from the survey to prioritise areas for development in our working practices and outputs. An article on how and why we communicate is included in this review. In April 2018 the latest iteration of the UK Civil Aviation (Investigation of Air Accident and Incidents) Regulations 2018 came into force to complement directly applicable EU law (Regulation (EU) No 996/2010). Separate regulations are also now being developed for the investigation of spaceflight accidents, as we prepare to respond to any future mishap with spaceflight launches from the UK. The rapid growth in unmanned aircraft systems (UAS) usage in the UK continues with a commensurate increase in accidents, incidents and reports of loss of safe separation from manned aircraft. In this review, there is an article to explain when and how we investigate accidents and serious incidents involving UAS, which is an increasingly important part of our remit. The AAIB has an extensive outreach programme, which included 113 formal visits to the Branch in 2018, and we continue to play a leading role in several national and international forums. We provided training and assistance to a host of different countries in 2018 and this will continue to be an important part of our work, with the objective of improving air safety through the effective investigation of air accidents wherever they occur in the world. Irrespective of the outcome of Britain’s exit from the EU, we expect little change to the way we work with State safety investigation authorities in Europe and worldwide, in accordance with Annex 13 to the Convention on International Civil Aviation. Closer to home, the AAIB and its sister organisations the Marine Accident Investigation Branch and the Rail Accident Investigation Branch, have much in common. Accordingly, the Department for Transport recently established an Accident Investigation Chiefs’ Council1 and appointed Air Marshal Sir Richard Garwood KBE CB DFC as non-executive Chairman. The Board is driving forward a programme of workstreams to maximise the synergy between the three modal branches and form common positions on areas of joint interest, such as the recent agreement of a new Memorandum of Understanding with the National Police Chiefs’ Council. 2019 is already proving to be a busy and demanding year for the AAIB and we look forward to engaging with stakeholders on a range of important safety issues. In the meantime, I invite you to peruse this 2018 Annual Safety Review which I trust you will find interesting and useful. Crispin Orr Chief Inspector of Air Accidents 1 Formerly known as the Tri-Branch Management Board.

Air Accidents Investigation Branch Annual Safety Review 2018 1 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Foreword and Contents Contents Foreword............................................................................................................................iii How we communicate and why........................................................................................3 Investigating UAS accidents.............................................................................................7 CICTT Factors on Investigations by the AAIB in 2018.................................................13 Field investigations.................................................................................................. 14 Correspondence investigations............................................................................... 15 Fatal investigations.................................................................................................. 16 Statistics for 2018............................................................................................................17 Category Definition.................................................................................................. 18 Notifications 2018.................................................................................................... 19 Notifications 2017.................................................................................................... 20 Notifications 2016.................................................................................................... 21 Safety Recommendations in 2018..................................................................................23 Safety Actions from investigations reported on in 2018..............................................35 Formal Investigations............................................................................................... 35 Special Bulletins...................................................................................................... 38 Field Investigations.................................................................................................. 40 Correspondence Investigations............................................................................... 55 Appendix 1 - CICITT Occurrence Categories................................................................67

Air Accidents Investigation Branch Annual Safety Review 2018 2 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Follow us on Twitter: @aaibgovuk

Air Accidents Investigation Branch Annual Safety Review 2018 3 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk How we communicate and why How we communicate and why Good communication is at the heart of every successful air accident investigation and it starts from the moment we are notified of an accident. In this early stage, we could be speaking to dozens of people from the emergency services, operators and manufacturers, and receiving information by phone, email and through social media. Running parallel to the job of gathering evidence and sifting through the evidence, we need to communicate with the wider public whether that is to appeal for witnesses or to provide reassurance by keeping them informed of our activities and our commitment to work out what happened. When our investigation concludes, we need to be able to say what happened and why, and what we have recommended to prevent similar accidents from happening again. Our safety recommendations are exactly that – recommendations – so communication plays a part in ensuring that our voice is heard and nobody is in any doubt as to whose responsibility it is to respond to our findings. As one of the smallest government organisations in the UK, our formal communication function is lean: we share a communication specialist with our sister branches, the Marine Accident Investigation Branch and Rail Accident Investigation Branch. The communication specialist’s role is as much about giving our investigators the tools they need to communicate well, as it is about setting our overarching communication strategy and looking after the inevitable day-to-day media requests. For major accidents, we have arrangements for government communication specialists to assist us with media on site in the early stages after the accident. Figure 1 Government communicators at an AAIB training day

Air Accidents Investigation Branch Annual Safety Review 2018 4 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk How we communicate and why When an accident happens, we may need to appeal for witnesses. While social media has ‘ballooned’ over the last decade, local tv, radio and website news continue to be our most important media for trying to reach potential witnesses to come forward with information relevant to our investigation. This is why we encourage our investigators to speak to the media if there are journalists near the accident site and there is an appropriate break in the investigators’ work. We prepare our investigators with some basic media training. We do not expect our inspectors to become polished media spokespeople – our ask is only that they are able to get our message across or publicise their witness appeal, while painting a picture for the journalist and their viewers to help them understand how we investigate. We recently published a range of pieces on our website1 to explain how we work, some of which are concise versions of articles from our previous Annual Safety Reviews.   Figure 2 Website articles about how we investigate Following a high profile accident, it is not unusual for rumours and speculation to surface, often with good intentions but based on limited information. This can be a distressing time for the bereaved and can be frustrating for operators or manufacturers, whose reputation may be on the line. We quell speculation as soon as we can, but first we have to be certain that a theory lacks credibility. This can take time, as many investigation processes are complex. 1 https://www.gov.uk/government/publications/how-we-work/how-we-work

Air Accidents Investigation Branch Annual Safety Review 2018 5 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk How we communicate and why Communication comes in peaks and troughs. For most of our investigations, after a flurry of communication when the accident has happened, the interest is muted as the investigation takes its course. It reignites when we publish our findings at the end of our investigation, or Special Bulletins as safety issues emerge during an investigation. While our public‑facing communication may have subdued, during investigations into fatal accidents, our investigators are in regular contact with the next of kin. The level of this communication varies, depending on how much information we are able to convey, and how much information relatives would like. Some families find it useful to visit us in person when we are nearly ready to publish our findings, so that we can go through our draft report and answer any questions. They may find it comforting to see the aircraft wreckage in our hangars. Our investigators also visit relatives at their own homes if they prefer not to visit our site and would like a face‑to-face opportunity to go through our findings. When our investigations conclude, we publish them in a monthly bulletin which is widely distributed in hard copy and is on our website. An ongoing challenge for us is the frequency and format of our reports. Research conducted in autumn 2018 showed divided opinion on whether our reports should be published online as soon as each investigation concludes, or wait for a printed bulletin cycle. It also showed mixed preferences around format, with some reading our reports on screen and others preferring to either receive or print their own hard copy. Our bulletins are particularly important in sharing the lessons of accidents within general aviation and a challenge for the year ahead is how we can communicate our findings more widely to improve aviation safety. Formal reports are reports on major AAIB investigations. When there is a significant media and public interest in our findings, this will be reflected in our communication approach. We may provide an animation to illustrate something technical, a briefing for journalists to help them understand complex aviation concepts so they can better inform their readers and viewers, and undertake media interviews to explain our findings. Figure 2 Media at AAIB for publication of the Hunter Accident at Shoreham Airshow formal report

Air Accidents Investigation Branch Annual Safety Review 2018 6 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk How we communicate and why AAIB UAS at rest - picture taken during an investigation

Air Accidents Investigation Branch Annual Safety Review 2018 7 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigating UAS accidents Investigating UAS accidents Introduction The AAIB started investigating accidents to Unmanned Aircraft Systems (UAS) in 2015. At the time, the AAIB was only required by regulation EU 9961 to investigate accidents and serious incidents to UAS when the unmanned aircraft (UA) weighed more than 150 kg, but there were no such UA on the civilian UK register. Under national regulations the AAIB has discretion to investigate accidents to UA of any weight when safety lessons are expected to be drawn. With the rapidly increasing number of small UAS (less than 150 kg) in UK airspace and the potential risk to 3rd parties, we decided to start investigating accidents to small UAS. Some of the benefits of doing so are: ● ● It increases AAIB knowledge of UAS and helps to prepare us for an accident involving a serious injury, fatality or a serious mid-air collision. ● ● It allows us to identify possible trends that might inform the regulations, change operational restrictions or training requirements. ● ● It enables us to inform UAS manufacturers of potential design issues. ● ● Unlike regulators and manufacturers, the AAIB can conduct a wholly independent investigation. ● ● The AAIB can make the investigation findings public and make safety recommendations intended to prevent recurrence. We have obtained information on 36 UAS accidents to date and published reports on seven of them. Reporting a UAS accident Under regulation EU 996 ‘any person involved’ who has knowledge of the occurrence of an aircraft accident or serious incident in the UK must report it to the AAIB; ‘any person’ includes (but is not limited to) the owner, operator and pilot of a UAS. All UAS accidents and serious incidents are required to be reported to the AAIB, regardless of weight or whether they are being used for commercial operations. The definition of an accident and serious incident can be found on our website2. In short, an accident has occurred if someone was fatally or seriously injured, or the aircraft has sustained damage beyond a certain level. If only the propeller blades of a multi-rotor UA have been damaged then this would not be classified as an accident. A serious incident is an incident involving circumstances indicating that there was a high probability of an accident. Footnote 1 Regulation (EU) No 996/2010 2 https://www.gov.uk/government/publications/definition-of-aircraft-accident-and-serious-incident/definition- of-aircraft-accident-and-serious-incident

Air Accidents Investigation Branch Annual Safety Review 2018 8 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigating UAS accidents If in any doubt about whether a UAS accident or serious incident needs to be reported, please report it to us anyway by calling our 24-hour reporting line +44 (0)1252 512299. AAIB UAS accident investigation policy The AAIB will investigate a UAS accident if it was being operated under a CAA permission or if the UA has a takeoff weight greater than 20 kg. The reason for the weight cut-off is above 20 kg the UA is required to have an airworthiness approval. In practice, this means that any accident involving a commercial operation, or a private operation with a UA greater than 20 kg, will be investigated. If the UAS accident involves a fatality and the UA was being operated under a CAA permission or it was above 20 kg, then the AAIB will deploy a team to the accident site and carry out a field investigation. If it isn’t a fatal accident, the AAIB will send a ‘UAS Accident Report Form’ to the pilot to collect the details. If there was a serious injury or there appears to be a significant safety issue then an investigation by correspondence will be carried out. This might include calling the pilot, analysing any recorded data and contacting the UAS manufacturer. At the end of the investigation a report will be published on our website. If none of these conditions are met then the information will be recorded on our database. Our decision tree for investigating UAS accidents is shown in Figure 1. UAS Accident/Serious  Incident reported  Operated under CAA  permission OR mass > 20 kg  Not operated under CAA  permission AND mass ≤ 20kg  Non‐fatal  Fatal  Serious injury OR significant  safety issue  Non‐serious injury AND no  significant safety issue  Send UAS Accident  Report Form  Record details on Database     Field Investigation  Correspondence  Investigation  Record details on Database  Fatal/Serious Injury  Non‐fatal  Discuss with Chief/Deputy  Write and publish report   Figure 1 UAS Investigation Decision Tree

Air Accidents Investigation Branch Annual Safety Review 2018 9 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigating UAS accidents UAS accidents investigated by the AAIB The AAIB has received completed accident report forms on 36 accidents involving UAS since February 2015. Two of these involved mid-air collisions between privately operated model gliders and manned light aircraft3. The remainder involved UAS operations under a CAA permission. Seven of these accidents, including the two mid-air collisions with light aircraft, resulted in published reports. Table 1 lists all 36 accidents by accident type. Most of the ‘loss of control’ accidents were for technical rather than piloting reasons; however, it is probable that operators are more likely to report accidents to the AAIB involving technical reasons than piloting reasons, and therefore this statistic should not be generalised. A number of the ‘loss of control (pilot)’ accidents involved gusts of wind. One involved the pilot’s remote controller tray harness strap lengthening, causing the pilot to make inadvertent inputs to the throttle which caused the UA to drop to the ground. The ‘loss of control (technical)’ accidents were for a variety of reasons including poor compass calibration, magnetic interference, IMU4 failure and electronic speed controller failure. For some the reason could not be determined. Of the six accidents involving loss of power, five involved the DJI Matrice 200 series UAS, one of which involved a battery issue and resulted in a published report. The remaining four are still under investigation and appear to relate to battery firmware issues which the manufacturer is working to resolve. Of the three ‘loss of link’ accidents, the cause of two was not determined, and the third was caused by a strong gust of wind blowing the UA behind a building where, following the loss of link, a software bug caused the UA to descend rather than return home. One of the mid-air collisions occurred between an SAS Wildthing model glider (weighing 615 grams) and a Robin DR400 light aircraft near the final approach path to Shoreham airport at about 220 to 320 ft agl. The collision was caught on video and still frames are shown in Figure 2. Despite the light weight of the glider it caused scuffing and scraping damage to the leading edge of the Robin’s wing which cost £1,400 to repair. The full report can be found on our website5. The other mid-air collision between a model glider and a light manned aircraft occurred in uncontrolled airspace away from an airfield at about 600 ft agl and the report can be found on our website6. In both mid-air collisions, the pilots of the model gliders heard the light aircraft approaching but by then it was too late for them to take avoiding action. Both pilots of the light aircraft initially thought they had hit a bird. The third mid-air collision reported to the AAIB was a collision between two UA. Footnote 3 The model gliders were below 20 kg, but as the accidents involved manned aircraft a correspondence investigation was initiated. 4 Inertial Measurement Unit 5 https://www.gov.uk/aaib-reports/aaib-investigation-to-robin-dr-400-180-f-gsbm-and-sas-wildthing-radio- controlled-model-glider 6 https://www.gov.uk/aaib-reports/aaib-investigation-to-pioneer-300-g-opfa-and-valenta-ray-x-s037996

Air Accidents Investigation Branch Annual Safety Review 2018 10 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigating UAS accidents The four accidents involving CFIT7 involved collisions with a ship, a rollercoaster, and cranes. In the first two cases the ship and rollercoaster were being filmed. The collisions with cranes occurred at constructions sites which were being surveyed by the UA. In one of these cases a construction site was being re-surveyed using a pre-programmed flight, but a third crane had been erected since the first survey. The UA was programmed to climb to 400 ft which was above the height of the cranes, but the climb occurred while the UA was flying forwards and it struck the new crane before it reached 400 ft. The operator stated that future missions would be planned such that the UA ascended vertically to 400 ft shortly after takeoff, in a safe corridor, before surveying the site and would avoid intersecting the working radius of any of the cranes. He also decided to split the mission in two and to survey the southern boundary by taking off from a new position on the south side. This would avoid flying directly across the site and would afford him a better view of the UA’s relative location to the cranes. The report on this accident can be found on our website8. Table 2 lists the type of UA that was involved in the 36 accidents in Table 1. The vast majority were multirotor UA. The accident involving the single rotor UA was a Schiebel Camcopter S-100 unmanned helicopter. It had a maximum takeoff weight of 200 kg (Figure 3). While taking off from a ship’s helideck it transited rearwards with insufficient height to clear a 19‑cm high gunwale. It hit the gunwale causing damage to its tail and resulting in it spiralling into the sea. The aircraft manufacturer came up with a software fix that prevented inadvertent pilot lateral control inputs during the initial phase of takeoff. Type of accident Number of accidents Loss of control (pilot) 7 Loss of control (technical) 10 Loss of power 6 Loss of link 3 Mid-air collision 3 CFIT 4 Other 3 TOTAL 36 Table 1 UAS accidents reported to AAIB since February 2015 Footnote 7 CFIT stands for Controlled Flight into Terrain but it also encompasses controlled flight into obstacles and vehicles. 8 https://www.gov.uk/aaib-reports/aaib-investigation-to-3dr-solo-uas-no-registration

Air Accidents Investigation Branch Annual Safety Review 2018 11 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigating UAS accidents Type of drone Number of accidents Multirotor 30 Single rotor 1 Fixed wing (powered) 3 Fixed wing (unpowered) 2 Table 2 Type of drone involved in the 36 accidents reported to the AAIB

Figure 2 Mid-air collision between SAS Wildthing model glider and Robin DR400 light aircraft

200 kg Figure 3 Schiebel Camcopter S-100 unmanned helicopter

Air Accidents Investigation Branch Annual Safety Review 2018 12 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigating UAS accidents Conclusion In the past three years the AAIB has learnt a lot about UAS and the different factors that can cause or contribute to UAS accidents. Whenever we perceive that there is a significant safety issue or a significant safety lesson to convey, then we aim to publish a report. We have published seven reports on UAS accidents so far and all these reports and any future reports can be accessed at this on our website9. We would like to encourage UAS operators to report accidents and serious incidents to us so that other operators and the UAS industry can learn from them. Footnote 9 https://www.gov.uk/aaib-reports?keywords=&aircraft_category%5B%5D=unmanned-aircraft- systems&date_of_occurrence%5Bfrom%5D=&date_of_occurrence%5Bto%5D= AAIB UAS in use - picture taken for aerial survey during an investigation

Air Accidents Investigation Branch Annual Safety Review 2018 13 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2018 CICTT Factors on Investigations by the AAIB in 2018 Every occurrence in the UK is recorded on the European Central Repository (ECCAIRS) and is coded using the occurrence taxonomy defined by the CAST/ICAO Common Taxonomy Team (CICTT). This is a worldwide standard taxonomy to permit analysis of data in support of safety initiatives. In the UK the coding of occurrences is carried out by the CAA. It should be noted that they are recorded as multiple factors, for example turbulence (TURB) leading to loss of control in flight (LOC-I). Similarly, other (OTHER) is also used and may include maintenance manual errors or human factors, aspects that do not have specific classifications. ARC OTHR SCF-NP LOC-I LOC-G RE SCF-PP CTOL GCOL TURB MED FUEL UNK WSTRW AMAN CABIN F-NI F-POST CFIT RAMP EVAC GTOW ICE MAC NAV AD... LALT UI... US... 39 32 31 27 17 15 13 82 82 46 See Appendix 1 for category descriptions Factors for all investigations reported on by AAIB in 2018 LOC-I 39 SCF-NP 46 ARC 82 SCF-PP 27 CTOL 17 GCOL 15 TURB 13 OTHR 82 RE 31 LOC-G 32 F-IN F-POST AMAN CABIN UNK WSTRW MED FUEL

Air Accidents Investigation Branch Annual Safety Review 2018 14 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2018 Field investigations See Appendix 1 for category descriptions ARC OTHR SCF-NP LOC-G LOC-I RE SCF-PP GCOL TURB MED WSTRW AMAN F-NI FUEL UNK CFIT GTOW ICE NAV F-POST MAC UIMC 11 11 7 4 3 3 2 2 2 2 2 2 2 2 Factors for field investigations reported on by AAIB in 2018 In 2018 the AAIB reported on 31 field investigations, 9 of which were fatal accidents in the UK and 22 were non-fatal accidents or serious incidents. The 22 non-fatal field investigations that were reported on in 2018 were mostly on serious incidents to commercial air transport (CAT) aircraft. The majority of CAT serious incidents were attributed to system/component failure or malfunction not related to the engines (SCF‑NP). LOC-I 11 SCF-NP 11 ARC 2 SCF-PP 2 F-POST 4 GCOL 2 TURB 3 OTHR 7 RE 3 LOC-G 2 NAV WSTRW UIMC MED F-NI GTOW ICE FUEL 2 CFIT 2 AMAN MAC 2 UNK 2

Air Accidents Investigation Branch Annual Safety Review 2018 15 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2018 Correspondence investigations ARC OTHR SCF-NP LOC-I LOC-G RE SCF-PP CTOL GCOL TURB MED FUEL UNK WSTRW AMAN CABIN F-NI CFIT RAMP EVAC GT... ICE NAV AD... LALT US... 80 75 35 30 28 28 25 17 13 10 See Appendix 1 for category descriptions Factors for correspondence investigations reported on by AAIB in 2018 Correspondence investigations are usually conducted on non-fatal accidents on GA aircraft and to some serious incidents on CAT aircraft. The factors most predominant in these occurrences were classified as abnormal contact with the ground (ARC), commonly the result of a hard or bounced landing. LOC-I 28 AMAN ARC 80 CTOL 17 F-IN SCF-NP 35 SCF-PP 25 GCOL 13 TURB 10 RAMP UNK LOC-G 30 WSTRW CABIN MED FUEL OTHR 75 RE 28

Air Accidents Investigation Branch Annual Safety Review 2018 16 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2018 Fatal investigations LOC-I OTHR F-POST RE TURB FUEL MAC SCF-PP CFIT GCOL UNK AMAN GTOW UIMC See Appendix 1 for category descriptions 7 3 2 2 2 1 1 1 2 1 1 1 Factors for fatal investigations reported on by AAIB in 2018

The predominant cause of fatal accidents in general aviation, in common with previous years, was loss of control in flight (LOC-I). However, other factors were also identified during our investigations. The post-crash fire (F-POST) is a factor which relates to survivability for the occupants once they are on the ground.

LOC-I 7 RE 1 FUEL 1 SCF-PP 1 GCOL 2 GTOW 1 OTHR 2 MAC 1 F-POST 3 TURB LINK 2 UIMC CFIT 2 AMAN 1

Air Accidents Investigation Branch Annual Safety Review 2018 AAIB Air Accidents Investigation Branch 17 © Crown copyright 2019 www.aaib.gov.uk @aaibgovuk Aircraft Accident Reporting - Telephone number +44 (0)1252 512299 Statistics for 2018 An overview of what we were involved with during 2018 can be seen below: UK Registered Overseas 23 Average months to publication for a Field Investigation 11.7 4.0 Average months to publication for a Correspondence Investigation Number of Correspondence Investigation Reports published 184 Total number of Correspondence (AARF) Investigations opened 221 Number of Safety Recommendations 15 Referred to Sporting Associations 40 Number of Field Reports published 31 Overseas (no AAIB involvement) 9 Military (no AAIB involvement) 2 UK Fatal Accidents 9 Number of Deaths 16 Foreign Registered Overseas 41 Number of Formal Reports published 2 No further AAIB action (Civil) 341 Number of Special Bulletins published 2 UK Field Investigations opened 26 15.4 Average months to publication for a Formal Investigation Total Number of Notifications received by the AAIB 706 Number of Safety Actions noted 60 Investigation Statistics Number of UAS Correspondence Investigations opened 11 Military (AAIB assistance) 3 Joint Military & Civil Aircraft 0

Air Accidents Investigation Branch Annual Safety Review 2018 18 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Introduction The following pages provide the statistics for 2018, 2017 and 2016, for accidents and serious incidents involving the Air Accidents Investigation Branch. An explanation of the categories is as follows: Category Definition UK Aircraft overseas Investigations involving UK registered aircraft, or aircraft registered in one of the UK Overseas Territories or Crown Dependencies, occurring in a Foreign State where the AAIB has participated in the capacity as the Accredited Representative in accordance with ICAO Annex 13. Foreign Aircraft overseas Accidents and serious incident investigations to Foreign registered aircraft occurring in a Foreign State where the AAIB has participated in the capacity as the Accredited Representative or Expert in accordance with ICAO Annex 13. UK Field Investigations Investigations involving the deployment of a ‘Field’ team within the UK or to one of the UK Overseas Territories or Crown Dependencies and those investigations where a team has not deployed but Safety Recommendations are made. Also includes investigations which have been delegated to the AAIB by another State. Unnmanned Aircraft Systems Refer to article on page 7 of this document. (UAS) Military with AAIB Assistance Where an MoD Service Inquiry is convened following an accident / serious incident to a Military aircraft and an AAIB Inspector is appointed to assist. AARF Investigations Investigations conducted by correspondence only using an Aircraft Accident Report Form (AARF) completed by the aircraft commander. Overseas (no AAIB) Notifications to the AAIB of an overseas event which has no AAIB involvement. Referrals to Sporting Investigations referred to the relevant UK Sporting Associations. Associations No further AAIB action (Civil) Occurrences notified to the AAIB involving civil registered aircraft which do not satisfy the criteria of an accident or serious incident in accordance with the Regulations. Military (no AAIB inv) Notifications to the AAIB concerning Military aircraft with no AAIB involvement.

Air Accidents Investigation Branch Annual Safety Review 2018 19 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Notifications 2018 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 2 1 1 2 4 4 3 0 2 4 0 0 23 Foreign Reg Overseas 5 6 3 1 2 5 4 5 1 3 4 2 41 UK Field Investigations 2 4 0 3 2 3 4 2 0 5 1 0 26 Military (AAIB Assistance) 0 0 1 0 0 1 1 0 0 0 0 0 3 Total no of Correspondence Investigations (AARF) 7 14 9 16 28 29 34 24 20 20 12 8 221 Correspondence Investigations (AARF) involving UAS 1 1 0 0 1 1 1 0 2 3 0 1 11* Overseas (no AAIB involvement) 1 1 1 0 2 0 1 0 1 0 2 0 9 Referred to the appropriate Aviation Sporting Association 1 4 0 3 8 7 6 6 0 3 0 2 40 Total no further AAIB action (civil) 15 22 29 22 28 44 37 50 28 33 23 10 341 Total no further AAIB action (civil) inv UAS 0 0 2 0 1 1 3 2 0 1 1 1 12* Military (no AAIB involvement) 0 1 0 0 0 0 0 0 1 0 0 0 2 Total 33 53 44 47 74 93 90 87 53 68 42 22 706 UK Fatal accidents 1 0 0 1 1 3 1 0 0 2 0 0 9 Number of deaths 2 0 0 2 1 3 1 0 0 7 0 0 16 UK Registered Overseas 3% Foreign Reg Overseas 6% UK Field Investigation 4% Military (AAIB assist) 1% Correspondence Investigation (AARF) 31% Overseas (no AAIB involvement) 1% Referred to the appropriate Aviation Sporting Association 6% Non-reportable (Civil) 48% Non-reportable (Military) 0%

• Included in the

total numbers of AARF and non-reportable investigations.

Air Accidents Investigation Branch Annual Safety Review 2018 20 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics UK Registered Overseas 6% Foreign Reg Overseas 9% UK Field Investigation 6% Military (AAIB assist) 0% Correspondence Investigation   (AARF) 29% Overseas (no AAIB involvement) 1% Referred to the appropriate Aviation  Sporting Association 7% Non‐reportable (Civil) 42% Non‐reportable (Military) 0% Notifications 2017 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 5 4 3 4 5 4 6 2 5 4 2 0 44 Foreign Reg Overseas 3 3 4 9 6 7 8 4 5 2 3 7 61 UK Field Investigations 2 3 4 2 6 3 2 4 5 1 2 4 38 Military (AAIB Assistance) 0 0 0 0 0 1 0 0 0 0 0 0 1 Correspondence Investigations (AARF) 9 7 15 15 36 29 24 25 17 11 10 6 204 Overseas (no AAIB involvement) 2 1 0 1 0 0 1 1 1 1 0 1 9 Referred to the appropriate Aviation Sporting Association 4 2 1 5 9 9 4 9 3 2 2 2 52 No further AAIB action (civil) 15 19 24 22 22 29 33 27 32 34 18 23 298 Military (no AAIB involvement) 0 1 0 0 0 0 0 0 0 0 0 0 1 Total 40 40 51 58 84 82 78 72 69 55 37 43 708 UK Fatal accidents 1 0 1 1 3 2 1 1 3 0 1 2 16 Number of deaths 1 0 5 1 4 2 2 2 4 0 4 3 28

Air Accidents Investigation Branch Annual Safety Review 2018 21 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Notifications 2016 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 5 3 5 6 6 4 6 4 2 4 3 2 50 Foreign Reg Overseas 1 5 4 7 4 9 3 5 18 8 6 4 74 UK Field Investigations 3 2 2 2 1 3 8 3 3 4 2 5 38 Military (AAIB Assistance) 0 0 0 0 0 0 0 1 0 0 0 0 1 Correspondence Investigations (AARF) 9 15 10 16 19 25 27 31 22 16 8 10 208 Overseas (no AAIB involvement) 1 2 1 1 0 0 0 0 0 2 0 0 7 Referred to the appropriate Aviation Sporting Association 1 2 3 4 4 3 5 9 8 4 0 1 44 No further AAIB action (civil) 18 12 19 20 22 27 29 23 21 11 15 14 231 Military (no AAIB involvement) 0 0 0 1 0 0 0 1 0 0 0 1 3 Total 38 41 44 57 56 71 78 77 74 49 34 37 656 UK Fatal accidents 0 0 1 1 1 1 4 1 1 2 0 2 14 Number of deaths 0 0 1 2 2 2 4 1 2 2 0 2 18 UK Registered Overseas 8% Foreign Reg Overseas 11% UK Field Investigation 6% Military (AAIB assist) 0% Correspondence Investigation   (AARF) 32% Overseas (no AAIB involvement) 1% Referred to the appropriate Aviation  Sporting Association 7% Non‐reportable (Civil) 35% Non‐reportable (Military) 0%

Air Accidents Investigation Branch Annual Safety Review 2018 22 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Air Accidents Investigation Branch European Best Practice Short Course on Air Accident and Serious Incident Investigation This activity was performed under the EU-South Asia Aviation Partnership project, funded by the European Union and implemented by the European Aviation Safety Agency www.eu-southasia-app.org © Crown Copyright 2018 Held at Farnborough, UK 19 November to 23 November 2018 Air Accident and Serious Incident Investigation Course 19 - 23 November 2018 AAIB Air Accidents Investigation Branch The AAIB organises training courses at its headquarters in Farnborough and overseas

Air Accidents Investigation Branch Annual Safety Review 2018 23 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendations in 2018 In 2018 the AAIB issued 15 Safety Recommendations from 8 investigations. Each Safety Recommendation is classified using the SR Topic taxonomy defined by the European Network of Safety Investigation Authorities (ENCASIA) Working Group 6 (WG6) which the AAIB is a member of. The majority of the Safety Recommendations were dealing with safety issues relating to aircraft operations and safety risk management. Each addressee to a Safety Recommendation has to respond within 90 days in accordance with European Regulation EU 996/2010 Article 18 and detail what actions have been taken or are under consideration and the time taken for their completion. If no actions are being considered by the addressee they have to provide their reasoning for the decision. On receipt the AAIB has 60 days in which to assess the response and to inform the addressee on whether it is adequate. If the reply is not adequate or is partially adequate then justification is provided to the addressee. The responsibility for monitoring the progress of action taken in response to a recommendation lies with the addressee including the authorities responsible for civil aviation safety. The AAIB will keep open Safety Recommendations where it expects to receive responses from the addressee. If no further response is expected the recommendation is closed. A closed status does not necessarily mean the actions for a Safety Recommendation are complete, nor that the Safety Issue has been addressed. 13 17 26 32 28 32 9 10 26 38 40 19 20 17 39 82 39 76 68 114 76 58 37 82 69 66 58 57 95 55 139 109 150 146 128 98 109 95 103 39 23 42 47 57 29 15 0 20 40 60 80 100 120 140 160 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018

Air Accidents Investigation Branch Annual Safety Review 2018 24 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview The chart above shows the recommendation topics. It should be noted that a recommendation can encompass several topics within the classification system. A ‘Not adequate’ assessment means that the response does not address the intent of the Safety Recommendation nor does it address the safety issue concerned. A ‘Partially adequate’ assessment means the response goes someway to meeting the intent of the Safety Recommendation and the action will address the safety issue to a certain extent, but further action would be required to fully address the issue identified. An ‘Adequate’ assessment means that the response fully meets the intent of the Safety Recommendation and the action is expected to address the safety issue. Of the 15 Safety Recommendations issued in 2018, as of the end of January 2018, responses have been received for 10. Four were assessed to be adequate, 4 were assessed to be partially adequate and 2 have been received recently and are pending AAIB classification. The AAIB is awaiting responses to 5 other recommendations. Following assessment, 6 Safety Recommendations have been closed leaving 9 open at the time of writing. Each Safety Recommendation is also defined as to whether it is a Safety Recommendation of European Union Wide Relevance (SRUR) or a Safety Recommendation of Global Concern (SRGC). Of those issued in 2018, 7 were SRUR and 8 were SRGC. The AAIB, as well as all EU Member States, is required to record on the European Central Repository Safety Recommendation Information System (SRIS) all recommendations it raises and the responses received. Data from SRIS is available to view publically at: http://eccairsportal.jrc.ec.europa.eu/index.php?id=114&no_cache=1 Safety Recommendation Topics Procedures / Regulations - Aircraft operations Personnel - Medical / Human Factors Procedures / Regulations Procedures / Regulations - Aircraft maintenance/inspection Aircraft / Equipment / Facilities - Aircraft equipment - Recorded data systems Procedures / Regulations - Oversight/Auditing Aircraft / Equipment / Facilities - Aircraft equipment Aircraft / Equipment / Facilities - Aircraft equipment - Transmission / rotor systems Procedures / Regulations - Design/Production/Manufacturing Aircraft / Equipment / Facilities - Aircraft documentation Aircraft / Equipment / Facilities - Aircraft equipment - Aircraft systems Aircraft / Equipment / Facilities - Other Personnel - Training / proficiency / check Procedures / Regulations - Aircraft certification Procedures / Regulations - ANS maintenance/inspection Procedures / Regulations - Other 0 1 2 3 5 6 4 7

Air Accidents Investigation Branch Annual Safety Review 2018 25 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendations issued in 2018

Notes: Safety Recommendation classification correct at the end of December 2018. Safety Recommendations can also be made through AAIB Special Bulletins and are then also reflected in the final report. G-GARB EV-97 Teameurostar UK on 18 September 2016 The aircraft was seen cruising at an altitude of around 2,500 ft. At a later point it was seen to pitch nose-up and enter a steep spinning-type descent before striking the ground, resulting in fatal injuries to the pilot and passenger. The left wing had appeared to fold rearwards in the descent and this was attributed by the investigation to a structural failure near the root of this wing, caused by upward bending of the wing beyond its design limits. No pre-existing material defect, or significant design issue, was found in the wing structure. The failure is most likely to have occurred as a result of an attempted recovery from an inadvertent manoeuvre inducing a structural overload, although the cause of the manoeuvre could not be identified. It was not possible to determine what events led to the structural overload in this accident but it is of concern that the trim lever in this aircraft type is located in a position, and is of a design, where there is a potential for it to be moved rapidly full-range, either by accident or intent. There are other microlight aircraft that have pitch trim levers but the LAA and BMAA were not aware of any other that had a pitch trim lever located between the seats as on the EV‑97. There have been occasions of inadvertent operation of the trim lever on the EV‑97 and the flight evaluation revealed the potential for this causing a significant upset. According to BCAR Section S 677, the trim system should be designed to prevent ‘inadvertent, improper, or abrupt trim operation’. Safety Recommendation 2018-001 made on 2 February 2018 It is recommended that the Civil Aviation Authority require the Light Aircraft Association, the British Microlight Aircraft Association, Light Sport Aviation Ltd and Evektor to conduct a joint review of the design and location of the pitch trim mechanism on the EV-97 Teameurostar UK, and the amateur-built EV‑97 Eurostar, to identify whether modification is required to prevent inadvertent, improper or abrupt input. Response Adequate – Closed

Air Accidents Investigation Branch Annual Safety Review 2018 26 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview N603AB Cessna 402C on 11 February 2017 The aircraft landed at Virgin Gorda in conditions (of weight, altitude, temperature and surface condition) where the landing distance required was very close to the landing distance available and without the required safety margin. Hence, when the performance of the brakes was not as expected, probably due to debris in the braking system, the aircraft could not be stopped on the runway. Analysis of the maintenance state of the aircraft involved in this accident indicated that the maintenance capability, processes and planning of its operator were not consistent with the standards expected in conducting international passenger charter services. This appeared also to be the case for the operational procedures and data management. Safety Recommendation 2018-002 made on 1 March 2018 It is recommended that the Federal Aviation Administration review the maintenance capability, processes and planning of Air Sunshine to ensure that they are sufficiently robust for conducting international passenger charter services. Response Partially Adequate – Closed Safety Recommendation 2018-003 made on 1 March 2018 It is recommended that the Federal Aviation Administration review the operations data management and operating procedures of Air Sunshine to ensure that they are sufficiently robust for conducting international passenger charter services. Response Partially Adequate – Closed G-CKLR SZD-55-1 on 8 April 2017 During a towed launch, the glider was seen to climb rapidly. After disconnecting from the tow rope with a very high pitch angle, the glider rolled to the right and descended before hitting the ground in a nose-down attitude. The pilot was fatally injured. The investigation determined that the elevator control connection had not been correctly made when the glider was rigged and this condition was not detected prior to the flight. Consequently, during the launch, the glider would have had no effective elevator control and the pilot would have been unable to control the pitch of the glider. It was found that an historic and unapproved modification to the glider significantly increased the opportunity for mis-rigging. As a result, the European Aviation Safety Agency have taken safety action to mandate an inspection of similar gliders.

Air Accidents Investigation Branch Annual Safety Review 2018 27 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview It was not established if, or how, a positive control check was performed by the pilot of G-CKLR after completion of its rigging. However, the guidance in the BGA Safety Briefing Leaflet could be interpreted to mean that these checks are not required for gliders with automatically-connecting controls. The following Safety Recommendation is therefore made: Safety Recommendation 2018-004 made on 1 March 2018 It is recommended that the British Gliding Association review its policy on the need for positive control checks on gliders with automatically-connecting controls and, where appropriate, amend its relevant publications including the Safety Briefing Leaflet entitled ‘Is your glider fit for flight?’. Response Adequate – Closed OK-LAZ Let L-410UVP-E on 23 February 2017 The aircraft departed Isle of Man (Ronaldsway) Airport (IOM) on a commercial flight to Belfast City Airport (BHD), in a region affected by a deep low pressure system with associated strong surface winds. After one unsuccessful attempt to land at BHD in a strong crosswind, the crew diverted back to IOM. When the aircraft landed at IOM the wind was gusting to 63 kt and creating a maximum crosswind component of 40 kt. After touchdown, nearby witnesses saw the right mainwheel lift off the ground and they estimated the left wingtip rolled to within approximately one metre of the runway surface before the landing was successfully completed. The relevant maximum demonstrated crosswind component for the Let L-410 was 19.4 kt and this was included in the ‘Performance Limitations’ section of the Airplane Flight Manual (AFM) but the aircraft operator did not apply a limiting component of crosswind to its operations. The only wind limit that was applied and used by the crew was 45 kt for ground operation. As a result of this serious incident the CAA of the Czech Republic stated that several safety actions have been completed, including:

1. The aircraft operator has increased the time allocated between crew report and

the scheduled departure time to 60 minutes and incorporated this in the operations manual Part A.

Air Accidents Investigation Branch Annual Safety Review 2018 28 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

1. The aircraft operator has updated the crosswind limits in OM Part B. No details of the

changes have been provided except a statement that the OM now offers guidance for taking off and landing in a crosswind, and that the EASA SIB 2014-20 has been taken into account.

1. The CAA of the Czech Republic has also stated that recent audits of the aircraft

operator have focussed on hazard identification and safety risk management, with particular focus on operations in hazardous weather conditions. These safety actions address some of the factors identified in this report but there appears to be a number of issues concerning operational control and supervision which still require attention. While this investigation highlighted certain of the operator’s policies and procedures which did not comply with regulatory requirements, it is possible that there are areas outside the scope of this investigation that may also require review. To ensure that the aircraft operator’s processes and procedures are effectively compliant with the applicable regulations the following safety recommendation is made: Safety Recommendation 2018-005 made on 1 March 2018 It is recommended that the Civil Aviation Authority of the Czech Republic review Van Air’s operational processes, training and operator’s guidance to ensure that they are effectively compliant with the applicable regulations for commercial air transport operations. Response Adequate – Closed G-WNSR Sikorsky S-92A on 28 December 2016 The helicopter was being operated from Aberdeen on a contract on behalf of an offshore oil and gas company. On 27 December 2017, during a flight on the day prior to the accident, the Health and Usage Monitoring System (HUMS) recorded vibration data which contained a series of exceedances related to the tail rotor pitch change shaft (TRPCS) bearing. Routine maintenance was carried out overnight which included a download and preliminary analysis of the HUMS data. While an anomaly for tail rotor gearbox (TGB) bearing energy was detected by the maintenance engineer, the exceedances were not identified, in part, due to the way they were presented in the analysis tool; the helicopter was released to service without further investigation. The investigation identified that had HUMS exceedance data been available on the helicopter in near real time, the flight crew would have had at least two pre-departure opportunities to safely abort the flight. Additionally, should G-WNSR have had such a capability, it is considered likely that, after the initial incident and re-land on the Elgin, the flight crew would have made use of it and that it would have informed their judgement as to whether to depart for the West Franklin.

Air Accidents Investigation Branch Annual Safety Review 2018 29 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Furthermore, given the circumstances of this event and the short timescale over which the problem developed, providing flight crews with a simple means to establish the health and serviceability of their helicopter whilst away from a maintenance base could be the only effective barrier remaining to prevent an accident. Safety Recommendation 2018-006 made on 13 March 2018 It is recommended that the European Aviation Safety Agency commission research into the development of Vibration Health Monitoring data acquisition and processing, with the aim of reducing the data set capture interval prescribed in the Acceptable Means of Compliance to CS 29.1465 and thereby enhancing the usefulness of VHM data for the timely detection of an impending failure. Response Adequate – Closed Safety Recommendation 2018-007 made on 13 March 2018 It is recommended that the European Aviation Safety Agency amend the regulatory requirements to require that Vibration Health Monitoring data gathered on helicopters is analysed in near real-time, and that the presence of any exceedance detected is made available to the flight crew on the helicopter; as a minimum, this information should be available at least before take-off and after landing. Response Partially Adequate – Open G-ZBKF Boeing 787-9 on 29 April 2017 The aircraft was on a scheduled flight from London Heathrow to New Delhi, India. The aircraft was dispatched in accordance with the Minimum Equipment List (MEL) with the left air conditioning (AC) system disabled. Shortly after reaching FL350 the crew were alerted by EICAS that the cabin altitude was increasing above normal, triggered at 8,500 feet. With no additional Environmental control system (ECS) actions available to control cabin altitude, the flight crew initiated a descent. During this descent the cabin altitude exceeded 10,000 ft and the crew completed the relevant emergency actions. The loss of cabin pressurisation was caused by detachment of the lower right air conditioning recirculation fan duct on a sector where the left air conditioning system had been disabled before flight. As a consequence of this finding, the Aircraft Maintenance Manual has been amended to alter the process of replacing the relevant recirculation fan and maintenance procedures to react to a related Maintenance Alert Message have been altered.

Air Accidents Investigation Branch Annual Safety Review 2018 30 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

The investigation also identified a software problem related to the volume of the cabin decompression pre-recorded announcement (PRA) in the passenger cabin and makes three Safety Recommendations, concerned with the testing of the installed performance of CVR systems. A review of the cockpit area microphone (CAM) recordings for the Boeing 787 indicated that airflow in the cockpit from the equipment cooling system appeared to contribute to the high level of ambient background noise, as a significant reduction in background noise is apparent on the CAM recording when the system was turned off. Discussions further indicated that the level of ambient background noise recorded by the CAM may not truly represent that experienced by a human observer in the cockpit. This indicates that the CAM installation is not optimised.

The NTSB has previously made Safety Recommendation A-14-126 to address the performance of the CAM recording on the Boeing 787. As of April 2018 this Safety Recommendation remains ‘OPEN’, awaiting a final response from the FAA. Therefore, although issues were found in this incident that are similar to those that caused the NTSB to issue Safety Recommendation A-14-126, the AAIB considers that it is not necessary to make a further Safety Recommendation on this subject. However, this AAIB investigation has highlighted an additional issue with the Boeing 787 CVR performance. A significant difference exists between the recorded dynamic range when the headset and oxygen mask microphones are used. The aircraft manufacturer attenuated the sidetone signal so that ATC communications did not inadvertently mask the crew speech when using the headset microphone. However, when the oxygen masks are used, the sidetone signal can be easily obscured due to the much higher signal level of the oxygen mask microphone. The aircraft manufacturer was aware of this during certification, but considered that it was acceptable. Although audio processing techniques may be applied to reduce the effect of the issues identified with the CVR recordings of the crew and CAM channels, it is not always possible to recover quieter background sounds and speech. Consequently, information that may be of significance to an investigation may be lost. Safety Recommendation 2018-008 made on 5 July 2018 It is recommended that the Federal Aviation Administration require Boeing to modify the audio system fitted to the Boeing 787, so that sidetone signals recorded on the cockpit voice recorder crew channels are not masked when flight crew oxygen mask microphones are in use. Response Received - pending AAIB classification

Air Accidents Investigation Branch Annual Safety Review 2018 31 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendation 2018-009 made on 5 July 2018 It is recommended that the European Aviation Safety Agency initiate a review to consider whether a repeatable and objective analysis technique can be applied to audio recordings to establish consistent installed performance of cockpit voice recorder systems. Response Partially Adequate – Open Safety Recommendation 2018-010 made on 5 July 2018 It is recommended that the European Organization for Civil Aviation Equipment (EUROCAE) amend their document ‘Minimum Operational Performance specification for Crash Protected Airborne Recorder Systems’ (currently ED‑112A) to include a repeatable and objective analysis technique to establish consistent installed performance of cockpit voice recorder systems. Response Received - pending AAIB classification LX-VCF Boeing 747-8R7F on 30 March 2017 Following an uneventful scheduled cargo flight, it became apparent after landing that a large quantity of fuel had leaked from a Bell 412EP helicopter which was being shipped as cargo on the main deck of the freighter aircraft. The escaped fuel then made its way through the lower deck and spilled onto the airport apron. Airport Rescue and Fire Fighting Services (RFFS) attended the aircraft to contain the fuel spill and manage the associated risk of fire and explosion. The investigation determined that the helicopter, which was disassembled and prepared for transportation some months prior to the incident, had not been shipped in accordance with the required provisions for transportation of such vehicles by air. In particular, the helicopter had not been drained of fuel prior to transportation. Approximately 322 litres of fuel escaped from the helicopter during the flight. Correspondence and documentation relating to the sale of the helicopter indicated that the seller would assist the buyer in disassembly and preparation of the helicopter for transportation, under the supervision of the buyer’s representatives. The buyer believed that these preparations would include defuelling of the helicopter. The seller considered that all transportation matters were the responsibility of the buyer, but was aware of the intention for the helicopter to be transported as air cargo. Notwithstanding the issue of where the contractual commitment for preparation and defuelling of the helicopter lay, the disassembly of the helicopter and preparations for

Air Accidents Investigation Branch Annual Safety Review 2018 32 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview its transport took place at the seller’s facility and were conducted by its staff, despite a substantial amount of fuel remaining on the helicopter. The buyer assumed that the helicopter would be prepared in accordance with guidance published by the helicopter manufacturer, which recommends defuelling as part of the preparations for transportation. The preparations also included packaging of the helicopter using an open flame, which would have represented a significant health and safety risk to those involved. Neither the seller’s staff undertaking the disassembly, nor the buyer’s representatives who were subsequently in attendance, identified the fact that a substantial amount of fuel remained onboard the helicopter prior to it being packaged and transported. Safety Recommendation 2018-011 made on 11 July 2018 It is recommended that Bristow US LLC review their procedures relating to the preparation of helicopters for air transportation to ensure they are defuelled. Response Awaited – Open C-FWGH Boeing 737-86J on 21 July 2017 At 1539 hrs on 21 July 2017, a Boeing 737-800 took off from Belfast International Airport (BFS) with insufficient power to meet regulated performance requirements. The aircraft struck a supplementary runway approach light, which was 36 cm tall and 29 m beyond the end of the takeoff runway. An outside air temperature (OAT) of -52°C had been entered into the Flight Management Computer (FMC) instead of the actual OAT of 16°C. This, together with the correctly calculated assumed temperature thrust reduction of 48°C, meant the aircraft engines were delivering only 60% of their maximum rated thrust. The low acceleration of the aircraft was not recognised by the crew until the aircraft was rapidly approaching the end of the runway. The aircraft rotated at the extreme end of the runway and climbed away at a very low rate. The crew did not apply full thrust until the aircraft was approximately 4 km from the end of the runway, at around 800 ft aal. The aircraft manufacturer released two service bulletins, prior to this serious incident, detailing the procedure to update the FMC OPS software and the CDS to the BP15 standard on Boeing 737NG aircraft. The aircraft manufacturer recommends that all Boeing 737NG operators embody both service bulletins by January 2019 but such action is not compulsory.

Air Accidents Investigation Branch Annual Safety Review 2018 33 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Therefore, given the potential consequences of departing with an incorrectly set N1, and because this serious incident would have been prevented by the OAT crosscheck, the AAIB made Safety Recommendation 2017-016 in Special Bulletin S2/2017. The recommendation asked the FAA to take measures to ensure the OAT crosscheck capability was incorporated into Boeing 737NG aircraft. In its initial response, the FAA stated that it needed to gather more information on the implications of this recommendation before replying more substantively, which it undertook to do by December 2018. A small number of older Boeing 737 aircraft, which predate the Boeing 737NG series, are also able to implement the OAT crosscheck, so the following Safety Recommendation is made which supersedes Safety Recommendation 2017-016: Safety Recommendation 2018-012 made on 14 November 2018 It is recommended that the Federal Aviation Administration mandate the use of Flight Management Computer OPS software revision U12.0, or later, and the Common Display System Block Point 15 update where this is required, to enable the outside air temperature crosscheck on all applicable Boeing 737 aircraft. Response Awaited – Open The electronic flight bag (EFB) used to calculate the takeoff data complied with the Canadian AMC document and was approved for use as a performance tool. However, there was no requirement to display the calculated N1, the parameter which defines each engine’s thrust and, therefore, determines the aircraft’s ability to meet takeoff performance requirements. Had N1 been displayed on the EFB, it would have allowed the pilots to crosscheck the value of N1 calculated by the FMC. Had they done so, they would have noticed the significant difference between the two calculated figures and investigated the discrepancy, and this would have probably prevented this serious incident. However, whilst the aircraft manufacturer required the crews to verify the N1, there was no specified procedure to do so. An N1 crosscheck would also highlight other errors that have caused serious incidents and accidents, including selecting the wrong fixed derate and entering an incorrect assumed temperature. Such errors would not be picked up by the automated OAT crosscheck which would only identify erroneous OAT entries. However, the errors would lead to a discrepancy between the EFB and FMC-calculated N1 and, if the N1 figures were crosschecked by the crew, there would be an opportunity for these additional types of errors to be picked up and corrected before they led to an incident or accident. For aircraft not equipped with EFBs, a crosscheck of FMC-calculated N1 against an alternative, independently-calculated value would increase the likelihood of identifying the error.

Air Accidents Investigation Branch Annual Safety Review 2018 34 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Recommendation 2018-013 made on 14 November 2018 It is recommended that the Boeing Commercial Airplanes give guidance to operators of Boeing 737 aircraft on how they might verify the FMC-calculated value of N1 against an independently-calculated value. Response Awaited – Open EUROCAE WG-94 concluded that it was not possible to develop standards and operational conditions for Takeoff Performance Monitoring Systems (TOPMS). Based on this, EASA responded to the Dutch Safety Board recommendation on TOPMS stating that, because the feasibility of TOPMS had not been demonstrated, no specifications could be developed. This report has demonstrated the feasibility of Takeoff Acceleration Monitoring Systems (TAMS), a simpler system than TOPMS which, nevertheless, has the potential to prevent potentially catastrophic accidents related to incorrectly-calculated takeoff performance. Safety Recommendation 2018-014 made on 14 November 2018 It is recommended that the European Aviation Safety Agency, in conjunction with the Federal Aviation Administration, sponsor the development of technical specifications and, subsequently, develop certification standards for a Takeoff Acceleration Monitoring System which will alert the crew of an aircraft to abnormally low acceleration during takeoff. Response Awaited – Open The aviation industry has been concerned about aiding pilot decision-making during takeoff at least since the accident to a McDonnell Douglas DC-8 at Anchorage, USA in

1. Following that accident the NTSB made a recommendation related to a crew’s

ability to ‘appraise the aircraft’s acceleration to V1 speed’. Following the accident to a McDonnell Douglas DC-10 at Boston, USA in 1982, the industry began actively considering an automated Takeoff Acceleration Monitoring System. Since then, there have been numerous incidents and accidents related to abnormal takoff performance leading to recommendations from the AAIB in the UK, the ATSB in Australia, the BEA in France, the NTSB in the USA, the TSB in Canada and the DSB in the Netherlands. Safety Recommendation 2018-015 made on 14 November 2018 It is recommended that the International Civil Aviation Organization note the conclusions of this report and introduce provisions addressing Takeoff Acceleration Monitoring Systems. Response Awaited – Open

Air Accidents Investigation Branch Annual Safety Review 2018 35 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Actions from investigations reported on in 2018 Early in an investigation the AAIB will engage with authorities and organisations which are directly involved and have the ability to act upon any identified safety issues. The intention is to prevent recurrence and to that end to encourage proactive action whilst the investigation is ongoing and not for those involved to wait for the issue of official Safety Recommendations. When safety action is taken, it may mean there is no need to raise a Safety Recommendation as the safety issue may have been addressed. However, if the issue remains then a Safety Recommendation will be raised. The published report details the safety issues and the safety action that has taken place, usually with a green highlight. In 2018 safety actions directly as a result of AAIB investigations were recorded on two formal investigations, two Special Bulletins, nineteen field investigations and sixteen correspondence investigations. FORMAL INVESTIGATIONS

Sikorsky S-92A, G-WNSR on 28 December 2016 The details of this accident are shown under Recommendation 2018-006 and 2018-007 shown under Safety Recommendations Issued in 2018 of this Annual Safety Review. Safety issues – HUMS procedures, component failure, airworthiness AAIB Special Bulletin The AAIB published Special Bulletin S1-2017 which provided the initial facts of this investigation. The Special Bulletin presented the following safety actions: Safety action by the helicopter operator The operator subsequently introduced a number of measures to further strengthen the ability to detect impending bearing degradation. These included: a review of all HUMS data to ensure no anomalies, fleet-wide borescope inspections and a requirement for HUMS to be serviceable before flight. The operator also reviewed their HUMS processes and analytical procedures, correcting the omission in the documentation of the use of the IMDHUMS ToolBar analysis tools. They also introduced a requirement for an additional assurance check to be carried out by a second licensed engineer prior to releasing the helicopter to service.

Air Accidents Investigation Branch Annual Safety Review 2018 36 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety action by the helicopter manufacturer On 31 December 2016 the helicopter manufacturer issued to all operators an ‘All Operators Letter’ (AOL), CCS-92-AOL-16-0019, which described the event. It emphasised the use of the HUMS Tail Gearbox Bearing Energy Tool, provided on the ground station, to detect a TRPCS bearing that is experiencing degradation, and recommended that this tool was utilised as often as reasonably possible. Alert Service Bulletin 92-64-011 was issued by the manufacturer on 10 January 2017 and introduced a once-only inspection of the TRPCS and bearing assembly for ratcheting, binding, or rough turning. It also called for a review of the HUMS Tail Gearbox Bearing Energy Tool. The manufacturer recommended that compliance was essential and to be accomplished prior to the next flight from a maintenance facility; three flight hours are allowed in order to return directly to a maintenance facility. The once-only inspection was mandated by FAA Airworthiness Directive (FAA AD) 2017-02-51 issued on 13 January 2017 and added a requirement to carry out a 10-hourly borescope inspection of the bearing in situ until further notice. Concurrent with the release of ASB 92-64-011, the manufacturer published Temporary Revision 45-03 to require operators to use S-92A HUMS ground station software to review Tail Rotor Gearbox energy analysis CIs for alert conditions on a reduced flight hour interval. CIs in excess of published alert levels required inspection of the pitch change shaft and bearing. The manufacturer developed a temperature sensing plug which could be retrofitted to in- service TRPCSs to establish fleet-wide trends. The temperature sensing plug installation was carried out under the authority of ASB 92-64-012, issued on 9 March 2017 with a scheduled compliance date of 13 April 2017. On 24 March 2017 the manufacture issued All Operators Letter CCS-ALL-AOL-17-0008 to remind users of the IMD software of the approved zoom and undo zoom commands for interrogating the HUMS CI data. It also informed users that the IMD software would be obsolete in the near future and that the maintenance manual revisions for the SGBA were now available. The helicopter manufacturer has worked with the bearing manufacturer to identify and implement a number of improvements to the bearing manufacturing process. An improved end play measuring tool has been introduced in order to carry out more accurate measurement and bearing setting up during assembly. The grease is now drawn from sealed cartridges and injected into the races using a syringe to ensure a more consistent distribution. The bearing is also now weighed before and after grease application.

Air Accidents Investigation Branch Annual Safety Review 2018 37 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety action by the helideck operator Since the accident the ‘Helicopter Occurrence - Communication Process’ procedures for the helideck operator’s UK operations have been revised to include a requirement to report an accident or serious incident to the AAIB. Helideck certification safety action The Helideck Certification Agency will bring this case to the attention of the CAA and the ICAO Heli Deck Working Group (HDWG) to consider whether the assumptions used in the regulations remain valid in the light of this accident. Boeing 737-86J, C-FWGH on 21 July 2017 The details of this accident are shown under Recommendation 2018-012 to 2018-015 shown under Safety Recommendations Issued in 2018 of this Annual Safety Review. Safety issues – Flight management computer data input error, human factors Safety Action by the aircraft operator As a result of the initial findings of this investigation into this serious incident the aircraft operator began a programme of upgrading their fleet of B737s to FMC Update 13 and cockpit display unit (CDU) BP15 in order that the OAT alerting function would be available. They also updated their EFB software to display N1 and included a crosscheck of this figure in their SOPs. Safety Action by the UK CAA After this serious incident, the CAA amended MATS Part 1 such that the senior controllers at ATSUs providing air traffic services at an aerodrome are required to notify the AAIB by telephone as part of their initial reporting actions following an aircraft accident or serious incident. The CAA also amended Civil Aviation Publication (CAP) 797, Flight Information Service Officer Manual, to require air traffic services personnel to notify the AAIB by telephone as part of their initial reporting actions following an aircraft accident or serious incident. In addition to the action above, a link to Regulation (EU) 996/2010 was put into MATS Part 1 and CAP 797 pointing to typical examples of what are likely to be classified as serious incidents.

Air Accidents Investigation Branch Annual Safety Review 2018 38 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview SPECIAL BULLETINS Agusta AW169, G-VSKP on 27 October 2018 S1/2018 and S2/2018 This accident is the subject of an ongoing AAIB investigation. Between 1900 hrs and 1930 hrs the pilot and four passengers boarded the helicopter for a flight to London Stansted Airport. The helicopter started up at 1934 hrs and at 1937 hrs it lifted from the centre circle, yawed 15° left and moved forward a few metres. The helicopter then began a climb on a rearward flight path while maintaining a northerly heading. Gear retraction started as it passed through a height of approximately 320 ft. The climb then paused. Heading changes consistent with the direction of pedal movements were recorded initially, then the helicopter entered an increasing right yaw contrary to the pilot’s left pedal command. The helicopter reached a radio height of approximately 430 ft before descending with a high rotation rate. The helicopter struck the ground in an approximately upright position on a stepped concrete surface, with the landing gear retracted, and rolled onto its left side. The helicopter was rapidly engulfed in an intense post-impact fire. Safety issue – Loss of yaw control in flight Safety action by the manufacturer The manufacturer of the helicopter has issued Alert Service Bulletin (ASB) 169120 for AW169 helicopters, giving instructions for a precautionary inspection of the tail rotor control assembly on all helicopters in the global fleet. The manufacturer also issued ASB 189-213 for AW189 helicopters, which have a similar tail rotor control system. Safety action by EASA These inspections have been mandated by the EASA, in its capacity as the regulator responsible for the type design approval of the AW169 and AW189. Airworthiness Directive 2018-0241-E has been issued to accomplish this. The second Special Bulletin S2/2018 provides information on the findings to date of a detailed examination of the helicopter’s yaw control system. Safety issue – component airworthiness Safety actions by the manufacturer and EASA On 19 November 2018 the EASA issued AD 2018-0250‑E, superseding AD 2018‑0241‑E, to require a precautionary one-time inspection of the tail rotor duplex bearing and, depending on findings, applicable corrective actions. On 21 November 2018 the helicopter manufacturer published Emergency Alert Service Bulletin ASB169-125 for AW169 helicopters, and ASB189-214 for AW189 helicopters, giving further instructions for a one-time inspection of the tail rotor

Air Accidents Investigation Branch Annual Safety Review 2018 39 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview duplex bearing. The EASA issued AD 2018-0252-E on 21 November 2018, superseding AD 2018-0250-E and mandating this inspection. On 30 November 2018 the helicopter manufacturer published Emergency Alert Service Bulletin ASB 169‑126 for AW169 helicopters, and ASB 189-217 for AW189 helicopters, introducing repetitive inspections of the castellated nut that secures the tail rotor actuator control shaft to the actuator lever mechanism, and the tail rotor duplex bearing. The EASA issued AD 2018 0261 E on 30 November 2018 mandating the repetitive inspections.

Air Accidents Investigation Branch Annual Safety Review 2018 40 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview FIELD INVESTIGATIONS Schleicher ASW 24, G-CFNG on 4 December 2016 During a glider winch launch in turbulent conditions the weak link parted. The pilot attempted to fly a circuit to land near the launch point but the glider encountered significant sink and had insufficient energy to complete the intended circuit. The pilot sustained fatal injuries in the impact with the ground. Safety issues – HF, decision making, turn back Safety action by the BGA In February 2017 the BGA published a leaflet ‘Safe Winch Launching – Land ahead if safe to do so’ and this material was put on the BGA Website. It contained the following text: ‘The instructors’ manual and the safe winch launch leaflet/booklet teach:

After power loss in mid-launch, adopt the recovery attitude, wait until the glider regains a safe approach speed, and land ahead if it is safe to do so. Why not turn? The BGA has been teaching ‘do not turn’ because:

After a push-over the airspeed can be less than the attitude would suggest turning before the glider has accelerated to a safe speed after a launch failure can cause the glider to spin. After commencing a turn, although the glider may have sufficient airspeed to avoid a stall and spin, no landing area may be immediately available, and this can expose the glider to other hazards which can prevent a safe landing. Sink is one such hazard, often associated with strong winds and wave. A glider making a 360° turn in still air at a bank angle of 35° and 50kt typically descends by only 70ft. But with 15ft/second sink the height loss in a 360° turn is over 400ft. If the launch failure was at 300ft the glider would crash before completing a 360° turn. The existence of additional hazards from a turn adds force to the advice: LAND AHEAD IF IT IS SAFE TO DO SO. If you are very experienced, you may sometimes be winch launching in challenging conditions. If you have a launch failure we would urge you to land ahead if it is safe to do so..’ In October 2017 the BGA updated and published the leaflet titled ‘Safe Winch Launching’, in its 6th edition.

Air Accidents Investigation Branch Annual Safety Review 2018 41 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Boeing 737-8AS, EI-EBW on 14 January 2017s Whilst descending in to a high altitude jetstream, an associated rise in headwind caused the aircraft to overspeed. The commander disengaged the autopilot (AP) and used manual control inputs to stop the speed increasing, but in doing so applied a significant nose‑up pitch input on the control column. The resulting manoeuvre caused two cabin crew members to fall, and one of them sustained a broken ankle. The operator has issued additional guidance to its pilots regarding overspeed recognition and recovery. Safety issues – HF, atmospheric conditions, handling Safety action by the operator After this event, the operator released a memo to all pilots entitled ‘Overspeed (Impending/Actual) Recognition and Recovery’, dated 3 May 2017. This document reiterates the manufacturers FCTM guidance on overspeed, and provides supplementary guidance for use of the mode control panel (MCP), speed brake, autothrottle and autopilot in an overspeed condition. It states: ‘…this guidance applies to all phases of flight. Crew, however, must recognize the difference between correcting an overspeed in level flight and correcting an overspeed when climbing or descending. Furthermore, when attempting to correct an overspeed condition, crew must also recognize the additional challenges associated with disengagement of (1) the auto throttle and (2) the autopilot.’ The memo also provides guidance for use of the MCP, speed brake, autothrottle and autopilot during the different phases of flight, in relation to overspeed recovery. In relation to descent it states: ‘Autopilot: Monitor. Disengage ONLY if [the] autopilot [is] exacerbating the overspeed, or if required due to severe turbulence’ The aircraft manufacturer stated that it is considering a revision to the overspeed guidance in the 737 Flight Crew Training Manual to state more explicitly that the preferred response to impending overspeed at high altitude is to leave the autopilot engaged and instead deploy partial speedbrakes slowly.

Air Accidents Investigation Branch Annual Safety Review 2018 42 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Let L-410 UVP-E, OK-LAZ on 23 February 2017 The details of this accident are shown under Recommendation 2018-005 shown under Safety Recommendations Issued in 2018 of this Annual Safety Review. Safety issues – Weather, aircraft limitations, decision making Safety actions by the Czech CAA As a result of this serious incident the CAA of the Czech Republic stated that several safety actions have been completed, including:

1. The aircraft operator has increased the time allocated between crew report

and the scheduled departure time to 60 minutes and incorporated this in Operations Manual (OM) Part A.

1. The aircraft operator has updated

the crosswind limits in OM Part B. No details of the changes have been provided except a statement that the OM now offers guidance for taking off and landing in a crosswind, and that the EASA SIB 2014-20 has been taken into account.

1. The CAA of the Czech Republic has also stated that recent audits of the

aircraft operator have focussed on hazard identification and safety risk management, with particular focus on operations in hazardous weather conditions. Boeing 747-8R7F, LX-VCF on 30 March 2017 The details of this accident are shown under Recommendation 2018-011 shown under Safety Recommendations Issued in 2018 of this Annual Safety Review. Safety issue – Air cargo preparation Safety action by the operator The operator has made a number of revisions to its procedures. It has also recommended that its contracted goods handling agency take steps to raise awareness among its staff about the possibility of dangerous goods in general cargo and to improve methods for detecting of undeclared dangerous goods.

Air Accidents Investigation Branch Annual Safety Review 2018 43 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Boeing 787-9 Dreamliner, G-ZBKF on 29 April 2017 The synopsis of this accident is shown under Recommendations 2018-008 to 2018-010 shown under Safety Recommendations Issued in 2018 of this Annual Safety Review. The inability of the aircraft to maintain normal cabin pressure was found to be have been caused by the right lower recirculation fan becoming detached from the inner duct, which allowed air from the air conditioning unit to leak to atmosphere rather than provide the required cabin pressure on a sector where the left air conditioning system had been disabled before flight. The right lower recirculation fan had been changed by the operator 11 days before the incident. Following the first flight after the fan had been changed, the operators engineering department was notified by the Aircraft Health Monitoring (AHM) system that it had detected a leak. A work request was raised to carry out a cabin pressure leak test, with an end date for completion set for 5 May 2017, in accordance with approved rectification periods. For each subsequent flight, the AHM system notified the operator that a leak had been detected, but the cabin altitude remained normal for these flights and the end date for the inspection was not altered. When the aircraft was operated during the incident flight with only the right air conditioning system available, the system did not have sufficient capacity to overcome the effect of the leak. It was concluded that the lower right recirculation fan had not been correctly attached to the inner duct when the fan had been installed on 18 April 2017. Safety issues – Loss of pressurisation, MEL, technical fault Safety actions by the manufacturer ● ●The aircraft manufacturer has revised the Aircraft Maintenance Manual (AMM) installation procedure for the lower recirculation fans. ● ●The aircraft manufacturer has made changes to its Fault Isolation Manual for Maintenance Message 21-34127, the message triggered by Maintenance Alert Message 21-0209-C740 from the AHM. This includes checking for recent maintenance activity on the cabin pressurisation system, including the lower recirculation fans. ● ●The aircraft manufacturer has made an update to the AHM ‘maintenance alert’ logic for message 21-0209-C740. This logic helps to filter out only those instances that are deemed valid and should be presented to the airline. ● ●The operator of G-ZBKF has revised its process for dealing with AHM ‘maintenance alert’ message 21-0209-C740.

Air Accidents Investigation Branch Annual Safety Review 2018 44 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Numbers represent AOB (every 0.5 seconds). Negative roll is to the left Normal g peaks at 1.98g Instructor takes control Position of aircraft in (Figure 4) G-MATH position when instructor changes grip on controls (Figure 7) G-MATH position in Figure 8 Safety action by the operator ● ●The operator of G-ZBKF is updating the audio system software fitted to its fleet of Boeing 787 to prevent the volume of the cabin decompression PRA from being attenuated. AS350 B3e Ecureuil, G-MATH on 5 May 2017 The accident occurred whilst the helicopter was engaged in hydraulic failure training. An instructor was in the left seat of the helicopter, a pilot under training in the right seat and another pilot under training, who was a passenger on this flight, was seated in the rear. The right-seat pilot was performing a hydraulics-off approach, to finish in a run-on landing. The instructor became dissatisfied with the approach parameters and took control in the latter stages, performing a hydraulics-off go-around into a left-hand circuit, before lining up the helicopter on final approach for the pilot to make a second attempt. Once again, the instructor took control late in the approach and performed another go- around. On this occasion, the left turn onto the downwind was flown with a higher angle of bank (AOB). The instructor was unable to control the roll attitude and the helicopter rolled left, beyond 90° AOB, descended rapidly and struck the ground, coming to rest on its left side. No technical issues were identified and a definitive reason why the instructor was unable to roll the helicopter back to a level attitude could not be determined. The investigation concluded that clearer instructions in the AS350 flight manual for hydraulics-off flight would help prevent similar accidents in future. In response to this accident, the helicopter manufacturer has taken safety actions including: amending the AS350 flight manual to limit the AOB to 30° during hydraulics-off flight and the inclusion of warnings not to conduct low speed manoeuvres with hydraulics off due to the danger of loss of control. It has also prepared a safety video describing how to perform hydraulics-off training. Safety issues – helicopter systems management, flying training Safety actions by the manufacturer The AS350 flight manual has been amended to: ● ●Include a clear angle of bank limitation of 30° for hydraulics-off flight; ● ●Include warnings to clearly emphasize the risk of loss of control of the helicopter if the hydraulic failure or hydraulics-off training procedures are not complied with;

Air Accidents Investigation Branch Annual Safety Review 2018 45 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview ● ●State: ‘In case of a go-around during hydraulic failure training procedure, it is recommended to abort the training and to reset the hydraulic cut-off switch to ‘ON’ ● ●Include the note: ‘When resetting the hydraulic cut-off switch to ON, be prepared for a significant decrease of cyclic and collective control loads’. Airbus Helicopters has taken the further safety actions of publishing Safety Information Notice No. 3246-S-29 highlighting these flight manual changes and preparing a video1 on how to conduct hydraulics-off training safely. Silence Twister, G-JINX on 14 May 2017 During a formation aerobatics display of a pair of aircraft at MOD Abingdon the engine of the number 2 aircraft lost power and then stopped in flight. The subsequent attempted forced landing onto the runway at Abingdon was unsuccessful. The investigation found that the engine seized following the loss of its oil during the accident flight. Safety issues – Loss of oil and lubrication, engine seizure, aircraft egress Safety actions by engine manufacturer The engine manufacturer advised the AAIB that it would introduce processes to monitor the condition of UL260iSA engines in regular aerobatic use, including: ● ●Installing additional temperature sensors in the cylinder walls. ● ●Regularly downloading and reviewing the data from the Dynon EMS-D10. ● ●The return of the engine to the manufacturer after a number of aerobatic displays for a full strip and examination. The manufacturer stated that it intended to issue an amendment to the engine manuals recommending that: ● ●The engine oil level should be between 4 and 4.5 litres prior to the start of an aerobatic display. ● ●A Teflon based additive should be added to the oil. ● ●Maintenance activities such as removing cylinder heads and replacing cylinders should be carried out by technicians approved by the manufacturer. Safety actions by the LAA Following the accident to G-JINX, the LAA amended its Technical Leaflet 2.11 ‘Aircraft Placards, Labels and Registration Marks’ to include the following: Footnote 1 A link to this video is at: https://dai.ly/k35kJCQ5f47SQcrffPU

Air Accidents Investigation Branch Annual Safety Review 2018 46 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview ‘When not otherwise obvious, the external and internal latches on cockpit doors and canopies should be clearly identified by labels or markings sufficiently prominent to be seen in an emergency. In the event of an accident, even a few seconds saved by first responders in rescuing the crew may be critical to a positive outcome, especially where there is the threat of fire. Each normal and emergency exit operating control should be red in colour. Suitable placards should be near each control and should be designed to clearly indicate its method of operation, especially to a non-aviation person. Where any special procedure must be followed to gain entry, this should be described, for example ‘to open canopy in an emergency, reach into cockpit through ventilator aperture and press red button. Canopy hinged on right hand side.’ Safety actions by the owner Following the accident, the owner fixed labels to the outside of his other two Silence Twister aircraft explaining how the canopy is opened from the outside. The aircraft owner stated he would consider enabling the EMS intercom audio alert function. Piper PA-28R-201 Cherokee Arrow III, G-CEOF on 25 May 2017 During a flight from Oban to Carlisle, the aircraft flew into an area of low cloud, fog and mist that extended from the Irish Sea, around the Isle of Arran and into Loch Fyne. As the aircraft travelled down Loch Fyne it descended into the sea, approximately two miles north-east of Skipness on the Kintyre peninsula. The pilot and passenger were fatally injured in the accident. Safety issues - Weather, HF, response Safety actions by the DfT and RAF Department for Transport and the Royal Air Force D&D Cell have initiated a number of safety actions to reduce duplication of effort and ensure that the required actions are carried out in a timely manner. The Distress and Diversion (D&D) Cell undertook a broad review of their procedures for dealing with missing / overdue GA aircraft in order to reduce the timeframe during the uncertainty phase. They have introduced a standard checklist for their staff which has been shared with NATS and the Air Rescue Coordination Cell (ARCC). The D&D Cell have also reduced the time for requesting a radar replay for GA events and the request to NATS will

Air Accidents Investigation Branch Annual Safety Review 2018 47 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview now be actioned no later than 30 minutes after an aircraft’s Estimated Time of Arrival, or the start of tracing action. The new procedures will also help to reduce duplication of effort across the ANSPs, the D&D and the ARCC. The introduction of improved log keeping and data gathering will also help to better inform future decision making. Review of the D&D Cell and ARCC processes The Department of Transport has initiated a review of the processes and procedures carried out by the D&D Cell and ARCC. The intention is to map the roles and responsibilities of both organisations, identify any duplication and consider if processes can be streamlined. Saab-Scania SF340B, G-LGNB on 5 June 2017 During the climb after departure from Edinburgh Airport, the aircraft encountered severe icing and turbulence. During this period the stick shaker activated three times, before the aircraft descended to regain airspeed. After flying clear of the icing conditions and the area of turbulence, the aircraft continued to the destination without further incident. Safety issues – Icing and turbulence Safety Action by EASA EASA, the operator and the manufacturer considered making deactivation of the ice speed logic independent of the requirement to maintain the engine anti-ice system on for five minutes after leaving icing conditions. This change, considered feasible by the manufacturer, would address the concerns about repeated activation of the stick shaker in the latter stages of an approach and in the flare. EASA expected to mandate the implementation of this improvement to address the safety concern. HK36 TC Super Dimona, G-FMKA on 13 July 2017 The purpose of the flight was for the aircraft owner to undergo a biennial refresher training flight with an instructor to revalidate his class ratings. The aircraft was seen to be manoeuvring at low level shortly before it departed from controlled flight. It struck the ground in a near vertical attitude on farmland. Both pilots were fatally injured and the aircraft was destroyed. There was insufficient evidence available to determine conclusively the cause of the loss of control, but it was possibly as a result of a power-on stall. 2 1 5 1 17 26 24 0 5 10 15 20 25 30 2010 2011 2012 2013 2014 2015 2016 2017 Saab340 Stall Warning/Stick Shaker CAA MOR Events Flare Approach Other

Air Accidents Investigation Branch Annual Safety Review 2018 48 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety issue – Licence privileges Safety action by the CAA The CAA has agreed to issue advice to remind flying instructors of the requirement to hold a valid TMG class rating if they intend to exercise their flight instructor privileges on this class of aircraft. Rockwell Commander 114, G-TWIZ on 1 August 2017 The aircraft’s left main landing gear (MLG) leg collapsed while landing at Lydd, following the fracture of the left MLG upper side-brace during retraction of the landing gear after takeoff. The upper side-brace had fractured under the application of landing gear retraction loads, due to the presence of a fatigue crack originating at a ‘cold shut’ casting defect. In response to this investigation the Type Certificate holder issued Service Bulletins applicable to the Rockwell Commander 112 and 114 aircraft models. Safety issues – Landing gear, fatigue Safety action by the manufacturer In response to this investigation the Type Certificate holder, Commander Aircraft Corporation, issued Service Bulletins SB-112-75 and SB-11437, applicable to the Rockwell Commander 112 and 114 aircraft models respectively. These Service Bulletins require inspection of the upper sidebrace for cracking in the area of the retraction cylinder attachment and replacement of the upper side-brace if it is found to be cracked and not repairable. HPH Glasflugel 304 eS, G-GSGS on 10 August 2017 During a normal touchdown following an uneventful flight, the glider’s forward FES lithium polymer battery ignited due to an electrical arcing event. The pilot was unaware that the glider was on fire and the battery continued to burn, generating smoke and fumes which entered the cockpit during the latter stages of the landing roll. The pilot was not injured and the fire was extinguished using foam retardant, although the glider’s fuselage battery box and surrounding structure were extensively damaged by the fire. A comprehensive investigation of the failed battery did not identify the cause of the electrical arcing event. The AAIB published a Special Bulletin, S3/2017, in September 2017 that contained three safety recommendations relating to the provision of fire warning systems in FES-equipped sailplanes.

Air Accidents Investigation Branch Annual Safety Review 2018 49 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety issue – Battery fire mitigation Safety actions Battery and sailplane improvements The HPH 304 eS sailplane manufacturer has replaced the composite battery compartment forward bulkhead with a stainless steel bulkhead to improve the fire‑resistance of the bulkhead in the event of a battery compartment fire. The internal surfaces of the battery compartment are now painted in an intumescent fireproof paint finish. The existing fleet of FES batteries was withdrawn from use and is currently being refurbished to a new design standard, to which new production batteries are also being produced. The new design standard includes replacement of the battery case with a stronger glass fibre case, constructed using high-temperature resin, that has been demonstrated in testing to remain structurally intact during a battery fire. The new battery case also features an impact label that permanently records if the battery has been subjected to a shock loading of 50g or more, to allow the battery to be withdrawn from use for inspection if subjected to abuse. The new FES battery features additional nomex-mylar insulation between the cells and an increased quantity of silicone encapsulation of the battery cells to prevent foreign objects from falling between the cells. The edges of the battery cells pouches are covered in an electrically-insulating tape to prevent electrical discharge of the cell should the cell pouch seal fail. The stainless steel battery cell connector plates have been replaced with anodized aluminium plates which have been demonstrated not to eject machining swarf from screw threads when the connector screws are inserted during assembly. Sailplanes equipped with the FES system also now feature a pressure-relief valve in the battery compartment cover, designed to allow the cover to remain attached to the sailplane in the event of over-pressurisation of the battery compartment should a battery fire occur. FCU caution and warning system changes The FCU caution and warning system has been redesigned such that red warnings are prioritised over lower-level yellow warning messages. Different audio warning tones now accompany red and yellow warning messages. All warning messages are recorded in the FCU’s non-volatile memory for recall during operation and certain warning messages are recorded for subsequent fault investigation.

Air Accidents Investigation Branch Annual Safety Review 2018 50 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Battery certification requirements An Electric Propulsion Working Group has been established including experts from the OSTIV2 Sailplane Development Panel, EASA, certain sailplane manufacturers and the manufacturer of the FES system. This group will review the existing EASA battery certification requirements and to coordinate research activities in electric propulsion integration in powered sailplanes, including battery fire detection and containment. Boeing 737-800, EI-DLV on 15 September 2017 As the aircraft was lining up on the runway to take off, the flight crew heard a noise similar to a nosewheel passing over a runway centre light; they did not consider the noise to be unusual. During the takeoff roll, the flight crew in an aircraft holding near the start of the runway noticed one of the nosewheels depart EI-DLV and be blown off the runway into the area behind the threshold. They informed ATC who informed the crew of EI-DLV, which was now in the climb. A diversion was carried out to East Midlands Airport where an uneventful landing was made. The nosewheel was found to have separated from the aircraft because the nose landing gear axle had failed at the left inboard journal (the part of the axle that rests on bearings). This was the result of heat-induced cracking and material property changes due to abusive grinding of the chrome plate during the part’s last overhaul almost three years earlier. The Maintenance and Repair Organisation (MRO) that performed the overhaul has introduced a new inspection for detecting abusive grinding. Safety Issues – Overhaul processes, QA Safety actions To ensure that any abusive grinding is detected, the MRO of EI-DLV has introduced a new process to perform a Barkhausen inspection on all journals after grinding. The MRO has also introduced a Barkhausen inspection early in the overhaul process, prior to the Nital etch test. In addition, the MRO is carrying out Barkhausen inspections on all 12 Boeing 737NG NLGs that were overhauled during the one-year period covering six months before and after the date of EI-DLV’s NLG overhaul. These inspections are carried out on the aircraft, on the line, after removing the wheel and bearings. Out of these 12, nine have already been inspected and no evidence of abusive grinding was found. Footnote 2 Organisation Scientifique et Technique International du Vol á Voile / International Scientific and Technical Soaring Organisation.

Air Accidents Investigation Branch Annual Safety Review 2018 51 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview As some of the manufacturer’s SOPM instructions, such as wheel dressing, are open to interpretation, the MRO is developing an internal protocol for grinding so that there is greater consistency among grinding operators. North American P-51D, Mustang, G-SHWN and North American P-51D-20 (Modified), Mustang, G-BIXL on 23 September 2017 Two P-51 Mustangs were taking part in a display sequence at the Battle of Britain Air Show at Duxford, Cambridgeshire. The accident occurred as they were joining formation with a Boeing B 17G in preparation for the next part of the display. The pilots had briefed and agreed that the lead P-51 would join on the B-17’s right side and the other on its left side. However, during the display both pilots tried to join on the B-17’s right, resulting in the two P-51s colliding. They landed without further incident. A number of human factors were contributory to the accident. Most significantly, although the P-51 pilots had performed a ‘walk through’ of their display, they did not include the part involving the B-17. Safety Issues – Flying display preparation, guidance Safety actions CAA has made the following addition to Appendix C of Edition 15 of CAP 403, Flying Displays and Special Events: Safety and Administrative Requirements and Guidance, that was published in March 2018: ‘Useful guidance for display pilots … Briefings and walk throughs C3 It is essential that in addition to the FDD’s written and verbal briefings that all display items consisting of formations are thoroughly briefed. It is vital that every member of the formation has a clear picture of the objectives of the formation as a whole and of their individual positioning and responsibilities within it. Walk throughs are an integral part of this briefing process and it is strongly recommended that they are adopted as a standard part of all formation briefings. C4 Walk throughs are not exclusive to formation briefs and can also be of benefit to the solo display pilot.’

Air Accidents Investigation Branch Annual Safety Review 2018 52 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Europa, G-MIME on 28 September 2017 The aircraft landed a significant distance down the runway at Grove Farm and was unable to stop before the end. The aircraft passed through a hedge and caught fire before coming to rest in the field beyond the end of the runway. Although both the pilot and passenger survived the accident, both subsequently died of the burns they sustained. Safety issues – Certification, approvals, use of MOGAS Safety actions Although it could not be determined whether the type of fuel being used was a contributory factor, this is the second recent accident where there was no evidence of the correct procedures being followed to approve the use of E5 MOGAS3.  The LAA agreed during discussions with the AAIB that it would remind all owners, via a Safety Spot article in their members magazine, of the importance of correctly following the published procedures to approve the use of E5 MOGAS in their aircraft.  This article was published in the January 2018 edition. Cessna 152, G-WACG and Guimbal Cabri G2, G-JAMM on 17 November 2017 The Cessna 152 and the Cabri G2 helicopter collided in mid-air when both were engaged on training flights. They were operating in Class G airspace and neither aircraft was receiving an ATC service. The opportunity for the occupants of either aircraft to see the other was limited because, although they were in proximity for some time, they were both following a similar track and were not in each other’s field of view. Safety issues – Mid-air collision, conspicuity Safety actions By the regulator Following previous Safety Recommendations, work is ongoing, led by the CAA, to promote the development and use of compatible Electronic Conspicuity (EC) aids to help mitigate the well-known limitations of ‘see and avoid’. By the operator The flying club which operated G-WACG has issued an Instructor Notice to highlight the importance of maintaining an effective lookout throughout flight, and the need to carry out a regular change of heading during a prolonged descent, to check that the area ahead is clear. Footnote 3 See report into the accident to Europa, G-NDOL in AAIB Bulletin 11/2017.

Air Accidents Investigation Branch Annual Safety Review 2018 53 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview BAE Systems (Operations) Ltd ATP, SE-MHF on 14 December 2017 The aircraft was conducting an ILS approach to Runway 27 at East Midlands Airport (EMA). At around 800 ft agl (approximately 670 ft aal) the co-pilot attempted to disconnect the autopilot but it did not appear to disconnect. The crew made several further attempts to disconnect the autopilot before initiating a go-around at 230 ft aal. An uneventful, manually flown, circuit and landing was completed afterwards. Although the crew perceived that the autopilot disconnected while the aircraft was climbing during the go-around, recorded flight data indicated that it disconnected at approximately 425 ft aal during the approach. No defects or abnormalities were identified with any units associated with the autopilot. Safety issue – Checklist procedures Safety action Following this incident (and two earlier similar events), the manufacturer decided to review the Emergency Checklist to see whether it should be amended to address the condition where crews are unable to disengage an autopilot. DHC-8-402 Dash 8, G-ECOE on 11 January 2018 After takeoff from Belfast City Airport, shortly after the acceleration altitude and at a height of 1,350 ft, the autopilot was engaged. The aircraft continued to climb but pitched nose‑down and then descended rapidly, activating both the “DON’T SINK’ and “PULL UP” TAWS (EGPWS) warnings. The commander disconnected the autopilot and recovered the aircraft into the climb from a height of 928 ft. The incorrect autopilot ‘altitude’ mode was active when the autopilot was engaged causing the aircraft to descend to a target altitude of 0 ft. As a result of this event the operator has taken several safety actions including revisions to simulator training and amendments to the taxi checklist. Safety issues – Auto pilot settings, training Safety actions Actions by the operator 1) Issued an Operational Notice to flight crews in which it describes the incident and sets out the policy for the flight deck actions once ATC clearance has been obtained. 2) Amended the Taxi Checklist to include: ‘PF to review clearance including: Confirming FMA selections (the heading bug should be adjusted for the expected drift).’ 3) Updated the operator’s simulator training within the operator’s recurrent training and testing programme.

Air Accidents Investigation Branch Annual Safety Review 2018 54 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview BAE Systems (Operations) Ltd ATP, SE-MHE on 14 February 2018 The aircraft was carrying out a cargo flight from East Midlands Airport to Guernsey Airport. As the aircraft commenced its descent from FL180, the ball in the slip indicator moved out to the left as normal and the pilot under training attempted to trim it back into the centre. He was unable to do so, and the autopilot disconnected automatically, causing a significant left bank and a nose-down attitude. The commander took control, closed the power levers and returned the aircraft to a safe flightpath. He had difficulty moving the flight controls and could not advance the power levers, believing both to have frozen due to ice. As the aircraft descended, the flight controls and power levers returned to normal and a safe landing was carried out. It is possible that the initial control upset was the result of the crew applying aileron trim instead of rudder trim whilst attempting to correct the yaw. Although the cause of the stuck power controls could not be established definitively, it is possible that the left power lever was restricted because of wear in the roll-over lever locking mechanism, although this would not explain the locking of the right power lever reported by the pilots. Action was taken by the manufacturer to improve the effectiveness of both an existing Service Bulletin, relating to wear in the locking mechanism, and an electronic Service Information Leaflet, relating to the purging of moisture from engine control cables. Safety issue – Mechanical wear Safety action The manufacturer stated that it: ● ●Would introduce a periodic wear check of the roll-over lever locking mechanism to supplement the previous one-off check that was introduced in Service Bulletin ATP-76-021. ● ●Would assess the effectiveness of eSIL 76-ATP-800-1 (to periodically purge moisture from the cables using low pressure nitrogen or air), consider possible options for long term corrective action, and would report to EASA on completion of the assessment.

Air Accidents Investigation Branch Annual Safety Review 2018 55 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview CORRESPONDENCE INVESTIGATIONS Sikorsky S-92A, G-CHHF on 29 January 2018 During a final approach to land at Scatsta the nose landing gear (NLG) failed to extend despite being recycled and the use of the emergency blowdown system. The crew declared a PAN and the decision was taken for ground crew to lever the NLG down manually. This was successfully carried out and the helicopter landed safely. It was found that the automatic nosewheel self-centring mechanism had not operated, causing the nosewheels to jam the nose leg in its bay. The exact cause of the failure of the NLG to centre the nosewheels could not be determined. Safety issues – Maintenance, helicopter configuration and emergency procedures Safety actions To reduce the risk of nosewheels not self-centring during retraction, the operator is undertaking the following safety actions: ● ● The manufacturer’s letter, ‘S92A Nose Landing Gear – Improper Servicing’, dated 19 September 2017, will be re-iterated to the operator’s engineering staff. ● ● S-92A crews will be reminded of the need to ensure the nosewheels are not canted off-centre after taxiing prior to takeoff (although this does not appear to have been a factor in this incident). ● ● The operator has also reviewed the EOPs and EOPs 8/2 and 8/3 have been amended and re formatted as EOP 13/2 and 13/4. EOP 13/2 now draws the crew’s attention to EOP 13/4 and the actions to be taken to ensure a safe landing with the leading gear retracted, or in an asymmetric configuration. Jetstream 4100, G-MAJW on 27 February 2018 On the approach to Sumburgh Airport, the primary and standby landing gear status indicators showed that the nose landing gear was not extended and downlocked. The crew aborted the approach, elected to return to Aberdeen and after unsuccessfully attempting to resolve the issue, declared a MAYDAY. The aircraft landed safely at 1235 hrs and the occupants evacuated via the overwing exits after the aircraft stopped on the runway. A subsequent ground inspection of the aircraft confirmed that the nose landing gear was ‘down and locked’ but the primary indication wiring harness had failed and the standby indication microswitch was out of position. Safety actions have been taken by the manufacturer and the operator to improve the reliability of the system and the clarity of the Emergency and Abnormal Checklists.

Air Accidents Investigation Branch Annual Safety Review 2018 56 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety issues – Landing gear wiring and indication, checklists accuracy Safety actions The manufacturer has taken a Safety Action to amend the AMM and a further Safety Action to thoroughly review all Emergency and Abnormal Checklist cards to ensure that the correct card is actioned efficiently without confusion. ● ●Revision to AMM to clarify NLG down lock microswitch rigging procedure. ● ●Review the Emergency and Abnormal Checklists to improve clarity and efficiency of application. Three Safety Actions have been taken by the operator to improve the reliability of the landing gear indication systems and to implement the latest revision of the Emergency and Abnormal Checklist cards. ● ●‘One-off’ inspection - Nose landing gear standby micro switch check. ● ●‘One-off’ inspection - NLG down lock and primary and standby microswitch inspection. ● ●Repeat inspection every 600 flight hours - Landing gear indication system check. ● ●Update all Emergency and Abnormal Checklists in accordance with manufacturers latest revision. Hummerchute, G-CKTA on 14 April 2018 On becoming airborne on its maiden flight, the newly assembled powered parachute aircraft pitched steeply nose-up before falling backwards to the ground. A number of the lines securing the canopy to the ‘trike’ (accommodating the wheels, occupants and engine) were found to be of the wrong length. This caused the canopy to ‘fly’ in a different longitudinal position and attitude from normal, leading to loss of control of the aircraft. Safety issues – Rigging, QA and flight test checks The aircraft manufacturer has taken the safety actions of improving its quality checks during manufacture and flight testing aircraft prior to releasing them from the factory. Safety actions On establishing the nature of the problem, the pilot immediately informed the owner/ customer of a Hummerchute he had recently supplied and had inspected at the same time as G-CKTA. He advised the customer not to attempt a flight. The customer confirmed shortly afterwards that the D lines on his parachute were about 8 inches shorter than those on the reference parachute. The parachute manufacturer was

Air Accidents Investigation Branch Annual Safety Review 2018 57 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview contacted and subsequently confirmed that they had identified a batch which had been manufactured with incorrect length D lines. They reported that only two of them had left the factory and both had been supplied to the UK. The manufacturer has informed the importer that all future parachutes will come with a full factory trim check and will also be check flown prior to shipping to the UK. Morane Saulnier MS.315E D2, G-BZNK on 5 May 2018 The aircraft made a successful forced landing on a beach following a loss of engine power. A spring in the fuel primer operating system had become disconnected, causing the primer to continue operating and resulting in the available fuel being consumed faster than expected. Safety issue – Technical fault Safety actions The LAA stated that it will recommend priming installations of this type be configured so that normal operation of the fuel pressure regulator is restored if the primer operating mechanism fails. Robinson R44 Raven, G-CTFL and Robinson R44 Raven, G-HYND on 5 May 2018 After lifting to a hover, the pilot of Robinson R44 G-CTFL reversed his helicopter, unaware that a second Robinson R44, G-HYND, had landed behind his position and was being shut down. One of G-HYND’s rotor blades collided with G-CTFL’s engine housing, startling the pilot of G-CTFL, with the result that he lost control, and the helicopter struck the ground several times before coming to rest in a tail-down attitude, next to a parked Robinson R22. Safety issue – Helicopter movements in a confined area Safety actions As a result of the accident, the following safety actions have been taken by the helicopter operator: ● ●The northern helipad was extended eastwards by 12  m, so a parked helicopter is further from the apron, leaving space for other helicopters to move between the parked helicopter and the apron.

Air Accidents Investigation Branch Annual Safety Review 2018 58 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview ● ●The prepared grass area east of the helipads has been extended, to ensure helicopters parked there can remain well clear of the pads. ● ●A mirror has been placed at the corner of the hangar, to assist pilots using either helipad see any activity to their rear. ● ●The helicopter operator no longer permits helicopters to reverse from the helipads. ● ●The helicopter operator’s safety team is due to review the procedure for turning off the avionics systems while a Robinson R44 is being shut down. ● ●A review of the Rescue and Firefighting Service (RFFS) response to this accident has led to several changes being instigated. These are intended to ensure that two appropriately trained employees are available, on the ground, at all times there is helicopter activity and that fire-fighting equipment can be readily accessed by these employees. Piper J3C-65 Cub, G-CGIY on 12 May 2018 The aircraft was en route from Gamston Airport near Retford to Leeds East Airport when the pilot noticed a vibration on the rudder pedals. This was followed by an uncommanded yaw and a jolt through the pedals. Several seconds later the pilot heard a loud bang with a violent nose-down pitch. The pilot slowed the aircraft, regained control and, looking behind, observed that the rudder appeared to be displaced. He informed Leeds East of the problem and landed without further incident. The partial rudder detachment and the resultant handling difficulties were caused by the loss of the rudder upper hinge pin and bushes. It is not known how the pin and bushes worked loose but their loss would have been prevented had the specified upper washer been in place. Safety issue – Correct component assembly Safety actions The CAA have been informed and are considering an appropriate safety action to inform owners and operators. In addition, the LAA has published a comprehensive article in the Safety Spot section in the association magazine with advice to Cub owners regarding the assembly and integrity of the rudder hinge pins.

Air Accidents Investigation Branch Annual Safety Review 2018 59 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Mainair Blade, G-CCZW on 20 May 2018 While attempting to land from an offset approach the pilot lost control, and the left wing struck a hedge which was adjacent to the runway. Safety issues – Loss of control, obstructions near runways (1) Safety actions The airstrip owner states that since this accident occurred, the trees on the northern boundary have been removed and the recommended approach has been modified to reduce the offset angle to 20º or less. The website is to be amended accordingly and a new video added in due course. The field to the south of Runway 14 belongs to the airstrip owner and he only grows a rapeseed crop there every third year. In future he will ensure the crop close to the narrowest section of the runway does not reach a height that is likely to distract pilots. Jodel DR1050-M1 Sicile Record, G-CIYB on 8 June 2018 at 1045 hrs The pilot lost control of the aircraft when it struck a hedge while approaching to land on a short runway at his private airstrip. The aircraft impacted the ground and incurred extensive damage. Safety issues – Loss of control, obstructions near runways (2) Safety action The pilot intends to remove the hedge along the airstrip’s southern boundary and will only operate a similar aircraft from here if he succeeds in lengthening the runway. Robin DR400/180R Remorqueur, G-LGCC and Schleicher ASK 21, G-CFYF on 8 June 2018 During the recovery to Dunstable Downs Airfield (DDA) after conducting a successful aero-tow launch, the pilot of the tug aircraft, G-LGCC, became aware of a glider ahead of him at close range. The pilot bunted to pass underneath the glider but had insufficient time to avoid a collision. The top of G-LGCC’s fin struck the outboard leading edge of the glider’s right wing. Despite suffering major damage, both aircraft remained controllable and landed without further incident.

Air Accidents Investigation Branch Annual Safety Review 2018 60 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety issues – Gliding, mid-air collision, conspicuity and communication Safety actions To reduce the risk of mid-air collisions between aero-tugs and gliders, the gliding club decided to: ● ● Publicise and enforce the policy of using landing lights on their tug aircraft during normal towing operations. ● ● Resolve the issue of radio interference generated by LED landing lights on the Club’s aero-tow aircraft. ● ● Review the policy on FLARM fitment for Club owned aircraft. ● ● Investigate the possibility of fitting extended life batteries to all Club aircraft with the aim of enabling radio use for all flights and supporting a growth path for wider use of electronic conspicuity systems. Sky 220-24 hot air balloon, G-SPEL on 14 June 2017 The balloon was on commercial passenger flight with six passengers. After an uneventful flight the balloon landed firmly, at a horizontal speed relative to the ground of about 9 kt, and the basket tipped over on to its side, during which one passenger fell out. The passenger was seriously injured. Safety issues – Pre-flight briefing, passenger actions for landing (1) Safety actions The operator stated that it is considering conducting the safety briefings before takeoff with only the passengers present, to avoid them being distracted. He will also give more emphasis on the need to hold onto the rope handles tight during the landing.

Air Accidents Investigation Branch Annual Safety Review 2018 61 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Groppo Trail, G-CIGR on 14 July 2018 The aircraft took off from a farm strip but did not climb sufficiently to clear a high hedge beyond the end of the runway. Safety issues – Aircraft performance, obstructions near runways (3) Safety actions Following the accident, the following Safety Action was taken: The operator of South Longwood airstrip decided to produce a briefing document for visiting pilots. A draft version, dated 18 July 2018, showed a diagram of the airstrip, runway and circuit information and warning text in a red box which included the following guidance: ‘South Longwood is a challenging farm-strip suitable for experienced pilots flying aircraft of sufficient performance to safely negotiate the obstructions on approach and departure. It is unlikely that any aircraft that requires a landing or takeoff run of more than 300m will be suitable.’ and ‘Due to the valley location, the windsock does not always provide reliable indication of wind direction or strength.’ The airstrip operator had been negotiating for a landline to be installed prior to the accident and re-contacted the supplier to ask for the installation to be carried out as soon as possible. The windsock was to be relocated to a position more central to the runway and would be set on a higher mast.

Air Accidents Investigation Branch Annual Safety Review 2018 62 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Boeing 767-300, D-ABUK on 21 July 2017 The aircraft was in the cruise on a positioning flight when the flight crew noticed an unusual smell, followed by smoke from the vicinity of the right windscreen. A MAYDAY was declared and the aircraft was diverted to Newcastle Airport where it landed without further incident. Investigation by the operator identified an anomaly with an electrical connection to the right windscreen heater. Safety issue – Wiring fault Safety actions Following its investigation the operator took the following safety actions: ● ●Adopted a double inspection requirement for electrical terminal installation following windscreen replacement; ● ●Reduced the repeat inspection threshold for windscreen electrical terminals from 500 flight hours to 100 flight hours; ● ●Introduced an additional engineering condition inspection for all windscreens entering stores; ● ●Conducted a fleet check to ensure correct installation of windscreen terminal connections; ● ●Clarified Aircraft Maintenance Manual (AMM) task 56-11-01-404-017, No  1 Window Installation, so that the resistance test of the window heater element is performed before installation to prevent the J5 terminal block connection being made twice; ● ●Added advice to AMM task 30-41-00-765-046 to use a torque wrench when connecting the wiring to the window terminals; ● ●Evaluating a coordinated replacement of windscreens not using the later design pin and socket connections.

Air Accidents Investigation Branch Annual Safety Review 2018 63 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Boeing 737-8K5, G-FDZJ on 28 September 2017 G-FDZJ was operating a charter flight from Malta to Manchester on behalf of a cruise ship company. On takeoff the pilot flying found the aircraft required significantly more aft control column movement than normal to rotate. The available evidence indicates that the aircraft was out of trim due to an incorrect MACTOW on the load sheet. This occurred because passenger’s actual seating positions were not passed to the handling agent. When producing the load sheet the handling agent assumed an even distribution of passengers within the cabin, when the actual distribution created a forward bias. Safety issues – Weight and balance, pax distribution Safety action Following its review into this incident, the operator indicated it would take the following safety action:

Update the existing process to ensure the position of any empty seats on a cruise flight (or any flight where check in and seating is not completed by the handling agent) is communicated by the cruise line representative to the load controller.

Ensure all handling agents that deal with cruise flights (or any flight where they do not handle the check in themselves) have a method of determining the actual seating position of passengers on any partly loaded flight in order to produce an accurate load sheet. Cameron Z-375 hot air balloon, G-VBFO on 9 October 2017 After an uneventful flight G-VBFO landed in a field near Royston. The basket landed firmly, bounced several times and was then dragged across the field eventually coming to rest approximately 60 m from the initial impact point. During the first impact, a passenger was ejected from the rear right compartment. Whilst it could not be determined why the passenger came out of the basket it is likely that he either let go prior to the landing or was unable to hold on tightly enough to keep himself in the landing position. Post-accident interviews with the passengers confirmed that safety briefings were conducted in accordance with the company operations manual. However, passengers commented that the briefings were difficult to hear and did not prepare them for the dynamic nature of the landing. This may have contributed to the accident.

Air Accidents Investigation Branch Annual Safety Review 2018 64 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety issues – Pre-flight briefing, passenger actions for landing (2) Safety actions By the operator Following this accident the operator indicated that it proposed to take the following safety actions;

The operator will explore ways to ensure passengers read and understand the safety information that is given to them before the flight.

The operator is considering the introduction of laminated passenger safety cards to be given to passengers to read between check in and boarding the flight to further emphasise the safety briefing.

The operator will continue to monitor safety briefings delivered by all pilots to ensure they are as clear as possible and convey the potential dynamic nature of a balloon landing. By the regulator The CAA has taken the following Safety Action: The CAA will instruct all UK Balloon Flight Examiners and Type Rating Examiners to particularly check the content and quality of delivery of the passenger safety briefing and subsequent passenger landing position checks whilst undertaking LPCs and/or OPCs during the coming 12 months. Jetstream 4100, G-MAJC on 16 October 2017 During a descent into Hawarden Airport, at around FL150, the flight crew noticed a burning smell. Oxygen masks were donned, a MAYDAY was declared and an expedited approach was carried out to land on Runway 22. The crew experienced some difficulty in communication, both internal and external, while using their oxygen masks. After landing the aircraft was taxied clear of the runway, brought to a stop, and an emergency evacuation was carried out. The burning smell was as a result of smoke and dust carried in the atmosphere from North Africa and Iberia.

Air Accidents Investigation Branch Annual Safety Review 2018 65 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety issues – Meteorological circumstances, information promulgation Safety actions In December 2017 a review of the smoke and fume events on 16 and 17 October was held by the UK CAA together with representatives from NATS and the Met Office. The Met Office advised that accurate forecasting of such phenomena is problematic because it is hard to forecast the extent and height at which the smoke is likely to be present due to the difficulty in accurately locating the fires. Met Office systems allow a SIGMET to be issued that contains smoke related information and, although it is not compliant with the ICAO format or existing templates, a test showed that it was compatible with NATS’s systems. In future a SIGMET will be issued when NATS informs the Met Office there is significant smoke in the atmosphere that is affecting aircraft operations. ANSPs are responsible for notifying the Met Office of any pilot reports of unusual phenomena affecting flight, but not at present for notifying the UK CAA.

Work is being undertaken to see whether a ‘Securité’ message broadcast on 121.500 MHz could be used to promulgate a safety message concerning smoke in the UK FIR. The participants agreed to ensure that suitable escalation and inter-agency coordination procedures are put in place to improve the promulgation of such unusual events in the future. The operator conducted its own internal investigation into the event and identified safety recommendations and actions. The operator decided to: Provide enhanced training on use of oxygen masks including a video of mask donning procedures. Provide a list of approved headset types shown to be compatible with the aircraft communication systems. Review and amend the passenger emergency briefing to include a warning about the danger of rotating propellers. Incorporate a similar type of event into the company training programme.

Air Accidents Investigation Branch Annual Safety Review 2018 66 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Boeing 777-236, G-VIIJ on 3 November 2017 During descent into London Heathrow Airport a strong smell of fumes was apparent in the cockpit and the cabin. The crew actioned the appropriate checklist and the aircraft landed at Heathrow without further event. The aircraft was returned to service after engineering work. On the next flight the aircraft returned to stand due to fumes in the cabin having taxied for takeoff. After further engineering work the aircraft was again returned to service. The aircraft then flew once more without incident but on the return flight there were several indications of overheating in the left engine. The subsequent engineering work identified a hole in the left engine’s combustor case, which resulted in the engine being changed. A replacement engine was installed and there were no further fume events. Safety issues – Smoke and fumes, technical fault diagnosis Safety actions The engine manufacturer stated that this was the first reported event in the history of the GE90’s approximately 24 million operating hours. The cause of the failure was not determined but the engine and airframe manufacturers have instigated the following safety actions: As a precautionary measure, all swirler repair schemes will be deleted from the engine overhaul manuals. The Fault Isolation Procedure for smoke or fumes in the cabin has been amended. If the engine is identified to be the source of fumes or smoke, the revised procedure includes a requirement to inspect the fuel nozzles irrespective of whether the fumes are believed to be associated with oil or fuel.

Air Accidents Investigation Branch Annual Safety Review 2018 67 AAIB Air Accidents Investigation Branch © Crown copyright 2019 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Appendix 1 - CICITT Occurrence Categories CODE DESCRIPTION ARC ABNORMAL RUNWAY CONTACT AMAN ABRUPT MANEUVER ADRM AERODROME MAC AIRPROX/TCAS ALERT/LOSS OF SEPARATION/NEAR MIDAIR COLLISIONS/MIDAIR COLLISIONS ATM ATM/CNS BIRD BIRD CABIN CABIN SAFETY EVENTS CTOL COLLISION WITH OBSTACLE(S) DURING TAKEOFF AND LANDING CFIT CONTROLLED FLIGHT INTO OR TOWARD TERRAIN EVAC EVACUATION EXTL EXTERNAL LOAD RELATED OCCURRENCES F–NI FIRE/SMOKE (NON-IMPACT) F–POST FIRE/SMOKE (POST-IMPACT) FUEL FUEL RELATED GTOW GLIDER TOWING RELATED EVENTS GCOL GROUND COLLISION RAMP GROUND HANDLING ICE ICING LOC–G LOSS OF CONTROL–GROUND LOC–I LOSS OF CONTROL–INFLIGHT LOLI LOSS OF LIFTING CONDITIONS EN ROUTE LALT LOW ALTITUDE OPERATIONS MED MEDICAL NAV NAVIGATION ERRORS OTHR OTHER RE RUNWAY EXCURSION RI RUNWAY INCURSION SEC SECURITY RELATED SCF–NP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (NON-POWERPLANT) SCF–PP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (POWERPLANT) TURB TURBULENCE ENCOUNTER USOS UNDERSHOOT/OVERSHOOT UIMC UNINTENDED FLIGHT IN IMC UNK UNKNOWN OR UNDETERMINED WILD WILDLIFE WSTRW WIND SHEAR OR THUNDERSTORM

GLOSSARY OF ABBREVIATIONS aal above airfield level ACAS Airborne Collision Avoidance System ACARS Automatic Communications And Reporting System ADF Automatic Direction Finding equipment AFIS(O) Aerodrome Flight Information Service (Officer) agl above ground level AIC Aeronautical Information Circular amsl above mean sea level AOM Aerodrome Operating Minima APU Auxiliary Power Unit ASI airspeed indicator ATC(C)(O) Air Traffic Control (Centre)( Officer) ATIS Automatic Terminal Information Service ATPL Airline Transport Pilot’s Licence BMAA British Microlight Aircraft Association BGA British Gliding Association BBAC British Balloon and Airship Club BHPA British Hang Gliding & Paragliding Association CAA Civil Aviation Authority CAVOK Ceiling And Visibility OK (for VFR flight) CAS calibrated airspeed cc cubic centimetres CG Centre of Gravity cm centimetre(s) CPL Commercial Pilot’s Licence °C,F,M,T Celsius, Fahrenheit, magnetic, true CVR Cockpit Voice Recorder DFDR Digital Flight Data Recorder DME Distance Measuring Equipment EAS equivalent airspeed EASA European Aviation Safety Agency ECAM Electronic Centralised Aircraft Monitoring EGPWS Enhanced GPWS EGT Exhaust Gas Temperature EICAS Engine Indication and Crew Alerting System EPR Engine Pressure Ratio ETA Estimated Time of Arrival ETD Estimated Time of Departure FAA Federal Aviation Administration (USA) FIR Flight Information Region FL Flight Level ft feet ft/min feet per minute g acceleration due to Earth’s gravity GPS Global Positioning System GPWS Ground Proximity Warning System hrs hours (clock time as in 1200 hrs) HP high pressure hPa hectopascal (equivalent unit to mb) IAS indicated airspeed IFR Instrument Flight Rules ILS Instrument Landing System IMC Instrument Meteorological Conditions IP Intermediate Pressure IR Instrument Rating ISA International Standard Atmosphere kg kilogram(s) KCAS knots calibrated airspeed KIAS knots indicated airspeed KTAS knots true airspeed km kilometre(s) kt knot(s) lb pound(s) LP low pressure LAA Light Aircraft Association LDA Landing Distance Available LPC Licence Proficiency Check m metre(s) mb millibar(s) MDA Minimum Descent Altitude METAR a timed aerodrome meteorological report min minutes mm millimetre(s) mph miles per hour MTWA Maximum Total Weight Authorised N Newtons NR Main rotor rotation speed (rotorcraft) Ng Gas generator rotation speed (rotorcraft) N1 engine fan or LP compressor speed NDB Non-Directional radio Beacon nm nautical mile(s) NOTAM Notice to Airmen OAT Outside Air Temperature OPC Operator Proficiency Check PAPI Precision Approach Path Indicator PF Pilot Flying PIC Pilot in Command PM Pilot Monitoring POH Pilot’s Operating Handbook PPL Private Pilot’s Licence psi pounds per square inch QFE altimeter pressure setting to indicate height above aerodrome QNH altimeter pressure setting to indicate elevation amsl RA Resolution Advisory RFFS Rescue and Fire Fighting Service rpm revolutions per minute RTF radiotelephony RVR Runway Visual Range SAR Search and Rescue SB Service Bulletin SSR Secondary Surveillance Radar TA Traffic Advisory TAF Terminal Aerodrome Forecast TAS true airspeed TAWS Terrain Awareness and Warning System TCAS Traffic Collision Avoidance System TODA Takeoff Distance Available UA Unmanned Aircraft UAS Unmanned Aircraft System USG US gallons UTC Co-ordinated Universal Time (GMT) V Volt(s) V1 Takeoff decision speed V2 Takeoff safety speed VR Rotation speed VREF Reference airspeed (approach) VNE Never Exceed airspeed VASI Visual Approach Slope Indicator VFR Visual Flight Rules VHF Very High Frequency VMC Visual Meteorological Conditions VOR VHF Omnidirectional radio Range Air Accidents Investigation Branch Annual Safety Review 2018 AAIB Air Accidents Investigation Branch

Air Accidents Investigation Branch Annual Safety Review 2018

FD06649 ｜ 2019_英国_aaib-investigation-to-aeroprakt-a22-l-foxbat-g-cesi__Aeroprakt_A22-L_Foxbat_G-CESI_02-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

54 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 G-CESI EW/G2018/10/14 ACCIDENT Aircraft Type and Registration: Aeroprakt A22-L Foxbat, G-CESI No & Type of Engines: 1 Rotax 912ULS piston engine Year of Manufacture: 2007 (Serial no: PFA 317A-14643) Date & Time (UTC): 22 October 2018 at 1553 hrs Location: Colwall Farmstrip, Herefordshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - None Passengers - None Nature of Damage: Damage to the nose landing gear, propeller, fire wall and tail wheel Commander’s Licence: Private Pilot’s Licence Commander’s Age: 63 years Commander’s Flying Experience: 531 hours (of which 185 were on type)

Last 90 days - 6 hours

Last 28 days - 4 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis Whilst landing, the aircraft struck a recently felled tree trunk causing the aircraft to pitch forward and land on its nosewheel. History of the flight The pilot was flying G-CESI (Figure 1) from RNAS Yeovilton to Colwall Farm in Herefordshire with one passenger onboard. Visibility was good with no significant cloud and a light northerly breeze. Following a normal approach to the north-easterly runway, the pilot flared the aircraft but the tailwheel struck a recently felled tree trunk causing the aircraft to pitch forward and land on its nosewheel. The nose landing gear collapsed and the aircraft slid to a halt. The pilot and passenger were able to exit the aircraft without injury. Prior to the flight, the pilot was aware that the tree had been felled recently and that the remains might present a hazard. However, the remaining tree trunk was obscured on approach by a hedgerow. The pilot reported that he had flown a lower approach than he had previously flown because the tree was no longer present; this brought his aiming point closer to the hedge. He further reported that low sun made the field appear shorter, which had encouraged him to land as short as possible. The shorter landing caused the aircraft to clip the obscured tree trunk.

55 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 G-CESI EW/G2018/10/14 Figure 1 G-CESI before the accident Additionally, the pilot thought that a recent family bereavement may have affected his capacity during this flight. This accident highlights the potential hazards of flying to farm strips. The CAA publishes guidance on flying to farm strips in the CAA Safety Sense Leaflet 12 - ‘Strip Flying’1. Footnote 1 http://publicapps.caa.co.uk/docs/33/20130121SSL12.pdf (assessed 4 December 2018)

FD06650 ｜ 2019_英国_aaib-investigation-to-aeroprakt-a32-vixxen-g-envv__Aeroprakt_A32_Vixxen_G-ENVV_06-23.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 ACCIDENT

Aircraft Type and Registration: Aeroprakt A32 Vixxen, G-ENVV No & Type of Engines: 1 Rotax 912ULS piston engine Year of Manufacture: 2019 (Serial no: LAA 411-15611) Date & Time (UTC): 19 July 2022 at 1920 hrs Location: Newtownards Airfield, County Down Type of Flight: Private Persons on Board: Crew - 2 Passengers - None

Injuries: Crew - 2 (Fatal) Passengers - N/A

Nature of Damage: Extensive Commander’s Licence: See pilot information section Commander’s Age: See pilot information section Commander’s Flying Experience: See pilot information section Information Source: AAIB Field Investigation Synopsis On the evening of 19 July 2022, two pilots were flying circuits around Newtownards Airport in G-ENVV an Aeroprakt Vixxen. After approximately 20 mins of circuits they flew a low pass parallel to Runway 03 followed by a steep right turn passing over several people on the ground. Recorded data showed the aircraft passed over the people with 70° angle of bank at 72 ft above the ground. During this turn the aircraft was seen to descend and hit the ground. The investigation could not determine exactly why the aircraft descended in the turn but no defects could be found with the aircraft or engine. There was evidence that the aircraft’s electronic displays lost power before the accident and this could have caused a distraction. However, it was being flown in a manner that exposed the aircraft, the occupants and the people on the ground to a high risk of an accident. The investigation identified several shortcomings in the build process and the registration of the ballistic parachute recovery system, which did not contribute to the outcome. The LAA and CAA have taken action to address these. During an inspection carried out immediately before the accident the CAA identified shortcomings in the aerodrome’s safety management system, which the CAA stated have now been addressed.

2 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 History of the flight The accident occurred whilst two pilots (one male and one female) were flying circuits around Newtownards Airport (near Belfast) in G-ENVV, an Aeroprakt A32 Vixxen. It is not known who was flying the aircraft; the male pilot was seated in the left seat and the female pilot was seated in the right. The accident occurred after the airport’s normal operating hours so there was no air/ground radio service. No other aircraft was flying at or near the airport at the time of the accident flight. Shortly before the accident flight the two pilots had been flying together in a Van’s RV-8A aircraft. They landed from this flight at 1840 hrs. Prior to this flight the male pilot had flown the RV-8A with a different pilot. Another pilot had flown G-ENVV just before the accident flight. He reported that the aircraft had no problems and was flying well. Accident Location Group of Witnesses Runway 03 Runway 33 Runway 26 Figure 1 Newtownards Airport showing the accident and witness locations Several people, who were at the airport preparing for an open day due to take place the following weekend, saw parts of the accident flight. When the accident occurred, they were stood by a vintage bus on the main apron (Figure 1). Many other people in the local area witnessed parts of the flight. Data recorded on the aircraft’s electronic displays showed the aircraft started to taxi from the apron on the north-west side of the airport at 1859 hrs and took off from Runway 33 at 1901 hrs. Witnesses saw the aircraft taxi out, complete normal power checks then takeoff. The aircraft flew a left-hand circuit to a touch-and-go back on Runway 33 (Figure 2 – Point 1). This was followed by another left-hand circuit to a full stop landing on Runway 26 (Figure 2 – Point 2). The aircraft then backtracked the runway and took off again from Runway 33.

3 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 Several witnesses reported the aircraft was flying lower and closer to the aerodrome than they typically saw aircraft flying. It was reported that the aircraft was flying inside Scrabo Hill (Figure 3) during each circuit. Several people reported that the engine sounded as though it was struggling during these circuits. After taking off again, the aircraft made a spiral climb to 1,600 ft above the airport. It then made a spiral descent, completing several orbits to land on Runway 33 (Figure 2 – Point 3). At 1907 hrs one of the people at the airfield, who had a handheld radio, heard the female pilot make a comment about the wind over the radio which the witness thought was referring to the approach and landing the aircraft had just completed. The aircraft took off again and completed another left-hand circuit back to Runway 33 (Figure 2 – Point 4). The recorded data showed the aircraft’s angle of bank was around 30° during most of the turns up to this point in the flight, although it reached 47° during one descending turn. The aircraft then took off again and flew an ’S’ turn to approach Runway 03 (Figure 2 – Point 5). During this turn the angle of bank reached 59° with the aircraft at 370 ft agl. The aircraft then flew a low pass parallel to Runway 03 at approximately 70 ft above the ground. At the end of the runway the aircraft made a right turn passing over the people stood next to the vintage bus. Witnesses estimated the aircraft’s bank angle was over 60°. One witness described the aircraft “travelling more in the direction of its belly rather than forward”. It was reported that the engine sounded “normal” and was at “full power”. The last data point, recorded as the aircraft turned right, showed the aircraft was at 72 ft agl, with 71° angle of bank, travelling at an indicated airspeed of 86 kt and a normal acceleration1 of 1.91 g. Figure 2 Flight path of accident flight Footnote 1 ‘Normal Acceleration’ is the head to foot acceleration experienced by the pilot.

4 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 Seconds after the aircraft passed over the bus it appeared to be out of control and descended rapidly to the ground. Witnesses reported it happened very quickly and accounts of exactly what happened varied. However, witnesses described the aircraft “spiralling”, “turning wing over wing” and “tumbling”. One witness reported that the aircraft “made a steep bank to its right before it pitched up. The aircraft partially turned over on itself, continued along the trajectory of its initial banking turn but it was losing altitude”. Another witness described seeing the aircraft yaw markedly into the turn as it lost control. No one reported any abnormal noises from the aircraft or its engine. Witnesses also confirmed that the aircraft did not collide with any other object. The aircraft struck the ground on the airfield boundary just to the south of the flying club and airport cafe buildings. Witnesses ran to the accident site and airport staff collected the airport fire vehicle. They reached the aircraft within a few seconds but there was no sign of life from the occupants. A fire started on the right side of the fuselage but this was extinguished by the airport fire crew and the local fire service, who arrived shortly after the accident. Accident site Accident Site Clubhouse Runway 03 Scrabo Hill Figure 3 Accident site location G-ENVV struck a wooden fence on the boundary of the airfield close to the clubhouse and its outside eating area, continuing through the fence before coming to rest, inverted, over a gorse bush (Figure 3). There were no apparent ground marks from impact prior to the fence line.

5 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 Right wingtip Nosewheel Left wing Rudder Right wing Tail section Engine Fence Direction of travel Figure 4 Accident site Witness marks matching G-ENVV’s paint were found on the fence posts. The right wingtip, some glazing from the windows, and the nosewheel were detached at the point of impact with the fence (Figure 4). The rudder became detached at the point of impact with the gorse bush, and was undamaged by the post-impact fire. The remainder of the right wing, left wing, tail section, fuselage, engine and propeller were all located at the final accident site. Recorded information The aircraft was fitted with two EFIS avionic units that display and independently record flight, position, engine, and fuel data at a sampling rate of 1 Hz. The recorded data ends about nine seconds before the accident, based on the last recorded speed and estimated ground track (Figure 2). Figure 5 plots some of the data from both EFIS units, starting from when the aircraft was flying parallel to Runway 03 at about 72 ft (22 m) above the ground, and ending when the recordings stopped. The close alignment of data between the two units, seen in the figure, indicates that each unit was sampling data to within a fraction of a second of the other. The figure also shows that the recording from the left EFIS stopped six seconds before the end of the recording from the right EFIS. The manufacturer of the units stated that the data is buffered for six seconds before being stored in memory, implying that the left EFIS stopped working up to six seconds before the last data point recorded by the right EFIS at time 19:19:32. (The buffer is volatile memory, so its contents are lost when the unit’s power is turned off or disrupted.)

6 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 Figure 5 Last 13 seconds of recorded data This absence of data indicates there may have been a loss of electrical power to the EFIS units before impact. The last few seconds of the recorded data are highlighted by the shaded area in Figure 5 and correspond to when the aircraft was in the right turn with a bank angle greater than 50°. During this time, the engine speed increased by about 500 rpm [1]; the aircraft’s airspeed

7 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 reduced [2]; the pitch attitude reduced from 10° to about 7° [3]; and the normal acceleration was less than that required to maintain level flight at the bank angles flown [4]. No change in altitude was recorded; however, the resolution of the altitude data was 5 m (about 16 ft) so any changes less than this during these few seconds would not be seen in the data. Aerodrome information Newtownards Airport is a licensed aerodrome with three asphalt runways. Residential areas are located close to the airport to the west, north and east. Strangford Lough is to the south of the airport. The airport’s operating hours are 0900 hrs to 1700 hrs, during which an air/ground radio service is provided. Aircraft can fly outside the operating hours by prior arrangement. The published circuit height is 1,000 ft aal. Aircraft information The Aeroprakt A32 Vixxen is a high-wing, two seat light aircraft fitted with a Rotax 912 ULS engine and Kiev 3-bladed ground adjustable propeller. It has an all-moving tailplane and flaperon flying controls. The construction is largely metal, with a mixture of metal and fabric‑covered surfaces. Figure 6 G-ENVV at Newtownards (image used with permission) Build history The A32 is supplied as a fast-build kit from the manufacturer to the UK importer, within the 51% owner-builder amateur requirements for a LAA Permit to Fly2. The fast-build kit is Footnote 2 At least 51% of the physical aircraft build must be completed by the amateur builder.

British Civil Airworthiness Requirements (BCAR) Chapter A3-7 ‘Permit to fly Aircraft - Initial and Continuing Airworthiness’.

Civil Aviation Publication (CAP) 659 ‘Amateur Built Aircraft’.

Light Aircraft Association LAA Technical Leaflet (TL) 1.02, section 18 ‘Amateur Building Rules’.

8 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 close to 49% complete in its supplied state, which precludes significant further work being completed by anyone other than the amateur owner-builder. G-ENVV was issued with a Permit to Fly in October 2019. The aircraft arrived at Newtownards by road, requiring final assembly and avionic systems installation. Work, including fabric covering and external paint, had been done prior to its arrival. There was evidence of remunerated subcontracted work towards build completion having occurred at Newtownards. The address listed for build was not where the aircraft was finally assembled3. There were three interested parties in the aircraft’s ownership at the point of build, of which one (the male accident pilot) was registered as the owner for the initial build. The investigation did not find evidence to substantiate that the owner was physically involved in the build of G-ENVV to qualify the build within the 51% owner-builder amateur requirements. Maintenance history The aircraft’s airframe and engine logbooks were retrieved from the aircraft but neither had been updated since the last Permit to Fly revalidation inspection in October 2021, at 451 flying hours. The A32 has a manufacturer’s maintenance schedule published within its Aircraft Maintenance Manual, detailing the required maintenance at 50, 100 and 200-hour intervals. The LAA provides generic maintenance schedules for use when a manufacturer’s schedule is either not available or is not mandated by the aircraft’s Permit to Fly Operating Limitations. The LAA stated that the manufacturer’s maintenance schedule was not mandated for G-ENVV, and the ‘owner’s tailored maintenance schedule’ was declared within the Certificate of Clearance form. It was stated by those carrying out maintenance on G-ENVV that a generic LAA schedule was followed. There were no workcards or maintenance documents to support airframe or engine logbook entries made before October 2021. There were no logbook entries or maintenance history to verify the status of the airframe or engine after October 2021. Data subsequently retrieved from on board flight display systems logged 587 engine hours at the time of the accident. Aircraft examination Structure The fuselage structure surrounding the passenger compartment was destroyed in the post‑impact fire. The aft section of the tail was mainly intact, had separated from the fuselage and suffered fire damage. There was some fire damage to the left all-moving tailplane but both left and Footnote 3 Light Aircraft Association LAA Technical Leaflet (TL) 1.02, section 4 ‘Workshop and Storage Facilities’ specifies that the LAA inspector will check the suitability of where the aircraft will be built. Section 7 ‘Frequency of Inspections’ details the in-person main inspection stages required for the project. Both require knowledge of where the aircraft is to be built.

9 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 right tailplanes were present and attached. The rudder had detached at final impact and was largely undamaged. The rudder at its uppermost attachment point to the tail structure showed evidence of having travelled beyond full deflection to both left and right sides before detaching from its base plate. The right wing exhibited impact damage to the leading edge and internal structure corresponding to contact with the boundary fence. The right flaperon was partially attached to the wing, but damaged from impact with the gorse bush. The left wing had suffered significant disruption at its point of attachment with the fuselage and had become detached during impact with the gorse bush. The left flaperon was still attached. Both wings had considerable fire damage in the region of the internal fuel tanks. The nosewheel had detached at the joint with the shock absorber, also corresponding to impact with the fence. Flying controls Flying control surfaces were activated via cable and pulley systems, from a central control stick located between the seats. Continuity was established between the rudder pedals to the rudder base plate, and control stick to the tailplane and left flaperon, with the cables free from restriction and intact after impact. The right flaperon cable was found to have broken in overload in the area of the wing to fuselage attachment point, consistent with damage sustained in this area during impact. The flap lever was found in the ‘up’ position. The lever is held in place with a locking pin, which is released by pulling the lever laterally to free the pin from its locating hole. There are three locating holes for each position of flap. Due to the force required to move the lever, it is likely that the flaps were ‘up’ during flight immediately prior to impact. The trim control was located between the seats at floor level. Control cable continuity and free movement from the control lever to the trim tab was established. Avionics The aircraft was equipped with flat-screen primary flight display systems. They were an additional item to the kit purchased by the owner and were installed during the initial build, except for an Attitude Heading and Reference System (AHRS) which was a later modification. The AHRS can display information including an artificial horizon, pitch and roll attitude, airspeed, and altitude. The flat-screen display system is customisable and capable of displaying comprehensive flight, engine, and navigation information, and is coupled to a data acquisition unit. Flight logs and aircraft parameters from those flights are stored within the system, and data from the accident flight was retrieved. Two battery back-up supply units were installed; one for the flat-screen display system and one for the AHRS unit. The purpose of the battery back-up is to give up to 40 mins usage of the instrumentation if aircraft main power fails. The power supplies for the flat-screen display system were controlled by two toggle switches added to an existing row of switches on the centre console. Both switches were required to be on for the screens to function.

10 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 The AHRS power was controlled from a single toggle switch at the top centre of the same console. None of the switches were labelled as to their function. At the accident site, both flat-screen display system switches were found in the on position and the AHRS switch was found in the off position, however, due to the disruption to the cockpit area that occurred upon impact, these switch positions cannot be confirmed to have been the same during flight. An examination of the electrical system was conducted, but it was too badly damaged by the post-impact fire to determine system integrity or continuity. Fuel G-ENVV was fitted with optional larger fuel tanks, with total capacity of 114 l, 112 of which is usable. The A32 can be used with fuel meeting three different specifications4. It was not possible to determine the type of fuel used during the accident flight although witness accounts refer to the pilot purchasing UL91 fuel in drums that were stored in the aircraft’s hangar. It could not be determined how much fuel was on board at the start of the accident flight. The pilot who flew the aircraft on the previous flight estimated there was 20 litres remaining after his flight. However, it was not possible to determine if the aircraft had been refuelled immediately prior to the accident flight. It was reported that the aircraft typically consumed 15-20 l/hr. The length of pipework between the fuel tanks and engine could contain enough fuel for approximately 40 seconds of flight once the usable fuel had been consumed. Fuel quantity is displayed on two analogue dials in the central console, each with its own low fuel warning light. The electronic flight displays did not record fuel quantity. Fire damage concentrated in the locations of the fuel tanks and fuselage indicated that the system contained fuel at impact. The A32 has two fuel supply handles, one for each wing tank. One of the fuel supply handles was retrieved and was in the ‘open’ position, but its position during flight could not be verified. There was no fuel remaining for sampling or quantity analysis. Engine The Rotax 912 ULS had suffered significant fire damage, and it was not possible to determine if fuel remained within the carburettors or fuel manifold although recorded engine data showed it running at approximately 5,100 rpm immediately prior to the accident. The throttle levers remained connected to the carburettors after the accident. The spark plug electrode gaps and colouration were within manufacturer limits. Two plugs were lightly coated with oil, but the engine was found inverted with an accumulation of oil Footnote 4 Motor gasoline (Mogas), Aviation gasoline (Avgas 100LL), or a fuel that meets a minimum octane of 95 and has an Anti-Knock Index of 91. The latter specification includes fuel type UL91.

11 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 within this cylinder, which probably occurred post-impact. Borescope examination of the cylinders did not show any areas of excessive wear or build-up of combustion products for the engine’s estimated hours. Propeller All three blades were found at the engine impact point. One blade was still attached to the propeller hub but cracked at its base, the second was partially attached and the third had completely detached. The blade damage was consistent with the propeller stopping within a single revolution upon impact. The Rotax 912 ULS engine is fitted with a clutch to protect the engine from damage caused by a propeller strike. It is possible that the clutch disconnecting the propeller from the engine, followed by multiple strikes with the fence and gorse before hitting the ground, could have slowed the propeller’s rotation. Therefore, the power of the engine at impact could not be clearly determined. Ballistic parachute recovery system A ballistic parachute recovery system (BPRS) is a rocket-deployed parachute, used to recover a whole aircraft including occupants to the ground in an emergency situation. G-ENVV was fitted with a Magnum 601 S-LSA BPRS located aft of the luggage compartment behind the seats. The system comprises a parachute packed into a soft case, launched by a separate rocket canister. The parachute exits the aircraft through a frangible hatch on the upper fuselage surface. The system is activated by a pull-handle cable located between the aircraft’s seats. The pull-handle has a safety pin inserted into it to prevent unintended operation on the ground, which is required by the manufacturer to be removed before flight. The BPRS had not been activated by either occupant, and the safety pin was found inserted in the handle. It is not known if the occupants had inadvertently left the pin in place or if they routinely flew with the activation pin installed. CAA and LAA guidance5,6 specifies a two‑stage release control for BPRS to avoid inadvertent operation. BPRS installation approval for the A32 was based on that for the A22 Foxbat, where a 2.5 mm cable tie is used for the secondary release, not the activation pin. It is possible that the occupants regarded the activation pin as the secondary release mechanism or were not familiar with the two‑stage release guidance for this aircraft type. External warning placards are required7 to be applied to aircraft fitted with a BPRS, to alert occupants upon entering the aircraft and emergency responders in the case of an accident. The presence of a BPRS must also be notified to the CAA (in this case via the LAA) for inclusion in the central aircraft register to provide safety information to those attending in an emergency. The requirement to notify the CAA at initial aircraft registration was introduced at the beginning of 2022 in response to an accident where BPRS was fitted but the CAA Footnote 5 Civil Aviation Authority (CAA) CAP 482 British Civil Airworthiness Requirements (BCAR) Section S – Small Light Aeroplanes, Sub-Section K, Issue 7. ‘AMC S 2003 (Interpretive Material)’. 6 Light Aircraft Association (LAA) Technical Leaflet (TL) 3.27 Ballistic Parachutes, Issue 1, 27 March 2020 Section 4.3 ‘Miscellaneous Points’. 7 Civil Aviation Authority (CAA) CAP 482 British Civil Airworthiness Requirements (BCAR) Section S – Small Light Aeroplanes, Sub-Section K, Issue 7. S 2041 ‘Markings and Placards’

12 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 was not informed8. There was no evidence of placards on the aircraft and the presence of a BPRS was not shown in G-ENVV’s CAA database record. The only reference found to a BPRS fitted to G-ENVV was within the weight and balance record completed at initial permit application. No entries were found within the aircraft’s build record, modification record or Permit to Fly application paperwork, nor subsequent annual Permit to Fly revalidations. LAA members and inspectors associated with G-ENVV’s build and maintenance did not appear to have a good understanding of the relevant requirements. Survivability The manufacturer of the BPRS specifies a minimum deployment altitude for safe rescue of 200 m, with some documented rescues down to 80 m. This allows sufficient time for safe parachute opening and aircraft stabilisation during which altitude is lost. G-ENVV was flying at an altitude of approximately 80 ft (24 m) at the point where departure from controlled flight occurred. If the BPRS had been activated at this moment, there would not have been enough time for the parachute to deploy and effectively arrest the aircraft’s descent. G-ENVV was fitted with four-point harnesses at both seats. There was extensive fire damage to the harness webbing but the buckles from both seats were found fastened. A lack of heat and smoke damage to the interior of the buckles indicated that they were both fastened correctly prior to impact. Weight and balance The aircraft had two occupants on board, a partial fuel load and no luggage, and would have been within its maximum takeoff weight of 600 kg and centre of gravity limits. Aircraft performance The Pilot’s Operating Handbook (POH) gives the aircraft’s 1g stall speed at maximum takeoff weight, with flaps up, as 32 KIAS. The POH does not give the stall speed for level flight with different bank angles. However, based on data supplied by the manufacturer, the stall speed in level flight at 70° angle of bank would be approximately 68 KIAS9. A load factor of 2.92 g is required to maintain level flight with 70° angle of bank. The aircraft is certified as non-aerobatic and its operating handbook specifies a maximum bank angle of 60°. It has a maximum positive load factor of +4.0g. Meteorology Weather reports are not recorded at Newtownards Airport outside aerodrome hours. Belfast City Airport (7 nm west-north-west) reported, at the time of the accident, a surface wind from 350° at 6 kt varying between 300° and 020°, visibility greater than 10 km, cloud overcast at 3,200 ft, temperature 16°C and a sea level pressure of 1022 hPa. Footnote 8 AAIB investigation to Silent 2 Electro, G-CIRK, 23 April 2021 https://www.gov.uk/aaib-reports/aaib- investigation-to-silent-2-electro-g-cirk [Accessed February 2023] 9 The indicated stall speed at this angle of bank is higher than might be estimated from increased load factor alone, due to indication errors at increased angle of attack.

13 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 A pilot who took off from Newtownards approximately 40 minutes before the accident estimated the wind at the airfield was from the north-west at 8 - 12 kt but he commented that the wind increased markedly in the climb. Pilot information The female pilot was 44 years old and held a Private Pilot’s Licence which was issued in October 2020. She held a Single Engine Piston rating which was valid until 31 October 2022 and also held a night rating. She had a valid Class 2 medical. She had been undertaking training for a restricted instrument rating (IR(R)) and it was reported that she had been studying to take the ATPL ground exams. The last entry in her logbook was on 21 October 2021 which was an IR(R) training flight in a Cessna 172. Her last flight as pilot in command in G-ENVV was recorded on 13 October 2021. The logbook gave a total flight time of 204.6 hours. Flying club technical log dockets were found relating to 14 further flights between 23 October 2021 and 19 February 2022 totalling 12.1 hours but these were not recorded in her logbook. A notepad was also found containing notes about three flights on 7, 14 and 20 May 2022.

An instructor commented that she had been a “competent and knowledgeable student” who flew with “caution and diligence”. However, he had noticed a change in her flying in the months preceding the accident. After observing several tight approaches with sharp turns onto final approach he felt compelled to speak to her about the risks involved in manoeuvring close to the ground. He spoke to her informally, advising her to be more cautious. The male pilot was 50 years old and held a National Private Pilot’s Licence which was issued in June 2018. He had held Microlight and Simple Single Engine Aeroplane (SSEA) ratings but the Microlight rating lapsed on 31 May 2022 and the SSEA rating lapsed on 31 October 2021. There was no evidence that either rating had been renewed. He had a valid self-declared medical. His logbook was in the aircraft when the accident occurred and was significantly fire damaged. A photograph was found of a page of his logbook which showed that in November 2021 he had accumulated 421 flying hours. His logbook contained five further completed pages (55 flights) but the logbook was too damaged to read the details of these flights. Several qualified pilots who knew him well commented that “he liked to push the boundaries” and “he enjoyed the more exciting side of flying”. It was reported that he was “a very capable pilot” but he enjoyed “flying low approaches and very tight circuits”. A commercial pilot who had recently flown with him in G-ENVV commented that he felt “uncomfortable” with the tight circuit the pilot had flown. He had recently purchased a Van’s RV-8A aircraft and had been flying aerobatic manoeuvres, although he had no formal training or qualification in aerobatics.

14 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 Organisational information The airfield is operated by a flying club. The flying club incorporates a Declared Training Organisation (DTO). Flying club members can fly the club aircraft but some members also hangar their own aircraft at the airfield. The flying club is managed by a committee of volunteers. The accident flight occurred in a privately owned aircraft being flown by two qualified pilots10. It was therefore outside the oversight of the DTO. It also occurred outside the aerodrome’s published hours, which limited oversight by the flying club. The Aeronautical Information Publication entry for the airfield states that flying outside the licensed hours is allowed ‘by arrangement’. The club website refers to an out-of-hours indemnity form which should be completed to fly outside licensed hours but the investigation found that no such form existed. The investigation did not find any record of who was authorised to fly outside hours or any arrangements by which this was managed. Some committee members reported that there had been previous reports of low flying and excessively tight circuits being flown by other pilots outside licensed hours. They reported that during licensed hours, with a duty instructor on duty and with considerable flight training activity taking place, there was sufficient oversight, but that outside hours there was no oversight. Several years previously, the committee had tried to report to the CAA another pilot who was observed low flying, but they had not been able to provide sufficient robust evidence, so the CAA was unable to take any action. This resulted in the committee feeling they were unable to tackle future similar issues. The flying club standard operating procedures set out the requirement for all incidents to be reported in writing and posted in the reporting box in the flying club. Despite several previous incidents being mentioned to the AAIB during this investigation, no evidence was found of any previous incident reports being made to the flying club. The aerodrome manual describes the club safety management system (SMS). It states that ‘an aerodrome safety committee meets a minimum of twice per year to review any safety related issues, accident and incident reports’. The investigation did not find any evidence that these meetings had ever happened. On the day of the accident and the previous day the CAA was conducting an oversight audit at the airport. The audit finished before the accident and made five Level 2 findings11. One of these related to the SMS and stated: Footnote 10 The male pilot’s flying licence was not valid at the time of the accident. 11 A Level 2 finding means it been identified that the Aerodrome is not in full compliance with the aerodrome licensing requirements set out in either the Air Navigation Order, the Aerodrome Licence, ICAO Annex 14, Civil Aviation Publication (CAP) 168 or the Aerodrome Manual. Rectifying action must be taken within the agreed timescales.

15 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 ‘The safety management system was found not to be operating as described in the aerodrome manual: 1) Current records could not be found for the committee monthly meeting or the 6 monthly Airport Safety Group meeting, 2) No evidence of internal audits could be found, 3) The SMS should include reference to “just culture”, 4) Current monthly reports could not be found’. The auditor also observed a runway incursion during the audit and made the following finding: ‘The aerodrome does not have effective procedures to prevent runway incursions. An incursion was witnessed during the audit when an individual riding a motorbike entered the aerodrome and crossed runways 03/21 and 15/33 to access hangars across the airfield but without making radio calls. An MOR needs to be filed for this event and adequate procedures implemented (covering access, driving rules and procedures and RTF procedures) to enable this activity to be completed safely.’ When asked about the safety culture at the flying club several people reported to the AAIB that it was poor. It was reported that there was a small group of pilots who often operated outside normal aviation convention, but this had not been addressed by the committee. Analysis Accident flight The accident occurred whilst the aircraft was making a low altitude steep turn, which occurred above people and buildings. There was no evidence of any construction anomaly, failure or malfunction in the airframe or flying controls that could have contributed to the accident. Data recovered from the aircraft’s avionics suggested the engine was performing normally during the accident flight. The exact fuel quantity on board could not be determined. However, the previous pilot reported there was at least 20 litres remaining after his flight and, if that were the case, there would have been sufficient fuel onboard for the 20 minutes flight. It is possible that the steep angle of bank could have caused the fuel supply to the engine to be interrupted but the fuel pipework was of sufficient capacity that had it contained fuel it could have sustained the engine for approximately 40 seconds. An absence of recorded data from the EFIS units indicates they may have lost power before impact, although it could not be determined why this occurred as battery back-up systems were installed. Had such a failure occurred, it is possible that it captured the pilot’s attention and briefly distracted the pilot from the primary task of flying the aircraft.

16 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 The aircraft exceeded its 60° bank angle limit in the last 1.5 seconds of recorded flight. It was not possible to determine if this was intentional. It was not possible to determine the exact sequence of events which led to the aircraft losing height and striking the ground. The last recorded data point showed the aircraft had a normal acceleration of 1.91 g. If sustained, this would be insufficient to maintain level flight with a 70° bank. It is possible that the accident was caused by over banking and descending in the turn with insufficient altitude for the pilot to recover, but witness accounts are more consistent with a departure from controlled flight. The stall speed with 70° bank and level flight is approximately 68 KIAS. At the last data point the aircraft was flying at 86 KIAS, but the speed was reducing and the application of nose-up elevator intended to arrest a descent might cause a stalling angle of attack. The aircraft was flown at 72 ft above people and buildings. The rules of the air12 state that the pilot in command should ‘not fly in a manner that would endanger either people or property’ and should ‘not fly closer than 500 ft to any person, vessel, vehicle or structure unless necessary for taking off or landing’. It is likely the pilot in command was breaching both rules. It is not known which pilot was flying the aircraft when the accident occurred. Both pilots had previously been seen flying steep turns at low altitude. The male pilot had recently purchased a Van’s RV-8A aircraft and it was reported that he had been flying aerobatic manoeuvres in that aircraft. The investigation did not find any evidence that either pilot had been trained in aerobatic flight. Choosing to fly excessive manoeuvres close to the ground increases the opportunity for error and reduces the room for recovery, placing occupants and the public at unnecessary risk. Pilot’s licence The male pilot did not have a valid flying licence. His Microlight and SSEA ratings had expired. It is likely that he would have had sufficient flying hours to revalidate by experience but he had not had his licence signed by an examiner13. Once the ratings had lapsed he would have needed to complete a proficiency test to renew the ratings. It is possible that he was not aware that his ratings had lapsed. The CAA does not provide a reminder service for when ratings and licenses lapse.  However, all pilots must ensure their licence is valid before flying. If unsure about the requirements advice can be sought from an instructor, examiner, flying club or the CAA. Footnote 12 Guidance on the Rules of the Air can be found in the Skyway Code (CAP1535) available at The Skyway

Code | Civil Aviation Authority (caa.co.uk) (accessed 22 November 2022). 13 It could not be determined if he had completed a flight with an instructor which is required to revalidate by experience but the 55 flights in his logbook suggests he would have achieved the 12 hours required.

17 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 Aircraft build and maintenance It was not possible to ascertain the exact build and maintenance status of G-ENVV due to a lack of detail within the aircraft’s build, maintenance and logbook paperwork. This is likely, in part, due to the low level of owner involvement during build completion compared to third party assistance, regarding the 51% amateur builder requirements. It is possible that as a result the aircraft did not conform to the requirements to qualify for a Permit to Fly, indicating this aspect of the process for fast-build kits that would benefit from a higher level of oversight. The LAA is exploring ways to improve oversight of the build process relating to the 51% rule, looking to include, but not limited to, more frequent and better targeted auditing of build projects. There was nothing to indicate to those attending the accident site that G-ENVV was fitted with a BPRS. CAA registration of G-ENVV occurred in 2019, before the introduction in 2022 of a point in the registration process to verify that BPRS and compliant placarding was fitted. There was no point within the LAA Permit to Fly issue or annual Permit to Fly revalidation process to verify that BPRS and relevant compliant placarding had been fitted, other than by relying on inclusion in the aircraft’s modification record during the build process. It also appears there was no reliable way to ensure this information was included in the CAA’s central aircraft register. Permit to Fly issue and annual revalidations presented three opportunities at which this could have been identified for G-ENVV. To ensure future visibility of BPRS installations the following safety actions have been taken: The CAA has amended form CA1 Application for Aircraft Registration or Change of Ownership, introducing a field to indicate whether an emergency ballistic device such as BPRS is fitted. The LAA has amended form CA3 Permit to Fly Application, introducing a field to indicate whether an emergency ballistic device is fitted, which is flagged to the CAA Aircraft Registration Team to subsequently update the GINFO database. Retrospective installations of BPRS must be notified to the LAA by an application to install BPRS as a new modification to the aircraft type, or notification that BPRS has been installed as a manufacturer’s standard option. The LAA will then notify the CAA of the installation. There was a lack of knowledge regarding regulations for BPRS installation, placarding and notification to the appropriate authorities amongst LAA inspectors and members. It is becoming increasingly popular amongst the general aviation community to fit BPRS, which are offered as an option or retrofit on many microlight and general aviation aircraft. To improve awareness among LAA inspectors and members, the following safety actions have been taken: The LAA has included the requirements for BPRS markings and notification of installation to the CAA for inclusion on G-INFO register in articles within the ‘Engineering Matters’ section of the member publication Light Aviation.

18 © Crown copyright 2023 All times are UTC AAIB Bulletin: G-ENVV AAIB-28491 New LAA Inspector induction briefings given by the LAA Chief Inspector now include a specific topic explaining BPRS installations and associated aircraft marking requirements. Organisation Members of the flying club committee were aware that low flying was taking place outside the aerodromes licensed hours in the months before the accident, but no action had been taken to prevent it. It was reported that the committee had not found an effective way to manage flying outside licensed hours. The CAA conducted an audit at the airfield just before the accident which found that the SMS was not functioning as described in the aerodrome manual. During the investigation of this accident the AAIB found a lack of safety reporting within the club and received several reports of a poor safety culture. The CAA audit made several findings which the CAA stated the aerodrome operator has now addressed. Conclusion The accident occurred when the aircraft was flown at low altitude and a high angle of bank over people and buildings. There was insufficient evidence to determine the precise cause. No defects were found with the aircraft or engine which could have contributed to the accident. There was evidence that the electronic displays in the aircraft lost power before impact and it is possible that this caused a distraction. However, the aircraft was being flown in a manner which exposed it, the occupants and the people on the ground to a high risk of an accident. The investigation identified several shortcomings in the build process and the registration of the BPRS system. The LAA and CAA have taken action intended to address the registration of BPRS systems. The LAA is exploring ways to improve oversight of the build process within the 51% amateur building rules. Published: 18 May 2023.

FD06651 ｜ 2019_英国_aaib-investigation-to-aerospatiale-sa341g-gazelle-yu-hmc__Aerospatiale_SA341G_Gazelle_YU-H.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

37 © Crown copyright 2019 All times are UTC AAIB Bulletin: 5/2019 YU-HMC EW/G2018/07/18 ACCIDENT Aircraft Type and Registration: Aerospatiale SA341G Gazelle, YU-HMC No & Type of Engines: 1 Turbomeca (Safran) Astazou 3A turboshaft engine Year of Manufacture: 1974 Date & Time (UTC): 14 July 2018 at 1540 hrs Location: Private landing field, Enfield, Greater London Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Helicopter destroyed by fire Commander’s Licence: Private Pilot’s Licence (Helicopters) Commander’s Age: 65 years Commander’s Flying Experience: 266 hours (of which 266 were on type)

Last 90 days - 17 hours

Last 28 days - 7 hours Information Source: Aircraft Accident Report Form submitted by the pilot and further enquiries by the AAIB Synopsis While trying to reposition his helicopter from one part of his garden to another, the pilot perceived that the engine had lost power. He tried to return to the takeoff site but the helicopter came down about 20 metres short and rolled onto its side. The helicopter was destroyed by a post-crash fire. The cause of the reported loss of power could not be determined. History of the flight The helicopter was parked at the bottom of the pilot’s garden while some building works were being carried out. The pilot intended to take off and position the helicopter nearer his house so he could clean and polish it, and then depart to Elstree for fuel. The takeoff weight with the pilot and 325 kg of fuel onboard was 1,524 kg (MTOW 1,800 kg). The wind was calm and the air temperature was 30°C. After carrying out his usual daily inspection and pre-flight checks the pilot lifted off into a 5 to 10 ft hover. All checks were normal. He then moved forward and initiated a right turn. During the right turn he perceived that the engine had lost power. He tried to return to the takeoff site but came down about 20 metres short. The ground there was uneven with some large wooden pallets and other building materials. The pilot thought the helicopter

38 © Crown copyright 2019 All times are UTC AAIB Bulletin: 5/2019 YU-HMC EW/G2018/07/18 probably struck one of the pallets and then rolled onto its side, with the rotor blades striking the ground. The pilot instinctively climbed out and moved rapidly away from the helicopter. He had omitted to operate the emergency fuel shutoff lever and he could hear the engine running, at low power, as he left the helicopter. He could see steam or smoke so he fetched a fire extinguisher. When he returned the helicopter was on fire with large amounts of smoke. The fire service had been notified of the fire by a passer-by and arrived on scene 8 minutes after the call, at 1551 hrs. The fire service applied water around the fire to stop it spreading. It then took them about 5 to 6 minutes to set up a new foam machine before they started applying foam to the fire, by which time most of the helicopter had already burnt out. The pilot stated that the incident happened very quickly and he did not recall seeing or hearing any cockpit warnings. Accident site and aircraft examination After the fire had subsided, there was very little remaining of the helicopter (Figure 1). The maintenance organisation recovered the helicopter wreckage to their facility and conducted an investigation but were unable to establish a cause of a loss of power. There was no evidence that the engine had suffered an uncontained failure and the turbine was intact and could be rotated through about 30°, but no further due to impact damage to the combustion chamber. There was very little remaining of the fuel system that could be examined. The engineer at the maintenance organisation thought that the fuel tank had probably been punctured by a pallet or metallic materials on the ground where the helicopter came down, resulting in the post-crash fire. Figure 1 Remains of YU-HMC at the accident site (image used with permission)

39 © Crown copyright 2019 All times are UTC AAIB Bulletin: 5/2019 YU-HMC EW/G2018/07/18 Engine examination The engine had accumulated 4,914 hours since new and 1,424 hours and 2,279 cycles since last overhaul (maximum time between overhauls is 1,750 hours and 5,600 cycles). The engine manufacturer examined the remains of the engine and performed a borescope examination. Their findings included the following: ● ● The engine air intake was found to be dirty with aggregated soot deposits. ● ● The axial and centrifugal compressors did not have any mechanical damage, with no evidence of foreign object impacts. ● ● Some soft material with the appearance of fibreglass cloth was found in the air path between the axial and centrifugal compressors, indicating continued engine rotation after impact. ● ● There was small unknown debris like sand or dust at the centrifugal compressor’s trailing edge. ● ● The stator vanes between the axial and centrifugal compressors were coated in black deposits which the engine manufacturer considered may have existed prior to the post-crash fire. ● ● The diffuser outlet between the axial and centrifugal compressors was coated in deposits that appeared like thin soil, sand powder or dust, which the engine manufacturer considered may have existed prior to the post- crash fire. ● ● There was some dust in the combustion chamber inlet but no anomalies inside the combustion chamber. ● ● The 1st stage turbine wheel had damaged blade tips which were consistent with a T41 overtemperature condition at some point. ● ● The blade tips of the 3rd stage turbine were discoloured due to heat which was also consistent with a T4 overtemperature condition at some point. The engine manufacturer stated that thin soil or sand powder deposits in the engine are commonly encountered during engine usage which is why routine chemical washing of the compressor is required. If these deposits build sufficiently it will result in a lower compression rate of the air entering the combustion chamber and therefore less power with the same fuel flow. The fuel control unit will attempt to maintain a constant engine speed so it will increase fuel flow, which will result in a higher temperature. This can lead to a T4 overtemperature and consequential turbine blade tip damage. The system does not have an automatic T4 limiting system and is reliant on the pilot noticing the T4 exceedance and reducing power. Footnote 1 The T4 temperature is the temperature measured at the 3rd stage turbine exhaust. It is a temperature indicated to the pilot and has an exceedance limit.

40 © Crown copyright 2019 All times are UTC AAIB Bulletin: 5/2019 YU-HMC EW/G2018/07/18 The engine manufacturer stated that the ‘dirty airpath’ could have led to a T4 exceedance in-flight at some point, resulting in 1st stage turbine blade damage and consequential loss of power. However, because the engine was still running after impact, it was also possible that the T4 exceedance and turbine damage were the result of the heat from the post-crash fire. Maintenance involving compressor wash The maintenance organisation stated that compressor chemical washes and water rinses were carried out on YU-HMC every 30 flying hours or 6 months, whichever came first, in accordance with the helicopter manufacturer’s maintenance requirements. The last compressor wash was carried out on 27 February 2018 during the helicopter’s last annual inspection and it had accumulated about 30 hours since then. The helicopter had been booked in for its 30-hour maintenance inspection on 16 July 2018, two days after the accident. The maintenance engineer, who had 34 years’ experience maintaining Gazelles, stated that he thought the deposits found in the engine were the result of post-impact ingestion. The pilot stated that he had not flown YU-HMC anywhere dusty but that there was soil at the accident site. Analysis Although it was a hot day with calm wind, the helicopter was 276 kg below its maximum takeoff weight so it should have had sufficient performance for the taxiing manoeuvre the pilot undertook. It is possible that the airpath to the centrifugal compressor had accumulated deposits during operation which led to a lower compression rate and a higher temperature operation. This, combined with the hot outside air temperature, could have led to a T4 exceedance, turbine damage and a consequential loss of power, leading to the accident. However, it is also possible that the T4 exceedance occurred during the post-impact fire and that some deposits were ingested while the engine continued to run on the ground, with the helicopter on its side.

FD06652 ｜ 2019_英国_aaib-investigation-to-airbus-a320-214-g-ezoi__Airbus_A320-214_G-EZOI_09-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

53 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-EZOI EW/G2019/02/14 SERIOUS INCIDENT Aircraft Type and Registration: Airbus A320-214, G-EZOI No & Type of Engines: 2 CFM56-5B4/3 turbofan engines Year of Manufacture: 2015 (Serial no: 6562) Date & Time (UTC): 25 February 2019 at 1700 hrs Location: En route from Edinburgh Airport to Bristol Airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 6 Passengers - 178 Injuries: Crew - None Passengers - None Nature of Damage: None Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 39 years Commander’s Flying Experience: 4,200 hours (of which 4,050 were on type)

Last 90 days - 149 hours

Last 28 days - 32 hours Information Source: Operator’s internal report and Aircraft Accident Report Form submitted by the pilot Synopsis A louder than usual noise was observed from an avionics vent fan before flight. During flight the noise increased and vibration became apparent. The crew then noticed a strong burning smell so they donned their oxygen masks and diverted the flight. An ECAM1 message, associated with an avionics ventilation system fault, was generated and the crew performed the associated actions. A subsequent investigation revealed the cause of the event to be worn bearings in the avionics extract fan. The fan manufacturer and the aircraft manufacturer both took safety action to prevent similar incidents in future. History of the flight On the ground at Edinburgh the flight crew were advised by the cabin manager of a louder than usual fan noise in the aircraft cabin. The commander identified the noise as being from an Avionics Vent Fan. There were no other indications and, following a discussion with the co-pilot and the cabin manager, the commander, who considered that the noise was not so unusual, decided to continue the flight and to monitor for any change in the noise. Footnote 1 Electronic Centralised Aircraft Monitoring.

54 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-EZOI EW/G2019/02/14 Later, while in cruise flight, the noise increased and vibration became apparent. The commander sent a message to the company Maintenance Operations Control (MOC) requesting engineering assistance on arrival at Bristol. The flight crew also reviewed their required actions in the event of a fan overheat or fire/smoke indication. Shortly after starting the initial descent, with the aircraft in the vicinity of Birmingham, “a very strong burning smell” filled the flight deck. The flight crew donned their oxygen masks and initiated a diversion to Birmingham Airport. The commander alerted the cabin crew to the situation and gave the cabin manger a NITS2 brief. The fan noise was then heard to wind down and, soon after, the Electronic Centralised Aircraft Monitoring (ECAM) message vent extract fault was displayed. The ECAM actions were carried out, after which the smell of smoke appeared to lessen. The crew declared a PAN to ATC and an uneventful approach and landing was made at Birmingham Airport.

Aircraft information The first steps of the procedure when a crew suspects that smoke is coming from the avionics and/or the air conditioning systems is to don an oxygen mask and establish communication between themselves. Switch selections are then made to ensure that avionics ventilation air is directed overboard and further smoke is prevented from entering the cockpit and cabin. The avionics blower and extract fans form part of the avionics ventilation system. The system is fully automatic and a vent extract fault alert triggers on the ECAM when the extract pressure is low. The associated crew action is to select the EXTRACT fan switch, located on the overhead panel, to ovrd (override). Aircraft examination The avionics blower and extract fans were removed from the aircraft and sent to the workshop for examination. The extract fan was found to be seized with the rear flange worn. Its rotor was damaged and the front bearing worn. No significant anomalies were found with the blower fan which was fully functional. The avionics blower and extract fans were replaced and the aircraft was returned to service.

Footnote 2 NITS emergency briefing protocol; Nature, Intention, Time, Special instructions

55 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-EZOI EW/G2019/02/14 Other information Previous similar event The AAIB reported on a similar in-flight fumes event which occurred in July 2015.3 The report advised on safety action taken by the aircraft manufacturer: ‘In March 2005 the fan manufacturer issued a Vendor Service Bulletin, 3454‑21-108, to replace the original steel ball bearings with an improved ceramic bearing. The aircraft manufacturer issued a corresponding Service Information Letter, SIL 21-141, to notify operators. SIL 21-141 was replaced by In Service Information (ISI) 21.26.00027, published in November 2013. The introduction of ceramic bearings has reduced the in-service arising rate, but the aircraft manufacturer reported that fan failure still causes between five and 10 aircraft diversions per year. In August 2013 the fan manufacturer issued a Service Information Letter, 3454HC-21-250, to inform operators that a new overhaul task had been added to the fan Component Maintenance Manual. The task periodically replaces the bearings and other components subject to wear, with a recommended periodicity of 10,000 Flying Hours. However, the fan manufacturer acknowledged that operators may wish to set their own avionics blower fan maintenance plan and recommended that operators avoid exceeding 12,000 flying hours between fan overhauls.’ Additional information was included: ‘The aircraft manufacturer advised that, in the longer term, fan vibration monitoring will be the subject of an in-service evaluation aimed at reducing similar events in the future.’ The fan manufacturer subsequently developed an optional modification to introduce a ball bearing health monitoring function on the avionics fan. This would stop the fan before a failure occurred and fumes were released. Analysis The flight crew were aware of a possibly noisy fan before departure from Edinburgh but in the absence of any other indication decided to continue the flight. The problem worsened in flight and the commander advised the company MOC that assistance would be required at their destination. The next indication to the crew was a strong burning smell and they donned their oxygen masks at once and initiated a diversion. Subsequently, an ECAM vent extract fault alert was triggered and the crew performed the associated actions.

Footnote 3 AAIB investigation to Airbus A320-232, G-EUYE, In-flight fumes event, 90 nm south-east of London Heathrow Airport, 27 July 2015. Available at:https://www.gov.uk/aaib-reports/aaib-investigation-to-airbus-a320-232-g- euye [Accessed 14 May 2019].

56 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-EZOI EW/G2019/02/14 The source of the smoke was traced to the avionics extract fan. The aircraft manufacturer had previously acted to reduce the number of avionics fan related smoke events. Subsequently, additional action was taken to introduce an optional modification which would stop a fan before smoke was released. Conclusion The avionics extract fan failed during flight and released smoke/fumes into the flight deck. The flight crew, already alerted to a possible problem by an unusual noise and vibration, initiated a diversion. Similar events have occurred in the past and the aircraft manufacturer, fan manufacturer and operator took action to reduce the number of occurrences. Safety action Fan manufacturer The fan manufacturer issued service bulletin 3454HC-21-101 on 18 April 2018, which provided details of an optional modification which introduced a ball bearing health monitoring (BBHM) function to continuously monitor the condition of the ball bearings and preventively stop the fan before its failure. Operator Following the fan manufacturer’s original service bulletin and information letters between 2005 and 2013, the operator introduced a soft-life campaign to incorporate the recommendations to reduce the inflight failure rate of these fans. This commenced in 2016. In November 2018 the operator commenced a soft-life campaign to install the BBHM function and at the date of this report 23 modified fans had been installed.

FD06653 ｜ 2019_英国_aaib-investigation-to-airbus-a330-243-g-tccf__Airbus_A330-243_G-TCCF_09-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

57 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-TCCF EW/G2019/02/05 SERIOUS INCIDENT Aircraft Type and Registration: Airbus A330-243, G-TCCF No & Type of Engines: 2 Rolls-Royce Trent 772B-60 turbofan engines Year of Manufacture: 1998 (Serial no: 248) Date & Time (UTC): 6 February 2019 at 1720 hrs Location: In flight over North Atlantic Ocean, west of the Republic of Ireland Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 11 Passengers - 326 Injuries: Crew - None Passengers - None Nature of Damage: VHF radio unit damaged Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 49 years Commander’s Flying Experience: 13,135 hours (of which 1,050 were on type)

Last 90 days - 98 hours

Last 28 days - 45 hours Information Source: Aircraft Accident Report Form submitted by the pilot and operator investigation Synopsis Coffee was spilled onto the commander’s audio control panel (ACP). This resulted in failure of his ACP and later, the ACP on the co-pilot’s side. During the failures, the ACPs became very hot and produced an electrical burning smell and smoke. The commander decided to divert to Shannon, Republic of Ireland. The failure of two ACPs caused significant communication difficulty for the flight crew. The operator has taken safety action to reduce the chance of spillage. History of flight The flight departed from Frankfurt airport in Germany and was scheduled to fly to Cancun in Mexico. Approaching position N5500.0 W02000.0 the flight crew were served coffee in cups without lids (Figure 1). This was normal for this operator and route. The commander was pilot monitoring. He put the coffee on his tray table while he completed tasks required due to approaching a waypoint. At approximately 1620 hrs, the cup was knocked over. Most of the liquid fell onto the commander’s lap and a small amount spilled onto the commander’s ACP (ACP1, see Figure 2).

58 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-TCCF EW/G2019/02/05 Figure 1 Example of cup used in the aircraft cup holder ACP1 ACP2 Figure 2 Location of the ACP1 and ACP2 boxes

59 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-TCCF EW/G2019/02/05 The coffee on the centre console was dried quickly but resulted in immediate malfunction of ACP1 that affected VHF transmissions and public address announcements from this unit. The crew attempted to isolate ACP1 but it was not possible to do this from the flight deck. Subsequently, at approximately 1700, the ACP1 unit became very hot and failed and there was an electrical burning smell in the cockpit. At approximately 1720 hrs, approaching N5600.0 W03000.0, the audio control panel on the co-pilot’s side (ACP2) became hot enough to start melting one of its buttons, and failed. A small amount of smoke was observed coming from the ACP1. The commander decided to divert to Shannon, Republic of Ireland. During the diversion, the flight crew alternately used supplementary oxygen, with one pilot on oxygen at all times. Approximate location where G-TCCF diverted Approximate location where the coffee was spilled Figure 3 Planned route and approximate location where the commander decided to divert The various ACP failures resulted in communication difficulties. The commander was not able to receive or transmit and could only hear transmissions through the co-pilot’s speaker. There was no interphone between the pilots. The aircraft diverted to Shannon without further incident. The smoke stopped and though there was a residual burning smell, the fumes did not result in injuries to anyone on board.

60 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-TCCF EW/G2019/02/05 Airbus flight crew techniques manual The A330 flight crew techniques manual states: ‘Airbus highly recommends that the flight crews put and store all objects in their dedicated area in the cockpit: Cups in the cup holders.’ Engineering action ACPs 1 and 2 were removed and stripped by the vendor. The strip report for ACP1 confirmed component failures attributed to liquid contamination. The strip report for ACP2 listed the failed components but did not offer potential causes these failures. The area below the centre console was inspected and no further areas were found that had been affected by liquid contamination. Analysis The strip report indicated that the failure of ACP1 and the smoke and fumes were the result of electrical shorting caused by liquid contamination. The reason for the failure of ACP2 was unclear from the strip report. The aircraft manufacturer recommends using the cup holder. The size of cups used by this operator on this route made it more difficult to take cups in and out of the cup holder than larger cups that have a bigger area at the top of the cup holder to grasp. This incompatibility generally discouraged use of the cup holder, despite the policy. In the A330, flight crew were provided with a table in front of them, and it was a natural place to put a drink momentarily. However, objects here are vulnerable to being knocked over because it is a fold out table in a small space. It is also a convenient place to put other things that are likely to be moved during flight, such as the pilot’s log. A lid properly secured on the top of the cup may have reduced the amount of liquid spilled on the centre console. Conclusion A spillage of coffee on to the centre console led to the failure of ACP 1 and 2 resulting in communication difficulties for the flight crew. The resulting electrical burning smell and smoke in the cockpit necessitated a diversion to Shannon Airport. Safety actions The operator changed their procedure to ensure that cup lids are provided for flights on all routes and reminded cabin crew of the requirement to use them. The operator also issued a flight crew notice reminding pilots to be careful with liquids. The operator raised an action to source and supply appropriately sized cups for the aircraft’s cup holders.

FD06654 ｜ 2019_英国_aaib-investigation-to-auster-aop-9-g-bxon__Auster_AOP.9_G-BXON_03-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

32 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 ACCIDENT Aircraft Type and Registration: Auster AOP.9, G-BXON No & Type of Engines: 1 Bombardier Cirrus 20801 piston engine Year of Manufacture: 1955 (Serial no: AUS/10/60) Date & Time (UTC): 18 June 2017 at 1135 hrs Location: Spanhoe Airfield, Northamptonshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - 1 (Fatal) Passengers - 1 (Serious) Nature of Damage: Aircraft destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 49 years Commander’s Flying Experience: 409 hours (of which 0.5 hours were on type)

Last 90 days - 2.0 hours

Last 28 days - 0.5 hours Information Source: AAIB Field Investigation Synopsis The pilot was undertaking his second flight on the recently-restored vintage ex-military aircraft. Shortly after taking off from Spanhoe Airfield, the aircraft was observed to bank left into a steep descent and strike the ground to the left of the runway. The pilot was fatally injured, and the passenger sustained serious injuries. The investigation determined that the aircraft stalled at a low height, from which it did not recover before striking the ground. The investigation also identified several issues relating to the aircraft and engine performance, maintenance documentation, the Permit to Fly application process, and guidance for pilots preparing for their first flight on a new type. The Light Aircraft Association (LAA) has taken a number of safety actions. No Safety Recommendations are made. History of the flight G-BXON had recently been rebuilt and restored at Spanhoe Airfield. Its first Permit to Fly was issued by the Civil Aviation Authority (CAA) on 2 June 2017 and the LAA sent it to the pilot on 6 June 2017. The pilot, who was also the owner, flew the aircraft for the first time the day before the accident, accompanied by another pilot. On the accident flight, the pilot took off from Spanhoe’s Runway 27 at around 1130 hrs with a passenger. The pilot occupied the left seat, and the passenger was in the right. A number of bystanders who were near the open entrance of a hangar watched the aircraft takeoff until it was obscured from view. Shortly after, on hearing a bang, and realising that

33 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 the engine noise had ceased, they went outside to find a column of smoke rising from the field left of the departure end of the runway. One person phoned the emergency services and some of the group immediately went to the accident site, where the aircraft was found to be on fire. One of this group discharged a hand-held fire extinguisher however this had no effect due to the intensity of the fire. The pilot, who was still inside, was fatally injured. The passenger had sustained serious injuries and was found near the aircraft. A horse rider had stopped at a position around 430 m from the end of the runway to watch the aircraft depart. She stated that the takeoff initially seemed normal but, soon after, the aircraft rocked slightly; first right then left. There was a short pause before the aircraft rolled left into a steep descent and struck the ground to the left of the runway. The engine noise sounded constant up until the impact. Figure 1 shows the location of the various witnesses. Airfield information Spanhoe is an unlicensed former World War II airfield in Northamptonshire, at an elevation of 340 ft amsl. It is situated 6 nm south-west of RAF Wittering, and within its Military Aerodrome Traffic Zone. It has a 700 m runway aligned 090° and 270° which is mainly concrete, and a 500 m grass runway aligned 140° and 320°. Figure 1 Spanhoe Airfield and location of witnesses Flight on the previous day The pilot’s first flight on the aircraft departed from Spanhoe’s Runway 27 at approximately 1600 hrs on 17 June 2017. He was accompanied by a pilot who had AOP.9 experience, hereinafter referred to as ‘Pilot B’. The pilot acted as commander from the left seat. Pilot B occupied the right seat as a passenger, albeit acting in a supportive capacity.

34 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Pilot B reported that takeoff flaps were used for the departure, and that the pilot accurately flew a climb speed of 60 KIAS. The pilot had asked him to monitor the takeoff engine rpm, which he recalled as being approximately 2,300 rpm. Pilot B recalled that the rate of climb (ROC) was relatively low although he was not concerned about it. The pilot raised the flaps at approximately 450 ft agl and turned left downwind. They left the circuit briefly to fly some steep turns and then landed back on Runway 27. The pilot’s logbook recorded a 30 min chock-to-chock time. Pilot B stated that he had been impressed by the pilot’s professionalism during the flight. He recalled commending the pilot on his precise speed control and suggesting that he may also benefit from ‘feeling’ how the aircraft is performing. Meteorology Aftercast information provided by the Met Office indicated that, during the weekend of the accident, there was high pressure across the UK and conditions were very warm. The weather at RAF Wittering around the time of G-BXON’s first flight and the accident flight was reported as follows: 17 June 2017 at 1550 hrs: wind from 260° at 7 kt, visibility greater than 10 km, scattered cloud at 4200 ft, temperature 29°C and QNH 1024 hPa. 18 June 2017 at 1150 hrs: wind from 240° at 7 kt, visibility greater than 10 km, no cloud, temperature 28°C and QNH 1023 hPa. These conditions resulted in density altitudes1 (DA) at Spanhoe of approximately 1,930 ft and 1,840 ft2 for the penultimate and accident flights respectively. Recorded information Accident flight No recorded data was recovered from the aircraft and the aircraft was below radar coverage. Flight on the previous day The takeoff and landing at Spanhoe on the day before the accident were videoed by a bystander at the airfield; the recording indicated an airborne time of approximately 10 minutes. The audio and images from the takeoff video were analysed to calculate the aircraft’s groundspeed and to review the climb performance, engine speed and flap settings. The windsock was visible in the takeoff video and indicated a light, varying headwind. Based on RAF Wittering’s weather report at that time, a 7 kt wind correction was added to the Footnote 1 Density altitude: Pressure altitude corrected for variations from standard temperature. As density altitude increases, an aircraft’s performance reduces, and vice versa. 2 DA values throughout this report have been corrected for humidity.

35 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 aircraft’s calculated groundspeed to derive its approximate true airspeed (TAS)3. However, there are limitations to the accuracy of the calculated groundspeed, and the derived TAS, as the wind speed correction applied for the latter was based on the reported wind conditions at an airfield 6 nm away. The takeoff occurred at 1557 hrs. Audio analysis indicates that, as the aircraft passed the camera position during the takeoff roll, the engine speed was 2,300 rpm ±50 rpm and there was no significant variation subsequently. The video images show approximately 17° ± 2.5° of flap, consistent with a takeoff flap setting; no flap asymmetry was evident. As derived from the video images, the aircraft lifted off with a true airspeed of approximately 56 KTAS. It climbed away at approximately 57 to 60 KTAS, with a ROC of approximately 500 ft/min. After the aircraft climbed through about 70 ft aal, it was no longer possible to extract useful data from the imagery. On the accident flight the following day the aircraft travelled approximately 80 m further along the runway from this point before departing from controlled flight. Personnel information Pilot The pilot held an EASA Private Pilot’s Licence (PPL(A)) and his logbook provided evidence that he had gained appropriate training4 and experience in operating taildragger5 aircraft. It showed a total of 409 flying hours, including 217 hours on taildragger aircraft. Prior to flying G-BXON on 17 June 2017, the pilot had logged two flights6 in the preceding 90 days. He had no recorded hours on any Auster type, but a significant proportion was on other high‑winged taildragger aircraft. Spanhoe had a close-knit community and witnesses reported that the accident pilot was eager, though somewhat apprehensive, to fly his newly-restored aircraft. Anecdotal evidence indicated that he had been very focussed on G-BXON’s rebuild. It was not determined to what extent he had prepared himself on the AOP.9’s specific handling characteristics but another AOP.9 owner reported that the pilot had often accompanied him as a passenger in his aircraft and, on those occasions, they did talk about handling matters. That aircraft was not fitted with dual controls. The pilot was described as being cautious and as someone who would ‘fly by the numbers’, tending not to deviate from target figures. Footnote 3 TAS is the speed of the aircraft through the air, whilst indicated airspeed (IAS) (presented on the airspeed indicator (ASI)) is a measurement of dynamic pressure entering the aircraft’s pitot tube. TAS is usually higher than IAS and at low altitudes the difference is insignificant. 4 Starting in 2003, the pilot had flown a number of hours in a Pitts S2A tailwheel aircraft with instructors, which he referred to as a ‘conversion’. There was no instructor’s signature present in the pilot’s logbook relating to completion of tailwheel differences training, but this may have been due to an administrative oversight. 5 Aircraft with a tailwheel or tailskid. 6 One of these was a Single Engine Piston (SEP) revalidation training flight involving more than one takeoff and landing.

36 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Pilot B Pilot B was an experienced naval and airline pilot who had owned a number of light aircraft including, previously, an AOP.9. He had 20 hours 35 minutes of flight time in the AOP.9, and his last flight in one was in G-BXON the day before the accident. Passenger The passenger on the accident flight was a friend of the pilot. He had automotive engine experience and had assisted with some aspects of the work on G-BXON’s engine during its restoration. He was not a qualified pilot. LAA inspector and testing pilot The pilot had engaged the services of an LAA inspector to assist with and oversee the completion of G-BXON’s rebuild, and the application for its Permit to Fly. The inspector held LAA approvals to sign off aircraft build projects, final inspections before first flight, aircraft maintenance and permit renewal recommendations. Although not required for the maintenance and inspection of LAA aircraft, he was also a Licensed Aircraft Maintenance Engineer (LAME) and owned an aircraft maintenance organisation based at Spanhoe. He also held valid EASA Part 66 and BCAR Section L licences and an ELA-1 authorisation, which allowed him to make recommendations to the CAA for issue/renewal of an aircraft Certificate of Airworthiness (CofA). This individual was also a former flying instructor and had particular Auster expertise, having previously owned and overseen the rebuild of a number of AOP.9s. He had conducted all the test flying on G-BXON. Previously, he had performed flight testing on other aircraft under the CAA process. First flights on type Amongst the LAA community, a pilot’s first flight on type was colloquially referred to as a ‘check-out’ as they would tend to be accompanied by another pilot experienced on type. However, there was no requirement for this flight to be instructional and, providing that a pilot and an aircraft were compliant with the necessary licencing and certification requirements, then a pilot new-to-type could act as commander and carry passengers. There was an informal expectation at Spanhoe that the pilot would fly G-BXON for the first time alongside its LAA inspector and testing pilot, or another AOP.9 owner with recent experience on type. These individuals had limited availability over the accident weekend. Pilot B reported that the accident pilot approached him shortly before 1600 hrs on 17 June 2017 requesting he accompany him on his first flight. Description of the aircraft The Auster AOP.9 is a high-wing, strut-braced tailwheel aircraft with three seats, originally designed for military airborne reconnaissance. The fuselage is constructed of welded steel tubes covered with a doped fabric. The wings are fabric-covered, with the exception of the metallic leading edge and the tail unit is of all-metal construction.

37 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 The AOP.9 is powered by a Bombardier Cirrus 20801 inverted in-line engine, driving a two‑blade, fixed-pitch metal propeller. Fuel is carried in flexible tanks located in the left and right wing roots and is gravity-fed to a collector tank. An electrically-driven fuel booster pump in the collector tank feeds fuel to two mechanical engine-driven pumps and then to a fuel injection pump, from which a metered quantity of fuel is delivered directly into the engine cylinders via fuel injection nozzles. The flying controls7 are conventional with control surfaces operated by push-pull rods, cables and chains. The aircraft is equipped with hydraulically-operated split flaps, actuated by a handpump and an up/down selector lever centrally mounted on the cabin roof structure. The flaps may be lowered to any intermediate position; the takeoff position is reached when the lower surface of the flap is in line with a yellow mark painted on the aileron hinge bracket. The ailerons are linked to the flaps via a cam and cam follower, so that when the flaps are lowered, the ailerons droop up to a maximum of 10°, thereby increasing the effective flap area. At the takeoff flap position, the cam profile changes sharply, so the aileron droop does not increase with further lowering of the flaps. The AOP.9 features a retractable pitot probe; it can be extended or retracted on the ground by withdrawing a spring-loaded locking pin on the lower wing surface. In order to lock it in either position, the locking pin must be engaged in one of the two locating holes on the underside of the probe. The AOP.9 is not equipped with an artificial stall warning device. Accident site and wreckage information The accident site was located in an area of standing crop, to the left of the end of Runway 27. Examination of the ground marks and wreckage distribution indicates a dynamic impact sequence, in which the left wingtip and pitot probe made first contact with the ground, dislodging the left wingtip fairing. The aircraft then cartwheeled with the propeller and engine striking the ground, followed by the right landing gear and right wingtip. The initial impact trail was on an approximate heading of 196° and the aircraft came to rest upright on an approximate heading of 287° (Figure 2). Several propeller strikes were evident in the crop and two distinct propeller strikes on the ground exhibited yellow paint transfer from the propeller tips (Figure 3). An intense post-impact fire had consumed the contents of the aircraft, the cockpit controls, instrument panel and the fabric covering of the fuselage and wings. Both wings had detached from the fuselage mounting points as a result of the impact and fire damage but remained close to the fuselage. The right elevator had separated and was found close to the main wreckage. All three aircraft doors had detached during the impact. The engine was no longer attached to its mounting points and was lying on its side. Footnote 7 G-BXON was fitted with dual controls, which was an optional fit on the AOP.9.

38 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Initial impact mark (wingtip) Right landing gear Main wreckage Engine impact mark Propeller strikes Figure 2 Aircraft wreckage and impact trail Propeller strikes Propeller ground-strikes Figure 3 Propeller strikes

39 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Detailed aircraft examination General The outer right wing leading edge exhibited damage consistent with striking the ground. With the exception of the metallic leading edge skin panels, all of the right wing structure inboard of the fuel tank boundary rib, including part of the flap, flap operating torque tube and aileron control run, was absent, having been consumed by the post-impact fire. The outer left wing and wingtip displayed damage consistent with striking the ground and the wingtip rib was bent inwards by about 90°. All the wing structure in the inboard-most rib bay, including the part of the left flap surface and the inner portion of the flap operating torque tube had been consumed by the fire. The pitot probe was filled with soil and bent upwards and outboard. It was found in a partially extended position and the locking pin was not engaged in either of the locating holes. Examination revealed that it was likely the pitot probe had been fully extended and impact forces displaced it towards the retracted position, overcoming the spring force of the locking pin. It was not possible to examine or test the remainder of the pitot/static system due to impact and fire damage. Flying controls The right elevator separated from the tailplane during the impact, however, all the cables and connections in the control runs for the elevator and rudder control systems remained intact. The elevator trim tab on the left elevator was found to be in the neutral position, however, the pre-impact trim setting could not be determined due to the extent of the disruption to the cockpit. The right aileron outer attachment bolt mounted to the wingtip rib had pulled through its mounting due to impact forces, but the right aileron control circuit was otherwise intact. The left aileron outer attachment bolt had also pulled through its mounting and the cam follower for the aileron droop mechanism had dislodged from the cam due to impact forces. The left aileron control rod had separated at the joint between the rod and the forward end-fitting; the four rivets which held it in place had sheared. The inboard end of the left flap torque tube was unrestrained, so it was not possible to make any determination of the flap position. The lower surface of the right flap was broadly aligned with the yellow indicator line on the aileron hinge bracket and witness marks indicated that it had been in the takeoff position at the time of impact. Cockpit The steel tubular structure of the cockpit remained largely intact, however the extensive fire damage meant that no meaningful information could be obtained from the instrument panel, instruments, flight controls or engine controls. Each of the three aircraft seats was equipped with a four-point ‘ZA-type’ harness with a quick release fitting (QRF). It was not possible to assess the effectiveness of the restraint

40 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 system on the occupied seats, as the harnesses had been entirely consumed by the post- impact fire, but three QRFs were found within the aircraft wreckage. One QRF, assumed to be that from the left seat, was fire-damaged and still had all four buckles engaged. The release mechanism appeared to function freely, however the buckles did not release, most likely due to deformation sustained in the accident. A second QRF was discoloured due to heat but appeared otherwise undamaged; one shoulder buckle remained engaged and the others were released. A third QRF was found close to the observer’s seat in the back of the aircraft; the two lap buckles were engaged but, due to the extent of the fire damage, the mechanism could not be operated. Engine examination General The engine and its ancillary components were examined under the supervision of the AAIB, at a specialist engine maintenance facility experienced in working on vintage piston engines. The propeller, spinner and No.1 cylinder baffles exhibited damage consistent with striking the ground and a number of the engine accessories were broken or had been damaged in the post-impact fire. However, the engine otherwise appeared largely intact. The engine would not rotate freely until the camshaft was removed and, although not visually apparent, it was determined that impact-related distortion in the cam assembly had prevented both the camshaft and engine from turning. No. 1, 3 and 4 cylinders exhibited poor compression, with leakage past the exhaust valves being evident. The inlet and exhaust valves were poorly seated to varying degrees on all cylinders and there were signs of blow-by and/or carbon build-up on the exhaust valves. They did not have the appearance of valves which had been recently lapped. All cylinders showed signs of glazing along with some corrosion pitting and evidence of only minimal honing. In addition, the No.1 and 2 cylinders were very oily. The spark plugs were of varying aerospace types and the firing gaps ranged from 0.015 to 0.025 inches compared to the recommended gap of 0.012 to 0.015 inches. When tested, only three of the spark plugs exhibited a strong spark with the others exhibiting weak and/ or intermittent sparks and, in one case, a spark that tracked down the insulation rather than jumping across the gap. The ignition leads had been manufactured from copper-cored automotive wire and had the appearance of having been recently replaced. Magneto8 timing checks revealed that the timing on the left side was slightly out, such that the voltage pulse occurred early at 48°, rather than the specified 41° ± 1°, before Top Dead Centre (TDC). The left and right contact breakers’ point gaps were 0.026 inches and 0.014 inches respectively; the recommend gap is 0.009 ± 0.001 inches. The magneto was run on a test rig and sparking was evident at the contact breaker points due to the large gaps. It operated for approximately 2 hours before failing ‘hot’ at a temperature of 59°C. A burning smell was Footnote 8 The Bombardier Cirrus 20801 is fitted with a duplex magneto which contains two separate ignition circuits within a single unit.

41 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 evident throughout the test and visual inspection showed heat degradation of the lacquer coating on the lower coils. It was not possible to determine whether this was related to the post-impact fire or whether the magneto had previously exceeded its operating temperature. Two pieces of re-solidified molten white metal and two flakes of paint-like material, were found in the main oil filter housing. There was no evidence that this debris had come from within the engine and its origin was not determined, however, the filter had prevented it from entering the engine oil supply. It was noted that the cap nut of the oil pressure relief valve (OPRV) was unlocked with three threads visible and had not been wire-locked and there were indications of relatively recent maintenance on the valve guide and ball. The engine oil was blacker than expected, possibly as a result of the blow-by noted on the cylinders. Mechanical fuel pumps There was no fuel present in either of the mechanical fuel pumps, the interconnecting pipe, nor the fuel line to the fuel injection pump. Although externally heat damaged, the fuel pumps and pipes were intact so there was no evidence that fuel could have leaked out since the accident but the possibility that the fuel evaporated in the post-impact fire could not be ruled out. The securing wing nuts on the fuel pump bowls were not wire-locked. When run on a fuel test rig neither pump was able to develop or maintain suction pressure to deliver fuel, even when manually primed. It was therefore not possible to conduct a delivery flow rate test on the pumps. Additionally, in certain conditions, fuel was observed to leak from the pump body and the fuel drain, which indicated that fuel was leaking past the internal diaphragm. In an attempt to determine how the pumps would perform on‑aircraft, the installed aircraft condition was simulated by providing gravity-fed fuel to the pumps from an external source mounted above the test rig. In this condition, the head of fuel created sufficient pressure to allow fuel to pass through the pumps. A rudimentary flow rate check was conducted at a test rig operating speed of 800 rpm9. After taking into account the contribution from the gravity-fed fuel, the delivery rate for each pump solely due to pump action was determined to be approximately 21% of the expected delivery rate at this operating speed. Disassembly revealed that on both pumps the clamping nut at the base of the central spindle was loose, resulting in the internal diaphragm not being adequately clamped. Additionally, the diaphragms did not have the appearance of having been professionally fitted and cut to size, exhibiting stretching and creasing, elongated bolt holes and a crudely-cut central hole (Figure 4). Oil had leaked to the fuel side of the diaphragm, indicating that the diaphragm did not form an effective seal between the fuel and oil (atmospheric) side of the pump. One effect of this is that fuel could escape through the centre of the diaphragm into the oil side of the pump and exit a fuel drain in the upper part of the pump body; this would result in reduced suction. Footnote 9 The fuel flow test described in the ‘Amal Operation, maintenance and overhaul instructions for Fuel Pump type 240/8’ has four test points at various test rig operating speeds; 800 rpm is the third test point.

42 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Figure 4 View showing oil side of diaphragm from right mechanical fuel pump Fuel injection pump The fuel injection pump was intact and did not display any obvious impact damage. No fuel was present in the pump, but a small amount of residual fuel was found in the No. 4 fuel injection line and was retained for further analysis. The timing of the fuel injection system is normally set to coincide approximately with the induction period of the engine. A fuel injection pump timing check was performed and fuel delivery to the No.1 cylinder commenced at 130° before TDC and stopped at 27° before TDC; the engine manual indicated that fuel delivery should commence at 27° before TDC. The fuel injection pump and nozzles were removed from the engine and tested on a fuel test rig using shop fuel lines. Leaks were observed on the No. 2 and 4 fuel injection nozzles. The part of both nozzles which mates with the fitting on the fuel injection line exhibited an uneven surface, with burrs, such as if they had been damaged by a spanner. This may have made it difficult to achieve an effective seal between the nozzles and fuel fittings on the aircraft. Additionally, two of the six clamping screws on the No. 2 nozzle were loose, causing fuel to leak from the injector body. These anomalies were rectified to allow testing of the injection pump. The pump operated normally when tested but the fuel flow was out of calibration because the mixture strength was running lean. The adjuster nut on the pump, which allows mixture strength to be altered, did not have an index mark, so it was not possible to determine if/how it had been previously adjusted. However, the end cap on the adjuster nut had modern wire locking, which indicated that it may have been disturbed at some point.

43 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Aileron control rods Left aileron control rod The heads of the failed rivets in the left aileron control rod forward end-fitting were not found. However, the rivet tails remained within the end-fitting and were subjected to metallurgical examination. The top rivet tail came loose during removal of the control rod from the aircraft and is shown separately in Figure 5. UP FWD Figure 5 Left aileron control rod (top) and end-fitting attachment rivets (bottom)

44 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 The rivets were identified as ⅛ inch diameter break-stem, pop-type blind rivets10. The inboard and outboard rivet tails were grey and were filled with corrosion product and paint. Conversely, the top and bottom rivet tails were green, and only the head of the mandrel was observed in the hollow centre. Metallurgical examination showed that the fracture surfaces of all four rivets exhibited differing amounts of mechanical damage, caused by contact between the opposing fracture surfaces during detachment of the end-fitting. The remaining surface detail showed that all four rivets had failed as a result of ductile overload in shear, indicating that they were carrying load at the time of failure. The outboard rivet also exhibited three distinct patches of intergranular fracture (shown in purple in Figure 6), which indicated the presence of pre‑existing intergranular cracking prior to the shear overload failure. The precise extent of the intergranular fracture could not be determined due to the mechanical damage, but the areas in which it was observed indicated that it may have extended across one third of the surface area. Figure 6 Fracture surface of outboard rivet showing areas of intergranular corrosion Footnote 10 Blind pop rivets are installed by pulling a mandrel through from the head side. When a tight joint has formed, the mandrel breaks at a pre-determined position on the stem, hence they are referred to as break-stem rivets. The head of the mandrel remains in the centre of the hollow rivet but does not provide any support to the joint in shear.

45 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Intergranular corrosion and stress corrosion cracking11 was also observed on the internal surfaces of the inboard and outboard rivets. Although no intergranular fracture was evident on the fracture surface of the inboard rivet, the mechanical damage may have destroyed any pre-existing cracking that was present. Energy Dispersive X-ray (EDX) analysis determined that all four rivets were manufactured from an aluminium-magnesium alloy consistent with 5056 Grade, which is commonly used for rivets. Micro-hardness tests indicated that the hardness range of the rivets was closer to the annealed condition than the fully hard condition12. All four rivets on the aft fitting of the control rod were green and manufactured from the same material as those on the forward fitting. Right aileron control rod A comparative examination of the right aileron control rod identified that all eight end-fitting attachment rivets were grey in colour. It was noted that the inboard rivet on the aft end‑fitting had failed. The rivet tail was filled with corrosion product and the rivet head was absent. The remaining rivets were intact, and there was no evidence that the joint had distorted under shear loading. Detailed examination showed that the fracture surface of the failed rivet was entirely comprised of intergranular failure. The absence of any ductile shear overload features indicated that this rivet was not carrying any load at the time of failure. The remaining rivets in the right aileron control rod were not examined. Aileron control rod drawings and material properties The AOP.9 spares manual13 indicates that, following a modification, there are two standards of aileron control rod, for which there are separate drawing numbers. No part number was marked on the failed aileron control rod from G-BXON, so it was not possible to identify whether it was of a pre or post-modification design. The original pre-modification drawing was not located, however, the AOP.9 Type Record document made reference to the pre‑modification drawing and indicated that the original rivets were AGS 2048-420 ⅛ inch pop rivets. The data sheet for AGS 2048-420 rivets indicated that they are green in colour and made from BS L.5814 aluminium alloy which is equivalent to 5056 Grade. Footnote 11 Stress corrosion cracking can occur when susceptible metals or alloys are subject to a continuing tensile stress above a threshold level in a corrosive environment. Initiation normally occurs when the protective surface finish has been compromised allowing corrosion to start. In the case of the rivets, the residual stresses from the rivet forming process may be sufficient, in combination with a corrosive environment, to provide the conditions for stress corrosion cracking. 12 Typical hardness values for 5056 Grade aluminium are 74 HV in the annealed condition and 123 HV in the fully hard condition. The hardness results obtained indicated that there had probably been some strain hardening of the rivets close to the fracture surface, due to deformation caused by the installation process. In each case the lowest hardness value for each rivet was measured close to the fracture surface and ranged from 85 HV to 93 HV. The rivets were therefore closer to the annealed condition. 13 Air Publication 2440 H Volume 3, Part 1 ‘Auster Mk.9 (AOP) Aircraft Schedule of Spare Parts’, first issued December 1954, amended June 1962. 14 The BS L.58 specification ‘Wire for solid, cold-forged rivets of aluminium – 5% magnesium alloy’ has since been superseded by BS 3L.58, but the material properties remain the same.

46 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 A copy of the post-modification drawing15 was provided to the investigation and specified the use of ⅛ inch diameter Chobert snap-head rivets16 and sealing pins17. The change to Chobert rivets did not appear to be directly related to the modification but had been added to the drawing at a subsequent revision. The Chobert rivets have an ultimate shear strength of 240 – 260 MPa, dependent upon the sealing pin material. By comparison, 5056 Grade aluminium alloy in the annealed condition, from which G-BXON’s rivets were manufactured, typically has an ultimate shear strength of 179 MPa, with a minimum shear strength of approximately 159 MPa. Aerodynamic flight loads for the AOP.9 aileron were calculated18 by the AAIB. Based on the rivets used in G-BXON and using the minimum allowable shear strength for 5056 Grade, the ultimate shear strength of the rivets was calculated to be sufficient to sustain the maximum flight loads which could be expected in the aileron control rod, even if two of the rivets had completely failed. The AOP.9 Type Record document included a ‘Strength summary of aileron control circuit’ which indicated that the critical design load case for the rivets was the ‘pilot effort’ case; this refers to the maximum control stick loads that could be applied by a pilot on the aileron control circuit, for example, if trying to overcome a jammed aileron. For this load case, the load in each rivet was quoted as 194.25 lbs and the allowable load as 195 lbs, giving a reserve factor of 1.004. Fuel sample analysis The fuel sample retained from the fuel injection line and another sample taken from the jerry cans used to fuel G-BXON, were tested to determine whether they conformed to the industry standard fuel specification for Avgas 100LL19. The jerry can sample did not meet the specification for vapour pressure, indicating that it was contaminated with a more volatile fuel, most likely automotive gasoline. Further testing indicated that the sample was broadly consistent with Avgas 100LL and that the level of contamination was small. The fuel injection line sample contained some particulate contamination and was green in appearance. Avgas 100LL typically has a blue tint. There was insufficient fuel to complete the full specification test, but analysis by other techniques indicated that, although similar to the jerry can sample, the fuel from the injection line had some volatile components Footnote 15 Originally issued in July 1957, and subsequently revised in August 1957 and September 1962. 16 Chobert rivets are installed using a reusable steel mandrel which is pulled through the rivet towards the head. The installed rivet is hollow, although the use of a sealing pin effectively makes the rivet solid, increasing its shear strength and sealing the internal structure of the assembly from the environment. 17 The sealing pins can be manufactured from either L64 or DTD 423 grade aluminium alloy, which is equivalent to a modern 2014 T4 or 2014 T6 respectively. 18 Using the criteria described in 14 CFR FAR 23 Appendix A ‘Simplified design load criteria of for conventional single-engine airplane of 6,000 pounds or less maximum weight’. 19 Defence Standard 91-90/4 for Aviation Gasoline, produced by the UK MOD Aviation Fuels Committee and endorsed by the CAA.

47 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 missing. This sample also contained some phthalate esters20 and other unidentified components. Medical and pathological information The pilot held a Class 2 medical certificate, valid until 22 July 2018, and records from his doctor indicated that he was in good health. A post-mortem of the pilot found no evidence of disease or toxicology that could have contributed to the event and concluded that the cause of death was burns sustained in the post-impact fire. The only injury not related to the effects of fire was a pelvic fracture and associated hip dislocation. The post-mortem report suggested that this could provide an explanation as to why the pilot was unable to extricate himself from the aircraft following the collision. However, the report also indicated that there was ‘no macroscopically apparent soot staining’ in the pilot’s airways and that the only ‘slightly raised level’ of Carboxyhaemoglobin21 in the pilot’s blood ‘supports that he died relatively quickly’ after the fire started. The passenger suffered multiple impact injuries and burns to his left arm and leg. Following the accident, he was found about 21 m away from the aircraft wreckage. He later commented that, despite some vague flashbacks, he could not reliably recall anything between taxiing out to the runway and being found in the field afterwards. Both occupants were wearing normal clothing which would not have offered protection against the post-impact fire. LAA published guidance Permit to Fly Aircraft that do not meet the certification standards required to hold a CofA may operate in the UK under a national Permit to Fly22,23 issued by the CAA. For aircraft operated under the LAA system, the CAA delegates responsibility to the LAA to oversee the airworthiness requirements and make recommendations for the issue of a Permit to Fly. The LAA, as the responsible sporting body, supports amateur build and restoration projects and maintenance of aircraft by its members, under the supervision of a suitably-approved LAA inspector. The LAA system places the responsibility for the airworthiness of the aircraft on the owner of the aircraft. On the Permit to Fly application form, an owner is required to sign the following declaration: ‘I undertake to keep the aircraft in an airworthy condition and to operate it within the limitations of the Permit to Fly.’ Footnote 20 Phthalate esters, typically plasticisers, are substances added to plastics to increase their flexibility, transparency, durability and longevity. These are common contaminants found in Avgas, as they can be extracted from polymeric materials that are in contact with fuel, such as fuel hoses or plastic storage containers. 21 Carboxyhaemoglobin is formed when carbon monoxide, a common product of combustion, is inhaled. 22 Aircraft in this category are typically amateur-built, vintage, ex-military, microlights or gyroplanes without a valid Type Certificate. 23 The Permit to Fly airworthiness regime allows aircraft to be built and/or maintained by an owner rather than a certified manufacturer or an approved maintenance organisation.

48 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 LAA Technical Leaflet TL 2.01 ‘A guide to LAA aircraft ownership’, dated 31 March 2014, provides a general summary of the responsibilities of owning, operating and maintaining a Permit to Fly aircraft. In the section titled ‘Maintain the aircraft in an airworthy condition’ it states: ‘The Permit to Fly requires that an aircraft be maintained in an airworthy condition…. LAA encourages owners to engage themselves fully with the maintenance of the aircraft, but alternatively this can be carried out on a commercial basis either using paid individuals or a maintenance organisation. Either way, by their very nature, Permit to Fly aircraft are somewhat unique and less well supported in airworthiness terms than their CofA cousins and need a greater degree of owner engagement, technical appreciation and vigilance to achieve an equivalent level of safety.’ And: ‘Note that if an LAA inspector carries out maintenance on behalf of an owner, he or she can do so but whether they are remunerated or not, this is not carried out under the LAA inspector’s remit. The LAA inspector’s remit only covers the inspection and certification role.’ Rebuild and restoration of LAA aircraft LAA Technical Leaflet TL 2.21 ‘Rebuilding an aircraft under the LAA system’, dated 3 January 2013, provides guidance for those undertaking an aircraft rebuild or restoration. It states: ‘Between you and your inspector, you will need to write up worksheets describing the rebuild, to be signed up by your inspector as you go along. A copy of the worksheets are [sic] to be submitted on completion of the rebuild.’ TL 2.21 describes the final inspection required upon completion of the rebuild and the process of applying to LAA Engineering for approval for flight testing. It states: ‘When the rebuild of the aircraft is complete, a final inspection must be carried out. Normally this takes the form of an annual check as listed in the LAMS [Light Aircraft Maintenance Schedule] schedule or the LAA generic maintenance schedule (see TL 2.19). In addition, a symmetry check and in-depth rigging check is carried out and all systems calibrated and tested fuel flows checked and engine ground run.’ And: ‘A minimum period of five hours flying followed by a formal flight test is required before a full Permit to Fly can be issued.’

49 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 LAA test flying Testing pilots LAA aircraft require test flying to qualify for initial issue of a Permit to Fly, and thereafter for renewal of a Permit to Fly. LAA Technical Leaflet TL 1.19, ‘Initial test flying of LAA aircraft’, dated 1 January 2008, is aimed at both owners and testing pilots, and outlines some of the safety and logistical considerations for the test flying process. It states: ‘The choice of pilots for carrying out test flying is another issue where owners put forward their suggestion and LAA Engineering have to vet the proposal, based on the previous flying experience of the person put forward, currency on aeroplanes of the type concerned, or at least, similar or related types… The whole point of the test period is to get the aeroplane fine-tuned so it will handle properly in normal use later on.’ The LAA produced a checklist24 for testing pilots entitled ‘LAA self-briefing tool for use pre first flight of newly completed aircraft’. It includes items such as reading the relevant operating manual; awareness of the operating limitations; and awareness of special issues for the type, for example, handling issues. The tool also contains a prompt to consider applying ‘…operating limitations over the standard ones eg reduced envelopes.’ At the time of this accident, no equivalent self-briefing tool existed for owners preparing for their first flight on type. Testing pilots are not necessarily affiliated with the LAA, nor are there specific qualifications required. Flight test schedule (FTS) TL 1.19 also describes the LAA FTS, stating: ‘The test form… looks for much more detailed evidence of satisfactory engine cooling and mixture settings than previously, calling for a five minute climb with readings taken every minute, and a more thorough investigation of the stall characteristics and speeds in each configuration.’ The FTS form provides fields for testing pilots to record their observed values from a flight but, for a number of test items, there are no fields to record the expected values. These are further discussed in subsequent sections of this report. The LAA’s Technical Leaflet TL3.22 ‘Flight Test Reports’, dated January 2014, asks testing pilots to supply the completed FTS to the aircraft owner, who should then send a copy to LAA Engineering together with any other requested information. Due to the informal nature of their role, testing pilots are not expected to brief owners on their aircraft’s FTS. However, the LAA subsequently commented that because a testing pilot is normally an Footnote 24 http://www.lightaircraftassociation.co.uk/engineering/flight%20test%20self-brief.pdf [accessed 20 August 2018].

50 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 experienced enthusiast, nominated by an owner, then the two would normally take a keen interest in discussing the FTS, albeit informally. Flying guidance for aircraft owners There is no published LAA guidance for owners regarding the content or duration of their first flight on type, or on choosing an accompanying pilot. While the LAA is not responsible for pilot licensing or training, it does offer an optional Pilot Coaching Scheme which is designed to train LAA members in their aircraft and promote good standards of flying and airmanship. Following completion of an aircraft’s test flying, TL 1.19 advises: ‘…before flying the aircraft yourself, please remember that the LAA Pilot Coaching Scheme is there to get you up to speed with flying the aircraft and get the most out of it.’ Furthermore, the LAA leaflet ‘Ready to fly? - Pilot Coaching Scheme’ which was available at the time of the accident stated25: ‘Statistics show that 20% of all homebuilt accidents happen during the first two flights and are usually caused by pilot error. The same is true of the first flight of any unfamiliar aircraft, whether it is homebuilt, vintage or microlight. The Pilot Coaching Scheme is here to provide tuition in the skills of learning to fly a new type of aircraft… Do not under-estimate the challenge which some of the types on the LAA register may represent… Look closely in the mirror, and ask yourself if you have sufficient experience to ensure that you can safely operate your new aircraft without any coaching… All coaches are current CAA and JAR-FCL certified Class Rating Instructors or Flight Instructors. They’re also your trainer, confidante and mentor throughout the process of you learning to fly your aircraft. There is no reason to go through the process of learning to fly a new type alone or with a bunch of friends helping you guess how to do it.’ It was not determined if G-BXON’s pilot was aware of the LAA’s Pilot Coaching Scheme. However, the LAA subsequently reported that the pilot had been sent a copy of TL 1.19. The LAA also commented that a survey in 2016 indicated that 95.8% of its members were aware of the pilot coaching scheme. Footnote 25 The LAA subsequently updated this leaflet and removed reference to the accident statistics, having advised that these were based on data from the USA rather than the UK.

51 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 G-BXON rebuild and restoration Background information G-BXON was constructed in 1955 by Auster Aircraft Ltd and was operated by the Army Air Corps until 1965, after which it fell into disuse. In 1997, the aircraft was purchased and placed on the UK civil register, with the intention of rebuilding it. However, before completion, one of the owners and a previous LAA inspector overseeing the rebuild, passed away and the aircraft was sold. The accident pilot purchased G-BXON in March 2016 as a part-complete restoration project. The work already undertaken by the previous owners included structural work and complete fabric recovering and painting of the airframe and wings, and overhaul of the propeller. The engine was installed but had been inhibited. No worksheets were provided with the aircraft, so there was no record of the maintenance tasks which had been completed by the previous owners, and only limited historic technical records were provided. Rebuild and Permit to Fly application process The pilot decided to base G-BXON at Spanhoe Airfield, where he engaged an LAA inspector to assist with and oversee the completion of the rebuild. In May 2016 he notified LAA Engineering of his restoration project and the LAA confirmed that G-BXON was eligible to be restored and flown on an LAA Permit to Fly. The accompanying documentation indicated that the aircraft had last flown in August 1965, had accumulated 2,524 flight hours and its engine had accrued 252 operating hours since last overhaul.26 The LAA requested that, upon completion of the rebuild, the pilot submit, among other items, worksheets detailing each stage of the strip down, inspection and rebuild, as well as final inspection checks, range of movements, duplicate inspections, engine ground runs etc. Also requested were details of any modifications, substitute materials and replacement parts, and copies of logbook certificates relating to engine rebuild, propeller overhaul, instrument calibration etc. Over the following months the pilot undertook maintenance restoration tasks on the aircraft with the assistance of the LAA inspector, friends, and other aircraft owners based at Spanhoe. This included fitting the wings, conducting a ‘top-end’ overhaul of the engine and replacement of various engine and fuel system components. In September 2016, the LAA inspector submitted, on behalf of the pilot, an application to the LAA for a Permit to Fly. It was accompanied by supporting worksheets listing 45 separate maintenance tasks, a list of modifications embodied on G-BXON and a ‘Rebuild Final Inspection & Declaration of Design’. All these documents were signed by the LAA inspector and dated 16 September 2016. Between October 2016 and March 2017, in a series of email exchanges, the LAA requested the LAA inspector to clarify which of the maintenance tasks had been undertaken by the Footnote 26 No historic airframe or engine logbooks were found for G-BXON and therefore the original source for this information was not established.

52 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 previous owners/inspector and to state clearly that he had re-inspected and certified those tasks. It also requested that he provide the results of fuel flow tests and engine ground runs, and properly documented duplicate inspections, which had not been noted on the original worksheets. On 10 April 2017, the LAA inspector submitted a single supplementary worksheet to the LAA to address this request. This worksheet identified which of the tasks on the initial worksheets had been undertaken by the previous owners/inspector and were subsequently re-certified by him. It also included a statement that all remaining tasks had been carried out under his supervision. Flight testing and permit issue On 26 April 2017, following receipt of this information, the LAA issued a ‘Certificate of clearance’ for flight testing to the pilot and LAA inspector/testing pilot. The accompanying correspondence stated: ‘No particular number of hours or landings is required, just as long as it takes to re-establish reliable use, fix any defects, trim to fly in balance and wings level, and then complete the flight test schedule.’ Between 28 April 2017 and 10 May 2017, the testing pilot undertook three flights in G-BXON totalling 1 hour 10 minutes flight time. He reported that the aircraft had performed well on the first flight and required no defect rectification, so he flew again the next day. On 11 May 2017, he conducted a 40-minute formal flight test (the section ‘G-BXON flight test’ later in this report covers this aspect in more detail), after which the completed FTS was sent to the LAA along with a copy of G-BXON’s logbook page showing a total of 1 hour 50 minutes flight time. The testing pilot conducted a further flight lasting 20 minutes on 14 May 2017 with the accident pilot as a passenger. G-BXON’s Permit to Fly was issued by the CAA on 2 June 2017 and this was sent to the pilot by the LAA, together with the Certificate of Validity and Operating Limitations on 6 June 2017. Engine maintenance Some of the other Spanhoe-based aircraft owners who had assisted the pilot in restoring G-BXON reported that it had been a challenging and lengthy process to return the engine to proper working order. A friend with automotive engine experience had assisted the pilot in stripping the engine and cleaning engine inhibiting oil from ‘top-end’ components, which included honing the cylinders and cleaning and lapping the valves. Separately, it was reported that the magneto was also replaced. It was reported that by August 2016 the engine was running but misfiring, did not operate consistently across the full rpm range and the oil pressure readings were fluctuating. Between August 2016 and January 2017, a number of problems were experienced with the fuel injection pump. The quill drive within the pump snapped a number of times, necessitating

53 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 replacement of the quill drive and, on at least one occasion, the fuel injection pump itself. The oil hoses to the fuel injection pump and the fuel injection nozzles were also replaced. The problem was subsequently determined to be related to a high oil pressure feed to the injection pump, caused by a seized OPRV. This was subsequently adjusted. Further engine issues experienced were reported to have included ignition problems and a persistent misfire on the No.4 cylinder. Work to address these included replacement of the right ignition lead in March 2017 and cleaning/replacement of the spark plugs. By the end of March 2017, the engine was reported to have been running well and the aircraft was successfully taxied for the first time on 9 April 2017. Anecdotal information from witnesses suggested that G-BXON’s engine had been developing approximately 2,200 to 2,300 rpm at takeoff setting. The pilot was reportedly not satisfied with this and had discussed the engine performance with another AOP.9 owner, by way of comparison. It was reported that the pilot had fitted new longer ignition leads on the day before the accident, in preparation for installing automotive spark plugs27. In a text message exchange following the pilot’s first flight on the day preceding the accident, the other AOP.9 owner asked if the loom [ignition lead] had worked. The pilot’s response indicated that the engine had operated much better with more power, that there had been no misfiring in flight and that the magneto drop check after landing was okay. Documentation Maintenance tasks undertaken during G-BXON’s restoration were documented on a standard LAA worksheet template, which contained fields for recording up to seven maintenance tasks. Against each task there were columns for the engineer/pilot and LAA inspector signatures. The worksheet template also contained a Permit Maintenance Release to be signed by the inspector which stated: ‘The work recorded above has been completed to my satisfaction and in that respect the aircraft is considered fit for flight.’ The worksheets submitted to the LAA in support of G-BXON’s Permit to Fly application contained a brief outline of the maintenance tasks performed during rebuild. The tasks were not individually dated but had been collectively grouped together and retrospectively documented and dated 16 September 2016. The original worksheets submitted in September 2016 described a number of engine-related maintenance tasks including overhaul and reinstallation of the mechanical and fuel injection pumps, engine top overhaul and reassembly, check of fuel flow to the injector pump and Footnote 27 The pilot had contacted the LAA to enquire about the possibility of applying for a modification to convert to automotive spark plugs, due to the difficulty in obtaining the correct aerospace spark plugs for G-BXON’s engine. However, he had not made the application before the accident occurred.

54 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 engine ground runs. The results of the fuel flow checks28 and engine ground runs29 were not originally recorded but were subsequently included on the single supplementary worksheet dated 10 April 2017. Other tasks documented on the original worksheets included connection and testing of the pitot/static system, calibration and fitment of the altimeter and ASI, and propeller overhaul by a specialist overhaul company. The results of the ASI and altimeter calibration were not recorded. All of the worksheets had been completed by the LAA inspector. He signed his initials against each task in the ‘Inspector’ column and signed the Permit Maintenance Release statement at the bottom of each worksheet. The pilot’s signature only appeared in the ‘Engineer’ column against one task on the 10 April 2017 worksheet; this related to the duplicate inspection of the flight and engine controls, which required two signatures. The ‘Rebuild final Inspection and declaration of design’ form submitted with the worksheets described the extent of the work performed on the engine as ‘Top overhaul. Fuel pumps overhauled. Injectors tested. Injector pump overhauled.’ The LAA inspector had signed both the fields for the ‘builder’ and the ‘inspector’. The engine-related work undertaken between September 2016 and April 2017 did not appear to have been recorded on worksheets. The LAA inspector was vague in his recollections of exactly what work had been undertaken on G-BXON and when. He commented that he looked after many aircraft and could not recall the details of work done on each of them and that he did not keep copies of worksheets or separate records. He also advised that, while he might inspect individual maintenance tasks on different days, his preferred approach was to sign them off all together. Furthermore, he stated that he is only able to verify the condition of an aircraft at the time of his inspection, and that owners may change something subsequently. Other than the worksheets submitted to the LAA in support of the Permit to Fly application, no other technical records were found which related to G-BXON’s rebuild. No receipts were found among the pilot’s documentation, so it was not possible to determine the provenance of replacement parts used during the rebuild. An invoice from the maintenance organisation dated 22 February 2017 referenced installation of a new radio and wiring, investigating an engine problem, timing and installing a new fuel pump. Footnote 28 Noted on the worksheet as 32 gallons per hour under gravity and 58 gallons per hour with both mechanical fuel pumps operating, but it was not determined how these flow rates were measured. The AOP.9 maintenance manual calls for minimum flow rates to the mechanical fuel pumps under gravity, with the booster pump off and on, of 23 and 50 gallons per hour respectively. It also specifies a minimum flow rate between the mechanical fuel pumps and the fuel injector pump of 2.5 pints per minute (18.75 gallons per hour), This corresponds to the maximum expected fuel delivery rate described in the ‘Amal Operation, maintenance and overhaul instructions for Fuel Pump type 240/8’. 29 The [maximum] static rpm was noted as 2,200 rpm.

55 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 G-BXON’s logbook30 did not contain any summary of the maintenance work carried out during the rebuild or cross-reference to the worksheets. The flights conducted between 28 April and 11 May 2017 were recorded, together with the flight conducted by the pilot on the day prior to the accident. The flight on 14 May 2017 was not recorded in the logbook. Weight and balance The AOP.9 Pilot’s Notes31 specifies two maximum weights. The normal maximum weight of 2,350 lb applies to all forms of flying. The overload maximum weight of 2,550 lb limits the aircraft to gentle manoeuvres only. From information provided by witnesses, G-BXON’s weight for the accident flight was calculated to be around 2,258 lbs and the CG was within specified limits. Aircraft operating information Pilot’s Notes guidance The Auster AOP.9 Pilot’s Notes explains how to depart using takeoff flap as follows: ‘…lower the flaps to take-off and open up to full throttle against the brakes… At full load the aircraft can be pulled off at approximately 45 knots. To clear obstacles climb at 50 knots, which will give the steepest angle of climb though not necessarily the greatest rate of climb. When clear of obstacles increase speed to 55 knots and raise the flap in stages by manipulating the selector lever… The speed should be allowed to increase slowly to 65 knots (normal climbing speed) and the last few degrees of flap pumped up with the hand pump.’ It details the AOP.9’s zero flap climb performance as follows: ‘Climb at full throttle and 65 knots… The initial rate of climb is about 800 feet per minute… The ‘Stalling’ section states: ‘There is no warning of the stall in any configuration. Pilots should bear this in mind when manoeuvring near the ground at low airspeed… Shortly before the stall is reached the aircraft wallows slightly and then, at the stall, the nose will drop probably accompanied by either wing… Recovery is immediate on releasing the backward pressure on the control column, the height loss being about 200 feet. If the control column is held back after the aircraft has stalled, a spiral or spin may develop.’ Footnote 30 The initial entry in G-BXON’s logbook of total flight time carried forward had been mistakenly entered as 252 hours. This figure was in fact the operating hours of the engine since overhaul. The total flight time carried forward was 2,524 hours. 31 The Pilot’s Notes document was produced under direction of the Air Ministry as the operating manual for the AOP.9.

56 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Pilot interviews – AOP.9 handling characteristics The AAIB interviewed a number of AOP.9 instructors and display pilots (military and non‑military), and civilian AOP.9 owners. The AOP.9 was widely described as an operationally challenging aircraft which should especially be flown by ‘feel’. One pilot commented that many of its handling peculiarities are not included in the original Pilot’s Notes, and that there had been no formal mechanism in the military for subsequently documenting them. Consequently, pilots have tended to share them anecdotally. It was also mentioned that achieving the correct angle of attack32 (AOA) during takeoff is important in the AOP.9. If a pilot under-rotates33 the aircraft, its mainwheels might dig in to soft ground, thus inhibiting acceleration. Conversely, with over-rotation34, the aircraft can ‘stagnate’, and the airspeed may not increase until the AOA is reduced. The AOP.9 was viewed in general as a low-performing aircraft type. Some pilots explained that, if the aircraft does not initially climb well during takeoff on a hot day, they might choose to lower the nose so that the airspeed can increase whilst still in ground effect35. Most pilots expressed a preference for flying faster than the published speeds and one highlighted the potential for stalling the AOP.9 during takeoff, particularly due to the absence of any stall warning. One pilot stated that he would climb at an airspeed well above 60 KIAS when departing using takeoff flaps on a hot day. The AOP.9’s stalling characteristics were widely discussed. One pilot stated that, when flight testing an AOP.9, he accepts a maximum deviation of 3 or 4 KIAS from the published stall speeds. A main concern was the aircraft’s tendency to drop a wing during the stall. If a pilot reacts to this using opposite aileron, a spin may develop. Aileron droop and high engine power settings exacerbate the wing drop. CAA advice on stall and spin awareness The CAA’s ‘Handling Sense Leaflet 2: Stall/Spin Awareness’ states: ‘At least one of the symptoms of the fully developed stall MUST happen before the aeroplane can spin… these are: wing drop (undemanded roll), nose drop, inability to maintain level flight, and buffet. It is clearly inappropriate to wait for this confirmation before recovery. What signs will be evident to help us avoid a full stall and possible spin? …We can draw on the classic list of signs of the approaching stall: increasingly high Footnote 32 AOA is the angle between the oncoming air and a reference line on the aeroplane or wing. 33 Under-rotate: Too little back pressure applied to the control column during lift off. 34 Over-rotate: Too much back pressure applied to the control column during lift off. 35 Ground effect: the increased lift and decreased drag generated by an aeroplane’s wings when it is close to the ground.

57 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 nose attitude (in level flight), reducing control effectiveness, low and decreasing airspeed, and the onset of buffet. These may be augmented by a mechanical stall warning device… One of the most critical phases of flight is just after take-off or when going around from an approach to land. At low level, at relatively low speed and with a high nose attitude, an engine failure will lead to a rapid deceleration and increasing angle of attack… To safely avoid the stall and spin: be alert and be prepared; practice regularly at safe altitude and keep your handling skills current; read and understand the contents of the Flight Manual/POH for your aeroplane; seek advice from a Flight Instructor if you are unsure of any techniques; be ready to apply immediate recovery action whenever you feel the aeroplane is not responding correctly. Now you have time to regain a safe flight path and analyse what happened. If prompt action is taken during the approaching stall, the attitude change required is small and height loss (if any) should be minimal.’ G-BXON flight test Performance results and comparison Table 1 details some of the results from G-BXON’s formal flight test on 11 May 2017. Also presented are the published performance figures from the Pilot’s Notes and the AOP.9 Flight Reference Cards36 together with seven flight test results from other AOP.9s, all of which had the same engine/propeller combination as G-BXON. One aircraft was included twice because it was tested at different times under both the LAA and CAA regimes. The other AOP.9s mainly involved aircraft tested by testing pilots for an initial LAA Permit to Fly. This flight test information was collated by the LAA after the accident in order for them to compare G-BXON with other examples of the type. Loading The LAA FTS requires an aircraft to depart at its maximum takeoff weight or maximum landing weight if it is lower. The testing pilot loaded G-BXON to 2,500 lb, which was 150 lb higher than its normal maximum weight and 50 lb less than the overload maximum weight. He stated that using the higher weight was a good practice he had learned during previous CofA aircraft testing. Most of the other AOP.9s which were analysed had takeoff weights which were within 100 lb of the normal maximum weight. Two of the other AOP.9s had takeoff weights above the normal maximum weight. The highest of these was 2,507 lb, and that aircraft achieved a test ROC of 710 fpm. Footnote 36 The AOP.9 Flight Reference Cards are a set of procedures prepared by the MOD Handling Squadron.

58 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Published figures* Other AOP.9 flight tests - Average (Range) G-BXON flight test Climb performance – ROC at 65 KIAS 800 fpm** 667 (633-720) fpm 450 fpm Climb performance – rpm at 65 KIAS Not specified 2,320 (2,240-2,350) rpm 2,350 rpm Stall speed, zero flap (VS1(f0)) 48 KIAS*** 48 (46-48) KIAS 54 KIAS Stall speed, takeoff flap (Vs1(t/o)) 42 KIAS*** 42 (42-45) KIAS 50 KIAS Stall speed, landing flap (VS0) 40 KIAS*** 42 (40-42) KIAS 46 KIAS Max static rpm 2,200-2,270 rpm 2,260 (2,200-2,350) rpm 2,200 rpm

• Figures from the AOP.9 Pilot’s Notes, except max static rpm, which is quoted from the AOP.9 Flight Reference

Cards. ** The Pilot’s Notes state that the initial rate of climb is ‘about 800 fpm’. *** The Pilot’s Notes state that these are ‘approximate stalling speeds in knots, engine off’. Table 1 G-BXON’s flight test performance results compared with other AOP.9s and the Pilot’s Notes values Climb performance The climb performance test assesses the relationship between achieved ROC and engine rpm. There are fields on the FTS for the testing pilot to record the observed ROC, but not the expected value. The guidance in the ‘Climb’ section of the FTS states: ‘Important notes: Sustained 5 minute climb is normally required to be carried out to establish adequacy of cooling, proper functioning at altitude and to provide sufficient data points to calculate a reliable rate of climb figure. However, where the rate of climb exceeds 1500 ft/min, or an aircraft with a Cirrus Minor or a Gipsy Major engine37 is fitted, then a 3 minute climb will be accepted. Incomplete climbs due to airspace cloud or other similar reasons will not be accepted.’ G-BXON underwent a three-minute climb. The LAA stated that had it been unhappy with the shorter duration of climb on G-BXON’s FTS, it would have requested a retest. Table 1 shows that G-BXON’s achieved climb rpm was similar to the other AOP.9s, but its average ROC (450 fpm) was substantially lower. Footnote 37 While G-BXON’s Cirrus Bombardier engine was not listed on the FTS as an engine to which this alleviation applies, the LAA subsequently stated that it would have granted the alleviation if the applicant had requested it.

59 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 The DA at aerodrome level for G-BXON’s flight test was approximately 1,240 ft. The corresponding DAs for the other AOP.9s38 ranged from around 170 to 1,000 ft. The aircraft which was tested with an aerodrome DA of 880 ft produced a test ROC of 720 fpm. After the accident, the testing pilot commented that, based on his experience at the time of the flight test, G-BXON’s ROC had seemed acceptable to him. The LAA stated that its post-accident comparison of AOP.9 performance highlighted G-BXON’s ROC as being ‘somewhat down’ even considering the higher maximum weight that was used. Stalling The LAA stated that the stall speeds recorded on an aircraft’s FTS are obtained with the engine power at idle. This test is normally performed in level flight. The Pilot’s Notes provides an example of the effect of engine power on the stall speed, as related to typical approach conditions. The example indicates that, with full flap and 1,700 rpm, the stall speed is approximately 38 KIAS; 2 KIAS lower than the power off stall speed. FTS guidance for stalling states: ‘Required limits: Stall warning 4 KIAS to 12 KIAS… above measured stall speed.’ On the FTS form against ‘Stall warning (knots/mph IAS)’, the testing pilot entered ‘N/A’ [not applicable] and, against ‘Type of stall warning (e.g. horn, lamp, natural buffet etc.)’ he noted ‘NONE’. Against ‘Other characteristics (e.g. buffet prior to stall)’, the testing pilot noted ‘NONE’. Against ‘sequence of nose and wing drop (if any) [at the stall]’ the testing pilot entered ‘NOSE ONLY’ for all three configurations. There is no place on the FTS form to record the expected stall speeds and the testing pilot stated that he did not study them as part of the flight testing process. Furthermore, as apparent from a photo taken during restoration, G-BXON’s ASI was of a type that did not have extra markings depicting airspeed limitations, for example, stall speeds. From the LAA’s post-accident comparison of AOP.9 performance, both the LAA and testing pilot separately commented that, notwithstanding the higher weight, the stall speeds recorded during G-BXON’s flight test (Table 1) were relatively high. The LAA questioned whether an improperly calibrated ASI could have contributed to this. The testing pilot suggested that there could have been a blockage in the static system. These items could not be tested after the accident due to the extensive damage. Maximum static rpm The FTS requires that, with a wide-open throttle, the engine must not overspeed when the aircraft is static on the ground. The FTS form provides fields to copy the maximum allowable rpm limitation from an aircraft’s flight manual, and the maximum achieved static rpm as measured during the flight test. Footnote 38 DA information was available for all but two of the other FTSs.

60 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 In the maximum allowable rpm field, the testing pilot noted ‘2,600 / 2,400’. In the Pilot’s Notes, 2,600 rpm corresponds with the ‘takeoff and operational necessity’ figure, 2,400 rpm corresponds with the ‘intermediate (1 hour limit)’ value and ‘maximum continuous’ is stated as 2,300 rpm. As can be seen from Table 1, G-BXON’s achieved maximum static rpm of 2,200 rpm was within the range specified by the AOP.9 Flight Reference Cards. G-BXON’s was the joint lowest maximum static rpm value achieved by those aircraft analysed. One other aircraft achieved the same value but, unlike G-BXON, that specific aircraft had flight test performance figures (Table 1) which were otherwise closely aligned with the Pilot’s Notes figures. The testing pilot explained that he normally used 2,000 rpm as the lowest acceptable limit for an AOP.9 in this test. The LAA stated that it would have queried a value of below 2,150 rpm. Fast cruise condition in level flight The fast cruise condition test determines the maximum achieved engine rpm39 in level flight and the corresponding airspeed (Vh). The Pilot’s Notes states values of 2,300 rpm and 90 KIAS, and G-BXON demonstrated values of 2,500 rpm and 89 KIAS. Performance - general discussion When advised of G-BXON’s relative performance after the accident, the testing pilot suggested that its reasonable fast cruise performance and low climb performance with what he described as being reasonable engine rpm values, may indicate that its propeller was coarse pitched40,41. It is not known if the accident pilot had looked in detail at G-BXON’s FTS or was aware of the aircraft’s deviations from the published performance figures. Comparison with a CAA flight test report Although most of the AOP.9s in Table 1 had been test-flown under the LAA regime, one of those aircraft had also been previously subject to CAA flight testing for the purposes of granting a CAA Permit to Fly. The CAA’s flight test department has since been dissolved and flight testing has been delegated to suitably approved organisations including the LAA. Nevertheless, the CAA test process for that other AOP.9 served as a comparison to that undergone by G-BXON. Footnote 39 With the power lever fully forward in level flight, at an altitude below 2,000 ft. 40 Coarse pitch: Large angle between the propeller blade chord and the plane of the propeller disc, producing high forward speed for a given rotational speed. 41 In common with most other AOP.9s on the UK civil register, G-BXON was equipped with a Bombardier Cirrus 20801 engine and a Fairey Reed A66960/X8 fixed-pitch propeller. Two UK AOP.9s are fitted with a similar Fairey Reed A66960/X1 fixed-pitch propeller. On Fairey Reed propellers a different ‘X’ number on the model number generally denotes a change in pitch, but a higher ‘X’ number may refer to a higher (coarser) or a lower (finer) pitch value. The pitch of the X1 variant is 4.43 ft but the pitch for the X8 variant was not determined and could not be measured on G-BXON’s propeller due to accident damage.

61 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 The CAA flight test was carried out by a qualified Test Pilot42 who used the same check flight schedule (CFS43) as was used for flight testing prior to the issue of a CofA. The Test Pilot compared the aircraft’s measured results with expected values from the Pilot’s Notes in order to be able to recommend to the CAA that the aircraft be granted a Permit to Fly. The aircraft in that case was loaded to its normal maximum weight. Its climb performance was tested over a 5-minute duration. This CFS included space for the Test Pilot to record an aircraft’s expected ROC and stall speed values from the relevant operating manual. The CFS also specified permitted deviations from these, stating that: ‘aircraft with climb shortfalls of more than 70 fpm should not be accepted.’ And: ‘Required limits: …Stall speed +3 to -5 kts/mph relative to scheduled stall speed…’ The Test Pilot recorded that that aircraft demonstrated a noticeable wing drop in all three configurations and noted: ‘The wing drop would not allow the aircraft to be certified44 and is a known potential deficiency of this type… The characteristic was repeatedly demonstrated to one of the owners and the other owner was fully briefed on completion of the flight test.’ Information provided by the LAA G-BXON worksheets With respect to worksheets submitted in support of Permit to Fly applications, LAA Engineering commented that worksheets can differ significantly between applicants in terms of content, style and detail. Of the range it receives, it considered that the worksheets for G-BXON contained less than the average level of detail and further worksheets had to be requested before they were accepted. The LAA considered that the brevity of the worksheets may have been due in part to the fact that G-BXON had changed hands part way through the rebuild project, and the absence of worksheets from the previous owners/inspector. G-BXON test flying When asked why it did not stipulate a minimum amount of test flying for G-BXON, LAA Engineering commented that homebuilt aircraft normally require a minimum of five hours Footnote 42 CAA Check (Test) Flights were conducted either by the CAA’s own experimental test pilots or by pilots specifically briefed and approved by the department following a check flight. 43 The LAA reported that it developed its FTS from the CAA’s CFS, by adapting it to the LAA environment. 44 The certification referred to is the granting of a CofA.

62 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 test flying because they have not flown before, and because there is more variability between examples. However, for factory-built aircraft with published technical documentation, like the AOP.9, a reduced number of hours test flying is often deemed acceptable. The LAA stated that, because G-BXON was unmodified from its original design and the testing pilot was experienced on type, no minimum testing time was stipulated in this case. LAA Engineering indicated that, if it had been aware that defects requiring ongoing rectification and component replacement had been experienced on G-BXON’s engine until shortly before the test flying commenced, it would have specified a minimum number of hours to be flown. LAA test flying – performance The LAA advised that there is an absence of performance data for some aircraft types and that there can be variation in modification state between individual aircraft of the same type in their fleet (eg different propeller types). As a consequence, assessment of an aircraft’s performance at initial Permit to Fly application tends to be based on experience with similar examples and adequacy for the intended role, rather than on closely matching available data for the type. For each subsequent flight test for a Permit to Fly renewal, the aircraft’s climb performance is compared against its values from previous years to identify any trends or anomalies. Analysis Introduction G-BXON departed controlled flight during its takeoff climb from Spanhoe. The investigation has considered factors which may have contributed to this including aircraft and engine performance, pilot handling, and the possibility of a technical failure. Engine performance Examination of the engine, propeller and ground marks indicated that the engine was operating with some power at the point of impact. It was not possible to ascertain the position of the throttle or throttle control due to the damage caused by the impact and post-impact fire. While there were a number of distinct propeller strikes on the ground and in the surrounding crop, the dynamic nature of the impact sequence, the orientation of the aircraft at impact and the absence of ground speed information for the accident flight, meant that it was not possible to calculate a meaningful range of engine rpm. Anecdotal information from witnesses suggested that G-BXON’s engine had been developing approximately 2,200 – 2,300 rpm at takeoff setting and the pilot had discussed this with another AOP.9 owner as he was reportedly not satisfied with the engine performance. Pilot B commented that the pilot had specifically asked him to monitor the takeoff rpm on the previous day’s flight. He recalled that it was approximately 2,300 rpm, and this was supported by audio analysis of the video recording of that takeoff. The pilot indicated in a text message that the engine performance during the previous day’s flight, had been much better than before. Engine speeds recorded during the flight test for the

63 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Permit to Fly indicated that the maximum static engine rpm was 2,200 rpm. The engine performance during climb (2,350 rpm) was average, but the associated ROC (450 fpm) was substantially lower (Table 1). A detailed engine strip examination identified a number of anomalies. These included poor compression on three out of the four cylinders, which would have limited the engine’s ability to develop full power. This was predominantly due to leakage at the exhaust valves, however the presence of oil in some of the cylinders indicates that the piston rings and/or piston may not have been providing adequate sealing. It was possible that the new piston rings had not fully run in to achieve a good gas seal. Additionally, five out of the eight spark plugs exhibited weak and/or intermittent sparks when tested and the magneto timing was not set correctly. When tested after the accident, the mechanical fuel pumps did not deliver fuel at the required fuel flow rate and examination revealed anomalies with the internal diaphragm, which would have prevented the pumps from functioning correctly. However, it is likely that in the installed condition, gravity-fed fuel from the high wings tanks and the presence of the electrically-driven booster pump in the fuel collector cell, may have, at least partially, compensated for the poor performance of the mechanical fuel pumps. The timing of the fuel injection pump, which had been replaced a number of times, was found to be incorrectly set and did not coincide with the induction period of the engine. Although fuel would have been delivered to the cylinders it would not have been delivered at the point in the engine cycle to produce optimum engine performance. The fuel injection pump did not display any obvious impact damage and it was considered likely that the incorrect timing could have occurred during installation. The fuel injection pump operated normally when tested but was out of calibration in that it was running lean. Additionally, during testing, leaks were observed from two of the fuel injection nozzles which may also have been present prior to the accident. Due to the extent of accident damage, it was only possible to examine and test individual components from the aircraft’s fuel system; it was not possible to assess whether collectively, the fuel system with its various fuel pumps, could adequately meet the fuel demands of the aircraft’s engine. Nor was it possible to make a comparison with the results of the fuel flow checks previously recorded on the supplementary worksheet. The anomalies identified during the engine examination could account for less-than-ideal engine performance during the accident flight. In contrast, the testing pilot, who was very familiar with the aircraft and its engine in his capacity as its LAA inspector, reported being satisfied with the aircraft and engine performance during the initial test flying and formal flight test. This indicates that either engine performance issues were not present, or not identified, during the test flying. Furthermore, it was reported that additional work was undertaken on the engine between the test flight and the accident flight, which may have had an effect on engine performance. Notwithstanding these observations, reduced engine performance in isolation would not have accounted for the departure from controlled flight during the accident flight. But its

64 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 effects, which may have been insidious, could have contributed to the less-than-ideal aircraft performance or served as a distraction to the pilot. Fuel Analysis of the fuel used to refuel G-BXON indicated low levels of contamination by a substance consistent with automotive gasoline. It was considered that the jerry cans in which the fuel was stored, may previously have been used to store automotive gasoline. The sample from the fuel injection line was broadly similar to the jerry can sample. It also exhibited particulate contamination and trace contamination including plasticisers. This may have been as a result of the fuel coming into contact with rubber fuel hoses, or plastic storage containers. An aircraft engine is designed to operate most efficiently on a specific type of fuel conforming to pre-determined specifications. The use of fuel that deviates from these specifications can reduce operating efficiency and, under some conditions, lead to engine failure. It was not possible to determine whether the presence of low levels of contamination in the fuel would have adversely affected engine performance in this case. Technical failure The left aileron control rod was found to have separated at the forward end-fitting. Metallurgical analysis determined that all four of the failed attachment rivets had been carrying load at the time of failure, although two also exhibited evidence of pre-existing intergranular corrosion and stress corrosion cracking. At least one third of the fracture surface on the outboard rivet was attributed to a pre-existing intergranular crack, which would have reduced its load‑carrying capability. The inboard rivet may also have been subject to intergranular cracking, but mechanical damage on the fracture surface prevented a definitive assessment. The investigation considered whether the left aileron control rod could have detached in flight and contributed to the departure from controlled flight. The strength of the aileron control rod riveted joint was calculated to be sufficiently strong to carry the maximum expected normal flight loads, even if pre-existing cracking had led to complete failure of two out of the four rivets. However, the critical load case for the rivets was the maximum pilot effort case and, given the potential for reduced load-carrying capability in two of the rivets, if large forces had been applied to the control stick, the aileron control rod riveted joint may not have been sufficiently strong to withstand such loads. While there was no evidence of a control restriction which might have necessitated application of such loads, it was not possible to definitively rule out the presence of a restriction as any evidence may have been destroyed in the post-impact fire. This scenario was not consistent with the eye-witness description of the takeoff and subsequent departure from controlled flight and is therefore considered unlikely. However, the possibility that the control rod failed due to the pilot applying large forces to the control stick during attempts to recover to controlled flight could not be ruled out.

65 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Examination of the wreckage indicated that the aileron control rod had most likely detached due to impact loads being transmitted, via the aileron mounting structure, to the aileron hinge and control rod when the left wingtip struck the ground. In addition, examination of the wreckage, although limited due to the extent of fire damage, did not identify any other technical issues which may have contributed to the accident, but there were parts of the primary flight controls, some systems and flight instruments which could not be examined. LAA flight testing process Notwithstanding some variation in DA and aircraft weight, G-BXON’s FTS showed that its stall speed values were substantially higher, and its ROC substantially lower, than other AOP.9s45 and the Pilot’s Notes figures. Its climb performance was tested over three minutes instead of five minutes, despite it not automatically qualifying for that alleviation. Nevertheless, G-BXON’s FTS was reviewed and accepted by the LAA on the basis that it considered that the results did not indicate that the aircraft was unairworthy. The CAA no longer performs flight testing. However a CAA Permit to Fly flight test for one of the other AOP.9s provided a comparison to the process used for G-BXON. In that example, the CAA testing was carried out by a qualified Test Pilot using a CFS form which had been designed for CofA flight testing. The form allowed the Test Pilot to record expected values, and it also specified permitted deviations from those. The Test Pilot analysed the aircraft’s results and made a recommendation for its permit to be issued. In that case, the Test Pilot demonstrated and briefed the owners on their aircraft’s wing drop tendency in the stall. Given the less formal nature of the LAA testing process, the LAA stated that whilst an owner and testing pilot would normally discuss a flight test informally, there was no formal mechanism for testing pilots to research expected performance results and compare those with achieved values, nor to brief owners on their aircraft’s FTS results. Testing pilots are expected to supply the aircraft’s FTS to its owner, who would then be responsible for sending a copy (along with any other requested information) to LAA engineering for review. Whilst the LAA had a process for continued monitoring an aircraft’s climb performance at each permit renewal, there was no formal process, during the initial permit application, to compare achieved performance results with expected values. Instead, it relied on its knowledge of the aircraft type. Since this accident, the LAA has created a database of flight test performance results for all types and introduced an additional process to compare an aircraft’s performance results at initial permit application with others of the same type. In the case of factory-built aircraft, the scheduled performance figures, when available, will also form part of this consideration. G-BXON’s testing pilot recorded on the FTS that no stall warning had been demonstrated and thus he noted ‘N/A’ for the stall warning speed. The stall test in the FTS requires that stall warning occurs between 4 KIAS to 12 KIAS above the measured stall speed. However, Footnote 45 All of which had the same engine/propeller combination.

66 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 the FTS does not make it clear what stall warning, if any, a subject aircraft is required to have, and so the form could be misleading in this respect. The LAA has stated that this requirement refers specifically to artificial stall warning devices. It has clarified the wording on the FTS to emphasise that it relates only to aircraft with such devices, and to reflect that some LAA aircraft may not be so equipped. Furthermore, the LAA has undertaken to write to owners with any safety related observations on an aircraft’s submitted flight test results. This will include highlighting the absence of any stall warning, particularly when the reported characteristics deviate markedly from those normally expected, but which have nevertheless been deemed acceptable by the LAA for permit issue. G-BXON performance It was not determined what caused the high stall speed values and low ROC demonstrated during G-BXON’s flight test. Due to the extent of the damage, it was not possible to test the ASI calibration, or determine if any aspects of G-BXON’s configuration could have contributed to these results. There was no recorded data for the accident flight. However, information was derived from the video of the pilot’s takeoff on the day before and, in the absence of evidence to the contrary, it is assumed that he flew G-BXON during the accident flight in a similar manner. The AOP.9 Pilot’s Notes indicate that, with takeoff flaps set, the power off stall speed is approximately 42 KIAS, and the aircraft can be ‘pulled off’ during departure at around 45 KIAS. However, G-BXON’s demonstrated VS1(t/o) of 50 KIAS was 8 KIAS higher than the Pilot’s Notes value and 5 KIAS higher than the speed at which the Pilot’s Notes state an AOP.9 can become airborne during departure. The application of engine power may lower an aircraft’s stall speed but the power off VS values provide a stall speed reference for pilots. Furthermore, the example provided in the Pilot’s Notes relating to the stall speed under typical approach conditions shows that a power setting of 1,700 rpm reduces VS0 by around only 2 KIAS. During the flight on the previous day, with takeoff flap set, the pilot elected to climb at 60 KIAS and video analysis showed that, for lift off and climb, G-BXON achieved a true airspeed of between 56 and 60 kt. Notwithstanding a slight difference46 between indicated and true airspeed, this would have provided a minimum margin of around 6 kt above G-BXON’s demonstrated power off stall speed in this configuration. The experienced AOP.9 pilots that were interviewed indicated that, particularly due to its lack of stall warning, they habitually fly the aircraft at higher speeds than those published. Some said they would climb at an airspeed of more than 60 KIAS when departing using takeoff flap on a hot day, and this would give a margin of more than 18 kt against the Pilot’s Notes expected VS1(t/o) of 42 KIAS. Footnote 46 Under normal circumstances, the difference would be insignificant at low altitudes.

67 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Those interviewed highlighted the AOP.9 as being generically low-performing. For G-BXON, this low performance may have been further exacerbated by an underperforming engine. A ROC of 450 fpm was recorded on the FTS and 500 fpm was achieved on the previous day’s flight, both figures being substantially less than the Pilot’s Notes value. High density altitude conditions present over the weekend of the accident would have affected the aircraft’s performance. As someone reported to ‘fly by the numbers’, and possibly less by ‘feel’, if the accident pilot had chosen a target climb airspeed using the Pilot’s Notes but was unaware of G-BXON’s higher indicated stall speeds, poor ROC, and the issues surrounding AOP.9 handling, then it is likely that he would have been flying closer to the stall regime than he realised. During the accident departure, if the pilot had over-rotated the aircraft without having built up sufficient airspeed, or if he had perceived the ROC to be low and then eased back on the control column to increase it, then the airspeed may have reduced enough for the aircraft to stall. During the takeoff on the previous day, the pilot asked Pilot B to monitor the engine rpm. On the accident flight, the pilot may have conducted the additional monitoring of the engine rpm himself and this could have provided a distraction to his monitoring of the airspeed. It is not known if the pilot was aware of the AOP.9’s stalling characteristics and the absence of stall warning features on G-BXON. The type is prone to dropping a wing during the stall and, if the back pressure on the control column is not promptly released, then a spin may develop. The presence of drooped ailerons and the high power setting used for takeoff further increase the likelihood of a wing drop in the stall. The Pilot’s Notes state that stall recovery will involve a height loss of around 200 ft, so particular care should be taken whenever near to the ground at low airspeeds. An instinctive, rather than deliberate, reaction to the associated wing drop and loss of height could involve aileron and nose-up elevator inputs. This would exacerbate any tendency to spin from which, in this instance, there was insufficient height to recover. The eyewitness description of G-BXON’s behaviour during the accident is consistent with the AOP.9 Pilot’s Notes description of a stall with an associated wing drop. Flight preparation At the time of the accident, the LAA noted on its website that, based on USA data, 20% of homebuilt aircraft accidents occur during the first two flights, and that the same is true of the first flight of any unfamiliar aircraft, whether it is a homebuilt, vintage, or microlight. The LAA’s Pilot Coaching Scheme assists owners in familiarisation with their aircraft but it is not known whether the accident pilot was aware of this. The related documentation reminds pilots not to underestimate the challenges posed by some aircraft types and to recognise that, even for experienced pilots, tuition may be appropriate when first flying a new type. The investigation did not determine how much preparation the pilot had done for flying the AOP.9. Prior to his first flight on this type, he had performed two flights, in the preceding

68 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 90 days on other types. He was reportedly eager to fly his newly-restored aircraft and the agreement to fly with Pilot B occurred a short time before they departed on their 10-minute flight together the day before the accident. Therefore, there would have been limited time for a briefing to take place. On the accident flight, he was accompanied by a passenger who had no pilot qualifications. Both days were warm. The LAA already promulgates a self-briefing tool for testing pilots and, since the accident, it has produced similar guidance for owners on how to prepare for flying a new type: it has published two magazine articles on the topic and, in December 2018, produced a Technical Leaflet (TL 2.30 ‘Converting to a new type’) for use as a preparation tool, similar to the one provided for testing pilots. Subjects addressed include: researching a new aircraft type (eg by reviewing its operating manual, operating limitations and handling peculiarities); the planning and content of a first flight on type to become familiar with the aircraft alongside a suitably experienced pilot; the importance of beneficial weather conditions (eg consideration of density altitude); and consideration of the desirability of carrying passengers both in terms of aircraft weight, and pilot recency and experience on type. It is likely that the pilot was not prepared for the aircraft to stall after takeoff, and it is not known whether he was aware of G-BXON’s higher stall speeds. The absence of any stall warning and the wing dropping would have added to his surprise. Therefore, he is unlikely to have been prepared to take immediate and appropriate recovery action. The CAA’s advice on stall and spin awareness reminds pilots to be prepared, particularly whilst flying at low level, to recognise both the ‘approaching’ and ‘full’ stall indicators, and to take immediate recovery action if the aircraft is not performing as expected. This prioritises the recovery of a safe flight path. Survivability The aircraft suffered extensive damage during the impact, however the steel tubular structure of the fuselage maintained a substantial ‘survivable space’. Although the impact forces were survivable, the post-mortem concluded that the pilot died from burns sustained in the post-impact fire. The post-mortem report suggested that an injury sustained in the impact may have impeded his ability to exit the aircraft. Additionally, the seat harness QRF found near the left seat may have suffered deformation during the accident and did not release when subsequently operated by the AAIB. Nevertheless, the post-mortem findings supported an indication that the pilot ‘died relatively quickly’ after the post-impact fire started. As such it was not determined whether the injury or QRF would have influenced the outcome. Both occupants were wearing normal clothing which would not have offered any protection from the effects of fire. Prior to this accident, in July 2016, the LAA published an article in its magazine relating to mitigating post-accident survival risks. Since this accident, the LAA has indicated its intention to incorporate advice relating to choice of flying clothing in a new Technical Leaflet.

69 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Other issues identified Maintenance documentation The worksheets submitted to the LAA in support of the Permit to Fly application listed the maintenance tasks performed during G-BXON’s rebuild. Where the tasks referred to component or system checks, the results of these checks were not initially documented. Results of the fuel flow checks and engine were subsequently provided on a follow-up worksheet, but the results of flight instrument calibrations were not recorded. The worksheets had been completed by the LAA inspector and each task was certified by him. Although a substantial amount of work on the aircraft would have been conducted by the pilot, the pilot’s signature only appeared against a single task relating to duplicate inspections of the flight and engine controls. In accordance with the LAA inspector’s preferred approach, the maintenance tasks had not been individually documented as the restoration had progressed but had instead been collectively grouped together and retrospectively documented. It is evident that the pilot relied on the LAA inspector to document the work undertaken on G-BXON and to manage the Permit to Fly application process on his behalf. The manner in which the worksheets had been documented made it difficult for the investigation to determine the chronology of the work performed on G-BXON. Additionally, it was not possible to differentiate work done by the pilot and certified by the inspector under his LAA remit from work performed by the inspector. Furthermore, the worksheets submitted in support of G-BXON’s Permit to Fly application did not fully reflect the status of the aircraft or all the work which had been undertaken. Substantial work is reported to have been carried out on the aircraft’s engine between September 2016 and April 2017. The supplementary worksheet submitted on 10 April 2017 made no reference to this work, and it did not appear to have been recorded elsewhere. It was not established to what extent the LAA inspector was aware of, or involved in, this additional work or whether this work had been re-inspected. Work on the engine is reported to have included replacement of the fuel injection pump, ignition leads and adjustment of the OPRV. A number of anomalies were noted with these components during the post-accident examination of the engine. This suggests that either the work had not been inspected, or not been inspected effectively. The initial worksheets dated 16 September 2016 referenced the installation and timing of an overhauled fuel injection pump. However, the fuel injection pump was subsequently replaced some months later. The absence of a formal record of this work meant it was not possible to establish whether the replacement pump had been correctly timed and tested. However, an invoice dated 22 February 2017 to the pilot from the LAA inspector’s maintenance company referred, among other items, to investigation of an engine problem and timing and installation of a new fuel [injection] pump. The LAA process for aircraft build and rebuild projects places the onus of responsibility on the aircraft owner for ensuring that the finished aircraft meets accepted standards for

70 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 build quality and airworthiness. The investigation found that LAA guidance regarding owner responsibility for the quality and conformity of a completed aircraft project differed for newbuild and rebuild aircraft. In particular, TL 2.21 lacked any specific guidance on this subject, although relevant guidance was available in other TLs. In October 2018, the LAA revised TL 2.21 to include additional guidance relating to completion of worksheets and the expected level of detail required. The revised TL also includes information on owner responsibility for the quality and conformity of rebuild projects, to reflect guidance already published for newbuild projects. Permit to fly application process Throughout G-BXON’s Permit to Fly application process LAA Engineering repeatedly sought clarification from the LAA inspector on a number of worksheet items, to ensure that the submitted paperwork met an acceptable standard to form the basis of an LAA recommendation for a Permit to Fly. The LAA commented that the worksheets submitted for G-BXON contained a less than average level of detail. Nonetheless, following receipt of the supplementary worksheet submitted on 10 April 2017, the LAA satisfied itself that the paperwork was adequate and cleared the aircraft to proceed to the flight testing stage. Although LAA guidance published in TL 2.21 for rebuild projects specified a minimum of five hours flight testing followed by a formal flight test, LAA Engineering did not impose a minimum number of flight testing hours or landings for G-BXON. Instead it left this determination up to the testing pilot, having taken into account his level of experience on type. The LAA was not aware of the additional work undertaken on G-BXON’s engine, following submission of the original worksheets in September 2016. It subsequently indicated that had it been aware of the difficulties experienced in getting the engine to run smoothly in the lead up to the flight testing period, it would have specified a minimum number of hours to be flown. While this may not have influenced the outcome of the accident flight, additional flight testing may have allowed any post-rebuild engine performance issues to become evident. Following the accident, the revised TL 2.21 includes updated information to bring the LAA’s published guidance on minimum flight testing hours into line with actual practice and to describe the factors that LAA Engineering takes into account when determining the initial flight test requirements for a given aircraft. Aileron control rod rivets The rivets installed in the left aileron control rod were of a different type and lower strength than those specified on the AOP.9 post-modification drawing. The AOP.9 Type Record indicated that the original aileron control rod rivets were AGS 2048-420 and had a reserve factor of 1.004 in the critical loading case. This may provide an explanation for stronger rivets specified in the revised post-modification drawing, but it was not determined whether there was any mandatory requirement for the change to Chobert rivets to have been embodied on G-BXON.

71 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 All the rivets from G-BXON appeared to conform with the material properties of the original AGS 2048-420 rivets, but only the green rivets conformed with respect to colour. The two rivets on the left aileron control rod which had suffered corrosive attack were grey and may have been from a different batch, or differed in some other respect, introducing the possibility that they were fitted at a different time. All eight rivets from the right aileron control rod end-fittings were grey and visually similar to the two grey rivets from the left aileron control rod. One of them had failed and metallurgical analysis determined that the failure was due entirely to intergranular fracture and that the rivet had not been carrying any load when it failed. It was concluded that the rivet had failed at some point prior to the accident flight, but it was not possible to determine when. There was no reference to work being carried out on either aileron control rod in the worksheets from G-BXON’s recent restoration, and the absence of historic technical records and/or worksheets from the previous owners meant it was not possible to determine whether the failed rivets were replacement or original rivets. A total of three aileron control rod attachment rivets examined exhibited partial, or total, pre-existing intergranular failure as a result of stress corrosion cracking. While it was determined that the aileron control rod joints could sustain normal flight loads, even with two failed rivets, the failure of fasteners on a safety-critical flight control connection is highly undesirable from an aircraft safety and airworthiness perspective. Only the failed rivets were subject to metallurgical examination during the investigation, so it is possible that the remaining rivets, although intact, could exhibit stress corrosion cracking. Intergranular stress corrosion cracking in these rivets may not be visually evident until the point of final failure and the only means to detect the presence of cracking would be via an inspection using a non-destructive testing (NDT) technique. There is currently no requirement for historic aircraft being restored under the LAA regime to be subject to NDT inspections. As a result of the findings of this investigation, in January 2019 the LAA issued Airworthiness Information Leaflet MOD/920/001 ‘AOP.9 Inspection of rivets securing the aileron operating rod end fittings’ which requires an inspection of the aileron control rod rivets on all AOP.9s with an LAA permit to fly to identify the type and condition of rivets installed, and appropriate rectification according to the findings of the inspection. The LAA has also included additional guidance in the updated TL 2.21 relating to the integrity of riveted joints in rebuilt aircraft. The updated guidance includes the following additional statement: ‘… at rebuild all rivets should be examined critically and consideration given to replacing rivets that may be internally corroded especially where they carry out a critical function….In particular it would be well worth drilling out and replacing as a matter of course any rivets that are not part of a large multiply‑redundant group, and are performing a function that’s critical to safety e.g. strut ends, pushrods, wing and tail attachments, engine mount brackets etc, even though they might appear to be still in good condition.’

72 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 Conclusion The investigation concluded that it was most likely that G-BXON departed from controlled flight because it stalled at a low height after takeoff. G-BXON, as is common to type, did not demonstrate any stall warning in its Permit to Fly flight test. It also demonstrated substantially higher stall speeds and a lower rate of climb in comparison with other AOP.9s and the Pilot’s Notes figures. The pilot was likely to have elected to fly at a departure airspeed which he perceived to provide an adequate margin from the stall regime. In the absence of prompt and appropriate pilot actions, recovery from a stall at a low height was unlikely. Examination of the wreckage, although limited to some extent due to impact and fire damage, did not identify any other technical issues which may have contributed to the accident, but there were some systems and flight instruments which could not be examined. Although the aircraft’s engine was operating at the time of the accident, the investigation identified a number of anomalies which could have contributed to less-than-ideal engine and aircraft performance. In isolation, these would not have accounted directly for the departure from controlled flight but may have served as a distraction to the pilot. Additionally, the investigation identified issues relating to the documentation of maintenance and the integrity of safety-critical rivets. The LAA has taken action to reinforce its existing processes and published guidance in areas relating to the Permit to Fly application process, documentation of aircraft maintenance and pilots undertaking their first flights on type. No Safety Recommendations are made. Safety action The following safety actions have been taken: The Light Aircraft Association (LAA) has: ● ● Created a database of initial flight test performance results and introduced a process to compare future aircraft against other examples of the same type prior to permit issue. In the case of factory-built aircraft, scheduled performance figures, when available, will also form part of this consideration. ● ● Clarified the wording of the stall requirement in the Flight Test Schedule which relates to the speed at which stall warning will occur. The new wording emphasises that this requirement relates only to aircraft with artificial stall warning devices and reflects that some LAA aircraft may not be so equipped. ● ● Introduced a procedure whereby, when it issues a newly-constructed or newly-rebuilt aircraft with a Permit to Fly, it will write to the owner with any safety related observations on the submitted flight test results. The

73 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-BXON EW/C2017/06/01 observations will include highlighting the absence of any stall warning features, particularly when the reported characteristics deviate markedly from that expected or from published data for the type. ● ● Produced guidance for pilots preparing for their first flight on a new type: it has published two magazine articles on the topic and has also produced a Technical Leaflet, TL 2.30 ‘Converting to a new type’, for use as a preparation tool, similar to the one provided for testing pilots. Subjects addressed include: researching a new aircraft type (eg by reviewing its operating manual, operating limitations and handling peculiarities); the planning and content of a first flight on type to become familiar with the aircraft alongside a suitably experienced pilot; the importance of beneficial weather conditions (eg consideration of density altitude); choice of appropriate flying clothing; and consideration of the desirability of carrying passengers both in terms of aircraft weight, and pilot recency and experience on type. ● ● In October 2018, revised TL 2.21 ‘Rebuilding an aircraft under the LAA system’ to include additional guidance on the completion of worksheets, the expected level of detail to be recorded, and reiterated the respective responsibilities of owners and inspectors for the quality and conformity of rebuild projects. Additional guidance relating to the integrity of riveted joints in rebuilt aircraft was also included, as was updated information to bring the LAA’s published guidance on minimum flight testing hours into line with actual practice, and to describe the factors that LAA Engineering considers when determining the initial flight test requirements for a given aircraft. ● ● In January 2019, issued Airworthiness Information Leaflet MOD/920/001‘AOP.9 Inspection of rivets securing the aileron operating rod end fittings’ which requires an inspection of the aileron control rod rivets on all AOP.9s within its fleet to identify the type and condition of rivets installed, and appropriate rectification according to the findings of the inspection. Bulletin Correction A bulletin correction was issued concerning this report prior to publication. In order to provide additional clarification, the information in the section titled ‘Passenger’ (page 36) and the last two sentences in the first paragraph of the ‘Engine maintenance’ section (page 52) have been amended. Full details regarding the correction can be found on the AAIB website (https://www.gov.uk/ aaib-reports/aaib-investigation-to-auster-aop-9-g-bxon).

FD06655 ｜ 2019_英国_aaib-investigation-to-aw109sp-g-rayn__AW109SP_G-RAYN_06-24.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Accident

Aircraft Type and Registration: AW109SP, G-RAYN No & Type of Engines: 2 Pratt & Whitney Canada PW207C turboshaft engines Year of Manufacture: 2019 (Serial no: 22401) Date & Time (UTC): 1 November 2022 at 1726 hrs Location: Nantclwyd Lodge, near Llanelidan, Denbighshire Type of Flight: Non-commercial operation Persons on Board: Crew - 1 Passengers - 5

Injuries: Crew - None Passengers - 1 (Serious)

4 (Minor)

Nature of Damage: Helicopter destroyed Commander’s Licence: Commercial Pilot’s Licence (Helicopters) Commander’s Age: 47 years Commander’s Flying Experience: 3,815 hours (of which 1,565 were on type)

Last 90 days - 81 hours

Last 28 days - 24 hours Information Source: AAIB Field Investigation Synopsis While climbing away from an unlit field landing site, at a height of approximately 40 ft agl, G-RAYN’s main rotor blades struck trees and sustained catastrophic damage. The helicopter fell to the ground, coming to rest on its right side. The fuel tanks maintained their integrity and there was no fire. The pilot was able to shut down both engines and, with the assistance of onlookers, helped the passengers to escape from the cabin. One of the passengers was seriously injured in the accident. Of the five passengers, at least four had not fastened their seatbelts prior to departure. No causal or contributory technical factors were identified with the helicopter during the investigation. The investigation found that the accident resulted from the unintended rearward transition of the helicopter into a stand of trees during a planned vertical departure at night from an unlit field landing site. The flight had been scheduled as a day departure but the takeoff became delayed until after nightfall. The investigation found several operational barriers which might have prevented this accident but were either breached or not present. These included a misunderstanding of the applicable operator-level restrictions for the non-revenue flight being undertaken and opportunities missed during the planning process to anticipate and mitigate for flight delays.

2 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Distraction and time pressure led to the pilot not completing auditable weight and balance (WB) calculations before leaving Biggin Hill, this potentially contributed to the helicopter being overweight when it took off on the accident flight. While the pilot had assessed the available lighting as sufficient for the intended takeoff profile, the visual cues available to him on the night proved inadequate for the detection of the subsequent unintentional rearward drift toward the trees behind the helicopter. The passengers did not exert any pressure on the pilot to delay beyond the planned departure time, and the pilot did not consider that a night departure would pose an unacceptable risk. The investigation thought it likely that, had all passengers been secured by their seat harnesses, the level of injuries sustained could have been less severe. For frequent flyer passengers, or those focused on time pressures, it might be tempting to see safety briefings and seatbelts as an unnecessary encumbrance. In helicopters with seating and cabin configurations like G-RAYN’s, once pilots are in their seats, it is not possible for them to visually check the security of their passengers’ seatbelts/harnesses. Nonetheless, it is important for all parties to understand that an aircraft commander is under a legal obligation to ensure passengers are appropriately briefed and have their harnesses secure for all takeoffs and landings. While the pilot carried out a strategic pre-flight risk assessment, a more effective and targeted tactical Threat and Error Management (TEM) approach to each phase of the operation could have provided an additional safety barrier for the flights being undertaken. Following the accident safety action has been taken by the operator to improve its night flying procedures, ground equipment and training. History of the flight The pilot flew G-RAYN from Biggin Hill on the morning of 1 November 2022 tasked with transporting five passengers to and from a field landing site in North Wales for a day’s game shooting. The helicopter was owned by the lead passenger, but routinely maintained and operated by the third-party operating company who provided the pilot. For flights in support of the owner’s requirements, G-RAYN was operated as a non-revenue flight under the regulations for ‘non-commercial air operations with other-than complex motor-powered aircraft’ (NCO)1. It was being flown by one of the operator’s ‘company approved’ pilots contracted by the owner on a daily rate. The pilot arrived at Biggin Hill at approximately 0645 hrs. His scheduled duty check-in time was 0700 hrs, 30 minutes before takeoff. While he had arrived early, much of that extra time was taken up with an unanticipated supportive conversation with a very recently bereaved colleague. The pilot self-briefed the weather, refuelled G-RAYN to approximately 600 kg of fuel and completed the prescribed pre-flight walk round check of the helicopter before taking off at 0727 hrs. Footnote 1 UK Regulation (EU) No 965/2012, Annex VII.

3 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Having flown G-RAYN from Biggin Hill, the pilot landed at the helicopter owner’s private landing site (Lisvane) north of Cardiff at 0830 hrs and embarked the five passengers and their luggage. The flight from Cardiff to North Wales was uneventful and the helicopter landed near Llanelidan at 0920 hrs. The field landing site was listed in the operator’s company landing site directory (CLSD) with the reference code LEA2. The designated landing location was a flat area of grass adjacent to a stand of trees and a shooting lodge (Figure 1). To the northwest of the landing area the ground sloped down and away toward several isolated trees, as indicated by the chevrons in Figure 1. Figure 1 LEA2 field landing site near Llanelidan (©2023 Bluesky, Infoterra Ltd & COWI A/S, CNES / Airbus, Getmapping plc, Maxar Technologies) After disembarking his passengers, the pilot flew G-RAYN to Hawarden Airfield (Hawarden) to refuel. The pilot’s firm recollection was that, after arriving at Hawarden, he refuelled the helicopter to 400 kg, calculating his required uplift of 250 kg2 from the indicated fuel quantity he observed prior to shutdown. The total fuel quantities recorded by the helicopter’s onboard systems were 206 kg on arrival at Hawarden and 456 kg when it departed for LEA23. Footnote 2 Receipted uplift of 320 litres of Jet A1 fuel with an assumed specific gravity of 0.78. 3 See Recorded data/Recorded fuel quantity section.

4 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 The tasking for the return flight showed a scheduled departure time from LEA2 of 1630 hrs. Sunset was at 1645 hrs, with the end of official evening civil twilight, marking the transition from twilight to night, occurring at approximately 1718 hrs4. The passengers were not ready to depart on schedule and remained in the shooting lodge until approximately 1715 hrs before walking to the helicopter and taking their seats. The pilot remembered seeing the passengers rearranging their seatbelts after sitting down but did not visually confirm they had securely fastened them prior to the cabin door being closed. The pilot’s recollection was of having approximately 340 kg of fuel on board the helicopter before the flight and that he “took his time” after engine start to burn off additional fuel because he knew the helicopter would be close to its maximum takeoff weight (MTOW). The landing site was unlit but the pilot was satisfied there were sufficient visual references available for him to safely conduct a vertical departure. The helicopter’s external lights were illuminating the area immediately around the helicopter and he could see what he described as a “vague horizon” ahead. The pilot judged that lights from the shooting lodge’s windows to his right would be an adequate lateral marker for the departure climb. The pilot reported that, after lifting into the hover, he translated G-RAYN forward and left to increase separation from the treeline and turned into wind. He used the beam from the helicopter’s controllable search light to orientate himself in relation to the nearest trees. The pilot then directed the beam forward and down to illuminate the grass ahead of the helicopter before committing to the departure. The initial climb proceeded as the pilot expected but passing approximately 30-40 ft, he felt what he described as a “massive jolt” and immediately ascribed it to a significant rotor head imbalance. The helicopter began shaking violently and fell to the ground, ending up on its right side. Eyewitnesses, who were standing at the edge of the treeline behind G-RAYN and watching it take off, reported not hearing or seeing anything unusual with the helicopter prior to it striking the trees. After the helicopter stopped moving, the pilot orientated himself in the cockpit, unstrapped and stood up to open the left cockpit door, which was by now above him. He reported hearing the engines still running and that he then turned the engine controls to off and closed the fuel valves. After doing this, the pilot could still hear a high-pitched whining noise which he determined was the rotor head spinning at high speed. He applied the rotor brake to try and stop it turning but this had no discernible effect. The pilot climbed out onto the left, now top, side of the helicopter and opened the cabin door so the passengers could escape. Four of the passengers were able to vacate the helicopter with varying degrees of outside assistance but the fifth was lying unconscious at the bottom of the cabin. Through the combined effort of the pilot, the other passengers and some onlookers, the unconscious passenger was manually extracted from the helicopter. At this point he was in significant medical distress. The casualty was carried to the lodge and CPR was administered by the pilot under the guidance of the emergency services operator. After the application of CPR, the casualty regained a reportedly “more-normal” colour but did not fully regain consciousness. He sustained serious injuries in the accident and was subsequently hospitalised for several months. Footnote 4 See Meteorology section.

5 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Accident site The helicopter came to rest at the base of a tree approximately 30 m from the shooting lodge. The main fuselage of the helicopter was intact but the tail boom had separated and been thrown forward of the point of ground impact (Figure 2). Figure 2 Overhead view of G-RAYN accident site There was a large amount of debris spread around the surrounding area, mainly consisting of fragments from the rotor blades and branches from the trees. A detailed GNSS plot was taken of the main components of wreckage, impact marks and debris. There was no evidence of fuel leaks and there was no post-crash fire. There were clear impact marks near the top of the trunk of the tree adjacent to the helicopter wreckage and a significant swathe of branches had been cut from the top of this tree and landed adjacent to the main fuselage (Figure 3). Figure 3 Ground view of main accident site

6 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Helicopter description General The AW 109SP is a member of the Agusta family of twin engine, light class helicopters. The SP version features three main modifications: the introduction of a new composite fuselage structure material, a four-channel digital autopilot and a new cockpit layout with four Chelton display units (EFIS) and integrated COMM/NAV management system. The SP has a fuel system designed to be crashworthy such that in the event of an accident the amount of fuel that leaks from the tanks is kept to a minimum. The helicopter is powered by two Pratt and Whitney Canada PW207C turbine engines. The AW109SP was designed to meet the certification requirement5 of providing ‘reasonable protection’ to each occupant from the dynamic loads experienced in a crash landing if they are properly using the seats, safety belts, and shoulder harnesses. Fuel system The fuel storage system has two main forward independent tanks, one main rear tank and two auxiliary fuel tanks. Each main forward tank supplies fuel to its associated engine, the forward tanks are gravity fed by the rear tank. The total usable fuel capacity of the main tanks is 563 litres (450 kg)6 with the auxiliary fuel tanks providing an additional 184 kg capacity. The fuel system is installed inside the helicopter and fuel vent lines are bonded to the airframe and are fitted with flame arrestors. Fuel indication The fuel indicating system (Figure 4) consists of the fuel monitoring and indicating systems to provide fuel system malfunctions and system indications. The fuel indicating system gives a continuous indication of the quantity of fuel contained in the fuel tanks and the pressure in the fuel system. Five variable-capacitance fuel probes are installed inside the tanks (two probes in the left bottom tank, two in the right bottom tank, one probe in the top tank). The tanks sense the difference in the dielectric constant of fuel and air. A change in the fuel level in the tank causes a change in the probe capacitance. Two independent electrical lines supply the Fuel Control Unit (FCU) with 28 V DC electrical power. When the quantity of fuel in the tank changes, the probes send an electrical signal to the FCU, which processes it and then sends proportional output currents to the Data Acquisition Unit (DAU). The latter sends the fuel quantity signals to the No 2 Electronic Display Unit (EDU) where the fuel quantity is continuously displayed. Another function of the FCU is to continuously monitor the system for faults. The FCU has two independent channels (left and right) and faults are monitored at channel level: when the analogue output signal of either FCU channel is less than 1.93 mA, the affected fuel quantity readout displays a white box with three red dashes. Footnote 5 As prescribed in CS 27.562 of Certification Specifications, Acceptable Means of Compliance and Guidance Material for Small Rotorcraft CS-27, dated 14 November 2003. 6 Based on a specific gravity of 0.8 for Jet A1 Fuel.

7 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Figure 4 Fuel indication system schematic Fuel quantity is displayed to pilots as separate totals for the left and right tanks rather than being presented as a single combined fuel total (Figure 5). Pilots are required to mentally sum the figures to calculate the total amount of fuel on board.

Figure 5 EDU fuel display Helicopter cabin Crashworthy seating and seatbelts are provided for the pilot and for the co-pilot. The seat structure consists of two lateral carriers milled from high tensile aluminium alloy. Between those carriers the seat bucket and the backrest are fixed. These two parts are made of an

8 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 aramid and carbon fibre material. The seat is equipped with an approved four-point safety belt system: lap belts are fixed on the seat while shoulder belts are guided by an aluminium tube downward to the inertia reel fixed on the rear of the backrest. The front edge of the seat pan is hinged to the two carriers. Two links struts connect the rear edge of the seat bucket with two energy absorbers mounted in the carriers. Under severe vertical loads the seat pan rotates downward at its rear edge so that the load on the spinal column is reduced. The passenger/cargo compartment occupies the rear portion of the cabin, access is provided by large sliding doors on each side of the helicopter. The passenger seats are provided with a fibre-reinforced structure to which the seat cushions attach by Velcro fasteners. The seats are also provided with a removable headrest. A four-point safety harness with a quick-release coupling holds the occupant to the seat. The four ends of the belts are fixed to the seat bucket. The shoulder-belt is guided over the upper edge of the seat bucket downward to the inertia reel. The inertia reel is fixed to the rear of the seat bucket and is equipped with a manual lock device for the shoulder belts. The seats are supported by two boomerang-shaped legs made of a high tensile aluminium alloy which carry the seat bucket and contain the energy absorbing device and act as rails for vertical stroking when severe vertical loads are applied to the seat assembly. Helicopter maintenance The Airworthiness Release Certificate was valid until June 2023. Responsibility for operation and maintenance of the helicopter had transferred to the operator in September 2022. After receipt and induction of the helicopter onto the operator’s Continuous Airworthiness management system an annual maintenance was undertaken on the helicopter in October 2022. During this maintenance an issue with the fuel indication system was identified. After extensive fault diagnosis the cause was isolated to the FCU which was replaced. No further anomalies with the fuel control system were highlighted by crews in the technical logbook for the 26 sectors flown between the annual maintenance and the last recorded flight on 31 October. No technical logbook entry had been opened for the 1 November series of flights. Recorded information Introduction The helicopter was not fitted with a flight data recorder or cockpit voice recorder, as neither was required by regulation. However, recorded data was available from the helicopters two Multi-Function Displays, two Primary Flight Displays, the DAU and two engine Data Collection Units (DCU). This provided time series data recorded at a rate of once per second, for the helicopter’s most recent five hours of operation, which had been accrued between 30 October 2022 and 1 November 2022. Recorded parameters included the helicopter’s indicated airspeed, groundspeed, altitude, normal acceleration, GNSS derived position, pitch and roll attitude, heading, total fuel quantity, rotor rpm (Nr) and engine collective position, torque, N1 and N2 speeds. The DAU and DCUs also provided snapshots of engine and system related faults and exceedances.

9 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 A tablet computer was fitted in the cockpit, which was operating a software navigation application7. This provided a recording of the helicopter’s GNSS derived position, altitude, and groundspeed. The software application could also be used by the pilot to calculate the helicopter’s WB. Image footage and ambient sound of the helicopter during the accident takeoff was captured by a CCTV camera fitted to a private dwelling located 290 m south of the accident site. The helicopter’s external lights were evident in the footage, which included its anti-collision lights fitted to the upper and lower fuselage, position lights fitted to the left horizontal stabiliser and end of the tail boom, and landing/taxi lights on the left sponson. Accident flight The recorded data showed the helicopter was parked on a heading of 315° and positioned (Figure 6) about 23 m from where it subsequently struck trees. At 1722 hrs the No 1 engine was started, followed about 90 seconds later by the No 2 engine. The helicopter lifted into the hover (Figure 7 Point A) at 1726:06 hrs and made a left turn onto a heading of 305°; engine torque was 88% and the recorded fuel quantity was 405 kg. The helicopter’s pitch attitude was about 6° nose-up and the collective was gradually raised, with engine torque increasing to 91%. This coincided with the start of the CCTV footage, which subsequently showed the helicopter moving slowly backwards towards the stand of trees. The engine torque continued to increase, and the helicopter climbed while also turning left onto a heading of 287°. The helicopter’s pitch attitude had briefly reduced to about 3° nose-up during the turn, but then increased to nearly 8° nose- up (Figure 7 Point B and Figure 8). The pitch and roll attitude then stabilised at about 7° nose-up and -3° left roll, with the helicopter now having climbed to approximately 25 ft agl (Figure 7 Point C and Figure 9). The collective was raised further, and engine torque increased through 106%. A few seconds later, at 1726:28 hrs, while travelling backwards at a groundspeed of about 7 kt and at a height of approximately 40 ft agl, the helicopter struck the stand of trees. The main rotor rpm (Nr) rapidly reduced from 100% and the helicopter pitched down to nearly 50° and rolled left to 83° as it then descended. Very shortly after, the helicopter struck the ground in a nose-down attitude before rolling onto its right side, where it came to rest. A few seconds later the No 2 engine was shut down, followed about one minute later by the No 1 engine. The main rotor head stopped rotating about 30 seconds later. The audio from the CCTV camera contained sounds consistent with the rotation of the helicopter’s Nr and tail rotor. The derived rotational speeds were consistent with the data recorded by the helicopter. There was no evidence of unusual sounds prior to the helicopter striking the trees. Footnote 7 SkyDemon, VFR Flight Planning Software and GNSS Navigation [accessed 14 November 2023].

10 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 The WB function of the software navigation application was reviewed with the assistance of its manufacturer. This showed that for the flights flown on 1 November 2022, the pilot’s weight was set at 85 kg, co-pilot, passengers and luggage were set at 0 kg and the total fuel was set to 640 kg. An additional 108 kg was also set for “floats”; although these were not fitted to G-RAYN. Based on these settings, the application would have provided a visual alert because the helicopter’s WB were outside of the limitations entered into the software. Figure 6 Position of helicopter prior to takeoff (©2023 Bluesky, Infoterra Ltd & COWI A/S, CNES / Airbus, Getmapping plc, Maxar Technologies)

11 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Figure 7 Flight data during the accident

12 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Figure 8 CCTV image as the helicopter started to climb Figure 9 Image of helicopter shortly before striking trees

13 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Recorded fuel quantity Table 1 shows, in sequential order, the helicopter’s total fuel quantity recorded at takeoff for each of the flights flown on 1 November 2022. Upon landing at Hawarden, the sensed fuel quantity was 206 kg and upon recommencement of the recording, when the helicopter was on the ground, the total fuel quantity had increased to 456 kg. This was consistent with the receipted uplift of 320 litres of Jet A1 fuel with an assumed specific gravity of 0.78 which equates to just less than 250 kg. Takeoff location Fuel quantity (kg) Biggin Hill Airport 592 Lisvane 380 Lodge (LEA2) 245 Hawarden 448 Lodge (LEA2) 405 Table 1 Recorded fuel quantity during takeoffs on1 November 2022 Aircraft examination A general visual inspection of the wreckage was conducted. While the main fuselage body was intact the nose was damaged and the tail boom had detached from the fuselage. The main rotor blades had all detached from the rotor head and were severely damaged. A detailed inspection of the upper deck including the Main Gearbox (MGB) and Rotor Head was performed. All the main rotor pitch links and rotating scissor were severed. The fracture surfaces of these damaged components exhibited the characteristics of overload failures. The No 1 hydraulic system filters were intact, but the No 2 system filters had both ‘popped.’ These filters sense a differential pressure of 70 psi between inlet and return. They are spring loaded and magnetic and can be set off by impact forces. Several locking nuts on the bolts on the case connecting the MGB with the rotor head were found not properly in contact with the joint surface of the MGB upper case. These were all on the right side of the casing. However, it was determined that this happened during the lifting operation to recover the aircraft which caused the bolts to stretch; the vector of force during the lifting operation would have initially been at 90° to the rotor head which would have placed a bending moment on the rotor head and placed these bolts under tension. Flying controls The flying control system was examined. A visual check of the system did not reveal any damage to the flying control rods or linkages up to the damaged section of the rotor head.

14 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 The upper deck panels were removed and flight controls disconnected from the servo actuators to check the free movement of the mechanical link and continuity of movement. From the co-pilot position the cyclic and collective full range of movement was achieved with the mixer unit reaching its backstops. However pedal movement was limited by nose deformation and the control run could only be checked up to the yaw actuators, due to the tail detachment at this section. From the pilot position the cyclic and collective operation resulted in full and free range of movement of the mechanical flying controls. To fully examine the system in yaw the co-pilot controls were disconnected from the connecting bar to see if full and free range of movement could be achieved using the pilot’s pedals. The range of movement on the pedals was different with greater movement on the right pedal than the left. The control mechanism would hit the forward backstops on the servo but not the rear backstop. There remained a clearance of approximately 4 mm. Examination of the fuselage showed impact damage that corresponds with the location of the control run for yaw channel. Borescope inspections in this area revealed some impact damage and a foreign object that had likely entered the structure during ground impact. It was not possible to assess if the control rod was distorted, but examination of the routing of the control run showed it contacting some of the surrounding structure. The extreme forces needed to separate the tail rotor boom from the fuselage would have resulted in high bending moments being applied to the fuselage and yaw control run which would have distorted its alignment. Tail boom and tail rotor Inspection of the detached tail boom and the tail rotor showed impact marks on the left side of the tail. One of the tail rotor blades was cut at the root and the other one damaged. The tail rotor blade that detached had impact damage on its leading edge. The tail rotor drive shaft was twisted at its broken section confirming rotation at the moment of impact. The tail rotor output shaft was distorted as a result of the high bending moments applied during the impact with the trees. Cockpit survey The following observations were made from a survey of the cockpit:

● Fuel Control Panel: both shutoff valve switches were found in the CLOSED position, the XFEED valve switch was in the AUTO position.

● Rotor Brake lever in ON position.

● Engine Control Panel: ENG 1 knob found in IDLE, ENG 2 knob in OFF position.

● Landing lever in DOWN position.

● Overhead panel: Engine levers in flight position (the Engine Control Panel overrides this throttle position).

15 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771

● No 1 and 2 GEN BUS switches in OFF position (as expected being a magnetic retaining type).

● Two circuit breakers had tripped: WRX and Anti-collision light breakers. No other circuit breakers had tripped. Avionic units The Flight Control Computer and FCU were inspected and found to be physically intact. These were removed for further testing. Similarly, both engines’ Digital Control Units (DCU) were inspected and removed so that data from these could be extracted. Organisational information Basic regulation Regulations for air operations with aeroplanes and helicopters within the UK are detailed in UK Regulation (EU) No 965/20128 (965/2012). These regulations include detailed rules for operators of aircraft engaged in both commercial and non-commercial air activities. The regulations are intended to be proportionate, with the most stringent criteria being applied to commercial air transport (CAT) operations. Aircraft operators may further limit the scope of their activities by publishing more restrictive guidance for their own operations. Requirements for ‘non-commercial operations of an AOC holder with aircraft listed on its AOC’ are detailed in 965/2012 at ORO.AOC.125. Company operations manual G-RAYN’s operator published an operations manual (OM) containing instructions to be followed by its personnel. Compliance with the OM was required to ensure that all CAT flights were planned and executed in accordance with applicable policies and requirements. The OM contained a statement that it had been ‘issued in accordance with the EASA Implementing Rules’ and that it complied with the acceptable means of compliance and guidance material contained within Annex III to 965/2012, ‘Organisation Requirements for Air Operations’ (Part-ORO), and with the terms and conditions of the company’s Air Operator’s Certificate. The OM consisted of four parts, published as separate manuals:

● Part A (OMA) General: non-type-related operational policies, instructions, and procedures.

● Part B (OMB) Type-Related Helicopter Operating Matters: type-related instructions and procedures, including differences between types, variants, and individual helicopters. Footnote 8 Available at Commission Regulation (EU) No 965/2012 of 5 October 2012 laying down technical requirements and administrative procedures related to air operations pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council (Retained EU Legislation) (caa.co.uk) [accessed 16 January 2023].

16 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771

● Part C (OMC) Route & Aerodrome Instructions: instructions and information needed for the area of operation.

● Part D (OMD) Training: training instructions for personnel. The OMA required that ‘every flight undertaken by the Company for whatever reason shall be conducted in accordance with the provisions of [the] Operations Manual.’ While the OMA was written primarily to support CAT operations it did allow for differences when conducting non-revenue flights. The scope of non-revenue flights listed in the OMA included ‘flights for a private owner using their aircraft with company approved pilots.’ The accident occurred on a non-revenue, NCO flight, flown by one of the operator’s pilots. The OMA9 listed specific differences from the CAT requirements for non-revenue and non- CAT flights. These included:

● fuel requirements,

● IFR destination alternate requirements,

● helicopter performance criteria,

● pilot age limitations,

● helicopter flights over water, and

● pilot licensing requirements for IFR flights. The OMA also gave guidance regarding the degree of flexibility that could be used in the following areas for non-revenue flights:

● flight time limitations,

● long term CAA permissions and exemptions,

● carriage and use of an electronic flight bag, and

● night helicopter landing site (HLS) operations. Specifically, the OM contained no derogation for night HLS operations, stating10, ‘all Categories of flight, (CAT/SPO/NCC/NCO) shall without exception, shall [sic] be flown IAW the Company Operations Manual.’ The investigation heard that, culturally within the industry, NCO operations for helicopter owners in their own aircraft were often referred to as ‘private’ flights; a description used before the category NCO was adopted by regulators to encompass such activity. This legacy terminology contributed to the pilot’s misunderstanding that, being a ‘private’ flight, he could choose to apply commander’s discretion regarding all additional limitations contained within the OMA, provided he complied with the higher-level regulations of 965/2012. Footnote 9 OMA 8.7 ‘Non-revenue / Non-CAT Flights.’ 10 OMA 8.7.9 ‘Night HLS.’

17 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Training and checking Part-ORO specifies the requirements to be followed by an air operator conducting CAT and non-commercial operations with complex motor-powered aircraft (NCC) operations. Part- ORO subpart FC (Flight Crew) establishes requirements to be met by an operator in relation to flight crew training, experience, and qualification. ORO.FC.230 details the requirements for recurrent training and checking, including the requirement for operator proficiency checks (OPC) ORO.FC.202(b) ‘Single-pilot operations under IFR or at night’ stipulates that ‘the recurrent checks required by ORO.FC.230 shall be performed in the single-pilot role on the relevant type or class of aircraft in an environment representative of the operation.’ Due to the diverse range and scope of operations covered by these regulations, the UK Regulator does not explicitly specify more detailed requirements for proficiency checks, instead delegating that to individual operators. The investigation found that the UK Regulator’s interpretation was that, for an operator that conducts night operations, ‘an environment representative of the operation’ would include an element of night flying. The OMD required any of the operator’s pilots without a valid Instrument Rating (IR) to undergo a night proficiency check before operating VMC at night. Thereafter, each second proficiency check was to be conducted at night. This requirement did not apply to the accident pilot because he held a valid IR. In the preceding five years, none of the accident pilot’s licence proficiency checks or OPCs flown on the AW109 had involved any night flying. The pilot completed his AW139 helicopter type course in early 2022, the two OPCs he had undertaken on that type were conducted in a flight simulator and did include night elements. The pilot recalled previously receiving training on night operations using a NATO-T lighting system11 and being accompanied by a senior company pilot on “many of [his] first night flights in and out of sites.” He also thought it likely that he had departed from unlit HLSs at some point in his career but could not recall specific occurrences. In having flown three takeoffs and landings at night on the aircraft type and three instrument approaches in the previous 90 days, the pilot met the OMD criteria for night recency. Safety management system Through their safety management system (SMS), the operator had identified five top risks to their organisation. These included the heightened risk associated with ‘off-airfield night landings.’ While potentially implicit, the SMS did not specifically extend the scope of that risk acknowledgement to off-airfield night departures. At the operator’s ‘Flight Operations Safety Action Group’ meeting held in September 2022 it was reported that a new contractor for deployable lighting provision for off-airfield operations had been found but the new system would benefit from ‘further integration and practise before being used operationally.’ A training event for pilots and ground crews to practise the associated procedures under controlled conditions on a ‘dusk running into dark exercise’ had been booked for 25 October 2022 but was postponed due to a key participant’s illness. Footnote 11 See Airfield Information, HLS Lighting provision section.

18 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Operational oversight and commercial pressure The OMA contains a policy statement that no commercial pressure from the company, or its employees should be placed on individual aircraft commanders to undertake a particular flight. Given the nature of the company’s business, its pilots are often conducting single-pilot operations at remote locations and needing to manage customer expectations in a dynamic and pressurised, commercially competitive environment. Expectation from clients to deliver an anticipated level of service irrespective of unforeseen complications can, on occasion, be at odds with the flight safety imperative. To limit such pressure on pilots, the OMA directs that company ground operations staff should act as the primary customer interface. This responsibility starts from when tasking is first proposed. To further separate the commander from commercial pressure, ‘whenever practical,’ go/no-go decisions by pilots on live operations are communicated to customers by ground operations staff or ‘a pilot not involved in the flight.’ The OMA says that, where there is ‘the likelihood of a divert or delay,’ customers should be made aware of contingency plan options in advance to help manage their expectations during a flight. The pilot reported that delayed departures were not uncommon when undertaking corporate tasking. Pilots were often required to adopt a flexible and proactive approach to emerging problems to achieve their assigned tasking. The shooting party had not been given a latest-possible departure time and did not exert any pressure on the pilot in relation to the day’s flying schedule. Tasking and flight planning processes The OMA lists operational factors12 that should be considered during the quotation process. These areas include:

● ‘day/night considerations,’

● ‘the suitability of any unlicensed landing sites,’ and

● ‘times of sunrise/sunset if applicable.’ On receipt of a task enquiry, the operator’s ground operations department use a commercially available software planning tool (planning tool) to validate the viability of the proposed flight schedule. The intended flight routing and timings, as well as crew, passenger, and luggage weights, are input to the planning tool for it to evaluate task feasibility. The system uses detailed weight, centre of gravity (CG) and performance data for the assigned helicopter to determine limiting conditions for the tasking on a sector-by-sector basis. For each sector, the planning tool calculates a range of acceptable fuel levels for departure that would keep the helicopter within MTOW, CG and Final Reserve fuel limits. Potential exceedances, such as CG out of limits or insufficient fuel on board to complete any proposed sector, are flagged to the planner. All such exceedances require an alteration of flight parameters in the draft Footnote 12 OMA 2.3.3 Operational considerations for acceptance of a task.

19 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 plan to resolve the issue before a workable flight plan can be generated. If, for example, the revenue payload meant MTOW considerations limited the maximum fuel on board at departure to less than was required to fly the proposed sector, a reduction in payload or the addition of an intermediate refuelling stop would be required to clear the warning. Similarly, sunrise and sunset times are automatically calculated for each landing and takeoff site. Greyscale shading for each sector is used to indicate to the planner if it would be day, night, or twilight at the planned arrival/departure time. This shading is not carried over into the operator’s pilot tasking documents. Detailed lighting and fuel data could potentially be included on the pilot tasking paperwork but the operator’s version of the planning tool was not configured to do this. Planned for 15 minutes before sunset, the flight from LEA2 to Lisvane was shown as a day departure in the planning tool. Although both sites were listed as Estimated HLSs in the CLSD, and therefore day-only under OMA rules13, contingency options had not been developed to mitigate the effect of potential delays precluding a daytime departure from LEA2. From the outset, the planned arrival time at Lisvane was after nightfall14. The operator’s pilots routinely received their tasking through documentation generated by the planning tool. This typically included printed route and payload data for the assigned duty. The pilots then used third-party software on their company-issued tablet computers for detailed flight and fuel planning. Route and waypoint data could be uploaded from the planning tool directly into pilots’ tablets using a weblink. The planning tool was not configured to export WB data to the third-party software applications used by the pilots. The operator’s standard duty check-in time for pilots ahead of a flight was 30 minutes prior to departure and allowed time for final planning and pre-flight preparation of the aircraft. To give pilots more time for detailed planning, the ground operations staff would aim to send tasking documentation no later than the day prior, although this was not always possible for short-notice tasks. The pilot received the flight paperwork for the 1 November task the day beforehand and uploaded the route waypoints to his tablet computer navigation application. He reported that using this application, he calculated fuel requirements for each sector on a ‘fuel-to-fuel’15 basis. The pilot also reported being aware that sunset would be approximately 15 minutes after the scheduled departure time from LEA2. At the time, it was his understanding that the OMA alleviations for non-revenue flights could be applied to night HLS operations, thus allowing him to depart the unlit site after dark. Accordingly, he was unconcerned about a delayed departure and did not pass a last possible day takeoff time to the passengers. TEM For multi-pilot operations the acceptable means of compliance (AMC) for the inclusion of TEM16 in Crew Resource Management (CRM) training are outlined in AMC1 ORO.FC.115 Footnote 13 See Airfield information section. 14 Using the OMA definition of nightfall being 30 minutes after sunset. 15 Planning refuelling levels to ensure compliance with Final Reserve requirements for each sector. 16 The practice of planning and thinking ahead to predict/identify potential errors and threats and consider strategies to manage or mitigate those that do occur.

20 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 of 965/2012 (AMC1). A corresponding AMC for single-pilot operations is specified at AMC2 ORO.FC.115 and directs that training should focus on the elements specified in Table 1 of AMC1. TEM is included as a required topic in the ‘General principles’ section of the referenced table. The investigation noted that TEM training is a core element of the current pilot training syllabi for LAPL onwards and widely referenced in Part FCL. The operator established risk management and mitigation activities through its SMS and TEM was included in the operator’s syllabus for initial and recurrent CRM training17. The operator reported that CRM, “including TEM,” would be assessed during OPC and Line Check flights. The pilot reported that he would be expected to manage and mitigate on-the-day risks using his own judgement. For the flight from LEA2 to Lisvane he assessed the most significant threats to be the weather, and any lengthy delay that might result in an extended flight duty period or an unscheduled night stop in Cardiff. He completed a written risk assessment, as detailed in the OM Part A218, before leaving Biggin Hill. The OM risk assessment format was derived from the European Helicopter Safety Team (EHEST) Excel Tool19. The EHEST tool is intended to be completed before flight and aims to help inform pilots as to whether their planned flight is ‘safe enough to be undertaken.’ Not all the operator’s personnel fully appreciated the principle of TEM being a complimentary and proactive, flight phase-by- flight phase, tactical strategy focused on anticipating potential immediate threats to safe operation. Following TEM principles helps pilots focus on and mitigate conceivable human, technical, and environmental threats engendered by the actual conditions prevailing during the immediate phase of flight. Threats identified may be less generic or different to those identified during a pre-flight risk assessment. Survivability Crashworthiness Despite the helicopter being subject to dynamic and complex loads during the impact sequence no fuel had leaked and there was no post-impact fire. The main fuselage retained its integrity during the accident sequence and protected the occupants from external hazards.

Regulatory requirement NCO.OP.150 of 965/201220 places a requirement on the pilot in command of an aircraft to ensure that ‘prior to and during taxiing, takeoff and landing…each passenger on board occupies a seat or berth and has his/her safety belt or restraint device properly secured.’ Footnote 17 OMD 5.1: ‘Flight crew CRM training: General Principles.’ 18 OMA A2 2.4.19: ‘Helicopter Commanders Pre-Flight Checklist and Risk Assessment.’ 19 EHEST pre-departure checklist. Available at https://www.easa.europa.eu/en/downloads/23352/en [accessed 7 February 2023]. 20 Available at NCO.OP.150 Carriage of passengers (caa.co.uk) [accessed 11 January 2024].

21 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Passenger briefing The OM21 stipulates a requirement for passengers to be appropriately briefed before flight, including on the operation of ‘normal and emergency exits’ as well as ‘the use of safety belts/ harnesses.’ Because the flight was in support of the helicopter owner, who was a frequent flyer, the pilot did not consider that a refresher pre-flight safety briefing was required. He was not aware that some of the passengers had not flown in that model of helicopter before. Use of restraint devices As well as placing a responsibility on commanders to ensure that each passenger is briefed on seatbelt/harness operation before takeoff, the OM22 also requires them to ensure that each passenger has their safety belt/harness properly secured before takeoff and landing. Of the five passengers on board, four remembered not fastening their seatbelts prior to departure, it was not conclusively determined whether the fifth passenger had fastened theirs. One passenger ascribed the reason for not wearing their seatbelt to the dim lighting in the rear cabin making it difficult to locate ‘the correct belts with the necessary attachments.’ Another passenger did not fasten their seatbelt because others had not been wearing theirs on the morning flight so he chose not to for the return journey. The most seriously injured passenger had been sitting in the right rear cabin seat. The other passengers had been thrown from their seats during the accident sequence and some, if not all, had ended up on top of him. The investigation did not have supporting data to enable a determination of the dynamics of the passengers’ trajectories within the cabin from the time when the helicopter struck the trees until it came to rest on the ground. While not requested by the passengers on the accident flight, the pilot reported that, in his experience, it was not unheard of for frequent flyer corporate passengers, in the interests of expediency, to encourage flight crews to close the cabin doors and begin their pre-flight procedures as soon as the passengers were on board, rather than waiting to visually check that all seatbelts were fastened. The previous experience of one of the lead passengers was that the operator’s “pilots would always carry out a safety briefing, and included in those briefings would be the importance of wearing a seatbelt.” Weight and Balance G-RAYN had a certified MTOW of 3,175 kg. The helicopter’s empty weight was recorded as 2,269 kg when it was last weighed on 8 September 2022. The operator uses a mix of standard and actual weights for passengers, baggage and crew. For the 1 November series of flights, the weights being used were as follows:

● Crew: standard weight of pilot and personal effects, 85 kg.

● Passengers: actual weights listed on tasking sheet, total 467 kg. Footnote 21 OMA 8.2.2.2.4 Passenger Brief and OMA 8.3.16 Passenger Briefing. 22 OMA 8.3.11.2 Passenger Restraint Devices.

22 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771

● Baggage: the weight listed on tasking sheet was 25 kg but the pilot assessed the weight of loaded luggage to be 20 kg. Using the figures above, with crew, passengers and baggage, but minus fuel, the weight of G-RAYN would have been 2,841 kg. In that configuration, MTOW would have been reached with 334 kg of fuel on board. The morning flight from Lisvane took off with an indicated 380 kg of fuel, giving a TOW of 3,221 kg. At the accident site the AAIB recovered 520 litres of fuel from the helicopter’s tanks, which equated to 405.6 kg using an assumed specific gravity of 0.78. Allowing for 10 kg of unusable fuel being present in its systems when the helicopter was weighed, G-RAYN’s all-up weight at the time of the accident was an estimated 3,237 kg. The corresponding longitudinal CG position would have been 3,403 mm aft of datum (Figure 12). The pilot stated that 340 kg was his calculated startup fuel at LEA2 to remain within MTOW limits once the shooting party was on board. He was not able to provide the investigation with auditable WB calculations for the day’s flying. He had not completed a manual loadsheet load, either standalone or as part of a technical log entry for the day’s flying, and the WB function on the pilot’s software navigation application had not been changed from its default parameters23. While 965/2012 does not require it for NCO flights, OMA directs that WB documentation for all categories of flight should be retained by the company for a minimum period of three months. A review conducted by the operator, of actual vs assumed fuel consumption rates for the AW109SP, revealed that the assumed figure of 240 kg/hr for planning purposes was overly pessimistic and that 220 kg/hr was more representative. They considered that this pessimistic planning consumption rate would have contributed, in part, to the helicopter arriving at destinations with more fuel than anticipated. The OMA24 also required final WB data for all flights to be recorded on the relevant sector record page in the aircraft’s technical log. A review of G-RAYN’s technical log showed that this requirement was not always complied with for NCO flights. Additionally, during a review of technical log pages on board the helicopter at the time of the accident, it was noted the loadsheet data for sector three of G-RAYN’s flying on 2 October 2022 was incorrect. While the actual takeoff weight (ATOW) was recorded on the sector record page as 3,174 kg, the total of the masses listed for helicopter on that sector (‘APS WT, CREW, PAX, BAGS’ and ‘FUEL’) was 3,194 kg (Figure 10)25. Footnote 23 See ‘Recorded information’ section. 24 OMA 8.1.8.11.1 Mass and Balance Data and Documentation/Records. 25 2,269 + 95 + 280 + 20 + 530 = 3,194 kg.

23 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Figure 10 Extract from G-RAYN’s technical log sector record page for 2 October 2022 Helicopter performance Hover attitude The helicopter manufacturer performed a simulation based on the accident takeoff weight, CG, and wind conditions, to establish the pitch and roll attitude, and engine torque necessary to have maintained a stationary hover. This showed the required pitch attitude was 4.0° nose-up and, depending upon being in or out of ground effect, the required roll attitudes and power settings were 3.3° and 3.8° left bank and 81% and 95% torque, respectively. The manufacturer also performed simulations to establish if the helicopter could maintain a stationary hover when the pitch attitude was at 7° nose-up, as recorded during the accident takeoff. This showed that at the MTOW of 3,175 kg it was possible, but the CG would need to be set at 3,583 mm which would be outside the certified longitudinal envelope (Figure 11). With CG set at 3,430 mm, the maximum longitudinal aft position for the helicopter at MTOW, it was not possible to maintain a stationary hover with a pitch attitude of 7° nose-up. Another simulation using the recorded pitch and roll attitude, heading and collective position was performed for the weight and CG calculated for the accident takeoff. The manufacturer concluded that, based on the accident data, the helicopter would not have maintained a steady hover position, but would have moved rearwards while also climbing.

24 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Figure 11 Weight and longitudinal CG envelope for G-RAYN Performance Classes Under the aviation regulatory framework, operational regulations are specified according to the single engine failure capability of a helicopter in a defined area of operations. These are designated as Performance Classes.

● In areas where Performance Class 1 (PC1) operations are planned the helicopter must be able to safely continue the flight or land within the rejected takeoff or landing area.

● Performance Class 2 (PC2) requires that the helicopter should be capable of either being safely flown away or executing a forced landing during takeoff and landing.

● Performance Class 3 operations are those where, should an engine fail, a forced landing will be required. Performance class compliance for routine operations Notwithstanding the OMA day-only restriction on LEA2, the physical characteristics of the site would, under the OMB criteria26, have allowed the commander to depart using helicopter PC2 criteria. Nonetheless, the pilot elected to conduct a Category A vertical Footnote 26 OMB Part B2 Section 4.2 Performance Applicability – General Operating Restrictions.

25 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 takeoff profile (Figure 12) which was compliant with PC1 operations and described in the RFM27. This was in line with the OMB direction28 that ‘the Commander shall endeavour to operate the helicopter in [PC1] whenever possible thereby maximising the safety margin for the passengers at all times.’ Due to the presence of trees behind the helicopter, the pilot elected to fly a vertical rather than ‘back-up’ procedure which would have required an initial rearward climbing flightpath (Figure 14). Figure 12 Overview of Category A ground level vertical departure profile Figure 13 Overview of Category A ground level back-up takeoff procedure Footnote 27 AW109SP RFM Supplement 4 Part E CAT A Operations, Ground Level Heliport. 28 OMB Part B2 paragraph 4.2.3.

26 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 The pilot’s experience was that, after power was applied to commence the climb for a vertical departure, the AW109 type was very stable and would invariably climb vertically with little longitudinal drift. For Category A ‘back-up’ procedures, the pilot reported needing to apply a conscious and positive pitch up to initiate the necessary rearwards movement. He did not recall making a positive pitch up of that nature during the accident flight takeoff. Based on previous experience, he estimated that he would have needed to hold approximately 5° nose-up to maintain his longitudinal position in the hover. A comparison between the recorded pitch attitudes and groundspeeds during the Category A back-up departure flown from Lisvane that morning and the attempted vertical departure on the accident flight is shown below (Figure 14). Other than the temporary reduction in pitch attitude as the pilot turned into wind at LEA229 the pitch attitude profiles are broadly similar. The takeoff from Lisvane was a crosswind departure, whereas the helicopter was experiencing a headwind as it climbed from LEA2, this could explain the difference in rearward ground speed acceleration rates observed beyond the 20 second point on the Figure 15 chart. Figure 14 Comparison of Lisvane (blue) and accident flight (red) Category A departures

Footnote 29 Between 10 and 15 seconds on the chart and described fully in the Recorded information, Data interpretation section.

27 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Meteorology The conditions in the vicinity of Llanelidan during the period of 0700-1900 UTC on the day of the accident were generally fine with good visibility, however, occasional showers throughout the period reduced reported visibility to between 8,000 and 9,000 m. Surface winds were recorded as being generally west-south-westerly at 5-11 kt. At the approximate time of the accident RAF Shawbury, 28 nm east-south-east of LEA2, was reporting 1-2 oktas of cloud at 2,200 ft with complete cloud cover at 4,000 ft. At the same time, Hawarden, 15 nm east-northeast of LEA2, was reporting light rain with 3-4 oktas of cloud at 2,400 ft and 5-7 oktas of cloud at 3,700 ft. Visibility in that light rain had reduced to 8,000 m, previously it had been reported as ≥10 km. The reported weather was above the OMA minimum requirement for night VFR flights by pilots holding a valid IR, of 3,000 m visibility and cloudbase 1,200 ft above nearby terrain. The pilot recalled that when he walked to the helicopter for the accident flight, “the rain had all but stopped and the wind had died off to a gentle westerly breeze.” Met Office data indicated that on 1 November 2022, local sunset at LEA2 was 1645 hrs. The end of official evening civil twilight would have been approximately 1718 hrs. Airfield information The operator’s OMA refers to an unlicensed heliport as an HLS. HLSs could be heliports intended for regular use, with a Final Approach and Takeoff area (FATO) in place, or ad hoc ones using an area of ground that has been assessed or surveyed as suitable for the purpose. Pre-approved HLSs are listed in the CLSD. A standard CLSD entry would include site details, such as contact and navigational information, as well as mapping and imagery of the landing area. The final page of a CLSD entry is titled ‘Area Survey (If Applicable)’ and includes a table on which the nature, location and height of relevant surveyed obstacles can be listed. Depending on the degree of prior surveying that has taken place, a site is assessed as falling into in one of the operator’s three HLS categories: Surveyed, Measured or Estimated. The three categories allow a degree of operational flexibility to use unlicensed and ad hoc HLSs, balancing operational imperative against the time available for pre-survey of a site. The OMA directs that, where ‘time permits and an existing acceptable site survey report is not available the site should be surveyed in accordance with the procedures described at [OMA] paragraph 8.10.5.’ The OMA also highlights that ‘the Company has a duty of care to both the crew and the passengers to pre-survey sites prior to use whenever operationally possible.’ Only once the appropriate procedure, as described at OMA 8.10.5 has been carried out, can an HLS be considered for categorisation as a Surveyed site.

28 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 The HLS categories have different operating restrictions. For example, Surveyed sites can be used at night subject to certain caveats, but Measured and Estimated HLS ‘may be used by Day only.’ The overall length (D) of the AW109SP type including the rotor is 12.96 m. The OMA requires that for day operations, the touchdown and lift off (TLOF) area of an HLS must be at least the larger of twice the helicopter length, (ie 2D) or the minimum heliport/helipad size detailed in the approved helicopter flight manual. For night operations the TLOF must be at least four times the helicopter length (ie 4D) or 110 m x 60 m, whichever is the greater. For the AW109SP, 4D is approximately 52 m so for night HLS operations the minimum acceptable TLOF area of 110 m x 60 m applies. The Limitations section of the AW109SP RFM30 did not detail a minimum heliport/helipad size. CLSD entries for Lisvane and LEA2 On the flight paperwork provided to the pilot, the Lisvane and LEA2 CLSD entries were both depicted as having been created on 25 March 2019. Comparing the entries for Lisvane and LEA2 revealed discrepancies in presentation and approval status (Figure 16). While Lisvane was listed as an Estimated HLS, the CLSD appeared to give approval for both day and night operations. This was in contradiction with the generic ‘use by day only’ OMA restriction for other than Surveyed sites. Additionally, at 107 m x 93 m, the longest dimension quoted in the CLSD for Lisvane was below the OMA requirement of 110 m x 60 m for a night HLS. LEA2 was listed as an Estimated HLS and the ‘Day/Night’ box only contained a dash symbol rather than an explicit ‘day’ or ‘day and night’ annotation. The investigation also noted the CLSD categorised sites as Estimated, Measured and Full rather than Estimated, Measured and Surveyed. Neither CLSD entry contained detailed obstacle or obstruction data, although adjacent power lines were depicted on satellite imagery of the Lisvane site. Nonetheless, the pilot was aware of the presence of trees at the LEA2 site and was familiar with the Lisvane HLS. Information later provided by the operator revealed that Lisvane had been surveyed for night operations on 28 January 2017. The relevant details were recorded in their legacy CLSD which was superseded in 2019 (Figure 15). The Lisvane survey details not been transposed to the new format CLSD. On the 2017 CLSD entry, the site dimensions for Lisvane were recorded as 93 m x 48 m. Footnote 30 AW109SP RFM (Document N°109G0040A018) Section 1.

29 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Figure 15 Extract from CLSD entries for Lisvane and LEA2

30 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 HLS lighting provision Given the restriction on use by day only, no minimum lighting standard was specified for an Estimated HLS. The operator’s minimum lighting standard31 for night flights at Surveyed HLSs was: ‘(i) A dedicated lighting system that clearly defines the TLOF and all obstacles in the approach/departure paths. or Secondary lighting from surrounding buildings and structures such that the TLOF/FATO is easily defined and surrounding critical obstacles in the approach/ departure paths can be easily seen. or Mobile lighting or mobile floodlights.’ The lighting at LEA2 on the evening of the accident flight did not meet the above criteria. For pre-planned night operations at an HLS without an established lighting system, the operator had engaged a third-party contractor to deploy suitable lighting. The preferred solution was a set of portable lights laid out in the NATO-T lighting configuration as shown below in Figure 16. Deployable lighting had not been requested to support the accident flight. Figure 16 Depiction of NATO-T lighting layout A note in the Site Description section of the Lisvane CLSD entry stated that helipad lights had been installed at the HLS but remained ‘untested.’ The date of that observation was Footnote 31 OMA 8.10.5.5.2 Lighting.

31 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 20 January 2017 (Figure 17). The arrival at Lisvane had been planned for 1715 hrs, a night arrival based on the OM definition of night starting 30 minutes after sunset. Prior to boarding the helicopter, its owner informed the pilot that he had turned the Lisvane helipad lights on using an application on his mobile phone. Figure 17 Note referring to lighting installation at Lisvane While on the ground at LEA2, the pilot had visually assessed the site as being suitable for the intended flight but had not completed the full site survey process as described in the OMA. Personnel The pilot began his flying career in 2000 and had been employed by the operating company for more than five years at the time of the accident. He had over 1,500 hours flying time on the AW109 type although only a small proportion of which were on the AW109SP variant. The pilot’s licence and medical were valid for the flight and he held a current IR. He completed his AW109 OPC the day before the accident and reported being in good health and sufficiently rested when he attended for duty on 1 November. Tests and research Fuel system Due to the necessary disruption of the aircraft and fuel system during the recovery process it was not possible to perform an end-to-end test of the fuel system to prove it’s serviceability. However, a key component of the system, the FCU, was removed and tested at the manufacturer’s facilities in France. Testing of the FCU showed it to be serviceable and in good condition. The data from the DAU download was also examined for evidence of fuel system faults present prior to the estimated time of impact with the trees. No fault codes relating to the fuel system could be identified in the data. Examination of the aircraft logbooks revealed no indications of anomalies or faults with the fuel system reported by crews on the flights prior to the accident. Flight Control Computer The Flight Control Computer (FCC) was removed from the helicopter and taken to the manufacturer in France for testing. The FCC was subjected to visual inspections, automatic bench testing and supplementary manual testing. All but one test point was passed, the failed test point related to the Channel 1 Coupling light CPL indication. There was no

32 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 evidence that this indication light fault was present at the time of the accident. But as the output was indication only and did not influence command of the autopilot modes this was considered to not have been relevant to the accident sequence. Engine DCUs Data was successfully extracted from the engine DCUs. From this information it was established that both the engines were serviceable and performing normally prior to the accident. Fault codes were seen on the system but these were attributable to the high resistance forces exerted on the rotor drive system during the impact with the trees. Other information Hover references Helicopter pilots use visual references, referred to as ‘markers,’ to maintain a stable position over the ground. By picking suitably visible objects when the helicopter is established in the desired location, pilots can detect, and correct, any drift away from the target position by reference to the alignment of their markers with other objects or the cockpit structure. Normally, a distant forward marker would be used to assess heading and lateral drift, while a distant lateral marker is used to detect longitudinal drift (Figure 18). Pilots would also generally choose a close-in lateral marker for height assessment and fine position keeping. Figure 18 Distant forward and lateral markers Heading changes affect the angular orientation of markers relative to the helicopter’s longitudinal and lateral axes (Figure 19). In a degraded visual environment without two usable distant markers, it is more challenging to correctly determine if the change in marker orientation results from positional rather than heading drift.

33 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Figure 19 Heading change perceived as positional drift Visually acquiring suitable markers at night is challenging unless they are lit, there is sufficient cultural or environmental lighting (eg moonlight on a clear night) for objects to be easily seen with the naked eye or the pilot is using a night vision device. In conditions of limited visibility, such as when relying on illumination from a helicopter’s external lights, pilots are more likely to pick a single identifiable ground feature close to the cockpit to use as their primary hover reference. The downward sightline from the pilot’s eyes to the feature means that, if it is maintained in the same relative position when lifting, the helicopter will naturally move up and rearwards as the pilot maintains that fixed sightline (Figure 20). Without an adequate distant lateral marker any consequential rearward movement is more difficult to detect visually. The investigation heard that, at night on an unlit site, a searchlight beam directed to a close-in reference 30-60° either side of the helicopter’s nose offers greater opportunity to detect rearward drift than one directed straight ahead. Figure 20 Extended sightline from close-in ground level markers At the time of departure on the accident flight, it was dark with overcast cloud and little cultural lighting other than that from the lodge’s windows. The pilot was not using a night vision device and the portable HLS lighting system had not been deployed.

34 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Analysis Aircraft serviceability Extensive inspection and examination of the helicopter, component level testing and examination of maintenance records was undertaken to determine if there were any technical factors that were causal or contributory to the accident. The extensive damage to the helicopter was determined to be due the impacts during the accident sequence. While end-to-end testing of systems such as the fuel system was not possible, the manufacturer analysis of key components such as the FCC, FCU and DAU showed that the aircraft systems were functioning correctly prior to the accident. The maintenance records showed that the helicopter had been correctly maintained. The investigation concluded that the helicopter was serviceable at the time of the accident. NCO and OM compliance The reported cultural misunderstanding regarding the status of ‘private’ flights, those conducted on behalf of owners flying in their own aircraft, led to the helicopter being flown outwith the OM restrictions for Estimated HLSs. The legacy term ‘private flights’ is no longer used by the regulator; such flights now fall under the remit of Part NCO. For those elements of the accident flight which took advantage of the less-restrictive Part NCO regulations, the associated enhanced protections established in the OM were not in place, negating safety barriers that might have prevented the accident. To reduce the opportunity for future confusion amongst its pilots over the applicability of OM restrictions for any flight being undertaken, as a safety action: The operator had amended their OM, flight documentation, and aircraft technical log sector record pages, to provide greater clarity on who, operator or owner, holds the duty of care and regulatory compliance oversight responsibility for the flight, or series of flights, being undertaken. Flight tasking and planning G-RAYN’s tasking for the 1 November series of flights was generated in response to the helicopter owner’s request for return flights for five passengers between Lisvane and LEA2. The operator’s ground operations staff followed their normal processes, using their planning tool to validate task feasibility before accepting the request. The OMA required planners to consider day/night implications and the suitability of landing sites ‘during the quotation process.’ Both LEA2 and Lisvane were listed as Estimated HLSs in the CLSD and, therefore, night operations at them were not permitted by the OMA. The departure from LEA2 was scheduled for 1630 hrs, 15 minutes before sunset. The evening arrival and departure at Lisvane were planned to occur at night. A departure from LEA2 before 1715 hrs would have been classed as a daytime takeoff, and thereby compliant with the OMA day-only restriction on Estimated HLSs. The tasking documentation generated for the pilot did not include sunset times, neither did it outline any contingency planning considerations for a delayed departure from LEA2.

35 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 While Lisvane had been surveyed in 2017 and approved for day and night flights, incomplete transfer of data to the extant (2019) version of the CLSD meant the survey details were not included in the accident pilot’s tasking documentation. The discrepancy between the 2019 CLSD’s Estimated HLS categorisation for Lisvane and its ‘Day + Night’ status had not been resolved in the intervening period leading up to 1 November 2022. On both versions of the CLSD, the reported dimensions of the landing site were less than the OMA-specified minima of 110 m x 60 m for a night HLS. The CLSD entry for LEA2 was potentially ambiguous regarding day/night status. While the pilot was aware of the sunset time at LEA2, he was under the misapprehension that the OMA allowed him to depart from LEA2 at night because he was operating a non- revenue, private flight. The OMA specifically stated that no deviation from CAT criteria could be applied to night HLS operations, regardless of flight category. The operator has since undertaken to work with the developer of the planning tool to explore the possibilities for further exploiting the tool’s capabilities for increasing operational oversight and providing additional information to pilots through enhanced tasking documentation. As a safety action, the operator had issued additional instructions to their pilots regarding the process for updating site entries and were working with the planning tool’s developer to align the CLSD management protocols and templates to their requirements. Decision making and commercial pressure The existence of the OMA derogations for certain aspects of non-revenue operations and contradictory entries in the CLSD contributed to the pilot’s misinterpretation of company regulations. Believing he could waive the day-only restriction, as the scheduled 1630 hrs departure time approached, the pilot saw no need to hurry the passengers. They did not apply pressure on him to delay the flight. While not an explicit factor in this accident, commercial and customer pressure is an unavoidable element of corporate helicopter operations. The operator had established procedures to alleviate pressures on individual pilots, whereby difficult conversations with customers would be the responsibility of duty managers. The judgement of when to refer to a duty manager was subjective, rather than objective. Inevitably, successful operations delivering client satisfaction require a flexible and proactive approach by pilots in command who are directly responsible for delivery of an expected level of service. Continually exposed to this operational environment, the danger is that pilots become acclimatised into an excessively ‘can do’ mindset where the balance of what is possible versus what is appropriate becomes tilted toward a more risk-tolerant approach. The operator declared an intent to review the scope and suitability of training for handling commercial and customer pressure currently provided as part of its recurrent CRM syllabus.

36 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 TEM The investigation found that, while TEM was included in the CRM training syllabus for the operator’s flight crew, the level of understanding of how it could be used to best effect was not fully appreciated across the organisation. While the pilot identified weather and delays as holistic threats for the flight from LEA2 to Lisvane, a more effective TEM strategy would have focused on the specific threats for each phase of the flight. For the accident flight takeoff, significant threats were the degraded visual environment coupled with a lack of HLS lighting, the presence of trees behind and relatively close to the helicopter, and the westerly wind blowing toward the trees. These combined threats gave rise to the potential error of an inaccurate hover leading to reduced separation from the treeline. The investigation considered that had the pilot been habituated to employing TEM in a more focused way he might have been more effective in identifying and proactively mitigating the takeoff threats. The operator declared an intention to issue enhanced guidance to their personnel on the implementation of TEM, from initial planning by ground operations staff through to sector- level considerations for pilots. The intent would be to include guidance for both single and multi-pilot operations as well as suggested mitigations for known general threats. Once codified within the OM and the SMS, the policy would be referenced during training, checking and auditing activities. Accident flight departure Having flown into the site during the day, the pilot was aware of the presence of trees to the east of the landing site. To meet the OMA intent of operating to PC1 standards whenever possible, he planned for a vertical Category A departure as a precaution against engine failure. While night had fallen when he took off, the pilot assessed that he had sufficient visual references to safely conduct the intended departure manoeuvre. He described using light from the lodge’s windows as his lateral marker and establishing a forward visual reference with the aid of the controllable searchlight. As the helicopter lifted into the hover, the lodge’s windows would have been in the helicopter’s approximate 3 o’clock position, in line with the pilot’s shoulders. Having turned into wind, the chosen lateral markers would have become more difficult to see, the pilot needing to look back over his shoulder to see the lights, approximately 30° behind his shoulder line (Figure 21). The lights’ change in relative position would have made it harder to discriminate between real and apparent drift, degrading their usefulness as markers. As the helicopter translated rearwards the lights would have appeared to move closer to their original orientation in the pilot’s 3 o’clock position.

37 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Figure 21 Representation of pilot’s sightline to lodge windows during departure (image © 2023 Getmapping plc) During the time from lift off until the pilot committed to the climb the helicopter’s attitude rose to 6° nose-up and G-RAYN was already moving rearward toward the trees before the attitude stabilised at approximately 7° nose-up. While the pilot reported having a “vague, but usable, horizon” ahead, he had not intended to use, nor appreciated, the amount of nose-up attitude selected. That the attitudes flown were similar to those used to generate the rearward trajectory for the earlier departure from Lisvane, indicates the external references available to the pilot were insufficient for accurate visual assessment of the helicopter’s pitch attitude. G-RAYN’s rearward drift was consistent with that predicted by the manufacturer’s performance modelling based on the helicopter’s recorded nose-up attitude and CG32. The investigation considered that, in twisting to look at the lodge lights, the pilot may have inadvertently applied increased rearward pressure on the control column, contributing to the higher than intended nose attitude. The investigation also considered it likely that, having the searchlight beam directed ahead of the helicopter made it more difficult to assess rearward movement by reference to sightline shift from a close-in marker. Having the searchlight beam directed 30-60° right, rather than straight ahead, could have aided detection of longitudinal drift. Training to depart from an unlit HLS might have helped the pilot avoid these pitfalls, nonetheless, the operator’s chosen mitigations were to prohibit night operations at Estimated HLSs and to stipulate a minimum lighting standard for Surveyed sites. Following this accident, the operator intended to investigate the potential for pilots to practise night takeoffs, with environmental lighting conditions “near to official dark” in a flight simulator where one is “available and capable of this training.” Footnote 32 Albeit modelling weight set to MTOW limit of 3,175 kg.

38 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Survivability The specific crashworthiness features introduced on the AW109SP appeared to function well. There was no fuel leak and no post-crash fire and the structural integrity of the main crew and passenger compartments were not breached. This reduced the severity of risk and protected crew and passengers against more severe or even lethal post-accident consequences in what was considered a survivable accident. The pilot had not delivered a passenger safety brief for either flight and had not confirmed that all passengers had fastened their seatbelts prior to the departure from Lisvane or on the accident flight. Most, if not all, of the passengers were unrestrained on the accident flight. The investigation did not have data to support a detailed analysis of how the wearing of seatbelts would have affected the injuries sustained by the passengers during the accident sequence. Ensuring that passengers are appropriately briefed and seated with harnesses secure is a regulatory obligation placed on aircraft commanders. Following this accident, the operator undertook to review different methods of delivering passenger briefings and any training that might be required to support a change in methodology. The operator had taken specific safety action to remind pilots that, irrespective of a passenger’s previous flying experience or status, safety briefings and a check of seatbelt/ harness security must be carried out for every flight, as per the OM. Weight and balance Although not a causal factor, G-RAYN was above the RFM MTOW limitation of 3,175 kg when it took off on the accident flight. It had also been above the MTOW limit when it departed Lisvane that morning. While he reported for duty ahead of his nominated check-in time, the pilot was distracted by the unanticipated conversation with his bereaved colleague and had not opened a tech log entry for the day’s flying. No auditable WB calculations for the day’s flying were provided to the investigation. Data from the software navigation application on the tablet device the pilot was using for the flight showed that the WB function had not been accessed on any of the sectors. The application remained set at its default parameters, which would have generated a CG warning if checked. Using the tablet-based software navigation application’s WB function or completing the tech log SRP loadsheet prior to each sector could have been a barrier to the aircraft taking off above MTOW. While the OMA required the SRP loadsheet to be completed for all flights, this requirement was not always complied with for NCO flights. One instance of the SRP loadsheet being incorrectly calculated was found in the tech log recovered from the aircraft.

39 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Exporting acceptable sector fuel ranges, as automatically calculated in the planning tool, to the pilots’ tasking paperwork could have been another barrier against MTOW exceedances resulting from excess fuel on board. The investigation was not able to resolve the discrepancy between the pilot’s recollection of the weight of fuel on board at takeoff and the physical quantity recovered from G-RAYN at the accident site. Data recovered from the helicopter indicated that its fuel displays would have been showing a combined total of just above 400 kg as G-RAYN lifted from LEA2. In December 2022, the operator issued an internal Flying Staff Instruction to remind all pilots that the load sheet section of the technical log sector record page must be completed for every sector on all flights, including NCO. They also amended the default WB configuration in the pilot’s software planning application and undertook a review of representative fuel burn rates to be used for flight planning purposes. SMS The risk of night off-airfield landings had been identified as one of the operator’s top risks in their SMS. There was no explicit mention of the risks associated with night off-airfield takeoffs but in many regards the risks could be directly read across. The operator commented that they had been unable to find an authoritative guide to the specifications for, and procedures for using, a NATO-T lighting array. Safety actions taken by the operator to further manage the risk of night off- airfield night operations were as follows:

● A new Integrated Management System was developed to improve operator processes for the management of hazards. This included a new generic risk assessment for off-airfield night operations that explicitly covered both night landings and night takeoffs.

● In November 2022 an FSI was issued to re-iterate the requirements for night off-airfield operations. This was subsequently incorporated into the OM.

● Deployable lighting sets were procured for use on flights where there was an identifiable risk of an unscheduled night takeoff resulting from a delay to the planned programme.

● Landing site risk was added as an additional criterion in the OM pre-flight risk assessment tool, with night off-airfield operations attracting the highest risk factor loading. Training ORO.FC.202(b) did not explicitly mandate that pilot recurrent checks should contain an element of night flying but did require such checks to be conducted ‘in an environment representative of the operation.’ The regulator’s interpretation was that for operators undertaking night flying operations, ‘an environment representative of the operation’ would include night flying elements.

40 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 The operator had not inferred from ORO.FC.202(b) that their instrument rated pilots were required to undergo any form of recurrent night proficiency training or checking. The accident pilot held a valid IR and none of his recurrent proficiency checks on the AW109 type included an element of night flying. The pilot could not recall having been trained or checked as proficient to operate from an unlit HLS at night during his employment with the operator. The operator’s Safety Action Group had identified a training need for operations utilising its contracted portable HLS lighting system but an illness-related delay meant the planned training had not been completed before the accident occurred. The operator took safety action to instigate an annual night flying training programme for all its onshore charter pilots (employees and contractors). The programme’s syllabus specified theoretical training on night procedures and site surveys as well as a flying element to include night takeoffs and landings using a NATO-T lighting array. The first iteration of this training programme was conducted in November 2022. Conclusion The accident resulted from the undetected rearward transition of the helicopter into a stand of trees during a planned vertical departure at night from an unlit HLS. No causal or contributory technical factors with the helicopter were discovered. The investigation identified several barriers that were either breached or not present which might have prevented this accident. Contradictory and potentially confusing CLSD entries and differing requirements for CAT and non-revenue flights, combined with colloquial legacy terminology, offered an opportunity for misinterpretation over the applicability of the OMA restrictions at the HLSs being used on the day. Opportunities were also missed during the planning process to anticipate and develop proactive mitigation strategies for delays to the published flight schedule. There was an air gap of information where data such as sunset time and acceptable sector fuel loads were available in the operator’s planning tool but not presented to the pilot. Distraction and time pressure contributed to the pilot not completing auditable WB calculations which could have alerted him to the potential for MTOW exceedances. Offloading planning tasks from pilots to the planning tool could have reduced their pre-flight workload, thereby releasing capacity in a time-pressured operation. The pilot could not recall having been trained to takeoff from an unlit HLS but judged there to be sufficient lighting for his intended departure. Even with the helicopter’s external lights to aid vision, the “vague horizon” and lights from the lodge windows proved inadequate visual reference for the pilot to detect unintentional rearward drift during the climb. The pilot’s focus on delivering the expected service to the clients, despite the challenges posed by a night departure from an unlit site, was indicative of an insidious acclimatisation to risk engendered by long term exposure to the nature of commercial and corporate charter operations.

41 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 Acclimatisation to risk is not the sole purview of pilots. For owners and frequent flyer passengers, or those focused on time pressures, it is tempting to see safety briefings and seatbelts as an unnecessary encumbrance. Nonetheless, it is important that all parties realise an aircraft commander is under a legal obligation to ensure passengers are appropriately briefed and have their harnesses secure for all takeoffs and landings. A shared understanding of this obligation is key to expectation management in this regard. Effective TEM could have provided an additional safety barrier for the accident flight. Safety Actions Following the accident, the operator took the following safety actions. They:

● Amended their Operations Manual, flight documentation, and aircraft technical log sector record pages, to provide greater clarity on who, operator or owner, holds the duty of care and regulatory compliance oversight responsibility for the flight, or series of flights, being undertaken.

● Issued additional instructions to their pilots regarding the process for updating company landing site directory entries and are working with the planning tool developer to align the directory management protocols and templates to their requirements.

● Reminded pilots that, irrespective of a passenger’s previous flying experience or status, safety briefings and a check of seatbelt/harness security must be carried out for every flight.

● Issued an internal Flying Staff Instruction to remind all pilots that the load sheet section of the technical log sector record page must be completed for every sector on all flights.

● They also amended the default weight and balance configuration in the pilot’s software planning application and undertook a review of representative fuel burn rates to be used for flight planning purposes.

● Developed a new Integrated Management System to improve operator processes for the management of hazards. This included a new risk assessment for off-airfield night operations that explicitly covered both night landings and night takeoffs.

● Issued a Flying Staff Instruction in November 2022 to re-iterate the requirements for night off-airfield operations.

● Procured deployable lighting sets for use on flights where there was an identifiable risk of an unscheduled night takeoff resulting from a delay to the planned programme.

42 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-RAYN AAIB-28771 I

● Instigated an annual night flying training programme for all its onshore charter pilots (employees and contractors). The programme’s syllabus specifies theoretical training on night procedures and site surveys as well as a flying element to include night takeoffs and landings using a NATO-T lighting array. The first iteration of this training programme was conducted in November 2022.

● Added landing site risk as an additional criterion in the OM pre-flight risk assessment tool, with night off-airfield operations attracting the highest risk factor loading. Published: 18 April 2024.

FD06656 ｜ 2019_英国_aaib-investigation-to-aw109sp-grandnew-g-frrn__AW109SP_GrandNew_G-FRRN_03-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

111 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-FRRN EW/G2018/11/06 ACCIDENT Aircraft Type and Registration: AW109SP GrandNew, G-FRRN No & Type of Engines: 2 Pratt & Whitney Canada PW207C turboshaft engines Year of Manufacture: 2017 (Serial no: 22371) Date & Time (UTC): 19 November 2018 at 0902 hrs Location: London Heliport (Battersea) Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Damage to rotor brake requiring replacement Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 71 years Commander’s Flying Experience: 14,142 hours (of which 391 were on type)

Last 90 days - 55 hours

Last 28 days - 3 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis The pilot was starting the helicopter in order to depart from the heliport before it closed. Having completed his checks and been given permission to start, the pilot started the No 1 engine. He was alerted by the marshaller and by ATC that smoke was coming from the rotor head. He shut down the engine and, whilst completing the checks, noticed that the rotor brake was on. History of the flight G-FRRN had flown from Denham Airfield to London Heliport, Battersea arriving at 0854 hrs. The helicopter had been flown into the heliport by another pilot with the incident pilot sitting in the left seat. After the helicopter had been shut down and the passengers and the other pilot had disembarked, the incident pilot moved to the right seat in preparation for the flight back to Denham. The incident pilot was told by the controllers at the heliport that it would shortly be closing due to a requirement for ATC breaks. There would be a wait of 30 minutes unless G-FRRN could depart before the closure. The pilot decided that it would be best to depart before the heliport closed and began to complete his before start checks. The pilot was given permission to start from ATC once another helicopter had parked on the adjacent landing spot. As engine No 1 started and the rotors began to turn, the pilot was

112 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-FRRN EW/G2018/11/06 alerted by the marshaller and ATC that smoke was visible from the top of the helicopter. He immediately shut down the engine thinking that he had an engine fire. He was about the dry-crank the engine to dissipate any residual fuel when he noticed that the rotor brake was on. The heliport fire service and the local fire brigade attended the scene, and it was soon clear that there had been no fire; although parts of the rotor head were hot. After opening all the cowls the temperature decreased and the helicopter was moved from the parking spots. Examination by the maintenance organisation found the helicopter to be largely undamaged except for the rotor brake system, which was replaced before the helicopter was returned to service. Helicopter information The AW109SP is a modern, four-bladed helicopter with a fully articulated main rotor. It is designed to be operated by a single pilot but has dual cockpit controls. With a fully articulated rotor system, each rotor blade is attached to the rotor hub by a series of hinges which allow the blade to move independently. The rotor brake, which is fitted to allow the blades to be stopped more rapidly after engine shutdown, is a hydraulically operated calliper acting on a disc secured to the tail rotor drive pinion. The rotor brake handle is in the centre overhead console of the flight deck on the left of the engine control levers and, with the rotor brake off, the handle is fully forward. There is no requirement to have the rotor brake on when the aircraft is parked unless there is a very strong wind. As part of the pre-start procedures the rotor brake is applied to check that a yellow caution message, rotor brake, illuminates. The message indicates that the rotor brake lever is not in the off position or that the rotor brake system is degraded. The rotor brake is not to be applied when the rotor rpm, NR, is greater than 40%. When the rotor brake is on or the brake pads are not in the fully retracted position, a red message, rotor brake on, appears on the right electronic display unit in the centre of the instrument panel. Some helicopters have a sensor in the rotor brake system (such as in the lever itself) to prevent starting with the rotor brake on, but no such system is fitted to this helicopter type. Human factors The AW109SP is designed to be flown by a single pilot and the checks are generally performed from memory without reference to a written checklist. The incident pilot did not tend to leave the rotor brake on after shutdown, selecting it off once the rotors stopped. The pilot who flew G-FRRN into Battersea tended to leave the rotor brake on after shutdown. With the checks before start completed rapidly from memory, the incident pilot missed the fact that the rotor brake was on because he was not expecting to see the handle in that position. The rotor brake handle can be difficult to see from the right‑hand seat because it is partially obscured by the engine control levers.

113 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-FRRN EW/G2018/11/06 Analysis The pilot was keen to depart from the heliport before it closed. Although checking the disengagement of the rotor brake was part of the before start checklist, it was not the pilot’s usual practise to leave it on. The checks were completed from memory, with time pressure to start and take off as soon as possible. The helicopter is not designed with a system to prevent the pilot starting the engine with the rotor brake on, and the rotor brake lever can be difficult to see from the right seat. The pilot did not notice that the rotor brake was on before he started the first engine. The attentiveness of the marshaller and ATC personnel meant that the pilot was alerted quickly to the smoke coming from the rotor head. He rapidly shut down the helicopter which probably prevented much greater damage. Conclusion A combination of factors led to the pilot starting an engine with the rotor brake on. The helicopter was not fitted with any system that would have stopped the engine starting, although a caption would have been visible on the electronic display on the instrument panel.

FD06657 ｜ 2019_英国_aaib-investigation-to-boeing-747-443-g-vroy__Boeing_747-443_G-VROY_05-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

34 © Crown copyright 2019 All times are UTC AAIB Bulletin: 5/2019 G-VROY EW/G2018/11/08 SERIOUS INCIDENT Aircraft Type and Registration: Boeing 747-443, G-VROY No & Type of Engines: 4 General Electric CF6-80C2B1F turbofan engines Year of Manufacture: 2001 (Serial no: 32340) Date & Time (UTC): 20 November 2018 at 1850 hrs Location: London Gatwick Airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 18 Passengers - 398 Injuries: Crew - None Passengers - None Nature of Damage: Heat damage to flap track fairing, various access panels and inboard flaps Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 48 years Commander’s Flying Experience: 13,238 hours (of which 7,255 were on type)

Last 90 days - 156 hours

Last 28 days - 53 hours Information Source: Aircraft Accident Report Forms submitted by the flight crew Synopsis During engine start there was a fire in the No 2 engine tailpipe. The ground crew alerted the flight crew who extinguished the fire using the relevant checklist. The aircraft returned to the stand and all the passengers were disembarked. Despite examination and testing of various engine control units and valves by their manufacturers, no faults could be found and all the equipment operated within normal parameters. History of the flight G-VROY had recently undergone heavy maintenance overseas and its first revenue flight was London Gatwick (LGW) to Orlando (MCO). The aircraft was pushed back from the North Terminal, Stand 566 and the engines were started. All flight deck indications were normal until part way through the start sequence for engine No 2, when the groundcrew engineer alerted the crew to flames coming from the engine tailpipe. The fuel control switch was selected to cut off, the QRH (quick-reference handbook) drill fire engine tailpipe was completed and no temperature exceedances were reported. The airfield fire crews arrived on site shortly after the fire had been extinguished. The remaining engines were shut down and the aircraft was towed back onto the stand for the passengers to disembark.

35 © Crown copyright 2019 All times are UTC AAIB Bulletin: 5/2019 G-VROY EW/G2018/11/08 Aircraft examination There was evidence of heat damage on the adjacent flap track fairing, several access panels and the inboard flaps. Structural inspections were performed, with no significant findings. Cosmetic repairs and replacements were completed as required. The quick-access recorder (QAR) data was analysed and prior to engine No 2 compressor rotation there was a large fuel demand (119% compared to 11% for the other engines) through the fuel metering valve (FMV). The hydro-mechanical unit (HMU) was removed from the aircraft and sent to the manufacturer for analysis. The unit was found to perform within expected limits. Various other valves and controllers were removed and returned to their manufacturers for analysis, also with no faults found. All work undertaken during the preceding heavy maintenance period was checked and no faults were found. Discussion Despite the strip, examination and testing of various valves and controllers for the incident engine, no faults could be found to explain the increased fuel flow recorded in the QAR data. The high fuel flow rate into the combustion chamber during engine start would almost certainly lead to an engine tailpipe fire. The ground crew quickly identified that the fire was in the tailpipe and alerted the aircrew who actioned the correct checklist. A fuel tank biocidal treatment had been carried out during the heavy maintenance period and although the additive treatments have been verified correct, it is suspected by the operator that some residual debris may have remained. This residue may have affected the operation of the HMU valves.

FD06658 ｜ 2019_英国_aaib-investigation-to-boeing-767-322-n657ua__Boeing_767-322_N657UA_10-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

56 © Crown copyright 2019 All times are UTC AAIB Bulletin: 10/2019 N657UA EW/G2019/04/19 SERIOUS INCIDENT Aircraft Type and Registration: Boeing 767-322, N657UA No & Type of Engines: 2 Pratt & Whitney PW4000 turbofan engines Year of Manufacture: 1993 (Serial no: 27112 LN:479) Date & Time (UTC): 29 April 2019 at 0835 hrs Location: Departure from London Heathrow Airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 11 Passengers - 86 Injuries: Crew - None Passengers - None Nature of Damage: Arcing and heat damage within a wiring harness Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 59 years Commander’s Flying Experience: 18,250 hours (of which 1,850 were on type)

Last 90 days - 218 hours

Last 28 days - 34 hours Information Source: Aircraft Accident Report Form submitted by the pilot and further enquiries made by the AAIB Synopsis The aircraft was climbing through 15,000 feet after departure from London Heathrow (LHR) when it was reported that an electrical burning smell, smoke and haze, was apparent in the cabin. The crew obtained clearance to return to LHR and, after carrying out the ‘smoke and fumes’ checklist, the problem was alleviated. The aircraft landed without further incident. A small section of wiring within the cabin ceiling lighting harness was found to have been the source of the smoke and fumes. Damage to the harness was found to have been caused by an electrical event leading to arcing between two of the insulated wires within the harness. The exact nature of this event could not be determined. History of the flight The aircraft had departed Heathrow, on route to Chicago O’Hare, and was climbing through 15,000 feet when the commander received a call from the cabin staff informing him of smoke in the cabin. It was reported that an electrical burning smell and haze was apparent near to Row 20. Rather than divert, the crew decided the aircraft should return to LHR. The commander declared a PAN to London ATC and permission was given to return. The crew carried out the smoke and fumes checklist, which included selecting the utility bus switches to off. After this had been done the purser reported that the smoke and haze had dispersed, although the electrical burning smell was still noticeable although dissipating.

57 © Crown copyright 2019 All times are UTC AAIB Bulletin: 10/2019 N657UA EW/G2019/04/19 The commander carried out the QRH requirements for an overweight landing and configured the aircraft accordingly. ATC and the commander agreed that, unless the situation deteriorated after landing, the aircraft should be turned off the runway and stop at a convenient location to enable the airport fire service to make an assessment. The aircraft landed without further incident and stopped at a remote stand. The fire service boarded the aircraft and found no signs of heat or fire. There were no injuries to the passengers and crew. Investigation One of the passengers on the flight reported that they had seen a momentary flash above the overhead ceiling panels near Row 20. The operator carried out an examination of the area and identified the source of the smoke and haze. Wiring in the cabin ceiling lighting harness above Row 19/20 on the left side showed evidence of electrical arcing and heat damage. There was also soot on the insulation surrounding a section of wiring, as shown in Figure 1. Figure 1 Damage to the wiring harness and surrounding material The circuit breaker (CB) protecting the circuit was found to have tripped. The wiring harness, CB and the lighting ballast connected to the harness were removed for further examination by the manufacturer. The CB and lighting ballast passed functional tests. Conclusion Damage to the harness was found to have been caused by an unidentified electrical event between two of the insulated wires within the harness. The electrical event led to arcing between the wires which generated significant heat, enough to cause localised melting of the copper strands in the wires. The exact nature of this event could not be determined.

FD06659 ｜ 2019_英国_aaib-investigation-to-boeing-777-236-g-ymmu__Boeing_777-236_G-YMMU_12-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

68 © Crown copyright 2019 All times are UTC AAIB Bulletin: 12/2019 G-YMMU EW/G2019/07/01 SERIOUS INCIDENT Aircraft Type and Registration: Boeing 777-236, G-YMMU No & Type of Engines: 2 Rolls-Royce RB211 Trent 895-17 turbofan engines Year of Manufacture: 2008 (Serial no: 36519) Date & Time (UTC): 3 July 2019 at 1530 hrs Location: On departure from London Heathrow Airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 13 Passengers - 259 Injuries: Crew - None Passengers - None Nature of Damage: None Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 56 years Commander’s Flying Experience: 24,433 hours (of which 13,397 were on type)

Last 90 days - 206 hours

Last 28 days - 49 hours Information Source: Aircraft Accident Report Form submitted by the commander and information supplied by the operator Synopsis Shortly after takeoff from London Heathrow the pilots smelt fumes on the flight deck. They donned oxygen masks, carried out the appropriate checklist and returned to Heathrow where the aircraft landed without further incident. Extensive engineering investigation was carried out and several components were changed, but the source of the fumes was not found. History of the flight On 3 July 2019 G-YMMU was scheduled to operate from London Heathrow to Bengaluru Kempegowda International Airport in India. The aircraft’s Auxiliary Power Unit (APU) bleed air valve and right air conditioning pack were isolated, in accordance with the Dispatch Deviations Guide (DDG), following two previous fumes events. The flight was operated by three pilots due to the length of the flight. After the engines were started but before the aircraft began to taxi, the third pilot smelt fumes. Neither the commander nor the co-pilot could smell anything unusual. After discussing the smell the crew decided to continue with the flight. Shortly after takeoff, all three pilots smelt fumes on the flight deck. They described the

69 © Crown copyright 2019 All times are UTC AAIB Bulletin: 12/2019 G-YMMU EW/G2019/07/01 smell as an “organic cheesy, oily smell” which left a metallic taste. The intensity of the smell increased as the aircraft passed through 2,000 ft. The co-pilot donned his oxygen mask and the commander passed control of the aircraft to him. The commander and third pilot then assessed the situation. They asked the Senior Cabin Crew Member (SCCM) to come to the flight deck to confirm the smell and confirm if there were any fumes in the cabin. The SCCM confirmed the smell of fumes on the flight deck and that he had not smelt anything in the cabin. After the SCCM left the flight deck the commander and third pilot donned their oxygen masks and started the ‘smoke, fire or fumes’ QRH checklist. After completing the first few items of the checklist the crew discussed if they needed to land urgently. At this stage the aircraft was approximately 51 tonnes above the maximum landing weight. As the fumes were isolated to the flight deck and all three pilots were on oxygen the crew decided the safest course of action was to jettison fuel to maximum landing weight rather than land overweight. The pilots made a PAN (urgency) call to ATC and started jettisoning fuel. The remaining items of the smoke, fire or fumes checklist required the left air conditioning pack to be switched off (to determine if this was the source of fumes). However, as the aircraft had dispatched with the right air conditioning pack isolated, this would have depressurised the aircraft. The crew also realised that they would not be able to determine if selecting the pack off stopped the fumes without removing their oxygen masks. They initially requested descent to FL100 to enable them to depressurise the aircraft but subsequently decided the safest course of action was to leave the left pack on. Once fuel jettison was completed and the cabin crew and passengers had been briefed, the aircraft returned to Heathrow for a normal approach and autoland.

The cabin crew subsequently reported that during the approach to land, fumes could be smelt around Door 2L1 and on the left side of the cabin from row 1 to 5. Previous fumes events Fumes were previously reported on G-YMMU on 29 June 2019 on final approach to land at Heathrow following a flight from Buenos Aires, Argentina. The flight crew reported that they smelt an oily smell but that it was not bad enough to don oxygen masks. They reported the smell to the operator’s engineering department, which was unable to replicate the smell on the ground. They suspected the source was the APU bleed, so this was isolated in accordance with the DDG and the aircraft was returned to service pending further investigation. On 1 July 2019, G-YMMU was returning to Heathrow from Cairo, Egypt. Whilst levelling at FL80 in the Heathrow hold the flight crew smelt “diesel fumes”. Both pilots described experiencing a “dry, tickly throat”. They donned their oxygen masks and declared a PAN to air traffic control. The aircraft landed at Heathrow uneventfully. Footnote 1 Door 2L is the second door from the front on the left hand side of the aircraft.

70 © Crown copyright 2019 All times are UTC AAIB Bulletin: 12/2019 G-YMMU EW/G2019/07/01 Following this event, the operator’s engineering department carried out further work to determine the source of the fumes. Damage was found in the right pack air cycle machine, so this was replaced. Several other components were changed in the air conditioning system. An odour from the APU and right pack was detected during subsequent ground engine runs. The aircraft was returned to service with the APU bleed valve and right pack isolated pending further investigation. Subsequent events Two further fume events occurred on 8 August and 17 August 2019, neither event required the use of oxygen. On 8 August the flight crew detected oily fumes during takeoff from London Heathrow. The fumes dissipated shortly after takeoff and the flight continued to destination. On 17 August 2019 the co-pilot detected a “wet dog” or “sock” smell on the flight deck at FL90 approaching London Heathrow. The commander initially thought the smell was associated with ozone from nearby thunderstorms. The smell lasted for approximately one minute. The smell reoccurred on the ground as the aircraft taxied to stand. Further engineering investigation Following the event on 3 July 2019 the operator investigated further, including ground engine runs and a flight test. During the flight test fumes were detected associated with the left pack. Following further inspections, the aircraft was returned to service with the left bleed valve isolated and the APU bleed valve and right pack reinstated. Further engineering inspections were conducted on 7 and 15 July 2019. Several additional components were replaced and further ground runs were conducted during which no fumes or odours detected. The aircraft was returned to service with the left bleed valve reinstated on 15 July 2019. After the events on the 8 and 17 August further engineering inspections were conducted but no faults were found. Conclusion Fumes were reported in the flight deck on five flights over a two month period. Two of the events required the flight crew to use oxygen. Despite extensive engineering investigation by the operator prior to returning the aircraft to service, at the time of publication, the source of the fumes has not been found.

FD06660 ｜ 2019_英国_aaib-investigation-to-cessna-152-g-ufco__Cessna_152_G-UFCO_03-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

74 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 ACCIDENT Aircraft Type and Registration: Cessna 152, G-UFCO No & Type of Engines: 1 Lycoming O-235-L2C piston engine Year of Manufacture: 1978 (Serial no: 152-81734) Date & Time (UTC): 19 April 2018 at 1119 hrs Location: Near Crumlin, County Antrim Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - 1 (Fatal) Passengers - 1 (Fatal) Nature of Damage: Aircraft destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 77 years Commander’s Flying Experience: 18,383 hours (of which 900 were on type)

Last 90 days - 5 hours

Last 28 days - 4 hours Information Source: AAIB Field Investigation Synopsis The purpose of the flight was to carry out aerial photography. During a manoeuvre at low level the aircraft stalled and descended rapidly, passing through some trees, before striking the ground. There was a post-crash fire and neither occupant survived. History of the flight Background The pilot had arranged to hire the aircraft, for a flight with himself and a passenger, from a local flying club based at Newtownards Airport. The passenger was a professional photographer specialising in aerial photography. He would arrange to be flown as a passenger in an aircraft to photograph properties with the intention of subsequently selling the photographs. The passenger had flown regularly with the pilot of G-UFCO, around 15 times a year for the last 14 years. The arrangement was that the passenger would provide a route plan, around various properties, and the pilot would then fly the route. It is not known what, if any, financial arrangements were made between the pilot and the passenger. On the day of the accident the pilot went in to the clubhouse where he was seen by several people. However, those there could not recollect having seen his passenger, so it is likely that he went directly to meet the pilot at the aircraft. The weather conditions were fine with good visibility and some scattered cloud.

75 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 Accident flight The aircraft took off from Newtownards at approximately 1047 hrs and flew in a north‑westerly direction. At 1049 hrs the aircraft was recorded on radar 1.5 nm north-west of Newtownards Airport at an altitude of about 800 ft amsl. This coincided with the pilot making initial radio contact with Belfast City ATC, who the pilot advised that they were operating a photographic flight near Nutts Corner (a disused airfield located 3 nm south-east of Belfast International Airport). The aircraft subsequently transited the Belfast City Control Zone at an altitude of about 1,300 ft amsl, before being transferred to the Belfast International approach frequency. The pilot requested clearance to operate between Nutts Corner and Loanends (Figure 1 and 2), which was granted and the aircraft entered controlled airspace. Figure 1 Radar track of flight from Newtownards Airport At 1058 hrs the pilot was transferred to the Belfast International tower frequency. A few minutes later at 1102 hrs, as the aircraft approached Nutts Corner, the pilot was instructed to hold position as an aircraft was on approach to land at Belfast International Airport. Having held at Nutts Corner for several minutes, flying at an altitude of about 1,100 ft amsl (a height of approximately 650 ft agl), the pilot reported that he was visual with the other aircraft and at 1106 hrs was cleared to proceed towards Loanends (Figure 2). The aircraft was then flown in a series of clockwise, circular and oval shaped turns at bank angles of up to 30° at heights between approximately 350 ft and 600 ft agl and at an estimated airspeed of about 60 kt TAS; based on a wind1 from 220° at 11 kt. The passenger was seated in the right seat and therefore clockwise turns would have facilitated a better view of properties during photography. Footnote 1 Obtained from the Belfast International Airport METARs timed at 1050 UTC and 1120 UTC.

76 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 Figure 2 Radar track of the last 19 minutes of the flight At 1117:10 hrs, the pilot contacted the controller to request a radio check (there had been a period of about 10 minutes with no radio traffic on that frequency). The pilot was advised that they were the only aircraft currently on frequency. This was the last radio communications received from G-UFCO. Radar recordings showed that during the next 90 seconds the aircraft maintained an altitude of about 900 ft amsl (approximately 400 ft agl), whilst making turns to the right. At 1118:44 hrs the turn rate increased to an estimated bank angle of about 45° right wing down, before reducing to about 20° right bank. The radar data indicates that the aircraft continued with a gradual turn to the right and at 1119:03 hrs the final radar point was recorded. The aircraft was at an altitude of about 810 ft +/- 50 ft (260 ft +/-50 ft agl) (Figure 3). Witnesses on the ground in the area of the accident saw the aircraft circling. Several reported seeing it flying apparently normally before suddenly “nose-diving” towards the ground. Two witnesses close to the accident site also reported hearing the engine “spluttering” as the aircraft passed overhead at a low height. After the aircraft struck the ground these witnesses heard a “popping” noise and then a larger explosion. There was an intense fire in the cockpit area and bystanders who arrived on the scene were not able to assist the occupants of the aircraft.

77 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 Figure 3 Radar track of the last 120 seconds of the flight Aircraft information G-UFCO was a Cessna 152, a two seat, dual control high wing monoplane powered by a horizontally opposed four-cylinder Lycoming piston engine driving a two-blade, fixed pitch propeller. The aircraft was originally registered in the USA and was transferred to the UK register in June 2015. It had a valid Airworthiness Review Certificate, which was due to expire on 8 July 2018. At the time of the accident the aircraft had accumulated a total of 3,021 airframe hours and 598 engine hours. The last 50-hour check was carried out at 3,006 hours, on 27 March 2018 and the records showed no significant defects recorded. The technical log showed that the aircraft had flown regularly in the days leading up to the accident. Carburettor heating system During normal operation, air passes through a filter, is mixed with fuel in the carburettor and then goes into the engine but in certain atmospheric conditions, ice can form in the carburettor, restricting and ultimately preventing, fuel and air from reaching the engine. To provide protection against carburettor icing, the aircraft, in common with other piston engine aircraft, is fitted with a carburettor heating system. The cockpit carburettor heat selector is connected to a flap valve in the air intake box by a cable and lever arm (Figure 4). When the selector is moved to the ON or HOT position, the cable pulls the lever arm, rotating the valve and allowing air heated by the exhaust manifold to flow into the carburettor to melt any ice present.

78 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 Flap Valve Cold air in Warm air in Figure 4 Carburettor heat valve Flying controls and flaps The Cessna 152 has conventional flying controls with inputs transmitted to the control surfaces via rods, cables and bell-cranks. It is fitted with inboard trailing edge flaps which are extended and retracted by a screw-jack actuator driven by an electrical motor, mounted in the inboard structure of the right wing. The actuator operates a system of cables and pulleys which move control rods attached to the flaps, with limit switches on the actuator removing electrical power to the motor when the flaps reach the fully extended [down] or fully retracted [up] position. The flap position is controlled by a cockpit mounted lever with detents at 10°, 20° and 30° increments and a feedback indicator-system which displays the actual flap position. Stall warning system The Cessna 152 is fitted with a stall warning system which gives an audio indication to the pilot of an impending aerodynamic stall approximately 5 kt to 10 kt before the stall speed is reached. The system consists of a small orifice in the leading edge of the left wing attached, via a tube, to a pneumatic horn. The horn emits an audible ‘whistling’ tone when negative air pressure at the wing leading edge causes reverse airflow through the horn. Stall speeds It was not possible to calculate the precise weight and balance of the aircraft at the time of the accident, but it was probably close to the maximum takeoff weight of 1,670 lb and towards the forward CG position. A range of stall speeds for the aircraft is shown at Table 12. Footnote 2 IAS is Indicated Air Speed, the speed displayed on the aircraft instruments. CAS is Calibrated Air Speed, IAS corrected for instrument and sensor position error.

79 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 Angle of bank 0° 30° 45° IAS CAS IAS CAS IAS CAS Forward CG 36 48 39 52 43 57 Rearward CG 40 48 43 49 48 55 Table 1 Stall speeds in kt at maximum takeoff weight 1,670 lb and various angles of bank Accident site The aircraft accident site was in a field approximately 4 nm south-east of Belfast International Airport (Figure 5). The aircraft had passed through a stand of trees, which were approximately 30 ft high, before it struck the ground. A one metre section of the right wing was retained in the trees. The ground impact marks, made by the forward fuselage and the wing leading edges, indicated that the aircraft struck the ground in a steep nose-down attitude (Figure 6). The wreckage site was compact, the aircraft was upright with both wings showing evidence of leading edge compression. Figure 5 Accident site The aircraft tail section had separated from the fuselage during the impact and the right wing had been bent rearwards, but the remainder of the aircraft was largely intact. There was a post-crash fire which was confined to the cockpit and inboard section of the right wing which contained one of the aircraft’s fuel tanks. Six litres of fuel were later recovered from the left wing tank. The left flap was displaced by approximately 5° from the trailing edge of the wing. It was not possible to measure the position of the right flap due to fire damage.

80 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 Right wing tip Ground Impact Figure 6 Accident site Aircraft examination The continuity of the flying control cables was confirmed before the aircraft was recovered to the AAIB facility for a detailed examination. No examination of the position of the cockpit controls was possible due to the severity of the post-crash fire. Engine The engine showed evidence of fire damage to some rear mounted ancillaries including the oil filter and one magneto, but was otherwise in good condition. The engine and carburettor were disassembled and inspected at an approved maintenance organisation under AAIB supervision, no defects were identified. The undamaged magneto was tested and found to be serviceable, the fire damaged magneto could not be tested. The carburettor throttle valve was found in a position that corresponded to an engine speed of approximately 1,800 rpm although it is possible it may have moved during the accident. The engine manufacturers operating manual for the O-235 engine showed that, at this speed, the engine would be producing approximately 35% of its maximum power. Carburettor heating system During removal of the engine, the carburettor heat valve was examined to determine the position of the flap valve. The valve box had deformed during the impact and jammed the flap valve, retaining it in the cold position (Figure 7).

81 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 Figure 7 Carburettor heat valve Propeller The propeller was removed from the engine and examined. The engine propeller attachment flange was deformed and five of the six threaded inserts into the flange had been pulled through and the spinner assembly was crushed flat by the impact. One blade tip was bent backwards about 45° from the midpoint of the blade and showed signs of damage from the post-crash fire. There was also was evidence of impact marks and scratches on its leading edge (Figure 8). The other blade was undamaged which was indicative of the engine operating at low power at impact. Figure 8 Propeller blade comparison Flaps The flap system was powered by an electrically driven screw-jack actuator in the right wing. The position of the flaps can be determined by measuring the extension of the actuator, the measured extension on G-UFCO was 9.2 mm (Figure 9).

82 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 Figure 9 Flap actuator According to the manufacturer’s documentation, the actuator is extended by 4 mm at flaps up. On the accident site, the left flap was found to be at an angle of 5°, which was calculated to require an actuator extension of 38 mm. It is therefore probable that the flap had moved due to the loss of tension in the control cables as a result of the post-crash fire. Discussion with the manufacturer confirmed that 9.2 mm of actuator extension could be accounted for in the flap rigging tolerances and it is therefore considered that the flaps were set to the up position at the time of the accident. Prior report of flap behaviour On 13 November 2017 an entry was made in the aircraft technical log reporting ‘flap oscillation 2-3° noted at flap 20° and flap 10°’. On 20 November 2017 a note was added, ‘fixed’, countersigned by a club instructor. After the accident the AAIB were provided with a video recording of unusual flap retraction behaviour on the aircraft. The video had been recorded several days before the accident. It showed that when the flaps were retracted from the 30° position to the up position, at both the 20° and 10° positions they would pause, oscillate two to three times, before continuing to retract. This behaviour was only observed when the aircraft was on the ground. Fire damage prevented any examination or testing of the flap actuation and position indicating system. The aircraft maintenance records showed that the flap position microswitches were last adjusted in September 2016. The flap oscillation was discussed with the aircraft manufacturer. It was suggested by the manufacturer that the oscillation could be caused by slight movement of the control microswitches when the flaps were moving. As there is no evidence that the flaps were moved during the accident sequence there is nothing to suggest this behaviour contributed to the accident. Stall warning system The stall warning system was destroyed in the post-crash fire, so it was not possible to verify if the system was operating normally.

83 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 Recorded information Sources of recorded information A digital camera and two mobile phones were recovered from the wreckage of the cockpit, however damage sustained during the post-crash fire meant that no data could be recovered from these devices. Recorded radar information (primary and secondary Mode A and C3) was available from ground-based sites located at Belfast City and Belfast International Airport. This provided an almost complete recording4 of the accident flight. The data started at 1049 hrs and ended at 1119:03 hrs, which was shortly before the aircraft struck the ground. RTF ground recordings of the pilot’s communications with ATC at Belfast City and Belfast International Airport were also available. (Figures 1, 2 and 3) Figure 10 is a plot of the estimated TAS and bank angle during the latter stages of the flight. The bank angle is derived from the aircrafts rate of turn and its TAS measured between each radar point, which were five seconds apart. Interpretation of recorded data The estimated TAS, derived from radar recordings, show that the aircraft was flying at below normal cruise speed during the latter stages of the flight when it was operating between Nutts Corner and Loanends. The average TAS between the last two data points was calculated to have been about 45 kt5. This was the lowest calculated during the flight. The final radar point was 60 m north-east of the accident site (Figure 3). Descent rate following final radar return The last radar return was at 1119:03 hrs when the aircraft was at a height of approximately 260 ft agl. Analysis of the Belfast International radar coverage6 indicates that the radar floor extended to ground level near the area of the accident site. This indicates that the aircraft struck the ground prior to 1119:08 hrs which is when the next radar scan of the area occurred. The average descent rate of the aircraft proceeding the last radar point would have needed to be greater than 3,120 ft/min for the aircraft not to have been recorded on radar at 1119:08 hrs. Footnote 3 Mode A refers to the four-digit ‘squawk’ code set on the transponder and Mode C refers to the aircraft’s pressure altitude which is transmitted in 100 ft increments. 4 The position of the aircraft was recorded once every five seconds by radar. 5 Based on level flight. 6 The lowest altitude at which an aircraft may be detected by radar when the aircraft is at a specific location relative to the radar site.

84 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01

Figure 10 Estimated airspeed and bank angle during latter stages of the flight Previous flight flown by pilot of G-UFCO Radar data was analysed for a flight on 5 April 2018 flown by the pilot of G-UFCO and accompanied by the same passenger; this was flown in another Cessna C152 registration G-UFCN. This flight was operated in an area just to the south-west of Newtownards Airport and was similar to the accident flight with multiple clockwise turns flown at between about 550 ft and 1,250 ft agl (Figure 11). Meteorology The 1120 hrs meteorological report from Belfast International Airport, 4 nm north-west of the accident site, was: surface wind from 220° at 11kt, visibility 10 km or more, scattered cloud at 1,900 ft with a temperature of 16°C, a dewpoint of 11°C and a barometric pressure of 1021 hPa. CCTV footage was obtained from a property near to the accident site which showed scattered cumulus cloud, estimated to be at a height of around 1,500 ft.

85 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 Figure 11 Flight flown by pilot of G-UFCO on 5 April 2018 Organisational information The operator of the aircraft is a flying club with aircraft available for training and private hire, it did not hold an Air Operator’s Certificate (AOC) for commercial work. The club stated that they were not aware that their aircraft were being used for photographic flights. Pilot information The pilot held a valid Class 2 medical certificate. The pilot’s most recent logbook was available for the investigation. The Certificate of Experience lapsed on 30 September 2017 and thus he was required to undertake a flight test with an examiner to re-validate his licence. The test was carried out on 31 March 2018 but was not completed then, at the pilot’s request. The examiner recorded that the pilot had been required to repeat one test item on 31 March, steep turns, which were noted as having been flown out of balance. The test was completed subsequently on 5 April 2018.

86 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 The pilot recorded photographic flights in his logbook. He had flown with two different photographers since 2003, on flights which varied in duration from 30 minutes to 4 hours. The flights were flown from Newtownards and most of the aircraft used were hired from the flying club which owned G-UFCO. Other information Regulations around the conduct of flights EASA Air Operations Regulation (EU) No 965/2012 Part-SPO (Specialised Operations) applies to any aircraft operation, other than Commercial Air Transport, where the aircraft is used for specialised activities such as agriculture, construction, photography, surveying, observation, patrol and aerial advertisement. EASA Part-SPO became applicable in the UK from 21 April 2017. Specialised Operations may be commercial or non-commercial; where operators are engaged in commercial Specialised Operations in the UK they are required to submit a declaration to the CAA about their operation confirming compliance with relevant aspects of Annex III 9 (Part-ORO) and Annex VIII (Part-SPO) of the EASA Air Operations Regulations. A declaration had not been submitted for this, or previous photographic flights. For non-commercial Specialised Operations in non-complex aircraft a pilot is required to operate in accordance with Annex VII (Part-NCO) and Subpart-E NCO.SPEC. The regulation includes a requirement for a risk assessment and provides an associated activity checklist which includes, as one item, a consideration of ‘the nature of the flight and the risk exposure, e.g. low height;’ At the time of the accident the definition of ‘commercial operation’ according to Regulation (EC) No 216/20087 Article 3 (Definitions) (i) was: ‘any operation of an aircraft, in return for remuneration or other valuable consideration, which is available to the public or, when not made available to the public, which is performed under a contract between an operator and a customer, where the latter has no control over the operator.’ A similar definition is provided for the UK in The Air Navigation Order 2016. European Regulation (EU) 923/2012, The Standardised European Rules of the Air (SERA), stipulates the minimum VFR flight altitude in daylight: ‘SERA.5005 Visual flight rules (f) Except when necessary for take-off or landing, or except by permission from the competent authority, a VFR flight shall not be flown: ..‘at a height less than 150 m (500 ft) above the ground or water, or 150 m (500 ft) above the highest obstacle within a radius of 150 m (500 ft) from the aircraft.’ Footnote 7 Superseded by Regulation (EU) 2018/1139, 22 August 2018.

87 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 The CAA has established an exception to this 150 m (500 ft) requirement, provided the aircraft is not flown closer than 150 m (500 ft) to any person, vessel, vehicle or structure, except with the permission of the CAA. No such permission had been obtained Analysis Accident site The location of the separated portion of the right wing in trees adjacent to the aircraft’s final resting place and the presence of all of the aircraft’s remaining structure on site confirmed that there had been no in-flight structural failure. Correct operation and continuity of all flying control surfaces was verified. The damage to the trees and the ground marks suggest that the aircraft was descending steeply whilst turning to the right which increased as the right wing contacted the trees. Both wings showed uniform leading edge compression from ground impact. This, together with the ground markings showed that both wings stuck the ground at the same time. Engine examination No evidence was found of any problems that would have prevented normal operation of the engine. The position of the carburettor throttle valve suggested that the engine had been operating at approximately 35% of its maximum power at the time of the accident. This was supported by the damage observed to the aircraft’s propeller which was consistent with an engine operating at low power at impact. If the engine’s performance had been affected by carburettor icing, it would be expected that the pilot would have increased engine power and operated the carburettor heat system. The position of both the throttle valve and carburettor heat valve suggest that it was unlikely that carburettor icing was present immediately before the aircraft’s final manoeuvre. Flying controls Due to the intense post-crash fire it was not possible to verify any of the positions or settings of the flight controls. Conduct of the flight The flight was carried out for the purpose of taking aerial photographs. The pilot and passenger had flown together on many similar flights over the last 14 years, thus, they were both familiar with the operation. Information was not available concerning any financial arrangement between them, either for this, or for previous similar flights. Were any ‘remuneration or other valuable consideration’ accepted by the pilot then the flight should have been conducted in accordance with the requirements for commercial Specialised Operations. Otherwise it should have been conducted as a non-commercial Specialised Operation in a non-complex aircraft. In either case the pilot would have been required to conduct a risk assessment and to specify how any risk would be mitigated; for example a declaration of a minimum height for aerial photography to address the risks associated with flying at low level.

88 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 During the flight the aircraft flew a series of sustained turns, all in a clockwise direction, facilitating the taking of photographs from the passenger (right hand) seat. The orbits were being flown at an average speed of 60 kt TAS and at a height varying between 500 ft and 300 ft agl. The CAA exception to SERA.5005 (f) allows flight below 500 ft agl in the United Kingdom, but the aircraft must remain 500 ft away from persons, vessels, vehicles and structures. As the aircraft was flown at a height of less than 500 ft agl and in the vicinity of houses for extended periods, it is improbable that the required separation was maintained throughout. Stall speed Calibrated (CAS) and True (TAS) airspeed have approximately equivalent values at the speed and altitude at which the aircraft was operating. During the later stages of the flight, the aircraft was flying at around 60 kt TAS and at bank angles of up to about 30°. The effect of a turn is to increase the stall speed. A speed of 60 kt TAS is about 12 kt above the stall speed for straight and level flight, but at 30° angle of bank, this reduces to an approximate 8 kt to 10 kt margin, and only a 3 kt to 5 kt margin at 45° angle of bank. The stall warner would have activated at between 5 kt to 10 kt before the stall speed is reached. It is likely therefore that for periods during the latter stages of the flight the stall warner would have been sounding. This may have resulted in the pilot and passenger becoming accustomed to the sound of the stall warner, thereby reducing the value of its warning. With the aircraft in a turn, additional engine power is required to maintain altitude and airspeed, but the evidence shows that the engine was operating at a low power setting. About 20 seconds before the final radar point the bank angle was estimated to have increased to about 45° as the aircraft turned through 180°. The altitude was maintained but the airspeed reduced to below 60 kt. The rate of turn was reduced for a short time and then the bank angle increased again to about 30°. The airspeed reduced below 50 kt TAS and the aircraft would have stalled, resulting in a loss of control with insufficient height to recover. Conclusion The aircraft was engaged in aerial photography and thus the flight came within the scope of Specialised Operations. This required a strategy for the evaluation and mitigation of risks, such as those associated with flying at low level. There was no evidence of the required risk assessment having been carried out or for the checklist associated with the mitigations for the particular activity being in place. The aircraft was flying at low level and low airspeed when, for an undetermined reason, there was a critical reduction in airspeed and a loss of control. There is an increased level of risk associated with flying close to the stalling speed without sufficient height to recover from a stall, particularly when focussed on a task such as taking aerial photographs.

89 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-UFCO EW/C2018/04/01 Safety action Since the accident the flying club has issued instructions to their pilot members to remind them of their responsibility to understand and comply with the privileges of their licences and ratings. The club flying instructors have been reminded not to authorise any rental flight where there may be any doubt as to its purpose. The club is also re-drafting the flying order book and aircraft hire/ rental agreements to make it clearer as to what can and cannot be undertaken in a hired aircraft. Additionally, the club intends to provide warning signage/ posters to remind pilots and passengers of the restrictions and implications of travelling for any kind of payment in light aircraft.

FD06661 ｜ 2019_英国_aaib-investigation-to-cessna-172s-jt-a-pr-pts__Cessna_172S_JT-A_PR-PTS_02-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

3 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04 ACCIDENT Aircraft Type and Registration: Cessna 172S JT-A, PR-PTS No & Type of Engines: 1 Technify Motors TAE 125-02-114 turbocharged diesel piston engine Year of Manufacture: 2017 (Serial no: 172S12057) Date & Time (UTC): 23 December 2017 at 2133 hrs (1733 local time) Location: Following takeoff from Providenciales Airport, Turks and Caicos Islands Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - 1 (Fatal) Passengers - 1 (Fatal) Nature of Damage: Aircraft destroyed Commander’s Licence: Brazilian Commercial Pilot’s Licence Commander’s Age: 44 years Commander’s Flying Experience: At least 1,398 hours

(of which at least 342 were on type)

Last 90 days - unknown

Last 28 days - unknown Information Source: AAIB Field Investigation Synopsis Shortly after takeoff from Providenciales Airport, Turks and Caicos Islands, the aircraft engine lost power, most likely due to a failure of, or detachment, of an intercooler induction hose. The pilot attempted to reposition for a landing at the airport but lost control of the aircraft whilst attempting to turn. Both the pilot and passenger were fatally injured. History of the flight The aircraft was newly-built at the manufacturer’s facility at Independence, Kansas, USA. As part of the purchase the aircraft had been fitted with a diesel engine in accordance with an FAA Supplementary Type Certificate (STC) before being handed over to the ferry company pilot on 20 December 2017. There had been some delays in the delivery due to technical issues with the aircraft which had required some replacement parts to be fitted before the aircraft was released. The aircraft was to be ferried to Sao Paulo, Brazil in order to receive its mandatory technical survey by the Brazilian authorities for importation. The crew consisted of a ferry pilot and a passenger who was an employee of the purchaser. Due to the size and range of the aircraft, the ferry flight was planned through Florida and the Caribbean islands before crossing into Brazil. In all, the flight was planned with ten stops before reaching its

4 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04 destination. The stop in Providenciales was originally planned as an overnight stay but due to the late delivery of the aircraft, and the time of year, suitable hotel accommodation was not available on the island. As a result, the flight was re-planned to proceed from Providenciales on to Punta Cana, Dominican Republic, a flight of approximately 2.5 hours. The crew were then planning to stay for the night before re-joining their original ferry plan. On 20 December 2017, the pilot and his passenger left Independence, Kansas, in the aircraft for a 2.9 hour flight to Meridian, Mississippi, where the occupants stayed for a night. The next day they completed the 4.5 hour leg to Fort Lauderdale, Florida. The crew left Fort Lauderdale on 23 December 2017. The routing from Fort Lauderdale to Providenciales is around 520 nm and would have taken approximately 5 hours. The aircraft landed at Providenciales at 2022 hrs (1622 local time) and the occupants disembarked into the fixed base operator (FBO) terminal. The aircraft was refuelled for its onwards flight to Punta Cana. The aircraft occupants were reported by witnesses to be relaxed without any concerns about the aircraft or the route. The weather in Providenciales was excellent with an easterly wind of 10 kt, visibility in excess of 10 km and a temperature of 28°C. It was daylight. At 2123 hrs (1723 local time) the pilot of PR-PTS requested taxi instructions from the tower at Providenciales for his flight to Punta Cana. Six minutes later he was cleared to enter and backtrack Runway 10. Another aircraft called on finals, and at 2131 hrs the pilot was asked by the tower if he could depart from his present position. The pilot answered that he could and at 2132 hrs PR-PTS was cleared for takeoff. The aircraft then made a 180° turn on the runway and began its takeoff roll. As soon as the aircraft became airborne from the runway, the tower controller and assistant noticed smoke coming from the aircraft. Very shortly after takeoff the pilot requested an immediate return which was granted by the controller, who asked the pilot to report on finals. The controller and assistant then saw the aircraft start a turn to the left. They observed an increasing angle of bank in the turn before the nose dropped and the aircraft was lost to sight behind some buildings. Other aircraft on the frequency reported to the controller that the aircraft had crashed and the emergency procedure was initiated. Around a minute later the controllers could clearly see a large cloud of black smoke although they were unable to see the accident site. The aircraft had struck the ground to the north of the airport and outside the perimeter fence (Figure 6). The accident site was a corner piece of undeveloped land bordered by roads and next to a petrol station. Police and fire services arrived at the scene quickly but a fierce fire had taken hold. The aircraft occupants were fatally injured. Post-mortem investigations showed that it is highly likely both occupants died instantly due to the initial impact. Pilot The pilot held a Brazilian Commercial Pilot’s Licence. His logbook was kept electronically and could not be accessed after the accident. Evidence from the Brazilian authorities and from paper copies of aircraft technical logs indicated he had at least 1,398 hours total flying experience, although witnesses reported that the total was much higher at around

5 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04 3,000 hours. The vast majority of this experience was in single-engine light aircraft. It could not be determined how much flying the pilot had completed in the previous 28 and 90 days. Having collected the aircraft from the manufacturer, the pilot had completed nearly 12 hours in the accident aircraft en route to Providenciales. It was reported that the pilot had ferried aircraft from the USA to Brazil on previous occasions but it has not been possible to verify this. Accident site and on-site wreckage examination The aircraft had struck the ground in a steep nose-down attitude, and had come to rest at the impact point (Figure 1) approximately 270 m north of the runway extended centreline. The impact heading was 010°M, 90° to the left of the departure runway heading. Both wing fuel tanks were ruptured on impact and a severe post-impact fire had developed, consuming the majority of the aircraft’s cabin and inboard wing structure. Figure 1 Accident site All major components of the aircraft were located at the accident site. Continuity of the flying controls was established between the cockpit controls and the flying control surfaces. The flaps were fully up and the elevator trim tab was in a neutral position. The pre-impact position of the fuel selector valve could not be determined due to disruption of the cockpit during the accident.

6 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04 There was insufficient fuel remaining in the fuel system from which to take a fuel sample, although traces of fuel with the appearance and odour of JET A were present in the engine’s fuel rail. A fuel sample drawn from the fuel bowser that was used to refuel PR-PTS prior to the accident flight was tested and found to conform to the specifications of JET A fuel. The post-crash fire had consumed most of the engine’s air induction and coolant hoses. The intercooler was recovered with both hose clamps and a remnant of the silicone hose in position at the intercooler inlet. The intercooler outlet hose clamps had released from the intercooler during the impact and subsequent fire, but were later identified within the aircraft wreckage. The induction manifold inlet had both hose clamps still in position although the hose itself had burned away. The turbocharger compressor outlet coupler was secured to the turbocharger by its metal V-band clamp, however the single hose clamp that attaches the compressor outlet hose to the turbocharger was not located in the aircraft wreckage or at the accident site. The engine’s FADEC1 unit, which was also burned, was recovered from the wreckage for analysis. The engine was removed from the aircraft for detailed examination at the engine manufacturer’s facility in Germany. Aircraft information The Cessna 172S is a single-engine, four seat light aircraft with a high-wing and a fixed tricycle landing gear. The Cessna 172S JT-A is a conversion of the 172S, in which the Lycoming IO-360-L2A piston engine is replaced with a Technify Motors turbocharged diesel TAE 125-02-114 engine. The aircraft manufacturer discontinued production of the 172S JT-A in May 2018. For PR-PTS, this engine conversion was embodied as an STC modification, prior to delivery of the newly-built aircraft to the customer. During installation of the engine a modification was carried out to the cylinder head2 and the fuel rail pressure regulation valve was replaced3. The modification to the cylinder head required the exhaust manifold and turbocharger to be removed from the engine, to provide access to the cylinder head. The necessary maintenance steps for removal of the exhaust manifold and turbocharger were specified in Chapters 72-40.03 and 72-04.01 of the engine Repair Manual, RM-02-02. RM-02-02 contains the following turbocharger removal instructions: ‘De-installation

1. Remove the clamp of the turbocharger air [inlet] hose and remove the air

[inlet] hose from the compressor case. Seal the opening with an appropriate plug to protect it from contamination or dirt. Footnote 1 Full-Authority Digital Engine Control. 2 Repair Instruction RI-05-0014-01, carried out on 18 October 2017. 3 Service Bulletin TMG 125-1022 P1, carried out on 27 October 2017.

7 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04

1. Remove the Wiggins clamp of the turbocharger pipe and remove the air

pipe from the compressor case. Seal the opening with an appropriate plug to protect it from contamination or dirt.

1. Remove the hoses from the wastegate control valve to the turbocharger.

This requires the Cobra clamps to be removed.’ The ‘Wiggins clamp’ referred to in step 2 above relates to a previous standard of TAE 125 engine, in which the induction air hose was connected to the turbocharger compressor outlet by a single clamp. This design was superseded when a turbocharger outlet adapter was introduced, which is attached to the turbocharger compressor outlet with a steel V-band clamp. The turbocharger compressor outlet air hose is secured to the outlet adapter with a single hose clamp. This later configuration of the TAE 125 engine was installed in PR-PTS. The technician who performed RI-05-0014-01 stated that he loosened both hose clamps that attach the induction hose to the inlet of the intercooler, to permit removal of the turbocharger. The same technician reinstalled the turbocharger and air hose after completing the cylinder head modification. The aircraft’s airworthiness certificate was issued on 18 December 2017 and at the time the accident occurred the aircraft had accumulated 32.4 hours and the engine 24.6 hours in operation. The TAE-125-02-114 engine is equipped with a dual-channel FADEC to control the engine operation in response to pilot demands. The FADEC unit also records engine parameters during engine operation. Figure 2 TAE-125-02-114 air induction system Engine air induction system Engine induction air is drawn though an inlet and filter on the right lower cowling, before being ducted to the turbocharger compressor inlet (Figure 2). Pressurised induction air

8 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04 passes from the turbocharger compressor outlet via a silicone hose to an intercooler where the induction air is cooled prior to being routed via a second silicone hose to the engine inlet manifold. Two manifold air pressure sensors, one for each FADEC channel, measure the induction air pressure at the inlet manifold. The turbocharger compressor outlet has an adapter attached to it, secured by a metal V-band clamp. The silicone hose connecting the turbocharger compressor outlet to the intercooler is attached with a single hose clamp at the coupler end as there is insufficient space for two hose clamps. This hose has two hose clamps at the intercooler end. The silicone hose that connects the intercooler outlet to the inlet manifold has two hose clamps at either end of the hose. Recorded information There were no radar recordings. The radio transmissions were recorded and are described in the ‘History of the flight’ section of this report. Recorded data was recovered from both control lanes of the fire-damaged FADEC by removing and downloading the memory chips. The data comprised event logs and continuous recordings. The recordings included more than 41 hours of data covering 16 flights, starting in October  2017 and ending with the accident flight. They contained a comprehensive parameter set for each control lane, with an update rate of once per second. Altitude and position were not recorded. Altitude was derived from the recorded barometric air pressure parameter and corrected to match the pressure altitudes the aircraft transponder was reporting during previous flights. The pressure recordings did not vary smoothly, but changed in increments of either two or three hPa, equating to 55 ft or 82 ft respectively near sea level. There were two flights recorded on the day of the accident, the first with a duration of nearly five hours, the second was the accident flight with a very short duration, stopping shortly before impact. The data shows the test switch was used before each of these flights. There was also a brief period of running the engine at maximum rpm on the ground prior to the first flight of the day. Accident flight The pertinent parameters for the accident flight are shown in Figure 3. The FADEC started logging data at a recorded time of 2118:31 hrs. The engine speed on the ground was generally held stable at 1,500 rpm. A test was carried out at 2130:49 hrs. Three minutes later the engine started developing full power and then the aircraft started to climb. Shortly after this the manifold air pressure (MAP) fell to approximately ambient pressure conditions and the engine waste gate was commanded to close to increase this pressure. The data stopped shortly after this. The displayed power had reduced to 49.8%.

9 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04

Figure 3 Extract from FADEC data – accident flight The event log did not include any warnings associated with the time of the failure. A comparison of this initial takeoff with previous successful ones using the same aircraft did not find any anomalies up to moment when the MAP dropped. Previous flight During the first flight of the day (Figure 4), climbing through approximately 1,000 ft agl, there was a period where the MAP started to fluctuate with a peak-to-peak value of approximately 200 hPa (200 mbar). This stopped when the engine rpm was reduced after levelling off. The fluctuations returned to a lesser degree when climbing once more, reducing in amplitude as the climb progressed. The waste gate control values also fluctuated when the MAP was fluctuating. As the MAP and waste gate parameters were only recorded once per second, it could not be determined whether the waste gate control fluctuations were driving the MAP fluctuations or reacting to them. The limited sample rate also means that the frequency of the fluctuations and an accurate amplitude for the fluctuations could not be determined. The engine manufacturer stated that tests allowed up to 75 mbar of fluctuation but they are normally much less than this, 30 mbar at most.

10 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04

Figure 4 Extract from FADEC data – previous flight The MAP fluctuations were also first observed with similar amplitudes, in excess of the manufacturer bench test limits, during a pre-delivery test flight conducted by the aircraft manufacturer on 16 December 2017. Similar MAP fluctuations were present on all subsequent flights. The data shows the MAP fluctuations on 16 December 2017 were present to a greater extent than that shown in Figure 4 but had not drawn the attention of the test pilot. The recorded displayed load parameters indicates that full power was available during the periods of MAP fluctuation. The engine maintenance manual requires that the FADEC is downloaded and the data examined for anomalies every 100 hours of engine operation, or at the annual inspection, whichever occurs first. The engine manufacturer also routinely examines the FADEC data for anomalies when the engine is first run on a test bench, when it is first ground‑run after installation in the aircraft, and after the initial test flight. In this instance, the engine manufacturer reported that downloaded FADEC data from PR-PTS had shown no abnormalities from the point of manufacture up to and including the initial test flight and the engine had not yet reached 100 hours of operation at the time of the accident.

11 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04 Engine manufacturer In the light of the data recovered from the FADEC in PR-PTS, the engine manufacturer reviewed past data from other engines, looking for previous cases of high MAP fluctuations. Although minor manifold pressure fluctuations are an inherent property of piston engines, the manufacturer could find no instances of fluctuations approaching those in PR-PTS (approximately 200 hPa (200 mbar)). There was therefore no basis, from service history, for determining the likely cause of this fluctuation in PR-PTS. Engine examination The engine was disassembled at the engine manufacturer’s factory in Germany with oversight from the AAIB and the BFU. There was no evidence of a pre-accident mechanical failure within the engine and all damage to the engine was consistent with the ground impact during the accident. The turbocharger turbine wheel blades had tip damage caused by contact with the turbine shroud, demonstrating that the turbocharger was turning at high speed at impact. The turbocharger shaft, which connects the compressor to the turbine, was fractured and a metallurgical examination of the fracture surface showed that the fracture was a ductile overload, caused by bending of the shaft during ground impact. The turbocharger waste gate operated normally when actuated by hand. Ground-running tests of a TAE-125 engine A series of ground-running engine tests were performed on a Piper PA-28 that was powered by a TAE 125 engine, similar to that fitted to PR-PTS. The tests were conducted to determine whether detachment of the hose which connects the turbocharger compressor outlet to the intercooler would result in a similar reduction in engine power to that observed in the FADEC data from the accident flight. Three configurations of the securing of the turbocharger compressor hose were tested (Figure 5). The first test involved the turbocharger hose clamp being correctly positioned and loosened to the point where it was free to rotate about the hose, but still tight enough not to slide over the bulge in the hose due to the turbocharger outlet barb feature. When the engine was run at full power, the hose remained attached and the engine ran normally. The second test involved removal of the hose clamp. The engine started and ran normally at idle power, but when the power lever was advanced the hose immediately detached from the turbocharger, before full power was reached. When the hose detached, the manifold pressure reduced to ambient pressure and the load reduced to approximately 55%. The exhaust gases were a dark, smoky colour due to an excessive level of unburnt fuel. The engine manufacturer confirmed that an abrupt reduction in manifold pressure would result in a lower air mass flow, leading to a sootier combustion which is visible in the black exhaust gases.

12 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04 A third test was performed with the hose clamp incorrectly positioned over the bulge in the hose where it passed over the turbocharger barb. With the hose clamp loose enough to be rotated by hand, the hose detached when the engine ran before full power was reached, with similar results to the second test. A fourth test was performed with the hose clamp positioned as for the third test, but with the clamp tightened to the 5 N cm torque level, as required by the Aircraft Maintenance Manual (AMM). The hose clamp and hose remained attached during the subsequent engine run and the engine developed full power with a normal exhaust gas appearance. The clamp torque level was then reduced to 2.5 N cm, only 50% of the AMM-required level. Despite this reduction in clamp torque, the clamp and hose remained attached during an engine run to full power, including slam-throttle tests where the engine was rapidly accelerated from idle to full power. Figure 5 Turbocharger compressor outlet hose clamp Weight and balance Th aircraft was refuelled to full tanks in Providenciales. Using the weight of the pilot and passenger, as well as estimates for their baggage it was estimated that the aircraft was close to the maximum takeoff mass of 2,550 lbs. The aircraft balance was within limits. Aircraft performance Following the engine examination and ground-running tests, the aircraft manufacturer conducted a test flight with a Cessna 172S JT-A, to simulate the power loss which occurred in PR-PTS. The test aircraft was flown at a similar mass to PR-PTS and at a density altitude greater than that achieved during the accident flight. With a power setting the same as that seen on the PR-PTS FADEC-recorded data, the aircraft was able to complete a level turn at up to 15° angle of bank. Airfield information Providenciales is the main international airport serving the Turks and Caicos Islands. The airport is at 15 ft amsl and has a single runway orientated 10/28. The runway is 2,807 m long. At both ends of the runway there are areas of water. In the case of Runway 10, this is a shallow lagoon containing areas of mangroves. Figure 6 shows the general area of the airport and the areas of water at each end of the runway.

13 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04 Figure 6 General area around the airport © Google Earth Analysis The cause of the power reduction The FADEC recorded data showed that, shortly after takeoff on the accident flight, the manifold air pressure (MAP) fell to approximately ambient pressure. Testing later conducted by the engine manufacturer confirmed that this reduction in MAP would result in a substantial reduction in engine power, as seen during the accident flight. Tests also confirmed that the reduction in MAP recorded on the FADEC was consistent with a major leak in the air induction system, between the turbocharger compressor outlet and the engine intake manifold. This loss in manifold pressure resulted in a significant loss of engine power. The engine manufacturer confirmed that an abrupt reduction in manifold pressure would result in a lower air mass flow, leading to a sootier combustion which was consistent with the smoky appearance of the engine’s exhaust gases observed by the witnesses in the control tower. Through examination of the aircraft wreckage it was possible to eliminate the induction hose joints at both the inlet and exhaust of the intercooler and the inlet of the induction manifold as possible causes of the induction leak. It was also possible, after their inspection, to eliminate the intercooler and induction manifold. This leaves two remaining possibilities:

The induction hose connection to the turbocharger compressor outlet may have failed. Since the single hose clamp at this position was not recovered in the aircraft wreckage, it is possible that it detached during

14 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04 the takeoff sequence although the absence of this component prevented further investigation into this scenario. Tests conducted by the engine manufacturer showed that, with the hose clamp either absent, or loose and misaligned over the turbocharger outlet barb, the induction hose did not remain attached to the turbocharger when the engine was run at full power. Therefore, as the aircraft had flown a number of flights successfully after the removal and reinstallation of the turbocharger and induction hose, for the modification RI-05-0014-01, it can be concluded that the hose clamp was present and was tight enough to retain the induction hose for at least the successfully completed flights.

As only a few fragments of the intercooler induction hoses remained following the post-impact fire, it was not possible to establish their condition prior to the accident. It is possible that one of the induction hoses may have failed, leading to the observed reduction in manifold pressure. The cause of the recorded fluctuations in manifold pressure could not be determined. It is possible that the pressure fluctuations may have caused a component in the induction system to fail prematurely, leading to the significant loss in manifold pressure during the accident flight takeoff, but there was no remaining physical evidence available to support, or exclude, this. Turnback decision There are several reasons why a pilot may attempt to turn back towards the airport in the event of a complete or partial engine failure after takeoff. The primary reason would be that there are no areas in which to attempt a forced landing ahead. Other reasons may include a desire to ‘save the aircraft,’ a fear of landing in water, if that is what is ahead, and seeking the reassurance of a strip of runway. In many cases, the attempt ends in the aircraft entering a stall or spin with catastrophic results. Decision making following engine failures requires a rapid appraisal of the conditions, followed by a prompt decision about the actions to be taken. When the situation is one of a partial or substantial power loss, but not a complete power loss, the decision making may be compounded by the need to rapidly assess the power available against that required to fly level or climb. Research by the Australian Transportation Safety Board (ATSB) concluded that partial power loss can be more challenging than full power loss, due to the choices confronting the pilot and general lack of training for such an event4. Training tends to concentrate on the complete loss of engine power. When power is lost after takeoff (whether completely or partially), the priority must be to maintain control of the aircraft. This may require significant positive action by the pilot to avoid stalling, especially in a turn. Footnote 4 ATSB Transport Safety Report – Managing partial power loss after takeoff in single-engine aircraft (Canberra, 2011).

15 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 PR-PTS EW/C2017/12/04 Conclusion This aircraft suffered a power loss just after takeoff, which was confirmed by the recorded engine data. This power loss was consistent with a significant leak in the engine air induction system, which could have been caused by either the detachment of an induction hose or the failure of one of the induction hoses. The pilot’s request to return shows that he was attempting to position the aircraft for a landing at the airport, but he then lost control in the turn. The aircraft bank increased, it is likely the lower wing stalled and the aircraft then descended rapidly into the ground. The pilot and passenger were almost certainly killed in the impact with the ground, not in the subsequent fire. The loss of power was significant, but not complete, and the power available was sufficient to allow the aircraft to be flown level and to complete gentle turns. ATSB research shows that a partial and insidious loss of power may be more challenging for effective decision making than a full loss of power. In this instance, it is likely that a controlled forced landing into the shallow water ahead would have resulted in the probable loss of the aircraft but it is unlikely that it would have had fatal consequences.

FD06662 ｜ 2019_英国_aaib-investigation-to-cessna-414-n414fz__Cessna_414_N414FZ_04-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

36 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 N414FZ EW/G2018/06/33 ACCIDENT Aircraft Type and Registration: Cessna 414, N414FZ (previous registration G-AZFZ) No & Type of Engines: 2 Continental Motor TSIO-520 piston engines Year of Manufacture: 1971 (Serial no: 414-0175) Date & Time (UTC): 26 June 2018 at 1320 hrs Location: Farm building at Enstone Airfield, Oxfordshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - 1 (Minor) Passengers - 1 (Serious) Nature of Damage: Aircraft destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 49 years Commander’s Flying Experience: 1,194 hours (of which 9 were on type)

Last 90 days - 60 hours

Last 28 days - 26 hours Information Source: Aircraft Accident Report Form submitted by the pilot and AAIB enquiries Synopsis Shortly after taking off from Enstone Airfield, and while in a climbing turn to the right, the right engine stopped. The aircraft descended and returned to the airfield, crossing the runway at a low height before crashing into a poultry farm on the north side of the airfield. The aircraft and part of the poultry farm were destroyed in the subsequent fire. The pilot sustained minor injuries and the passenger multiple injuries, including a fractured vertebra. Introduction This investigation was carried out as a correspondence investigation and was based on information provided by the aircraft commander, witnesses, technical publications and photographs taken at the scene of the accident. History of the flight The aircraft departed Dunkeswell Airfield on the morning of the accident for a flight to Retford (Gamston) Airfield with three passengers on board, two of whom held flying licences. The passengers all reported that the flight was uneventful and after spending an hour on the ground the aircraft departed with two passengers for Enstone Airfield. This flight was also flown without incident.

37 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 N414FZ EW/G2018/06/33 The pilot reported that before departing Enstone he visually checked the level in the aircraft fuel tanks and there was 390 ltr (103 US gal) on board, approximately half of which was in the wingtip fuel tanks. After spending approximately one hour on the ground the pilot was heard to carry out his power checks before taxiing to the threshold of Runway 08 for a flight back to Dunkeswell with one passenger onboard (Figure 1). During the takeoff run the left engine was heard to stop and the aircraft veered to the left as it came to a halt. The pilot later recalled that he had seen birds in the climbout area and this was a factor in the abandoned takeoff. The aircraft was then seen to taxi to an area outside the Oxfordshire Sport Flying Club, where the pilot attempted to start the left engine, during which time the right engine also stopped. The right engine was restarted, and several attempts appeared to have been made to start the left engine, which spluttered into life before stopping again. Eventually the left engine started, blowing out clouds of white and black smoke. After the left engine was running smoothly the pilot was seen to taxi to the threshold for Runway 08. The takeoff run sounded normal and the landing gear was seen to retract at a height of approximately 200 ft agl. The climbout was captured on a video recording taken by an individual standing next to the disused runway, approximately 400 m to the south of Runway  08. The aircraft was initially captured while it was making a climbing turn to the right and after 10 seconds the wings levelled, the aircraft descended and disappeared behind a tree line. After a further 5 seconds the aircraft came into view flying west over buildings to the east of the disused runway at a low height, in a slightly nose-high attitude. The right propeller appeared to be rotating slowly, there was some left rudder applied and the aircraft was yawed to the right. The left engine could be heard running at a high rpm and the landing gear was in the extended position. The aircraft appeared to be in a gentle right turn and was last observed flying in a north-west direction. The video then cut away from the aircraft for a further 25 seconds and when it returned there was a plume of smoke coming from buildings to the north of the runway (Figure 1). The pilot reported that the engine had lost power during a right climbing turn during the departure. He recovered the aircraft to level flight and selected the ‘right fuel booster’ pump (auxiliary pump) and the engine recovered power. He decided to return to Enstone and when he was abeam the threshold for Runway 08 the right engine stopped. He feathered the propeller on the right engine and noted that the single-engine performance was insufficient to climb or manoeuvre and, therefore, he selected a ploughed field to the north of Enstone for a forced landing. During the approach the pilot noticed that the left engine would only produce “approximately 57%” of maximum power, with the result that he could not make the field and crashed into some farm buildings. There was an immediate fire following the accident and the pilot and passenger both escaped from the wreckage through the rear cabin door. The pilot sustained minor burns. The passenger, who was taken to the John Radcliffe Hospital in Oxford, sustained burns to his body, a fractured vertebra, impact injuries to his chest and lacerations to his head.

38 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 N414FZ EW/G2018/06/33 Video taken in this area Runway 08 Accident site Flying club Aircraft appeared here at low level Disused runway Figure 1 Enstone Airfield Accident site The aircraft had crashed into a poultry farm on the edge of the airfield, destroying part of a timber-framed building that was partially lined with asbestos. The resulting fire caused a substantial loss of poultry, from the effect of the fire and asbestos contamination. The aircraft was destroyed in the intense fire (Figure 2). While liquid petroleum gas (LPG) was present at the accident site, the General Manager responsible for the farm advised that it had not been compromised in the accident and that the intense fire was caused by the fuel on the aircraft.

39 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 N414FZ EW/G2018/06/33 Right engine Right wing Front seat Figure 2 Remains of aircraft and engines at the accident site Weather The Met Office provided an aftercast based on the weather conditions at the time of the accident at RAF Brize Norton, RAF Benson and Oxford Kidlington Airport. With stable atmospheric conditions it was assessed that the weather at these locations would have been very similar to the conditions at Enstone Airfield. The aftercast concluded: ‘The weather conditions at the time of interest would have been benign, with light easterly winds, visibility in excess of 10 Km, with no significant weather and no significant cloud below 5,000 feet. The most likely QNH pressure 1025 hPa, air temperature 27 degrees Celsius, wind speed and direction for 1,000 ft (agl) 090 degrees 05 knots …’ Pilots qualifications and experience The pilot’s logbook and licence show that he undertook his check flight for his Multi Engine Piston (MEP) rating on 10 March 2016 and last renewed it on 21 March 2018. On the morning of the accident he had accumulated 120.4 hours as pilot-in-command on MEP aircraft, of which 8.5 hours and 10 flights had been flown in N414FZ. The pilot had not flown any other Cessna 414 aircraft. Although there was no requirement for him to have done so, there was no record of the pilot having had a formal conversion flight on this aircraft type.

40 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 N414FZ EW/G2018/06/33 Aircraft history Much of the aircraft documentation, including the Pilot’s Operating Handbook (POH), was destroyed in the fire. The current registration document for N414FZ was issued on 4 April 2018 when the aircraft was purchased by the pilot who was a joint owner. A 50-hour maintenance check was completed on 2 November 2017 at 5,274.7 airframe hours during which Teledyne Continental Service Bulletin 95-7 was carried out on both engines. This Service Bulletin requires a check of the engine manifold valve for evidence of a fuel leak. The maintenance documents record that the fuel pressure tests were carried out satisfactorily on both engines. The owner had reported that the cylinder head temperature (CHT) on the right engine was not working. The fault was traced to a wiring defect and rectified. No significant defects were identified during the maintenance check. Approximately 20 flying hours later, on 22 March 2018, the aircraft was taken to another maintenance organisation for a survey and clean. Wear was discovered in both propellers, which were replaced. No other significant faults were identified, and the engine ground runs were found to be satisfactory. The aircraft was collected on 14 June 2018 and the accident occurred 5 flying hours later. The pilot reported that he had experienced no technical problems with the aircraft prior to the accident flight. Aircraft fuel system General In the Cessna 414, the aircraft fuel system consists of the main wingtip fuel tanks (50  US  gal  each) and an auxiliary fuel tank (20 US gal each) in each wing. Two electrically‑operated fuel pumps, the auxiliary pump and the fuel transfer pump, are mounted in each main fuel tank. The auxiliary fuel pump is mounted on the bottom of the main fuel tanks and provides fuel pressure for priming during engine starting and supplies fuel to the engine in an emergency. The transfer fuel pump is mounted on the main tank rear bulkhead and transfers fuel from the nose section of the main tank to the centre baffle area, where it is picked up and routed to the engine by either the engine-driven or auxiliary fuel pump. The fuel transfer pump prevents the possibility of fuel starvation to the engine during steep angles of descent and when fuel is low. The fuel auxiliary pump provides fuel to the engine‑driven fuel injection pump via the fuel selector valve. A fuel vapour return line is installed between the engine-driven pump and the main fuel tanks. Auxiliary fuel pump (‘booster pump’) N414FZ had been fitted with a three-position auxiliary fuel pump switch and circuitry which was compliant with Cessna Service Bulletin MEB88-3. This modification allows the pilot to have direct control of the output pressure of the two auxiliary fuel pumps. The two switches are labelled aux pump l and aux pump, r. The positions on each switch are low, off and high. The low position operates the auxiliary pumps at low speed and can be used, when required, to provide supplementary fuel pressure for all normal operations.

41 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 N414FZ EW/G2018/06/33 The high position is reserved for emergency operations and operates the pump at a high speed which can provide sufficient fuel flow to sustain partial engine power in the event of an engine-driven fuel pump failure. The Airplane Flight Manual Supplement for the auxiliary fuel pump switch system states: ‘On rare occasions, such as during engine starting in cold weather, the high position (instead of low) may be needed for a few seconds to ensure a good ground start or restart in flight. CAUTION If the auxiliary fuel pump switches are placed in the high position with the engine-driven fuel pump(s) operating normally, total loss of engine power may occur.’ Fuel distribution The fuel distribution system allows either engine to be fed from the main fuel tanks in either wing or the auxiliary fuel tanks. Two fuel selector handles, one for each engine, are located between the front seats on the cabin floor that are marked with the following position: Left engine fuel selector handle Right engine fuel selector handle ˗ left main ˗ right main ˗ right main ˗ left main ˗ left auxiliary ˗ right auxiliary ˗ off ˗ off The main and auxiliary fuel tanks are fitted with a capacitance fuel quantity indicating system. The fuel quantity gauge is a dual-indicator fuel gauge for the left and right main fuel tanks as well as the left and right auxiliary fuel tanks. When the fuel selector handle is in the main tank position, the gauge will indicate the quantity of fuel in the main tanks. When the fuel selector handle is placed in the auxiliary position an indicator light under the gauge will illuminate, indicating that the selector handle is in the auxiliary position and the fuel quantity gauge is indicating the content of the auxiliary tank. Last refuel N414FZ was last refuelled with 185 ltr (48 US gal) of Avgas 100LL at Dunkeswell Airfield on the morning of the accident. The aircraft then flew for approximately 0.8 hour before departing on the accident flight when the pilot reported that there was 390 ltr (103 US gal) of fuel on board. There have been no reports of any other aircraft experiencing problems with fuel uplifted from Dunkeswell Airfield.

42 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 N414FZ EW/G2018/06/33 Aircraft performance Engines The engines fitted to N414FZ were Continental TSIO-520-NB that had been modified by RAM Aircraft in 1996 by a Supplementary Type Certificate (STC) to increase the horsepower by approximately 25 hp. This modification would increase the climb and single-engine takeoff performance. Regarding this modification, the FAA mandated for Part 1351 aircraft the Time Between Overhaul as 1,600 hours or 12 years, this requirement did not apply to Part 912 aircraft such as N414FZ. At the time of the accident, the engines had operated for 5,827 and 4,447 hours since new and 1,764 and 1,774 hours since overhaul. However, RAM Aircraft had no record of the engines having been overhauled and considered it unlikely that the aircraft would still be able to achieve the increased performance from the modification that had been embodied in 1996. Aircraft weight The aircraft had last been weighed on 7 October 2013 when the basic weight was 4,875 lb and the centre of gravity was established as 156.97 inches aft of the datum. During the accident flight there was approximately 140 lb of equipment in the cabin. Performance graphs used on the accident flight The pilot reported that he would have calculated the aircraft’s performance during the accident flight using the aircraft’s POH, which he believed were based on the engines being equipped with the RAM modification. Calculation of aircraft performance by AAIB As RAM aircraft advised the AAIB that the performance curves for the RAM modification were unlikely to be achieved, the AAIB estimated the single-engine climb performance using a POH for unmodified engines. The performance was calculated on: Pilot and passenger 448 lb Basic weight 4,875 lb Other equipment 140 lb Fuel 618 lb

Total weight 6,066 lbs Temperature 27°C (81°F) Airfield height 550 ft (amsl) Footnote 1 Part 135 is regulations defined by the US Federal Aviation Administration (FAA) for operations of small commercial aircraft. 2 Part 91 is regulations defined by the US Federal Aviation Administration (FAA) for operations of small non- commercial aircraft.

43 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 N414FZ EW/G2018/06/33 These parameters gave a single-engine climb performance of 173 ft/min at maximum takeoff weight (6,350 lb) and a single-engine climb performance for the accident flight (6,066 lb) of 250 ft/min. This climb performance assumed: Max continuous power on the operating engine. The propeller was feathered on the inoperative engine. The flaps and landing gear were in the retracted position. The engine cowl flaps were closed on the inoperative engine and open on the operating engine. For the accident flight, the aircraft was flown at an airspeed of 101 kt AAIB comment Engine failure The pilot and the passengers reported that both engines operated satisfactory on the two flights prior to the accident flight. No problems were identified with the engines during the maintenance activity carried out 25 and 5 flying hours prior to the accident and the engine power checks carried out at the start of the flight were also satisfactory. It is therefore unlikely that there was a fault on both engines which would have caused the left engine to stop during the aborted takeoff and the right engine to stop during the initial climb. Fuel The aircraft was last refuelled at Dunkeswell Airfield and had successfully undertaken two flights prior to the accident flight. There had been no reports to indicate that the fuel at Dunkeswell had been contaminated; therefore, fuel contamination was unlikely to have been the cause. The pilot reported that there was sufficient fuel onboard the aircraft to complete the flight, which was evident by the intense fire in the poultry farm, most probably caused by the fuel from the ruptured aircraft fuel tanks. With sufficient fuel onboard for the aircraft to complete the flight, the most likely cause of the left engine stopping during the aborted takeoff, and the right engine stopping during the accident flight, was a disruption in the fuel supply between the fuel tanks and engine fuel control units. The reason for this disruption could not be established but it is noted that the fuel system in this design is more complex than in many light twin-engine aircraft. Aircraft performance The AAIB calculated the single-engine climb performance during the accident flight using the performance curves3 for engines not equipped with the RAM modification. It was a hot day and the aircraft was operating at 280 lb below its maximum takeoff weight. Assuming Footnote 3 Cessna Model 414 FAA Flight Manual applicable for serials numbers 414-0001 thru 414-0350, Revision 12, dated 29 August 1996.

44 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 N414FZ EW/G2018/06/33 the landing gear and flaps were retracted, the engine cowls on the right engine were closed and the aircraft was flown at 101 kt, then the single-engine climb performance would have been 250 ft/min. However, the circumstances of the loss of power at low altitude would have been challenging and, shortly before the accident, the aircraft was seen flying with the landing gear extended and the right engine still windmilling. These factors would have adversely affected the single-engine performance and might explain why the pilot was no longer able to maintain height. Bulletin Correction The AAIB report published in Bulletin 4/2019 reported in the Synopsis: ‘The pilot and passenger both sustained minor injuries.’ This was based on early information. It was later established that the passenger had sustained multiple injuries, including a fractured vertebra. The passenger’s injuries are therefore properly classified as ‘Serious’. The Bulletin header information should, therefore, read: Injuries: Crew - 1 (Minor) Passengers - 1 (Serious) The online version of this report was amended on the 14 November 2019 and a correction will appear in the December 2019 Bulletin.

FD06663 ｜ 2019_英国_aaib-investigation-to-cirrus-sr20-g-gcda__Cirrus_SR20_G-GCDA_07-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

54 © Crown copyright 2019 All times are UTC AAIB Bulletin: 7/2019 G-GCDA EW/G2018/10/25 ACCIDENT Aircraft Type and Registration: Cirrus SR20, G-GCDA No & Type of Engines: 1 Teledyne Continental IO-360-ES piston engine Year of Manufacture: 2008 (Serial no: 1962) Date & Time (UTC): 19 October 2018 at 1300 hrs Location: Turweston Aerodrome, Buckinghamshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A

Nature of Damage: Fire damage to ‘bolster’ switch panel circuit board and insulation Commander’s Licence: Private Pilot’s Licence Commander’s Age: 49 years Commander’s Flying Experience: 492 hours (of which 248 were on type)

Last 90 days - 10 hours

Last 28 days - 5 hours Information Source: Aircraft Accident Report Form submitted by the pilot and enquiries made by the AAIB Synopsis The aircraft owner was collecting his aircraft after its annual inspection. The pre-flight checks and takeoff roll were normal. However, just as the aircraft lifted off, the pilot became aware of smoke in the cockpit. He landed immediately and despite shutting down all the electrical equipment, the smoke persisted. With the assistance of an engineer, the source of the smoke and a small fire was identified and extinguished. It was caused by a ‘circuit track’ in a switch panel, which had been electrically overloaded because of an unidentified problem with a diode in the standby battery wiring harness. The aircraft manufacturer has taken several safety actions to ensure the significance of the diode is understood and have included an additional circuit protection device. The aircraft manuals and circuit diagrams have also been amended to clarify the circuit maintenance information. History of the flight The pilot was collecting his aircraft from Turweston aerodrome after its annual inspection. The pre-flight checks, engine-start and power checks were normal. The pilot then lined the aircraft up on the runway and started the takeoff roll. As the aircraft lifted off, smoke emanated from a switch panel in front of the pilot, near the primary instrument display. He called Turweston air/ground radio and reported smoke in the cockpit and advised of his intention to perform a brief circuit to land. There was no other traffic to conflict and the pilot

55 © Crown copyright 2019 All times are UTC AAIB Bulletin: 7/2019 G-GCDA EW/G2018/10/25 flew a low circuit and landed. On landing he switched all the electrical equipment off and opened the cabin door to clear the smoke. The smell of the smoke led him to believe that it may have been an electrical fire. He taxied the aircraft to the maintenance hangar and shut down. He noticed that despite all the electrical switches being turned off, the avionics still appeared to be powered. He then asked one of the engineers nearby for assistance. There was still a significant amount of smoke in the cockpit being generated from the switch panel. With assistance from the engineer, the engine cowling was removed and the main battery disconnected. Despite this, smoke continued to emanate from the switch panel which was then hurriedly removed. Material around the back of the switch panel had caught alight but was quickly extinguished. Engineering investigation Examination of the aircraft and switch panel, known as the ‘bolster panel’, found the fire had been caused in the circuit board behind the row of system master switches. One of the copper circuit tracks leading from the bat 2 master switch had completely melted away and the heat generated had also damaged circuit board mounted components and tracks nearby. A small fire appeared to have taken hold in a fibrous insulation material below the circuit board. System description The Cirrus SR20 is fitted with two batteries to support the avionics system in normal and emergency situations. Cirrus aircraft are fitted with a ballistic parachute recovery system (BRS) known under the manufacturer’s title as the Cirrus Airframe Parachute System (CAPS). The CAPS in this aircraft had been modified and is now electrically initiated, rather than the previous system in which a manual cable led from the cockpit to a percussion initiation device at the rocket. In the subject aircraft a diode was introduced as an integral part of the battery relay with the CAPS modification. This was fitted to suppress any possibility of a voltage spike on relay switch-over. When the relay manufacturer stopped including the diode within the relay, an external diode was introduced. It consists of a heat-shrink insulated diode with two spade connectors which connect it across the relay terminals. During the modification programme the aircraft circuit diagrams were updated by the manufacturer accordingly. Discussion During recent maintenance and prior to the flight, the No 2 battery relay was replaced to rectify a battery charging problem. Subsequent investigations suggest that a fault with the diode may have been the cause of the relay failure. It is also possible that its disturbance, during the relay replacement, could have led to a short within the diode and examination of the diode showed evidence of overheating. However, it is not clear exactly how or when the diode failed. Nevertheless, it appears to have allowed the No 2 battery load to pass through the relay coil and through the aircraft wiring to the circuit board track connecting the system to the bat 2 switch. The circuit track was not designed to sustain an electrical load of this magnitude and subsequently overheated.

The awkward location and unremarkable look of the diode assembly meant that its significance could easily be overlooked.

56 © Crown copyright 2019 All times are UTC AAIB Bulletin: 7/2019 G-GCDA EW/G2018/10/25 Actions by the aircraft manufacturer The aircraft manufacturer has examined the switch panel circuit and reviewed this sequence of events. The position and unremarkable look of the diode was understood by the manufacturer. In addition, they have also identified that there is a slight risk of mis‑assembly. To address this risk and to inform owners, the following safety actions are being carried out: An update to the parts catalogue, wiring manual and electric CAPS service bulletins have been released. The addition of a fuse to the harness assembly to prevent damage. The engineering drawings for this are now released and will be used in new aircraft. Issuing new CAPS kits is planned but not released yet. Adding the fused harness will require another round of revisions for the service bulletins. The fused harness is field retrofittable and can be installed in existing aircraft and listed as the field spare.

FD06664 ｜ 2019_英国_aaib-investigation-to-cirrus-sr22-g-srtt__Cirrus_SR22_G-SRTT_03-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

116 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 ACCIDENT Aircraft Type and Registration: Cirrus SR22, G-SRTT No & Type of Engines: 1 Teledyne Continental IO-550-N46 piston engine Year of Manufacture: 2007 (Serial no: 2421) Date & Time (UTC): 9 June 2018 at 1039 hrs Location: Benington, Hertfordshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - None Passengers - None Nature of Damage: Minor damge to fuselage at the lower left engine mount and where the CAPS cables pulled out of the structure; engine severely damaged Commander’s Licence: Private Pilot’s Licence Commander’s Age: 60 years Commander’s Flying Experience: 284 hours (of which 4 were on type)

Last 90 days - 18 hours

Last 28 days - 4 hours Information Source: Aircraft Accident Report Form submitted by the pilot, AAIB enquires and examination of the engine Synopsis Approximately eight minutes into a cross-country flight there was a catastrophic engine failure. At a height of approximately 800 ft agl the pilot successfully operated the aircraft’s parachute recovery system and the aircraft descended into a field near the village of Benington (Figure 1). The engine failure most probably occurred because of an insufficient quantity of oil. History of the flight The pilot reported that he was conducting a VFR flight from North Weald Airfield to Retford Gamston Airfield and was accompanied by a passenger, who also held a private pilot’s licence. The wind was approximately 5 kt from 070°. Approximately six minutes into the flight, and while at a cruise height of approximately 1,500 ft agl, the engine oil low pressure warning light illuminated. The engine oil pressure gauge, which would normally have indicated 45 to 50 psi, indicated approximately 9 psi. The pilot reduced the engine power, which reduced the airspeed from approximately 130 kt to 90 kt, and made a turn with the intention of returning to North Weald.

117 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 Figure 1 G-SRTT descending under the parachute (Photograph used with permission) Shortly after the pilot informed Farnborough Radar of his engine problem and intentions, the engine started to run rough, there was a loss of power and grey smoke and oil started to come out from the engine cowlings. At this stage the pilot had entered a shallow descent in order to maintain his airspeed. The rough running developed into severe banging, there was a further loss of engine power and the smoke became denser to the extent that the pilot had difficulty in seeing through the windscreen. The aircraft was now at a height of approximately 1,100 ft agl and while there were a number of large fields within glide range, with the smoke obscuring his forward visibility the pilot was not confident that he could make a safe landing. He was also concerned that an engine fire might develop. The passenger, on the pilot’s instructions, made a MAYDAY call to Farnborough Radar while the pilot checked that the area below the aircraft was clear and operated the Cirrus Aircraft Parachute System (CAPS) at a height of approximately 800 ft agl. The CAPS operated normally, and the aircraft descended into a field on the eastern edge of the village of Benington (Figure 2). The pilot and passenger were uninjured.

118 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 Figure 2 Accident site Aircraft information General The Cirrus SR22 is a four-seat light aircraft equipped with a single piston engine fitted with an oil-operated variable pitch propeller. The cockpit is equipped with two electronic displays: a Primary Flight Display (PFD) and a Multifunctional Display (MFD). Also mounted on the instrument panel is an annunciator panel that contains a red oil warning light that illuminates when the oil pressure is below 10 psi. Cirrus Aircraft Parachute System (CAPS) The Cirrus SR22 is fitted with CAPS, a ballistic parachute recovery system, which is designed to bring the aircraft and occupants to the ground in the event of a life-threatening emergency. Its deployment has been demonstrated in straight and level flight at a speed of 133 kt with a loss of height of 400 ft. In the event of an engine failure, Cirrus Aircraft provide the following advice in their document ‘Guide to CAPS’ (Figure 3). Figure 3 Extract from Cirrus aircraft document – Guide to CAPS

119 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 Engine General The aircraft was equipped with a Teledyne Continental IO-550-N46 six-cylinder, fuel-injected engine. The engine had been fitted with two Tornado Alley intercoolers and turbochargers by the aircraft manufacturer under a Supplementary Type Certificate. At the time of the accident the engine had operated for approximately 1,280 hours since new. The last significant maintenance on the engine occurred during the annual inspection carried out in June 2014, approximately 430 engine hours prior to the accident, when the No 2 and No 4 cylinders were found to be cracked. Both cylinders were replaced without disturbing the piston connecting rods. The engine was last inspected during the 50-hour servicing carried out approximately two weeks prior to the accident. The inspection revealed no evidence of an oil leak from the engine or propeller, or burnt oil residue in the exhaust system. Capacity of the engine oil system The Continental IO-550-N46 engine fitted to the Cirrus SR22 has a certified oil capacity of 8 US quarts, whereas the IO-550 engine used in other aircraft installations has a 12 US quart system with the extra 4 US quarts used for cooling. The aircraft manufacturer advised that the IO-550-N engine was reduced to 8 US quarts (slightly smaller sump) as the SR22 cowling provided better aerodynamic cooling. Regarding the oil system, the Pilot’s Operating Handbook (POH) provides the following caution: ‘The engine should not be operated with less than six quarts of oil. Seven quarts (dipstick indication) is recommended for extended flight.’ The pilot on the accident flight informed the AAIB that he checked the oil level during the pre-flight walk round and it was full at 8 US quarts. He also reported that there was no evidence of oil leaks on the outside of the aircraft. Description of the engine oil system The engine is provided with a wet-sump, high-pressure oil system for engine lubrication and cooling (Figure 4). The engine oil, which is contained in the oil sump, is drawn through a screen into the oil suction tube to the inlet of the positive displacement oil pump. Pressurised oil from the pump outlet is directed past the oil pressure relief valve to the oil filter. From the oil filter, pressurised oil flows through a crankcase passage to the oil cooler.

120 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 Figure 4 Engine oil system From the oil cooler the oil is directed to the oil galley in the left side of the crankcase and the camshaft. The oil in the left side of the crankcase is directed to all the main bearings and then feeds through galleys in the crankshaft to each of the connecting rods (Figure 5). The oil lubricating the main bearings is also directed to the oil squirt nozzles that spray a mist of oil onto the bottom side of the pistons to lubricate the cylinder walls and piston pins; gravity returns the oil to the sump. Oil that passes through the left side of the crankcase is also used for the propeller governor operation. Oil is also passed though the camshaft to the right side of the crankcase to lubricate the valve lifters and other cylinder components. MB = Main crankshaft bearing CB = Connecting rod bearing MB1 MB2 MB3 MB4 MB5 CB1 CB2 CB3 CB4 CB5 CB6 Figure 5 Crankshaft oil transfer passages The oil pressure is sensed by a transducer located between the oil cooler and crankshaft oil gallery and the oil temperature by a sensor located in the sump.

121 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 Engine limitations The POH provides the following engine operating limitations: Oil Temperature …………..240°F (115°C) maximum Minimum oil pressure …….10 psi Engine indications The SR22 is equipped with engine instrumentation and warning lights to monitor the engine performance. A data acquisition unit converts analogue signals from the cylinder head temperature (CHT), exhaust gas temperature (EGT), manifold air pressure (MAP), oil pressure, oil temperature and tachometer to digital format which is then transmitted to the MFD and the PFD. The engine oil pressure is continuously displayed in the engine data block located in the lower right corner of the PFD. System health, caution, and warning messages are displayed in colour-coded advisory boxes in the lower right corner of the MFD (Figure 6). In addition, the text of the engine parameters displayed on the PFD changes to the corresponding colour of the advisory box during an annunciation event.

Messages are displayed in this area Figure 6 Multi Functional Display If the oil pressure falls below 30 psi or exceeds 75 psi, the MFD will display ‘Check Oil Press’ in a yellow advisory box in the lower right corner of the MFD. If the oil pressure falls below 10 psi or exceeds 99 psi, the MFD will display ‘Check Oil Press’ in a red advisory box. An annunciator panel located in front of the pilot contains an oil warning light which illuminates when either the oil pressure or oil temperature warning messages are generated.

122 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 Emergency procedures for low engine oil pressure Regarding low oil pressure, the POH provides the following guidance to the pilot: ‘If low oil pressure is accompanied by a rise in oil temperature, the engine has probably lost a significant amount of its oil and engine failure may be imminent. Immediately reduce engine power to idle and selected a suitable forced landing field. Note If low oil pressure is accompanied by normal oil temperature, it is possible that the oil pressure sensor, gauge, or relief valve is malfunctioning. In any case, land as soon as practical and determine cause.’ Engine data The aircraft MFD has a Flight Data Logging feature which automatically stores critical flight and engine data on a compact flash card. The engine data for the accident flight is plotted in Figure 7. The data shows that the engine had been running for 11 minutes before the rpm and MAP increased for takeoff. During this period the oil temperature rose progressively to 162°F and the oil pressure reduced to approximately 45 psi before peaking at 58 psi as the engine speed was increased to 2,670 rpm. Over the next 13 minutes, the oil temperature continued to increase, peaking at 198°F. Approximately 6 minutes after the start of the takeoff run, the oil pressure reduced to 30 psi (yellow warning) and 2 minutes later reduced to 10 psi (red warning). The engine stopped rotating approximately 13 minutes after the takeoff run commenced. During the flight the CHTs peaked at 346°F, and the EGTs at 1,436°F. Apart from the reducing oil pressure, all the parameters indicate that the engine was operating normally until 30 seconds before the engine stopped, when the EGTs started to decrease. The engine data for the four flights prior to the accident fight appeared to be normal with the oil pressure remaining at around 50 psi during the cruise. The oil temperature during the previous flights peaked at between 184°F and 195°F; on the accident flight the oil temperature peaked at 198°F. Examination of the aircraft and engine Examination of the aircraft at the accident site The engineering organisation who recovered the aircraft reported that the only significant damage to the aircraft was to the area of the fuselage adjacent to the lower left engine mount and the areas where the cables for the CAPS had been pulled out of the airframe. The CAPS had operated as designed. Engine oil had leaked onto the ground from the sump, which had been punctured during the impact. There was a hole in the crankcase next to the No 4 cylinder through which the oil had leaked out of the engine in flight. There was no other evidence of an oil leak

123 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 from the engine or propeller. The engineering organisation also reported there was no evidence of residues in the exhaust to indicate that oil had been burnt in the combustion chambers. The engine could not be rotated by hand.

Figure 7 Engine data from accident flight

124 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 Examination of the engine by the AAIB An examination of the engine was carried out by the AAIB at the engine overhaul facility. For reference, the parts of a generic piston and connecting rod assembly are shown at Figure 8. Connecting rod Bearing cap Piston Journal Figure 8 Generic piston and connecting rod The bearing caps on the No 3 and No 4 piston connecting rods had become disconnected. Damage to the No 4 connecting rod indicated that it had then been struck by the crankshaft with sufficient force for it to knock a hole approximately 10 cm by 8 cm in the crankcase beneath the No 4 cylinder (Figure 9). Number 4 cylinder Hole in crankcase Figure 9 Hole in the crankcase caused by the No 4 connecting rod

125 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 The No 2 piston connecting rod was seized on the crankshaft and the No 5 piston connecting rod was partially seized. The No 1 and No 6 connecting rods rotated normally. Except for the No 1 connecting rod, there was discoloration and corrosion on the bottom part of all the connecting rods, which was greatest on the inner four connecting rods (Figure 10). The bearing material on all the overheated connecting rods had extruded out of the bearing caps leaving the connecting rods running on the steel shells. There was no evidence that any of the bearings had rotated in their journals. The crankshaft counterweights were intact and there was no evidence of overheating on the cylinders, pistons or valve assemblies. Figure 10 Corrosion and discoloration on connecting rod and bearing cap The bottom of the No 3 connecting rod and bearing cap had broken into four parts and the remnants of the bolts exhibited failure in overload. The skirt on the piston had also broken off (Figure 11). The No 4 bearing cap was intact, and distorted, and had separated from the connecting rod. The parts of the two bolts that remained in the bearing cap also exhibited necking associated with failure in overload. Figure 11 Damage to No 3 and No 4 connecting rod and bearing caps No 3 Connecting rod and bearing cap No 4 Connecting rod and bearing cap

126 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 Parts of two bolts, that had failed in overload, a nut containing part of a bolt that had failed in shear and a broken part of a nut where found in the engine (Figure 12). Necking due to overload Figure 12 Parts of failed nuts and bolts recovered from the engine Overall condition of the engine There were multiple sites of impact damage within the crankcase and on the bottoms of the pistons, caused by flying debris. The oil galleries in the crankshaft were checked and found to be clear. There was oil throughout the engine and debris from the crankcase was found in the oil filter. The remainder of the oil system, including the bypass and relief vales were intact and operated normally. There was no evidence of an oil leak in the turbochargers. There was no evidence of overheating in the cylinders or pistons, or at the ends of the crankshaft. All the piston rings and oil scrapers were intact and there was no evidence of oil having been burnt in any of the combustion chambers. Metallurgist report Metallurgists from QinetiQ examined the failed bolts, the parts that were recovered from the No 2 and 3 connecting rods, and photographs of the crankshaft taken by the AAIB. The parts had been badly damaged and based on the evidence available they concluded that the main bearings on the No 3 and 4 connecting rods had overheated sufficiently to cause the bearing material to melt and the strength of the steel bolts to reduce such that they failed in overload.

127 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 Engine oil consumption No complete record had been kept of either the engine oil level or oil replenishments. Pilots of this aircraft on previous flights stated that the engine oil level was satisfactory at the start of the flight, there was no evidence of oil leaks and no additional oil was added to the engine. Analysis Engine failure Examination of the engine revealed that the temperature at the bottom of a number of the connecting rods had been sufficient for the bearing material to melt and for the No 3 and 4 connecting rod cap bolts to fail in overload. There was no evidence of overheating in any other part of the engine and no fault was found in the engine lubrication system. The engine manufacturer advised that the heat damage along the crankshaft and the failure of the connecting rod bearings was consistent with the engine having been operating with a low level of oil. With insufficient oil to cool and lubricate the bearings, the temperature of the bearing material would increase and start to melt, causing the gap between the bearing surface and the crankshaft to increase. This would result in an increase in vibration and a drop in the oil pressure which would affect the cooling and lubrication of other parts of the engine. Once all the bearing material had melted, the connecting rod would be left running on the steel bearing shell, which would have caused a further increase in temperature sufficient to reduce the tensile strength of the cap bolts so that they failed under normal loads. The engine data indicates that the rise in temperature at the connecting rod bearings, and subsequent failure of the cap bolts, occurred over a short period of time and before there was sufficient heat transfer from the crankshaft to affect the temperature of the oil in the engine sump where the temperature sensor is located. Loss of oil Apart from the oil that had been lost through the hole in the crankcase, caused by the failed No 4 connecting rod, there was no other evidence of the engine having sustained an oil leak during the accident flight. Nor was there any evidence that the engine had been burning oil. Actions of the pilot The pilot was aware of the decreasing oil pressure, without a corresponding increase in temperature, and considered that he acted in accordance with the POH to land as soon as practicable. However, once the connecting rod failed he not only had insufficient power to maintain height but his forward visibility was affected by the smoke from the engine. He was also concerned at the possibility of an engine fire. The pilot acted in accordance with the recommendation from Cirrus to operate CAPS immediately if the engine failure occurs between 500 to 2,000 ft agl. The CAPS was deployed at approximately 800 ft agl and the aircraft descended into a field approximately 120 m from the village of Bennington without injury to the pilot or passenger.

128 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 G-SRTT EW/G2018/06/09 Conclusion The pilot activated the CAPS following an engine failure in accordance with the POH and advice by the aircraft manufacturer.  The engine failure was due to overheating of the connecting rod cap bolts as a result of insufficient cooling by the engine oil. AAIB comment This accident highlights the importance of understanding the sensitivity of an engine’s oil capacity and oil level during flight. The engine in the Cirrus SR22 has a certified oil capacity of 8 US quarts and a drop from the maximum level can increase the risk of the bearings starting to overheat and fail. It is also worth emphasising that a drop in oil pressure, without a corresponding increase in oil temperature, does not necessarily indicate that the fault is caused by an oil sensor or gauge and, therefore, a pilot should land as soon as safely practical. In considering whether to make a field landing, a pilot would need to consider the risk of continued flight to a suitable airfield against the risk of a precautionary landing in a field. Bulletin correction Following further discussion with the pilot, the conclusion to this report now reads: Conclusion The pilot activated the CAPS following an engine failure in accordance with the POH and advice by the aircraft manufacturer.  The engine failure was due to overheating of the connecting rod cap bolts as a result of insufficient cooling by the engine oil. The online version of this report was corrected prior to publication.

FD06665 ｜ 2019_英国_aaib-investigation-to-cirrus-sr22-g-srtt__Cirrus_SR22_G-SRTT_Corr_05-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

91 © Crown copyright 2019 All times are UTC AAIB Bulletin: 5/2019

AAIB Bulletin: 5/2019 G-SRTT EW/G2018/06/09 BULLETIN CORRECTION Aircraft Type and Registration: Cirrus SR22, G-SRTT Date & Time (UTC): 9 June 2018 at 1039 hrs Location: Benington, Hertfordshire Information Source: Aircraft Accident Report Form submitted by the pilot, AAIB enquiries and examination of the engine AAIB Bulletin No 3/2019, page 128 refers Following further discussion with the pilot, the conclusion to this report now reads: Conclusion The pilot activated the CAPS following an engine failure in accordance with the POH and advice by the aircraft manufacturer.  The engine failure was due to overheating of the connecting rod cap bolts as a result of insufficient cooling by the engine oil. The online version of this report was amended prior to publication.

FD06666 ｜ 2019_英国_aaib-investigation-to-colomban-mc-30-luciole-g-cibj__Colomban_MC-30_Luciole_G-CIBJ_11-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

54 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-CIBJ EW/G2019/04/06 ACCIDENT Aircraft Type and Registration: Colomban MC-30 Luciole, G-CIBJ No & Type of Engines: 1 Briggs And Stratton 0114-E1 piston engine Year of Manufacture: 2013 (Serial no: LAA 371-15002) Date & Time (UTC): 10 April 2019 at 1815 hrs Location: Farm strip at Thankerton, South Lanarkshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Destroyed Commander’s Licence: National Private Pilot’s Licence Commander’s Age: 83 years Commander’s Flying Experience: 15,324 hours (of which 60 were on type)

Last 90 days - 1 hour

Last 28 days - 1 hour Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis After a local flight, the ground taxi route back to the hangar involved several tight turns and when full left rudder pedal was applied the cockpit filled with smoke. The pilot exited the aircraft without injury and the ensuing fire consumed the aircraft. It is suspected that the terminals of the starter solenoid were not insulated, and the rudder pedal created an electrical short circuit which damaged a fuel pipe and ignited the fuel. Several Safety Actions have been taken to prevent recurrence. History of the flight The pilot had returned to the farm strip in Thankerton, where the aircraft was based, after an uneventful local flight. After landing the pilot taxied the aircraft to the hangar. The route from the airstrip to the hangar involved several tight turns (Figure 1) and it was following a left turn, where the pilot applied full left rudder pedal, that he felt a restriction. Shortly afterwards the cockpit filled with smoke and the pilot quickly exited the aircraft. In his haste to exit he did not wait for the aircraft to come to a halt, turn off the fuel or turn off the ignition. The aircraft was destroyed by fire (Figure 2) but the pilot did not suffer any injuries.

55 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-CIBJ EW/G2019/04/06 Figure 1 Thankerton farm strip – taxi route and accident location

Figure 2 G-CIBJ shortly after the pilot had evacuated Aircraft information The Colomban Luciole is an ultra-lightweight single-seat aircraft, home built from plans and is powered by a V-twin four-stroke petrol engine. The construction is a mixture of wood, plywood, metal, foam and carbon reinforced plastic and has a maximum takeoff weight of 200 kg. The compact cockpit footwell has the battery on the floor of the left side with the starter solenoid mounted forward on the engine bulkhead. The fuel tank is behind the instrument panel with the fuel supply pipes, associated electrical pump and filter routed along the right

56 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-CIBJ EW/G2019/04/06 side of the cockpit, going forward and through the engine bulkhead just beneath the starter solenoid. The rudder pedals are adjustable fore and aft on a moveable carriage to suit the pilot and are centralised using elastic cords (Figure 3). During the accident flight the rudder pedals were adjusted fully forward. Ignition Starter solenoid Fuel system Rudder pedals on moveable carriage Battery Figure 3 Cockpit interior (not G-CIBJ) Analysis During the taxi manoeuvres the pilot noted a restriction when he applied full left rudder pedal and shortly afterwards smoke was seen in the cockpit. It is probable that, as the rudder pedal carriage was in the fully forward position, the metal pedal contacted the exposed terminals of the starter solenoid. The solenoid is connected directly to the battery and the metal rudder pedal created a short circuit to earth, resulting in rapid discharging of the battery and overheating of the electrical system. Evidence was found of local heat damage to the engine bulkhead around the starter solenoid. This overheating may have caused the fuel pipe to melt, with a spark igniting the fuel and the aircraft was then consumed by the fire. The plans for the aircraft state that the terminals of the solenoid should be “perfectly isolated”. The Light Aircraft Association (LAA) has examined all other Luciole aircraft registered in the UK and confirmed that all the terminals are insulated (Figure 4). It is suspected that only G-CIBJ did not have this insulation and awareness of this issue has been raised by the LAA in their June 2019 “Safety Spot” publication and Technical Leaflet TL3.26. The LAA intends to mandate a change to the specification of the fuel pipe in the cockpit to one that is more heat resistant and will require all UK owners to modify their aircraft to this new fuel pipe specification.

57 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-CIBJ EW/G2019/04/06

Insulated starter solenoid terminals Fuel pipe Figure 3 Cockpit interior (not G-CIBJ) The LAA will mandate that all UK-registered Colomban Luciole aircraft be modified to the higher heat resistant fuel pipe specification. Conclusion The source of the fire which consumed the aircraft was the electrical system, which had overheated due to a short circuit. The short circuit was made by the metal rudder pedal contacting the exposed terminals of the starter solenoid mounted to the engine bulkhead. The rudder pedals had been adjusted to the fully forward position and due to the pedal inputs required for the taxiing manoeuvres, the left pedal had contacted the exposed terminal. The plans for the aircraft required the terminals to be insulated; however, the insulation had not been fitted to G-CIBJ. The LAA will mandate that the fuel pipes on all UK-registered Luciole aircraft be modified to a higher heat resistant specification. Safety actions/Recommendations The LAA has recommended that all UK-registered Colomban Luciole aircraft be modified to the higher heat-resistant fuel pipe specification.

FD06667 ｜ 2019_英国_aaib-investigation-to-dh82a-tiger-moth-g-adxt__DH82A_Tiger_Moth_G-ADXT_01-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

44 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 ACCIDENT Aircraft Type and Registration: DH82A Tiger Moth, G-ADXT No & Type of Engines: 1 De Havilland Gipsy Major 1H piston engine Year of Manufacture: 1935 (Serial no: 3436) Date & Time (UTC): 26 August 2017 at 0828 hrs Location: Near Compton Abbas Airfield, Dorset Type of Flight: Introductory Flight Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - 1 (Fatal) Passengers - 1 (Fatal) Nature of Damage: Aircraft destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 64 years Commander’s Flying Experience: 22,240 hours (of which 512 were on type)

Last 90 days - 50 hours

Last 28 days - 24 hours Information Source: AAIB Field Investigation Synopsis The aircraft was carrying out an introductory flight with the pilot and a passenger aboard. As it became airborne from Runway 08, the engine was heard to misfire, but the aircraft continued to climb before making a left turn. Shortly afterwards, the pilot reported an engine problem and his intention to return to the airfield. The aircraft was on the base leg of an approach for Runway 26 when the nose pitched down, and it appeared to enter a steep descending turn to the left from which it did not recover before impact in a crop field. Both occupants were fatally injured. History of the flight The flight was intended to be an introductory flight for the passenger, which the operator referred to as an “air experience flight”, and was the aircraft’s first flight of the day. The pilot arrived at the airfield and was seen to carry out a full pre-flight inspection of the aircraft including checking the fuel tank quantity, which was full, and performing a water check of a fuel sample. The passenger arrived at the airfield at about 0730 hrs and completed the required documentation before receiving a briefing on the aircraft and associated safety matters. He was then dressed in flying clothing, including a flight suit, leather gloves, flying jacket, goggles, and a helmet with a built-in headset and microphone.

45 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 The passenger was taken to the aircraft and assisted into the front cockpit by a member of the ground crew who ensured his safety harness was secure and that the headset lead was connected. He also pointed out the flying controls and other items to remain clear of. The pilot then occupied the rear seat. His normal habit was to carry out his general and safety brief of the passenger. The flight was to last for 30 minutes and was to overfly Shaftsbury, followed by the Steam Fair at Blandford Forum, before returning to the airfield. The weather at the time of the accident was not recorded but included light and variable wind, clear skies and good visibility with a small amount of fog in the valley to the north of the airfield (Figure 1). The temperature and dew point were not recorded at the airfield. Another member of the ground crew was responsible for starting the engine by hand swinging the propeller. The normal procedure of priming the fuel line and cylinders was followed and on the second swing of the propeller the engine briefly ran backwards. With the possibility of an over-primed engine, the propeller was turned backwards several rotations in accordance with the operating manual and a second attempt to start was made but was unsuccessful. On the third start cycle, at the second attempt, the engine started and was warmed up before the magneto checks were performed by the pilot, which sounded normal with no rough running. The wheel chocks were removed and the aircraft taxied to the threshold of Runway 08. It was seen to accelerate along the runway before becoming airborne at about the 300 m marker. At that point, the engine was heard to misfire but the aircraft continued to climb. Witness recollections indicate that the aircraft probably made a left turn to the north, which was the intended direction after departure. The airfield does not record radio transmissions on its air/ground frequency but the operator heard the pilot transmit in an apparently calm voice that he had a “rough running engine” and was making a 180º turn to land on Runway 26. The radio operator responded that the wind was light and northerly. The engine could not be heard by witnesses at the airfield. The perceived direction of turn differed between witnesses, but during the turn or when rolling out of it, the aircraft appeared to be slow and in one witness’ description, it appeared slow and became unstable before a wing dropped sharply and the aircraft descended rapidly in a turn which they thought was to the right. One witness thought that as it departed the airfield, it pulled up sharply before making a right turn and descending steeply towards the ground. A witness approximately 1,500 m south of the accident site heard and then saw the aircraft climbing slowly at low airspeed, with the engine “sounding awful and misfiring” before it descended “corkscrewing down”. A flying instructor, who had been speaking to the accident pilot earlier, was next to the radio operator when he heard the transmission indicating engine trouble. He looked out of the window and located the aircraft heading north approximately 1 to 2 nm from the airfield at about 500 feet above airfield elevation. He saw it make a gentle, descending left turn onto a right base leg for Runway 26 and when above some high trees at the eastern end of the

46 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 field, at about twice their height and some 200 m beyond them, the nose pitched sharply down and the aircraft rolled to the left in a steep descending turn. Shortly afterwards a column of smoke was seen. Two witnesses at a farm approximately 350 m from the accident site heard the aircraft takeoff. One saw it briefly above trees before losing sight of it behind a barn, after which they heard the engine stop. Driving towards the scene they could see smoke and on arrival at the wreckage they were unable to assist the occupants. The aircraft had struck the surface of a crop field in a steep nose-down attitude and caught fire. The airfield fire and rescue service attended the scene and controlled the fire using foam and dry powder. Both the pilot and passenger were fatally injured. The police control room log recorded that the accident was reported at 0828 hrs1; the first person reporting it thought that they did so approximately 30 seconds after the accident. Figure 1 below shows the aircraft immediately prior to departure with the weather as described and the fog at the western end of the valley north of the airfield. Figure 1 G-ADXT before the accident Footnote 1 The control room log does not record the exact time in minutes and seconds and, therefore the log was started between 08:28:00 and 08:28:59.

47 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Accident site and initial assessment of the wreckage The accident site was in a cornfield approximately 0.4 nm east of the threshold of Compton Abbas Runway 26. Examination of the wreckage indicated that the aircraft was structurally intact prior to the accident. The aircraft struck the ground in a steep nose-down attitude, coming to rest on a heading of approximately 130ºM. A significant post-crash fire consumed most of the fabric covering of the aircraft and cockpit structure including the seats, instruments, instrument panels and electrical wiring. The steel frame of the fuselage structure was distorted due to loads imparted in the accident. The wooden wing spars and associated structure had burned to varying degrees, with the right wing being more badly affected than the left. The fire had consumed both safety harnesses, but the harness lugs were found to be fully engaged and locked in their respective buckles. The front cockpit shoulder harness attachment cable had failed due to overload. One of the propeller blades had broken from the hub and its remains were found embedded in the soil beneath the aircraft. The root of the second blade remained attached to the hub but was partially burnt. Both blades had broken approximately mid-span and they had both come to rest to the left of the aircraft centreline. The investigation determined that the flying controls and their operating mechanisms were intact prior to the accident. Approximately two litres of residual fuel were siphoned from the aircraft fuel tank, which had ruptured. The wreckage was recovered to the AAIB at Farnborough for detailed examination. Aircraft information General The De Havilland DH82A Tiger Moth is a single-engine wire-braced biplane with two open cockpits in tandem. The fuselage is constructed of welded steel tubing covered in fabric and the floor and cockpit decking are of plywood. The engine cowling is of metal construction with hinged side panels, and the wings are primarily constructed from wood with fabric covering. Flying controls Dual controls consisting of a conventional control stick and rudder pedals allow the aircraft to be flown from either cockpit, although with a single pilot it is normally flown from the rear cockpit.

48 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 The primary flying controls consist of a rudder, elevators and ailerons; the latter on the lower wings only. The control surfaces are of wooden construction with fabric covering but the trailing edges of the elevators and the rudder are made from light alloy tubing. G-ADXT was fitted with slots on the leading edges of the upper wings which, when unlocked, deploy automatically at high angles of attack. It was not equipped with the optional anti-spin strakes fitted to some Tiger Moths. The strakes were introduced after the Royal Aircraft Establishment studied spin characteristics in 1941 when aircraft were fitted with aileron mass balance weights and bomb racks. Aircraft performance limits are not affected but the aft centre of gravity limit is reduced if strakes are not fitted. Safety harnesses The original ‘Sutton-type’ harness was designed to ‘keep the wearer firmly in his seat’ and the specification dated from circa 1940. The harness was not part of an integrated crashworthy aircraft design in which energy absorption and survivable space were considered to the extent that they are for more modern aircraft. G-ADXT was fitted with ‘Z’ type harnesses. The shoulder straps were fixed to the aircraft by a cable running across the fuselage, and the lap straps were attached to the fuselage structure. A CAA mandatory airworthiness directive was issued in 2000 to introduce higher strength transverse cables for the attachment of the shoulder straps. Fuel system An aerofoil section fuel tank manufactured from tinned steel sheet is fitted above the front cockpit between the upper wings. The tank has a capacity of 19 Imperial gallons (IG) (approximately 86 litres). G-ADXT was not equipped with the optional extended range tank. Fuel is fed by gravity. It leaves the tank via a shut-off valve and flows through a copper pipe before passing through a filter on the right of the engine compartment. A flexible hose delivers the fuel from the filter to a carburettor. The fuel shut-off valve can be opened and closed from either cockpit by interconnected push-pull rods. Fuel is turned on and off by moving the control forwards and backwards, respectively. A mandatory airworthiness directive, applicable to all Tiger Moths operating on the UK CAA register, requires the installation of a locking device to ensure that the shut-off valve cannot be closed inadvertently in flight. Compliance with the directive was not recorded in the airframe log book but the locking device was found amongst the wreckage and its condition indicated that it was serviceable prior to the accident. Oil system Engine oil is contained in a welded aluminium tank fitted to the outside of the left fuselage immediately behind the engine cowling. The oil tank has a capacity of 2.1 IG (approximately 9.5 litres).

49 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Engine and controls G-ADXT was equipped with a Gipsy Major 1H engine driving a fixed-pitch, two-bladed, wooden propeller. The Gipsy Major is a four-cylinder, air-cooled, inline inverted engine. The engine is equipped with two independent ignition systems comprising two magnetos, one on each side of the engine, each feeding four spark plugs. The right magneto is fitted with an impulse coupling, which retards the ignition to aid engine starting. Two pairs of ignition (magneto) switches are fitted outside each cockpit on the left-side of the fuselage. The front switch of each pair controls the right magneto and the rear switch of each pair controls the left magneto. A control in each cockpit operates the throttle by means of metal control rods. Throttle and magneto controls are interconnected so that when the throttle is closed the ignition is fully retarded. The throttle is moved forward to increase engine power and an engine rpm gauge is fitted in both cockpits. G-ADXT was equipped with an automatic carburettor heating system, designed to minimise the risk of carburettor icing. The Tiger Moth air intake is of a two-way construction such that cold air can be drawn from an air scoop or warmer air can be drawn from the vicinity of the engine crankcase. The source of the air is determined by the position of a flap valve inside the air intake. The valve is interconnected with the throttle so that when the throttle is fully open cold air is admitted, but at lower power settings, warm air from the engine bay is admitted. A return spring is used to bias the valve to the warm air position when the engine is not running at high power. Engine starting G-ADXT was not equipped with an electronic starting mechanism, so the engine was started by hand swinging the propeller. The Bristol Siddeley Gipsy Major handbook, dated December 1958, gave the procedure as follows: ‘1. Ensure that all oil cocks, if fitted, are turned on.

1. Ensure that both magnetos are switched off.
2. Turn on the fuel cock.
3. Set the throttle lever in the fully closed position.
4. Set the mixture (altitude) control in the fully rich position. On some

installations a catch on the throttle lever ensures that the mixture control is automatically returned to rich as the throttle is closed.

1. Where a manual air-intake control is fitted (Mk.7 embodying Mod. G.1483)

set the hot-and-cold air intake control on the cold air position.

1. Where the fuel supply is by gravity (Tiger Moth 2 installation) depress the

carburettor flooder valve knob. Where engine driven pumps are fitted (Magister 1 and Auster T7 installations) operate one of the fuel pumps through the full range of travel whilst holding out the carburettor flooding device.

50 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03

1. Turn the engine through several revolutions by the propeller in order to

prime the cylinders.

1. Move the throttle lever forward about ½ in. from the fully closed position.
2. Switch on the starboard magneto.
3. Swing the propeller cleanly through the compression stroke to start the

engine. When the propeller is being swung, it is advisable for a second operator to be ready to adjust the throttle lever setting if required, as the engine starts.

1. When the engine is running switch on the port magneto.’

The handbook states: ‘The engine should start easily in normal weather.’ and ‘The most likely cause of trouble is over-priming. If this occurs, switch off both magnetos, and with the throttle fully open turn the engine backwards by hand. If the engine still fails to start after two or three successive attempts reference should be made to Chapter 8 and a systematic investigation made.’ Chapter 8 of the handbook contains a list of possible defects, over-priming and insufficient priming being the first two scenarios to be considered if the engine fails to start. Weight and balance The aircraft was estimated to weigh 1,780 lbs at takeoff with a CG position 12 inches aft of the datum2. The CG limits were +7.0 inches to +13.5 inches when anti-spinning strips are not fitted as in the case of G-ADXT. The maximum permitted takeoff weight was 1,825 lbs. Aircraft history General G-ADXT was built in 1935 and, according to the airframe logbook, had accumulated approximately 1,245 flying hours. The engine had accrued approximately 862 hours, which was within the defined 1,500 hours between overhauls. In 2001, the aircraft was involved in an accident in which the engine had stopped during an inverted aerobatic manoeuvre3. The aircraft was repaired and returned to service. Footnote 2 The CG datum for this aircraft was the lower wing leading edge at the root. 3 https://assets.digital.cabinet-office.gov.uk/media/5422f8b9e5274a13140006af/dft_avsafety_pdf_500228. pdf [accessed on 9 August 2018].

51 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 At the time of the accident in August 2017, the aircraft had a valid National Certificate of Airworthiness and a current Type Responsibility Agreement4. The available records indicated it was maintained in accordance with the Civil Aviation Authority Light Aircraft Maintenance Schedule. Aircraft log book, technical log and operator’s diary The last 10 days of operations had not been incorporated into the airframe and engine log-books, but the technical log was comprehensive and there were no outstanding faults recorded. The operator maintained an informal diary to enable the sharing of information within the local team. Diary entries were not attributable to individuals and the content varied. Nevertheless, it provided an insight into the recent operation of G-ADXT and information relating to 137 flights showed that approximately 85% of the engine starts were achieved within five swings of the propeller. Recent maintenance history In September 2016, the aircraft underwent a routine 50-hour service. Maintenance records indicate that low compression was identified on two cylinders and all four cylinder heads were removed and returned to an authorised repair organisation. The repair agent stated that he was not told why the components were removed and only the cylinder heads and valves were returned; the aircraft maintenance organisation retained the valve springs and rocker arms. Four new exhaust valve guides were fitted; the valves were reworked and their clearances were checked before the assemblies were recertified and refitted to G-ADXT.

Approximately 25 flying hours later, in February 2017, the aircraft underwent an annual check. Maintenance paperwork referred to a ‘report of rough running engine’ and low compression was identified on two cylinders. The number 1 and 2 exhaust valves were found ‘stuck open’ and the respective cylinder heads were removed and returned to the repair agent, complete with their valve springs. The repair agent identified that the number two exhaust valve was bent, and a replacement valve was installed; the replacement valve was inspected prior to use and was annotated with a local serial number. The repair agent reworked the assemblies and checked the valve clearances and spring forces before returning the equipment to the aircraft maintenance organisation. The aircraft underwent its most recent scheduled maintenance in June 2017. The right magneto was removed for repair after difficulties starting the engine. Maintenance records indicate that the timing was adjusted and four new spark plugs were installed. Footnote 4 If an aircraft type is no longer supported by a UK Type Certificate Holder, the UK CAA allows an owner to obtain a National Certificate of Airworthiness if a suitably capable organisation has entered into a Type Responsibility Agreement with the CAA. The organisation must be capable of monitoring the continued airworthiness of the type and in the case of a Tiger Moth, this organisation is de Havilland Support Ltd.

52 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 When the accident occurred, the aircraft had completed approximately 70 flying hours in 225 flights since the cylinder heads were reworked. It had completed 77 flights since the right magneto was refitted. Previous report of a rough running engine Thirteen days before the accident, during the first flight of the day, another pilot encountered a rough running engine while flying G-ADXT. With sufficient performance to maintain altitude he decided to return to Compton Abbas, but the symptoms cleared and he completed the flight in the local area. Six more flights were completed that day with no recurrence and the pilot considered it to have been an isolated event; he did not record it in the technical log. The aircraft completed approximately a further six flying hours in 19 flights before the accident. Detailed examination of the wreckage Flying controls There was evidence the flying controls were connected before the accident, but it was not possible to establish the control surface positions at impact. Instruments The cockpit instrumentation was severely damaged in the accident and fire, except for an altimeter which had been thrown clear of the wreckage. The front cockpit engine rpm gauge was found to indicate approximately 1,175 rpm and examination using a computerised axial tomography scanning facility identified that the pointer had disengaged from its drive mechanism. The gauge was disassembled for closer examination, but it was not possible to validate the pointer reading. Typical engine speed in cruising flight is approximately 1,900 rpm, and approximately 2,100 rpm when climbing. Fuel system The fuel shut-off valve was found in the off position. The fuel delivery pipe had broken at the filter and the fuel tank had ruptured along the length of one of its joints. The internal construction and cork float showed a combination of impact and fire damage, the varnish coating of the float having been severely degraded or burnt. Analysis of the fluid that was siphoned from the tank after the accident was inconclusive because of the effects of thermal degradation. The aircraft technical log indicated that the fuel tank was full prior to the flight and a fuel receipt, signed by the accident pilot, showed that 27.78 litres of Avgas 100LL were supplied to G-ADXT on 22 August 2017. This was the last time the aircraft was refuelled prior to the accident and a combined total of 281 litres of Avgas 100LL was supplied to four other aircraft from the same facility on the same day with no reports of problems. Also, prior to the accident, there were another 48 supplies of Avgas 100LL from the same facility with no reports of anomalies. Analysis of a fuel sample retained from 22 August 2017 showed it to be typical of Avgas 100LL, though degraded during storage since the sample was taken.

53 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Engine controls It was not possible to determine the throttle position at impact because of the damage sustained in the accident. Both sets of magneto switches were found and all four switches were in the on position. Engine The engine was dismantled under the supervision of the AAIB. The magnetos and ignition harnesses had been severely damaged and, apart from the impulse coupling, which was found to be in good condition, it was not possible to assess the pre-accident status of these components. The spark plugs in the number 1 cylinder had broken off during the accident. The electrodes of the other six spark plugs appeared normal. The air intake and carburettor were severely damaged by the fire and their pre-accident status could not be assessed. The carburettor heat return spring arrangement was found to differ from that depicted in the maintenance manuals because two springs were connected in series instead of the correct single spring. The springs remained securely attached, but they were distorted by loads imparted during the accident. The material properties had been affected by the fire and their original stiffness was unknown. An engine test on a representative aircraft showed that when the aircraft was stationary and the spring was disconnected from the flap valve, simulating a spring failure, the valve continued to operate in the correct sense. This replicated the least favourable operating condition that could exist whilst the aircraft was stationary with the engine being warmed up. The CAA could not discount the possibility that they had approved the installation as a minor modification, which should be referenced in the aircraft records. The AAIB could not find a reference to the springs in the maintenance records that were reviewed as part of the investigation, none of which was dated before 2013. Witness evidence indicated that the aircraft had been operating in this condition for several years. The contents of the oil tank had been consumed by the fire but the oil that remained in the engine and filters was clean and free of debris. The cylinder heads sustained impact damage in the accident and oil had leaked from the rocker covers. However, when the covers were removed the internal surfaces remained wet with oil and it was apparent that they had been adequately lubricated. Except for the No 1 exhaust valve, which was severely bent due to impact damage, the valves could be removed with some difficulty. Most of the valve stems were found to be slightly distorted but there was no evidence of adverse wear or contact with the piston crowns. The distortion would account for the difficulty in removing the valves and, given the damage sustained by the cylinder heads, must have occurred during the accident. Overall, there was no evidence that the engine had suffered a mechanical failure prior to the accident.

54 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Personnel information The pilot began his flying career in the Royal Air Force where he operated large transport aircraft before moving into commercial aviation at the end of his service career. He flew a number of large aircraft types, retiring from airline operations in 2007 as a Boeing 747 commander. During that career, he had also flown light aircraft and gained a flying instructor rating. He started flying at Compton Abbas in July 2006. His last flight prior to the accident flight was on the previous day in a DHC-1 Chipmunk aircraft, carrying out ‘spin avoidance training’ as part of another instructor’s annual training requirement. The passenger had no background of flying training, and no previous experience of controlling an aircraft or flight simulator. Meteorological information There was low-level mist and a witness at the airfield, who assisted with starting the aircraft, stated that the aerodrome grass was wet. Another witness, who performed the runway inspection prior to the aircraft being started, stated that the runway and grass area adjacent to the signal square were dry and free of dew. The investigation did not discover any local temperature or dewpoint information. The METAR for Bournemouth Airport, approximately 16 nm south-east of Compton Abbas, indicated an outside air temperature of 20ºC and a dew point of 14ºC. The METAR for Royal Naval Air Station Yeovilton, approximately 19 nm west of Compton Abbas, indicated an outside air temperature of 18ºC and a dew point of 15ºC. Aerodrome information Compton Abbas Airfield has a single grass runway orientated 08/26, 803 m in length. The airfield elevation is 811 ft amsl. Circuits are flown at 800 ft above airfield elevation, left hand on Runway 08 and right hand on Runway 26. To the north of the airfield is a steep sided valley, the bottom of which is some 300 ft below the airfield elevation. To the east of the airfield is a large irregular shaped field approximately 900 m long and 160 m wide, which at the time of the accident, was standing cereal crop of which, two rows had been cut with a combine harvester on the southern edge. (Figure 2) The airfield has a rescue and firefighting service (RFFS) vehicle which provides initial emergency response to accidents or incidents within the airfield boundary. CAP 168 – ‘Licensing of Aerodromes’, Appendix 8C sets out the requirements which cover RFFS at Compton Abbas, which is a Special Category aerodrome. There is no specified time within which the vehicle should reach the occurrence location but the RFFS should achieve ‘a response as expeditiously as possible’.

55 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Figure 2 Extract from Ordnance Survey map of the local area Recorded information The aircraft was fitted with a video recording system. Remnants of electronic chips that may have related to this system were found in the wreckage but were too damaged for data recovery. A heat damaged USB5 memory stick was also recovered from the wreckage. Recordings recovered from it were from a previous flight. No other recording devices were fitted. The accident flight was not captured by radar. A witness to the takeoff at the airfield provided a series of short video clips6 taken during the flight preparation, takeoff roll and the initial climb; all while the aircraft was still within the airfield boundary. The video clips had embedded times enabling them to be aligned to each Footnote 5 Universal serial bus. 6 The video clips were from “live” photographs which are very short video clips, in this case each approximately three seconds long, with an associated photograph. Accident site

56 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 other with an accuracy of one second. They did not form a complete record of the takeoff and initial climb but provided a basic timeline of events. The engine was started at some point between two video clips recorded at 0811 hrs and 0819 hrs. The aircraft left its parking position at 0823 hrs. The next clip was just over a minute later, showing the aircraft having started its takeoff roll. There were three more gaps in the remaining sequence, the last clip showing the initial climb and ending at 0825 hrs. Figure 3 At the beginning of the takeoff run showing the tops of cloud or fog in the valley to the west of the airfield Figure 4 The cloud or fog conditions are not the same in the valley to the north of the airfield (separated from the westerly valley by a ridge). The windsock indicates a light crosswind from the north Figure 5 Abeam the camera location

57 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Figure 6 Lifting off Figure 7 Initial climb Figure 8 Last video clip, initial climb The propeller speeds were established from the images in the video clips. The aircraft engine was running at approximately 2,000 rpm when passing the camera location but had reduced to approximately 1,710 rpm by the end of the video clips. Spectrum analysis of the video clip audio enabled measurement of the audio frequencies that related to the engine rotating speed, as they reached the camera. The recorded audio also reduced in frequency as the aircraft passed the camera location and flew into the distance. This was partly due to the reducing engine speed as identified using the video images, and partly due to the Doppler effect7. The groundspeed was then derived from the measured Doppler effect and the approximate flight path of the aircraft. This indicates that the aircraft took off with a groundspeed of approximately 50 mph, and the groundspeeds for the penultimate and final video clips were in the ranges of 52 to 60 mph and 48 to 56 mph respectively. Footnote 7 An example of the Doppler effect is a siren on a police car that appears to drop in tone as it passes you, the faster it is travelling relative to you the bigger the shift in frequency.

58 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 No sudden changes in engine behaviour were detected during the video clips. It was not possible to observe throttle position in the imagery. Previous flights Video recordings created by the system fitted to the accident aircraft were obtained for two recent previous flights, one in the morning and one in the afternoon, flown by the same pilot on the same aircraft but with different passengers. These recordings had a groundspeed indication embedded in the image. The audio part of the recording provided engine related signatures except during periods of recorded speech. The data for these two flights is compared to the accident flight in Figure 9. The pilot use of the throttle lever was not evident from the videos. The aftercasts for airfields in the area at the times of the flights indicated similar conditions across all three flights apart from an approximate 8 kt headwind on the day of the previous flights. Figure 9 shows that during the takeoff of both the previous flights engine speeds were faster than those for the accident flight; there was also a marked difference between the previous two flights. The engine speed for the morning flight showed a reducing trend, which subsequently increased to engine speeds closer to those achieved during the afternoon flight. This was similar in behaviour to the accident flight but with only about half the reduction. Medical and pathological information Post mortem examination revealed no pre-existing medical conditions or diseases which might have contributed to the accident, and no drugs or alcohol were present. Survival aspects Post mortem The pathologist considered that the injuries sustained by both pilot and passenger prior to the fire were not survivable. Safety harnesses The safety harnesses were consumed by the fire but the harness lugs were found securely locked in the quick release buckles. The front shoulder harness attachment cable was found to have broken and this would have compromised the restraint of the front seat occupant. The aircraft maintenance records indicated that the higher strength attachment cables for the shoulder straps had been incorporated, but fuselage distortion caused by the accident had loaded the cable beyond its capability. Fire First responders from Compton Abbas airfield tackled the post-crash fire using a combination of aqueous film-forming foam (AFFF) and dry powder extinguishers.

59 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03   Figure 9 Accident flight parameters compared to previous flights aligned to the point in time of takeoff Flight trials The pilot had reported in his transmissions to the airfield that he had a “rough running engine” but did not report an engine failure. He appears to have made a gentle, descending left turn to return to the airfield with the intention of landing on Runway 26. No radar or recorded images of the flight path or performance data for the aircraft type were available to the investigation. Initially, two trial flights were conducted as part of the investigation to establish takeoff, climb and descent performance at different airspeeds, using full power and throttle closed, with varying angles of bank in the turns. Two Tiger Moths of a similar specification to G-ADXT were used, and data recorded. From this data, height gained or lost against time and/or distance could be calculated. It was not possible to determine the effects, if any, of the “rough running engine” on the performance of the accident aircraft, the rates of climb recorded in these trials were greater than those estimated for the accident flight.

60 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 The aircraft used in the trials were as follows: G-ACDI - TOW 1,760 lbs and CG 12.6 inches aft. G-ANNG – TOW 1,790 lbs and CG 13.7 inches aft8. The indicated engine speed for takeoff and the initial climb was 2,100 rpm for G-ACDI and 2,050 rpm for G-ANNG. The results are set out in Table 1 below: Serial Profile Data Remarks 1 Takeoff Run 300 m Full power 2 Stabilised Climb 650 ft/min G-ACDI 500 ft/min G-ANNG Full power 3 Climbing Turn 580 ft/min G-ACDI Full power 4 Descending Turn At 66 mph 860 ft/min Throttle closed 5 Stalling – idle power Approx 40-45 mph Benign – full back stick no wing drop 6 Turn Back (180º turn) Height loss 400 ft Throttle closed 7 Descent at Stall Speed 1,200 ft/min Throttle closed Table 1 Consolidated table of results from initial flight trials The final two test points simulated turn back manoeuvres assuming a worst case in which the power available from the engine was equivalent to idle power. The aircraft was positioned and climbed at 66 mph to 800 ft QFE and the throttle closed. The aircraft nose was promptly lowered to target 66 mph and the aircraft rolled to a 45° angle of bank to commence a simulated turn back to the airfield. The test pilot conducting the trials considered the aircraft flown to be typical and representative of Tiger Moths registered in the UK. Both had similarly benign stall characteristics at between 45-49 mph IAS9, adopting a high angle of attack and rate of descent with the stick held full back and no tendency to drop a wing. The measured rates of descent were consistent with other Tiger Moths he had flown, but with a noticeable increase in rate of descent when flown at or just above the stall speed. The aircraft could be turned relatively easily with an increasing rate of turn, with approximately 45° bank being the optimum for a turn back towards an airfield. Height loss in turns through 180° was approximately 400 ft. The test pilot considered that starting such a manoeuvre much below 800 ft, with a total engine failure, would give the pilot little opportunity to manoeuvre onto the reciprocal runway10. Footnote 8 G-ANNG had anti spin strakes fitted which increases the aft CofG limit to 15.3 inches aft. 9 The Pilot’s Notes state: ‘Normal stall from a straight glide, engine off 40 mph (35Kts), engine on 30 mph (25 Kts)’. 10 A turn to intercept the reciprocal runway would require a combination of turns though more than 180°.

61 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 A third trial was undertaken to assess the takeoff and initial climb, using G-ANNG at the same takeoff weight as on the previous flights. The trial was undertaken from Runway 06 at Old Sarum Airfield, which has a grass surface 781 m long that was dry. During the trial the surface wind was calm but with a slight northerly drift. Conditions were CAVOK, with a surface temperature of 15˚C and QNH 1026 hPa. The test points were:

Rejected takeoff performance

Climb performance at partial power (low engine rpm)

Aircraft attitude in a glide at minimum ROD airspeed Rejected takeoff Rejecting the takeoff in the Tiger Moth introduced a number of challenges. The aircraft was not fitted with wheel brakes, had a very crude steerable rear tail skid and was a ‘tail dragger’ configuration. Rejecting the takeoff when the wheels were still in contact with the runway required the throttle to be closed and the level attitude held initially before allowing the tail to drop gently as the airspeed reduced. During this period there was no braking and steering was entirely aerodynamic and reliant on airflow over the rudder (which was reduced with loss of propeller wash). This technique worked satisfactorily and, from being light on the wheels at 40 KIAS, the aircraft was brought to a halt in approximately 230 m after closing the throttle and following an initial takeoff run of 200 m. The situation became slightly more problematic once the aircraft had become fully airborne. Typically, the aircraft would be landed in a ‘three point’ attitude, main wheel and tail skid contacting the runway at the same time in a stalled or semi stalled condition with a minimum ground and airspeed. Rejecting the takeoff once airborne at 40+ KIAS meant that the initial application of aft control stick would have potentially caused the aircraft to climb initially before the ‘three point’ landing attitude was reached which would have resulted in a heavy landing. The alternative was to retain the level attitude and close the throttle allowing the aircraft to descend back onto the runway initially on the main wheels and then complete the reject as described previously. Any delay in making the decision to reject once airborne would noticeably extend the distance required to complete the manoeuvre. Given the risks of performing such a manoeuvre once airborne it is unlikely that it was practised regularly, if at all. This type of reject, once airborne, was attempted during the sortie with the aircraft having reached about 20 feet agl and a flying speed of 50KIAS. The test pilot summarised the test as follows: ‘As the throttle was closed and the nose dropped to a level attitude for landing, it was considered that insufficient runway remained to complete the landing without risk and the power was re-applied to climb away.’

62 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Partial power The aircraft was flown at 66 mph (58 KIAS) and a density altitude of 2,000 feet, the power being set using the rpm gauge. The height was noted every 15 seconds until a stable condition and rate of climb or descent could be ascertained. The results of the trial are set out in Table 2 below: Serial rpm Remarks 1

1,700

The aircraft almost was able to remain in level flight but over a minute, indicated a very slight rate of descent of approximately 20 fpm. 2 1,800 The aircraft exhibited a barely discernible rate of climb of approximately 20 fpm. 3 1,900 A rate of climb of 200 fpm was established. 4 2,000 A rate of climb of 400 fpm was established. Table 2 Consolidated table of partial power climb results Pitch attitude A manoeuvre was flown from level flight at 66 mph (58 KIAS). The throttle was closed rapidly and the attitude to glide at 66 mph (58 KIAS) adopted. A nose-down pitch attitude of approximately 10º was required. It was also noted that the front cockpit of the Tiger Moth was quite confined for a large person of the size of the passenger on the accident flight, whose weight was recorded as 16 stone. All engine and flight controls were operational and accessible to the passenger, and there was nothing to prevent a passenger restricting control stick or rudder movement. Organisational information Aircraft operation The aircraft was owned and operated by an Approved Training Organisation (ATO), which was permitted to carry out introductory flights, referred to by the ATO as ‘air experience flights’. The operation of such flights is explained in CAA Information Notice Number IN‑2015/029, which refers to such flights as ‘introductory flights’. EASA regulations define these as follows: ‘“Introductory flight”’ means any flight against remuneration or other valuable consideration consisting of an air tour of short duration, offered by an approved training organisation or an organisation created with the aim of promoting aerial sport or leisure aviation, for the purpose of attracting new trainees or new members.’

63 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Guidance material GM1 ARO.OPS.300 (Introductory Flights), published by the EASA, states: ‘For introductory flights carried out in the territory of the Member State, the competent authority may establish additional conditions such as defined area of the operation, time period during which such operations are to be conducted, safety risk assessments to be accomplished, aircraft to be used, specific operating procedures, notification requirements, maximum distance flown, pilot qualification, maximum number of passengers on-board, further restrictions on the maximum take-off mass.’ The CAA did not impose such conditions but instead recommended that operators apply their own conditions based on their assessment of the risk to the occupants of the aircraft, which should include: ● ● The experience and currency of the pilot particularly on the aircraft to be used and familiarity with its flight characteristics over the range of planned weight and CofG. ● ● The pilot’s familiarity with proposed route(s), airspace, operational restrictions and emergency procedures. ● ● Weather minima to be observed, particularly visibility, cloudbase, wind strength and direction. ● ● Any other criteria which should be considered to achieve the objective of a safe and enjoyable introductory flight for the participant(s). Important Note: The exemptions issued under the ANO11 for national licences and Annex ii aircraft are not valid outside the airspace of the UK unless validated or otherwise accepted by the relevant authority of the State where the flight is to take place.’ Under these conditions, the approved training organisation was permitted to conduct what they termed ‘air experience’ flights. Additional information Operation of the fuel shut-off valve Analysis performed by the Civil Aviation Authority of New Zealand after a previous Tiger Moth accident (ZK-DHA) concluded that the fuel shut-off valve on this aircraft type can close because of structural deformation sustained during an accident. Tests that were performed as part of that previous investigation showed that if the valve was turned off with an engine running at full throttle, the engine continued to run for approximately 16 seconds before coming to an immediate stop. Footnote 11 Air Navigation Order. ‘

64 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Possible causes of a rough running or misfiring engine The pilot reported that the engine was running rough and witnesses described it as misfiring. The Gipsy Major Handbook includes a table of running defects, possible causes and recommended remedial actions. The appropriate sections are reproduced in Table 3 below. Symptoms Possible Defect Missing or irregular firing Defective sparking plugs Defective ignition Incorrect carburation Incorrect tappet clearance Vibration and rough running Defective ignition Incorrect carburation Mechanical defects Loss of compression Engine loose on mountings Induction manifold leakage Induction blockage Propeller hub loose on crankshaft Propeller out of balance Spinner out of truth Reduced valve spring loads Table 3 Possible cause of misfiring and rough running Carburettor icing Carburettor icing is typically associated with rough running, gradual power loss and, eventually, engine stoppage. CAA Safety Sense Leaflet (SSL) No 14, ‘Piston Engine Icing’ gives advice and guidance on how to recognise and avoid carburettor icing. It notes: ‘the most common, earliest to show, and the most serious, is carburettor (carb) icing caused by a combination of the sudden temperature drop due to fuel vaporisation and pressure reduction as the mixture passes through the carburettor venturi and past the throttle valve. If the temperature drop brings the air below its dew point, condensation results, and if the drop brings the mixture temperature below freezing, the condensed water will form ice on the surfaces of the carburettor. This ice gradually blocks the venturi, which upsets the fuel/air ratio causing a progressive, smooth loss of power and slowly ‘strangles’ the engine.’ The leaflet identifies several risk factors, including when the ground is wet (even with dew) and the wind is light; and in clear air where cloud or fog may have recently dispersed.

65 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Previous research The ATSB carried out an Aviation Research and Analysis, AR-2010-055, and produced a booklet, ‘Avoidable Accidents No 3’. The aim of the booklet was to increase awareness among flying instructors and pilots of the issues relating to partial power loss after takeoff in single-engine aircraft. The booklet set out the issues related to partial power loss as distinct from total loss of power and illustrated the analysis with case studies. It provided the following ‘key messages’: ‘Most fatal and serious injury accidents resulting from partial power loss after takeoff are avoidable. This report will show that you can prevent or significantly minimise the risk of bodily harm following a partial or complete engine power loss after takeoff by using the strategies below:

Pre-flight decision making and planning for emergencies and abnormal situations for the particular aerodrome

Conducting a thorough pre-flight and engine ground run to reduce the risk of a partial power loss occurring

Taking positive action and maintaining aircraft control either when turning back to the aerodrome or conducting a forced landing until on the ground, while being aware of flare energy and aircraft stall speeds.’ Analysis Recorded data Over the period covered by the video clips, the engine speed reduced from approximately 2,000 rpm to approximately 1,710 rpm. During takeoff on one of the previous two flights reviewed, a reduction in engine speed was also apparent, though to a higher value of approximately 1,900 rpm, before increasing again. Engine speed during the other takeoff reviewed was above 2,050 rpm. This demonstrates that the pattern of engine speeds during takeoff was not consistent. A reducing engine speed during takeoff was not unique to the accident flight and had previously resulted in a successful flight. The investigation did not determine how the pilot operated the throttle. Flight test results showed that the engine speed indicated by the last video clip would have been insufficient for the aircraft to climb, indicating that it did increase after that. The reduced engine speeds of the recorded parts of the accident flight resulted in a slower groundspeed profile than at similar points in previous flights, even though the previous flights were flown with more headwind. There was only intermittent video coverage of the initial takeoff and climb. The sound of the engine was not obviously unusual during these clips. Witnessed engine sounds and pilot‑reported rough running either occurred between these recordings or after them.

66 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Engine start The first attempt to start the engine was unsuccessful and witnesses reported that it briefly ran backwards. This indicates the presence of a combustible fuel / air mixture and a source of ignition. As this was the first flight of the day, the possibility of a localised hot-spot inside the engine can be discounted. The only conceivable source of ignition in a cold engine is a spark from a spark plug. This indicates that the left magneto may have been on, or that there was a timing anomaly with the right magneto or a problem with its impulse coupling. The impulse coupling was found to be in good condition after the accident and the timing of the right magneto could not be checked because of the extent of the damage sustained. If the right magneto timing was incorrect, this would have been the case since it was installed, and the engine would always have been susceptible to running backwards during start-up; the aircraft had completed 77 flights since the magneto was refitted. The engine cannot self-sustain if it runs backwards and when the engine was dismantled there was no evidence of any mechanical failures or damage that could not be attributed to the accident. The pilot informed the groundcrew that he believed the engine had been over-primed. The appropriate procedures were followed, and the engine started. Rough running engine The pilot reported that the engine was “rough running” shortly after takeoff and witnesses described an engine misfire as the aircraft lifted off. The two witnesses at the farm reported that, shortly after they became aware of the aircraft, the engine stopped. The Tiger Moth Maintenance and Repair Manual states that the engine should be warmed for four minutes prior to the magneto and power checks and the Bristol Siddeley Gipsy Major handbook states that the oil temperature should be at least 15ºC prior to takeoff. Photographic evidence showed that the engine was running at least four minutes before the aircraft left the parking area and witnesses reported that the magneto and power checks sounded normal. Examination of the engine did not identify any pre-existing defects that would have prevented normal operation but damage sustained in the accident meant that it was not possible to establish the pre-accident status of the magnetos, ignition system and carburettor. The engine handbook states that a problem with any one of these items could result in the symptoms described by the pilot and witnesses. Both sets of magneto switches were found, and all four switches were in the on position, which is the normal flight position. The switches are on when they are in the up position and it is considered unlikely that they changed during the accident. The fuel shut-off valve was found in the off position but it was not possible to determine when the valve was closed. The mandatory locking device was found in the wreckage and its condition indicated that it was serviceable prior to the accident. Analysis performed after a previous Tiger Moth accident concluded that the valve can close because of structural deformation sustained during an accident. The possibility that the pilot closed the valve

67 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 in preparation for a forced landing cannot be discounted, but this is considered to be less likely. Witnesses who saw the aircraft shortly before the accident reported that the engine was still running and a test conducted as part of a previous investigation established that the engine would run for approximately 16 seconds if the valve was closed when the engine was running at full power. Both propeller blades had broken approximately mid-span and were embedded in the ground on the same side of the aircraft centreline. This indicates that the propeller was turning when the accident occurred. The fact that the wooden propeller did not shatter and that the broken parts were found close to the wreckage indicates that the propeller was probably turning slowly. Carburettor icing G-ADXT was equipped with an automatic carburettor heat system intended to minimise the possibility of carburettor icing. The installation differed from the configuration depicted in the maintenance manual but the aircraft had been operating in this condition for several years. Tests indicated that the air intake flap valve would still operate in the correct sense whilst the aircraft was stationary and the engine was being warmed up. When the pilot selected full power for takeoff, the intake flap would move to the cold air position as designed. The chart included in SSL No 14 indicates that, at the temperatures recorded at Bournemouth and Yeovilton, moderate icing could be experienced at cruise power and serious icing could be experienced at descent power. Over the period covered by the video clips, the engine speed reduced from approximately 2,000 rpm to approximately 1,710 rpm, but the cause is unknown. A test flight established that the aircraft could not have climbed at 1,710 rpm so the engine power must have increased after the last video clip. Post-crash fire The aircraft struck the ground in a steep nose-down attitude and a post-crash fire began before first responders arrived at the scene. The fuel delivery pipe was found to have broken at the joint with the fuel filter. This would have given rise to a fuel leak, but the volume of fuel would have been limited because the fuel shut-off valve was closed. The fuel tank, which was full before the flight, was found to have ruptured along the length of a joint. This would have resulted in a significant fuel leak and it is possible that leaking or atomised fuel ignited when it contacted the hot engine. First responders tackled the fire using a combination of AFFF and dry powder extinguishers. The fire had been extinguished prior to the arrival of the Fire and Rescue Services. Flying controls Examination of the flying controls showed no evidence of a pre-accident failure.

68 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 Operations The pilot was properly licensed and qualified to carry out the flight, which was being operated in accordance with the regulations governing ‘introductory flights’. The aircraft was being operated within its weight and balance envelope. The post mortem examination did not identify any pre-existing medical condition that might have led to pilot or passenger incapacitation. The weather was good with a light and variable wind, which at the time of the accident was given as northerly at less than five knots. No precise time was recorded for the flight but the last photograph showing the aircraft towards the eastern airfield boundary was taken at 0825 hrs and the police incident log commenced at 0828 hrs. This indicates the flight lasted between three and four minutes. On takeoff, the engine was heard to misfire, but the aircraft continued to climb. It would have been possible to abandon the takeoff closing the throttle and attempting to stop on the runway. If the decision was made promptly, there would have been sufficient space remaining for the aircraft to stop or turn away from the obstacles at the eastern boundary. Once the aircraft was airborne, the pilot would have faced the same situation observed by the test pilot during sortie three of the flight trial. During the accident takeoff, engine speed reduced to 1,710 rpm. This may have been a result of the pilot reducing throttle in order to reject the takeoff. However, the takeoff continued and he may have concluded that there was insufficient runway or other space on the airfield in which to stop. Flight trials indicated that power settings, 1,700 and 1,800 rpm would not have been sufficient to achieve the height gained in the time available. Although the pilot had reported “rough running”, the engine must have been producing sufficient power to achieve between 1,900 and 2,000 rpm at the best rate of climb speed in order to gain between 300 and 500 feet above airfield level in the time available. Subsequently, both the turn and descent back towards the airfield were gentle manoeuvres and there were no additional transmissions from the pilot reporting any deterioration in his situation. No radar or GPS positions, heights or ground track were available to the investigation and witness evidence varied regarding the flight path, distance from the airfield and the direction of the turn back towards it. However, the aircraft’s final manoeuvre was described consistently as a steep, nose down, rapidly descending turn. This was above and slightly beyond the trees at the eastern end of the airfield and at about twice their height, or approximately 200 ft above airfield elevation. Up to this point, the gentle rate of descent suggests that the engine was still producing power but was not, and probably could not be, heard from outside the flying club if at reduced power. The pilot either made a normal approach throttling back and descending on the base leg or, if power available had reduced and he was unable to maintain height

69 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 was forced to let the aircraft descend. With a rough running engine, the possibility of a total or increased loss of power is always a possibility and maintaining height until within gliding distance of the intended landing point is desirable in this situation if it can be achieved whilst maintaining sufficient speed. The aircraft’s nose was seen to pitch positively down some 30º, which when combined with the turn, would have caused the aircraft to lose height rapidly. Flight trials established that the rate of descent could have been at least 1,200 feet per minute if the aircraft was just above the stall at low speed and low power. One witness had seen the aircraft briefly before the accident and reported hearing the engine “sounding rough”. Shortly thereafter that witness and one other witness both heard the engine stop abruptly. Given the location of the witnesses and timings of the observations, the engine stoppage was most likely as a result of the aircraft impact with the ground, rather than an engine failure in flight or the pilot closing the throttle. Three possible reasons for the final manoeuvre were considered:

Low airspeed resulting from trying to maintain height which caused a wing to drop at the stall, as described by one witness.

Low airspeed resulting in the need for a large nose down attitude change in order to regain airspeed but resulting in a significant rate of descent.

A late decision to change the landing area to the crop field, requiring a tight left turn. This would have required an increase in airspeed, obtained by the significant nose-down attitude change before the turn. Either (1) or (2) may have caused the aircraft to descend below the minimum glide angle required to land at the airfield. In these cases, the pilot may have recognised that he was not able to return to the airfield and turned towards the large open area of crop field. Alternatively, the angle of the descent placed the aircraft at a height and position from which the pilot decided to change his landing area to the crop field. He may also have been attempting to recover from or avoid a loss of control at low airspeed. Finally, there was either insufficient height to recover or a restriction of the controls that prevented recovery before impact. The accident aircraft was fitted with dual controls and, although the passenger had received a full cockpit and safety brief, it is possible the flying controls were involuntarily restricted as the passenger reacted to what would have been a very stressful situation. Conclusion The accident occurred when the pilot was attempting to return to the airfield after reporting a rough running engine. Damage sustained during the accident prevented an assessment of the magnetos, ignition system and carburettor. A problem with any one of these could have caused the reported symptoms. The possibility of carburettor icing could not be discounted.

70 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-ADXT EW/C2017/08/03 At about 200 ft agl, the aircraft pitched suddenly and significantly nose down before descending in a left turn from which it did not recover before striking the surface of a crop field. The reason for this final manoeuvre was not determined. Aviation Research and Analysis, AR-2010-055, ‘Avoidable Accidents No 3’, published by the Australian Transport Safety Bureau, considers issues related to partial power loss after takeoff in single-engine aircraft and contains valuable guidance when dealing with such an emergency and is potentially relevant to this accident.

FD06668 ｜ 2019_英国_aaib-investigation-to-diamond-da42-n648km__Diamond_DA42_N648KM_06-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

99 © Crown copyright 2019 All times are UTC AAIB Bulletin: 6/2019 N648KM EW/G2018/11/14 SERIOUS INCIDENT Aircraft Type and Registration: Diamond DA42, N648KM No & Type of Engines: 2 Thietlert TAE 125-02-99 piston engine Year of Manufacture: 2007 Date & Time (UTC): 27 November 2018 at 1450 hrs Location: En route from Retford Gamston Airport to Weston Airport, Dublin, Ireland Type of Flight: Private Persons on Board: Crew - 2 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: None reported Commander’s Licence: Private Pilot’s Licence Commander’s Age: 54 years Commander’s Flying Experience: 386 hours (of which 103 were on type)

Last 90 days - 64 hours

Last 28 days - 6 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis While in the cruise at FL100 the left engine fire warning illuminated. A PAN was declared and a diversion to Liverpool initiated with the assistance of Scottish and Liverpool ATC. During the descent, control of the aircraft was lost while in IMC. The aircraft descended rapidly, and control was recovered as the aircraft reached VMC at approximately 800 ft agl. At this juncture, and at the suggestion of Liverpool ATC, the aircraft diverted to the nearby RAF Woodvale where it landed safely. History of the flight The aircraft was on an IFR flight from Gamston to Weston, near Dublin. The planned cruising level was FL100 and icing was forecast. The aircraft is equipped with a fluid anti icing system and is cleared for flight into known icing conditions. The pilot stated he replenished the fluid level prior to departure and that pitot heat was on during the climb. The pilot had been cleared to route direct from DESIG to BAGSO. Approximately 39 nm east of BAGSO the left engine fire warning illuminated. The pilot disengaged the autopilot, retarded the left engine control to idle and began to monitor for smoke or flames. The co-pilot contacted Scottish ATC, informed them of the fire warning and declared a PAN. The crew requested a descent and vectors to land at the nearest airfield. Scottish ATC suggested a diversion to Liverpool Airport and cleared a descent to 5,000 ft. Scottish ATC asked the crew to Squawk 7700 and then handed the aircraft over to

100 © Crown copyright 2019 All times are UTC AAIB Bulletin: 6/2019 N648KM EW/G2018/11/14 Liverpool ATC. Liverpool ATC offered vectors for an instrument approach to Runway 09 and cleared the aircraft for further descent. Liverpool ATC also asked the crew about their ability to maintain heading and altitude, concerned at manoeuvring that had not been directed by ATC. The fire warning persisted during the descent until below 5,000 ft when it cleared briefly before reappearing. Apart from the warning, however, there were no signs of fire. At approximately 3,000 ft the pilot stated that he engaged the autopilot, though he confirmed he had become aware subsequently that autopilot use was not permitted for asymmetric flight. The pilot said he then felt a sudden jolt in the aircraft and the autopilot disengaged. Simultaneously, the slip ball moved rapidly to full scale deflection left and the aircraft pitched sharply nose down. The aircraft descended rapidly. The pilot stated that he applied full left rudder, neutralised the control column and retarded the good engine to idle thrust. Then he gradually pulled back on the control column. The aircraft reached VMC just southeast of Crosby at approximately 800 ft agl and was recovered to level flight. Liverpool ATC, concerned at the sudden descent, asked if the aircraft was in VMC and the pilot could see the coast. The crew confirmed that they could. Liverpool ATC then suggested a diversion to RAF Woodvale, as it was closer than Liverpool Airport, or a continued diversion to Liverpool by following the Mersey River. The crew accepted the first option and were passed the Woodvale weather and the tower frequency by Liverpool ATC.

The in-use runway at Woodvale was Runway 08. Woodvale ATC had been informed of the diversion by Liverpool ATC and so were alerted to the arrival of the aircraft. The crew called Woodvale Tower shortly before arrival, when the aircraft was on final approach to Runway

1. The weather was poor and, given the circumstances, Woodvale cleared the aircraft

to land on Runway 03, although it was out of use due to a degraded surface. The aircraft landed safely and taxied to the apron under its own power. It was not established why the fire warning was triggered. Personnel The pilot had an FAA PPL with an Instrument Rating. His logbook indicated that he had completed the necessary recency training to operate in IMC and that he had completed the requisite biennial check flight. Human factors The pilot was in an unfamiliar, high stress and high workload environment. With asymmetric thrust, the handling of the aircraft is much more challenging than normal and effective control of attitude is more difficult. In asymmetric flight any power changes induce yaw and roll effects which must be corrected to control the flight path. In IMC these additional factors increase the risk of spatial disorientation.

101 © Crown copyright 2019 All times are UTC AAIB Bulletin: 6/2019 N648KM EW/G2018/11/14 Analysis Following the fire warning the pilot was in asymmetric flight, with the left engine at idle power. With the fire warning emergency, the unplanned diversion in IMC and the higher than usual workload there were many and significant pressures on the pilot’s capacity to operate effectively. The autopilot was disengaged after the fire warning occurred, so the descent was being manually flown. Given the high workload and the difficulties in controlling the aircraft the pilot decided to re-engage the autopilot at approximately 3,000 ft. The autopilot has no yaw channel and therefore is unable to control the effects of asymmetry. Shortly after the autopilot was engaged the pilot reported feeling a sudden jolt and the autopilot disengage. The aircraft then went out of control. It is likely that the autopilot exceeded its operating parameters as a result of the asymmetric condition. With the slip ball deflected left, the aircraft was yawing rapidly right. The secondary effect of the yaw would induce a right roll and it is probable the aircraft entered a spiral dive condition. The pilot took appropriate corrective action and the aircraft was recovered to level flight, albeit at low altitude. The diversion to Woodvale was flown at low altitude and in poor weather, though VMC. The pilot called Woodvale only shortly before his arrival and was positioned on final approach for Runway 03. While this runway was closed by NOTAM, ATC assessed the surface to be safe and, in the circumstances, allowed the aircraft to land on it. Conclusion Control of the aircraft was lost during high stress, high workload flight following an engine fire warning. It is probable that the pilot, operating in very challenging circumstances during the descent, became spatially disorientated. His use of the autopilot in an attempt to manage workload, in fact exacerbated the situation. The pilot was able to recover before terrain impact as the aircraft entered VMC at low altitude.

FD06669 ｜ 2019_英国_aaib-investigation-to-dornier-alpha-jet-fb-oe-fas__Dornier_Alpha_Jet_FB_OE-FAS_03-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

114 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 OE-FAS EW/G2018/07/26 SERIOUS INCIDENT Aircraft Type and Registration: Dornier Alpha Jet FB, OE-FAS No & Type of Engines: 2 SNECMA Larzac 04-C20 turbofan engines Year of Manufacture: 1980 Date & Time (UTC): 13 July 2018 at 1345 hrs Location: Farnborough Airport, Hampshire Type of Flight: Flight display Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: None Commander’s Licence: Commercial Pilot’s Licence Commander’s Age: 40 years Commander’s Flying Experience: 2,300 hours (of which 182 were on type)

Last 90 days - 35 hours

Last 28 days - 14 hours Information Source: Aircraft Accident Report Form submitted by the pilot The aircraft had been conducting a display routine making use of smoke produced by two oil-fuelled smoke generators, mounted on the wing pylons. The pilot had switched off the smoke generators as the aircraft turned onto the final approach to land and he observed the smoke stop using the cockpit-mounted mirrors. During the approach, spectators observed flames coming from both smoke generators. The pilot became aware of the flames during the landing roll and isolated the smoke generation system using the circuit breakers. After briefly extinguishing the flames reappeared, so the pilot declared a MAYDAY. The flames self‑extinguished before AFRS reached the aircraft. An examination by the operator’s engineers did not find any defect with the generators and all subsequent operation of the system has been normal. The event is thought to have been caused by the smoke generators being switched off as they ran out of fuel, which caused a small quantity of fuel to pool in the smoke generator nozzle which then ignited due to the residual heat present in the nozzle.

FD06670 ｜ 2019_英国_aaib-investigation-to-ec120-b-colbri-g-rcnb__EC120_B_Colbri_G-RCNB_09-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

61 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-RCNB EW/G2019/06/20 ACCIDENT Aircraft Type and Registration: EC120 B Colbri, G-RCNB No & Type of Engines: 1 Turbomeca ARRIUS 2F turboshaft engine Year of Manufacture: 2002 (Serial no: 1333) Date & Time (UTC): 25 June 2019 at 1120 hrs Location: Enniskillen Airport, County Fermanagh Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Damage to rotor blades, head, tailboom, horizontal stabliser, fenestron and skid gear Commander’s Licence: Private Pilot’s Licence Commander’s Age: 60 years Commander’s Flying Experience: 395 hours (of which 13 were on type)

Last 90 days - 19 hours

Last 28 days - 3 hours Information Source: Aircraft Accident Report Form submitted by the pilot The pilot had planned a flight from Enniskillen, St Angelo Airport, to a private site at Frosses in Donegal, Ireland. The helicopter was parked on the apron adjacent to the fuel installation where it had just been refuelled to full tanks. Having completed all the pre-start checks from the checklist and carried out a normal start, the pilot performed the pre-takeoff checks and raised the collective pitch lever. He led with right yaw pedal but, as the helicopter became light on the skids, it started to yaw to the left. Due to the close proximity of the fuel storage tanks, he applied left cyclic control to move the helicopter to the left away from them, but the helicopter continued to yaw to the left. After yawing through 360°, the helicopter lost height with the left skid contacting the apron. The helicopter rolled about the left skid and the main rotor contacted the ground and debris was scattered over a wide area. The helicopter continued to yaw through another 90° about the tail before rolling onto its right side. The pilot shut off the fuel before applying the rotor brake and was able to leave the helicopter unassisted through the left door. The airport Rescue and Fire Fighting Service attended the scene immediately and applied a foam blanket to the wreckage. Over the preceding weekend the pilot had been flying a Robinson R44 helicopter on which the main rotor blades turn anticlockwise when viewed from above. The EC120 main rotor blades turn in the opposite direction ie clockwise when viewed from above. The pilot was aware of this difference and the way it affects the use of the yaw pedals: raising the collective pitch lever in the Robinson requires increasing amount of left pedal to counter the rotor torque, but in the EC120 increasing amounts of right pedal are required. The pilot believed

62 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-RCNB EW/G2019/06/20 that during the initial phase of applying collective lever, he had used insufficient right yaw pedal, allowing the helicopter to yaw left, and the application of additional right pedal did not then reduce the yaw rate.

FD06671 ｜ 2019_英国_aaib-investigation-to-evolve-dynamics-sky-mantis-uas-registration-n-a__Evolve_Dynamics_Sky.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

75 © Crown copyright 2019 All times are UTC AAIB Bulletin: 7/2019 Sky Mantis EW/G2019/02/06 ACCIDENT Aircraft Type and Registration: Evolve Dynamics Sky Mantis (UAS, registration n/a) No & Type of Engines: 4 electric motors Year of Manufacture: 2019 (Serial no: ED/SM68-00212) Date & Time (UTC): 7 February 2019 at 1022 hrs Location: Nailsea Fire Station, Somerset Type of Flight: Commercial Operations Persons on Board: Crew - N/A Passengers - N/A Injuries: Crew - N/A Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: Other Commander’s Age: 27 years Commander’s Flying Experience: 7 hours (of which 4 were on type)

Last 90 days - 5 hours

Last 28 days - 2 hours Information Source: Aircraft Accident Report Form submitted by the pilot and subseqeunt AAIB enquires Synopsis During a demonstration flight, the UAS dropped to the ground from a height of 50 m when the electric motors stopped, despite the battery being fully charged. The UAS struck the ground and was destroyed in the subsequent post-impact fire. The UAS manufacturer determined that the loss of power was caused by the battery not being fully locked in place. It has updated the operations manual and intends to install sensors to prevent the aircraft from operating if the battery is not correctly locked in place. History of the flight The Evolve Dynamics Sky Mantis is an all-weather long endurance quadcopter UAS, which is still under development. It has a maximum takeoff mass of 6.9 kg and a 60-minute endurance (Figure 1). The pilot, who works for the UAS manufacturer, was operating the UAS on a demonstration flight. It was the first flight of the day and prior to taking off, the battery level indication had indicated a 100 % state of charge and a voltage of 25.2 V. The UAS took off at maximum takeoff mass and indicating an available flight time of 60 minutes. The pilot climbed the UAS to a height of 50 m where it maintained a stable hover. It had been flying for approximately 5 minutes when the pilot initiated a control input to rotate the UAS about its yaw axis. Whilst yawing, the UAS appeared to suffer a complete power failure; all four electric motors stopped and the UAS began descending rapidly. There were no associated warnings

76 © Crown copyright 2019 All times are UTC AAIB Bulletin: 7/2019 Sky Mantis EW/G2019/02/06 displayed on the controller and the UAS did not respond to any control inputs by the pilot. It entered autorotation at approximately 10 - 15 m above the ground, but this was insufficient to arrest the rate of descent and it struck the ground hard. The onboard battery ignited and the UAS was destroyed in the ensuing fire. Figure 1 Evolve Dynamics Sky Mantis Investigation by the UAS manufacturer The UAS manufacturer undertook an internal investigation to determine the cause of the power loss. It identified that the battery had not been fully locked in place during the accident flight and vibration had caused it to lose contact with the electrical connections, leading to the loss of power. Safety action The manufacturer has since updated the Sky Mantis Operations Manual to include an instruction to check that the battery is locked in place and will include this requirement in customer training. It also intends to install sensors in the battery lock mechanism which will prevent the aircraft from being able to fly if the battery is not correctly locked in place.

FD06672 ｜ 2019_英国_aaib-investigation-to-flight-design-ctsw-g-kupp__Flight_Design_CTSW_G-KUPP_01-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

99 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-KUPP EW/G2018/07/38 ACCIDENT Aircraft Type and Registration: Flight Design CTSW, G-KUPP No & Type of Engines: 1 Rotax 912ULS piston engine Year of Manufacture: 2006 (Serial no: 8227) Date & Time (UTC): 19 July 2018 at 1140 hrs Location: Redhill Aerodrome, Surrey Type of Flight: Training Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - None Passengers - None Nature of Damage: Fire damage to cockpit instrument console Commander’s Licence: National Private Pilot’s Licence Commander’s Age: 65 years Commander’s Flying Experience: 4,870 hours (of which 2,069 were on type)

Last 90 days - 47 hours

Last 28 days - 24 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis An electrical fire in the instrument console developed shortly after takeoff and the pilot returned to land on the active runway. An electrical short circuit with the composite instrument console, resulting in a resin fire, was traced to a damaged wire. The wiring had been previously modified and a Service Bulletin has been released to reduce the risk of electrical and fuel fires. History of the flight The aircraft took off from Runway 08R at Redhill Aerodrome, on the second training flight of the day at 1138 hrs. The northerly wind was 3 kt and the pilot in command was in the right seat. As the aircraft climbed through 500 ft the pilot noticed an electrical burning smell and smoke coming from the instrument console. He declared a MAYDAY, immediately turned the aircraft left and could feel heat coming from the central instrument console onto his left leg. The pilot continued a tight left-hand circuit to land back on Runway 08R and selected 40° of flap. With the smoke making it difficult to the read the ASI on final approach, the pilot landed the aircraft about halfway along the runway. The airport RFFS met the aircraft as it stopped and used carbon dioxide fire extinguishers to put the fire out. The total flight time was less than two minutes. It was noted by the pilot, after exiting the aircraft, that the flaps were in the takeoff configuration (15°).

100 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-KUPP EW/G2018/07/38 Aircraft examination The aircraft was recovered to a repair organisation for examination and the instrument console was disassembled. There was evidence that the console had been modified previously to fit new avionics equipment and the charge indicator lamp had been moved. The original location was the upper right of the panel, but it had been moved to the lower central section (Figure 1). The repair organisation’s assessment was that the standard of wiring was very poor. Wires were over length, had insufficient support, there was a risk of entrapment or chafing and improper terminals had been used.

Figure 1 Instrument console The charge indicator lamp is connected to the voltage regulator through a 22AWG (0.64 mm) wire which is nominally sized for current up to 3 amps. Should the lamp supply wire short to earth, the current could be up to 50 amps; the full regulator output of 20 amps and up to 30 amps from the battery. The wire to this lamp had burned through and several adjacent wires showed evidence of heat damage. The structure of the instrument console is a woven carbon / resin composite which showed evidence of fire damage. The damage showed that in some places, the resin had been totally consumed and only the carbon mat remained (Figure 2).

101 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-KUPP EW/G2018/07/38 Figure 2 Fire damage to the instrument console Located in the rear of the instrumnt console (Figure 3) was the engine fuel supply pipe, and the fuel filter, from the wing fuel tanks to the engine.

Figure 3 Fuel supply and filter location (Instrument console removed) Analysis The repair organisation assessed that the modification to the charge warning lamp, without shortening the wires, was a causal factor in initiating the fire. The length of wire for the modified position was significantly less compared to the original location. The insulation

102 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-KUPP EW/G2018/07/38 on this excess wire was damaged and this resulted in a short circuit to the structure of the composite instrument console. The cause of the insulation damage could not be determined but could have been from chafing or pinching in a panel joint. The composite material is electrically resistive and the current of up to 50 amps generated sufficient heat for the resin to ignite and produce smoke as it burned. The UK type approval holder (also the repair organisation) has subsequently issued Service Bulletin 150 for Flight Design CTSL, CTSW and CT2K aircraft. The Service Bulletin recommends a 1 amp fuse to be fitted to the charge warning lamp supply wire and to: ‘ensure the wiring is tidy with tight connections and is well secured and protected. Be sure the wiring cannot be trapped in panel joints and has adequate strain relief. Ensure it cannot short against anything including control runs, at all extremes of movement.’ Further, it states that any fuel filter inside the instrument console must be of a fire-resistant type. Conclusion Due to a modification to the charge warning lamp in the instrument console, an over-length wire was damaged and short circuited to the composite structure. The heat generated from the short circuit resulted in the resin igniting shortly after takeoff. The pilot managed to land the aircraft on the active runway despite reduced visibility and system failures. Safety Actions Following the accident, the following Safety Action was taken: The UK type approval organisation has issued a Service Bulletin No 150 to modify Flight Design CTSL, CTSW and CT2K aircraft, to reduce the risk of electrical and fuel fires.

FD06673 ｜ 2019_英国_aaib-investigation-to-luton-la4a-minor-g-awmnLuton_LA4A_MinorG-AWMN_11-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

3 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 ACCIDENT Aircraft Type and Registration: Luton LA4A Minor, G-AWMN No & Type of Engines: 1 Volkswagen 1800 piston engine Year of Manufacture: 1987 (Serial no: PFA 827) Date & Time (UTC): 3 February 2019 at 1145 hrs Location: Near Belchamp Walter, Essex Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 (Fatal) Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: UK Private Pilot’s Licence Commander’s Age: 55 Commander’s Flying Experience: 317 hours (of which 150 were on type)

Last 90 days - n/k

Last 28 days - n/k Information Source: AAIB Field Investigation Synopsis The pilot was conducting a test flight in G-AWMN to renew the aircraft’s Permit to Fly. Whilst climbing away from the runway, the aircraft was observed to bank to the right and then descend steeply to the ground. It was not possible to definitively determine the cause of the accident. It is possible that the engine stopped producing power due to carburettor icing which led to a stall from which the aircraft was not able to recover. The investigation also identified that, despite wire locking being present, the barrel from an aileron flight control turnbuckle was missing, but it could not be determined if this had been missing prior to the accident. History of the flight The pilot began operating G-AWMN from Waits Farm, near Belchamp Walter, Essex in July 2012. In recent months he had been completing test flights in G-AWMN to renew the aircraft’s Permit to Fly following a period when it had not flown. It was reported that he had completed one test flight in December 2018 and a second in January 2019. On the day of the accident the pilot arrived at the airfield at approximately 1030 hrs. He spoke to the airfield owner and another pilot. He told the other pilot that he did not intend to take off until approximately 1200 hrs. Before he took off in his own aircraft at 1100 hrs, the other pilot conducted a radio check with the pilot of G-AWMN. The pilot

4 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 of G-AWMN did not mention what he intended to do on his flight to either person and no documents were found describing what tests the pilot intended to conduct. No one witnessed G-AWMN taking off and it is not known exactly when the aircraft was started up. The airfield owner heard G-AWMN start up but was not sure exactly what time this occurred, but he was informed of the accident approximately 10 – 15 minutes later. Accident location Wind west south- west at 7-8 kt Witness 1 Witness 2 Figure 1 Waits Farm showing the accident and witness locations A witness (Figure 1 – Witness 1), working in a nearby garden, thought he heard an aircraft start up, taxi and then take off. He first saw the aircraft climbing away from the airfield heading north-east and described it as “travelling quite slowly.” He then saw the aircraft bank sharply to the right and descend, at an approximate 45° angle, to the ground. He did not see the aircraft hit the ground, but he heard the impact. He recalled that he could hear the engine when the aircraft was climbing away from the airfield but did not remember hearing it after the aircraft banked right. During the period that he was able to hear the engine he did not remember it sounding unusual. He ran towards the accident site but, approximately three minutes after the impact and before he could reach the scene, the aircraft caught fire. A couple walking in a nearby field (Figure 1 – Witness 2) heard an aircraft flying towards them from the airfield. When they looked in that direction, they saw the aircraft banked to one side and then descend to the ground. They heard, but did not see, the impact. They also ran to the scene but did not reach the aircraft before it caught fire.

5 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 Another couple who were working in a nearby garden heard the aircraft but did not see it. Their attention was drawn to it when they heard the engine noise suddenly stop. A few seconds later they heard a “dense thud” which they thought sounded like an aircraft crash. The accident occurred at approximately 1145 hrs. The fire service, ambulance, police and air ambulance attended the scene promptly and the remaining fire was extinguished. The pilot was fatally injured. Several other people reported seeing or hearing aircraft in the surrounding area which appeared to be having engine problems. However, the timings and descriptions suggest these were unlikely to be the accident aircraft. Meteorology The day of the accident was cold with a clear sky and light south-westerly wind. The nearest airfield that records weather reports is Stansted which is 17 nm south-west of the accident site. At 1150 hrs, Stansted recorded the surface wind as 220° at 7 kt, visibility greater than 10 km, no discernible cloud, temperature 4°C and dew point -2°C. The pilot who took off from Waits Farm at 1100 hrs reported that, when he started his engine, the surface wind was west south-westerly at approximately 7 – 8 kt, the temperature was - 1°C and the grass was wet with melting frost. Using the chart published in the CAA Safety Sense Leaflet 14 – ‘Piston Engine Icing’1 the temperature and dew point is indicative of a relative humidity of 60 – 70%. The chart suggests that with these conditions there is a moderate risk of carburettor icing at cruise power and a serious risk at descent power. However, the leaflet highlights that with wet ground and light winds the local humidity could be higher and further increase the risk of icing. Airfield information Waits Farm (Figure 2) has a small privately-owned airfield with hangar space for a few light aircraft. The owner keeps his own aircraft there and rents hangar space and use of the airfield to a few other pilots. The airfield has a bulk fuel tank to store aviation fuel (100LL). There is a single taxiway leading to the eastern end of a 500 m grass runway orientated approximately 07/25. Runway 07 has a slight up-slope. A prominent windsock is located to the north of the runway. Aircraft normally take off and land into wind. The surface wind on the day of the accident was south-westerly which would suggest Runway 25 would be the preferred runway for takeoff and landing. The start of Runway 25 is closer to the hangar so requires less taxiing and no need to backtrack the runway. The aircraft that took off before the accident and Footnote 1 http://publicapps.caa.co.uk/docs/33/20130121SSL14.pdf [accessed 8 August 2019].

6 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 returned later in the day used Runway 25. As no one witnessed G-AWMN taking off, it is not known which runway was used. However, the aircraft was seen climbing away from Runway 07. Taxiway

Hanger

Figure 2 Waits Farm Airfield The airfield owner reported that he inspected the runway after the accident and, despite the soft ground, found no tyre marks in the first third of Runway 07. This suggests that no aircraft had used this part of the runway recently. Personnel information The pilot held a UK Private Pilot’s Licence with a valid Single Engine Piston rating. This licence allowed the pilot to operate non-EASA aircraft, such as G-AWMN, in UK airspace. His logbook records that he had a total of 317 hours of flying experience, of which 150 hours were in G-AWMN. It records that, on 6 July 2015, he had an engine failure in G-AWMN which resulted in a forced landing in a field. The logbook suggests that the aircraft flew again on 15 July 2015 and completed 18.5 hours of flying between July 2015 and October 2017. The last flight in G-AWNM was recorded on 17 October 2017. There were no flights recorded between October 2017 and July 2018. In July and August 2018, the pilot completed two training flights in a Piper Warrior aircraft. The last entry in the pilot’s logbook was a licence proficiency check (LPC) on 25 August 2018. The examiner who conducted his LPC commented that he was a safe and competent pilot. Witnesses reported that the pilot flew G-AWMN on two occasions in the months before the accident flight, once in December 2018 and once in January 2019. No record was found of these flights. It is therefore not known exactly how many flying hours the pilot had completed in the last 28 or 90 days.

7 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 Medical and pathological information The pilot had ‘self-declared’ that he was medically fit to fly on 17 September 2018; this declaration was valid at the time of the accident. Self-declaration allows the pilot to fly non‑EASA aircraft, such as G-AWMN. The pilot had previously held a CAA class 2 medical but, this expired on 20 October 2018. The post-mortem report stated that the cause of death was ‘multiple traumatic injuries.’ There was evidence of ‘significant bony trauma about both knees’ and of a ‘significant head injury.’ The report found there was a ‘small amount of carbon pigmentation within the airways suggesting there may have been some respiratory effort at the time of the onset of the fire.’ However, the report stated that this was ‘most likely weak and not prolonged.’ The post-mortem found no evidence of any significant underlying natural pathology or of an acute pathological event. No drugs or alcohol were detected in the post-mortem blood or urine samples. Accident site The aircraft crashed in a harvested arable field close to the extended centreline of the landing strip from which it had departed (Figure 3). The surface of the field was bare earth which was extremely soft and wet. Activity of emergency services had disrupted the surface around the wreckage and obscured some impact marks. Figure 3 Accident site

8 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 The engine was partly buried by the force of the impact, but its final orientation was consistent with the aircraft having descended steeply nose-down with the left wing hitting the ground just before the right wing. An intense post-impact fire had destroyed almost all the wooden structure, leaving only the extreme outboard section of the right wing and aileron unburnt. There was no evidence of impact damage in these unburnt areas. Charred remains of curved wooden members indicated that the tail-plane, rudder and elevators were present at the site but nothing identifiable as the wooden structure of the fuselage or of the left wing survived the fire. Numerous metallic components did survive including the highly disrupted fuel tank and various steel struts, brackets, hinges, bracing wires and control cables. The aluminium alloy cowling panels were severely disrupted and fire-damaged; a number of molten lumps of aluminium alloy were found at the scene. One lightly damaged propeller blade protruded visibly upwards from the engine to which it was still attached, whereas the other blade, recovered from underneath the engine, had broken off at the root. The accident site was compact with no evidence of any visible wreckage trail of items from, or parts of, the aircraft. Recorded information No radar returns for G-AWMN were recorded, either by civilian or military installations, covering the area of Waits Farm and neither were any radio transmissions from G-AWMN recorded. A mobile phone was found at the accident site and a tablet device was recovered from the pilot’s car. The phone was extensively damaged and, although communication records were obtained which showed the cell towers that the phone had connected to, the data was not of sufficient fidelity to determine the track of the accident flight. Examination of the tablet identified that typical aviation applications were installed but none provided any insight into the planning of the accident flight. Aircraft information General The Luton LA4A Minor was designed in 1958 as an update of a legacy 1930’s ultra-light aircraft. It was intended for amateur construction using commercially available drawings. An aircraft owner, from the design drawings, has responsibility for the building of an aircraft, and the Light Aircraft Association (LAA), through its inspectors and LAA Engineering, can provide guidance and processes to help the owner ensure that the aircraft build meets the minimum airworthiness requirements appropriate to the type.

9 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 Figure 4 G-AWMN before the accident (used with permission) The LA4A has a largely wooden structure with fabric covering. It has a high ‘parasol’ type wing arrangement, the wing structure being mounted on a system of cable-braced, streamlined, metal tubular struts, well above the fuselage and its single seat open cockpit (Figure 5). The bracing cables incorporate turnbuckles to enable the wing rigging to be adjusted. Figure 5 G-AWMN cockpit (used with permission)

10 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 Flying controls The flying controls are conventional, with cables operating the control surfaces (rudder, elevators and ailerons). For each flight control, a number of turnbuckles are used to adjust rigging and alter cable tensions. Each turnbuckle (Figure 6) consists of a cylindrical barrel, which incorporates left and right hand threaded bores in opposite ends, and a hole bored at mid-length. Bored hole Figure 6 A typical turnbuckle recovered from G-AWMN Threaded eye-bolts, each pair having respective left hand and right hand threaded portions, are screwed into the barrel ends. Rotating a barrel enables cable tension to be increased or decreased, depending on the direction of rotation, without twisting the eye‑bolts or cables. The cable ends pass through holes in each eye-bolt and are bent backwards around a protective metal member and secured to the parent cable by a swaged collar. Once adjusted for tension, the assembly’s security is maintained by wire locking the eye-bolts to one another and to the barrel. This is achieved by passing locking wire through the holes in each of the eye-bolt ends. Rotation relative to the barrel is prevented by the wire being passed through the bored hole and the ends being twisted together. On all turnbuckles on G-AWMN the wire locking ends were repeatedly wrapped around the centre of the barrel. As a result of its non-proprietary nature, considerable differences in detailed design and component selection can be found in examples of the LA4A type. Hence no surviving example can fully serve as a pattern for details of the pre-accident configuration of G-AWMN. In particular, the locations of the turnbuckles, so far as could be determined from the wreckage of G-AWMN, did not entirely replicate the locations shown on the only flying control cable drawing available. Engine The LA4A type is capable of being powered by a range of engine types. G-AWMN utilised a 1,766 cc horizontally opposed four-cylinder air cooled engine of the type used to power Volkswagen cars and camper vans. The engine drives a two-bladed propeller manufactured from a single continuous length of laminated timber, bolted to the drive flange on the forward end of the engine crankshaft.

11 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 The ignition system consisted of two ‘Skycraft’ ignition modules mounted on the rear of the installed engine. Carburation was by means of a single Zenith-Stromberg automotive carburettor. An air box, incorporating a controllable intake flap, was positioned upstream of the carburettor. The engine log book recorded that a modified air box was installed on or before 6 November 2018 following the installation of a different fuel pump whose geometry prevented fitment of the previous air box. The flap enabled direct ambient air delivery to the carburettor to take place but, when closed, caused heated air to be drawn into the air box via a section of hose from a single muffler surrounding one of the four individual exhaust pipes. This provided heated air to remove ice from the carburettor intake. The flap was controlled by a lever in the cockpit. Aircraft performance There are no published manuals describing the handling characteristic or performance of the LA4A and, as the aircraft are handmade from drawings, each is slightly different. As no other pilot regularly flew this aircraft, it is not possible to know the exact handling characteristic of G-AWMN. However, pilots who have flown other Luton LA4A Minors describe them as having benign stall characteristics. There is no tendency to drop a wing if the aircraft is stalled in balance. Due to the high drag, the aircraft does require a steep nose-down attitude to maintain speed in a glide. The CAA publish Handling Sense Leaflet 02 - ‘Stall/Spin Awareness’2 which highlights the hazard of stalling following an engine failure shortly after takeoff or during a go-around. The leaflet states: ‘One of the most critical phases of flight is just after take-off or when going around from an approach to land. At low level, at relatively low speed and with a high nose attitude, an engine failure will lead to a rapid deceleration and increasing angle of attack. To avoid any possibility of stalling and spinning, the pilot must promptly and positively select a lower nose attitude, to achieve and maintain a safe gliding speed. If the aircraft has already decelerated below the recommended gliding speed, this may initially require an attitude lower than normal.’ History of G-AWMN Construction of the original aircraft took place over an extended period; the maiden flight having taken place in 1987. Since then, according to its maintenance records, it had flown approximately 330 hours and had been owned by four different people. The accident pilot acquired the aircraft in 2007 after it had been damaged in a previous accident in Ireland3. He rebuilt the aircraft and first flew it on 4 December 2011. Footnote 2 https://publicapps.caa.co.uk/docs/33/ga_srg_09webHSL02.pdf [accessed 8 August 2019]. 3 The accident on 29 July 2007 was investigated by the Air Accidents Investigation Unit of Ireland. The report is available at http://www.aaiu.ie/sites/default/files/upload/general/9720-0.PDF [accessed 8 August 2019].

12 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 On 6 July 2015, the aircraft suffered an engine failure in flight and the pilot landed the aircraft in a field near Wickham St. Paul. Documentation submitted to the LAA states that the aircraft did not fly again until after the Certificate of Clearance was issued by the LAA on 30 November 2018. Similarly, neither the aircraft nor engine log books contain any reference to any flights after 6 July 2015. However, the pilot’s logbook recorded that the aircraft flew again nine days after the engine failure and completed 18.5 hours of flying between July 2015 and October 2017. The documentation submitted to the LAA shows that a programme of work was completed on the aircraft on 8 November 2018. A worksheet of that date shows that the wings had been removed for road transport and subsequently refitted, with fasteners checked and replaced as necessary. The aileron cables were inspected, reconnected, wire locked, and checked for correct operation and full movement. The wing strut bracing tension was adjusted and the turnbuckles wire locked. All control hinges were inspected and lubricated with full movement checked. The wheels were removed, the tyres inspected, and the brakes cleaned and adjusted. All of these were signed for by an engineer. A final recorded action was a dual inspection of control cables which was signed for by the engineer and countersigned by the owner/pilot. An application for Renewal (revalidation) of the Permit to Fly was signed by the owner/ pilot on 10 November 2018 and received by the LAA on 13 November 2018. On 30 November 2018, the LAA issued a Certificate of Clearance, valid until 28 February 2019. This was an authorisation to carry out test flights with the alternative fuel pump and air box fitted. The authorisation limited flight to within a 35 nm radius of Waits Farm and stipulated that the pilot conducting the test must have a minimum total experience of 100 hours, including 10 hours on type, and that they must be in current flying practice. Aircraft examination General Due to the absence of the majority of the aircraft, the examination was necessarily limited in scope and almost entirely restricted to metallic components, in particular the power unit and the flying controls. Engine An external examination of the power unit indicated that the propeller remained correctly bolted to the drive flange on the forward end of the crankshaft. One blade was only lightly damaged whilst the other blade, recovered from underneath the engine, had failed at the root. The fracture was consistent with a backward bending load which was not the failure orientation to be expected from a propeller blade impact occurring with the engine delivering power. Although neither propeller blade showed any evidence of the chordwise scoring which could be expected with an engine delivering power, the impact and fire damage to the outer section of the broken blade precluded a reliable

13 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 assessment of power at impact as this is the area where such evidence is normally most obvious. The body of the engine-mounted fuel pump had broken away from the engine crankcase as a result of the impact. Part of the internal rocking lever remained attached to the surviving portion of the pump body adjacent to the mounting flange. The remainder of the body of the unit was not only separated, but a portion of it was not identified amongst the recovered items. The portion incorporating the main spring and diaphragm was nonetheless identified and dismantled. Both the spring and diaphragm were examined and found to be intact and capable of functioning correctly. As a result of the post-impact fire, a number of other parts of the aircraft fuel system could not be identified. The two electronic ignition units were removed and subjected to rig testing at the premises of the supplier. Following rectification of a small impact damage feature, both units were mounted in the test rig and found to operate satisfactorily. The carburettor was severely heat damaged and its examination revealed no useful evidence. Strip examination of the engine unit involved removing the cylinder heads from both pairs or banks of cylinders, removing all four cylinders and splitting the crankcase into its two halves. All internal revolving and reciprocating parts of the engine were then examined. The internal condition of the engine was good, no defects were found amongst those components and all bearings, gears and moving surfaces showed no evidence of seizure or a lack of lubrication. Examination of the combustion chambers and the piston crowns revealed an absence of the characteristic brown colouring normally found in aviation piston engine types which have operated for periods with the correct air/fuel mixture. Instead, all combustion chambers and piston crowns within all cylinders exhibited a distinctive black finish. The combustion chamber colouring was compared with that of a Volkswagen-derived aero-engine recently removed from an aircraft which was known to have had high power at impact. The normal characteristic brown colouring, mentioned previously, was present in the combustion chambers and on the piston crowns of this other engine. Flying controls The cables for the flying controls were severely disordered and only two of the many pulleys had survived the fire. The rudder control cables were identified as being complete from the rudder bar in the cockpit to the rudder bell crank, which is normally attached directly to the rudder. It was noted, however, that a turnbuckle barrel had fractured at mid-length (across the bored hole) but the turnbuckle remained capable of transmitting force as a result of the wire locking remaining intact (Figure 7). The rear elevator operating bell crank was identified along with operating cables and turnbuckles. These were found to be almost entirely intact from the pilot’s control column to the rear bell crank with the exception of a turnbuckle barrel that linked the control

14 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 column to the elevator. The barrel had fractured as a result of bending and was severely affected by heat; all features which are consistent with impact and the effects of the post‑impact fire. Figure 7 Fractured barrel in a rudder flying control turnbuckle Examination of the roll control system revealed that, for the turnbuckle on the aileron balance cable, both eye-bolts and most of the locking wire was present but the barrel was absent (Figure 8). Figure 8 Aileron balance turnbuckle (barrel missing) Neither threaded eye-bolt showed evidence of significant oxidation, and thus appear not to have been overheated. Lubricating grease was found on both threads but there were no traces of any metal from the barrel. Both corresponding cable ends appeared correctly swaged. The locking wire of one eye-bolt to the missing barrel was present and attached to the eye-bolt. It appeared to have been correctly routed through the hole in the now‑absent barrel with multiple coils and the wire end visible where the mid-length bored hole in the barrel would have been. The portion of locking wire extending from the central hole to the other eye-bolt and back was absent. Both wire ends showed the characteristics of tensile failures and both failures were in the area where the mid-length hole in the barrel would have been.

15 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 Survivability The cockpit area was substantially damaged in the impact and subsequent fire leaving no survival space. The accident was not survivable. Analysis Purpose of the flight The pilot was conducting a test flight to renew the aircraft’s Permit to Fly. The LAA requires pilots conducting test flights to be in current flying practice and have a minimum of 100 hours total time including 10 hours on type. The accident pilot had significantly more experience than these minimum hours, but it is not known how much recent flying he had completed. His logbook records that he last flew on 25 August 2018 in a different aircraft type. However, witnesses reported he flew G-AWMN in December 2018 and January 2019 although no records were found of these flights. The aircraft had suffered an engine failure in July 2015. There was a discrepancy in the paperwork regarding whether the aircraft had flown between this engine failure and the recent test flights. The pilot’s flying logbook suggested the aircraft had been flown whereas the aircraft log book, engine log book and paperwork submitted to the LAA suggested it had not. This discrepancy was not resolved. It is not known what specific tests the pilot intended to conduct during the accident flight. Accident Flight – direction of takeoff No one witnessed the aircraft taking off from Waits Farm, so it is not known exactly what time the aircraft took off or in which direction. The aircraft was not recorded on radar and no radio transmissions were recorded, so it is not known where it flew after takeoff. The airfield owner heard the aircraft’s engine start and remembered being informed of the accident 10 – 15 minutes later which implies the aircraft could not have flown far from the airfield. The witnesses who saw the accident reported seeing the aircraft climbing away from Runway  07 and this could infer that the aircraft had just taken off from that runway. However, this would mean that the aircraft would have needed a longer takeoff run in order to depart with a tailwind on an up-slope. There were no tyre marks evident on the first third of Runway 07 and therefore, it seems unlikely that the pilot took off in this direction. Conversely, if the aircraft took off from Runway 25, to arrive where it was seen by the witnesses, it would have needed to fly a 180° turn, return to approach the airfield in the opposite direction, and then climb away. This would be an unusual manoeuvre but one that the pilot may have elected to follow if he had had an aircraft problem and decided to attempt a tailwind landing onto Runway 07. From such an approach, it is possible that the tailwind caused the pilot to go-around and this was when the aircraft was first seen by the witnesses.

16 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 Accident Flight – loss of control Eye witnesses report seeing the aircraft bank to the right then descend in a steep nose‑down attitude before impacting the ground and ear witnesses report hearing the engine noise stop before the impact. The investigation found two possible explanations for these observations; either carburettor icing causing the engine to stop producing power or a flight control issue. Both of these possibilities are discussed further below. Flying controls The flying control cable system, although disrupted and with most of its pulleys destroyed by fire, appeared to have been intact before the accident with the possible exception of the turnbuckle barrel on the aileron balance cable. The process and sequence of separation of the eye-bolts from the turnbuckle barrel, the absence of the latter and the absence of a section of locking wire could not be explained. The condition of the two eye-bolts, and in particular the absence of the significant oxidation seen on components of other turnbuckles known to have been severely fire affected, was not consistent with this assembly having been excessively heated in the post-impact fire. The presence of lubricant grease on the threads of both eye-bolts also indicated that the assembly had not been greatly affected by the fire. Therefore, it is unlikely that the turnbuckle barrel had melted and was thus absent. One other turnbuckle barrel in the aircraft had failed at the mid-point locking wire hole. However, had this occurred on the barrel in question, it would have required both fractured ends of the broken barrel to be individually unscrewed from the eye-bolts. An absence of any material from the barrel in the eye-bolt threads indicates that it was unlikely that both eye-bolts had been pulled out of the threads in the barrel by tensile forces. In addition, no mechanism was identified that could leave most of the locking wire intact but result in both eye-bolts becoming unscrewed. The reason for the loss of continuity at that location was not determined, but the investigation did consider the effect that such a loss of continuity might have had on aircraft handling. If this turnbuckle barrel was missing prior to flight or failed in flight, it is possible that the aileron circuit would still have functioned whilst held together by the locking wire. However, once the locking wire failed, the pilot would have been left with very limited roll control, although directional control could have been maintained through use of the rudder. Had such a flying control failure occurred, it could support the theory that the pilot tried to return to the airfield. However, with limited roll control and with a tailwind, maintaining runway alignment would have been challenging and might have necessitated a go-around. The presence of such a flying control disconnect could have either directly caused a loss of control or distracted the pilot from the monitoring of his airspeed which could then have resulted in the aircraft stalling.

17 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 Engine The condition of the propeller was consistent with an absence of power at impact. No evidence of pre-impact mechanical failure was identified in the engine. The combustion chambers and piston crowns lacked the brown coating generally associated with petroleum‑fuelled piston engines operating normally. Examination of another Volkswagen‑derived aero‑engine had confirmed that such brown colouring was to be expected in the combustion spaces of a correctly functioning engine. Instead, all G-AWMN’s piston crowns exhibited a black finish as normally found in engines which have operated for a period with an over-rich mixture. Such over-rich operation can result from a period of running with significant and increasing carburettor ice formation and which will, eventually, cause the engine to stop producing power. The low temperature and recent clearance of ground frost at the airfield at the time of the accident indicates that conditions conducive to carburettor icing near ground level would have been present. It is possible that the pilot experienced a rough running engine due to carburettor icing. If the aircraft had taken off from Runway 25 this might be a reason for the pilot to return to the airfield for a landing on Runway 07. However, with the tailwind mentioned earlier, this may have necessitated a go-around during which the engine stopped producing power. It is also possible that, again due to carburettor icing, the engine lost power following a takeoff from Runway 07. Following either scenario, if the pilot attempted to make a forced landing in a field, it would be natural to reduce engine power, and this may explain why witnesses heard the engine noise stop. It would normally be possible to glide an aircraft into a field if the engine fails, however, this can be particularly challenging when at low speed and with a high nose attitude on a go‑around. Owners of other Luton Minors reported that the aircraft requires a steep nose‑down attitude in a glide to maintain a safe airspeed. It is possible that the pilot was not able to react quickly enough to the loss of engine power and the aircraft then stalled. It is unlikely that it would have been possible to recover from such a stall at this low height. A loss of engine power due to carburettor icing followed by a stall would be consistent with the witness observations of the aircraft. Conclusion The aircraft was seen climbing away from Runway 07 at Waits Farm. It could not be determined if the aircraft had just taken off or if it was going around from an approach to land on Runway 07. The aircraft was observed to bank to the right and then descend rapidly to the ground which it struck at a steep nose-down angle. The structure was almost totally destroyed by a post-impact fire. The accident was not survivable. The investigation found that the engine may have stopped producing power due to carburettor icing. It is possible that the pilot was not able to lower the nose of the aircraft quickly enough to maintain adequate airspeed and the aircraft then stalled at a low height from which recovery was unlikely.

18 © Crown copyright 2019 All times are UTC AAIB Bulletin: 11/2019 G-AWMN EW/C2019/02/01 The investigation also identified that a turnbuckle barrel was missing from the aileron balance cable. It could not be determined how this component came to be absent nor whether it was missing prior to the accident. Published 19 September 2019.

FD06674 ｜ 2019_英国_aaib-investigation-to-pegasus-quantum-15-912-g-bzss__Pegasus_Quantum_15-912_G-BZSS_10-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

67 © Crown copyright 2019 All times are UTC AAIB Bulletin: 10/2019 G-BZSS EW/G2019/04/09 ACCIDENT Aircraft Type and Registration: Pegasus Quantum 15-912, G-BZSS No & Type of Engines: 1 Rotax 912 piston engine Year of Manufacture: 2001 (Serial no: 7770) Date & Time (UTC): 20 April 2019 at 1400 hrs Location: RAF Oakley (disused), Buckinghamshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - 1 (Minor) Passengers - 1 (Minor) Nature of Damage: Substantial Commander’s Licence: National Private Pilot’s Licence Commander’s Age: 56 years Commander’s Flying Experience: 413 hours (of which 23 were on type)

Last 90 days - 5 hours

Last 28 days - 4 hours Information Source: Aircraft Accident Report Form submitted by the pilot During the approach to Holmbeck Farm Airfield, the aircraft encountered ‘sink’ on final approach. The pilot was unable to arrest the high rate of descent despite adding power and flaring. The aircraft made a hard landing that caused substantial damage; including to its base tube, front strut, right main and nose landing gear, Figures 1 and 2. This damage resulted in the foot throttle becoming jammed at a high power setting. Figure 1 Damage including bent front strut and displaced right main landing gear

68 © Crown copyright 2019 All times are UTC AAIB Bulletin: 10/2019 G-BZSS EW/G2019/04/09 Figure 2 Damage to base tube The pilot decided to continue to climb away from the resulting bounce as the throttle was now stuck at a high power setting. He also decided to return to RAF Oakley (now disused), his home base, as it had a larger concrete runway. During the return flight, the pilot alerted emergency services using the emergency frequency. After a short hold overhead, to allow arrival of the emergency services, the pilot selected the ignition systems off and carried out a successful ‘dead-stick’ emergency landing. The pilot and passenger received minor injuries and were assisted by the emergency services.

FD06675 ｜ 2019_英国_aaib-investigation-to-pioneer-300-g-cear__Pioneer_300_G-CEAR_04-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

45 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 G-CEAR EW/G2018/09/20 SERIOUS INCIDENT Aircraft Type and Registration: Pioneer 300, G-CEAR No & Type of Engines: 1 Rotax 912 ULS piston engine Year of Manufacture: 2007 (Serial no: PFA 330-14511) Date & Time (UTC): 29 September 2018 at 1400 hrs Location: Near New Alresford, Hampshire Type of Flight: Private

Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Heat distress to engine cowling and components on firewall; hairline cracking on wing skin and deformed landing gear brackets Commander’s Licence: Light Aircraft Pilot’s Licence Commander’s Age: 61 years Commander’s Flying Experience: 885 hours (of which 135 were on type)

Last 90 days - 38 hours

Last 28 days - 3 hours Information Source: Aircraft Accident Report Form submitted by the pilot During the takeoff roll from Sandown Airfield, the aircraft hit a ridge in the runway causing it to become airborne before it had reached flying speed. Unable to sustain flight, it descended onto the runway before hitting a second ridge, causing it to become airborne again. It contacted the runway a second time with a “very heavy bump” and bounced. After a third bounce it then climbed away and routed towards its home airfield. After 15 minutes of flight, approximately overhead New Arlesford, Hampshire, the cockpit filled with smoke. The pilot made a PAN call and was guided to land at Popham Airfield. He landed there successfully with fire crew in attendance and the aircraft was shut down. Subsequent inspection of the engine compartment identified that the exhaust tailpipe had dislodged, allowing exhaust gases to impinge onto the engine cowling and firewall, causing significant damage. The heating of the fibreglass engine cowling had generated smoke which was then entrained into the cockpit ventilation system. Inspection of the airframe found cracks on the leading edge of the wing skin and deformed landing gear brackets.

FD06676 ｜ 2019_英国_aaib-investigation-to-pioneer-300-pioneer-g-rabs__Pioneer_300_Pioneer_G-RABS_02-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

50 © Crown copyright 2019 All times are UTC AAIB Bulletin: 2/2019 G-RABS EW/G2018/11/05 ACCIDENT Aircraft Type and Registration: Pioneer 300 Pioneer, G-RABS No & Type of Engines: 1 Rotax 912 ULS piston engine Year of Manufacture: 2006 (Serial no: PFA 330-14563) Date & Time (UTC): 11 November 2018 at 1105 hrs Location: Strathaven Airfield, South Lanarkshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Propeller and nose landing gear damage plus minor damage to lower cowlings and firewall Commander’s Licence: Light Aircraft Pilot’s Licence Commander’s Age: 75 years Commander’s Flying Experience: 1,011 hours (of which 462 were on type)

Last 90 days - 7 hours

Last 28 days - 2 hours Information Source: Aircraft Accident Report Form submitted by the pilot The pilot had taken off from Strathaven Airfield for a local flight. Shortly after getting airborne the weather started to deteriorate, and the pilot decided to return to the airfield to land on grass Runway 09. The outside air temperature was about 8°C and light rain. During the final stages of the approach the pilot selected the cabin heat on. Shortly after, the inside of the windshield rapidly misted up, obscuring the pilots forward view. The pilot subsequently misjudged the flare and the aircraft landed heavily, causing the nose gear to collapse and the propeller to strike the runway. The aircraft came to a stop shortly after on the runway. The pilot was uninjured. The pilot considered that the late application of cabin heat had most likely caused warm moist air within the cockpit to condense on the windscreen.

FD06677 ｜ 2019_英国_aaib-investigation-to-piper-pa-31-n250ac__Piper_PA-31_N250AC_03-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

3 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 ACCIDENT Aircraft Type and Registration: Piper PA-31, N250AC No & Type of Engines: 2 Lycoming TIO-540-A2C piston engines Year of Manufacture: 1976 (Serial no: 31-7612040) Date & Time (UTC): 6 September 2017 at 1723 hrs Location: Caernarfon Airport, Gwynedd Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 (Fatal) Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: Commercial Pilot’s Licence Commander’s Age: 62 years Commander’s Flying Experience1: Over 4,000 hours (with experience on type)

Last 90 days - unknown

Last 28 days - unknown Information Source: AAIB Field Investigation Synopsis Approximately 20 minutes after takeoff from a private airstrip in Cheshire the pilot reported pitch control problems and stated his intention to divert to Caernarfon Airport. Approximately 5 minutes later, the aircraft struck Runway 25 at Caernarfon Airport, with landing gear and flaps retracted, at high speed, and with no noticeable flare manoeuvre. The aircraft was destroyed. The elevator trim was found in a significantly nose-down position, and whilst the reason for this could not be determined, it is likely it would have caused the pilot considerable difficulty in maintaining control of the aircraft. The extensive fire damage to the wreckage and the limited recorded information made it difficult to determine the cause of this accident with a high level of confidence. A possible scenario is a trim runaway, and both the CAA and the EASA are taking safety action to promote awareness for trim runaways as a result of this accident. History of the flight The pilot operated N250AC from a private grass airstrip situated between Manchester and Liverpool. On the day of the accident he intended to fly to Dublin Weston Airport, which he visited regularly in this aircraft. Footnote 1 A number of the pilot’s log books were not located but other evidence indicated his total flight time, and also that he flew N250AC regularly.

4 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 The pilot had shown an employee how to perform pre-flight preparations on his behalf and the latter did so regularly. This did not include instruction on how to perform any pre-flight checks on the autopilot or trim systems. On the day of the accident, the employee stated that he spent 2 hours and 20 minutes preparing N250AC, during which he checked the elevator control surface and recalled it moving smoothly with no restrictions. The employee reported that he submitted the relevant General Aviation Report2 form two days before the accident. He produced a VFR flight plan which he filed after the pilot had checked it. The employee stated that this specified Dublin and Liverpool as destination alternate3 aerodromes. The pilot was also familiar with Caernarfon Airport, located on the Welsh coast, and had flown there three days previously. The employee recalled that the pilot arrived at approximately 1630 hrs. They walked around the aircraft together and the pilot departed in it shortly afterwards. The employee observed the elevator and ailerons being checked whilst the aircraft taxied, and they appeared to move normally. N250AC took off at 1653 hrs and the employee observed the landing gear retract normally at approximately 20 ft agl. Shortly after, the aircraft was recorded on primary and secondary radar at an altitude of about 550 ft amsl and squawking 70004. The aircraft turned onto a southerly course and progressively climbed to about 1,100 ft amsl. The pilot then contacted Liverpool Approach and requested activation of his flight plan; shortly after the aircraft stopped transmitting Mode A and C transponder information (Figure 2). Anecdotal evidence from a relative of the pilot who was also a commercial pilot suggested that it is likely that the pilot would have flown the aircraft manually, as opposed to using the autopilot. The aircraft continued on a southerly course until it was abeam the town of Crewe, Cheshire, where it changed course to the west. A few minutes later at 1702 hrs, Liverpool Approach confirmed that the flight plan had been activated, upon which the pilot advised that he was changing frequency to the London FIR information service (London Information). The pilot contacted London Information at 1710 hrs. The aircraft was 35 nm east of Caernarfon Airport. The pilot reported the aircraft was at 4,200 ft amsl and requested assistance in coordinating his arrival at Dublin. This was acknowledged and the pilot was requested to set his transponder Mode A squawk code to 1177, and transmit Mode C Footnote 2 General Aviation pilots, operators and owners of aircraft making international journeys are required to report their expected journey to UK authorities. The UK Government states that the General Aviation Report is used by Border Force and the Police to facilitate the passage of legitimate persons and goods across the border and prevent crime and terrorism. 3 ‘Destination alternate’ – an aerodrome at which an aircraft would be able to land should it become impossible or inadvisable to land at the aerodrome of intended landing. Different to an ‘en route alternate’. 4 The general conspicuity code was set on the transponder.

5 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 altitude information. Mode A was then transmitted from the aircraft, but no Mode C altitude data was received by radar. The aircraft’s groundspeed at this time was about 160 kt, which equates to an estimated indicated airspeed of approximately 165 KIAS based on a wind5 from 300ᵒ at 20 kt. During these transmissions, the pilot gave an estimated time of arrival at waypoint DEXEN6 as 1745 and thereafter turned right approximately 10° towards DEXEN. Shortly after, as the aircraft approached Snowdonia, the pilot confirmed with the ATCO that the regional QNH was 1013 hPa. Three minutes later at 1717 hrs, the pilot transmitted the aircraft’s callsign, indicating that he wanted to transmit a message. The ATCO acknowledged, but asked the pilot to ‘standby’ as she was dealing with other aircraft. N250AC was about 16.5 nm from Caernarfon Airport. At 1718:25 hrs the pilot radioed London Information again. The following is a transcript of communications between the pilot and the ATCO: N250AC: “london information november two five zero alpha charlie” ATCO: “november zero alpha charlie pass your message” N250AC: “we are having some pitch control problems eh with the elevator and so as a precaution i am going to divert to eh caernarfon” ATCO: “november zero alpha charlie roger, are you declaring a pan” N250AC: “um say again” ATCO: “november zero alpha charlie do you wish to declare a pan” N250AC: “not as yet i’ll see how it goes” ATCO: “roger do you have an eta for caernarfon and we will pass your details along” N250AC: “eh two five” ATCO: “roger so time one seven two five for caernarfon” N250AC: “affirm” ATCO: “roger we will pass your details” After reporting the control problem, the aircraft turned left slightly and tracked towards Caernarfon. As the aircraft flew over Snowdonia it was maintaining a westerly course towards Caernarfon Airport, and it was intermittently recorded by primary radar. At 1721:20  hrs, the aircraft was about 6.4 nm from Caernarfon Airport and 15 nm from RAF Valley, Anglesey. This coincided with the ATCO advising the pilot that Caernarfon appeared to be closed because there was no answer from the tower, and offering to liaise with RAF Valley as an alternate destination. The pilot did not respond to this transmission. Analysis of primary radar coverage indicates that the aircraft was above 4,000 ft amsl. Footnote 5 5,000 ft amsl spot wind at a temperature of 7°C provided in an aftercast by the Met Office. 6 The pilot gave navigational waypoint DEXEN as his point of entry in to Irish airspace, which is approximately 35 nm west of RAF Valley.

6 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 The aircraft was recorded again on radar between 1721:44 hrs and 1722:12 hrs when it was 4 nm from Caernarfon. Its average groundspeed had increased to about 175 kt, which equates to an estimated indicated airspeed of approximately 180 KIAS7. Analysis of radar coverage indicated the aircraft was above 2,600 ft amsl. At 1723:168 hrs, CCTV footage showed the aircraft during the final seconds of the flight as it approached Runway 25 at Caernarfon Airport. Eyewitnesses reported that the aircraft appeared to approach faster and lower than usual, and was rocking from side to side. Its engines were making a high-pitched noise, as though they were operating at a high rpm setting. The aircraft contacted the runway heavily with a high rate of descent. It then bounced into the air for just less than two seconds, during which it rolled right, through almost 360° around its longitudinal axis, before impact with the runway again. A significant fire broke out as the aircraft slid along the runway. The aircraft came to rest nine seconds after it had initially struck the runway. The RFFS arrived at the aircraft five minutes later at 1728 hrs, and shortly after started to apply fire suppressant. The pilot had been fatally injured. Weight and balance Information provided by the pilot’s employee, who loaded and fuelled N250AC before the accident flight, indicated that the aircraft’s weight and balance were within the limits specified for this aircraft type, and that there was sufficient fuel onboard for the planned route. Meteorology An aftercast for the planned route provided by the Met Office showed some cloud above 2,000 ft amsl, with good visibility beneath and no significant weather. The 5,000 ft wind and air temperature at 1800 hrs were 300° at 20 kt, and 7°C. RAF Valley’s METAR at 1750 hrs reported wind from 210° at 12 kt, visibility greater than 10 km, few clouds at 4,500 ft and broken cloud at 10,000 ft, temperature 15°C, and QNH 1019 hPa. METARs for Hawarden, Liverpool and Manchester showed similar conditions. METAR information for Caernarfon was not available. Aerodrome information Caernarfon’s operational runway is 932 m long and orientated 070°/250° (Figure 1). The airport’s published summer operating hours were from 0800 to 1700 hrs. A number of the eyewitnesses were situated in a caravan site under the final approach to Runway 25. RAF Valley is approximately 11 nm north-west of Caernarfon Airport. Footnote 7 Based on a spot wind at 5,000 ft amsl from 300° at 20 kt and a temperature of 7°C. 8 The CCTV time stamp was corrected for a 10 second offset from UTC.

7 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Caravan park Figure 1 Caernarfon Airport and location of caravan park Personnel The pilot held an EASA Class 1 medical certificate, which had been revalidated on 13 April 2017. He had a valid EASA CPL(A) with multi-engine and instrument ratings, and UK PPLs for both fixed and rotary wing aircraft. He also had similar licensing certificates and ratings issued by the FAA. The pilot’s 42 years of flying experience included various piston and turbine engine aeroplanes and helicopters, and he had owned both fixed wing and rotary aircraft. Several of his log books were not located after the accident, including the most recent ones, so an accurate breakdown of his experience could not be determined. However, he declared a total of 4,000 flying hours at his last medical revalidation, and 50 hours in the previous 13 months. Flight planning paperwork provided by his employee indicated that he had planned around 25 flights to or from Ireland in the period since 11 April 2015. Any domestic flights which may have occurred would have been in addition to these. Medical and pathological information A post-mortem examination of the pilot revealed no evidence of underlying disease or toxicology which could have contributed to the event. It concluded that the cause of death was multiple injuries sustained when the aircraft struck the runway.

8 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Recorded information Sources of recorded information Recorded radar information (primary and secondary Mode A and C9) was available from ground-based sites located at Manchester Airport and St Anne’s (near Blackpool). The radar data provided an almost complete record of the accident flight, starting shortly after the aircraft had taken off and ending when the aircraft was about 4 nm east of Caernarfon Airport. Figure 2 provides a plot of the aircraft radar track. RTF recordings were available of communications between the pilot and both Liverpool Approach and London Information. RTF communications were not recorded at Caernarfon Airport. Closed Circuit Television (CCTV) footage of the accident was captured by two cameras located at Caernarfon Airport. One camera, installed on the control tower, provided a field of view that included the approach to Runway 25 and approximately the first 500 m of the runway. Images from this camera showed the aircraft from four seconds10 before it struck the runway to it coming to a stop. The other camera, installed on an adjacent hangar, recorded the aircraft as it slid along the runway before disappearing out of camera view. The aircraft was not fitted, nor was required to be, with a flight data recorder. Interpretation Assuming that N250AC flew a direct track from the last radar point at 4 nm from the runway, its average indicated airspeed would have been approximately 190 KIAS based on a wind from 210°at 12 kt11. Analysis of the CCTV footage indicated that, prior to impact, the aircraft was in an almost wings-level attitude and the landing gear was retracted. The approach track was calculated to be about 245°T, the flight path angle was about 9° nose-down, the descent rate was about 2,700 ft/min and the estimated groundspeed was approximately 175 kt; this equates to an indicated airspeed of about 185 KIAS based on a wind from 210° at 12 kt. Footnote 9 Mode A refers to the four-digit ‘squawk’ code set on the transponder and Mode C refers to the aircraft’s pressure altitude which is transmitted in 100 ft increments. 10 The resolution of the camera meant that the aircraft was not discernible until four seconds prior to impact. 11 Reported at RAF Valley (EGOV) around the time of the accident.

9 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Figure 2 Radar track of N250AC Map data: Google, Landsat/Copernicus Aircraft information The Piper PA-31 Navajo has two turbocharged piston engines with three-bladed variable pitch propellers, retractable landing gear and seating for two pilots and four passengers. The aircraft was manufactured in 1976 and had been operated by the owner since approximately 2002. The aircraft’s logbooks were not located following the accident, however technical records provided by the aircraft’s maintenance facility showed that an annual inspection had been carried out on 8 February 2017, at 9,243 flying hours. The last recorded maintenance activity was the replacement of the left engine’s turbocharger, which occurred on 1 September 2017. There was no record of any ongoing or deferred aircraft defects. The aircraft’s flying controls are conventional, unpowered and operated directly by the control yokes and rudder pedals via mechanical linkages. The elevator control circuit includes an electrically-powered pitch servo, actuated by the autopilot. Aileron, elevator and rudder trim are manually operated by trim wheels connected to cable-wrapped drums located in the cockpit centre pedestal (Figure 3). With rotation of a drum, a screw is moved fore or aft to allow the positioning of the trim tab. An electric sender unit is attached to each trim tab screw assembly to transmit an electrical signal to the trim position indicator on the centre pedestal, to provide a visual indication of the trim tab positions to the pilot. Electric pitch trim system The electric pitch trim system (Figure 9) is powered when the aircraft master switch is on and the electric trim circuit breaker is engaged. When the left part of the control yoke pitch trim switch is pressed down, and the right part of the switch is moved forward, a solenoid in the pitch trim servo causes the pitch trim motor to engage with the cable capstan and rotation of the pitch trim motor moves the elevator trim cable to change the position of the elevator

10 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 trim tab, to provide nose-down trim. The pitch trim servo capstan has an internal clutch to allow the elevator trim cables to move, should the servo jam. Rearwards movement of the right pitch trim toggle switch, with the left part of the switch depressed, moves the elevator trim tab to provide nose-up trim. The two-part switch is designed such that should one part of the switch fail closed, the pitch trim system will not operate unless the other part of the pitch trim switch is operated by the pilot, to prevent a trim runaway condition due to a single switch failure. The electric pitch trim system has two modes of operation; a manual mode and an automatic mode.

Figure 3 N250AC cockpit, showing trim controls (image used with permission) Manual mode The manual mode is operational only when the pitch axis of the autopilot is disengaged. The position of the elevator trim tab is directly controlled by pilot demand, either via movement of the elevator trim wheel on the cockpit pedestal or by selection of the electric pitch trim switch on the left control yoke. Automatic mode When the pitch axis of the autopilot is engaged, the pitch trim switch on the left control yoke becomes inoperative and any movement of the switch will cause the autopilot to disconnect. The autopilot pitch servo detects any differential elevator cable tension caused by an out‑of‑trim condition, and the automatic pitch trim system actuates the pitch trim servo to move the elevator trim tab to re-trim the elevator. Any attempt to overpower the autopilot

11 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 pitch axis will cause the automatic pitch trim to oppose the applied force, resulting in an out‑of-trim condition and high yoke forces. Pitch trim warning system In manual and automatic pitch trim modes, a pitch trim warning system is provided. The function of this system is to provide the pilot with a visual indication of an abnormally long or continuous pitch trim servo operation. The system consists of a logic circuit that is designed to be failsafe, an electronic timing device within the pitch trim servo and an indicator warning light on the left side of the instrument panel. The indicator warning light (Figure 3) will illuminate if the pitch trim servo operates for longer than 3-4 seconds, and extinguishes when the pitch trim servo ceases to operate. Illumination of the indicator warning light is coincident with the operation of a relay in the pitch trim servo that removes power from the pitch trim servo motor, to prevent a trim runaway. The automatic pitch trim system normally maintains trim with pitch trim servo operations of less than one second duration and therefore a prolonged illumination of the indicator warning light may indicate a runaway pitch trim servo, or a slipping pitch trim servo clutch, or low elevator trim cable tension. A ‘press-to-test’ switch is provided next to the indicator warning light to permit the pilot to check for correct operation of the pitch trim warning system. When pressed, this switch introduces a failure within the pitch trim system removing power from the pitch trim servo and causing the warning light to illuminate. Autopilot N250AC was equipped with a Bendix Altimatic V-1 two-axis autopilot, which when engaged can manoeuvre the aircraft in response to following pre-selected flight control functions: ● ● Automatic pitch trim ● ● Altitude hold ● ● Pitch command (for climb or descend) ● ● Radio coupling (VOR/LOC), capture and tracking ● ● ILS localiser back course capture and tracking ● ● Automatic ILS glideslope capture ● ● Pre-selected heading hold ● ● All angle VOR/LOC capture ● ● Manual turn control The system is composed of a mode control panel, a computer-amplifier, a power supply, an altitude controller, pitch and roll control servos, a directional gyro and optional flight director instrumentation. The autopilot is powered through the autopilot master switch and the power supply circuit is protected with a circuit breaker on the circuit breaker panel. The autopilot is engaged by selecting the desired mode on the mode control panel. The autopilot can be disengaged by either selecting the autopilot release switch on the left control yoke, or by pressing the electric trim switch during autopilot operation, or by switching the autopilot master switch to off, or by pulling the autopilot circuit breaker.

12 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Circuit breaker panel Electrical switches for the aircraft’s systems, including the master switch, are located on the circuit breaker panel on the left cockpit sidewall (Figure 4). Circuit breakers are provided that automatically open each electric circuit should an overload occur. The pitch trim servo has a dedicated circuit breaker located on this circuit breaker panel. It is possible to manually open the circuit breakers by pulling their reset buttons outwards, which disconnects the selected circuit from electrical power. Electric trim circuit breaker Figure 4 Circuit breaker panel in a representative PA-31

13 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Airworthiness requirements for controllability Previous amendments of the relevant certification specification documents under the FAA and the EASA12, expressed controllability and manoeuvrability requirements as FAR 23.143 and CS 23.143. These specified force limits for pitch control as 34 kgf13 for temporary application with two hands on the control wheel rim, 23 kgf for temporary application with one hand on the control wheel rim, and 5 kgf for prolonged application. Prolonged application was defined14 as ‘some condition that could not be trimmed out, such as a forward c.g. landing. The time of application would be for the final approach only, if the aeroplane could be flown in trim to that point.’ The current amendments to FAR 23 and CS 2315 represent a transition to performance- based airworthiness standards. As such, control force limits are no longer specified. ‘Controllability’ is now defined in both documents as follows: ‘23.2135 Controllability. (a) The airplane must be controllable and maneuverable, without requiring exceptional piloting skill, alertness, or strength, within the operating envelope— (1) At all loading conditions for which certification is requested; (2) During all phases of flight; (3) With likely reversible flight control or propulsion system failure; and (4) During configuration changes.’ Aircraft operation PA-31 Navajo checklists The pre-flight checklists for N250AC were outlined in section 3 of its Flight Manual under ‘normal operating procedures’. These procedures did not include reference to the autopilot and trim systems, other than to ensure that the elevator trim is set to the neutral position for the walk around inspection and then, later, to ensure that it is in the correct position for takeoff. Section 5 of the Flight Manual contained various supplements. A number of these related to various autopilot types which could be installed in relevant PA-31s. The Bendix Altimatic V-1 autopilot supplement, relevant for N250AC, contained pre-flight procedures, and normal and emergency in-flight procedures, for both the autopilot and the manual electric trim systems. Footnote 12 For example, ‘Certification Specifications for Normal Category Aeroplanes CS-23’ Amendment 4, https:// www.easa.europa.eu/sites/default/files/dfu/CS-23%20Amendment%204.pdf (accessed 21 September 2018), and equivalent FAA document. 13 The force values contained within the documents were specified in Newtons and pounds of force and have been converted to kgf in this report for the purpose of consistency. 14 CS-23 Amendment 4 Book 2 Flight Test Guide Book, section 4 Controllability and Manoeuvrability. 15 CS-23 Amendment 5 and equivalent FAA document.

14 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 The autopilot ‘Pre-flight check-out procedures’ were: ‘2. PREFLIGHT CHECKOUT PROCEDURES (a) AUTOPILOT MASTER SWITCH – Turn autopilot master switch to ON. (b) BEFORE TAKEOFF – Engage the autopilot, apply a force to the controls (on one axis at a time) to determine if the autopilot may be overpowered. (1) Press Hdg, Nav, Appr, Rev buttons one at a time, place pitch command disc in center detent position and check respective lights on the Flight Controller for operation. (c) RELEASE SWITCH – Disengage the autopilot by pressing the Autopoilot Release Switch, located on the left side of the pilot’s control wheel, and recheck aircraft pitch trim before takeoff. (d) GYRO CHECK – Check attitude gyro for proper erection. Set the directional gyro, if manual slaving type. (e) PITCH TRIM INDICATOR – Centering the Pitch Trim Indicator (by rotating the pitch command) prior to engagement will insure that the aircraft will continue in its present attitude. However, if the Trim Indicator is not centered, aircraft will smoothly take up the attitude dictated by the pitch command.’ The autopilot ‘In-flight procedures’ section included: ‘…AUTOMATIC PITCH TRIM is provided whenever the autopilot is engaged. Any attempt to overpower the autopilot pitch axis will cause the pitch trim to oppose the applied force, resulting in an out-of-trim condition and high stick forces. To manually operate the elevator trim tab, the autopilot must be disengaged. Pushing the release switch will disengage the autopilot.’ The ‘Manual electric trim’ procedures stated: ‘…TRIM EMERGENCY PROCEDURES In [the] event of an in-flight malfunction of the electric trim system, disconnect by pulling electric trim circuit protector [breaker]. TRIM PRE-FLIGHT PROCEDURES The following pre-flight shall be conducted prior to each flight and during flight as considered appropriate.’

15 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 (1) A/P Master Switch – ON (2) Trim Warning Light – OUT (3) Manual Trim Wheel Freedom of Movement – Check (4) Actuate Electric Trim Switch and observe proper direction of movement of manual trim wheel – Check (5) Press the press-to-test button next to the trim warning light. Light should light while being pressed and should not run – Check.’ Under ‘Emergency Operating Procedures’ the Flight Manual stated: ‘(a) In [the] event a malfunction in the autopilot performance is detected, the pilot must immediately disengage the autopilot by momentarily pressing the Autopilot Release Switch on the control wheel. (b) In [the] event of a runaway pitch trim during autopilot operation, an overpower force of up to 20 lbs.16 at the control wheel will be experienced at the time of disengagement (3 second delay for recognition time). Pull A/P circuit breaker and have the system checked prior to re‑engagement…’ PA-31 Navajo normal operation The PA-31 Navajo Flight Manual used by the pilot defined the maximum structural cruise speed (VNO) as 187 KIAS. It stated that for landing, when the airspeed is below 152 KIAS, flap 15° may be selected. Landing gear and full flap may be selected when below their limiting speed of 130 KIAS. Whilst the pilot’s copy of the Flight Manual17 did not specify a final approach speed, another version of the manual quoted that speed as 95 KIAS. Stabilised approaches The Flight Safety Foundation’s document18 entitled ‘Approach-and-Landing Accident Reduction Tool Kit – Briefing Note 7.1 Stabilised Approach’ lists the criteria for a stabilised approach under VFR. An approach is stabilised when all criteria are met. Table 1 below relates these to the accident approach. Footnote 16 20 lbf equates to approximately 9 kgf. 17 The pilot’s copy of the Flight Manual states that it applies to aircraft with serial numbers 31-752 and up 18 https://www.skybrary.aero/bookshelf/books/864.pdf (accessed on 21 September 2018).

16 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Stabilised criteria Correct Accident approach The aircraft is on the correct flight path 2,100 ft amsl at 6.4 nm1 1,400 ft amsl at 4.0 nm1 Above 4,000 ft amsl at 6.4 nm Above 2,600 ft amsl at 4.0 nm Only small changes in heading/ pitch are required to maintain the correct flight path Not achieved, 9° nose-down pitch in final seconds The aircraft speed is not more than VREF+20 knots indicated airspeed and not less than VREF 2 95 kt +20, -0 185-190 KIAS – 70-75 KIAS above VREF+20 The aircraft is in the correct landing configuration Flap full, landing gear down Flap and landing gear remained up – airspeed 55-60 KIAS above limiting speed Sink rate is no greater than 1,000 feet per minute Average of 2,000 fpm or more from 6.4 nm, and 2,700 fpm in last few seconds. Power setting is appropriate for the aircraft configuration and is not below the minimum power for approach as defined by the aircraft’s operating manual Power setting unknown. Some but not full power applied and propellers close to fully fine. Table footnotes: 1 Approximate altitudes based on a 3° glideslope. 2 Target approach speed. Table 1 Comparison of accident approach conditions with stabilised approach criteria19 Accident site The aircraft had struck the paved surface of Runway 25, 3 m to the right of the runway centreline and 101 m before the displaced threshold (Figure 5). The main wreckage of the aircraft, consisting of the fuselage, empennage, right wing and engine and most of the left wing apart from the left engine had come to rest on the runway surface 293 m beyond the initial impact point. A severe post-impact fire had consumed the majority of the aircraft with only the nose section ahead of the cockpit remaining free from fire damage. Examination of the wreckage confirmed that the aircraft had been structurally complete at the point of impact. The landing gear was retracted and the flaps were fully up, confirmed by the position of the flap jackscrew actuators. Footnote 19 The Flight Safety Foundation states that ALAR briefing notes were prepared primarily for operators and pilots of turbine-powered aeroplanes with underwing-mounted engines but can be adapted for those who operate fuselage-mounted turbine engines, turboprop-powered aeroplanes and piston-powered aeroplanes.

17 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Assessment of the initial ground impact marks indicated that the aircraft had struck the ground in a nose-down attitude with a slight left bank. The distance between the first and second propeller ground impact marks was 72 cm for both the left and right engines, indicating that both engines were operating at the same speed at impact and the aircraft’s groundspeed at impact was approximately 180 kt. The absence of ground marks from the aircraft’s flaps and landing gear further confirmed that both were retracted at impact. Figure 5 Accident site (image courtesy of North Wales Police) Wreckage examination The aircraft wreckage was recovered to the AAIB’s facility at Farnborough for detailed examination. The damage from the post-impact fire had destroyed the upper fuselage structure and much of the cockpit area. Hence most of the wiring and electrical components in the cockpit, including the circuit breaker panel and the pitch trim switch were not available for inspection. Flying controls It was not possible to functionally test the left and right control yoke slide assemblies (Figure 6), which translate pilot pitch demand into elevator control cable motion, due to fire damage. Visual examination however confirmed the presence of all the required yoke slide bearings and the correct connection of the yoke slide assemblies to the elevator control torque tube and elevator cable control sector. The elevator control cables were correctly routed and terminated at the elevator control sector. Examination of the elevator control cables between the control yokes and the elevator pushrod did not reveal any evidence of a pre-impact defect, misrouting or disconnection. It was not possible to determine the pre-impact cable tension of the elevator control cables due to accident damage to the fuselage. The elevator cables were connected to the elevator bellcrank and the bellcrank itself was free to rotate normally. The elevator pushrod was

18 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 intact and attached at both ends, and the pushrod’s rod-ends were correctly installed and structurally intact. Figure 6 PA-31 elevator controls The elevator horn, which connects the pushrod to the elevator torque tube, was found to be fractured on initial examination of the wreckage at the accident site (Figure 7). Figure 7 Fractured elevator horn as found at accident site

19 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Both parts of the elevator horn had partially melted in the post-accident fire. The lower section of the horn was attached to the pushrod’s aft rod-end and the upper section of the horn remained attached to the elevator torque tube. Both parts of the fractured horn were subjected to specialist metallurgical examination. Figure 8 Fractographic assessment of elevator horn fracture surfaces This examination revealed that most of the horn fracture surface exhibited features consistent with localised melting and fire damage (Figure 8). The fracture surface had a rough macro appearance, with the topography following the underlying grain microstructure of the material. No evidence of progressive crack growth, such as fatigue, was observed and no flat areas of fracture surface were evident that would be consistent with this type of crack growth. A small area of non-fire damaged ductile overload, equating to 4% of the fracture surface, was visible at the forward section of the horn indicating that this area had separated after the post-accident fire had been extinguished. This may have occurred during disturbance of the wreckage during fire-fighting operations or due to wind blowing on the elevator after the accident. The left and right elevator halves were correctly bolted to the elevator torque tube. The elevator assembly was free to rotate about its hinge line and had the required range of motion between the up and down control stops. There are six elevator hinges on the PA-31 elevator, three per elevator half; each hinge had the correct hardware installed. Examination of the aircraft’s other flying controls did not reveal any evidence of a pre‑accident defect.

20 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Elevator trim system The elevator trim system cables were identified in the aircraft wreckage and found to be continuous from the elevator trim wheel in the cockpit to the elevator trim tab actuator in the right tailplane (Figure 9). Both adjustment turnbuckles within the elevator trim cable system were correctly assembled and wire-locked. The elevator trim cable was correctly wrapped around the pitch trim servo capstan and idler pulley assembly, and the pitch trim servo was securely attached to the airframe within its mounting bracket. Fire damage prevented any electrical wiring or functional checks of the pitch trim servo. Figure 9 Elevator trim system The elevator trim tab was functionally tested and was free to move between the extreme trailing edge up and down positions. The elevator trim tab position as observed at the accident site was 12.4° trailing edge up, with the elevator held in the neutral position20. The range of elevator trim tab deflection is 16° ±1° trailing edge up (providing nose-down pitch trim), and 29° ±1° trailing edge down (nose-up pitch trim), with the elevator in a neutral position (Figure 10). The elevator trim tab position as observed at the accident site was therefore close to, but not at, the full nose-down trim position. Footnote 20 The elevator trim tab is geared to the elevator such that as the elevator rotates about its hinge line, the elevator trim tab rotates relative to the elevator. This gearing causes the elevator trim tab to also act as an anti-balance tab.

21 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Figure 10 Elevator trim tab position as found at accident site, and range of movement Autopilot Damage sustained in the accident prevented functional testing of the aircraft’s Bendix Altimatic V-1 autopilot system. The autopilot pitch servo was mechanically connected to the elevator bellcrank via a bridle cable assembly that was correctly wrapped and secured around the servo’s capstan pulley. The pitch servo was internally examined using X-ray CT21 imaging, which showed that the solenoid that engages the servo motor driving gear with the capstan pulley was in the de-energised position, with the driving gear disengaged from the capstan pulley. This is the normal configuration for the servo when electrical power is removed from the servo engage solenoid, and allows the servo capstan to rotate freely in response to pilot-commanded movement of the elevator when the autopilot is not engaged. The CT scans did not reveal any pre-accident related mechanical defect within the servo assembly. The servo capstan features a friction plate clutch that allows the pilot to overpower the servo by application of force to the aircraft’s control yoke. The capstan’s internal friction clutch breakout torque level was tested with the assistance of the equipment’s manufacturer. This test revealed that the clutch breakout torque level was 20 in.lbs, compared to the specified limit of 15 in.lbs ±1 in.lb. It is possible that heat damage to the capstan clutch sustained during the post-impact fire may have affected the breakout torque level. However, even if the breakout torque during the accident flight had been 20 in.lbs, this is unlikely to have affected the ability of the pilot to overpower the autopilot pitch servo, if the pitch servo had been engaged. Engines Due to accident damage, neither engine was in a condition to be functionally tested. Visual examination of both engines did not reveal any evidence of a pre-accident defect or mechanical failure that would have prevented normal engine operation. Footnote 21 Computed Tomography is an X-ray scanning technique in which X-ray images are computer-processed to produce individual ‘slice’ images through an object.

22 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Propellers The right propeller had remained attached to the right engine and all three propeller blades were attached to the propeller hub. The left propeller had separated from the left engine during the accident and came to rest in the debris trail on the runway. All three left propeller blades remained attached to the hub. Both propellers exhibited significant blade bending, consistent with rotation under low power at impact. The propellers were disassembled at an overhaul facility to permit internal examination of the blade pitch-change mechanisms. Internal witness marking on both propellers’ pitch‑change pre-load plates indicated that the propeller blade angle22 of both propellers at impact was approximately 19°. The operational range of propeller blade angle varies between 82° in the feathered position through to 13° at the fully fine position. The propeller blade angle at impact was therefore within the operational range, and close to the fully fine position. Other observations The nose baggage compartment door was found within the debris trail with its latch securely fixed in the closed position, indicating that the baggage door was closed at impact. Due to the severity of the post-accident fire and its effect on the aircraft’s flight instruments it was not possible to determine their pre-impact readings or condition. The fire damage also precluded identification of the cockpit-selected positions of the flaps and landing gear controls. PA-31 flight trial Results The AAIB commissioned a flight trial using a representative PA-31, ballasted and fuelled to match as closely as practical the weight and balance of the accident aircraft. Trials were flown to explore its handling characteristics in the event of an elevator control jam. Measurements were made with a simple spring balance for the forces required to overcome autopilot operation or a trim runaway to provide some indicative control force information; it was not the purpose of the flight trial to assess the aircraft against airworthiness requirements. The aircraft was shown to be controllable in all of the speed and configuration combinations used to simulate an elevator control jam. The test pilot reported that a strategy could be devised to manoeuvre the aircraft in pitch using the elevator trim tab. He considered this would be difficult and that it would “take some time to learn and practise this unusual control technique”. He reported that the technique became more difficult with increasing airspeed. In one example, where the aircraft’s landing gear and flap were retracted, the test pilot noted that “aggressive high gain use of the manual trim wheel” was required at 170 KIAS, but not at 130 KIAS. Footnote 22 Propeller blade angles are measured at a station 30 inches from the root of the propeller blade.

23 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 The test aircraft’s autopilot was representative of that fitted to the accident aircraft. It was “very difficult” to override the autopilot and the test pilot considered this might cause a problem if it could not be electrically disconnected following some form of runaway. The simulated trim runaways resulted in high control forces, with the nose-up runaway resulting in such a high two-handed push force that the handling pilot could not maintain level flight without assistance. In the nose-down runaway case, the test pilot found he could control it on his own but considered that it would be very tiring. Reducing power, slowing down or applying flap would all result in an increased nose-down tendency. He considered it possible that this condition would allow a pilot to control the aircraft in a clean23 high‑speed transit for a few minutes, but not have sufficient strength to reduce power and flare the aircraft for landing. Table 2 shows the measured yoke control forces for maintaining level flight at various indicated airspeeds in several configurations with full nose-down trim applied. KIAS Flaps Gear Trim Position Force kgf 190 UP UP Full ND 18 170 UP UP Full ND 16 130 UP UP Full ND 20 125-130 UP DOWN Full ND 20+ 125-130 DOWN DOWN Full ND 20+ Table 2 Yoke control force to maintain level flight with nose-down trim Table 2 shows that control forces increased with reducing airspeed, and also with the deployment of landing gear and flaps. Additional information After the flight trial, the forces required to override the electrical trim actuation using the manual trim wheel were measured on the same aircraft. It took 2.1 kgf to resist the electrical trim, and 2.4 kgf to counter it. Footnote 23 Landing gear and flaps retracted.

24 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Occurrences involving abnormal nose-down trim AAIB report, VP-BJM: Serious Incident at West Sussex, 2005 The AAIB reported on a serious incident involving a Bombardier Challenger 604, VP-BJM, in which a failure of the stabiliser trim system resulted in almost fully nose-down trim24. Control of the aircraft required both pilots to apply prolonged aft pressure on the control column. The commander stated that great physical effort was required to fly the aircraft and commented that any increase in this effort, occasioned for example by the addition of flap, might have rendered control of the aircraft beyond the combined capability of the crew. Therefore, the commander elected to land with flap retracted, despite the aircraft’s QRH specifying the use of 20° flap in such a condition. The destination runway at Farnborough was not long enough for this so the commander declared a PAN and requested a diversion to Stansted. However, around 6 min later, concerned about the physical effort required to fly the aircraft manually, the commander decided to divert to Heathrow, which was closer, and declared a MAYDAY. The crew attempted to fly a stabilised flapless approach at a target airspeed of approximately 160 KIAS, considerably faster than required for a normal approach with flap. A successful landing was achieved by the coordinated efforts of the commander and co-pilot operating the primary flight controls, and a third off-duty employee closing the thrust levers on touch down. There were no injuries sustained during the event. NTSB report, N996JR: Accident at Penn Cove, Washington, 2003 A single-pilot operated Cessna Citation 525, N996JR25, experienced a loss of elevator trim control that resulted in an uncommanded nose-down pitch attitude. Although the pilot and a passenger seated in the co-pilot’s seat both applied maximum back pressure on the control column, the attitude increased beyond 10° nose-down, the airspeed approached 263 KIAS, and the rate of descent reached approximately 2,000 fpm. The pilot stated that he could not safely remove either hand from the control column for more than several seconds at a time. He determined that he could not safely land the aircraft on a runway, so elected to land on the nearby water of Penn Cove, using landing flap, and with landing gear retracted. There were no fatalities. This NTSB investigation concluded that it was likely that the force limits which had been defined in FAR 23.143 at the time of the accident were exceeded during the occurrence. The subject aircraft type had no clear indications or warning for an electric elevator trim runaway (such as an aural or visual trim-in-motion warning), the accident pilot had only indirect indications26 to assist in identifying the condition. These indications were insufficient to allow timely recognition of the problem. The report stated: Footnote 24 AAIB Aircraft Accident report 1/2008 https://assets.publishing.service.gov.uk/ media/5422f7b240f0b613460006eb/VP-BJM_2-2008.pdf (accessed on 18 September 2018). 25 NTSB Safety Recommendation A-07-52 through 54 https://www.ntsb.gov/safety/safety-recs/recletters/ A07_52_54.pdf (accessed 9 October 2018) 26 For example, tactile indications of increasing pitch control force, and the continuous nose-down motion of the trim wheel or the elevator trim position indicator.

25 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 ‘Because the airplane is certified for single-pilot operation, it is critical to alert a pilot to a trim runaway condition before the associated control forces exceed what a single pilot can manage.’ In this event, the only way the accident pilot could have arrested the pitch trim runaway would have been to pull the pitch trim circuit breaker – which was one of an array of identically sized, shaped and coloured circuit breakers. The report stated: ‘…given the pilot’s report of the control forces involved, it is unlikely that he would have been able to quickly locate and pull the appropriate circuit breaker while maintaining control of the airplane. In addition, during airplane simulator trials, Cessna’s test pilot, flying as a single pilot, was unable to counteract the control forces from similar elevator trim runaway conditions while attempting to pull the pitch trim circuit breaker. [A footnote to the previous sentence states: When a second pilot assisted with backpressure on the control column, the test pilot was able to locate and pull the pitch trim circuit breaker.] A pilot’s rapid identification and disabling of the pitch trim circuit breaker is essential to effectively respond to the rapid increase and excessive magnitude of control forces during an elevator trim runaway in a Cessna Citation 525.’ Research The FAA performed studies of general aviation pilot responses to a number of autopilot malfunctions27 in a fixed-base simulator configured as a Piper Malibu, with a Bendix/King KFC-150 autopilot. In considering factors which might lead to an autopilot-related accident, the paper stated: ‘The tempering factors, one would expect, would be that a prudent pilot generally would learn everything possible about the airplane to be flown, particularly if it were owned or regularly flown by the pilot… This is often not the case, however… …In the case of general aviation, it is likely that many pilots will not have experienced autopilot failures prior to their first need to respond to one as pilot in command.’ The paper cited two accidents where the elevator trim was found in the full nose-down position. In one of those, it was determined that 45 lb (20.4 kg) force would have been required to maintain level flight. Footnote 27 http://www.dtic.mil/dtic/tr/fulltext/u2/a340243.pdf (accessed 9 Oct 2018).

26 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 When describing the design of the studies, the author(s) stated: ‘It was recognised that the most hazardous malfunction, in terms of its ability to place the aircraft in a configuration from which it might be difficult to recover, was the runaway pitch-trim-down failure…’ The study showed that in the case of nose-down pitch trim runaway, the average time for initial action was 12.2 seconds, and the average lag thereafter to pulling the pitch trim circuit breaker was 36.4 seconds (and ranged from 3.6 to 160.0 seconds). Therefore, the average time to recognise and correct the malfunction was 48.6 seconds. Thirteen of the twenty four participants encountered ‘flight-terminating circumstances’28. In the ‘Post-test Questionnaire/Interview’ section, the paper stated: ‘When asked to report on the difficulty or ease of diagnosing and recovering from autopilot failures experienced during their experimental session, our subjects unanimously agreed that runaway pitch trim was the most difficult from which to recover.’ Analysis Introduction The pilot reported “we are having some pitch control problems eh with the elevator” and “i am going to divert to caernarfon”. Evidently, he was having a problem controlling the aircraft in pitch. No further information was received by air traffic control about the symptoms of the problem or his attempts to diagnose it. This could indicate that he was having to prioritise dealing with a possible malfunction, rather than communicating the nature of it. He had already flown over much of the mountainous terrain on his intended route, and Runway 25 at Caernarfon was almost directly ahead. Given that he was familiar with the aerodrome, it may have seemed an attractive option for a diversion. Estimates using radar and CCTV information suggests that the aircraft’s airspeed had increased from around 165 KIAS when the pitch control problem was reported to around 190 KIAS when the aircraft struck the ground. It is possible that a technical condition was necessitating a high airspeed. The radar data indicates that, after reporting pitch control problems to London Information, the pilot turned the aircraft directly towards Runway 25 at Caernarfon and flew there without delay. The airport was closed. The aircraft’s airspeed was about 95 kt above the normal approach speed, and considerably above the limiting speed for landing gear and flaps, both of which remained retracted. This indicates either that the pilot did not intend to land or that he was having difficulty controlling the aircraft. Footnote 28 The simulator was frozen when high descent rates persisted within 100 ft of the ground or overspeed conditions were attained.

27 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 The extensive fire damage to the wreckage and the limited recorded information made it difficult to determine the cause of this accident with a high level of confidence. The elevator trim tab was found close to, but not at, the full nose-down trim position. This is not a normal position for an approach and landing, and it would have caused the pilot considerable difficulty in controlling the aircraft due to the large control forces. The nose‑down forces would have tended to increase as the aircraft slowed down, and with the application of flaps and landing gear. Eyewitness accounts were consistent with the aircraft approaching the runway at high speed, and making a high-pitched noise, as though the propellers were operating at a high rpm as the aircraft passed them. Whilst they also described the aircraft as being lower than usual, the recorded data showed that the average descent profile was significantly steeper than would normally be expected. The impact damage to the propeller blades indicated that at the point the aircraft struck the runway it had some, but not full, power applied. This could indicate that the pilot reduced power prior to landing. Engineering A detailed examination of the aircraft’s elevator controls did not identify any technical problem that could have accounted for a loss of elevator control during the accident flight. The fracture damage observed on the broken elevator horn was most probably sustained when the aircraft initially struck the runway as, had the horn fractured during flight, the small area of unburned ductile overload would not have sufficient strength alone to remain intact during the accident sequence. The autopilot pitch servo was recovered from the wreckage. The clutch functioned when tested, and the breakout torque was sufficiently low that it would not have impeded the pilot overcoming the autopilot pitch servo in the event that the pilot was not able to disconnect the autopilot. It was concluded that the autopilot pitch servo was not a factor in this accident. The elevator trim tab was found close to, but not at, the full nose-down trim position. Impact and fire damage prevented any electrical and functional checks on the aircraft’s pitch trim system and therefore it was not possible to identify a cause for a possible pitch trim runaway. No other defects were noted with the aircraft’s flying controls, engines or propellers, and both engines were running at the same speed and producing power when the accident occurred. The flaps and landing gear were both in their retracted positions. Due to the severity of the post-accident fire, it was not possible to determine whether either had been selected DOWN by the pilot and they had not responded, or whether the retracted positions were those intended by the pilot in response to the pitch control problems he reported.

28 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Control jam discussion It was not possible to exclude the possibility of a control jam, the evidence for which could have been lost during the impact sequence or post-accident fire. If an elevator control jam was to occur whilst flying approximately level, it would not initially alter the attitude and behaviour of the aircraft to a significant extent. Furthermore, flight trials showed that in the event of a jam that did not change29 the test aircraft was controllable. The test pilot described the strategy for manoeuvring the aircraft in pitch as being difficult and unusual, and requiring time to learn and practice. There was no evidence of the accident pilot taking time to do that and, since that technique was shown to be more difficult at higher airspeeds, it would not have prevented him from slowing the aircraft down. Therefore, in the event of an elevator control jam that did not change, and considering that the aircraft should have been controllable, then there was no obvious reason for the pilot not to slow the aircraft down, and to divert with such urgency. It was therefore concluded that an elevator control jam was unlikely. Autopilot override The force required to override an autopilot once a large out-of-trim condition in pitch has developed was measured during the flight trial. The test pilot reported that he had found it very difficult to override the autopilot and considered that this might cause a problem if it could not be electrically disconnected following some form of runaway. Anecdotal information suggested that the pilot was likely to have flown the aircraft manually. Therefore, a problem with overriding or disengaging the autopilot did not appear to account for the flight profile of the accident aircraft. Trim runaway The elevator trim tab was found in an almost fully nose-down trim position. The flight path of the aircraft was consistent with an aircraft experiencing a significant nose-down trim. In the flight trial, 16 to 20+ kgf was required to fly the aircraft straight and level with full nose‑down trim, which is a significant control force to apply for a period of around five minutes. The test pilot during the flight trial reported that at high speed and with landing gear and flap retracted he found it possible, though tiring, to control the aircraft with the elevator trim tab in the full nose-down position. He reported that reducing power, slowing down or applying flap would all have increased the nose-down tendency, and a pilot might not have sufficient strength to reduce power and flare the aircraft for landing. Moreover, the forces required to flare the aircraft from such an unstable approach would most likely have exceeded those measured in the flight trial for straight and level flight. If the pilot had used one hand to reduce power, then controlling the aircraft, particularly during the flare, would have been more difficult. Additionally, judging the height at which to flare, and the strength required to do so, would most likely have been outside the pilot’s training and experience. Footnote 29 The flight test aircraft was tested with a jam in a fixed position, and not a jam that became progressively more nose down.

29 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 The flight trial demonstrated that it was possible to override the electric trim actuation using the manual trim wheel. The almost fully nose-down position of the trim tab could suggest that the pilot had been doing this prior to the landing manoeuvre. If he had removed his hand from the manual trim wheel in order to reduce power and flare the aircraft for landing, an electric trim runaway condition would have driven the trim back towards the nose-down position. Trim runaway safety discussion It was not possible to determine the reason for the nose-down position of the elevator trim tab. However, the final flight path of N250AC was consistent with other occurrences in which a malfunction resulted in significant nose-down trim, and with the findings of the flight trial. Overview The FAA research paper indicated that general aviation pilots are often not fully aware of the systems onboard the aircraft they fly, and that they may not experience autopilot failures prior to their first need to respond to one as pilot in command. The FAA studies, previous events and the findings from this investigation have shown that, due to possible high control forces, trim runaway can be a difficult condition from which to recover. Prompt recognition and response The FAA study showed that, in a simulator, it took pilots 48.6 seconds to recover from the trim runaway nose-down case. The flight trial and the serious incident involving VP-BJM indicated that the longer time spent in this failure condition, the more tiring it becomes for the crew. Therefore, prompt and effective recognition and response during a trim runaway is likely to reduce the potential handling difficulties. N250AC was fitted with a trim warning light to assist with recognition of a runaway pitch trim. However, this was located on the lower half of the instrument panel and was probably not tested regularly as part of the pre-flight procedures. There was no accompanying aural alert and, in the event of a trim runaway, other indications would have been indirect. In that case, it is possible that the condition could take time to diagnose. Similar to that described in the N996JR accident report, the procedure for responding to a malfunction of the electric trim system was to pull the electric trim circuit breaker. In N250AC this was located in the lower portion of the circuit breaker panel, which was beside the pilot’s left knee. Fire damage to the panel meant that it could not be determined whether any circuit breakers had been opened. The flight trial and other previous events have indicated that the forces associated with a trim runaway can be such that a single-pilot, in particular, could have difficulty flying the aircraft whilst attempting to locate and pull a circuit breaker. The flight trial indicated that electric trim operation could be overridden by use of the manual trim control wheel on the PA-31.

30 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Pre-flight procedures The pre-flight procedures for the autopilot and trim systems were contained in a supplement within N250AC’s Flight Manual, and these were not referenced in the ‘normal operating procedure’ pre-flight checklists. Anecdotal evidence indicated that the pre-flight procedures for those systems had not been carried out regularly on N250AC. Pilot knowledge and awareness of trim runaway – safety message The FAA research, other previous events, and findings from this investigation, indicate that a pilot’s familiarity with the autopilot and trim system could reduce the time to recognise and effectively respond to a potentially hazardous trim runaway condition. This could include, for each aircraft type to be flown: ● ● System knowledge of the electric trim and autopilot, and the associated normal and abnormal operating procedures ● ● Carrying out the relevant pre-flight checklists for the autopilot and trim systems – being aware that they may be separate to the main pre-flight procedures ● ● Awareness of the indications of a trim runaway – remembering that the indications may not be ‘direct’ ● ● Appreciation of the significance of the control forces which may be required to control the aircraft in the event of a trim runaway, particularly for a single pilot ● ● Awareness of the corrective actions for a trim runaway – for example, how to locate and open the appropriate circuit breaker, and other possible ways to override or disable the system. Conclusion After reporting pitch control problems, N250AC made a direct diversion with a significantly unstable approach, in a clean configuration, to Runway 25 at Caernarfon Airport. The elevator trim was found in a nose-down position and, whilst the reason for this could not be determined, it is likely that it caused the pilot considerable difficulty in controlling the aircraft. The aircraft struck Runway 25 at Caernarfon Airport, with landing gear and flaps retracted, at high speed, and with no noticeable flare manoeuvre. The extensive fire damage to the wreckage and the limited recorded information made it difficult to determine the cause of this accident with a high level of confidence. It is possible there was a nose-down trim runaway that the pilot was unable to stop.

31 © Crown copyright 2019 All times are UTC AAIB Bulletin: 3/2019 N250AC EW/C2017/09/02 Safety actions As a result of this investigation the EASA have undertaken action to promote awareness of trim runaways as part of its General Aviation safety promotion plan. It also intends to include trim runaway as part of a wider technical safety project, studying various technical failure scenarios. Also, as a result of this investigation the CAA plans to produce a coordinated package of educational information on trim runaway, including a video, Clued Up article and online information which will be targeted at GA pilots. Both authorities have indicated that they intend to work together on the subject for a coordinated approach and to ensure a broad reach.

FD06678 ｜ 2019_英国_aaib-investigation-to-quik-gt450-g-tpwl__Quik_GT450_G-TPWL_07-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

67 © Crown copyright 2019 All times are UTC AAIB Bulletin: 7/2019 G-TPWL EW/G2019/05/06 ACCIDENT Aircraft Type and Registration: Quik GT450, G-TPWL No & Type of Engines: 1 Rotax 912-UL piston engine Year of Manufacture: 2006 (Serial no: 8187) Date & Time (UTC): 12 May 2019 at 1340 hrs Location: Ashcroft Airfield, Cheshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Damage to wing, trike nose pod, nosewheel and propeller blades Commander’s Licence: National Private Pilot’s Licence Commander’s Age: 61 years Commander’s Flying Experience: 171 hours (of which 171 were on type)

Last 90 days - 5 hours

Last 28 days - 3 hours Information Source: Aircraft Accident Report Form submitted by the pilot The pilot was returning to land following a local flight, during which he reported there had been occasional “short bursts of wind” from the west that had resulted in a “bumpy flight”. Joining the airfield overhead, the pilot initially observed that the windsock near the centre of the airfield indicated a light wind from the north to north-west, and the windsock in the north-west corner indicated a light wind from the west. A few minutes later the pilot noted that smoke from a fire a few miles away indicated a light wind from the north and that both windsocks now indicated nil wind. The pilot decided to land on Runway 31 and reported that the approach was normal, but shortly after moving the throttle lever to idle and at a height of about 10 to 15 ft above the runway a “burst of wind” caused the left wing to lift and the aircraft veered to the right. The pilot levelled the wing but the aircraft was now parallel to the runway and it touched down heavily into long grass. After a short landing roll the nose tipped forward before the aircraft rolled onto its right side. The pilot was unhurt and vacated the aircraft unaided.

68 © Crown copyright 2019 All times are UTC AAIB Bulletin: 7/2019 G-TPWL EW/G2019/05/06 Figure 1 G-TPWL after the accident

FD06679 ｜ 2019_英国_aaib-investigation-to-reims-cessna-f152-g-olee__Reims_Cessna_F152_G-OLEE_04-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

56 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 G-OLEE EW/G2019/01/09 ACCIDENT Aircraft Type and Registration: Reims Cessna F152, G-OLEE No & Type of Engines: 1 Lycoming O-235-L2C piston engine Year of Manufacture: 1980 (Serial no: 1797) Date & Time (UTC): 22 January 2019 at 1129 hrs Location: Fairoaks Airport, Surrey Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 (Minor) Passengers - N/A Nature of Damage: Tailfin, rudder, engine, propeller, nose landing gear, and right wingtip damaged Commander’s Licence: Private Pilot’s Licence Commander’s Age: 63 years Commander’s Flying Experience: 136 hours (of which 118 were on type)

Last 90 days - 3 hours

Last 28 days - 1 hour Information Source: Aircraft Accident Report Form submitted by the pilot and subseqeunt enquiries Synopsis The aircraft bounced twice on landing and deviated to the left side of the runway, becoming inverted when the nosewheel entered soft ground. History of the flight The pilot had hired the aircraft with the intention of conducting circuit practice at Fairoaks Airport. He reported that the weather was CAVOK and the wind was calm. Following the first circuit, the pilot flew an approach to Runway 24 intending to carry out a touch‑and‑go. After the landing flare, he stated that the main wheels touched down as normal, but the aircraft bounced and briefly became airborne again. A second, more severe bounce followed, during which he reported that the aircraft was lifted by a gust of wind, causing it to come down on the left side of the runway. The aircraft landed heavily on its nose gear, causing it to partially collapse. It then slid towards the runway edge and became inverted when the nosewheel entered soft ground at the side of the runway (Figures 1 and 2). The pilot sustained only minor injuries and exited the aircraft with the assistance of the airport fire and rescue service.

57 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 G-OLEE EW/G2019/01/09 Figure 1 Witness marks on the runway from G-OLEE’s nose gear Figure 2 G-OLEE after coming to rest

58 © Crown copyright 2019 All times are UTC AAIB Bulletin: 4/2019 G-OLEE EW/G2019/01/09 Discussion Witnesses in the airport tower reported that no attempt to initiate a go-around was observed after either bounce. The pilot considered that he could have selected full throttle for a go‑around but he was unsure how effective this action would have been, as the airspeed had reduced substantially during the second bounce.

FD06680 ｜ 2019_英国_aaib-investigation-to-spitfire-mk-26b-g-clhj__Spitfire_Mk_26B_G-CLHJ_07-24.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 Accident

Aircraft Type and Registration: Spitfire Mk 26B, G-CLHJ No & Type of Engines: 1 Isuzu V6 Piston Engine Year of Manufacture: 2019 (Serial no: LAA 324-15249) Date & Time (UTC): 22 August 2023 at 1403 hrs Location: Near Enstone, Oxfordshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 (Fatal) Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 68 years Commander’s Flying Experience: 1,164 hours (of which 26 were on type)

Last 90 days - 18 hours

Last 28 days - 8 hours Information Source: AAIB Field Investigation Synopsis During a test flight towards obtaining a Permit to Fly, control of the aircraft was lost. The flight was testing the effects of leading edge stall strips as part of the Light Aircraft Association (LAA) approved test programme. The pilot was fatally injured when the aircraft struck the ground. The aircraft was found to have been built with a misaligned fin and rudder. This misalignment made a wing drop at the stall more likely, but it did not prevent or restrict the ability of the pilot to recover from the stall nor any subsequent spin or spiral dive that might develop. Although the pilot’s medical history indicated the possibility of an incapacitation this could not be confirmed or dismissed by the pathologist. The possibility of a control restriction preventing recovery could also not be excluded due to the extensive fire damage to the aircraft. The LAA took action to alert owners regarding the possibility of a fin and rudder misalignment by issuing a Mandatory Technical Directive1 (MTD) applicable to all Spitfire Mk 26 and Mk 26B aircraft. History of the flight The pilot was conducting the 20th test flight on the aircraft as part of the process for obtaining a Permit to Fly. All the test flying was being conducted at Enstone Airfield where the Footnote 1 https://mar2013.lightaircraftassociation.co.uk/engineering/TADs/324/MTD_01-2024_issue_1.pdf [accessed March 2024].

2 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 aircraft had been built and where it was based. The aim of the flight was to assess the stall characteristics after the repositioning of stall strips on the inner leading edges of both wings. The pilot completed his usual pre-flight preparation and started the engine at 1344 hrs. At 1350 hrs the pilot began to taxi towards Runway 26 and took off at 1356 hrs. Witnesses reported the aircraft turning right into the circuit whilst continuing to climb to what they estimated to be between 3,000 to 4,000 ft aal. After a few minutes the aircraft was to the south of the airfield and although some distance away, the witnesses could see the aircraft undergoing what appeared to be a series of stall manoeuvres during which the right wing was seen to drop followed by recovery to straight and level flight. After the third manoeuvre the right wing dropped and the aircraft entered a clockwise spin or rotation. The aircraft struck the ground in an open field near the village of Enstone in Oxfordshire. The aircraft was severely damaged in the impact and caught fire. The pilot was fatally injured. Accident site The aircraft came to rest in a field approximately 100 m from a road opposite houses. The initial impact point was directly below 11kV power lines that crossed the field in a north/ south direction; there was no evidence the aircraft touched any of the power lines during the accident (Figure 1). The ground marks showed the right wingtip hit the ground first with significant force. The impact mark and trail of debris suggested the aircraft was travelling in a westerly direction. Three propeller blades and a substantial part of the spinner were found together a short distance from the first impact point. Gouging and disruption to the soil from there on showed the aircraft to have carried on forwards until the left radiator fairing on the underside of the left wing ploughed into the soil causing the aircraft to rotate to the left before coming to a stop. The aircraft remained upright throughout the accident sequence. A fire, centred on the cockpit area, caused extensive damage to the centre of the aircraft. Figure 1 Accident sight overview

3 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 Recorded information Sources of information The aircraft was fitted with a Pilot Aware® system2 and an engine control unit. Any recordings that may have been stored on these items, or any personal devices, were lost in the post- accident fire. The aircraft was fitted with a transponder but there was no secondary radar detection of the aircraft. There was also no track recorded by the ground network associated with the electronic conspicuity device. The flight was detected and recorded by NATS primary radar. This provided the approximate flight path over ground when the aircraft was high enough to be in view of the radar installations but does not provide altitude information (Figure 2). CCTV cameras installed at the airfield recorded the taxi and part of the takeoff of the aircraft. Part of the takeoff was also recorded from the ground on a personal electronic device. The takeoff appeared normal to those who were familiar with the aircraft. Figure 2 Approximate flight path Footnote 2 Pilot Aware® is a commercially available self-contained interoperable conspicuity and warning device fitted to aircraft to enhance airspace safety. It has the capability to receive Mod-S, Mode-C and ADS-B and can up and downlink relevant data to and from ground stations.

4 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 CCTV Analysis A south facing airfield CCTV camera recorded the last part of the final descent from approximately 2 km away. It did not show the aircraft at the entry to the descent which witnesses reported as being between 3,000 to 4,000 ft. Figure 3 shows a compounded image of the aircraft every 0.2 seconds extracted from a version of the recording that has been corrected for lens distortion and perspective. The aircraft size in the image is small compared to the image pixel size; however, rotation during the descent is still visible. The CCTV captured the descent which was generally from west to east ending with a flight path with an increasing component to the west. Combining the CCTV with the location of the accident site itself and the approximate ground track provided by the primary radar recording enabled calculation of the aircraft altitude profile. The derived data is shown in Figure 3. The errors associated with the calculations are shown as error bars. These are larger at high altitude due to distance uncertainty, but the resultant descent rate data is less sensitive to these errors. Figure 3 Compound undistorted CCTV image and analysis of the final descent

5 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 The aircraft was not visible in the CCTV recording when it was in front of a relatively bright area of the sky during the initial part of the captured portion of the descent. However, the available data points indicate that the flight path appears relatively consistent for approximately the first five seconds of the captured part of the descent. The shape of the descent during the final three seconds indicates a reduced descent rate. The final second of the captured descent indicated an increasingly westerly component to the direction of travel. The aircraft was not in view of the camera for approximately the last 100 ft of the descent. Aircraft description The Spitfire Mk 26B3 is a kit-built scale replica based on the original Spitfire. The aircraft is supplied as a kit from a US based manufacturer. The aircraft structure is assembled by riveting aluminium alloy skins onto pre-formed frames, ribs and longerons. The wing form and empennage, other than overall dimensions, mirror the original Spitfire types. The completed aircraft is shown at Figure 4. Figure 4 G-CLHJ undergoing engine runs (used with permission) The flying control system on G-CLHJ was mechanical, using push-pull rods, bell cranks and levers to move the aileron, flap and elevator control surfaces. A trim tab was fitted to the right elevator which is set via a lever and Bowden cable mechanism. The rudder control system consisted of multistrand steel cables running from the rudder along the left and right side of the fuselage to the rudder pedals in the cockpit. A second cable was connected from the rudder pedals through pulleys on the left and right side of the footwell to form a continuous loop of cable to synchronise the rudder pedals (Figure 5). These pulleys were mounted on a steel pulley mounting plate which had holes drilled along its length to engage Footnote 3 The manufacturer introduced a series of scale replica Spitfires identified by their Mark (Mk). The Mk 25 was a 75% scale single seat aircraft. The Mk 26 was a 80% scale replica twin seat and the Mk 26B was a 90% scale replica twin seat. The MK 26 and 26B fuselage dimensions differ from the Mk 25 but retain the 75% scale wing form.

6 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 on a pin, pivot and locking pin assembly to allow the rudder pedal position to be adjusted. Simple guide pins were located beside the outer edge of each pulley to prevent the cable derailing in use. Figure 5 Rudder pedal and cable assembly (schematic) This aircraft was powered by an Isuzu V64 fuel injected, normally aspirated, piston engine driving a three blade variable pitch propeller. The engine was water cooled with a radiator mounted under each wing. An oil cooler was positioned within a scoop on the lower engine cowl. The aircraft was originally fitted with an electric tab stall warning system on the left wing. This had been removed and the system disabled because it had been incorrectly positioned on the wing leading edge and therefore at the time of the accident flight the aircraft did not have a functioning artificial stall warning system. The cockpit was fitted with modern analogue primary and secondary instruments. In addition, there were several avionic devices which included a digital LCD engine and electrical power monitoring display, and digital radio and transponder. Footnote 4 Other engine variants and types can be fitted to the Spitfire Mk 25, Mk 26 and Mk 26B depending on the customer’s choice.

7 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 Aircraft history Construction of the aircraft by a small team began in 2013. G-CLHJ was constructed under the LAA regulations. The build had been finished in 2019 but the project was delayed by the Covid19 pandemic. After the satisfactory completion of the necessary LAA airworthiness inspections, the aircraft was given a Certificate of Clearance5. This allowed it to be flown by a test pilot nominated by the owners, who was accepted by LAA as being suitably competent and experienced to do so, on a flight test programme to enable the issue of a Permit to Fly. Flight test programme During the flight test programme several issues had been encountered which required rectifications, modifications and adjustments. Following each flight the test pilot produced a comprehensive report with clear recommendations and solutions for each issue as they arose. Rectification work and adjustment were comprehensively recorded on sequential work cards which included the signatures of the individuals carrying out the work. From the second test flight, the pilot reported a marked tendency for the aircraft to roll to the right, to the extent that the aircraft could not be flown hands-off and required a constant left aileron input. To correct this roll, the team made several incremental adjustments to the aileron and flap control rods. These adjustments gradually improved the handling of the aircraft although they were not sufficient to fully resolve the issue. The decision was made to fit a narrow expanded foam wedge on the underside trailing edge of the left aileron. After the 13th test flight, the pilot reported that the tendency to roll to the right had been resolved to his satisfaction. He carried out clean stall tests and found the aircraft tended to rapidly drop its right wing, and he recommended that stall strips should be fitted. The purpose of the strips are twofold; they provide a means of warning to the pilot by increasing buffet as the wing approaches the stall and by fitting them to the inboard leading edge they can promote the wing root to stall first, reducing the risk of the outboard wing stalling first which can cause a wing drop leading to a spin or spiral dive. For kit-built aircraft the positioning and final fitment of stall strips may form part of flight testing before the approval of a Permit to Fly. The stall strips consisted of short lengths of angled aluminium alloy fitted to the wing leading edge. During the test flights, the strips were held in place by duct tape, which allowed them to be easily moved following each flight. The team examined the position of the stall strips fitted to the other Spitfire Mk 26B at Enstone and initially attached the strips on G-CLHJ in the same position. Footnote 5 Certificates of Clearance are issued by LAA in accordance with BCAR Section A8-9 following inspection and evaluation of an aircraft, to authorise it to be flown under test conditions in preparation for the issue of a Permit to Fly. They are valid for three months at a time and a record is kept of the progress, test results and adjustments.

8 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 Although the next few flights were planned to explore the stall characteristics of the aircraft with the strips fitted, the aircraft experienced a number of engine coolant issues which resulted in an engine-off emergency landing back at the airfield on the 15th flight. The engine faults were caused by a warped cylinder head. It was nearly four months before flying resumed with the 16th flight to check the engine operation was normal. The aircraft was flown on its 17th flight on 25 May 2023 and the pilot again reported a right wing drop in the stall at around 45 kt to 50 kt. Two more flights were carried out on 7 July 2023 and the pilot reported that the aircraft stall characteristics were not so good with the aircraft dropping its right wing with gear and flaps down at 50 kt to 55 kt. The pilot recommended moving both stall strips a few millimetres lower. The stall strip positions were datum marked with a permanent marker pen in line with the top of the aluminium angle and were moved downwards. The aircraft was being flown on its 20th flight on 22 August 2023, and whilst conducting further stall testing departed from controlled flight. Aircraft examination An initial examination of the aircraft was carried out at the accident site with further, more detailed, examinations carried out at the AAIB. General examination An intense fire had taken hold in the cockpit and nose section of the aircraft rendering the majority of light alloy, plastic and composite parts unrecognisable. The main spar on the left side had bent rearwards by 30° and the outer section of the wing had twisted upside down and was only attached by a flying control rod. The right wingtip was severely distorted, and the majority of its attachment rivets were missing. Compression damage and buckling was present over the entire surface of the right wing. The outer sections of both wings, rear fuselage and empennage had not been damaged by fire but had sustained impact damage during the accident. Flying control continuity checks were carried out. Despite the disruption, continuity could be demonstrated in all axes with the damage to various components within the systems directly attributable to the impact sequence and fire. The flaps were fully up, and the landing gear was fully retracted within the left and right wings. Stall strips The stall strip fitted to the leading edge of the right wing was still in place (Figure 6) although there was distortion on its surrounding structure. The stall strip that had been fitted to the left wing was found lying beneath the wing at the accident site. The leading edge section to which it had been attached was melted and burnt through and there was no duct tape present. Therefore, the left wing stall strip position on the wing could not be accurately determined. Both stall strips were 24.5 cm in length.

9 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 Figure 6 Stall strip fitted to the right wing leading edge Pictures taken of the aircraft when the stall strips were initially fitted were compared to the current location of the remaining stall strip. Despite the damage to the wing around the stall strip, reference points were established between the before and after pictures which showed that the stall strip had been moved down a few millimetres as requested by the pilot. Left aileron wedge Remains of the duct tape attached to the left aileron trailing edge were present with signs of heat degradation of the tape surface. The foam wedge piece or remains of any material identified as such were not found. (Figure 7) Figure 7 Remains of duct tape on the lower surface of the left aileron Fin and rudder A visual examination of the fin and tailplane found the leading edge of the fin appeared to have a significant misalignment to the left. Precision measurements along with laser alignment checks found the fin and rudder were misaligned 4.4° to the left of the aircraft

10 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 centre line (Figure 8). Removal of the left and right fin root fairings confirmed this and revealed the position of the fin relative to the centre line of its support frame. The left and right tailplane inboard rib measurements show the base of the fin, where it attaches to the fuselage, was misaligned 5 mm to the left of the centre line. Detailed examination of the structure around this area and the fin root fairings found no evidence that the misalignment was because of the impact sequence. Fuselage centreline Fin and rudder centreline Figure 8 Fin and rudder misalignment from above with the rudder horn aligned with the fin leading edge

11 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 Controls The rudder pedals and adjustment components within the cockpit were partially destroyed in the fire. The steel rudder cables and turnbuckles were generally intact and there was continuity between the ends of each cable. By manually operating the ends of the cables, it was possible to establish that the rudder had a full range of movement and operated in the correct sense. There have been occurrences on the aircraft type of the rudder cable loop derailing from the pulleys if both rudder pedals are pushed hard at the same time. This can lead to restricted movement. The rudder cable and pulley system were disassembled and examined. Although the pulleys were destroyed in the fire, close examination of the pulley mounting plates and the cables found no evidence of chafing, rubbing, or jamming. Other examples of the aircraft type were examined and the possibility of a loose item affecting the rudder controls, was considered. Although there is clear space above and around the front of the rudder pedals, the design of the cockpit would make it difficult for a loose object to migrate to this area. The rudder pedal side mechanisms are close to the fuselage inner skin and it is possible that a foreign object could lodge between them. Due to the damage to the aircraft, the possibility that the rudder controls had been jammed by a foreign object could not be excluded. Construction of the aircraft While the aircraft is supplied as ready-to-assemble with parts supplied pre-shaped and pilot drilled, during the construction many of the structural parts required significant rework and alteration. In some cases, this was due to permitted tolerances, and in others, it may have been due to fabrication errors. There is the possibility that as multiple parts are assembled, where these problems exist, a significant non-conformity may go unnoticed. The problems encountered in this aircraft were not dissimilar to those experienced by other builders of this kit. The team took numerous pictures during construction and held regular meetings to discuss and address the problems. The construction team were aware that there was a slight misalignment in the fin and rudder which was only noticeable when attention was drawn to it. However, the frame and tailplane attachment features presented no difficulties during assembly and fitted together neatly. As the fin assembly was an integral part of the assembly it was assumed that the misalignment was a correct feature of the aircraft. The team inferred that the misalignment was a deliberate feature to offset the propwash yaw effect, but the design of the kit already featured offset engine mounts to deal with this.

12 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 The LAA is responsible for inspection and approval of this aircraft type.. An LAA examination of the aircraft after the accident lead to the consideration of additional potential difficulties in constructing the Spitfire Mk 26 series aircraft. With several ongoing projects in the UK, the LAA took action by issuing an MTD: The LAA issued Mandatory Technical Directive MTD-01-2024 on 13 February 2024 applicable to all Spitfire Mk 26 and Mk26b aircraft. The MTD required geometry and symmetry checks to be carried out to ensure correct alignment of fin assembly and rigging of rudder with comprehensive illustrated instructions how to achieve the checks. Weight and balance The aircraft was within both the maximum takeoff weight and the centre of gravity envelope for the flight. For each test flight the weight and balance of the aircraft was the same as previous flights to allow for consistent handling. Final manoeuvre Witnesses described the aircraft as entering a ‘spin’ or ‘rotating’ to the right from the third stall. When an aircraft stalls asymmetrically one wing will drop before the other. The dropping wing has an increasing angle of attack and drag. This increase in angle of attack and drag increases any yaw creating a rotation which can continue into a fully developed spin. In a spin an aircraft is rotating about a helical axis and is rolling, pitching and yawing with a very low and stable speed and a high rate of descent. The pitch of the nose will depend on the aircraft characteristics. To recover from the spin the pilot should close the throttle, apply full opposite rudder to the direction of rotation whilst centralising the ailerons and unstalling the wings by progressively pushing forward on the stick until the rotation stops. The aircraft can then be recovered from the resulting dive. It is also possible that when a wing drops in a stall, it may then become unstalled and the aircraft may enter a spiral dive. In this condition the aircraft speed will increase rapidly, the rotation will tend to be slower than in a spin but the rate of descent can be very high. In a spiral dive all the controls are effective although they may be heavy due to the high speed of the aircraft. To recover from a spiral dive the pilot must roll the wings level using co-ordinated ailerons and rudder before recovering from the dive. Aircraft performance The LAA stated in their Type Acceptance Data Sheet6 for the Spitfire Mk 26 that: ‘The first two UK–built examples exhibited a significant wing drop at the stall and no pre-stall warning as first built. Both the wing drop and the lack of stall Footnote 6 https://www.lightaircraftassociation.co.uk/infolibrary/24a9b2c1-92b4-4b77-ab9d-31c646d8ba91 [accessed October 2023]

13 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 warning were corrected on G-CCZP by fitting wing leading edge stall strips. Variation between wing leading edge profiles on individual aircraft is likely to cause differences in stall characteristics between individual aircraft’. The LAA did not approve the aircraft for aerobatics or spinning (Spitfire Mk 26 or 26B) and as such there was no requirement to test the spinning characteristics of the aircraft type. The Spitfire Mk 26B was only approved for a single pilot due to pitch instability with a rearwards centre of gravity. All of the Supermarine replica spitfires are kit built and can therefore be significantly different in their performance and flying characteristics. These differences are the result of the ‘hand built’ nature of the aircraft. Other owners and builders of the Spitfire Mk 26 and 26B aircraft had found there was an inconsistency of some of the prefabricated parts of the aircraft. This has led to subtle, but generally acceptable, differences in finished aircraft. This was evident from the comparison between the two Spitfire Mk 26Bs at the airfield with the other showing much more benign characteristics in its stall testing compared to G-CLHJ. Spinning the Spitfire Mk 25/26/26B The investigation was unable to find details of spinning trials conducted on any of the scale replica Spitfires produced by the manufacturer, although owners and pilots outside the UK have spun their aircraft. Pilots who have spun the Spitfire Mk 26B state that entering an intentional spin is very easy either by letting the wing drop in a stall or by using rudder in a nose high attitude with low power. The spin was described as smooth, without hesitation in any axis and the recovery was very quick and controllable. A report from the New Zealand7 distributor of the replica Spitfire commented that: ‘Spins conducted, clean aircraft, one and a half turns each. Entry, full rear stick, throttle closed, full in spin rudder, ailerons central. A/cs nose dropped after 1/2 rotation. Spin slightly faster to right and tending to increase rate when starting recovery. Yaw stopped instantly when opposite rudder applied. Aircraft normal safe recovery, speed builds quickly after roll and yaw stops.’ Meteorology The weather around Enstone was good. There was scattered cloud with a base of between 3,500 ft and 4,000 ft agl. Wind was from a west or south-westerly direction with a speed of around 8 kt. The temperature was 22°C. Pilot The pilot of G-CLHJ had been accepted by LAA as having suitable competence and experience for the required testing, with significant experience on tail wheel aircraft. He had also flown another Spitfire Mk 26B before undertaking the flying on G-CLHJ. The pilot had a PPL which contained valid class ratings for the flight and a Class 2 medical. He also held an aerobatic rating. Footnote 7 http://www.campbellaeroclassics.com/id80.html [accessed November 2023].

14 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 The pilot had suffered a myocardial infarction (also known as a heart attack) in 2005, aged 50 and there was significant history of heart disease. Since 2005, for Class 2 certification he was required to undergo regular exercise tolerance tests (stress ECGs) which look for ischaemia of the heart muscle with increasing workload. Since these were all negative, his incapacitation risk in the subsequent years was assessed as statistically less than 1%. This means his risk of a subsequent heart problem was the same as the general population, and he was able to hold a CAA Class 2 medical. His last exercise tolerance test was carried out in April 2023. There was evidence from the post-mortem examination of the pilot’s heart of the previous myocardial infarction, as well as long standing heart disease but the examination did not show any clear signs of a recent event. There was evidence of what was considered to be traumatic damage as a result of the accident. The pathologist did however comment that given the signs of significant coronary disease and the previous infarction: ‘This could put the individual at risk of indeed [sic] sudden cardiac death potentially at any time.’ During his flying career the pilot had regularly flown aerobatics and practised spin recoveries, but he had not done this recently. The pilot did regularly fly another light aircraft which had approval for aerobatics and intentional spins of up to three turns, but witnesses reported that he did not use the aircraft for this. The skills required for upset and spin recovery are perishable, and a lack of recency may mean a pilot does not react as quickly or instinctively to a spin as one who is in regular practise. According to CAA Safety Sence Leaflet 30 – Loss of Control Spin & Stall Awareness, loss of control through stalling or entering a spin remains one of the leading causes of general aviation accidents.8 Survivability The pilot was wearing flying overalls and a modern ‘retro style’ flying helmet. The aircraft was fitted with a four-point nylon web safety harness. The pilot was not wearing a parachute. The aircraft struck the ground with considerable force, sufficient to bend the main spar of the wing. These forces were likely not survivable for the pilot. Evidence from the post-mortem indicated that the pilot had died before the fire began. The front seat harness, except for the steel buckles, and seat furnishings had been destroyed in the fire. The front seat buckles, although fire damaged, were in position within their clasp showing that the harness was correctly fastened. Examination of the seat frame showed the seat back frame and pan had shifted to the right and the seat back had collapsed downwards to a fully reclined position; this would have occurred during the impact sequence. Footnote 8 https://www.caa.co.uk/media/ajobzoaq/caa8230_safetysense_30-lossofcontrol_v10.pdf [accessed November 2023].

15 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 Human performance Startle response When a person encounters something that they are not expecting it can generate a startle response. This is a natural response of the brain to a significant stimulus. Whilst the processing of that stimulus within the brain may not be instantaneous, there is an area of the brain that can respond instantly with an aversive reflex. It is this ‘instant response’ whilst the processing of the stimulus is occurring that is the startle effect. The United States Federal Aviation Administration talks about the startle response as being when pilots are ‘faced with unexpected emergency situations’ and that such a response may delay a reaction from the pilot but may also lead to an incorrect response being triggered.9

All humans have a startle response but training and preparing can reduce the startle response time. This promotes a more timely and effective response to emergencies. Although the pilot had significant experience of both aerobatics and spinning, he was not in recent or regular practise. Incapacitation The CAA medical system aims to ensure that the risk of pilot incapacitation remains low. The risk does increase with age as it does with the general population. The pilot of G-CLHJ had a number of risk factors that might have raised his chance of incapacitation, although he was regularly assessed by his AME as part of his medical examination. Incapacitation can be partial or complete but either case can prevent a pilot from operating an aircraft. Incapacitation as the aircraft was at or close to the stall might have prevented the pilot from recovering the aircraft, and once the aircraft had entered a spin or spiral dive, might have prevented or delayed recovery. Incapacitation can also vary in completeness over short periods of time. Analysis During a flight test towards obtaining a Permit to Fly, control of the aircraft was lost. The pilot was fatally injured when the aircraft struck the ground. Aircraft construction and flying control systems The aircraft had been constructed from a kit over several years, during which the build team followed the LAA guidance and principles on building and test flying home built aircraft. Numerous short comings with the kit had been addressed and overcome by the build team. Test flying started in 2021 and as it progressed the team made adjustments to correct the tendency for the aircraft to roll to the right. Although the fin misalignment was known about by the build team, it was assumed that the misalignment was a feature of the kit design. It was not considered as a possible cause of the tendency to roll to the right. A comparison of the tail with the other Spitfire Mk 26B aircraft at the airfield was never explored by the build team. Footnote 9 https://www.faa.gov/newsroom/safety-briefing/startle-response [accessed November 2023]

16 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 Despite the damage sustained during the accident there was no evidence of a malfunction or failure of any of the aircraft flying control systems. Whilst the layout and space around the rudder pedals and the cockpit floor would suggest that a loose article would be unlikely to cause a control restriction, the fire damage in the area around the controls meant any plastic or organic components in the vicinity were completely destroyed. Therefore, a control restriction cannot be completely ruled out. Fin misalignment effect The aircraft should not have had a fin misalignment. There is no mention of it in the kit construction manual and the fin is shown symmetrically on the fuselage centre line on the manufacturers drawing. Other Spitfire Mk 26 and Mk 26B aircraft do not have the fin misalignment and during the testing of those aircraft, there was no marked tendency for them to roll. Despite the adjustments made to correct the roll, when the aircraft is approaching the stall and the effect of the ailerons is reduced, the fin misalignment may have had an effect by inducing a constant yaw causing the right wing to stall first and drop as reported by the pilot. In effect the misalignment fin and rudder created a pro-spin condition. CCTV and witness evidence show the aircraft descending and rotating to the right. If it is considered that the aircraft was in a spin to the right and the standard corrective action was taken, the fin misalignment and full left rudder would have created a significant aerofoil camber and therefore aerodynamic force to counter the rotation. Therefore, had full left rudder been applied, the misalignment would have been more than sufficient to arrest the rotation. Although the fin misalignment was undesirable, it is not considered to be a causal factor in this accident. Stall strips Throughout the flight testing of G-CLHJ the pilot had conducted numerous stalls to ascertain the characteristics and stalling speed of the aircraft. In nearly all of these stalls the pilot reported a wing drop to the right. For the accident flight the stall strips had both been moved down a few millimetres. Both stall strips were located at the accident site, although one was no longer attached to the leading edge of the wing due to the fire. The pilot conducted two stalls and recovered before the aircraft departed from controlled flight on the third stall. Given the pilot was familiar with the tendency of the aircraft to drop its right wing at the stall, and that he had completed two previous stalls during the flight in which the right wing was seen to drop, it would seem unlikely that he was startled by the aircraft behaviour on the third stall. The position of the stall strips did not seem to significantly change the behaviour of the aircraft compared to previous flights. Flight manoeuvres Witnesses observed the aircraft depart the airfield without incident. The pilot climbed to between 3,000 and 4,000 ft which was sufficient for the planned elements of the flight.

17 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 Although at some distance away they observed the aircraft undergoing stalls as planned. Immediately after the third stall the aircraft departed from controlled flight and descended. The observers considered the aircraft to have entered a spin. Analysis of the CCTV would indicate that there was little change in the rate of descent or aircraft speed for most of the descent which would fit with the aircraft being in a spin. However, the steep nose-down attitude of the aircraft could be more indicative of a spiral dive. The distance of both the CCTV camera and the witnesses from the aircraft means that it is not possible to clearly identify whether it was a spin or spiral dive. However, the fact that two stalls appeared to have been carried out satisfactorily suggest the pilot was in full control and flying to the plan for the flight. Something appears to have gone wrong during or immediately after the third stall. The pilot had suffered a heart attack some years previously and there was significant history of heart disease. Although the assessment of his heart condition for his Class 2 aviation medical indicated he was at a low risk of a cardiac event, the post-mortem found evidence of longstanding heart disease and scarring from the previous myocardial infarction. The pathologist suggested that a cardiac event leading to an incapacitation was possible at any time, but there was no definitive evidence that one occurred during the accident flight. At some point during the third stall the pilot experienced an event which prevented him from immediately recovering from the stall and the aircraft entered into a spin or spiral dive. The CCTV indicates that for the initial period the flight path of the aircraft remained relatively constant which would indicate either no action or a lack of effective recovery action by the pilot. The pilot had extensive experience in aerobatics and spinning, however he was not in recent practice. Although the wing drop was familiar to the pilot, the subsequent departure from controlled flight possibly startled him leading to a delay in any recovery action. The CCTV analysis did indicate there was a change in flight path characteristics as the aircraft approached the ground which in the absence of other changes to the aircraft, could indicate some level of control input from the pilot. Evidence from the accident site would confirm this change in flight path as the aircraft struck the ground at a shallow pitch angle and did not make contact with the electricity cables running above the point where the aircraft initially struck the ground. The cause of the loss of control following the third stall and the lack of complete recovery could not be established, but either startle, an incapacitation or a control restriction cannot be ruled out. Conclusion Control of the aircraft was lost during a test flight towards the grant of a Permit to Fly. Despite the damage sustained during the accident, there was no evidence of a malfunction or failure of any of the aircraft flying control systems. The aircraft was found to have been built with a misaligned fin and rudder. This misalignment made a wing drop at the stall more likely, but it did not prevent or restrict a recovery from the stall nor any subsequent spin or spiral dive that might develop. The pilot had conducted numerous stalls on the aircraft

18 © Crown copyright 2024 All times are UTC AAIB Bulletin: G-CLHJ AAIB-29511 during its flight testing and was familiar with the wing drop in the aircraft and therefore it is unlikely that he was startled by the behaviour although the subsequent entry into a spin or spiral dive may have. There was sufficient height for a recovery from a spin or spiral dive. Although the pilot’s medical history indicated the possibility of an incapacitation this could not be confirmed by the pathologist. The prospect of a control restriction preventing a full recovery could also not be excluded due to the extensive fire damage to the aircraft. Safety action The LAA issued Mandatory Technical Directive MTD-01-2024 on 13 February 2024 applicable to all Spitfire Mk 26 and Mk26b aircraft. The MTD required geometry and symmetry checks to be carried out to ensure correct alignment of fin assembly and rigging of rudder with comprehensive illustrated instructions how to achieve the checks. Published: 20 June 2024.

FD06681 ｜ 2019_英国_aaib-investigation-to-sportstar-max-g-tmax__Sportstar_Max_G-TMAX_01-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

97 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-TMAX EW/G2018/08/23 ACCIDENT Aircraft Type and Registration: Sportstar Max, G-TMAX No & Type of Engines: 1 Rotax 912 ULS2 piston engine Year of Manufacture: 2010 (Serial no: 2010 1305) Date & Time (UTC): 29 August 2018 at 1140 hrs Location: Wycombe Air Park, Buckinghamshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Damage to the firewall, nosewheel, cowling and propeller Commander’s Licence: Private Pilot’s Licence Commander’s Age: 37 years Commander’s Flying Experience: 225 hours (of which 26 were on type)

Last 90 days - 1 hour

Last 28 days - 1 hour Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis The aircraft landed, in crosswind conditions, on the nosewheel causing damage to the nosewheel, firewall, cowling and propeller. The pilot attributed the accident to lack of recency and reflected that he should have gone around when the aircraft did not land as expected.

History of the flight The pilot was returning from a local general handling flight to land on Runway 24 at Wycombe Air Park. The surface wind was varying between 330° and 340° at 10 kt giving a crosswind from the right and slight tailwind for Runway 24. Visibility was good with scattered cloud at 3,500 ft and temperature 21°C. The pilot described the approach and initial landing as unremarkable, but after the initial touchdown the aircraft did not appear to ‘settle’ as he expected. The pilot tried to force the aircraft to settle onto the runway, causing oscillations in pitch as the landing continued. Approximately two thirds along the runway the aircraft ‘ballooned’ then landed firmly on the nosewheel. The pilot was initially unaware of any damage and was able to taxi back to the normal parking position. Subsequent inspection found damage to the firewall, nosewheel, cowling and propeller.

98 © Crown copyright 2019 All times are UTC AAIB Bulletin: 1/2019 G-TMAX EW/G2018/08/23 Analysis After the accident the pilot believed that the additional groundspeed due to the lack of headwind caused the aircraft to not settle as he anticipated. He reflected that an early decision to go around would have avoided the accident. The pilot had only flown for 36 minutes in the last 90 days and he thought that his lack of recency may have contributed to the accident.

FD06682 ｜ 2019_英国_aaib-investigation-to-team-minimax-91-g-bzor__Team_Minimax_91_G-BZOR_09-19.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

70 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-BZOR EW/G2019/05/19 ACCIDENT Aircraft Type and Registration: Team Minimax 91, G-BZOR No & Type of Engines: 1 Rotax 447 piston engine Year of Manufacture: 2001 (Serial no: PFA 186-13312) Date & Time (UTC): 19 May 2019 at 1006 hrs Location: Godshill, New Forest Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Dented cowling, broken brake cable Commander’s Licence: Private Pilot’s Licence Commander’s Age: 61 years Commander’s Flying Experience: 182 hours (of which 22 were on type)

Last 90 days - 2 hours

Last 28 days - 1 hour Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis During the cruise at 2,000 ft, G-BZOR’s engine began running roughly and lost power. Unable to maintain height, the pilot positioned the aircraft for a forced landing on open heathland. Just as the aircraft came to rest it tipped forward onto its nose causing minor damage to the airframe and a brake cable. The cause of the engine failure was traced to a faulty stator in the ignition system. History of the flight While cruising at 2,000 ft and 80 kt G-BZOR’s engine suddenly began misfiring and lost power. An increase in vibration and reduction in throttle response led the pilot to believe that one engine cylinder had failed. Unable to maintain height, he positioned the aircraft for a forced landing. The pilot was not receiving an air traffic control service at the time and decided to concentrate on flying the aircraft rather than transmitting a MAYDAY call. Initially over a copse of trees, the pilot selected a suitable landing site south of the woods, on an uphill slope in open heathland (Figure 1). Aware that he would have to execute a tight turn into wind on finals, he increased his airspeed from 55 to 75 mph to give a higher stall margin in the turn.

71 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-BZOR EW/G2019/05/19 Figure 1 Approximate ground track of G-BZOR during the forced landing Having rolled out into the light north-north-easterly breeze the pilot reduced speed and achieved a gentle touchdown. As G-BZOR came to a halt its front axle fouled in heather and the aircraft tipped forwards, resulting in minor damage to the airframe (Figure 2) and a brake cable. Figure 2 G-BZOR after the forced landing with minor damage evident on the engine cowling Aircraft information The pilot described the aircraft as being “carefully maintained”. Within the previous 30 flying hours the engine had been rebored and rebuilt with new bearings, and fitted with a new main ignition module. The crankshaft had recently been clearance checked, the spark

72 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-BZOR EW/G2019/05/19 plugs were less than five hours old and the propeller was brand new. The fuel (MOGAS) had been drawn earlier that day from a “busy source”. It was “correctly diluted” with oil and filtered into the aircraft’s tank. While the Rotax 447 is not a certificated aircraft engine it is the recommended engine in the Pilots’ Operating Handbook (POH). It is also accepted as the normal engine fit by the Light Aircraft Association (LAA) in their Type Acceptance Datasheet (TADS1861) for the Team Minimax 91. The Rotax 447 POH2 contains the following warnings and safety information for users of the engine: ‘This engine, by design, is subject to sudden stoppage…This is not a certificated aircraft engine…and conforms to no aircraft standards…User assumes all risks…Be informed and prepared for any situation or hazard associated with flying.’ On this aircraft, carburettor heating is not pilot-selectable. Fixed ducts circulate warm air from the engine bay past the carburation system. Aircraft examination The pilot reported that, on inspection after the accident, the carburettor float bowl contained a “suitable” amount of uncontaminated fuel. When he later removed the spark plugs, the pilot noted that they were “clean”, the “correct colour” and sparked normally when tested. Subsequent diagnostic testing found that “the ignition stator was breaking down under load and causing the engine to misfire”. The engine ran normally after a new stator had been fitted. Personnel The pilot credited good training and regular practice of abnormal situations as significant contributors to a successful outcome in this challenging event. He opined: ‘Two stroke engines can fail without warning - Be Prepared! The success of the [forced] landing considering the adverse nature of the terrain is entirely due to good tuition and well-rehearsed “what if’ drills. Practice [forced landing] procedures regularly, and when things go wrong: Fly the aircraft.’ Analysis The Rotax 447 is not a certificated aircraft engine, but it is approved for use under the LAA type acceptance process. The user guide is explicit in its guidance regarding the risks associated with using the engine in an aircraft. Pilots are left in no doubt that they should be prepared for sudden engine failures at any stage of flight. The accident pilot was aware of the risk and mitigated it by regularly practising emergency drills. Footnote 1 http://www.lightaircraftassociation.co.uk/engineering/TADs/186%20TEAM%20MINIMAX%2091.pdf [Accessed 11 June 2019]. 2 https://rotax-docs.secure.force.com/DocumentsSearch/sfc/servlet.shepherd/version/ download/200681H000002wI8PQAU?asPdf=false [Accessed 11 June 2019].

73 © Crown copyright 2019 All times are UTC AAIB Bulletin: 9/2019 G-BZOR EW/G2019/05/19 Faced with a forced landing on rough terrain, the pilot prioritised flying the aircraft and planning for the landing ahead of transmitting a MAYDAY call. Landing uphill and into wind required a tight turn on late finals. Aware of the attendant risk, the pilot increased his gliding speed to generate a higher stall margin in the turn. The forced landing was successful. The cause of the engine failure was a faulty ignition stator. Conclusion This was a successful forced landing. Key factors in this outcome were the pilot’s knowledge and his preparedness for such an emergency. By prioritising flying the aircraft over communicating, the pilot was able to anticipate problems and focus his thoughts on achieving a safe and controlled touchdown.

FD06683 ｜ 2019_英国_annual-safety-review-2019__AAIB_Annual_Safety_Review_2019.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

AAIB Air Accidents Investigation Branch Annual Safety Review 2019

Air Accidents Investigation Branch Annual Safety Review 2019 AAIB Air Accidents Investigation Branch © Crown Copyright 2020 All rights reserved. Copies of this publication may be reproduced for personal use, or for use within a company or organisation, but may not otherwise be reproduced for publication. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and it is not used in a derogatory manner or in a misleading context. Published 6 July 2020 Enquiries regarding the content of this publication should be addressed to: Air Accidents Investigation Branch Farnborough House Berkshire Copse Road Aldershot Hampshire GU11 2HH. enquiries@aaib.gov.uk This document is also available in electronic (pdf) format at www.aaib.gov.uk

Air Accidents Investigation Branch Annual Safety Review 2019 iii AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Foreword and Contents

Foreword I am pleased to introduce this Annual Safety Review which includes information on occurrences and the safety action taken or planned in response to AAIB investigations concluded in 2019. It may seem strange that we are publishing this review in the midst of a pandemic that has had such a profound effect on aviation in 2020. However, last year’s events are no less significant because of what has followed. As attention focuses on restart and recovery, the key safety messages are as a relevant as ever. Investigations The AAIB received 826 occurrence notifications in 2019 and opened 37 field investigations, eight of which were into fatal accidents in the UK resulting in 10 deaths. A further 124 investigations were opened by correspondence. In addition, the AAIB appointed an accredited representative to 96 overseas investigations, including 45 involving UK registered aircraft. The AAIB deployed on investigations to Belgium, USA, Ethiopia, Chile, UAE, Italy, Portugal, Montserrat and Kazakhstan. Globally, the most prominent event was the loss of a second Boeing 737 Max in Ethiopia which led to the grounding of the fleet and a fundamental review of certification regimes and other systemic issues. Closer to home, the loss of a Piper Malibu a few miles north of Guernsey, led to a complex and high-profile investigation that drew attention to two significant safety issues – the risks associated with unlicensed charter operations, and the need for carbon monoxide detectors with an active warning. This was one of two AAIB investigations conducted in 2019 which involved operations to locate and gather evidence from aircraft wreckage on the seabed. An article on how we set about these operations is included in this Annual Safety Review. In 2019 all the fatal accidents that we investigated in the UK involved general aviation aircraft or gliders with the most common factor being loss of control in flight. The most common factor in commercial air transport accidents and serious incidents was system/component failure or malfunction. The AAIB published two Special Bulletins, 29 Field Investigation Reports and made 12 Safety Recommendations. Details of them all are in the pages that follow, together with updates on the status of responses received and the action being taken. Also included are details of 153 significant safety actions taken by manufacturers, operators and regulators to address safety issues identified during AAIB investigations. I am pleased to report that some progress has been made by the industry and regulators towards the introduction of takeoff acceleration monitoring systems following safety recommendations of global concern raised by the AAIB and others in 2018. However, the AAIB investigated five more takeoff performance serious incidents in 2019, showing why these systems are urgently needed.

Air Accidents Investigation Branch Annual Safety Review 2019 iv AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk

Developments Within the Branch, major projects last year included the development of a sophisticated case management system that exploits modern digital collaborative tools to manage investigations from notification to closure. It will allow us to meet all legal requirements, including evidence and wreckage management, and provide a rich source of safety data for future exploitation. Other changes included the introduction of a ‘record only’ option for some less serious occurrences allowing us to focus AAIB expertise and investigation resources where the safety benefit is greatest. And by publishing our field investigation reports on-line as soon as they are ready, rather than wait for up to six weeks for the next monthly bulletin, we have reduced overall timescales to publication. Collaboration between the Air, Marine and Rail Accident Investigation Branches has been further strengthened with the Accident Investigation Chiefs’ Council driving forward workstreams to maximise the synergy between the three modal branches and form common positions on areas of joint interest. Joint memoranda of understanding have been developed between the branches and other authorities to facilitate cooperation while protecting the AIB’s independence. Engagement I am very grateful to all those who contributed to our Stakeholder Survey; we greatly valued the feedback. In this Review there is an article to explain how we are using the insights to develop our external communications to reach a wider audience and influence key stakeholders with the important safety messages from our investigations. In 2019 the AAIB established a global outreach framework. We engaged directly with many safety investigation authorities around the world and participated actively in several international forums. These connections enable us to share experiences and ideas, develop specialist capabilities and train together. This is important as the investigation of civil aviation accidents is an inherently international activity. A short article on our overseas deployments and some of our engagement activities in 2019 is provided in this Review. Future challenges 2020 is already proving to be an extraordinary year as the UK adjusts to life outside the EU and the world sets about recovering from the impact of the Coronavirus. The AAIB is investigating more and more unmanned air system accidents as the regulatory and technological boundaries are being pushed to the limits. Soon the regulations will be in place for commercial spaceflight from the UK and that may bring a whole new dimension to our work. In the meantime, I invite you to peruse this 2019 Annual Safety Review which I trust you will find interesting and useful. Crispin Orr Chief Inspector of Air Accidents

Air Accidents Investigation Branch Annual Safety Review 2019 1 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Foreword and Contents

Contents Foreword ...........................................................................................................................iii AAIB stakeholder research...............................................................................................3 AAIB underwater wreckage operations...........................................................................7 The AAIB worldwide........................................................................................................17 CICTT factors on investigations by the AAIB in 2019..................................................19 Field investigations.................................................................................................. 20 Correspondence investigations............................................................................... 21 Fatal investigations ................................................................................................. 22 Statistics for 2019............................................................................................................23 Category definition .................................................................................................. 24 Notifications 2019.................................................................................................... 25 Notifications 2018.................................................................................................... 26 Notifications 2017.................................................................................................... 27 Safety Recommendations in 2019 ................................................................................ 29 Safety Recommendations issued in 2019............................................................... 33 Safety Actions from investigations reported on in 2019 .............................................49 Field investigations.................................................................................................. 49 Correspondence investigations............................................................................... 63 Index of Safety Actions............................................................................................ 86 Appendix 1 - CICITT occurrence categories.................................................................88

Air Accidents Investigation Branch Annual Safety Review 2019 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk 2

Air Accidents Investigation Branch Annual Safety Review 2019 3 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Stakeholder Research

AAIB stakeholder research Avid followers of our work will know that air accident investigations started in the UK more than 100 years ago. Bound by the need to comply with regulations and international standards, one could be forgiven for assuming that the AAIB would not be overly concerned about people’s views on its work. However, while regulations give us and our Inspectors the powers needed to secure valuable evidence to conduct an investigation, our effectiveness in improving aviation safety depends on our collaboration with those we investigate and those with the means to effect changes that we call for in our Safety Recommendations. For this reason, we recently commissioned research specialists ComRes to undertake research with a wide range of our stakeholders. We had three objectives for the research: ● To understand overall stakeholder perceptions of the Branch and the contribution it makes to improving aviation safety. ● To benchmark stakeholder opinions about the performance and processes of the Branch. ● To understand stakeholder views on the Branch’s engagement with stakeholders. 119 stakeholders were surveyed online and ten 30-minute telephone interviews were conducted. The stakeholder types included Government/Regulators, Manufacturers, Operators, Academia, Sporting Associations and Unions. ComRes research report summary Overall perceptions Stakeholders have a good understanding of the AAIB’s remit, and the organisation is seen extremely positively. Four in five would speak highly of the AAIB, and the organisation is seen as professional, knowledgeable, trustworthy and impartial. The AAIB’s work is seen as highly valuable to the aviation industry worldwide. Performance The AAIB’s work is seen very positively. The AAIB is seen to be independent and expert, and very capable at making safety recommendations and avoiding apportioning blame. While ratings are lowest for being compassionate, this derives from a lack of knowledge. Those who have relevant experience are very positive about the compassion of inspectors. AAIB is seen as good at investigating incidents involving well established factors such as technical and maintenance issues. While ratings are high for human and operational factors, stakeholders would like to see an increased focus on these, and welcome the

Air Accidents Investigation Branch Annual Safety Review 2019 4 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Stakeholder Research

AAIB’s appointment of its first Inspector of Air Accidents (Human Factors). Stakeholders are uncertain about the AAIB’s ability to investigate incidents involving Unmanned Air Systems, and think it is crucial the organisation is able to cope with the rise of new technologies. Communications Stakeholders access reports through a range of channels; primarily the website, but also hard copies, the press and word of mouth. Around half have read guidance documents and the same for the Annual Safety Review. Both are seen as useful by those who have read them, while those who have not read the annual review usually were unaware of its publication. Some stakeholders would like the AAIB to explore new methods of communication. What we are doing? This is a sample of some of the actions we are taking following the research. Unmanned air systems Since the survey, we have published many correspondence investigations on unmanned air systems (UAS) as part of our monthly bulletins. In January 2020 we published our first Field Investigation involving a UAS, which was an accident to a DJI Matrice 210. In last year’s Annual Safety Review we included an article on how we investigate UAS accidents and our ‘decision tree’ for initiating an investigation. We are now preparing a dedicated section for our website so it will be easier to find out which UAS accidents we investigate and how, and it will bring together those on which we have published a report.

Air Accidents Investigation Branch Annual Safety Review 2019 5 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Stakeholder Research

Communication Since the survey, we have been publishing Field Investigations individually. This means that we can communicate the safety messages from our reports faster, removing the delay that was sometimes caused if reports were finalised just after the monthly bulletin had been produced. In October, we started a new format for less serious incidents. Introducing this ‘record only’ category is freeing up Inspectors’ time to focus on those Field and Correspondence Investigations which will provide the greatest safety benefit, and over the year we expect this initiative to help further reduce the time it takes to publish some of our reports. We have also started to produce short videos for investigations where we feel there is a public interest or a widely applicable safety message. One of these videos has had more than 140,000 views, so communicating this way is reaching a much wider audience. Sporting associations We have improved the frequency and consistency of our engagement with sporting aviation clubs and associations making best use of our established single points of contacts. So the sporting associations, such as the British Gliding Association and Light Aircraft Association, have regular contact with the appointed individual Inspector. We know there is more to do and over this year we look forward to more exciting developments in the way we communicate and engage with our stakeholders.

Air Accidents Investigation Branch Annual Safety Review 2019 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk 6

Air Accidents Investigation Branch Annual Safety Review 2019 7 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Underwater Wreckage Operations

AAIB underwater wreckage operations Introduction Every aircraft accident brings its own challenges in finding and examining the wreckage. However, when an aircraft accident occurs over water the challenges can become more extreme and require the AAIB to make significant and difficult decisions. In recent years the AAIB has conducted a number of investigations of accidents where the aircraft wreckage has come to rest under water. The approach in conducting these investigations has been developed over many years and is documented in internal processes and agreements with partner organisations. We continue to develop these processes and techniques through applying lessons learnt after each investigation. This article will provide some insight into the factors we consider when investigating an accident where the aircraft wreckage is in water. Who investigates? The AAIB is responsible for investigating all accidents within the UK, its Crown Dependencies and its Overseas Territories, that occur on land and within their territorial waters. We are also responsible for investigating accidents involving UK registered aircraft (or those registered in UK’s Crown Dependencies or Overseas Territories) that occur in international waters. Other States may also delegate their investigations to us. A recent example is our investigation into the accident involving the US registered Piper PA-46 (Malibu), N264DB, which occurred in international waters in the English Channel.

Air Accidents Investigation Branch Annual Safety Review 2019 8 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Underwater Wreckage Operations

The tail section of N264DB at a depth of 68 m Where the safety investigation is led by another accident investigation authority, the AAIB may also participate in the search, survey and recovery operation as either an Accredited Representative, Expert or Observer. An example was the accident to the Air France Airbus A330, F-GZCP, in the Atlantic on 1 June 2009. The investigation was led by the French accident investigation authority (BEA) who invited the AAIB to participate in the underwater survey as an observer. BEA image of wreckage from F-GZCP taken at a depth of 3,980 m Recovery of wreckage As with all investigations, our initial objective is to recover and preserve evidence that is considered essential in establishing the cause of the accident. In doing so our priority is the safety of individuals involved in the operation and ensuring that the AAIB’s resources are used in the most effective manner possible.

Air Accidents Investigation Branch Annual Safety Review 2019 9 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Underwater Wreckage Operations

In general terms, the decision to search and recover wreckage from water, either floating or submerged, is made after considering the following questions:

1. Is it safe to do so?
2. Is it necessary to establish the cause of an accident and identify safety

issues?

1. Is the cost of the operation proportionate to the expected safety benefit?

If it is possible to establish the cause of the accident and make Safety Recommendations without recovering the wreckage, then we may not recover it. However, we will always consider the feasibility of recovering the wreckage against the three questions above so that an informed decision can be made. The AAIB is not responsible for the recovery of victims from aircraft accidents either on the land or in the water but will always work with and support the relevant authorities. How the AAIB conducts this type of operation As diving operations are heavily regulated, and the AAIB are not experts in chartering and operating vessels, we normally work with the MoD Salvage and Maritime Operations Project Team (SALMO) who act as the Government Competent Authority on the recovery and surveying of aircraft wreckage in water. As such, SALMO are the Project Team in any maritime or diving contracts and we act as their adviser. A Memorandum of Arrangement between AAIB and SALMO defines the roles and responsibilities of each organisation. SALMO are always available to advise the AAIB, identify options and manage risk for finding and recovering wreckage in water. Subject to their available resources at the time, we can ask SALMO to carry out the following tasks: ● Work with AAIB personnel in the preservation of evidence. ● Assist with the development and execution of the search, survey and recovery plan. ● Carry out a full onsite risk assessment with regard to the safety of AAIB personnel working in the maritime environment. ● Contract vessels and marine contractors (including survey / diving / Remotely Operated Vehicle (ROV)) to meet the AAIB requirements. ● When required, provide and operate their underwater location / survey and recovery equipment. ● Provide guidance and advice on the training needs for AAIB personnel undertaking maritime operations.

Air Accidents Investigation Branch Annual Safety Review 2019 10 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Underwater Wreckage Operations

The AAIB will help to identify the likely location of the aircraft by analysing the radar recordings, considering the aircraft performance and by using our equipment to detect the underwater locator beacon. We will also identify the evidence to be recovered and take action to preserve it once it has been recovered to the vessel. We also have a key role in the safety of the divers, personnel on the recovery vessels and the ROV by providing information on the aircraft and associated hazards. This requires AAIB Inspectors to deploy on the vessels so they need to maintain their qualifications and competencies for working at sea. Categories of water operation We categorise the type of water in which an aircraft has crashed to enable us to respond appropriately. These categories are Inland, Coastal and Offshore. It should be noted that these categories are different to the normal maritime definitions. Categories of water depth when considering aircraft search and recovery Inland Inland water can take many forms, including rivers, lakes, lochs and canals. Inland water is defined as ‘away from the coast and more than knee deep, or fast moving of any depth’. The factors to consider are varied and may often bring unique challenges. A shallow waterway or lake, with partially submerged wreckage may require specialist lifting equipment that can reach the wreckage, whereas a deep open expanse of water will first require suitable equipment to find the wreckage and then undertake a survey to determine its condition. Only then can the feasibility of recovering the wreckage be considered. By definition, inland water is away from the coast and can be difficult to access with specialist lifting equipment, which may need to be floated close to the wreckage. An example of a challenging recovery involved an accident to an AS350 in Loch Scadavay in the Western Isles of Scotland. The helicopter was partially submerged in the remote loch and was lifted using floatation devices. It was then towed ashore and recovered using a shore based mobile crane.

Air Accidents Investigation Branch Annual Safety Review 2019 11 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Underwater Wreckage Operations

G-PLMH partially submerged in Loch Scadavay prior to recovery Coastal Coastal waters are defined as being ‘not inland and with the aircraft partially visible at some stage of the tide’. The wreckage will therefore be in relatively shallow water and may be within the tidal range on a beach, at the foot of a cliff or in an estuary. Consequently, the wreckage may be submerged at high tide and above the waterline at low tide. Wave action and strong tidal flows can cause the wreckage, which may have some buoyancy, to move or be buried by sand, silt or mud. Wreckage close to the coast can be difficult to recover and it might only be accessible at certain stages of the tide. The wreckage may be further damaged if the recovery is delayed, especially if the sea is rough and the wreckage is washed against the shore or cliffs. We would normally expect to recover wreckage in coastal waters. An example is an accident involving an Augusta Bell 206B Jet Ranger II helicopter (G-SUEX) next to cliffs near Flamborough Head, Yorkshire. The wreckage came to rest on a shale beach in a small inlet at the foot of the cliffs. Although the wreckage could be accessed by sea, we were unable to recover it by boat and so was lifted it using a cliff top winch. Recovery of G-SUEX, Flamborough Head, Yorkshire in 2014

Air Accidents Investigation Branch Annual Safety Review 2019 12 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Underwater Wreckage Operations

Offshore The third type of operation, and normally the most complex and expensive, is finding and recovering wreckage from offshore, which is defined by the AAIB as ‘not coastal and in water deep enough to cover the aircraft if it sank’. Following an aircraft accident at sea, a search and rescue operation, involving a number of different organisations, would be initiated and carried out in accordance with international protocols laid down in Annex 12 to the convention on international civil aviation Search and Rescue and the International Aeronautical and Maritime Search and Rescue Manual published by the IMO and ICAO. Although the AAIB would not actively participate in the search and rescue phase, we would work with and provide support to the appropriate authorities. At the same time, we would start preparation for the investigation phase, which would commence once the search and rescue phase had been concluded. An early priority is to find the wreckage. Although the last position of the aircraft in flight might be known, being able to determine the location of wreckage on the seabed requires an understanding of where the aircraft entered the water and the tidal conditions. This requires an understanding of the aircraft dynamics including the direction, speed and distance travelled. Once the area in which the aircraft entered the water has been identified, an estimation of the tidal drift and sink rate is applied to determine the most likely location on the seabed. This defines the search area. The next step is to conduct the search. We often use side scan sonar (SSS) to carry out the initial underwater search. This is achieved by “flying” a towed SSS transmitter/receiver close to the seabed that emits a series of sonar pulses that are reflected off the seabed and any underwater objects. The reflected pulses are captured and processed on the vessel to produce an image of the seabed and objects. The SSS operator and the AAIB inspectors then assess the image to identify any potential targets. SSS was used in the search of a Piper PA-28 (G-CDER) which ditched off the East Sussex coast and came to rest upside down on the seabed. Other surveying techinques, such as multibeam sonar, which use a surface based sonar transmitter/receiver are also used to locate wreckage. Side scan sonar survey results from search of G-CDER

Air Accidents Investigation Branch Annual Safety Review 2019 13 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Underwater Wreckage Operations

Commercial aircraft are normally equipped with cockpit voice and flight data recorders that are fitted with an acoustic beacon which is activated when it is submerged in water. The AAIB has its own handheld detectors that can be held over the side of a small boat and a more capable ‘towed fish’ that can be deployed from a suitable vessel and can be used to detect a beacon at depths of up to 1,000 m. The AAIB does not just use its equipment to locate missing aircraft; we also deployed to the Red Sea to search for the El Salam Boccaccio 98, a ferry which sank on 2 February 2006, 80 km (50 miles) from Duba, Saudi Arabia. The towed fish being recovered from the water during sea trials Once a potential target has been identified we need to visually determine if it is wreckage from the aircraft. We do this by using an remotely operated vehicle (ROV) equipped with cameras and if conditions allow this is followed up by divers equipped with handheld cameras. A full survey of the aircraft and wreckage field is always carried out to capture evidence and to allow an assessment to be made as to what items should be recovered and the best way in which to do so. The survey will also enable us, by assessing the aircraft damage and whether the whole aircraft is there, to establish: ● the attitude and speed of the aircraft when it struck the water, ● whether the aircraft is complete or there has been an inflight break up, ● if the engine(s) had been operating, ● evidence of fire. Offshore activities require significant planning and early engagement with SALMO to identify suitable vessels and weather windows. It is often necessary to plan the operation over three phases sometimes using different vessels for each phase.

Air Accidents Investigation Branch Annual Safety Review 2019 14 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Underwater Wreckage Operations

The phases are: ● Phase 1. Finding the wreckage by using vessels either towing SSS or by using hull mounted multi beam sonar equipment. ● Phase 2. Surveying the wreckage with ROVs. ● Phase 3. Recovering the wreckage which may require a dynamically positioned vessel equipped with a stabilised crane, ROV, divers and a decompression chamber. When planning the search, the depth of water, seabed topography, tidal flows, sea state and weather will all be factored in to determine the most appropriate vessel and survey technique to be used. For shallow waters it may be easier to deploy surface-based divers or a small ROV, which is a relatively cheap way of surveying the wreckage. As the water depth increases the complexity and costs also increase. Critically, as the depth increases it is necessary to change from surface-based divers to saturation divers which require the use of vessels that can remain dynamically positioned and specialised diving equipment with decompression facilities. If the decision is made to recover all or part of the wreckage, then a plan must be made to ensure the correct assets are in place to ensure the safety of all those involved in the operation and to minimise injury to those undertaking the recovery or destroying evidence. Wreckage may be recovered by attaching lifting straps to move it into cages or bags positioned on the seabed by divers or an ROV, or by lifting it directly to the surface. Air bags can also be attached which are then inflated and float the wreckage to the surface. It might also be necessary to cut the wreckage into manageable pieces before it is moved. The vessel must be large enough to secure the wreckage onboard and to allow AAIB Inspectors to undertake anti-deterioration measures, which is essential to delay the onset of corrosion when the aircraft is removed from saltwater. Recovering the wreckage of helicopter G-BLUM onto the deck of the vessel in the early hours of the morning. (Irish Sea)

Air Accidents Investigation Branch Annual Safety Review 2019 15 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Underwater Wreckage Operations

Conclusion Following an aircraft accident where the wreckage enters the water, the AAIB is prepared and has the necessary support on standby to enable an investigation tto be carried out to determine the cause of the accident. The complexities and difficulties associated with finding, surveying and recovering wreckage make the activity challenging. We will weigh the benefits in surveying and recovering the wreckage against the risk to individuals, and vessels, involved in the operation. Although the cost effectiveness of underwater activities is a consideration, we will attempt to survey and recover wreckage when it is practical to do so and is considered necessary to determine the cause of the accident.

Air Accidents Investigation Branch Annual Safety Review 2019 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk 16

Air Accidents Investigation Branch Annual Safety Review 2019 17 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB Worldwide

The AAIB worldwide The AAIB is the UK’s designated Accident Investigation Authority for the purposes of Annex 13 to the Convention on International Civil Aviation (Air Accident and Incident Investigation). The global nature of commercial and non-commercial aviation, and the aerospace industries, means that we contribute to investigations and related activities around the world. We are proud that we continue to be held in high esteem by the international investigation community. We are involved with many international aviation safety bodies and are invited to lead or participate in many seminars, forums and training exercises. We have been welcomed as participants in investigations where there is a UK interest and as observers to those that provide training benefit to our Inspectors. In 2019 we established a global outreach framework to engage directly with accident investigation authorities around the world. The map on the next page shows some of the overseas activities conducted by the AAIB in 2019 and illustrates our global reach. As an example an accident to Britten-Norman Islander registration VP-MNI, at John A Osborne Airport, Montserrat on 23 September 2019

Air Accidents Investigation Branch Annual Safety Review 2019 18 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk

Colour key Places visited for accident and serious incident investigations Belgium, Channel Islands, Chile, UAE, Ethiopia, France, Italy, Kazakhstan, Montserrat, Norway, Portugal, USA Places where the AAIB has either provided or received training Bermuda, Canada, Cayman Islands, Falkland Islands, Hong Kong, Ireland, Netherlands, Taiwan, USA Places where the AAIB has sent representatives to participate in international organisation meetings International Civil Aviation Organisation (ICAO) Canada European Union Aviation Safety Agency (EASA) Germany European Civil Aviation Conference (ECAC) Hungary, Ukraine European Network of Safety Investigation Authorities (ENCASIA) Belgium, Latvia, Poland, Switzerland International Society of Air Safety Investigators (ISASI) Netherlands, USA Places where the AAIB has participated in international conferences, forums or exercises Austria, Australia, Canada, Japan, Portugal, Singapore, USA Places visited by the AAIB for liaison and outreach Argentina, France, Hong Kong, Netherlands, Taiwan, USA

Air Accidents Investigation Branch Annual Safety Review 2019 19 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2019

UNK AMAN EVAC RI RAMP ICE 4 ADRM 4 FUEL 4 LOC-I 41 SCF-NP 67 ARC 91 SCF-PP 46 CTOL 23 GCOL 32 TURB 11 OTHR 87 RE 37 LOC-G 61 F-IN 10 F-POST 6 NAV 6 WSTRW 7 MED 8 MAC 6 ATM 5 C... USOS L... BIRD UIMC C... See Appendix 1 for category descriptions Factors for all investigations reported on by AAIB in 2019 CICTT factors on investigations by the AAIB in 2019 Every occurrence in the UK is recorded on the European Central Repository (ECCAIRS) and is coded using the occurrence taxonomy defined by the CAST/ICAO Common Taxonomy Team (CICTT). This is a worldwide standard taxonomy to permit analysis of data in support of safety initiatives. In the UK the coding of occurrences is carried out by the CAA. It should be noted that they are recorded as multiple factors, for example turbulence (TURB) leading to loss of control in flight (LOC-I). Similarly, other (OTHR) is also used and may include aspects that do not have specific classifications.

Air Accidents Investigation Branch Annual Safety Review 2019 20 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2019 Field investigations LOC-I 5 ARC 4 ATM 3 RI 1 USOS 1 UIMC 1 SCF-NP 7 SCF-PP 3 OTHR 8 RE 1 CTOL 1 MAC 2 LALT 1 EVAC 1 MED 1 FUEL 2 See Appendix 1 for category descriptions Factors for field investigations reported on by AAIB in 2019 In 2019 the AAIB published 29 field investigation reports, 12 of which were investigations into fatal accidents and 17 were into non-fatal accidents or serious incidents. The 17 investigation reports published during 2019 into non-fatal events were balanced between commercial air transport (CAT) and general aviation (GA) aircraft and were attributed to OTHR.

Air Accidents Investigation Branch Annual Safety Review 2019 21 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2019 Correspondence investigations UN.. FU.. F-P... RI C... AMAN AT.. 3 U... EVA.. 3 RAMP BIR.. 4 MAC 4 SCF-NP 57 LOC-G ICE 61 4 ADRM 4 NAV 5 WSTRW SCF-PP 7 41 ARC MED OTHR 86 7 74 F-IN 10 RE 36 TURB 11 LOC-I CTOL GCOL 28 21 31 See Appendix 1 for category descriptions Factors for correspondence investigations reported on by AAIB in 2019 Correspondence investigations are usually conducted into non-fatal accidents on GA aircraft and to some serious incidents on CAT aircraft. The factors most predominant in these occurrences were classified as abnormal runway contact (ARC), commonly the result of a hard or bounced landing or cross wind conditions.

Air Accidents Investigation Branch Annual Safety Review 2019 22 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2019 SCF-PP 2 SCF-NP 3 F-POST 4 LOC-I 8 OTHR 5 UNK 2 ARC 1 CTOL 1 GCOL 1 CFIT 1 NAV 1 UIMC 1 See Appendix 1 for category descriptions Fatal investigations Factors for fatal investigations reported on by AAIB in 2019

The predominant cause of fatal accidents in general aviation, in common with previous years, was loss of control in flight (LOC-I) such as a stall near to the ground. However, other factors identified during our investigations included physiological events.

Air Accidents Investigation Branch AAIB Annual Safety Review 2019 Air Accidents Investigation Branch Statistics for 2019 An overview of what we were involved with during 2019 can be seen below: © Crown copyright 2020 www.aaib.gov.uk @aaibgovuk Aircraft Accident Reporting - Telephone number +44 (0)1252 512299 UK Registered Overseas 45 Average months to publication for a Field Investigation 11.97 4.88 Average months to publication for a Correspondence Investigation Number of Correspondence Investigation Reports published (incl UAS and Rec-only) 173 Total number of Correspondence (AARF) Investigations opened 124 Number of Safety Recommendations 12 Referred to Sporting Associations 48 Number of Field Reports published (incl UAS) 29 Overseas (no AAIB involvement) 13 UK Fatal Accidents 8 Number of Deaths 10 Foreign Registered Overseas 51 Number of Formal Reports published n/a No further AAIB action (Civil) 392 Number of Special Bulletins published 2 UK Field Investigations opened (incl UAS) 37 n/a Average months to publication for a Formal Investigation Total Number of Notifications received by the AAIB 826 Number of Safety Actions noted 153 Investigation Statistics Number of UAS Correspondence Investigations opened 23 Military (AAIB assistance) 0 Joint Military & Civil Aircraft 0 Military (no AAIB involvement) 1 Record-only Investigations published 28 Record-only Investigations opened 115 Number of UAS Correspondence Investigations published 14 23

Air Accidents Investigation Branch Annual Safety Review 2019 24 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics

Introduction The following pages provide the statistics for 2019, 2018 and 2017 for accidents and serious incidents notified to the Air Accidents Investigation Branch. An explanation of the categories is as follows: Category definition UK Aircraft overseas Investigations involving UK registered aircraft, or aircraft registered in one of the UK Overseas Territories or Crown Dependencies, occurring in a Foreign State where the AAIB has participated in the capacity of Accredited Representative in accordance with ICAO Annex 13. Foreign Aircraft overseas Accidents and serious incident investigations to Foreign registered aircraft occurring in a Foreign State where the AAIB has participated in the capacity of Accredited Representative or Expert in accordance with ICAO Annex 13. UK Field Investigations Investigations involving the deployment of a ‘Field’ team within the UK or to one of the UK Overseas Territories or Crown Dependencies and those investigations where a team has not deployed but Safety Recommendations are made. Also includes investigations which have been delegated to the AAIB by another State. Unnmanned Aircraft Accidents and serious incident investigations to UAS where Systems (UAS) they are operated under a CAA permission, or are privately operated with mass greater than 20 kg. Military with AAIB Where an MoD aircraft accident, serious incident Service Assistance / Observer Inquiry may be convened, an AAIB Inspector is appointed to assist or observe. AARF Investigations Investigations conducted by correspondence only using an Aircraft Accident Report Form (AARF) completed by the aircraft commander. Overseas (no AAIB Notifications to the AAIB of an overseas event which has no involvement) AAIB involvement. Referrals to Sporting Investigations referred to the relevant UK Sporting Associations Associations. No further AAIB action Occurrences notified to the AAIB involving civil registered (Civil) aircraft which do not satisfy the criteria of an accident or serious incident in accordance with the Regulations. Military (no AAIB Notifications to the AAIB concerning Military aircraft with no involvement) AAIB involvement. Record-Only An occurrence that if investigated fully has little likelihood of Investigations identifying new safety lessons that will advance aviation safety.

Air Accidents Investigation Branch Annual Safety Review 2019 AAIB Air Accidents Investigation Branch Investigation Statistics

Notifications 2019 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 3 1 5 1 8 6 8 6 4 2 0 1 45 Foreign Reg Overseas 3 1 5 4 7 4 5 6 1 6 4 5 51 UK Field Investigations 2 3 2 3 3 4 4 4 4 2 2 4 37 Military (AAIB Assistance) 0 0 0 0 0 0 0 0 0 0 0 0 0 Total no of Correspondence Investigations (AARF) 11 20 11 14 11 10 14 13 6 6 5 3 124 Correspondence Investigations (AARF) involving UAS 3 3 3 2 0 2 1 0 4 2 2 1 23* Overseas (no AAIB involvement) 2 0 2 1 1 1 0 1 2 2 0 1 13 Referred to the appropriate Aviation Sporting Association 3 1 3 5 6 5 8 7 6 1 2 1 48 Record Only Investigations 1 1 1 7 11 15 22 16 14 7 6 14 115 Total no further AAIB action (civil) 22 23 26 26 23 45 49 33 44 40 36 25 392 Total no further AAIB action (civil) inv UAS 0 0 0 0 0 0 0 0 1 2 1 7 11* Military (no AAIB involvement) 0 0 1 0 0 0 0 0 0 0 0 0 1 Total 47 50 56 61 70 90 110 86 81 66 55 54 826 UK Fatal accidents 1 1 0 0 1 0 2 1 0 0 1 1 8 Number of deaths 2 1 0 0 1 0 2 2 0 0 1 1 10

• Included in the total

UK Registered Overseas numbers of AARF No further AAIB action 5.45% and non-reportable Referred to the appropriate Aviation Sporting Association Foreign Reg Overseas 6.17% UK Field investigations 4.48% Military (AAIB assist) 0.00% Correspondence investigation (AARF 15.01% Overseas (no AAIB) 1.57% Record Only investigations 13.92% No further AAIB action (Civil) 47.46% (Military) 0.12% investigations. 5.81% AAIB 24-hour Reporting - Telephone number © Crown copyright 2020 www.aaib.gov.uk +44 (0)1252 512299 @aaibgovuk 25

Air Accidents Investigation Branch Annual Safety Review 2019 26 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics

Notifications 2018 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 2 1 1 2 4 4 3 0 2 4 0 0 23 Foreign Reg Overseas 5 6 3 1 2 5 4 5 1 3 4 2 41 UK Field Investigations 2 4 0 3 2 3 4 2 0 5 1 0 26 Military (AAIB Assistance) 0 0 1 0 0 1 1 0 0 0 0 0 3 Total no of Correspondence Investigations (AARF) 7 14 9 16 28 29 34 24 20 20 12 8 221 Correspondence Investigations (AARF) involving UAS 1 1 0 0 1 1 1 0 2 3 0 1 11* Overseas (no AAIB involvement) 1 1 1 0 2 0 1 0 1 0 2 0 9 Referred to the appropriate Aviation Sporting Association 1 4 0 3 8 7 6 6 0 3 0 2 40 Total no further AAIB action (civil) 15 22 29 22 28 44 37 50 28 33 23 10 341 Total no further AAIB action (civil) inv UAS 0 0 2 0 1 1 3 2 0 1 1 1 12* Military (no AAIB involvement) 0 1 0 0 0 0 0 0 1 0 0 0 2 Total 33 53 44 47 74 93 90 87 53 68 42 22 706 UK Fatal accidents 1 0 0 1 1 3 1 0 0 2 0 0 9 Number of deaths 2 0 0 2 1 3 1 0 0 7 0 0 16 UK Registered Overseas 3% Foreign Reg Overseas 6% UK Field Investigation 4% Military (AAIB assist) 1% Correspondence Investigation (AARF) 31% Overseas (no AAIB involvement) 1% Referred to the appropriate Aviation Sporting Association 6% Non-reportable (Civil) 48% Non-reportable (Military) 0%

• Included in the

total numbers of AARF and non-reportable investigations.

Air Accidents Investigation Branch Annual Safety Review 2019 27 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics

                                           Notifications 2017 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 5 4 3 4 5 4 6 2 5 4 2 0 44 Foreign Reg Overseas 3 3 4 9 6 7 8 4 5 2 3 7 61 UK Field Investigations 2 3 4 2 6 3 2 4 5 1 2 4 38 Military (AAIB Assistance) 0 0 0 0 0 1 0 0 0 0 0 0 1 Correspondence Investigations (AARF) 9 7 15 15 36 29 24 25 17 11 10 6 204 Overseas (no AAIB involvement) 2 1 0 1 0 0 1 1 1 1 0 1 9 Referred to the appropriate Aviation Sporting Association 4 2 1 5 9 9 4 9 3 2 2 2 52 No further AAIB action (civil) 15 19 24 22 22 29 33 27 32 34 18 23 298 Military (no AAIB involvement) 0 1 0 0 0 0 0 0 0 0 0 0 1 Total 40 40 51 58 84 82 78 72 69 55 37 43 708 UK Fatal accidents 1 0 1 1 3 2 1 1 3 0 1 2 16 Number of deaths 1 0 5 1 4 2 2 2 4 0 4 3 28 UK Registered Overseas 6% Foreign Reg Overseas 9% UK Field Investigation 6% Military (AAIB assist) 0% Correspondence Investigation (AARF) 29% Overseas (no AAIB involvement) 1% Referred to the appropriate Aviation Sporting Association 7% Non‐reportable (Civil) 42% Non‐reportable (Military) 0%

Air Accidents Investigation Branch Annual Safety Review 2019 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk 28

Air Accidents Investigation Branch Annual Safety Review 2019 29 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Safety Recommendations in 2019 In 2019 the AAIB issued 12 Safety Recommendations from 5 investigations. 13 17 26 32 28 32 9 10 26 38 40 19 20 17 39 82 39 76 68 114 76 58 37 82 69 66 58 57 95 55 139 109 150 146 128 98 109 95 103 39 23 42 47 57 29 15 0 20 40 60 80 100 120 140 160 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 12 Recommendation numbers made in previous years Each addressee to a Safety Recommendation has to respond within 90 days in accordance with European Regulation EU 996/2010 Article 18, and detail what actions have been taken or are under consideration and the time expected to be taken for their completion. If no actions are being considered by the addressee they have to provide their reasoning for the decision. Monitoring of Safety Recommendations From 1 January 2019 the AAIB took responsibility for monitoring not only the responses but also the action taken by the addressees to Safety Recommendations. This is in accordance with the amendment that was made to ICAO Annex 13 in November 2018. The specific Paragraph 6.12 requires that; ‘A State that receives a safety recommendation shall implement procedures to monitor the progress of the action taken in response to that safety recommendation’. The AAIB carries out this function on behalf of the State Safety Board (SSB) for the UK, its Overseas Territories and Crown Dependencies. It is important to note that the AAIB monitors the progress of actions taken in response to a Safety Recommendation. The AAIB is not a regulator and cannot require action to be taken. The AAIB reports the progress to the SSB which then considers whether further regulatory intervention is required.

Air Accidents Investigation Branch Annual Safety Review 2019 30 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

This monitoring of actions is not only for Safety Recommendations issued by the AAIB but also those that have been issued to addressees in the UK from other State Accident Investigation Authorities. When the AAIB receives a response to a recommendation from the addressee it is assessed as to its adequacy under the requirements of Article 18 of Regulation (EU) 996/2010. The AAIB applies the following assessment criteria to the Safety Recommendation responses: ● Adequate means that the response fully meets the intent of the Safety Recommendation and the action is expected to address the safety issue. ● Partially Adequate means the response goes someway to meeting the intent of the Safety Recommendation and the action will address the safety issue to a certain extent, but further action would be required to fully address the issue identified. ● Not Adequate means that the response does not address the intent of the Safety Recommendation nor does it address the safety issue concerned. The AAIB will apply an open or closed status depending on the expectation of whether the addressee will reassess their response. ○ Not Adequate - Open The status of ‘open’ implies that AAIB still has concerns regarding the identified safety deficiency and that there is an expectation that the addressee will provide further responses. ○ Not Adequate - Closed The status ‘closed’ implies that there is a low likelihood that the addressee will act on the recommendation or provide any further responses. ● Superseded means the Safety Recommendation has been ‘Superseded’ either by a ‘newer’ and more comprehensive Safety Recommendation or actions have subsequently been taken by the addressee that have superseded the recommendation.

Air Accidents Investigation Branch Annual Safety Review 2019 31 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Actions taken on a Safety Recommendation are reported as meeting one of the following: ACTION STATUS Meaning Status ● Planned actions complete All planned actions are completed. Closed ● Planned actions partially completed Some of the planned actions have been completed and the addressee is not intending on taking any further action. Closed ● Planned actions not completed The planned actions have not been completed and the addressee now has no intention of taking any further action. Closed ● Planned actions ongoing update due (XX/XX/XXXX) Actions are still on-going and a new date for completion has been submitted Open ● Not enough information The update is not detailed enough to assess. A request will be made for a further update. Open ● No planned actions There are no planned actions Refer to Not Adequate A Safety Recommendation issued after 1 January 2019 will therefore remain Open until such time as the addressee has completed its activity in relation to that recommendation. It is therefore possible for the response to a Safety Recommendation to be assessed as Adequate but it will remain Open until the planned actions are completed. Of the 12 Safety Recommendations issued in 2019, as of the of 15 June 2020, responses have been received for 11 Safety Recommendations. The AAIB response assessment has classified those responses as follows: ● Four are Adequate, with planned actions completed, and are Closed. ● One is Adequate, with planned actions ongoing, and remains Open. ● Two are Partially Adequate with planned actions ongoing, and remain Open. ● Two are Partially Adequate with not enough information on the planned actions, and remain Open. ● Two are Not Adequate and are Closed. ● One is awaiting a response from the addressee.

Air Accidents Investigation Branch Annual Safety Review 2019 32 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Summary table Number Response Assessment Action Status Status 2019-001 Partially Adequate Planned actions ongoing update due 28 February 2020 Open 2019-002 Not Adequate No planned actions Closed 2019-003 Adequate Planned actions ongoing update due 1 June 2020 Open 2019-004 Adequate Planned actions complete Closed 2019-005 Partially Adequate Not enough information Open 2019-006 Adequate Planned actions complete Closed 2019-007 Partially Adequate Not enough information Open 2019-008 Adequate Planned actions complete Closed 2019-009 Adequate Planned actions complete Closed 2019-010 Awaiting Response Open 2019-011 Not Adequate No planned actions Closed 2019-012 Partially Adequate Planned actions ongoing update due 31 July 2020 Open Each Safety Recommendation is also defined as to whether it is a Safety Recommendation of European Union Wide Relevance (SRUR) or a Safety Recommendation of Global Concern (SRGC). Of those issued in 2019, nine were SRUR and three were SRGC. The AAIB, as well as all EU Member States, is required to record on the European Central Repository Safety Recommendation Information System (SRIS) all recommendations it raises and the response that are received. Data from SRIS is available to view publicly at: http://eccairsportal.jrc.ec.europa.eu/index.php?id=114&no_cache=1 Safety Recommendation Topics 0 1 2 Aircraft / Equipment / Facilities - Aircraft documentation Aircraft / Equipment / Facilities – Maintenance manuals Procedures / Regulations - Aircraft maintenance/inspection Aircraft / Equipment / Facilities - Aircraft equipment ­ Recorded data systems Procedures / Regulations - Aircraft flight manual Procedures / Regulations - Aircraft operations Procedures / Regulations - Oversight/Auditing Procedures / Regulations - Recorded data systems Procedures / Regulations – Safety management systems The chart above shows the recommendation topics using the ENCASIA taxonomy. Note - a recommendation can include several topics within the classification system. 3

Air Accidents Investigation Branch Annual Safety Review 2019 33 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Safety Recommendations issued in 2019 Notes: Safety Recommendation classification correct at time of publication. Safety Recommendations can also be made through AAIB Special Bulletins and are then also reflected in the final report. Reflects the situation with Safety Recommendations at 15 June 2020. British Aerospace BAe ATP, SE-MHF, on 3 May 2018 Synopsis The aircraft experienced a loss of DC electrical power during the cruise whilst operating a cargo flight from East Midlands Airport to Stansted Airport, resulting in the loss of a significant number of flight deck instruments and systems. The crew decided to return to East Midlands Airport where they made a normal landing, following which DC electrical power was restored without crew action. The loss of electrical power was consistent with a failure of the No 1 Transformer Rectifier Unit (TRU) or its contactor, followed by a subsequent failure of the DC essential busbar couple function. Subsequent testing of the aircraft’s electrical system did not identify the cause of either failure. The investigation identified that the aircraft’s FDR was recording intermittently due to corrosion caused by moisture ingress. Two Safety Recommendations are made, relating to the prevention of moisture entering the FDR on BAe ATP aircraft with the Large Freight Door (LFD) modification and for the replacement of flight recorders using magnetic tape. Intermittent fault within the FDR system The PV1584 FDR fitted to SE-MHF had an intermittent fault that caused nine hours of data not to be overwritten and the loss of data during several other flights. Inspection of the FDR found evidence of moisture within the electronics module. This most likely caused the intermittent operation of the magnetic-tape recording function. The moisture may have also prevented the correct operation of the BITE as no fault was noticed during the period of incorrect operation. Records showed that between 2010 and 2018, 35% of the PV1584 FDRs removed from BAe ATP aircraft contained evidence of moisture within the unit’s electronic module. The majority of these units required replacement of damaged connectors, with 22 FDRs confirmed as having failed due to moisture damage. The majority of FDRs found with moisture ingress were those that had been fitted to BAe ATP aircraft with the LFD. Discussions with engineers, and inspection of SE-MHF, indicate

Air Accidents Investigation Branch Annual Safety Review 2019 34 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

that rainwater can enter the cargo bay area during loading, which may then find its way into the rear equipment bay and the FDR. There was also some evidence that rainwater had dripped onto the FDR. Over time this will increase the probability of moisture entering the FDR and cause it to fail as corrosive products develop. Although tested for resistance to moisture ingress at certification, the PV1584 is not hermetically sealed and therefore moisture and liquids can easily enter the unit. Unlike later generation solid-state recorders, the unit was not required to be tested for its waterproofness or the potential effects of dripping water. Therefore, to minimise the effects of moisture ingress on the performance of the FDR fitted to the ATP, the following Safety Recommendation is made: Safety Recommendation 2019-001 made on 18 April 2019 It is recommended that the European Union Aviation Safety Agency (EASA) require BAE SYSTEMS to protect the flight data recorder fitted to those ATP aircraft equipped with large freight doors from the effects of rainwater and other liquids. Addressee response Received 3 July 2019 The European Union Aviation Safety Agency (EASA) has contacted BAE SYSTEMS to discuss the protection of the flight data recorder fitted to those ATP aircraft equipped with large freight doors from the effects of rainwater and other liquids. Response Assessment Partially adequate Action Status Planned actions ongoing, update due 28 February 2020 Safety Recommendation Status Open Magnetic tape obsolescence In response to an ICAO recommendation to discontinue the use of magnetic-tape FDR and CVR technology, EASA required the replacement of all magnetic-tape CVRs with a solid-state CVR by 1 January 2019. However, although EASA acknowledged that magnetic tape is unreliable, obsolete and ‘have an insufficient recording quality’, they did not require the replacement of magnetic tape FDRs. In addition to the operator of SE-MHF, which has indicated that it intends operating their BAe ATP fleet for several more years, there are also a small number of UK-operated aircraft that are equipped with a magnetic-tape FDR. Discussions with UK based MROs indicate that long-term support for this obsolete technology is declining. However, it may still be several years before aircraft operating in Europe with magnetic-tape FDRs are finally retired from service, or a lack of spares require an operator to install an alternative solid-state FDR.

Air Accidents Investigation Branch Annual Safety Review 2019 35 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

It is important that FDR systems are reliable and ensure high quality data is available to accident investigation authorities. Therefore, the following Safety Recommendation is made: Safety Recommendation 2019-002 made on 18 April 2019 It is recommended that the European Union Aviation Safety Agency (EASA) set an end date to prohibit the use of flight data recorders that use magnetic tape as a recording medium, to ensure compliance with ICAO Annex 6 from that date. Addressee response Received 3 July 2019 Prohibiting the use of flight data recorders (FDRs) that use magnetic tape as a recording medium was considered under European Union Aviation Safety Agency (EASA) rulemaking tasks RMT.0400 & RMT.0401 ‘Amendment of requirements for flight recorders and underwater locating devices’. The results of the related regulatory impact assessment (RIA) are contained in the associated notice of proposed amendment NPA 2013- 26, which was published on 20 December 2013. As described in the RIA, a conservative assumption was that, on 1 January 2013, 20% of FDRs installed on aeroplanes operated for commercial air transport by EASA Member State operators were using magnetic tape technology. The proportion of magnetic tape FDRs was assumed to decrease at a rate corresponding to the renewal rate of the fleets of aeroplanes of EASA Member State operators. Assuming an economic life cycle of 30 years for an aeroplane, the proportion of magnetic tape FDRs on board aeroplanes was expected to decrease by 10% every 3 years. With this assumption, by 1 January 2019 the proportion of aeroplanes fitted with a magnetic tape FDR was estimated to be close to 0%. Therefore, requiring the replacement of magnetic tape FDRs for a few residual inservice aeroplanes was considered not to be justified. Furthermore, prohibiting the use beyond 01 January 2019, of FDRs that use magnetic tape as a recording medium would need to be considered through a new rulemaking task which would be allocated a priority according to EASA’s established rulemaking planning process. The FDR is not needed for safe flight and landing, it does not directly improve the survivability of aircraft accidents, and the number of aeroplanes of EASA Member State operators potentially impacted by phasing out of magnetic tape FDRs is minimal, so that such a rulemaking task would most probably be allocated a low priority. Response Assessment Not adequate Action Status No planned actions Safety Recommendation Status Closed

Air Accidents Investigation Branch Annual Safety Review 2019 36 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Airbus A320, EI-CVB, on 3 February 2018 Synopsis A vehicle carrying out a runway inspection was cleared onto the active runway ahead of an aircraft decelerating after landing. The investigation identified shortcomings in runway inspection procedures and the management of the internal review conducted after the incident. Runway inspections The importance of effective runway inspection is borne out by the number of foreign objects found over a relatively short period at Gatwick Airport and the potential safety risk these pose to aircraft. Whilst this problem is not unique to Gatwick Airport, in its drive to maximise the use of its single runway, the airport has created an intensity of operations that makes the task of runway inspection more difficult to achieve. It is apparent from the investigation that both ATC and the airside operations teams were striving to carry out runway inspections under the prevailing working environment. There was, however, evidence of a lack of understanding of how each discipline’s work impacted on others operating at the airport and had potentially normalised procedures that would otherwise have been considered undesirable, or at worst unacceptable. The ATC and airport investigations were triggered by the pilot declaring his intention to file a safety report. The ATC report, subsequently adopted by the airport operations department, saw nothing wrong in what happened. This was reinforced by subsequent interviews with ATC staff and was in direct contrast to the opinion of the airline operator involved and of other airline operators, when asked. The ATC report justified the actions of the controller and operations staff as it considered the aircraft was committed to vacating at RET Foxtrot Romeo. This was based on the radio transmissions during the landing roll and ground radar recordings showing the aircraft moving off the centreline towards the exit as the operations vehicle entered the runway. The report, however, gave no consideration to the fact the aircraft appeared to be still on the centreline at the time the instructions were issued to the operations vehicle, the speed of the aircraft, the wet state of the runway and the implications had the aircraft, for whatever reason, needed to continue on the runway past RET Foxtrot Romeo. There was also no apparent understanding of the potential distraction caused by asking the crew questions at a time of high workload.

Air Accidents Investigation Branch Annual Safety Review 2019 37 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

These conclusions were inconsistent with the comments of the ATC manager who justified the actions based on the aircraft having been re-cleared, after it touched down, to vacate at RET Foxtrot Romeo: in effect an instruction during the landing to stop short of a particular position on the runway. It is not clear that this is in accordance with any recognised ATC procedure. In confirming the procedure to be adopted, SI 021 made no reference to re-clearing aircraft, but specified the need to ensure an aircraft ‘must clearly be established in the turn off the runway-centreline into the runway exit’ before a vehicle can be cleared onto the runway ahead of it. This statement leaves the risk, as already outlined, of an aircraft subsequently turning again to continue along the runway past the exit. In addition, SI 021 contains no information on the direction runway inspections should be performed. The guidance available to the controllers both in SI 021 and MATS Part 2 lacks relevant information published in the airport’s runway inspection SOP, such as communication procedures and actions in the event of a vehicle breakdown on the runway. There was also a lack of consistency between the existing guidance in MATS Part 2 and SI 021 on the desirability of conducting the runway inspection in one run. Safety Recommendation 2019-003 made on 15 August 2019 It is recommended that Air Navigation Solutions Ltd amend the wording of the Gatwick Airport Manual of Air Traffic Services Part 2, Chapter 10 and Supplementary Instruction 021 to specify how an aircraft is determined to have fully committed to vacating the runway, and ensure a vehicle cannot be cleared onto the runway ahead of an aircraft until the aircraft has done so. Addressee response Received 11 November 2019 ● The ANSP and the airport company have introduced a new regime for runway inspections including the introduction of planned (rather than ad- hoc) delivery of inspections and requirements to only accept inspections in blocks meaning urgent on/off access (as in the incident being reported upon) is no longer required and not used. ● The appendix to this letter contains the original text and the new text that has been submitted to the CAA to address the recommendation. The process to introduce this as an instruction included a review with the local examiners and an assessment of the effect that this change may have on workload and/or complexity. The instruction is now with the CAA for review and approval. Upon receipt of the CAA approval this instruction will be published. ● A follow-on review of safety performance regarding runway inspections in light of this incident and subsequent to the changes to the procedures

Air Accidents Investigation Branch Annual Safety Review 2019 38 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

implemented. The review revealed no incidents or reported events and standards reporting showed the introduction has been delivered safely. Response Assessment Adequate Action Status Planned actions ongoing, update due 1 June 2020 Safety Recommendation Status Open Boeing 737 4Q8, G-JMCR, on 12 October 2018 Synopsis The aircraft was operating a night flight to East Midlands Airport, with the left engine generator disconnected, and had just commenced its descent when the crew faced an unusual array of electrical failures on the flight deck. Despite the loss and degradation of a number of systems, the aircraft landed safely at East Midlands. The electrical failures were caused by the right engine Generator Control Unit (GCU) which had been incorrectly secured in its mounting tray and had disconnected in flight. The investigation also uncovered a number of contributory factors including: the management of defects and Acceptable Deferred Defects (ADD), recording of maintenance, and a number of weaknesses in the operator’s Safety Management System with regards to managing risk. Use of the minimum equipment list The operator did not appear to use the MEL in the spirit of EASA’s Acceptable Means of Compliance or its own procedures. Rather than using the MEL to allow the aircraft to return to its main operating base where the faults could be rectified, it appears to have been used to enable the aircraft to meet operational commitments. Fault finding, and rectification was frequently stopped before the root cause had been identified and on a number of occasions the aircraft was dispatched from a location where the work could have been carried out. The burnt pins on the feeder cable was a known fault. On 10 October 2018, an engineer correctly identified that there was a FF on Gen 1 and inspected the connector between the engine and pylon but ran out of time to check the connector between the pylon and wing where the burnt pin was located. The Rectification Interval Extensions (RIE) for the defect on Gen 1 should only have been granted in exceptional circumstances. However, while resources were available to identify and fix the fault within the specified time, the RIE was approved to enable the operator to meet operational commitments.

Air Accidents Investigation Branch Annual Safety Review 2019 39 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

There also seemed to be confusion with operations and engineering staff within the LMC and the Part M organisation as to what constituted a main operating base. It was commonly believed that a number of locations across their operating network that had Part 145 organisations could be considered as a main operating base and that it was acceptable for aircraft to be dispatched from East Midlands with an ADD operating in accordance with the limitations in the MEL. This was, however, contrary to the operator’s Operation Manual. The confusion as to what constituted a main operating base and the routine deviation from the operator’s procedures on the use of the MEL and RIE might have partly been due to the operator’s policy and procedures not being suitable for its routine operations. Therefore, the following Safety Recommendation is made: Safety Recommendation 2019-004 made on 28 August 2019 It is recommended that West Atlantic UK revises its policy and procedures for approving and clearing Minimum Equipment List entries and Rectification Interval Extensions to ensure that it conforms with the guidance contained within the European Union Aviation Safety Agency Acceptable Means of Compliance. Addressee response Received 17 December 2019 Signatories for RIE have received additional training in RIE approval, including detailed analysis of FSR to ensure application is within the regulatory requirements. MEL Revision 14, May 2019 updated to include: Changes to section 9.3.8 defining “maintenance bases” and “transit station” within a night program. Changes to section 9.5.3 giving the commander detail on the risk assessment of multiple defect within the context of the operation they expect. This guidance is meant as the last action before aircraft operation and supports the risk analysis process adopted by Part M within the LMC. The processes have been developed in conjunction with each other. All RIE’s have an accompanying SMS report filed which is investigated by Part M. A policy/organisational change has been implemented introducing a dedicated team of engineers tasked with monitoring on daily bases all deferred and repetitive defects (MEL). The defect control process started in May 2019 and was fully effective as from October 1, 2019. The defect control team is part of the Line Maintenance Control process and reports to the NPCA via the LMC Manager. For this purpose, a Defect Control application was introduced called Chronic’X. In addition, all aircraft defects are recorded in the FSR with actions taken, risk assessment and recovery plan in place. Daily meeting at 08:45, 7 days a week assess all open defects using the data in the FSR and Chronic’X.

Air Accidents Investigation Branch Annual Safety Review 2019 40 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Defect control team arrange parts, manpower and rectification plan to ensure rectification is completed expeditiously or before the open defect (MEL) expiry date. This system gives full control on approving and clearing of MEL entries. Weekly meeting the NPCA is briefed to ensure MEL oversight. The process is described in the LMC Company operating Procedure CoP 4.0 chapter 12- A follow-on review of safety performance regarding runway inspections in light of this incident and subsequent to the changes to the procedures implemented. The review revealed no incidents or reported events and standards reporting showed the introduction has been delivered safely. Response Assessment Adequate Action Status Planned actions complete Safety Recommendation Status Closed Operational management of defects The operator recognised that the management of defects and rectification across their fleet was challenging due to the nature of their operations. The aircraft were rarely in the same place on consecutive days and there were frequently changes to the flying programme, which made the provision of spares, specialist engineers and equipment difficult. The operator’s staff were also conscious of the tight turnaround times that their customers expected and whilst there was no evidence of external pressure having been applied to any individuals, there may have been an element of self pressure to ensure that aircraft were not delayed. Fault finding was frequently stopped part way through and on three separate occasions the GCU were swapped without the aircraft documentation having been completed in accordance with Commission Regulation (EU) No 1321/2014, (continuing airworthiness). The following Safety Recommendation is made: Safety Recommendation 2019-005 made on 28 August 2019 It is recommended that West Atlantic UK ensures that all work undertaken on its aircraft is documented in accordance with the requirements of Regulation (EU) No 1321/2014 (regarding continuing airworthiness). Addressee response Received 17 December 2019 The work undertaken on the aircraft are either covered by an SRP (Sector Record Page) entry with action taken and action reference of via a dedicated Work Order (WO) For Deferred Defects and or repetitive defects (MEL’s) dedicated Work Orders are raised by LMC for defect trouble shooting as required to either give trouble shooting advise and or have spare parts available.

Air Accidents Investigation Branch Annual Safety Review 2019 41 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

The procedure for issuing WO is laid down in CoP 4.0 chapter 12 in order to ensure work is properly documented and traceable in case of repetition. The FSR Fleet status listing log and Chronic’X and LMC shift handover application are put in place to monitoring and control that the correct MEL references and Airworthiness documentation is applied. Response Assessment Partially adequate Action Status Not enough information Safety Recommendation Status Open Management of defects policy The management of defects was primarily carried out by staff in the LMC. These individuals may be required to manage a number of issues on separate aircraft during their shift. Their main aim is to ensure that the company meets its operational commitments during their period of duty. The main oversight was undertaken during the 0600 hrs morning conference which involved representatives from LMC and the Part M organisation using the updates provided on the operator’s messaging system. Despite numerous entries on FSR highlighting concerns with the electrical system on G-JMCR, and the difficulty in completing the fault finding during the tight turnaround times, there was no evidence of a plan to ensure that the aircraft was given sufficient downtime to rectify the faults and clear the ADD. Instead, the issue drifted on with an RIE approval and a number of engineers at different locations repeating similar fault-finding tasks until eventually the GCU was incorrectly secured and disconnected in flight. The operator has addressed the situation by establishing the post of Defect Controller who reports through the Part M organisation. However, this individual is not available outside normal office hours or during periods of holiday or sickness. Moreover, the morning conference calls only take place during the normal working week which means that frequently only the operations supervisor and the LMC staff are in a position to undertake a dynamic risk assessment of the ongoing airworthiness of individual aircraft. While these individuals have the authority to prevent an aircraft flying if they believe it is unsafe to do so, it might not be apparent to them that this dynamic oversight is a key part of their job. The following Safety Recommendation is made: Safety Recommendation 2019-006 made on 28 August 2019 It is recommended that West Atlantic UK revises its policy and procedures to ensure effective management of defects, and the undertaking of dynamic risk assessments of the airworthiness of aircraft during all hours of operation.

Air Accidents Investigation Branch Annual Safety Review 2019 42 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Addressee response Received 17 December 2019 A new risk assessment application integrated into the FSR requires a risk assessment in the event an aircraft develops multiple deferred defects. The monitoring of deferred defect risk assessment is the responsibility of the LMC controller. LMC controller will take appropriate actions to mitigate identified hazards. The process is described in CoP 4.0 chapter 13 The process is described in CoP 4.0 chapter 1. Response Assessment Adequate Action Status Planned actions complete Safety Recommendation Status Closed Communicating with other Part 145 organisations The electrical fault that occurred during the landing at Amsterdam was unusual. Lights and screens that can only be on or off were flashing which indicated that there was an intermittent fault within the No 2 electrical system that eventually caused the circuit breaker for GCU 2 to trip. The Part 145 engineers did not have access to the operators FSR and would not have known the history of the electrical problems on the aircraft, which LMC described to the commander as serious. While the commander gave a detailed explanation to LMC as to the problems he had experienced, this was not relayed to the engineer who was tasked with rectifying the problem with Gen 2 and resetting the system so that the aircraft could return to East Midlands. No written tasking document, recent history of the aircraft or the concerns from LMC that there was a serious electrical problem on the aircraft were provided to the engineer. The engineer reset the system as requested and reported back to LMC who did not ask him to undertake any further work. The total time from the engineer being tasked to travelling to the aircraft and completing the work was 35 minutes. In completing the trouble shooting as laid out in the Maintenance Manual, the engineer had satisfactorily completed the task he was given, which was to investigate why the two serviceable generators were inoperative. But the circuit breaker that was found to have tripped could not have caused the intermittent electrical supply to the flight deck instruments. Significantly, no one appeared to address the potential increase in risk to the safe operation of the aircraft should the fault reoccur in flight while operating with one generator already inoperative in accordance with MEL 21-1b. The commander initially felt uneasy at the fault being cleared but was reassured when the engineer discussed what he had done with LMC: the engineer felt that his conversation with LMC was more to do with when the aircraft could be returned to service. In turn, the LMC was reassured by the commander, who was new to the company, and the engineer that the aircraft was now serviceable. However, the engineer in Amsterdam did not have knowledge

Air Accidents Investigation Branch Annual Safety Review 2019 43 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

of the ongoing electrical problems on the aircraft and none of the three parties discussed the impact of the fault on Gen Bus 2 reoccurring during the next flight. In summary, none of the three individuals involved had the full picture on the condition of the aircraft and a risk assessment was not carried out to determine if the aircraft was in a safe condition to continue flying with one generator inoperative. The following Safety Recommendation is made: Safety Recommendation 2019-007 made on 28 August 2019 It is recommended that West Atlantic UK revises its policy and procedures for the tasking of maintenance activities by Line Maintenance Control and the sharing of relevant aircraft technical history to ensure that maintenance organisations undertaking work have access to all appropriate information. Addressee response Received 17 December 2019 The technical log records all maintenance defects actioned against each airframe and is transferred into RAL, our approved maintenance management system. The WAcloud application “FSR” collects additional maintenance information on deferred maintenance activities. The Chronic’X system access data in both RAL and the FSR to provide a comprehensive source of information and feedback on defect control to support line maintenance with trouble shooting. The station engineers have access to the FSR for consultation if so required. Response Assessment Partially Adequate Action Status Not enough information Safety Recommendation Status Open Safety management system This investigation identified safety issues across a number of areas that had not been identified or addressed by the Operator’s SMS. Therefore, the following Safety Recommendations are made: Safety Recommendation 2019-008 made on 28 August 2019 It is recommended that West Atlantic UK revises its Safety Management System to meet the requirements of the scale and nature of their operation.

Air Accidents Investigation Branch Annual Safety Review 2019 44 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Addressee response Received 17 December 2019

1. To support the Head of Risk, Safety and Compliance a full-time Part M

Quality Engineer has been employed as of 1st November 2019. This will provide a dedicated resource with direct responsibilities for ensuring the policy of the Management System is effectively managed.

1. The Safety Management System has been modified to include additional

quality assurance and verification processes to monitor corrective and preventative actions introduced to mitigate risks within the operation.

1. Four additional part-time auditors have been employed in support of the

Compliance Monitoring programme.

1. Additional training courses have been implemented and delivered;

a) Advanced Safety and Compliance Course for Managers. b) Internal Auditors Course. c) Investigators Course. Response Assessment Adequate Action Status Planned actions complete Safety Recommendation Status Closed Safety Recommendation 2019-009 made on 28 August 2019 It is recommended that the Civil Aviation Authority assess West Atlantic UK’s Safety Management System to ensure it meets the requirements of the scale and nature of their operation. Addressee response Received 25 October 2019 The Civil Aviation Authority accepts this recommendation. The CAA has conducted an initial assessment of West Atlantic UK’s Safety Management System and continues to monitor compliance and effectiveness of this element of the organisation’s approval. Further assessments, including effectiveness, are scheduled to be completed by no later than February 2020. Response Assessment Adequate Action Status Planned actions complete Safety Recommendation Status Closed

Air Accidents Investigation Branch Annual Safety Review 2019 45 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

DHC-8-402 Dash 8-Q400, G-JECR, 15 November 2018 Synopsis Whilst climbing to FL190 en-route to Charles De Gaulle Airport, Paris the pilots received an alt mismatch message and they elected to return to Exeter Airport. Following an inspection after landing, a small white crystalline deposit was found covering three of the four static pressure holes on the left primary pitot static probe. It is probable that the use of a non-approved product, to improve the seal between a test adaptor and the pitot static probe during maintenance immediately prior to this flight, may have resulted in the blockage of the static holes and led to the alt mismatch message. Two Safety Recommendations have been made; one to the air data accessory kit manufacturer and one to the aircraft manufacturer to improve the instructions for the use of testing kits when carrying out leak tests of the pitot/static system and to only use approved lubricants. The maintenance organisation has taken Safety Action to introduce tighter controls on the test kit equipment. Instructions for use of air data accessory kits The kit manufacturer stated that the instructions for use of the air data accessory kit should be described in the relevant section of the AMM. The work orders issued by the maintenance organisation state that to accomplish a task it is to be done in accordance with the specific AMM task. However, the AMM does not provide any details on how to install the adaptors, which products should be used, or any additional information to aid the technicians to achieve a good seal between the probe and the adaptor. Therefore, to improve the information with the air data accessory kits, which are used on several different aircraft types, the following Safety Recommendation is made: Safety Recommendation 2019-010 made on 24 October 2019 It is recommended that Nav-Aids Ltd amend the manual supplied with air data accessory kits to include more specific installation instructions, and to include warnings against using non-approved materials to aid sealing.

Air Accidents Investigation Branch Annual Safety Review 2019 46 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Addressee response Awaited Response Assessment Awaited Action Status Awaited Safety Recommendation Status Open AMM instructions To improve the information in the AMM for the De Havilland Aircraft of Canada Ltd DHC-8-402 the following Safety Recommendation is made: Safety Recommendation 2019-011 made on 24 October 2019 It is recommended that De Havilland Aircraft of Canada Ltd amend the instructions in the Aircraft Maintenance Manual for the DHC-8-402 for testing pitot static probes to include more specific installation instructions, and to include warnings against using non-approved materials to aid sealing. Addressee response Received 22 April 2020 De Havilland Aircraft of Canada Ltd appreciates the chance to respond to your proposed Safety Recommendation. While safety is of upmost concern in our industry, it is our belief that, in this particular situation, any qualified technical staff should review and utilize the manual for any of the required pieces of test equipment that are external to the basic airframe. The information necessary to utilize the test equipment is specific to the each type of test equipment and different again, depending on each supplier of the various types of test equipment. Furthermore, these types of instructions are already available, as well as being authored by those who manufacture the equipment. One of the manufacturers has an on-line video available to aid use of a preferred lubricant for installation of the adapter (http://navaidsltd.net/LF5050-Lubricating-Fluid.html) Response Assessment Not adequate Action Status No planned actions Safety Recommendation Status Closed

Air Accidents Investigation Branch Annual Safety Review 2019 47 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Boeing 737-8AS, EI-GJT, 9 October 2018 Synopsis Shortly after reaching cruise at FL360 the commander’s attitude indicator malfunctioned affecting numerous aircraft systems, and the aircraft climbed 600 ft. After a significant time delay an irs caution was displayed. The Quick Reference Handbook (QRH) was followed by the crew and the left Air Data Inertial Reference Unit (ADIRU) was put into ATT mode. The left Primary Flight Display (PFD) continued to display erroneous attitude information to the pilot, and other systems were also affected. The aircraft was flown manually to Edinburgh where it landed safely. The left Inertial Reference System (IRS) suffered a transient fault in one of its accelerometers which led to an erroneous calculation of position. False position information led to the incorrect attitude information on the commander’s PFD, and the autopilot (AP) responded by initiating a slow climb. QRH guidance There was a significant period between the first symptoms of faulty attitude information and the appearance of the irs fault indication. Shortly after the attitude information failed, pitch and roll comparator annunciations appeared on both PFDs. While these flags indicate a failure, they do not decisively indicate where it lies. Pilots must use standby instruments to determine where the failure is and, if necessary, recover to the correct attitude through manual flight. Selecting a different source for the faulty PFD would remove the flags and restore valid attitude information on both pilots’ PFDs, although it would lead to a reduction in redundancy because all PFD attitude information would be from a single source. Information is available in the FCOM to aid crew understanding, but because of the expressed philosophy in the QRH discouraging troubleshooting, and the training discouraging the use of QRH checklists except in response to relevant associated warnings, it is unlikely crews will act unless specifically directed to do so by the QRH checklist. In these events, the failure occurred in VMC and straight and level flight and the outcome was benign. However, the PFD is a primary instrument which dominates a pilot’s display panel, and a failed attitude display presents a powerful disorientating stimulus to the relevant pilot. The comparator annunciation appears simultaneously in both PFDs and, if no action is taken, can remain as a significant distraction for the remainder of the flight. In manoeuvring flight it could be unclear where the failure lay, and the presence of the failed display would continue to constitute a disorientating factor. Boeing decided to amend the QRH checklist for irs fault but this would not address the situation where there was faulty attitude information but no IRS caution message.

Air Accidents Investigation Branch Annual Safety Review 2019 48 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Therefore, the following Safety Recommendation is made: Safety Recommendation 2019-012 made on 24 October 2019 It is recommended that Boeing Commercial Aircraft amend the Boeing 737 Quick Reference Handbook to include a non-normal checklist for situations when pitch and roll comparator annunciations appear on the attitude display. Addressee response Received 24 April 2020 Boeing has reviewed the Quick Reference Handbook (QRH) procedures for the 737 and compared the handbook to other Boeing models. The current PITCH and ROLL comparator annunciations are classified as flags in our certification documentation. Adding corresponding non-normal procedures to the QRH would require reclassifying the flags as alerts for certification purposes. Boeing is currently reviewing our certification documentation to understand all the potential effects of making the proposed changes. We will update the AAIB on the QRH change status by July 31, 2020. Boeing will also provide the AAIB with a copy of any changes upon their release. Response Partially adequate Action Status Planned actions ongoing, update due by 31 July 2020 Safety Recommendation Status Open

Air Accidents Investigation Branch Annual Safety Review 2019 49 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Safety Actions from investigations reported on in 2019 Early in an investigation the AAIB will engage with authorities and organisations which are directly involved and have the ability to act upon any identified safety issues. The intention is to prevent recurrence, and to encourage proactive action whilst the investigation is ongoing, and not for those involved to wait for the issue of official Safety Recommendations. When safety action is taken, it may mean there is no need to raise a Safety Recommendation as the safety issue is likely to have been addressed. The published report details the safety issues and the safety action that has taken place. In 2019 there were 153 Safety Actions recorded directly as a result of 18 field and 36 correspondence investigations. There were 88 commercial air transport (CAT), 48 general aviation (GA) and 17 unmanned air systems (UAS) Safety Actions undertaken in 2019. FIELD INVESTIGATIONS Auster AOP.9, G-BXON on 18 June 2017 The pilot was undertaking his second flight on the recently-restored vintage ex-military aircraft. Shortly after taking off from Spanhoe Airfield, the aircraft was observed to bank left into a steep descent and strike the ground to the left of the runway. The pilot was fatally injured, and the passenger sustained serious injuries. The investigation determined that the aircraft stalled at a low height, from which it did not recover before striking the ground. The investigation also identified several issues relating to the aircraft and engine performance, maintenance documentation, the Permit to Fly application process, and guidance for pilots preparing for their first flight on a new type. The Light Aircraft Association (LAA) has taken a number of safety actions. Safety actions: The Light Aircraft Association (LAA) has: ● Created a database of initial flight test performance results and introduced a process to compare future aircraft against other examples of the same type prior to permit issue. In the case of factory-built aircraft, scheduled performance figures, when available, will also form part of this consideration. ● Clarified the wording of the stall requirement in the Flight Test Schedule which relates to the speed at which stall warning will occur. The new wording emphasises that this requirement relates only to aircraft with artificial stall warning devices and reflects that some LAA aircraft may not be so equipped. ● Introduced a procedure whereby, when it issues a newly-constructed or newly-rebuilt aircraft with a Permit to Fly, it will write to the owner with any safety related observations on the submitted flight test results. The observations will include highlighting the absence of any stall warning features, particularly

Air Accidents Investigation Branch Annual Safety Review 2019 50 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

when the reported characteristics deviate markedly from that expected or from published data for the type. ● Produced guidance for pilots preparing for their first flight on a new type: it has published two magazine articles on the topic and has also produced a Technical Leaflet, TL 2.30 ‘Converting to a new type’, for use as a preparation tool, similar to the one provided for testing pilots. Subjects addressed include: researching a new aircraft type (eg by reviewing its operating manual, operating limitations and handling peculiarities); the planning and content of a first flight on type to become familiar with the aircraft alongside a suitably experienced pilot; the importance of beneficial weather conditions (eg consideration of density altitude); choice of appropriate flying clothing; and consideration of the desirability of carrying passengers both in terms of aircraft weight, and pilot recency and experience on type. ● In October 2018, revised TL 2.21 ‘Rebuilding an aircraft under the LAA system’ to include additional guidance on the completion of worksheets, the expected level of detail to be recorded, and reiterated the respective responsibilities of owners and inspectors for the quality and conformity of rebuild projects. Additional guidance relating to the integrity of riveted joints in rebuilt aircraft was also included, as was updated information to bring the LAA’s published guidance on minimum flight testing hours into line with actual practice, and to describe the factors that LAA Engineering considers when determining the initial flight test requirements for a given aircraft. ● In January 2019, issued Airworthiness Information Leaflet MOD/920/001‘AOP.9 Inspection of rivets securing the aileron operating rod end fittings’ which requires an inspection of the aileron control rod rivets on all AOP.9s within its fleet to identify the type and condition of rivets installed, and appropriate rectification according to the findings of the inspection. Piper PA-31, N250AC on 6 September 2017 Approximately 20 minutes after takeoff from a private airstrip in Cheshire the pilot reported pitch control problems and stated his intention to divert to Caernarfon Airport. Approximately 5 minutes later, the aircraft struck Runway 25 at Caernarfon Airport, with landing gear and flaps retracted, at high speed, and with no noticeable flare manoeuvre. The aircraft was destroyed. The elevator trim was found in a significantly nose-down position, and whilst the reason for this could not be determined, it is likely it would have caused the pilot considerable difficulty in maintaining control of the aircraft.

Air Accidents Investigation Branch Annual Safety Review 2019 51 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

The extensive fire damage to the wreckage and the limited recorded information made it difficult to determine the cause of this accident with a high level of confidence. A possible scenario is a trim runaway, and both the CAA and the EASA are taking safety action to promote awareness for trim runaways as a result of this accident. Safety actions: As a result of this investigation the EASA have undertaken action to promote awareness of trim runaways as part of its General Aviation safety promotion plan. It also intends to include trim runaway as part of a wider technical safety project, studying various technical failure scenarios. Also, as a result of this investigation the CAA plans to produce a coordinated package of educational information on trim runaway, including a video, Clued Up article and online information which will be targeted at GA pilots. Both authorities have indicated that they intend to work together on the subject for a coordinated approach and to ensure a broad reach. DHC-8-402 Dash 8 Q400, G-JEDU on 10 November 2017 The aircraft was carrying out the third sector of a four-sector day from Belfast City Airport to Inverness Airport. After takeoff, the landing gear was selected up. Cockpit indications indicated that the main landing gear (MLG) retracted normally but the nose landing gear (NLG) did not. The crew carried out the actions in the relevant abnormal checklists and were unable to lower the NLG. After burning off fuel, the aircraft was diverted to Belfast International Airport where it landed with the NLG retracted. The crew initiated an emergency evacuation. It was determined that a damaged electrical harness on one of the nose landing gear proximity sensors caused an erroneous signal, which resulted in the forward NLG doors starting to close while the NLG was still in transit to the up position. The nose landing gear tyres contacted the forward doors, causing the NLG to rotate off-centre. Although the NLG subsequently retracted, the forward doors remained open and the tyres became jammed in the NLG bay. This prevented the nose landing gear from extending when subsequently commanded.

Air Accidents Investigation Branch Annual Safety Review 2019 52 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

The damage to the harness resulted from a cyclically-driven fatigue failure mechanism, which occurred because the harness had been secured with a non-flexible cable tie which restricted it from flexing during normal nose landing gear operation. Safety actions: The aircraft manufacturer has: ● In October 2018, issued a Service Letter to inform operators of the Dash 8 Q400, of the correct routing of the nose landing gear lock (NGLK) sensor harnesses. ● In November 2018, issued Service Bulletin 84-32-157 to inspect the NGLK sensors for correct routing and signs of wear, abrasion or fretting. ● In January 2019, updated three AMM tasks in order to clarify the harness routing, provide instructions for the location of the rubber lacing, to add cautions indicating that harnesses should not be retained or restricted at locations other than the specified p-clips and to correct a routing installation illustration. The operator has: ● Throughout August and September 2018, the operator carried out an inspection of the nose landing gear proximity sensor harness routing on its Dash 8 Q400 fleet and undertook rectification of any anomalies noted. EMB-145EP, G-CKAG on 22 December 2017 The flight crew were conducting an ILS Category II1 approach and landing on Runway 27 at Bristol Airport. On touchdown they noticed that the aircraft de-rotated sharply. The pilot flying (PF) was unable to maintain directional control during the landing roll and the aircraft ran off the left side of the runway onto the grass. At some point during the landing the throttles were moved forward, reducing the rate of deceleration. As the aircraft left the paved surface the crew realised that the landing had been carried out with the Emergency/Parking brake set. The aircraft may have remained on the runway surface but for the addition of forward thrust during the landing roll. Safety action: The operator introduced a revision to the Landing Checklist in the Operations Manual which requires the handling pilot to confirm the parking brake is off. Decision height lower than 200 ft but not lower than 100 ft and RVR of not less than 350 m. 1

Air Accidents Investigation Branch Annual Safety Review 2019 53 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Agusta Westland AW189, G-MCGR on 17 February 2018 The helicopter was tasked to rescue three climbers in the area of the Beinn Narnain mountain. The flight was at night and the crew made several attempts to reach them from different directions but due to low cloud were unable to do so. On the fourth attempt, from another direction, the visual references seen through each pilot’s Night Vision Imaging System (NVIS) were lost and a turn back down the re-entrant was attempted. Due to the proximity of the ground, the pilot climbed the helicopter but lost airspeed after which the helicopter yawed to the right. The Pilot Flying (PF) attempted to use the Automatic Flight Control System (AFCS) upper modes to assist him but decoupled them because they caused the collective control lever to lower. The helicopter spot-turned through some 370° before regaining VMC on top. Control was regained and the aircraft subsequently landed. The crew liaised with the Mountain Rescue Team (MRT) who recovered the climbers on foot. Safety action: Shortly after the incident, the operator introduced a scenario-based training exercise for all pilots that reproduced the incident during six-monthly recurrent training and testing. The training was continued with an emphasis on unusual attitude recovery. EC135 P2+, G-POLA on 5 April 2018 During a maintenance flight to adjust engine speed, main rotor rpm varied between its maximum and minimum continuous limits. A mechanical stop within the adjusting potentiometer had failed in such a way that main rotor speed could not be controlled accurately, putting the helicopter at a significant risk. The pilot had not been specially trained to carry out the flight test but his actions in flight prevented rotor speed exceeding its limits and a more serious outcome. The manufacturer and operator have taken safety action regarding the conduct of airborne engine speed adjustments. Safety actions: The manufacturer has: ● Issued an AMM amendment regarding the N2 adjuster installation procedure (76-11-00,8-4), a caution to install the stop ring correctly / take care that the ring is not forgotten.

Air Accidents Investigation Branch Annual Safety Review 2019 54 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

● Issued an AMM amendment regarding N2 adjustment maintenance flights (05-60-00, 6-4), to check, prior to flight while on ground without power, that the N2 adjustment switch works properly (only three switch positions are possible ­ decrease, neutral, increase). After successful check the switch must be turned into the neutral position. ● Issued Safety Information Notice AH 3254-S-76: ‘Engine Controls – Engine Power Turbine Speed (N2)’ to draw attention to this occurrence, remind operators of the procedure, and to highlight the difference in N2 adjustment procedures between the P2 and T2 Series EC135 helicopters. ● Has undertaken to inform operators of all its helicopter types of the circumstances of the occurrence to G-POLA, reminding them of the importance of the specific pilot skills required by all AMM post maintenance flying tasks. The operator: ● Has categorised its flight test activities according to which of its pilots should perform them. It has restricted the N2 adjustment flight procedure to the remit of specially trained type rating instructor and examiner pilots. ● Intends to incorporate the incident scenario in to its newly established simulator training package. Cessna 152, G-UFCO on 19 April 2018 The purpose of the flight was to carry out aerial photography. During a manoeuvre at low level the aircraft stalled and descended rapidly, passing through some trees, before striking the ground. There was a post-crash fire and neither occupant survived. Safety action: Since the accident the flying club has issued instructions to their pilot members to remind them of their responsibility to understand and comply with the privileges of their licences and ratings. The club flying instructors have been reminded not to authorise any rental flight where there may be any doubt as to its purpose. The club is also re­ drafting the flying order book and aircraft hire/rental agreements to make it clearer as to what can and cannot be undertaken in a hired aircraft. Additionally, the club intends to provide warning signage/posters to remind pilots and passengers of the restrictions and implications of travelling for any kind of payment in light aircraft.

Air Accidents Investigation Branch Annual Safety Review 2019 55 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Cessna 172M Skyhawk II, N9085H on 30 April 2018 Shortly after takeoff the aircraft exhibited a tendency to pitch nose down despite the application of nose up trim. During the subsequent approach to land, the forces required to maintain the approach path increased to the point where the pilot could no longer control the glidepath and the aircraft struck the ground short of the runway. The investigation found that the drive chain for the elevator trim actuator had been fitted incorrectly, which resulted in the elevator trim tab moving in the opposite sense to the movement of the trim wheel. The maintenance organisation has introduced procedures to ensure that duplicate inspections of all flight critical systems are carried out following maintenance. Safety action: The Bermuda-based maintenance organisation has introduced procedures to ensure that duplicate inspections of all flight critical systems are carried out, in line with its BCAA-approved maintenance procedures, on any aircraft that they operate or maintain, regardless of its State of Registration. Guimbal Cabri G2, G-PERH on 8 June 2018 While conducting a Simulated Engine Failure from the Hover (SEFH) the helicopter yawed rapidly to the left. Despite the actions of the pilots the helicopter continued to yaw rapidly, and control was not recovered. The helicopter was seen to climb while spinning before descending rapidly and contacting the ground, sustaining severe damage. Both occupants suffered serious injuries. Safety actions: As a result of this, and other similar events, the manufacturer published in February 2019 two Service Letters to prevent reoccurrence. They are available on its customer support portal. ● SL19-001 - Throttle management during simulated engine failure. This service letter provides an explanation of the engine governor / correlator system and the need to ensure the twist grip throttle is fully closed whilst practicing certain manoeuvres. It proves advice to flight instructors on how to position the hand on the throttle grip to enable the throttle to be closed in one movement and therefore ensuring the engine throttle does not open when the collective is raised.

Air Accidents Investigation Branch Annual Safety Review 2019 56 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

● SL19-002 - Controllability in yaw at low rotor speed. This service letter proves advice on yaw control when operating with low rotor speeds. It includes a list of scenarios where yaw control could be lost and mitigating actions to prevent loss of control. One scenario is Simulated Engine Failure from the Hover. When operating at low rotor speeds with full or almost full right pedal applied it is recommended not to raise the collective but keep it as low as possible and increase forward airspeed by cyclic input, and not to increase the rotor speed by turning the twist grip. Grob G109B, G-KHEH on 10 June 2018 The aircraft collided with a dead tree whilst conducting a field landing exercise. It has not been possible to determine conclusively whether the aircraft was suffering from an engine problem, most likely carburettor icing, during the descent, however, the engine was under power at the point it collided with the tree. Had it been necessary, the aircraft should have been able to avoid the tree and carry out a landing in the field beyond. It was considered most likely that the pilots did not see the tree until it was too late to avoid it. Safety action: The BGA publication on 11 July 2018 in response to this and previous field landing accidents sets out the main hazards and precautions required in conducting field landing training. Accident site 0958:24 – aircraft on approach heading, 674 ft amsl 0957:02 – Descent from 1,078 ft amsl AS350B2 Ecureuil, G-PLMH on 13 June 2018 Whilst the helicopter was performing an underslung load operation at Loch Scadavay the boat it was carrying became unstable and flew upwards, causing the lifting line to strike the helicopter’s tail rotor. The helicopter became uncontrollable and descended rapidly into the loch, fatally injuring the pilot. The physical characteristics of the boat and the method by which it was carried increased the probability of it becoming unstable. Safety actions: As a result of this accident, the operator has taken a number of safety actions intended to prevent similar accidents in the future.

Air Accidents Investigation Branch Annual Safety Review 2019 57 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

These are as follows: ● Temporarily curtailed Helicopter Exernal Sling Load Operation (HESLO) involving the carriage of boats, caravans and aeroplanes. ● Released a Safety Information notice reminding pilots and Task Specialist Air (TSA) that helmets must be worn onboard, which must fit and be properly secured at all times. ● Increased the length of the standard lifting line for Identification of Unstable or Potentially Unstable Loads (UoPULs) to 20 m, with an associated airspeed limit of 60 KIAS. Where shorter lifting lines are required, the airspeed limit is 40 KIAS and, for some operations, 30 KIAS. ● Added a section on UoUPL to its HESLO 1 pilot training syllabus. This contains sections on low-density loads and aerodynamic shape, and refers to load orientation. It states that ‘any change in the status of a load in flight calls for an immediate reduction of speed below 40 KIAS’. ● Significantly expanded its Specialist Operation (SPO) Manual and Ground Handler’s Manual guidance on the preparation and acceptance of loads to emphasise UoPULs. This includes information on low-density loads and aerodynamic shape, and methods of rigging loads to increase their stability, eg cargo nets, and amalgamation. ● Provided guidance in its Ground Handler’s Manual which explains that pilots and Task Specialist Ground (TSG) should examine UoPULs together. Adequate time must be allowed to assess and rig UoPULs, and to put adequate control measures in place. Customer expectations should be managed accordingly. ● Added a section on flying techniques for UoPUL to its SPO Manual, which includes: accelerate in 10 KIAS increments; continually observing the load in the mirror; if the line goes slack, jettison the load; and states that ‘the company will support any pilot who declines to carry [a UoPUL] on the grounds that he is not able to put in place adequate control measures’. ● Undertaken to continue with its plan to extend its Crew Resource management (CRM) training throughout the organisation and bring more of that training ‘in- house’. ● Undertaken to produce written guidance on decision making. Furthermore, to select and endorse a decision making aid company-wide and incorporate it in to CRM training.

Air Accidents Investigation Branch Annual Safety Review 2019 58 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Rutan Long-Ez (Modified), G-BPWP on 7 July 2018 The pilot was operating his aircraft with a mixture of automotive gasoline (Mogas) and aviation gasoline (Avgas) 100LL in the left fuel tank and Avgas 100LL in the right fuel tank. While on base leg to land on Runway 04 at Dunkeswell Airfield the engine, which was being supplied with fuel from the left fuel tank, suddenly stopped. The pilot established a glide to land in a field in the undershoot, but at a late stage in the approach he spotted a fence running across his chosen landing site. Whilst manoeuvring to avoid the fence the aircraft touched down firmly, seriously injuring the pilot; the passenger sustained minor injuries. The likely cause of the engine stopping was either carburettor icing or a vapour lock in the aircraft fuel supply to the engine. Safety action: The LAA have advised that they will use this accident to publicise the risk from vapour lock when operating piston engines on Mogas. Cessna 150M, N66778 on 18 July 2018 N66778 was taking off from Beef Island, in the British Virgin Islands (BVI), on the sixth sector of a delivery trip from Florida to Argentina. After takeoff the aircraft was seen to fly along the length of the runway at slow speed in a nose-high attitude. It then turned left before entering a steep nose dive and hitting the sea. The investigation concluded that the aircraft stalled during the left turn. No evidence of any mechanical failure was found. The aircraft was likely to have been operating slightly above the Maximum Takeoff Weight and with the centre of gravity aft of the approved limit. Several items were not secured in the cabin which could have shifted aft during the takeoff roll moving the centre of gravity further aft. It is possible that this aft centre of gravity caused control difficulties resulting in the stall. Improvements in emergency communications on BVI have been made following the accident. Safety action: As a result of this accident the BVI Airports Authority (BVIAA) has taken action to ensure that Virgin Island Search and Rescue (VISAR) can now be contacted directly by ATC if they cannot be alerted via the 911 operator.

Air Accidents Investigation Branch Annual Safety Review 2019 59 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Boeing 737-800, EI-FJW and Airbus A320-214, OE-IVC on 13 August 2018 OE-IVC EI-FJW A landing Boeing 737 closed to within 875 m of a departing Airbus A320 when landing at Edinburgh Airport. The airport air traffic control service provider defined this as a runway incursion as the 737 was over the runway surface when the A320 was still on its takeoff roll. A combination of factors, including brief delays to the departure of the A320 and the speed of the Boeing 737 being higher than normal, led to the reduction in separation before the controllers became aware of the closeness of the aircraft. The trainee controller lacked the experience to resolve the situation in a timely manner and the supervising OnTheJob Training Instructor judged it safer to let the 737 land than to initiate a goaround in proximity to the departing aircraft. The Air Navigation Service Provider (ANSP) has conducted a review of High Intensity Runway Operations at Edinburgh and taken a number of safety actions to improve procedures and on-the-job training for trainees. Safety actions: The ANSP at Edinburgh has taken the following safety actions in response to this incident: ● Published procedures in the Edinburgh MATS Part 2 regarding what events must be entered as Manditory Occurrence Reporting (MOR) on the TOKAI2 system. ● Conducted a review of High Intensity Runway Operations at Edinburgh. ● Conducted a review of On the Job Training Instructor (OJTI) competency and introduced refresher training for all OJTIs as an outcome of the review. ● Has introduced additional higher OJTI chairs to provide OJTIs with a better view of the trainee, the screens and the trainee interactions with the equipment. ● Has reminded OJTIs of the requirement in the Unit Training Plan which mandates the requirements for a pre-training briefing between the OJTI and the trainee controller prior to every training session or at least every training day. ● Has incorporated a one-sheet overview of trainee ATCO’s experience in their training file covering what key conditions and procedures they have experienced (eg fog, wind, go-arounds, significant slot delays, weather avoiding, snow etc). TOKAI - web-based application for air traffic management that enables users to report, investigate and take corrective action following incidents and accidents. 2

Air Accidents Investigation Branch Annual Safety Review 2019 60 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Czech Sport Aircraft Sportcruiser, G-CGEO on 7 October 2018 The aircraft’s right main landing gear (MLG) leg was damaged following a normal landing at Fowlmere Aerodrome. Investigation of the failed MLG leg revealed a manufacturing defect that caused the progressive delamination of the leg during service. Safety action: The aircraft manufacturer is currently certifying a reinforced MLG leg, part number SG0160L/P, intended to increase the durability of the legs in service. This new MLG will be available for retrofit to all models of Sportcruiser and PS-28 Cruiser aircraft. In addition to slightly enlarging the MLG leg cross-section, the inflatable tubes and stretch film material used during leg manufacture are now surrounded by a woven glass fibre ‘sock’, to prevent radial migration of the stretch film into the leg’s composite structure. Boeing 737-8AS, EI-GJT on 9 October 2018 Shortly after reaching cruise at FL360 the commander’s attitude indicator malfunctioned affecting numerous aircraft systems, and the aircraft climbed 600 ft. After a significant time delay an irs caution was displayed. The Quick Reference Handbook (QRH) was followed by the crew and the left Air Data Inertial Reference Unit (ADIRU) was put into ATT mode. The left Primary Flight Display (PFD) continued to display erroneous attitude information to the pilot, and other systems were also affected. The aircraft was flown manually to Edinburgh where it landed safely. The left Inertial Reference System (IRS) suffered a transient fault in one of its accelerometers which led to an erroneous calculation of position. False position information led to the incorrect attitude information on the commander’s PFD, and the autopilot (AP) responded by initiating a slow climb. One Safety Recommendation is made concerning the Boeing 737 QRH. Safety action: Following this incident, Boeing decided to amend the QRH checklist for irs fault. The reference to ATT mode would be removed and the checklist would direct crews to use the IRS Transfer Switch to supply relevant aircraft systems from the serviceable side.

Air Accidents Investigation Branch Annual Safety Review 2019 61 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Boeing 737-4Q8, G-JMCR on 12 October 2018 The aircraft was operating a night flight to East Midlands Airport, with the left engine generator disconnected, and had just commenced its descent when the crew faced an unusual array of electrical failures on the flight deck. Despite the loss and degradation of a number of systems, the aircraft landed safely at East Midlands. The electrical failures were caused by the right engine Generator Control Unit (GCU) which had been incorrectly secured in its mounting tray and had disconnected in flight. The investigation also uncovered a number of contributory factors including: the management of defects and Acceptable Deferred Defects (ADD), recording of maintenance, and a number of weaknesses in the operator’s Safety Management System (SMS) with regards to managing risk. Safety actions: As a result of this serious incident, and the findings of the AAIB, the operator has stated that they will take the following safety actions: ● Redefine the criteria of a maintenance base with each aircraft allocated to a specific maintenance base dependent on the route flown. ● All ADDs will be monitored daily and best endeavours made to rectify them within 48 hours. Where this time limit is not achieved an occurrence report will be raised to enable an investigation to be carried out to establish why this was not possible. ● A Safety Report will be raised via the SMS for all RIE applications. ● Monitor in real-time the management of ADD and RIE applications using a number of Performance Indicators over a 12-month rolling period. ● Line Maintenance Control (LMC) will be informed of all intended deferred defects before actual deferral. ● Prior to deferral of a defect, a risk assessment based on the source of the fault and subsequent impact on the aircraft systems and operational limitations will be carried out by an engineer in consultation with the crew. LMC will provide historical defect information relevant to the unserviceable system in question and knowledge of the aircraft’s historical airworthiness generally. ● An additional status header of ‘Risk Assessment’ has been added to the Flight Safety Reporting (FSR). A summary of the risk assessment will be documented in the FSR against the deferred defect highlighting significant risks that are associated with the aircraft’s airworthiness status. ● A review of persons authorised to ground a serviceable aircraft without reason and with good reason following a risk assessment has been carried out.

Air Accidents Investigation Branch Annual Safety Review 2019 62 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

● Procedural deficiencies were identified in the following processes. A compliance review of these areas had been planned for completion by 31 July 2019 with corrective and preventative actions identified implemented by 30 September 2019. ○ Risk management of deferred defects. ○ Rectification management of deferred defects. ○ Interface between LMC and remote Part 145 organisations. ○ Standardisation of policy across all departments concerning deferred defect control. DHC-8-402 Dash 8 Q400, G-JECR on 15 November 2018 Whilst climbing to FL190 en-route to Charles De Gaulle Airport, Paris the pilots received an alt mismatch message and they elected to return to Exeter Airport. Following an inspection after landing, a small white crystalline deposit was found covering three of the four static pressure holes on the left primary pitot static probe. It is probable that the use of a non-approved product, to improve the seal between a test adaptor and the pitot static probe during maintenance immediately prior to this flight, may have resulted in the blockage of the static holes and led to the alt mismatch message. Two Safety Recommendations have been made; one to the air data accessory kit manufacturer and one to the aircraft manufacturer to improve the instructions for the use of testing kits when carrying out leak tests of the pitot/static system and to only use approved lubricants. The maintenance organisation has taken Safety Action to introduce tighter controls on the test kit equipment. The air data accessory kit manufacturer recommends the use of LF5050 to aid installation and the avionics technicians stated that it is often missing from the kit box due to kit control issues. It is possible therefore that to ‘get the job done’ the technicians may resort to other more easily available products with the unintended consequence, in this case, of residual grease blocking some of the static holes. As a result of this investigation the following safety action has been taken: Safety action: The maintenance organisation has purchased new air data accessory kits and implemented tighter tool control of the kits to ensure all the components are always available. Forward Outboard

Air Accidents Investigation Branch Annual Safety Review 2019 63 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

CORRESPONDENCE INVESTIGATIONS Aeryon Skyranger R60, (UAS) SR9112798 on 18 January 2018 After takeoff the unmanned aircraft (UA) experienced winds exceeding the manufacturer’s stated limitations and was unable to hold its position position. A culmination of the subsequent position warning and automatic attempt to return “home” and land triggered a software error, commanding the UA to land while not over its home position. As the UA descended there was a loss of link with the ground control unit and the UA collided with a tree. The loss of signal was probably caused by the loss of radio line of sight between the UA and ground control unit when it drifted in the high wind over a five-storey building. Safety actions: As a result of the accident, the operator carried out a comprehensive review of their procedures as well as liaising with the manufacturer on the technical aspects of the accident. As a result, the operator has introduced a number of safety actions. These include: ● Ensuring software checks and updates are integrated into the maintenance procedures. ● Ensuring at least one member of the operating team is experienced in operating the system and introducing a mentoring scheme to provide opportunities to increase experience levels with appropriate oversight. ● Providing information on the most appropriate sources of weather information to be used in planning and operating flights and ensuring these take into account actual, as well as forecast, weather conditions. ● Providing pilots and observers with training on weather effects experienced in a built-up environment, especially related to wind. ● Introducing reduced wind limits on the operation of UAS to allow a safety factor, mitigating the risk of exceeding the limits. These will also be varied to take account of each pilot’s experience. ● Revised training on the assessment of ground station transmitter siting to minimise the likelihood of signal loss. ● Review of incident and accident reporting procedures. MBB-BK 117 D-2 EC145, G-RMAA on 3 May 2018 The pilot of the Helicopter Emergency Medical Service (HEMS) helicopter took off from a car park in variable wind conditions. Once airborne the helicopter yawed to the left and the pilot attempted to correct by applying opposite anti-torque pedal, but it continued to rotate. He lowered the collective and as the helicopter landed, its fenestron contacted a low wall on the perimeter of the car park. Most of the pilot’s experience had been on another type

Air Accidents Investigation Branch Annual Safety Review 2019 64 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

of helicopter and he had made inputs consistent with controlling that aircraft, which were insufficient in this instance. The operator has reviewed the circumstances of the accident and has taken two safety actions as a result. Safety actions: As a result of this event the operator has re-briefed all of its pilots on the possible consequences of remaining light on the skids when lifting into the hover. The operator has also updated their Operations Department Communication (ODC) to reflect the most recent EASA Acceptable Means of Compliance and refer to dimensions of both the EC135 and the EC145. Cameron A-300 hot air balloon, G-VBAD on 18 May 2018 A passenger fell off the basket onto the ground whilst attempting to board before flight and was seriously injured. Safety action: The operator has stated that it now briefs passengers to take extra care when climbing in or out of the basket and suggests to some passengers that preloading might be a better option for them than climbing in after the envelope has been inflated. Just Super STOL XL, G-SSXL on 10 June 2018 The aircraft was on a test flight prior to being issued with a Permit to Fly. Shortly after takeoff the engine failed. During the subsequent forced landing the aircraft landed firmly, sustaining severe damage. One of the two pilots suffered serious injuries. It is believed that the engine failure was caused by fuel vaporisation as a result of high engine compartment temperatures. Safety actions: In consultation with the engine manufacturer, the owner stated he would have the engine cowlings redesigned to increase the intake airflow and modify the engine

Air Accidents Investigation Branch Annual Safety Review 2019 65 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

layout by relocating the fuel pumps and cooling fuel returning to the header tank. These changes are intended to reduce the possibility of a fuel vapour lock recurring. ● LAA Technical Leaflet TL 2.263 highlights the procedures for using unleaded Mogas in piston engines. Due to the greater risk of vapour lock the LAA has stated that when using Mogas the temperature of fuel in the tank must not exceeding 20°C and the aircraft must fly below 6,000 ft. ● The LAA plans further flight tests over a range of weights to gain more accurate approach speed data for this aircraft type. ● The LAA has stated that it will review how it manages the testing of new engine types and engine installations. One option being considered is the download of the ECU’s data as part of the engine’s initial testing, so that all available measured parameters can be checked against the manufacturer’s stated limitations. Britten-Norman BN-2B-21 Islander, VP-AEJ on 4 July 2018 During a short flight between the islands of Saint Eustatius and Saint Kitts, in the Caribbean, the pilot noticed that the ailerons felt “sluggish” but the aircraft landed successfully at Saint Kitts. It was found that a drive rod for the right aileron had broken and a spherical bearing, fitted to one end of the rod, had corroded heavily and was seized. Several safety actions have been taken to reduce the maintenance interval for control rods due to an increased risk of corrosion from the environmental factors where the aircraft operated. This investigation was delegated by the Dutch Safety Board to the AAIB in accordance with paragraph 5.1 of ICAO Annex 13. Aileron attachment Drive mechanism Safety actions: The following safety actions have been taken by: The aircraft manufacturer ● Service Letter SL127 published to remind operators of the greasing requirements and to provide relevant feedback. Maintenance organisation ● A reduction in the lubrication task interval from 1,000 hours to 100 hours for the aileron drive rod bearings. ● A fleet-wide corrosion inspection of all drive rod/bearing assembles. LAA leaflet TL 2.26 can be found here: https://www.lightaircraftassociation.co.uk/engineering/ TechnicalLeaflets/Operating%20An%20Aircraft/TL%202.26%20Procedure%20for%20using%20E5%20 Unleaded%20Mogas.pdf [accessed April 2019] 3

Air Accidents Investigation Branch Annual Safety Review 2019 66 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Boeing 787-9 Dreamliner, G-TUIM on 6 July 2018 The aircraft was on approach to Runway 26L at London Gatwick Airport and was being configured to land. After flaps 1 was selected, there was a progressive deterioration in normal flight controls, landing gear lowering and nosewheel steering capabilities. The crew performed a go-around and actioned the relevant checklists. The aircraft landed safely with flaps 20 set but with the nosewheel steering inoperative. The cause of the system degradation was a failure of the Nose Landing Gear Isolation Valve (NLGIV). Following this event, the manufacturer changed its procedures in relation to the manufacturing and testing of the NLGIV. Safety actions: Following this incident, the aircraft manufacturer: ● Introduced changes to the component Acceptance Test Procedure for the NLGIV ● Made changes to the manufacturing procedures of the NLGIV to prevent brinelling. ● Made amendments to the Fault Isolation Manual (FIM) and Aircraft Maintenance Manual (AMM) to add operational tests of the NLGIV. Airbus Helicopters EC175B, G-EMEA on 10 July 2018 The helicopter was returning to Aberdeen after a routine passenger flight. During a normal approach to land the landing gear appeared to deploy normally but at touchdown the nose landing gear collapsed due to the failure of the A-frame pintle pin. Owing to a low fuel state the passengers were disembarked whilst the helicopter was in a low hover. The aircraft was then landed safely, using sandbags to support the fuselage. During the subsequent investigation, the operator identified that a bush, which should have supported the pintle pin, had not been fitted into the A-frame when it was installed 50 flying hours before the incident flight. The investigation identified several human factors issues which contributed to the accident, including shift staffing levels, lack of experience and fatigue. The helicopter manufacturer subsequently published Service Information Notice 3259-S-32 notifying operators of this failure mode and an Alert Service Bulletin (ASB) 32A003, requiring an inspection to ensure the correct installation of the pintle pin bushing. The ASB was subsequently mandated by EASA Airworthiness Directive 20180190. Nose landing gear actuator A-Frame Pintle Pin Pintle Pin Bushing

Air Accidents Investigation Branch Annual Safety Review 2019 67 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Safety actions: Following this incident to G-EMEA, the operator revised its procedures regarding work time monitoring and reminded staff of their responsibilities to follow company fatigue management procedures. The operator introduced a ‘complex task’ job card for the H175 nose landing gear leg replacement task. Additionally, the operator reviewed the engineering manpower, supervision and experience levels needed for base maintenance inputs. On 13 July 2018, the helicopter manufacturer published Safety Information Notice (SIN) No 3259-S-32 which notified other operators of this, and previous, nose landing gear pintle pin failures. The SIN highlighted the need to remove and reinstall the pintle pin bushing during A-frame replacement. As a result of another operator identifying an incorrectly fitted pintle pin bushing, the helicopter manufacturer published Emergency Alert Service Bulletin (ASB) 32A003 in August 2018. This required a one-off inspection of the EC175 nose landing gear pintle pin bushing. In addition, operators were required to review helicopter maintenance records to identify any occasions where bushings had been misinstalled or found not fitted. ASB 32A003 was subsequently mandated by the EASA with the publication of Airworthiness Directive 2018-0190 on 31 August 2018. Flight Design CTSW, G-KUPP on 19 July 2018 An electrical fire in the instrument console developed shortly after takeoff and the pilot returned to land on the active runway. An electrical short circuit with the composite instrument console, resulting in a resin fire, was traced to a damaged wire. The wiring had been previously modified and a Service Bulletin has been released to reduce the risk of electrical and fuel fires. Safety action: The UK type approval organisation has issued a Service Bulletin No 150 to modify Flight Design CTSL, CTSW and CT2K aircraft, to reduce the risk of electrical and fuel fires.

Air Accidents Investigation Branch Annual Safety Review 2019 68 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Piper J5A Cub Cruiser, G-BSXT on 20 July 2018 During a check flight, a newly repaired Piper J5A Cub Cruiser overran the runway and struck a gate at Felthorpe Airfield near Norwich. This was because the aircraft was travelling too fast in the final stage of the landing. It floated a long distance and landed a long way down the runway. The pilot had no time on type and the aircraft had heel brake controls that he found difficult to use. The LAA did not have the opportunity to assess the suitability of the check pilot, in part due to a misunderstanding between the LAA and one of its Inspectors about what airworthiness process to follow. In response to this accident, the importance of clear and unambiguous communications with members has been reinforced at LAA HQ. The LAA has also informed inspectors of the circumstances of this event and issued a decisionmaking flow chart to help them determine what process should be followed. Safety actions: In response to this accident, the LAA has re-emphasised to its staff the importance of clear and unambiguous conversations between LAA headquarters, aircraft owners and LAA inspectors. The LAA has also produced a communication for LAA inspectors that describes this event and provides advice regarding inspector responsibilities in this type of case. It has also produced a decision-making flow chart to assist inspectors to determine what process should be followed. As a safety action in response to the accident involving G-BXON, the LAA has published Technical Leaflet 2.30 Converting to a new type4. This contains relevant guidance for pilots transitioning between aircraft types. Boeing 737-8Q8, YR-BMF on 28 July 2018 Prior to departure the aircraft’s takeoff data was calculated on an electronic flight bag (EFB) using its zero fuel weight (ZFW) instead of its takeoff weight (TOW). The pilots did not crosscheck or independently calculate the data. During the takeoff the aircraft suffered a tailstrike. Despite ATC asking the pilots if they had a tailstrike, the error subsequently being noticed in the EFB and a member of LAA (2018). Technical Leaflet 2.30. Converting to a new type. Issue 1. 19 December 2018. http://www. lightaircraftassociation.co.uk/engineering/TechnicalLeaflets/Operating%20An%20Aircraft/TL%202.30%20 Converting%20to%20a%20New%20Type.pdf (accessed on 15/01/2019). 4

Air Accidents Investigation Branch Annual Safety Review 2019 69 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

the cabin crew hearing a strange noise during the takeoff, the tailstrike checklist was not actioned. The aircraft continued to its destination and, after landing, damage was discovered on the underside of the aircraft. Safety actions: As a result of this event the operator issued Safety Information Bulletin No 7/2018 to its pilots, highlighting the background to it and highlighted the following: ● ‘The flight crew members are advised to strictly follow the provisions of OMB 4.6 “AFTER COMPUTING INDEPENDENTLY, THE CREW SHALL PERFORM A CROSSCHECK OF THE RESULTS”, ● When feeding the Flight Management Computor (FMC) with data that can affect performance or carrying out a correction, a cross-check shall be initiated before executing the task, ● To take into consideration the importance of the information provided by the cabin crew and ATC, ● QRH shall be used any time a non-normal situation occurs (ie NNC Tail Strike).’ Skystar Kitfox Mk 7, G-FBCY on 5 August 2018 While returning to its home airstrip, the aircraft experienced a loss of engine thrust coincident with an uncommanded increase in engine speed. The pilot made a forced landing in a ploughed field during which the nosewheel collapsed, resulting in substantial damage to the aircraft. Subsequent examination of the propeller hub revealed that the threads on the lead screw within the propeller pitch-change mechanism had been stripped. This had caused the propeller blades to move to a very fine pitch setting, leading to the loss of thrust. Safety actions: Prior to this accident, the LAA had embarked on a long-term project to transfer aircraft, engine and propeller information from SPARS5 to a web-based Type Acceptance Data Sheets (TADS) system, in order to make this information, including Airworthiness Information Leaflet (AIL), easily available to its members. This activity is ongoing and the transfer of aircraft-specific data is almost complete, and it is planned that the transfer of engine and propeller information will follow. It is envisaged that the propeller TADS will include any relevant limitations or modifications for each propeller type and the LAA considers that this will provide a useful reference for aircraft owners when deciding what propellers to fit to their aircraft. SPARS - LAA paper based Inspectors manual. 5

Air Accidents Investigation Branch Annual Safety Review 2019 70 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

The LAA also intends to reissue the AIL originally issued in 2008 for the Arplast PV50 propeller and is currently identifying all LAA aircraft to which this propeller is fitted. Owners of projects still under construction who may have this propeller but who have not yet identified the propeller type to the LAA, will be identified when an application for an initial permit to fly or modification is made. The LAA published a ‘Safety Spot’ article in the November 2018 issue its ‘Light Aircraft’ magazine, to alert owners to the issues arising from this accident. ERJ 170-200 STD, Embraer 175, G-FBJK on 11 August 2018 When advised that the takeoff runway had changed the pilots recalculated the takeoff performance from an intersection. This produced a different flap setting, which they did not notice, despite them cross-checking the information. The aircraft subsequently took off with an incorrect flap setting for the calculated takeoff performance data. Safety actions: The operator has taken the following safety actions: ● Changed its SOPs on EFB performance calculation procedures, in OM Part A, to align them with the current EASA regulation where both pilots independently calculate the departure performance and cross-check the other pilots, before being accepted for use. ● The operator has introduced the use of a takeoff and landing data card on their Embraer 175 fleet. It believes the process of transferring data from the EFB to the card could potentially act as an additional safety barrier. The operator is considering the following safety action: ● Changing the format, font or colour of the calculated takeoff speeds and flap setting on the EFB to make the calculated data stand out differently from the rest of the inputted data. CZAW Sportcruiser, G-CGJS on 18 August 2018 The aircraft suffered an engine failure while climbing through 1,400 ft after takeoff, and a forced landing was carried out into a ploughed field. The aircraft was damaged but the occupants were not injured. The flywheel had detached due to failure of its attachment bolts which were found to have broken; fatigue was evident on at least one bolt. There was a discrepancy in the time intervals for replacement of the bolts in the engine manufacturer’s documentation.

Air Accidents Investigation Branch Annual Safety Review 2019 71 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Safety actions: By the engine manufacturer ● The engine manufacturer made a series of improvements to the configuration of the flywheel attachment system on this engine type. The improvements included the introduction of Nordloc washers, which the manufacturer stated ‘should be implemented on existing engines whenever flywheel bolts are replaced’. The various configurations that have been used, and the installation process for Nordloc washers are detailed in Service Bulletin JSB 012. ● On 12 February 2019, the engine manufacturer issued Service Bulletin JSB 0143, which aligned the maintenance requirement for ‘non-approved propellers’ to that described in the Maintenance Manual. By the LAA ● The LAA was proactive in highlighting the failures of flywheel attachment bolts after first becoming aware of the problem. Sikorsky S-92A, G-CKXL on 23 August 2018 The pilots were operating the S-92A helicopter on a multi-sector route between platforms in the Brae field in the northern North Sea, approximately 150 nm north-east of Aberdeen. On the third sector from the East Brae platform to the Brae Alpha platform, the pilots mis­ identified the Brae Bravo platform as the destination and made an approach to the hover above the deck of the platform. The radio operator on the Brae Bravo platform told the pilots that they had made an approach to the wrong deck; following clearance to depart, the pilots continued the flight without further incident. The operator stated that it would conduct additional training addressing the task management requirements and complexity during shuttling6 to prevent a recurrence. Safety actions: The operator identified the following safety actions to be carried out: ● Training to highlight complex requirements of shuttling and need to concentrate on all aspects of SOPs. ● Highlight of importance of following checklists at appropriate times. ● Review shuttle checks. ● Highlight task management during the brief for a shuttling line training flight. Shuttling is the act of flying between installation helidecks which are less than 10 nm apart. 6

Air Accidents Investigation Branch Annual Safety Review 2019 72 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Airbus Helicopters AS 350, VP-CIH on 30 August 2018 The AS 350 helicopter suffered tail rotor control problems in flight due to a rupture of the tail rotor gearbox (TGB) actuating rod. The pilot carried out a successful run-on landing. On 20 March 2019 the EASA issued Airworthiness Directive 2019-0060, mandating an inspection of TGB actuation rods to check for cracks. Safety action: ● As a result of these findings, on 20 March 2019 the EASA issued Airworthiness Directive 2019-0060, mandating dye penetrant crack checks of TGB actuating rods on affected AS 350 and AS 355 helicopters. DJI Matrice 210 (UAS, registration n/a) on 4 September 2018 After about six minutes into the flight, a battery low voltage condition was detected by the UAS causing it to enter an automatic landing mode. Shortly afterwards, while the aircraft was 20 m above the ground, it powered down and the electric motors stopped, causing it to fall to the ground. An investigation of this and similar accidents was conducted by the manufacturer which found that the batteries’ State of Charge (SOC) was indicating an erroneously high level of charge remaining. Safety actions were taken by the CAA to introduce operational restrictions while a fix was being found, and by the manufacturer to develop and ‘push out’ firmware changes to the battery and aircraft. Safety actions: A number of safety actions have been made by the aircraft manufacturer and UK regulator. These are summarised as follows: ● Provided battery firmware updates to correct the erroneously high SOC issue. ● Provided aircraft firmware updates to perform a gross check of the batteries’ SOC and trigger a RTH or Automatic Landing if a difference of greater than 10% is detected at specified trigger points. ● The DJI Pilot app has been updated to provide a clear warning when the battery firmware is out of date. The manufacturer is also planning improvements to the DJI Go 4 app.

Air Accidents Investigation Branch Annual Safety Review 2019 73 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

● A planned update to the Matrice 200 series user manual will specify that the DJI Pilot app is recommended and will specify that the batteries contain firmware that must be individually updated. ● The CAA issued four safety notices and Skywise Alert SW2019/067 to raise awareness of the battery issues and firmware updates to DJI Matrice 200 series users, as well as introducing operational limits depending on the version of firmware installed. These limitations have now been removed with the publication of Skywise Alert SW2019/116 which also reminded operators to have appropriate mitigations in place if flying over persons or property. Cirrus SR20, G-GCDA on 19 October 2018 The aircraft owner was collecting his aircraft after its annual inspection. The pre-flight checks and takeoff roll were normal. However, just as the aircraft lifted off, the pilot became aware of smoke in the cockpit. He landed immediately and despite shutting down all the electrical equipment, the smoke persisted. With the assistance of an engineer, the source of the smoke and a small fire was identified and extinguished. It was caused by a ‘circuit track’ in a switch panel, which had been electrically overloaded because of an unidentified problem with a diode in the standby battery wiring harness. The aircraft manufacturer has taken several safety actions to ensure the significance of the diode is understood and have included an additional circuit protection device. The aircraft manuals and circuit diagrams have also been amended to clarify the circuit maintenance information. The aircraft manufacturer has examined the switch panel circuit and reviewed this sequence of events. The position and unremarkable look of the diode was understood by the manufacturer. In addition, they have also identified that there is a slight risk of misassembly. Safety actions: The following safety actions are being carried out by the manufacturer: ● An update to the parts catalogue, wiring manual and electric CAPS service bulletins have been released. ● The addition of a fuse to the harness assembly to prevent damage. The engineering drawings for this are now released and will be used in new aircraft. Issuing new CAPS kits is planned but not released yet. Adding the fused harness will require another round of revisions for the service bulletins. The fused harness is field retrofittable and can be installed in existing aircraft and listed as the field spare.

Air Accidents Investigation Branch Annual Safety Review 2019 74 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Piper PA-34-220T Seneca V, G-OXFF on 2 November 2018 The aircraft was about to enter the runway for takeoff when the instructor became concerned about the feel of the left rudder pedal. He aborted the flight and taxied the aircraft back to the hangar. The subsequent engineering inspection found the left rudder cable had parted, with evidence that it had melted through due to chafing against the standby battery cable. Safety actions have been taken by the Civil Aviation Authority and the manufacturer has issued a mandatory Service Bulletin (No 1337) to reroute the emergency power wiring to give more clearance from the rudder cables. Safety actions: Safety actions taken by the regulator and manufacturer; ● This potentially serious risk to airworthiness was brought to the attention of the manufacturer, the CAA, EASA and the FAA. The CAA took immediate steps to inform owners and operators of similarly configured Piper Seneca V aircraft. ● The manufacturer has subsequently issued a mandatory Service Bulletin (No 1337) which gives instructions to reroute a portion of the emergency power wiring to improve the clearance from the rudder control cables. Bell 429, M-YMCM on 25 November 2018 Whilst on short final to Edinburgh Airport, at approximately 100 kt, the helicopter suffered a bird strike to the left windscreen. The windscreen shattered and debris entered the cockpit, injuring the occupant in the left seat, who required hospital treatment. The Bell 429 windscreen is not designed to withstand bird strikes and the design certification requirements do not require it to do so. A recent study by the Rotorcraft Bird Strike Working Group has recommended the introduction of bird strike protection requirements for Normal category rotorcraft to minimise the risk of damage or injury.

Air Accidents Investigation Branch Annual Safety Review 2019 75 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Safety actions: By the European Union Aviation Safety Agency (EASA) ● In November 2018, the EASA published the European Plan for Aviation Safety (EPAS) for 2019 – 20237. Rule Making Task 0726 is entitled ‘Rotorcraft occupant safety in event of a bird strike’. The document states: ○ ‘Since the 1980s there have been an increasing number of accidents involving rotorcraft bird strikes where the rotorcraft was not certified in accordance with the latest bird strike protection provisions. This has resulted in a number of occurrences where rotorcraft bird impacts have had an adverse effect on safety. The objective of this RMT is to improve rotorcraft occupant safety in the event of a bird strike. This will be achieved by considering the development of new CS27 provisions for bird strike and also considering proportionate retrospective application of applicable CS-27 and CS-29 to existing fleets and types that are not compliant with the latest provisions.’ The document indicates that associated timescales are 2024. By the Federal Aviation Administration (FAA) ● In a presentation at the 12th rotorcraft symposium8, the FAA indicated that their Rotorcraft Standards Branch (RSB) is reviewing the Bird Strike Working Group report. Further FAA study and evaluation will influence potential rulemaking and indications are that the RSB will pursue rulemaking in fiscal year 2020. This will be a multi-year process to achieve a final rule and they will ‘coordinate and harmonize to maximum extent with EASA’. ● The FAA indicated that they consider pilots and operators to be the first line of defence. They will consider how to address appropriate rotorcraft flight manual procedures. These are not considered to be flight limitations but ‘best practices’. They will continue discussion and studies with industry. Guidance material such as Advisory Circulars will be issued where appropriate. 7 European Plan for Aviation Safety 2019 – 2023 https://www.easa.europa.eu/document-library/general-publications/ european-plan-aviation-safety-2019-2023 [Accessed 28 February 2019] 8 Presentation number 28 Bird Strike Rotorcraft Protection https://www.easa.europa.eu/newsroom-and-events/ events/12th-rotorcraft-symposium#group-easa-downloads [Accessed 28 February 2019]

Air Accidents Investigation Branch Annual Safety Review 2019 76 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

DHC-8-402 Dash 8, G-ECOC on 13 December 2018 During the climb to cruising altitude the flight crew took the precautionary action of using the fixed oxygen system following a pressurisation event. The aircraft pressurisation system was reset and functioned normally, however the oxygen system failed to provide the pilots with oxygen. The oxygen cylinder regulator was later disassembled, and the crew oxygen supply port was found blocked with a piece of debris. It is suspected that the debris was the tip of a screw extraction tool, but no evidence could be found to explain how it came to be in the regulator. The operator has changed the ‘first flight’ checks to ensure the flight deck emergency oxygen system is functioning correctly. Safety action: The operator has taken the following safety action: ● The Operations Manual for the Flight Deck Fixed Oxygen Checks has been updated to include a one-second flow of oxygen to ensure that system pressure is maintained during the first flight check. DJI Matrice M210 RTK, (UAS, registration n/a) on 14 January 2019 The unmanned aircraft system (UAS) was fitted with a third-party lidar9 pod for its planned survey mission which involved flights of around 8 minutes duration. As it commenced its pre-programmed route, it appeared to continue to climb above the 30 m height that had been set. The remote pilots observed that is was too high and attempted to land it immediately. The aircraft appeared unresponsive to the remote pilot’s inputs and it then commenced an uncontrolled descent, rapidly increasing speed, until it struck the ground. Safety actions: The UAS operator is updating its procedures to include the following checks: ● Before any new aircraft / payload combination is flown, its actual weight will be established and recorded, by weighing, to ensure it is within specified limits. ● Before any new app or software is flown, confirmation, in writing, of its compatibility with other equipment by either the airframe manufacturer or the app developer is required. Lidar is a surveying device that uses laser light to measure distances. 9

Air Accidents Investigation Branch Annual Safety Review 2019 77 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Airbus A330-243, G-TCCF on 6 February 2019 Coffee was spilled onto the commander’s audio control panel (ACP). This resulted in failure of his ACP and later, the ACP on the co-pilot’s side. During the failures, the ACPs became very hot and produced an electrical burning smell and smoke. The commander decided to divert to Shannon, Republic of Ireland. The failure of two ACPs caused significant communication difficulty for the flight crew. The operator has taken safety action to reduce the chance of spillage. Safety action: The operator changed their procedure to ensure that cup lids are provided for flights on all routes and reminded cabin crew of the requirement to use them. The operator also issued a flight crew notice reminding pilots to be careful with liquids. The operator raised an action to source and supply appropriately sized cups for the aircraft’s cup holders. Evolve Dynamics Sky Mantis (UAS, registration n/a) on 7 February 2019 During a demonstration flight, the UAS dropped to the ground from a height of 50 m when the electric motors stopped, despite the battery being fully charged. The UAS struck the ground and was destroyed in the subsequent post-impact fire. The UAS manufacturer determined that the loss of power was caused by the battery not being fully locked in place. Safety action: The manufacturer has since updated the Sky Mantis Operations Manual to include an instruction to check that the battery is locked in place and will include this requirement in customer training. It also intends to install sensors in the battery lock mechanism which will prevent the aircraft from being able to fly if the battery is not correctly locked in place.

Air Accidents Investigation Branch Annual Safety Review 2019 78 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Socata TB20 Trinidad, G-BMIX on 7 February 2019 The aircraft, whilst taxiing at night at Dundee Airport, departed the right side of Taxiway E at the point where the taxiway curves to the left prior to joining the main apron. The aircraft’s left main landing gear oleo was damaged as it rolled over the paved edge of the main apron. A contributory factor in the pilot’s loss of situational awareness of his position on Taxiway E may have been his loss of sight of the taxiway edge lights against the brightly-lit main apron. Excessive taxiing speed may have also been a contributing factor. Safety action: Dundee Airport conducted an investigation into the event and plan to take two actions resulting from their investigation. A taxi speed limit is to be inserted into the warnings section of the textual data of the Aeronautical Infomation Publication (AIP) document for Dundee Airport. The airport also plans to reduce the severity of the lip between the grass and the main apron surface at the point where Taxiway E joins the main apron. Airbus A320-214, G-EZOI on 25 February 2019 A louder than usual noise was observed from an avionics vent fan before flight. During flight the noise increased and vibration became apparent. The crew then noticed a strong burning smell so they donned their oxygen masks and diverted the flight. An Electronic Centralised Aircraft Monitoring (ECAM) message, associated with an avionics ventilation system fault, was generated and the crew performed the associated actions. A subsequent investigation revealed the cause of the event to be worn bearings in the avionics extract fan. The fan manufacturer and the aircraft manufacturer both took safety action to prevent similar incidents in future. Safety actions: Fan manufacturer ● The fan manufacturer issued service bulletin 3454HC-21-101 on 18 April 2018, which provided details of an optional modification which introduced a ball bearing health monitoring (BBHM) function to continuously monitor the condition of the ball bearings and preventively stop the fan before its failure.

Air Accidents Investigation Branch Annual Safety Review 2019 79 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Operator ● Following the fan manufacturer’s original service bulletin and information letters between 2005 and 2013, the operator introduced a soft-life campaign to incorporate the recommendations to reduce the inflight failure rate of these fans. This commenced in 2016. ● In November 2018 the operator commenced a soft-life campaign to install the BBHM function and at the date of this report 23 modified fans had been installed. Airbus A300b4-622R(F), D-AEAD on 26 February 2019 The aircraft’s takeoff clearance was cancelled because a maintenance vehicle that had been manoeuvring on an adjacent taxiway entered the runway. The vehicle driver had become disorientated. Safety actions: The airport operator has carried out the following safety actions; ● A runway safety guide has been produced by Heathrow Airport Limited for issue to contractors holding A Class driving permits but driving airside on manoeuvring areas and runways. ● A Temporary Advice Notice (Airside_ASD_TAN_0119) has been published updating procedures for setting up work sites adjacent to runways, including the requirement to place Bolton barriers across runway access points prior to any work commencing. ● A Safety Alert (ASWorks_SA_017) has been issued to contactors at the airport advising of the updated procedures. Spitfire Mk.T IX (Modified), G-CTIX on 27 February 2019 The landing gear warning horn sounded during the approach to land. The undercarriage had been selected down and the green light indicating it was safe was illuminated, but the right undercarriage leg collapsed towards the end of the landing ground roll. Neither occupant was injured. The operator has provided additional information to its pilots concerning the landing gear systems on each of its aircraft and the aircraft will be modified to standardise system functionality with its other Spitfires. The right main undercarriage was not locked down and retracted under the weight of the aircraft on landing.

Air Accidents Investigation Branch Annual Safety Review 2019 80 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

It is likely the undercarriage was serviceable and capable of operating correctly, but excessive air load or incomplete selection of the undercarriage lever to the down position meant that the hydraulic system returned to idle before the undercarriage was locked down. The undercarriage warning horn operated as intended but the right undercarriage down switch was stuck closed, providing an incorrect indication that the undercarriage was safe. The pilot’s previous experience and incomplete knowledge of the systems fitted to G-CTIX led him to believe that the green down indication alone confirmed that the undercarriage was safe. Safety actions: As part of the repairs and return to service, the Operator has taken the following safety action to standardise the operation and functionality of its Spitfires: ● Individual switches for the undercarriage down position and the warning horn have been replaced with a single switch for both purposes. ● A switch has been added to the throttle quadrant so that the undercarriage warning horn will sound if the throttle is closed, flaps are down and the undercarriage position switch is not closed. ● Having reviewed the circumstances of the accident, the operator held a safety briefing for its pilots aimed in part at improving their awareness of the various undercarriage operating and indication systems fitted to its aircraft. ● Recognising the differences between different marks of the same basic design, and the fact that aircraft have been fitted with a variety of systems that are not necessarily original, the operator intends to provide its pilots with handling notes for each aircraft that correctly describe the systems currently fitted to it. DHC-8-402 Dash 8, G-JECN on 2 March 2019 The aircraft had landed at Southampton and was being taxied to its allocated stand. The No 1 engine had been shut down in accordance with the operator’s SOPs. As it approached the stand, at walking pace, the commander applied the brakes, which had no effect and the aircraft hit signage and the rotating No 2 (right) propeller struck a nearby ground power unit (GPU). The accident was caused by the aircraft standby (hydraulic) power unit (SPU) not being selected to on. This selection was normally made during the approach checks. However, on this occasion, the approach checks were not completed prior to landing. This meant that the aircraft mainwheel brakes did not work with the No 1 engine shut down. During the collision the aircraft sustained damage to the nose fuselage behind the radome, a nose landing gear door and right propeller tips. The Operator considers several safety barriers failed in the lead up and during the accident. The approach checks and after landing checklist should have captured the incorrect aircraft configuration. The use of the emergency brakes may have prevented the outcome.

Air Accidents Investigation Branch Annual Safety Review 2019 81 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Safety actions: Because of this event, the Operator has carried out a safety study looking into previous occurrences. This has produced several additional observations to be considered, regarding the approach checklist design and the single engine taxi risk assessment. In addition, a Notice to Air Crew (NOTAC) has been raised implementing a No 1 hydraulic system check during taxi. Tecnam P2006T, G-SACL on 17 March 2019 During taxi the pilot manoeuvred the aircraft to the left to avoid a Piper PA-28 parked on the right side of the taxiway. Whilst he was looking to the right to ensure sufficient clearance from the PA-28, he was also looking ahead to identify the centreline, which he found difficult due to road markings on the apron. The road markings were white and faded with older markings visible. As he was attempting to regain the centreline the aircraft’s left wing tip struck a large metal generator which was positioned close to the left apron edge. The pilot stated that the colour of the generator blended with the hangar behind and he had not noticed it. The aircraft slewed to the left and came to rest after the nose struck an articulated lorry parked next to the generator. Safety actions: An aerodrome inspector from the CAA visited Redhill after the accident and inspected the apron. The following changes were agreed with the airport operator: ● The existing edge of white road marking will remain in front of the hangars. ● A yellow taxiway centreline marking will be placed 6 m from this edge. ● A red safety line (behind which aircraft will be parked) will be marked 6 m from the other side of the yellow centreline. ● Instructions to aircraft operators will be issued to ensure that the main wheels of parked aircraft are pushed back on to the edge of the grass. ● A warning will be added to the UK AIP10 to request that pilots unsure of wing tip clearance request assistance. 10 Aeronautical Information Publication.

Air Accidents Investigation Branch Annual Safety Review 2019 82 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Airbus A320-232, HA-LPL on 23 March 2019 The aircraft was being pushed back from its stand by a ‘towbarless’ tug when the pilots detected a “major shake” from the aircraft nose landing gear. On inspection, damage was found on the torque link pivot of the nose landing gear and the aircraft had to be taken out of service. The damage had been the result of incorrect alignment of the tug lifting paddles. This was caused by the tug laser alignment system being lined up on the nose gear main forging whilst the nosewheels were 10° to 15° off centre. Correct alignment with the nosewheels is vital. Lining up on the nose gear leg, rather than the nosewheels, potentially leads to misalignments of up to 250 mm. This can result in significant damage to the components on the lower articulated part of the nose landing gear on this and many other aircraft types. Safety actions: The handling company have taken four safety actions to prevent recurrence. ● The towbarless tug training was reviewed to confirm the correct procedures are being taught. There is now a specific emphasis made on the requirement to ensure the tug is always aligned with the nosewheels. ● Pushback crews have been briefed to be more aware of the importance of the nosewheel position and have been asked to make the aircraft crew aware that, if possible, the nosewheels should be straight. ● The handling company are consulting with the tug manufacturer to identify and if possible, trial a system, that warns the tug operator of wheel misalignment. ● The A320 has been identified as the most potentially susceptible aircraft type to sustain nose landing gear damage whilst using the TLD 200MT tug. When possible on the A320 series of aircraft, the handling company will use either the conventional tow bar and tug or the TLD 100E towbarless tug. DJI Inspire 2 (UAS, registration n/a) on 25 March 2019 The DJI Inspire 2 UAS was returning from a surveillance flight when it unexpectedly yawed and uncontrollably descended, contacting the ground. An object was seen to be released from the aircraft prior to the loss of control which was thought to be a part of a propeller blade. The operator has implemented safety action as a result of this investigation. Safety actions: During warm starts the operator has introduced physical checks, including an inspection of the propellers, before the next flight. The operator has also instructed its pilots not to overfly people.

Air Accidents Investigation Branch Annual Safety Review 2019 83 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Airbus A320-214, G-EZWC on 3 April 2019 While being pushed back from Stand 18 at Belfast International Airport, the aircraft was stopped with the tug and tow bar positioned at a significant angle to the aircraft’s nose. The tow bar disconnected from the nose landing gear, and the aircraft rolled forward and struck the tug. Safety actions: Following this incident, the handling agent acted to prevent a reoccurrence of the incident: ● A Safety Alert was issued to all staff regarding the incident. ● A training awareness training module was developed covering the use of pushback tugs and gear selection. ● Refresher training was instigated for headset procedures and action to be taken in the event of a shear pin to bar head separation. ● A Safety App was developed that all managers and supervisory assessment staff could use on pushback and/or headset evaluation. ● Bluetooth headsets would be issued to tug drivers to improve communication with the flight deck. Colomban MC-30 Luciole, G-CIBJ on 10 April 2019 After a local flight, the ground taxi route back to the hangar involved several tight turns and when full left rudder pedal was applied the cockpit filled with smoke. The pilot exited the aircraft without injury and the ensuing fire consumed the aircraft. It is suspected that the terminals of the starter solenoid were not insulated, and the rudder pedal created an electrical short circuit which damaged a fuel pipe and ignited the fuel. Safety action: The LAA has recommended that all UK-registered Colomban Luciole aircraft be modified to the higher heat-resistant fuel pipe specification.

Air Accidents Investigation Branch Annual Safety Review 2019 84 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Boeing 737-73S, EI-SEV and Boeing 737-33A, G-GDFB on 30 April 2019 EI-SEV was taxiing to park on Stand 22 (S22) at East Midlands Airport (EMA) and the routing passed behind G-GDFB on Stand 24 (S24). As EI-SEV passed behind G-GDFB its winglet struck the other aircraft’s right horizontal stabiliser. Low Visibility Procedures (LVPs) were in force, and controllers could not see the apron area and were unaware that S24 was occupied. Neither the UK Aeronautical Information Publication (AIP) nor the pilots’ airfield charts indicated that wingtip clearance could be compromised when taxiing behind parked aircraft in that location. Safety actions: Following this event: ● The airport operator closed Stand 22 pending a safety review and conducted a survey of parking stands across the airport to identify any similar aircraft taxi separation hazards. ● The operators of both aircraft alerted their EMA-based flight crew to the hazard of reduced separation when using Stands 20 to 25. ● The operator of EI-SEV issued a Company NOTAM to alert its pilots to the reduced separation hazard on Stands 20 to 25 at EMA. Ace Aviation As-tec 13, G-CKUL on 15 May 2019 After an uneventful local flight the pilot was returning to Shotteswell Airfield at an altitude of 2,100 ft when he noticed the engine speed suddenly increase. He observed that the pusher propeller had detached from the aircraft and so he shut the engine down and commenced a glide descent back to Shotteswell Airfield, which was approximately 1 nm to the north. A successful power-off landing was made. The flex-wing aircraft’s single-cylinder engine rotates a pusher propeller using a reduction drive belt, driven by a pulley on the engine crankshaft. Drive belt tension may be adjusted using an eccentrically-mounted bearing on the propeller driveshaft. Inspection of the engine revealed that the eccentric bearing assembly and propeller had detached at the support bracket due to a fatigue failure of the bearing support. The propeller was not located following the event.

Air Accidents Investigation Branch Annual Safety Review 2019 85 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Safety action: Following this event, the engine manufacturer issued a safety notice11 to all owners and operators of the Mini 3 engine, requiring the eccentric bearing support to be replaced before the next flight. Boeing 737-89P, SP-LWA on 20 May 2019 After an uneventful takeoff from London Heathrow the flight crew were informed that the aircraft was 953 kg heavier than indicated on the load sheet. The flight crew corrected the figures in the aircraft’s flight management computer and the flight continued without incident. The load sheet error occurred because a consignment of mail was initially recorded twice in the operator’s computer load management system. A correction was applied by both the dispatcher and by an electronic message from the cargo company, which resulted in both entries being removed. Safety actions: The handling agent has taken safety action to remind all dispatchers of the importance of checking that the load sheet reflects the actual loading of the aircraft. They have also changed work patterns to ensure dispatchers will remain familiar with the IT systems used by all the operators they service. The operator has taken safety action by asking for all future occurrence for duplicate cargo figure to be report to them so that they can determine the cause. 11 Simonini Racing SRL Security Campaign No. 1, 31 May 2019.

Air Accidents Investigation Branch Annual Safety Review 2019 86 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

Index of Safety Actions (by aircraft weight) Commercial Air Transport (Fixed Wing) Page Boeing 787-9 Dreamliner, G-TUIM 66 Airbus A330-243, G-TCCF 77 Airbus A300b4-622R(F), D-AEAD 79 Boeing 737-89P, SP-LWA 85 Boeing 737-800, EI-FJW and Airbus A320-214, OE-IVC 59 Boeing 737-8AS, EI-GJT 60 Boeing 737-8Q8, YR-BMF 68 Airbus A320-214, G-EZOI 78 Airbus A320-214, G-EZWC 83 Boeing 737-4Q8, G-JMCR 61 Airbus A320-232, HA-LPL 82 Boeing 737-73S, EI-SEV and Boeing 737-33A, G-GDFB 84 ERJ 170-200 STD, Embraer 175, G-FBJK 70 DHC-8-402 Dash 8 Q400, G-JEDU 51 DHC-8-402 Dash 8 Q400, G-JECR 62 DHC-8-402 Dash 8, G-JECN 80 DHC-8-402 Dash 8, G-ECOC 76 EMB-145EP, G-CKAG 52 Britten-Norman BN-2B-21 Islander, VP-AEJ 65 Commercial Air Transport (Rotary Wing) Sikorsky S-92A, G-CKXL 71 Agusta Westland AW189, G-MCGR 53 Airbus Helicopters EC175B, G-EMEA 66 MBB-BK 117 D-2 EC145, G-RMAA 63 EC135 P2+, G-POLA 53 AS350B2 Ecureuil, G-PLMH 56 Commercial Air Transport (Hot Air Balloon) Cameron A-300 hot air balloon, G-VBAD 64 General Aviation (Fixed Wing) Spitfire Mk.T IX (Modified), G-CTIX 79 Piper PA-31, N250AC 50 Piper PA-34-220T Seneca V, G-OXFF 74 Cirrus SR20, G-GCDA 73 Socata TB20 Trinidad, G-BMIX 78 Tecnam P2006T, G-SACL 81 Cessna 172M Skyhawk II, N9085H 55 Auster AOP.9, G-BXON 49 Grob G109B, G-KHEH 56 Cessna 152, G-UFCO 54

Air Accidents Investigation Branch Annual Safety Review 2019 87 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

General Aviation (Fixed Wing) Cont Page Rutan Long-Ez (Modified), G-BPWP 58 Cessna 150M, N66778 58 Czech Sport Aircraft Sportcruiser, G-CGEO 60 CZAW Sportcruiser, G-CGJS 70 Just Super STOL XL, G-SSXL 64 Piper J5A Cub Cruiser, G-BSXT 68 Skystar Kitfox Mk 7, G-FBCY 69 Colomban MC-30 Luciole, G-CIBJ 83 Flight Design CTSW, G-KUPP 67 Ace Aviation As-tec 13, G-CKUL 84 General Aviation (Rotary Wing) Bell 429, M-YMCM 74 Airbus Helicopters AS 350, VP-CIH 72 Guimbal Cabri G2, G-PERH 55 Unmanned Air Systems Evolve Dynamics Sky Mantis (UAS, registration n/a) 77 DJI Matrice 210 (UAS, registration n/a) 72 DJI Matrice M210 RTK, (UAS, registration n/a) 76 Aeryon Skyranger R60, (UAS) SR9112798 63 DJI Inspire 2 (UAS, registration n/a) 84

Air Accidents Investigation Branch Annual Safety Review 2019 88 AAIB Air Accidents Investigation Branch © Crown copyright 2020 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk

Appendix 1 - CICITT occurrence categories CODE DESCRIPTION ARC ABNORMAL RUNWAY CONTACT AMAN ABRUPT MANEUVER ADRM AERODROME MAC AIRPROX/TCAS ALERT/LOSS OF SEPARATION/NEAR MIDAIR COLLISIONS/MIDAIR COLLISIONS ATM ATM/CNS BIRD BIRD CABIN CABIN SAFETY EVENTS CTOL COLLISION WITH OBSTACLE(S) DURING TAKEOFF AND LANDING CFIT CONTROLLED FLIGHT INTO OR TOWARD TERRAIN EVAC EVACUATION EXTL EXTERNAL LOAD RELATED OCCURRENCES F–NI FIRE/SMOKE (NON-IMPACT) F–POST FIRE/SMOKE (POST-IMPACT) FUEL FUEL RELATED GTOW GLIDER TOWING RELATED EVENTS GCOL GROUND COLLISION RAMP GROUND HANDLING ICE ICING LOC–G LOSS OF CONTROL–GROUND LOC–I LOSS OF CONTROL–INFLIGHT LOLI LOSS OF LIFTING CONDITIONS EN ROUTE LALT LOW ALTITUDE OPERATIONS MED MEDICAL NAV NAVIGATION ERRORS OTHR OTHER RE RUNWAY EXCURSION RI RUNWAY INCURSION SEC SECURITY RELATED SCF–NP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (NON-POWERPLANT) SCF–PP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (POWERPLANT) TURB TURBULENCE ENCOUNTER USOS UNDERSHOOT/OVERSHOOT UIMC UNINTENDED FLIGHT IN IMC UNK UNKNOWN OR UNDETERMINED WILD WILDLIFE WSTRW WIND SHEAR OR THUNDERSTORM

Air Accidents Investigation Branch AAIB Annual Safety Review 2019 Air Accidents Investigation Branch GLOSSARY OF ABBREVIATIONS aal above airfield level ACAS Airborne Collision Avoidance System ACARS Automatic Communications And Reporting System ADF Automatic Direction Finding equipment AFIS(O) Aerodrome Flight Information Service (Officer) agl above ground level AIC Aeronautical Information Circular amsl above mean sea level AOM Aerodrome Operating Minima APU Auxiliary Power Unit ASI airspeed indicator ATC(C)(O) Air Traffic Control (Centre)( Officer) ATIS Automatic Terminal Information Service ATPL Airline Transport Pilot’s Licence BMAA British Microlight Aircraft Association BGA British Gliding Association BBAC British Balloon and Airship Club BHPA British Hang Gliding & Paragliding Association CAA Civil Aviation Authority CAVOK Ceiling And Visibility OK (for VFR flight) CAS calibrated airspeed cc cubic centimetres CG Centre of Gravity cm centimetre(s) CPL Commercial Pilot’s Licence °C,F,M,T Celsius, Fahrenheit, magnetic, true CVR Cockpit Voice Recorder DFDR Digital Flight Data Recorder DME Distance Measuring Equipment EAS equivalent airspeed EASA European Aviation Safety Agency ECAM Electronic Centralised Aircraft Monitoring EGPWS Enhanced GPWS EGT Exhaust Gas Temperature EICAS Engine Indication and Crew Alerting System EPR Engine Pressure Ratio ETA Estimated Time of Arrival ETD Estimated Time of Departure FAA Federal Aviation Administration (USA) FIR Flight Information Region FL Flight Level ft feet ft/min feet per minute g acceleration due to Earth’s gravity GPS Global Positioning System GPWS Ground Proximity Warning System hrs hours (clock time as in 1200 hrs) HP high pressure hPa hectopascal (equivalent unit to mb) IAS indicated airspeed IFR Instrument Flight Rules ILS Instrument Landing System IMC Instrument Meteorological Conditions IP Intermediate Pressure IR Instrument Rating ISA International Standard Atmosphere kg kilogram(s) KCAS knots calibrated airspeed KIAS knots indicated airspeed KTAS knots true airspeed km kilometre(s) kt knot(s) lb LP LAA LDA LPC m mb MDA METAR min mm mph MTWA N NR N g N1 NDB nm NOTAM OAT OPC PAPI PF PIC PM POH PPL psi QFE QNH RA RFFS rpm RTF RVR SAR SB SSR TA TAF TAS TAWS TCAS TODA UA UAS USG UTC V V1 V2 VR VREF VNE VASI VFR VHF VMC VOR pound(s) low pressure Light Aircraft Association Landing Distance Available Licence Proficiency Check metre(s) millibar(s) Minimum Descent Altitude a timed aerodrome meteorological report minutes millimetre(s) miles per hour Maximum Total Weight Authorised Newtons Main rotor rotation speed (rotorcraft) Gas generator rotation speed (rotorcraft) engine fan or LP compressor speed Non-Directional radio Beacon nautical mile(s) Notice to Airmen Outside Air Temperature Operator Proficiency Check Precision Approach Path Indicator Pilot Flying Pilot in Command Pilot Monitoring Pilot’s Operating Handbook Private Pilot’s Licence pounds per square inch altimeter pressure setting to indicate height above aerodrome altimeter pressure setting to indicate elevation amsl Resolution Advisory Rescue and Fire Fighting Service revolutions per minute radiotelephony Runway Visual Range Search and Rescue Service Bulletin Secondary Surveillance Radar Traffic Advisory Terminal Aerodrome Forecast true airspeed Terrain Awareness and Warning System Traffic Collision Avoidance System Takeoff Distance Available Unmanned Aircraft Unmanned Aircraft System US gallons Co-ordinated Universal Time (GMT) Volt(s) Takeoff decision speed Takeoff safety speed Rotation speed Reference airspeed (approach) Never Exceed airspeed Visual Approach Slope Indicator Visual Flight Rules Very High Frequency Visual Meteorological Conditions VHF Omnidirectional radio Range

Air Accidents Investigation Branch Annual Safety Review 2019

FD06684 ｜ 2020_英国_aaib-investigation-to-airbus-a319-111-g-eznm__Airbus_A319-111_G-EZNM_06-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

17 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-EZNM AAIB-25731 SERIOUS INCIDENT Aircraft Type and Registration: Airbus A319-111, G-EZNM No & Type of Engines: 2 CFM56-5B5/P turbofan engines Year of Manufacture: 2005 (Serial no: 2402) Date & Time (UTC): 11 May 2019 at 0630 hrs Location: En route to Bristol Airport Type of Flight: Commercial Air Transport (Passenger)

Persons on Board: Crew - 6 Passengers - 107 Injuries: Crew - None Passengers - None Nature of Damage: None Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 41 years Commander’s Flying Experience: 9,159 hours (of which 5,737 were on type)

Last 90 days - 54 hours

Last 28 days - 26 hours Information Source: AAIB Field Investigation

Synopsis The lenses of both pilots’ oxygen masks misted when donned during a smoke and fumes event, obscuring their vison. The commander removed his mask so he could see the flight instruments. The aircraft diverted to Birmingham and landed without further event. The investigation found that the masks misted up due to a combination of the environment in which they were stowed and the condition of the lenses. The source of the smoke was probably an accumulation of dust in the transformer rectifier unit (TRU). The aircraft manufacturer has added a cleaning procedure for the TRU in the Aircraft Maintenance Manual. The operator has added a practical demonstration on the use of the mask and its selectors during its recurrent training cycle. History of the flight The aircraft was on a scheduled flight from Newcastle International Airport to Bristol Airport. The co-pilot was PF for the sector and the commander was PM. About 30 minutes after takeoff, while in the cruise at FL290 and about 80 nm north‑north‑west of Bristol, the co-pilot noticed an acrid burning smell. Upon looking to the rear of the flight deck both crew members observed smoke in front of the flight deck door and rising to shoulder height behind their seats. They donned their oxygen masks, and the commander took control of the aircraft and continued to communicate with ATC; the co-pilot actioned

18 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-EZNM AAIB-25731 the ‘SMOKE/FUMES/AVNCS [avionics] SMOKE’ checklist in the quick reference handbook (QRH). The commander transmitted MAYDAY to ATC, selected the emergency transponder code, and the crew started an emergency descent towards the final approach for Runway 27 at Bristol Airport. About 90 seconds after the pilots donned them, their oxygen masks misted up, obscuring their vision. The co-pilot was able to read the checklist by holding it close to the mask, but could not read his flight instruments. The commander removed his oxygen mask so he could see the flight instruments, having first informed the co-pilot that he would do so and agreeing this was the least risk option. Upon removing his mask the commander noticed the smoke had dissipated. He then gave the senior cabin crew member a NITS1 briefing over the interphone, informing her of their intent to continue to Bristol. Upon looking at the aircraft’s navigation display, which was now visible, it was noted that Birmingham was a closer option. The pilots decided to divert to Birmingham, and informed ATC and the cabin crew of their revised plan. During the descent the crew made an announcement to passengers informing them of the situation. After this the smoke became perceptible in the cockpit again. The commander then informed the co-pilot that he felt “a little bit wobbly” but well enough to continue. As his oxygen mask had cleared he refitted it, and it did not mist up again. The aircraft subsequently landed at Birmingham and stopped on the runway, without further event and with the RFFS in attendance. After a review of the situation, the commander removed his mask and discovered no perceptible smoke or fumes in the cockpit. The aircraft was then taxied onto a stand and shutdown. Pilots’ comment The commander believed the condensation formed on the lenses because they were stowed in a compartment that was relatively cold compared to the flight deck. After he removed the oxygen mask from his head, he placed it on his lap, when it probably warmed towards ambient temperature. He reported that his breathing rate was high when he first donned the mask, because of the stress of the situation. The commander commented that he was proficient in operation of the mask, but while he was aware of the emergency pressure selector2 on the mask, his knowledge on the use of it was probably incomplete. He added that he could not be certain if he had selected it during the event. The co-pilot did not select the emergency setting. Footnote 1 A standard form of briefing that considers the Nature of the situation, Intentions, Timings and Special instructions (NITS). 2 See Crew oxygen masks section for a description of the masks and the oxygen regulator controls.

19 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-EZNM AAIB-25731 Crew oxygen masks Description The mask type fitted to G-EZNM was a ‘MF10’ full-face mask-regulator that provides protection during depressurisation and smoke events, while allowing the pilots to communicate with each other. The window has two lenses with an air gap between them. The internal lens has an anti-fogging coating (Figure 1).

Figure 1 Mask lens arrangement Pushing the n/100% (n - normal flow) selector into the 100% position, on the regulator control, supplies 100% oxygen (item 3 in Figure 2). After pushing the N/100% rocker into 100% position, rotating the emergency pressure selector in the direction of the arrow to the emergency position provides 100% oxygen with an overpressure (item  2  on Figure  2). The overpressure eliminates condensation or fogging of the mask, and prevents smoke, smell or ashes from entering the mask.

20 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-EZNM AAIB-25731

Figure 2 Oxygen regulator controls SMOKE/FUMES/AVNCS SMOKE checklist The QRH checklist for ‘SMOKE/FUMES/AVNCS SMOKE’ was as follows:

21 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-EZNM AAIB-25731 Additionally, the aircraft’s Flight Crew Operating Manual, which is a support document for crews, contained additional information. It stated, under the heading ‘CREW OXY MASK…’: ‘Turn the emergency knob to remove condensation or smoke from the mask.’ Oxygen masks examination The crew’s masks were examined by the manufacturer under AAIB supervision. Visual inspection Both masks were in a generally good condition. The commander’s external and internal lenses were reported to be in a “good condition”. The inner surface of the internal lens was sensitive to fogging (uniform blurring), and fogging remained for a few seconds on the inner surface of the internal lens after exhaling on it. The co-pilot’s external and internal lenses were reported to be in a “bad condition”, with scratches present. The inner surface of the internal lens was sensitive to fogging (with non‑uniform blurring reported), and fogging remained for a few seconds on the inner surface of the internal lens after exhaling on it. When fogging appeared on the inner surface of the internal lens, elongated shapes were visible that looked as though the surface had been wiped (Figure 3). Figure 3 Co-pilot’s mask showing fogging and marks on internal lens Both masks had 100% selected and the emergency pressure selector had not been rotated in the direction of the arrow; a state in which no overpressure was provided. An exemplar mask was also tested. Its internal lens was not sensitive to fogging, and fogging disappeared instantly after exhaling on it.

22 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-EZNM AAIB-25731 A test of the emergency mode pressure was performed on a universal test bench. Values for the emergency pressure demand was within the acceptable range for both masks. Fogging test A fogging test was performed in the manufacturer’s cockpit simulator room. This reproduced an aircraft cockpit and supplied pressurised oxygen to a mask via a stowage box. It did not replicate the relative temperature environment of the stowage or the cockpit. The fogging test simulated the masks being worn for 10 minutes and breathing in different configurations of oxygen flow. The objective was to determine in which configuration it was possible to reproduce the fogging described during the incident on the visor. Neither mask exhibited any fogging in either n, 100% or emergency oxygen flows. Recurrent pilot training Some of the operator’s type rating examiners reported that some crews were unfamiliar with the correct use of the oxygen masks, particularly in the selection of the various oxygen flows. Accordingly, the operator has added a practical demonstration on the use of the mask and its selectors during its next recurrent training cycle. Aircraft Maintenance Manual A detailed inspection of the masks is required every 24 months. The Aircraft Maintenance Manual (AMM) contains the process to be followed if they require cleaning. The extant AMM stated in its Subtask 35-12-41-160-050-A, ‘Cleaning of the Full-Face/ Quick-Donning Oxygen Mask on Aircraft’: ‘(1) Clean the mask of the Inter technique MF10 series as follows:

… (b) …

Do not let the Disinfectant and cleaner-Oxygen Mask- (Material No. 11CKA1) touch the surfaces of the visor of the mask.

…’ At the operator’s request, the aircraft manufacturer has moved the above warning to the beginning of the procedure and highlighted it as follows: ‘CAUTION: BE CAREFUL NOT TO PUT DETERGENT SOLUTION, DISINFECTANT OR WATER ON THE MASK VISOR. IF YOU DO, DAMAGE TO THE ANTI-MIST LAYER OF THE MASK VISOR CAN OCCUR.’ This was incorporated into the February 2020 revision of the AMM.

23 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-EZNM AAIB-25731 Source of the smoke and fumes Initially the operator’s maintenance control remotely diagnosed the source of the smoke as a faulty recirculation fan but, upon inspection, both fans were found to be in a “very good condition”. As the source of the smoke was not positively identified, and based on previous experience with burnt smells in the cockpit, the transformer rectifier units (TRU) were suspected as being the source. In previous cases of electrical burnt smells in the cockpit, dust contamination of the TRUs was identified as the cause. G-EZNM’s records showed neither TRU had been replaced since the aircraft was manufactured, since when it had accumulated more than 40,000 flying hours. Upon inspection, the TRU ventilation grids and hot air exhaust ducts showed light dust accumulation and no other abnormal findings. They were cleaned and reinstalled. As a result, the aircraft manufacturer has introduced a cleaning procedure for the TRUs in the AMM. This was incorporated into the May 2019 revision of the AMM revision. Analysis The crew experienced a smoke and fumes event in the cockpit and subsequently initiated and completed a successful diversion to Birmingham. About 90 seconds after donning their masks both of the crew’s masks became obscured by condensation. The misting obscured the flight instruments leading the commander to remove his mask. While this decision was judged to achieve the greatest overall aircraft safety in the circumstances, it exposed the commander to potentially hazardous fumes. Both emergency pressure selectors were found not to have been rotated to the emergency position. The commander was unable to recall if he had selected emergency. However, if they both had, even for a short period, it is likely the condensation would have been removed, enabling the commander to keep his mask on and breath 100% oxygen during the remainder of the flight. This would probably have improved the physiological condition he reported, which may have been caused by inhaling fumes. Removing the condensation in this way would also have allowed the co-pilot to properly monitor the aircraft’s flight path. The option to select emergency was stated in the QRH checklist. The Flight Crew Operating Manual (though not as readily accessible) contained the additional information that this selection would remove condensation. The results of the fogging test conducted after the event were inconclusive because the simulator did not replicate the cockpit environment and the testers were not exposed to the stress and increased breathing rate probably experienced during the incident. The masks are likely to have misted up during the event due to a combination of the cold stowage compartment, a relatively warm cockpit, damage to the anti-fog coating and the crews’ higher breathing rate.

24 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-EZNM AAIB-25731 This incident highlights the importance of fully understanding mask operation, including what selections are available and how to use them. Conclusion The aircraft had a smoke and fumes event that was probably a result of dust accumulation on its TRUs. The pilot’s oxygen masks misted up shortly after donning, due to a combination of the environment in which they were stowed, the crews’ breathing rate and the condition of the lenses. This left them unable to see the flight instruments, resulting in the commander removing his mask. Selecting the emergency pressure setting helps clear a mask and reduced exposure to any remaining smoke and fumes. Safety actions The operator has taken safety actions in the following areas as a result of this incident: The operator has added a practical demonstration on the use of the mask and its selectors during its recurrent training cycle. The aircraft manufacturer has taken safety actions in the following areas as a result of this incident: At the operator’s request, the aircraft manufacturer has moved the relevant warning to the beginning of the procedure and highlighted it as follows: ‘CAUTION: BE CAREFUL NOT TO PUT DETERGENT SOLUTION, DISINFECTANT OR WATER ON THE MASK VISOR. IF YOU DO, DAMAGE TO THE ANTI-MIST LAYER OF THE MASK VISOR CAN OCCUR.’ This was incorporated into the February 2020 revision of the AMM. The aircraft manufacturer introduced a cleaning procedure for the TRUs in the AMM. This was incorporated into the May 2019 revision of the AMM. Published: 21 May 2020.

FD06685 ｜ 2020_英国_aaib-investigation-to-airbus-a320-214-oe-loa__Airbus_A320-214_OE-LOA_09-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

16 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 SERIOUS INCIDENT Aircraft Type and Registration: Airbus A320-214, OE-LOA No & Type of Engines: 2 CFM56-5B turbofan engines Year of Manufacture: 2007 Date & Time (UTC): 1 March 2019 at 2020 hrs Location: London Stansted Airport Type of Flight: Commercial Air Transport (Passenger)

Persons on Board: Crew - 7 Passengers - 169

Injuries: Crew - None Passengers - 10 (Minor) Nature of Damage: Left engine contained failure Commander’s Licence: Air Transport Pilot’s Licence Commander’s Age: 44 years Commander’s Flying Experience: 14,128 hours (of which 10,308 were on type)

Last 90 days - 195 hours

Last 28 days - 71 hours Information Source: AAIB Field Investigation Synopsis The aircraft was on a scheduled flight from London Stansted Airport to Vienna International Airport, Austria. Shortly after the takeoff roll was commenced it was rejected, due to a contained failure of the left engine, and the aircraft was brought to a stop on the runway. Just as the flight crew were about to taxi the aircraft off the runway, an evacuation was commanded by the Senior Flight Attendant. The investigation identified several factors that contributed to this decision. Ten passengers were treated for minor injuries that occurred during the evacuation and there was a risk of serious injury due to one of the engines running during the evacuation. The operator has taken several safety actions, principally based around the training of its flight attendants. Two Safety Recommendations regarding passenger evacuation have been made in this report. The left engine experienced a contained failure following the rupture and release of several blades from the first stage of the high-pressure compressor. The investigation found that the blades fractured as a result of high-cycle fatigue loading which initiated in the dovetail (part of the blade root), due to a once-per-revolution aerodynamic excitation. An inlet guide vane lever arm had been improperly assembled which led to aerodynamic excitation of the passing blades and the resulting forces exceeded the design loads of the blades.

17 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 History of the flight The aircraft was on a scheduled flight from London Stansted Airport to Vienna International Airport, Austria, having previously flown in from Vienna about an hour earlier. The commander was the PF for the sector and it was a line training sector for the co-pilot. There were five flight attendants1 (FAs), including an additional crew member (ACM)2. The aircraft pushed back and taxied out to Runway 22 without event. ATC clearance was then given for the aircraft to line up and take off. At the time it was dark outside, and the weather was clear with the wind from 160° at 5 kt. In the cabin, the lights had been dimmed for takeoff, as is normal practice. Flight crew observations Having lined up on the runway, the commander set the throttles to full power/toga3 and commenced the takeoff roll. About one second after the co-pilot said “thrust set”, at a groundspeed of 31 kt, a loud bang was heard and the aircraft immediately drifted towards the left of the runway. The commander said “stop stop stop” and rejected the takeoff. The aircraft came to a stop between the centreline and the left side of the runway. The commander then set the parking brake, selected the public address system (PA) button and announced “attention crew: on station”4 twice. The co-pilot then informed ATC that they were stopping on the runway and then completed the actions for ‘ENG 1 FAIL’ and ‘ENG 1 REVERSER UNLOCKED’ electronic centralised aircraft monitor (ECAM) messages; there were no fire indications. The left engine was shutdown at 2006:23 hrs. After the ECAM messages had been actioned the commander contacted the RFFS, who were quickly on the scene, on frequency 121.6 MHz to confirm that there were no signs of fire visible from the outside. As a result, it was decided to vacate the runway using the thrust from the right engine and he asked ATC for clearance to do so. At 2007:21 hrs, just as the commander was about to make a PA to instruct the FA to return to normal operations, he noticed an amber ‘DOOR L [LEFT] FWD [FORWARD] CABIN’ caution message illuminated on the ECAM. At first, he thought it was a fault but then saw the evacuation slide deployed at Door L1 out the left cockpit window and passengers moving across the front of the aircraft. The commander then had a conversation with the Senior Flight Attendant (SFA), over the interphone, during which the commander asked why the evacuation had been initiated. She replied that she believed he had ordered one, which he denied. After this conversation, the APU was started and the right engine, which was still operating while the evacuation was underway, was selected off at 2009:38 hrs. Footnote 1 The operator refers to its cabin crew as flight attendants. 2 An ACM is a member of the flight attendant team who is not designated an operational role. She was having a familiarisation flight having recently completed her training. 3 It was a requirement of the operator to do a full power/TOGA takeoff, for maintenance purposes, on the first day of each month. The flight crew elected to carry this out on the sector from Stansted to Vienna. 4 In an emergency on the ground, this command is issued as an advance warning. Upon this command, flight attendants should immediately move to their doors, remain on high alert and wait for additional commands from the cockpit.

18 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 The co-pilot then went into the cabin while the commander stayed in the cockpit and maintained contact with ATC and the RFFS. In the cabin the co-pilot found no passengers but noted a lot of baggage near the exits. There were also only three of the five FA present, as two had left the aircraft to assist the passengers on the ground. The commander then requested they return to the aircraft, which they subsequently did. Flight attendants’ observations Soon after the takeoff roll started, all the FAs heard a loud noise and felt the aircraft drift to the left before coming to a stop a few seconds later. All except the SFA heard the commander announce “attention crew: on station” over the PA after which they all stood up at their assigned exits. At the front of the cabin the SFA stood in the aisle facing rearwards, while FA2 looked out of the Door 1L window. At the rear of the aircraft FA4 and FA3 looked out of Door 3L and 3R respectively while the ACM stood in the middle. No danger was observed; they thus awaited further instructions from the commander. Figure 1 shows the location of the seating positions of the FAs and doors. Figure 1 A320 doors, FA seating locations and engine hazard areas

19 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 The SFA then tried to call FA3, in the rear of the aircraft, using the interphone, to check if everything was alright. However, when FA3 stood up, his crew swivel seat displaced the attached handset from its stowage and its cable became trapped in the now folded seat5. This caused the crew high/low chime6 in the cabin to be suppressed so it was difficult for the SFA to attract FA3’s attention. There then followed an exchange between the SFA and FA3 which resulted in the SFA commanding an evacuation over the PA. See the Flight attendants’ comments section for details of this exchange. Upon hearing the command, the FAs and passengers commenced the evacuation. When FA3 opened Door 3R the escape slide inflated and floated in the air, close to the horizontal, but he did not understand why at the time. However, knowing it was unsafe to use, he blocked the exit. The slide at Door 3L inflated correctly and FA3 and 4 shouted their evacuation commands to the passengers as the passengers exited the aircraft. Several passengers brought hand baggage with them, but it was removed from them and placed by Door 3R. A similar situation with baggage occurred at Doors 1L and 1R. See the Emergency evacuation section for more on the evacuation. Once all the passengers had left the aircraft, the FAs checked the cabin. FA3 then instructed the ACM to exit the aircraft to assist the passengers. He was about to follow her but the SFA instructed all the FAs to remain on the aircraft. Shortly thereafter the FAs found out that the evacuation was not necessary. As a result, FA3 left the aircraft to find the ACM to inform her to return to the aircraft. The airport RFFS were quickly in attendance and were subsequently joined by local authority ambulances. Two injured passengers were taken to hospital and several were treated for minor injuries at the scene. The passengers were subsequently taken to the airport terminal by buses. The majority of them were able to travel on to Vienna on a replacement aircraft later that evening. The aircraft was subsequently towed off the runway to a remote parking position. Flight attendants’ comments All the FAs were initially interviewed by the AAIB the following day. Further interviews were later conducted with the SFA, FA3 and FA4. SFA’s comments The SFA stated that the noise of the engine failure was very loud. The noise and the movement of the aircraft to the left scared her. She reported that her attention was focused on the noises made by the aircraft and she did not hear the commander announce “attention crew: on station” over the PA. Footnote 5 See FA3 crew seat and cabin interphones section for more details. 6 The high/low chime alerts the FAs that there is an incoming call on the interphone. Lights in the ceiling indicate who is calling.

20 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 The SFA reported that she stood up when the other FAs stood up. She was aware of all the passengers looking at her and felt under pressure because of this. She was feeling “shocked” and overwhelmed. She attempted to contact FA3 at the rear of the aircraft, initially without success. She reported that it felt like a long time that she was trying to contact FA3. There was confusion while they attempted to communicate using a combination of the interphone, hand signals and the PA. The darkness in the cabin made the use of hand signals difficult and she could not see well enough to understand signals given by FA3. The SFA commented that she intended to obtain information from FA3 to help her decide whether an evacuation was needed. She added that FA3 said he had seen flames and sparks from the engine. Her impression was that FA3 was “scared and shocked” and FA2 was “completely shocked”. She stated she attempted to discuss what to do with FA3. However, at some point during this exchange she said “evacuate, evacuate, evacuate” over the interphone and subsequently over the PA. The SFA stated that she knew the guidance from the operator’s flight safety manual about the circumstances to initiate an evacuation but was not thinking about this at the time. See Flight attendants’ training and experience section. The SFA explained that she generally had very limited interaction with the pilots and a limited understanding of their responsibilities in an emergency. She said, “For me, it was the door closed, I have nothing to do with them.” And she did not think about contacting the flight crew at any point. FA3’s comments FA3 reported that he heard a bang when the engine failed and saw red and yellow lights through the passenger windows for one or two seconds. He recalled that FA4 told him and the ACM to stay calm and expect instructions from the flight crew. After the “attention crew: on station” announcement he fumbled with the seat when standing up. It closed very fast, knocking the interphone from its cradle. The interphone fell to the floor and the cable became trapped in the seat. The next communication he was aware of was the SFA asking “Can you hear me?” over the PA. FA3 said he subsequently had difficultly freeing the interphone. He stated that when he was eventually able to speak to the SFA she said “evacuate, evacuate, evacuate”. He did not understand why she would command an evacuation over the interphone and felt he could not open the door alone, so he told her to announce it over the PA. FA3 commented that in this situation “A few seconds feels like minutes” and it is difficult for FAs waiting after the “attention crew: on station” command because they do not know what is going on in the flight deck and feel responsibility for the passengers’ safety. FA4’s comments FA4 reported that she started briefing FA3 and the ACM after the engine failure. She told them to stay calm and wait for the “attention crew: on station” command and not to open the doors. She explained that she did this because she was aware of their inexperience and to keep herself calm.

21 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 She did not follow all the conversation between FA3 and the SFA, but she remembered FA3 saying that he had seen fire outside. She heard him tell the SFA to say the evacuation command “out loud”. She attempted to contact the SFA via the other interphone at the rear of the aircraft but was unsuccessful. Then the SFA announced “evacuate, evacuate, evacuate” over the PA. FA4 initially hesitated to begin the evacuation but when she realised that FA3 had already opened the Door 3R, she opened Door 3L. Emergency evacuation AAIB passenger questionnaire The airport operator commented that it has a requirement in its Terminal Emergency Orders for the AAIB’s passenger questionnaire to be distributed to passengers after an evacuation. However, none were given to the passengers on this occasion as an alternative aircraft had been sourced by the parent company of the operator. As a result, the airport operator’s staff were busy organising those passengers that wanted to complete their journey to Vienna. Most passengers subsequently completed their journey later that evening. After the accident the AAIB emailed its Passenger Questionnaire to the 169 passengers; 46 (27%) were subsequently returned. Injuries Local authority ambulances attended the scene. They reported that 10 patients were treated for minor injuries at the scene by paramedics. Most of the injuries were cuts, grazes, bruises and sprains. Two were subsequently taken to a local hospital for further treatment but were later discharged. While the physical injuries sustained were minor, a few passengers stated on the questionnaires that they have suffered from post-traumatic stress which they were receiving treatment for. Passengers’ comments Several of the passengers commented that after the aircraft came to a stop the FAs seemed to have problems with the PA. Additionally, they used the PA to communicate between the front and rear of the aircraft in German. Four passengers commented that they either did not hear or did not fully understand the command to evacuate. Numerous passengers also commented that the aisle and Doors 2L and 2R and the overwing exits, were impeded as people were trying to take their baggage from under seats and overhead bins. As a result, passengers were shouted at by some to leave their baggage behind. One passenger thought that about half of the passengers took their hand baggage with them. Images of passengers leaving the aircraft with baggage from the right overwing exit were captured by the RFFS’s onboard infrared CCTV camera (Figure 2).

22 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Figure 2 RFFS infrared CCTV showing some passengers leaving with baggage Of those passengers that used Door 2R, several commented that they were either nearly blown over, or were blown over several times by the jet exhaust from the right engine, with some of their belongings blown away. Figure 1 shows passengers crossing behind the engine exhaust could have been exposed to ‘wind’ speeds of 65 mph or greater, even with the engines running at idle. A320 emergency evacaution checklist The ‘EMER[GENCY] EVAC[UATION]’ checklist from the A320 Quck Reference Handbook (QRH) (Figure 3) was what the flight crew would have actioned had the commander elected to command an evacaution.

23 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Figure 3 A320 Evacuation checklist Safety studies regarding passenger behaviour during evacuation The issue of passengers taking baggage with them during an evacuation has been well documented. An NTSB safety study on evacuation of commercial aircraft7 stated that ‘Passengers exiting with carry-on baggage were the most frequently cited obstruction to evacuation.’ The study collated questionnaires from passengers who had been evacuated and found that almost 50% attempted to remove a bag during the evacuation. The primary reason given was to keep hold of high value items in the bags such as money, keys and medicine. Footnote 7 National Transportation Safety Board (2000). Emergency Evacuation of Commercial Airplanes. Safety Study NTSB/SS-00/01. Washington, DC: NTSB https://www.ntsb.gov/safety/safety-studies/Documents/SS0001. pdf [Accessed July 2020].

24 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 A similar safety study by the Transportation Safety Board (TSB) of Canada8 studied 21 evacuations and found nine in which passengers stopped to retrieve carry-on baggage and attempted to take it with them as they exited the aircraft, despite being told not to by the flight attendants. An EASA-sponsored study on CS-25 cabin safety requirements published in 20099 identified 13 evacuations in which evacuees attempted to collect cabin baggage and five where they carried baggage out of exits or down the slides. In 2018 the Royal Aeronautical Society published a paper entitled ‘Emergency Evacuation of Commercial Passenger Aeroplanes10’. It highlighted many of the factors that influence the success of an evacuation, including the tendency for passengers to take baggage with them. The paper identified six accidents where passengers evacuated with baggage. These studies identified accidents and incidents where passengers evacuated with baggage. Appendix 1 provides a list of those cases where the full report was available online and described the issues with the passengers’ behaviour. The Royal Aeronautical Society commented ‘This trend appears to be increasing and can only be exacerbated by the increasing volume of cabin baggage being permitted by some operators for commercial reasons.’ The paper stated that operator practice of charging for hold baggage has resulted in there being more baggage in the cabin and an increased number of passengers travelling with only cabin baggage. The Royal Aeronautical Society paper emphasises the point that passenger behaviour is not strongly influenced by briefing or flight attendant instructions and recommends: ‘Aviation authorities should consider the feasibility of introducing a certification requirement for a means of remotely locking, from the flight deck, overhead bins in passenger cabins that do not contain emergency equipment, for taxi, take-off and landing.’

Footnote 8 Transportation Safety Board Canada (2013). Aviation Safety Study SA9501: A safety study of evacuations of large passenger carrying aircraft. https://skybrary.aero/bookshelf/books/2699.pdf [Accessed July 2020]. 9 European Aviation Safety Agency (2009). Project EASA.2008.C18 Study on CS-25 Cabin Safety Requirements. https://www.easa.europa.eu/sites/default/files/dfu/1%20-%20Study%20on%20CS-25%20 Cabin%20Safety%20Requirements-easa.2008.c18.pdf [Accessed July 2020]. 10 Royal aeronautical society (2018). Emergency Evacuation of Commercial Passenger Aeroplanes. https:// www.aerosociety.com/media/8534/emergency-evacuation-of-commercial-passenger-aeroplanes-paper.pdf [Accessed July 2020] .

25 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Safety recommendations following previous evacuations On 16 April 2012 an Airbus A330, registration G-VSXY11, was en route from London Gatwick Airport to McCoy International Airport in Orlando, USA, when a smoke warning in the aft cargo compartment illuminated. After a successful emergency landing an emergency evacuation was ordered. The AAIB report concluded that some passengers slowed their own evacuation due to issues with cabin baggage. As a result, the following Safety Recommendation was made: Safety Recommendation 2014-005 It is recommended that the European Aviation Safety Agency amend AMC1 CAT.OP.MPA.170, ‘Passenger briefing’, to ensure briefings emphasise the importance of leaving hand baggage behind in an evacuation. The EASA’s response to this Safety Recommendation was that it had evaluated this safety issue within the framework of rulemaking tasks RMT.0516 and RMT.0517 Updating Air OPS Regulation (EU) No 965/2012/Implementing Rules and related Acceptable Means of Compliance (AMC) & Guidance Material (GM). The outcome of the evaluation was contained in EASA Executive Director (ED) Decision 2017/008/R, which was published on the EASA website on 30 March 2017. The ED Decision introduced new text under AMC1 CAT.OP.MPA.170 on ‘passenger briefing’ which states that, before takeoff and before landing, passengers should be briefed on/ reminded of the importance of leaving hand baggage behind in case of evacuation. This is stated in Section 1.2.12, Passenger briefing, of the operator’s Flight Safety Manual. The ED Decision also introduced guidance under GM2 CAT.OP.MPA.170, (f)(5)(vi) Passenger briefing - safety briefing material which states that the operator should consider including information on leaving hand baggage behind, in its safety briefing material on emergency exits. The operator of OE-LOA had this information on its passenger safety cards that were in each seat pocket of the aircraft and in Section 1.1.12.4, Safety card, of its Flight Safety Manual. The EASA stated that emergency evacuations had also been captured as a candidate safety issue within their safety risk portfolio for commercial air transport (fixed wing), as part of the EASA’s safety risk management process. Footnote 11 The full report into the accident involving G-VSXY can be found here: https://www.gov.uk/aaib-reports/1- 2014-g-vsxy-16-april-2012 [Accessed July 2020].

26 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 CS-25 requirements for evacuation emergency demonstration CS-25.80312 requires that all passengers and crew can be evacuated within 90 seconds and compliance must be shown using a demonstration. Appendix J of CS-25 specifies test criteria and procedures for the demonstration. It must be conducted in the dark with a certain mixture of passengers in terms of age and gender. It requires a proportion of cabin baggage and other items to be placed in the cabin to act as minor obstructions. It does not require any of the simulated passengers to retrieve their own baggage and attempt to leave the aircraft with it. Flight attendants’ training and experience The SFA initially qualified as a FA in May 2017 and flew from then until November 2017 for the previous operator13. Between December 2017 and March 2018 she did not fly due to the previous operator going bankrupt and the current operator commencing operations. She resumed working for the current operator who had taken over as the AOC holder. She completed SFA training and was promoted to SFA in May 2018. FA4 also worked for the previous operator and had a period of not flying between December 2017 and March 2018. All the other FAs were recruited after this. The ACM was completing her first familiarisation flight following her initial training. The operator reported that the initial FA training course was designed for 20 to 25 trainees, though there was no formal limit. It consisted of a six-week classroom-based course and practical training using a Cabin Emergency Evacuation Trainer (CEET)14. The SFA’s initial FA course was attended by 39 trainees. Her SFA course was a five-day classroom-based course. Though the SFA and FA4 were initially trained by a previous operator, there was a lot of continuity of practice and staff between the previous and current operators. All practical training scenarios in the CEET resulted in a simulated evacuation. The initial and senior training received by these FAs did not include examples of the pilots’ activities when responding to an emergency or the potential effects of startle and surprise on FA performance. The operator did not have their own FA simulation training facility and relied on the use of a facility owned by another operator. All FA training met the relevant requirements and was approved by the national aviation authority. Footnote 12 European Union Aviation Safety Agency (2020) Certification Specifications and Acceptable Means of Compliance for Large Aeroplanes CS-25. Amendment 24, 10 January 2020. https://www.easa.europa.eu/ sites/default/files/dfu/CS-25%20Amendment%2024.pdf [accessed on 30 March 2020]. 13 The current operator started on 1 March 2018. All references in this report to the ‘operator’ refer to this current operator unless they are specifically identified as the ‘previous operator’. 14 A simulation device that approximates the passenger cabin environment and equipment to enable practical emergency scenarios to be trained.

27 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Organisational information The operator’s Operations Manual, Part A, stated: ‘the designated senior flight attendant must have at least one year’s experience as an operating cabin crew member.’ The operator did not have any requirements for the composition of the FA team in terms of experience. Emergency evacuation initiation Normally the commander would initiate an emergency evacuation using the PA. However, FAs can command an evacuation under certain circumstances. These are stated in the operator’s Flight Safety Manual: ‘1.16.1 Carrying out an evacuation … If no evacuation command is issued from the cockpit, and there is no doubt that an evacuation is necessary, the Senior FA or any other FA can initiate an evacuation under the following conditions: a) Immediate danger (fire, smoke, explosion, water etc.) b) Cockpit crew is incapacitated (injured, not on board) c) Communications down due to heavy damage to aircraft’ Aircraft information Evacuation routes The slides available on the aircraft are shown in Figure 1. FAs do not supervise the overwing exits but give a brief to those passengers adjacent to them about their duties in the event of an evacuation before departure. FA3 crew seat and cabin interphones There were three interphone handsets located in the aircraft; one at the front and two at the rear. A rear aisle swivel seat folded away from the wall and locked into position to provide a forward-facing view into the passenger cabin. When the release latch was lifted, the seat automatically folded back into the stowed position (Figure 4). The rear interphone intended for use by FA3 was located on the aisle swivel seat.

28 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Figure 4 Rear aisle swivel seat in stowed (left) and forward-facing (right) positions   Figure 5 Example picture of interphone dislodged from the cradle and trapped in the stowed seat

29 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Figure 6 Interphone handset Figure 6 shows the buttons available on the passenger cabin interphones. It was possible to call the FA3 interphone handset individually from the front handset using the aft r[ight] attnd [flight attendant] button or to call all handsets together using the all attnd button. If the handset was called individually, and it was not fitted on its cradle, the attention getters of the chime and panel lights would not activate. According to the FAs, it was common for the interphone handsets to fall from their cradles. The aircraft was serviceable and there were no entries in the aircraft technical log or cabin log about the interphone. An example interphone on the folding seat was inspected in the CEET during the investigation and it was easily dislodged from the cradle when the seat was released to fold back. The equipment manufacturer was informed about this during the investigation. There were no previous reports in their in-service experience database of seat-mounted cabin interphones becoming dislodged when the seat was released. Evacuation signal The aircraft was fitted with an evacuation signal. The operator’s procedure was for the evacuation signal to be set only to be activated from the cockpit and not from the passenger cabin. Recorded information The FDR and CVR were recovered from the aircraft and downloaded at the AAIB. Both recorders captured the event and the recordings have been used to help write the History of the flight section. The CVR contained a number of discussions between the flight crew and the FA, but not the PA in the cabin.

30 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 The CVR is a 4-channel recorder which records audio from the commander, co-pilot, cockpit third occupant station and the Cockpit Area Microphone (CAM). Each of the occupants can control their audio (and subsequent CVR recording) using a dedicated Audio Control Panel (ACP). If the PA recept[ion] is selected on an ACP, the CVR will record any PA announcements. The operator’s FCOM contains a number of the checklist items required to be completed prior to each flight. One of these items is to ensure the third occupants ACP is set to enable audio from the PA system so the CVR will record it: THIRD OCCUPANT AUDIO CONTROL PANEL PA knob…………………………………………............……………..RECIEPT

• This allows cabin attendant announcements to be recorded on the CVR.
• For proper recording, set volume at or above medium range.

The co-pilot stated that he checked this item before the flight. It is believed recept is deselected when there is a third occupant, as this avoids all PA announcements being heard through their headset. A check of the system by the operator’s engineers found it to be serviceable. Engine aspects General description The CFM 56-5B engine is a two spool, high bypass ratio turbofan engine. It has a single‑stage fan and a four-stage booster which together comprise the LP compressor (LPC) and a nine‑stage HP compressor (HPC). The LPC is driven by a four-stage LP turbine and the HPC is driven by a single-stage HP turbine. It has a Full Authority Digital Engine Control (FADEC) which provides engine control and monitoring via the Engine Control Unit. The HPC increases the pressure of the air as it passes from stage to stage, in order to supply the combustor section. It is comprised of a rotor, front stator and rear stator. The Variable Stator Vane (VSV) system, located at the forward end of the HPC (Figure 8), positions the Inlet Guide Vanes (IGV) and the stage 1, 2 and 3 stator vanes to the appropriate angle to optimise the airflow over the HPC rotor blades (Figure 9). The VSV actuation system consists of two hydraulic actuators located at the 2 o’clock and 8 o’clock positions, a series of bellcranks, tie rods and four actuation rings (one for each stage) made in two halves. The actuation ring halves are connected at the split-line of the compressor casing by a connecting link, to which the actuator tie rods are connected. Each vane is connected to the actuation ring by a lever arm. The connecting links and actuation rings rotate circumferentially about the horizontal axis of the compressor in response to actuator inputs and this movement is transmitted through the lever arms to change the angular position of the vanes.

31 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 The Variable Bleed Valve (VBV) system is located forward of the HPC. It regulates the amount of air discharged from the LPC into the HPC. Figure 8 Section of High Pressure Compressor showing rotor, IGVs and VSVs Figure 9 Example High Pressure Compressor rotor blade

32 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Engine maintenance history The left engine, engine serial number (ESN) 697283, was manufactured in 2007 and had been fitted to the aircraft since new. The aircraft had been leased to an Indonesian operator prior to entering service with the current operator. During the return-from-lease inspection several defects were identified with the engine which resulted in its removal and subsequent repair at an engine overhaul facility in Indonesia. During the repair process, the IGV and VSV actuation rings were split to remove the top half of the HPC case (front stator), allowing access to replace two damaged HPC blades. This involved disassembly of the connecting links on the IGV and VSV actuation rings. The IGV and VSV actuation rings and connecting links were reassembled after reinstallation of the HPC case. No defects were noted during the post-repair inspections or the subsequent engine test cell runs and the engine was refitted to the aircraft. The operator took delivery of the aircraft, registered as OE-LOA, on 22 December 2018. No maintenance was performed on the left engine between then and the accident, other than routine oil replenishment, and there were no relevant defects in the technical log. At the time of the accident the engine had accumulated 513 operating hours and 220 cycles since the engine repair. Engine examination The aircraft had been moved from the runway but debris which had exited the left engine was collected from the runway by the Airport Authority and provided to the AAIB (Figure 10). The items collected included multiple IGVs, fragments of compressor blades and fragments of engine acoustic liner. Figure 10 Items collected from the runway (Note: the yellow items are frangible links from the emergency evacuation slides)

33 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Preliminary examination of the engine identified that the engine casing had not been breached but that engine parts, predominantly IGVs, had exited the engine through the VBV louvre panels. Other parts, later identified as IGV vanes and HP compressor stage 1 blade fragments, had collected in the VBV sumps. The engine centrebody exhibited a circumferential crack running around approximately 270° of its diameter. Debris retrieved from inside the engine cowlings was identified as fragments of washers and bushings from the IGV and variable stator vane (VSV) actuation rings. Engine borescope inspection An engine borescope inspection identified that the fan blades and LPC booster stages 1 to 3 were undamaged but the trailing edges of all LPC stage 4 blades and stators exhibited substantial impact damage including dents, tears and missing material. The HPC rotor could not be rotated, but it was evident that all IGVs were missing and extensive damage had been sustained by all HPC stage 1 blades. The downstream stages of the HPC exhibited extensive damage and some stage 1 VSVs were missing. Engine strip examination General An engine strip examination was conducted at an approved engine overhaul facility under the supervision of the AAIB. External examination A single IGV lever arm in the 3 o’clock position (aft looking forward) immediately below the split-line of the HPC case, was found to be disengaged from the connecting link on the IGV actuation ring (Figure 11). This lever exhibited no distortion or damage but did have a small impact mark on its forward edge, which coincided with where the lever arm could come in to contact with the HPC case if it was not connected to the connecting link. There was no corresponding mark on the HPC case. Approximately half of the remaining IGV lever arms were bent or distorted and many of the bushings in the IGV actuation ring were absent or damaged.

34 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Figure 11 Lever arm disconnected from connecting link on IGV actuation ring Internal examination of the HPC module Disassembly of the HPC module showed that all the IGVs had sheared at their outer platform. All 38 HPC stage 1 blades were damaged. Four blades (Nos 10, 12, 13 and 37) had ruptured below the blade platform and one blade (No 9) had separated above the blade platform, releasing the remainder of the blade (Figure 12). Another three blades exhibited cracking below the platform. The damage to HPC stator vanes and blades downstream of stage 1 was consistent with secondary impact damage from the release of the stage 1 blades and the resulting rotor imbalance.

35 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599     Figure 12 HPC module showing missing IGVs and damaged stage 1 blades Detailed examination of the fracture surfaces of the HPC stage 1 blades which had separated below the platform, showed initiation of high-cycle fatigue (HCF) above the pressure surface on the concave side of the blade, near the leading edge. The fatigue had propagated downward and through the thickness of the blade. Beyond the area of HCF, the fracture surface was consistent with tensile overload. Blade 10, which exhibited the greatest area of fatigue, was most likely the first blade to be released (Figure 13). The fracture surface of the blade which had failed above the platform was consistent with tensile overload and had been heavily smeared, which was indicative of secondary damage. On the blades which exhibited below-platform cracking, the cracking was consistent with the initiation of HCF in the blade dovetail, but the fatigue had not yet propagated to the point of tensile overload. Detailed component examination – IGV hardware The IGV connecting link exhibited no damage. Approximately half of the lever arms were bent or distorted, including several immediately adjacent to the disconnected lever arm. The disconnected lever arm, which was free to rotate exhibited a contact mark, most likely from contact with the HPC case.

36 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Figure 13 Fracture surfaces of blades exhibiting below-platform liberation Known effects of disengaged IGV/VSV lever arm The engine manufacturer advised that a disengaged, bent or broken IGV or VSV lever arm will result in an off-schedule variable vane which does not move in unison with the other vanes. This will cause variation in the airflow around the vane, and lead to a once‑per‑revolution (1/rev) excitation of the adjacent blades as they rotate past the vane. The force of the excitation is proportional to the angle of the off-schedule vane. The excitation creates stresses in the blade which are beyond the design limit. This phenomenon typically results in below-platform fracture in the blade dovetail, caused by a fatigue crack which initiates on the concave face of the blade and propagates towards the convex face. The crack grows with every loading cycle (aerodynamic excitation) and as it does, the load-carrying capability of the blade reduces, until ultimately it fails in tensile overload. The engine manufacturer determined that the blade fracture surfaces from this event, were consistent with its experience of previous events where 1/rev aerodynamic excitation had occurred as a result of one or more disengaged, bent or broken IGV/VSV lever arms. The engine manufacturer is aware of approximately 200 off-schedule VSV findings and/or events, of which 22 were attributed to improper engagement of lever arms in the connecting links. Thirteen of those, including this event resulted in HPC blade release. Of those, ESN 697283 had the lowest cycles to failure (220 cycles) and was among those with lowest time to failure (513 hours). The remaining nine occurrences were detected before blade release occurred. The previous thirteen events have shown that the time to blade release is variable and can be influenced by the magnitude of the excitation force, the individual blade material properties and the nature of the improper engagement of the lever arm.

37 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Other findings during engine disassembly During the engine examination several non-conformances were noted with components which may have been disturbed during the recent engine repair, but these were not considered causal or contributory to the engine failure. Non-conformances were also noted with engine components which were not disturbed during the recent repair and it was outside the scope of this investigation to determine when these non-conformances had occurred. Maintenance documentation CFM56 Engine Shop Manual (ESM) task 72-00-32-430-001 ‘Compressor Front Stator Assembly – Installation’ includes the following instructions to verify that the IGV and VSV lever arms are correctly installed in the connecting links. ‘…. CAUTION: HIGH PRESSURE COMPRESSOR BLADE DAMAGE WILL OCCUR IF THE LEVER ARM PINS ARE NOT CORRECTLY ENGAGED INTO THE CONNECTING LINKS AND ACTUATION RING BUSHINGS. (6) Do a visual inspection to make sure all of the lever arm pins are correctly engaged as follows: (a) Verify the lever arm pins are properly installed into each of the connecting links. 1 Place a white stripe across four IGV lever arm pins and bushings (2 each side). Use a temporary marking pen. 2 Place a white stripe across eight stage 1, 2 and 3 lever arm pins and bushings (4 each side). Use a temporary marking pen. (b) Verify that all IGV and stage 1, 2 and 3 lever arm pins are engaged around the entire VSV system.’ Information from the engine maintenance facility Personnel from the engine overhaul facility were interviewed on behalf of the AAIB by the Indonesian National Transportation Safety Committee. The mechanic who installed the IGV and VSV connecting links, reported that although access was difficult in some places, he did not find any discrepancies with the lever arms when performing the task. Similarly, the certifying engineer who inspected the installation of the IGV and VSV connecting links and those involved in other related tasks on the VSV actuation system, did not note any discrepancies with the lever arms. Additionally, no defects were identified during the post-maintenance inspections. The maintenance job card for the installation of the IGV and VSV connecting links referenced the relevant ESM task and was stamped as having been completed and inspected. When asked about what circumstances might have contributed to the IGV lever arm not being attached to the connecting link, the mechanic involved stated that he did not know how this occurred, but that since there are several external accessories that needed to be moved for access, it might be possible to

38 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 overlook tightening a lever arm. The certifying engineer indicated his belief that if an IGV was not secure, an engine surge or stall would occur during the post-maintenance engine run or post maintenance check flight. ESN 697283 was the first CFM56-5 engine that the engine overhaul facility had worked on, but the engineers working on ESN 697283 had undertaken CFM-56-5 training and were accustomed to working on CFM56-3 and CFM56-7 engines. They reported that they did not encounter any significant differences or difficulties working the IGV/VSV system. The engineers reported that there were no issues with workload, overtime or night working during the engine repair, as all maintenance tasks were planned to be completed within a day shift. They indicated that they had good access to tools and that the ESM was available at every workstation. Analysis Flight crew aspects After the failure of the left engine the flight crew responded correctly by rejecting the takeoff, bringing the aircraft to a stop and announcing “attention crew: on station” to the FAs and actioning the ECAM checklist. As the engine failure was secured by the crew actioning the ECAM checklist and there were no other causes for concern, the decision to vacate the runway under the power of the right engine was appropriate. The crew were subsequently surprised to see a cabin door open, a slide deployed and passengers walking in front of the aircraft. The commander then contacted the SFA to ask why an evacuation had been initiated. After this exchange he realised that passengers were going towards the right engine, which was still operating. Had any of them entered the right engine’s inlet suction danger area (Figure 1, Area A), it is possible that they could have been sucked into the engine. The right engine was shutdown 2 minutes after the commander noticed that Door 1L was open. Once they had noticed that an evacuation had commenced there was realistically no way that the flight crew would have been able to recover the situation. It may have been prudent to action the EMER EVAC checklist to ensure that the aircraft systems were all in as safe a state as possible for the passengers to exit the aircraft. However, given that passengers were potentially going to encroach into the right engine’s inlet suction danger area it was probably quicker to select the eng master to off. Had the commander prioritised shutting down the engine and thus had a more succinct discussion with the SFA, the right engine could have been shut down sooner. Flight attendant aspects All evacuations carry risk of passenger injury so flight attendants should not command an evacuation unless there is no doubt that it is required. The operator’s Flight Safety Manual listed the circumstances when flight attendants should initiate an evacuation and none of these criteria applied. A combination of factors combined to overwhelm the SFA and cause her to command the evacuation over the PA.

39 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 At the front of the aircraft, the noise of the engine failure sounded very loud to the two FAs. The SFA was startled by the noise of the engine failure and the movement of the aircraft to the side of the runway. This appears to have caused her to narrow her attention to the aircraft sounds so that she did not hear the “attention crew: on station” command. The other FAs all heard it and were not aware that she had not. Initially it was organised and calm in the cabin at the rear of the aircraft. The crew members there were helped by the calming influence of FA4 who was more experienced. Also FA3 and the ACM were recent recruits and may have benefitted from the recency of their training. Communication between the SFA and FA3 was not effective in either means or content. The crew members’ and passengers’ accounts suggested that communication was attempted using a combination of the PA system, the interphone, shouting and hand gestures. A combination of English and German language was used. The interphone at the FA3 seat was knocked off by the force of the folding seat closing. This resulted in the attention-getting chime and lights being inhibited so there was a delay between the SFA calling and establishing communication. The FAs reported that the handsets were prone to falling out of the cradle. It was dark outside, and the cabin lights were dimmed for takeoff. The lack of light in the cabin made it difficult to see what was happening at the rear of the aircraft so communication by hand signals was not effective and the SFA could not see that the interphone was stuck. The communication difficulty meant that the SFA could not establish whether the situation was safe at the rear of the aircraft. The SFA formed the impression that all the other flight attendants were scared. Only one minute and twenty seconds elapsed between the “attention crew: on station” command and the ‘evacuate’ command by the SFA. It would have felt like much longer to the flight attendants, especially the SFA who had heard nothing from the cockpit and felt under pressure from the passengers. Altogether this increased her anxiety and uncertainty and contributed to her commanding the evacuation. Any FA could have contacted the cockpit during this time. The FAs who heard the “attention crew: on station” command would have been unlikely to do so because they understood the procedure to wait. The SFA had not heard this command but it did not occur to her to contact the pilots. As well as her emotional state, this may have been partly because her interactions with them were so limited under normal circumstances. The operator did not provide training for FAs and pilots designed to increase their interaction and understanding of each other’s roles. All FAs had been trained that the pilots would be busy in an emergency, but they had no understanding of the tasks the pilots were doing or how long they would take. Not all passengers heard the evacuation command on the PA. If the evacuation signal had been used the passenger response and the overall evacuation may have been quicker. However, this was not available to the FAs and the pilots were unlikely to operate it given they had not commanded the evacuation.

40 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 The SFA had recently been promoted after a relatively short time as an FA. During her time as FA, there was a period where she did not fly due to the operator’s bankruptcy. As a result, she did not meet the operator’s requirement for promotion in terms of duration of operational experience. Her initial training course as an FA was within a large group which may have resulted in aspects not being fully explained or understood by all that attended. The pressure to have staff operationally available for flights after the bankruptcy and change of operator meant that the subsequent training for SFA was purely theoretical and short in comparison to the operator’s more recent practice. These factors may have meant that the SFA was not well prepared for her role in the emergency. All FA practical training for emergencies involved a practice evacuation. None of them had practiced a return to normal operation. This may have resulted in a false expectation that all emergencies would result in an evacuation. Overall, it seems that the SFA’s emotional response to the emergency was aggravated by her general inexperience and the communication difficulties the FAs encountered. Despite meeting regulatory requirements, there were weaknesses in her training that meant she was not well prepared for the situation. Together this resulted in an overwhelming ‘flight’ response in which she felt the need for herself and everyone else in the cabin to escape the situation as quickly as possible. She did not contact the pilots and ended up commanding an evacuation. The operator has undertaken to implement a range of improvements to FA training and to instruct FAs to attempt to establish communication with the flight deck before commanding an evacuation. The evacuation Once the evacuation was commenced it was important that it proceeded in as safe and efficient a manner as possible to minimise the risk of passenger injury. In general, the evacuation proceeded swiftly, without significant panic or delay. The event provided an opportunity to learn about factors that influence a safe and efficient evacuation. Many passengers in this evacuation collected their bags and attempted to leave the aircraft with them. At the supervised doors, the FAs removed baggage from them. At the unsupervised overwing exits passengers with bags could exit unchallenged. Baggage brought to the exits created difficulty for the FAs who then needed to remove it and store it somewhere which could have created an obstruction. The carried baggage probably slowed the evacuation and had the potential to damage the escape slides or injure other passengers on the slides. It was not possible to determine how long the evacuation took compared to the CS-25 requirement of 90 seconds. The safety studies by the NTSB, TSB Canada, EASA and the Royal Aeronautical Society show that carried baggage has long been an issue. Appendix 1 lists many of the evacuation events identified in these four studies and provides additional details. It shows that it is extremely common for passengers to carry off bags in evacuations, even when there is a clear and immediate threat to life from remaining on board the aircraft. One of the events shows that even trained flight crew are not immune from the compulsion to keep their possessions with them. There were several examples where witnesses reported that

41 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 this passenger behaviour slowed the evacuation or that the evacuation took longer than 90 seconds. The Royal Aeronautical Society commented that: ‘This trend appears to be increasing and can only be exacerbated by the increasing volume of cabin baggage being permitted by some operators for commercial reasons.’ The Society made a recommendation to consider physical means of preventing passengers retrieving their baggage: ‘Aviation authorities should consider the feasibility of introducing a certification requirement for a means of remotely locking, from the flight deck, overhead bins in passenger cabins that do not contain emergency equipment, for taxi, take-off and landing.’ Current mitigations for the issue include passenger briefing and printed instructions on the cabin safety card. However, the motivation for passengers to remain united with their baggage is extremely powerful and, in some cases, the danger is not immediately apparent to passengers. These factors may lead passengers to feel it is safe to pause and collect baggage and for the evacuation to proceed at a slower pace. For a high proportion of passengers, briefing and instruction by FAs does not overcome this. The EASA addressed previous Safety Recommendation 2014-005 and published new acceptable means of compliance in AMC1 CAT.OP.MPA.170 on ‘passenger briefing’ and new guidance material in GM2 CAT.OP.MPA.170, (f)(5)(vi) ‘Passenger briefing - safety briefing material’ almost two years before this accident. The operator was compliant with the new material but, despite these improvements, the instructions about baggage still did not influence this behaviour for a high percentage of passengers. The evidence from this accident, in combination with the collated evidence from previous cases shows that, even despite recent improvements, it remains the case that passenger briefing, safety cards and FA instructions are insufficient to stop passengers retrieving cabin baggage during an evacuation. This hazard will still exist in future emergencies unless additional measures are taken to either reduce the impact of that behaviour on the safety and speed of an evacuation or to prevent passengers evacuating with baggage. Therefore, the following Safety Recommendation is made: Safety Recommendation 2020-018 It is recommended that the European Union Aviation Safety Agency commission research to determine how to prevent passengers from obstructing aircraft evacuations by retrieving carry-on baggage.

42 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 This incident has shown once again that, during an emergency evacuation, a proportion of passengers will attempt to leave the aircraft with their carry-on baggage slowing the evacuation process. The emergency evacuation demonstrations conducted to show compliance with CS-25 do not include a realistic simulation of this aspect of passenger behaviour which will slow down the evacuation and increase the risk of injury. Therefore, the following Safety Recommendation is made: Safety Recommendation 2020-019 It is recommended that the European Union Aviation Safety Agency consider including a more realistic simulation of passenger behaviour in regard to carry‑on baggage in the test criteria and procedures for the emergency demonstration in CS-25. Engine failure The left engine experienced a contained failure as a result of the release of several HPC stage 1 blades. The blade failures were caused by crack progression due to HCF with final failure due to tensile overload. Several other blades also exhibited fatigue initiation in the blade dovetail. The fatigue failures on the liberated blade fracture surfaces were consistent with failure due to a known aerodynamic excitation phenomenon which results from an off-schedule IGV/VSV condition and creates stresses in the blade which are beyond the design limit. One IGV lever arm was found disconnected from the connecting link on the IGV actuating ring and would have provided the stimulus for the aerodynamic excitation. In comparison with other blade liberation events arising from improper engagement of IGV/ VSV lever arms with the connecting link, ESN 697283 demonstrated a low time to failure. The magnitude of the excitation force, and therefore the time to failure, depends on the extent to which the affected vane is off-schedule (the angle between it and the other vanes). The fact that the lever arm was fully disengaged from the connecting link and the vane was therefore free to move, may have influenced the comparatively low time to failure. The release of the HPC stage 1 blades resulted in separation of all the IGVs and the forces experienced by the vanes would have been transmitted through the lever arms and into the actuation ring. The absence of damage on the disconnected lever arm indicates that it was disconnected from the connecting link prior to, and not as a result of, the engine failure. The IGV actuation ring connecting links were removed and reassembled during the recent engine repair, and it is probable that mis-assembly of the lever arm occurred at this time. The relevant ESM task contains instructions for a visual inspection to verify proper installation of the lever arms. But the mis-assembly was not identified by maintenance staff during installation of the IGV connecting link, visual inspection, or during other maintenance conducted in the immediate vicinity of the lever arm. As reassembly of the engine progressed, it is unlikely that the disconnected IGV lever arm could have been easily detected as it would have been obscured by the external hoses, pipes and brackets. It is also highly unlikely that post-maintenance engine-runs would have detected an improperly assembled IGV lever arm.

43 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 The time elapsed between the engine repair and the subsequent investigation and the absence of anything particularly memorable about the installation of the connecting links, meant that there was limited information available regarding the factors which may have contributed to the IGV lever arm mis-assembly. The engine manufacturer commented that it considered incomplete installation of components as ‘‘a common skill-based error’’. Additional training or revisions to maintenance documentation have typically been shown to be ineffective in preventing improper component installation. In general, such occurrences can only be reliably prevented by design solutions, or an error-tolerant design from the outset. The engine manufacturer has considered these aspects and determined that the addition of further instructions in the ESM is not likely to be an effective mitigation. Mitigating or eliminating the possibility of an improperly assembled IGV/VSV lever would require an engine redesign which it does not consider feasible based on the low rate of occurrence. It further indicated that the limited space, concentration of moving parts and engine temperatures in the vicinity of the IGV/VSV actuation rings would preclude the installation of a placard to highlight the correct assembly of the IGV/VSV connecting links. The engine manufacturer presented on the subject of improper IGV/VSV lever arm assembly and its consequences at an All Operators Conference in June 2019 and published an article in its monthly publication ‘Fleet Highlites’, available to all CFM operators and approved overhaul facilities, in January of 2020. It also intends to highlight this subject during calls with its field service representatives for onward dissemination to operators and overhaul facilities. There is currently no means, other than visual inspection, to detect improper lever arm assembly. The engine manufacturer has recently implemented an HPC performance analytic tool that is designed to detect shifts in HPC efficiency. Relevant alerts from the analytic tool are notified to operators. While there is not currently enough experience with the analytic tool to determine if the effects of a mis-assembled lever arm could manifest as a detectable shift in engine performance, the engine manufacturer intends to evaluate this possibility as experience with the tool increases. CVR Discussions between the flight crew and FAs were captured on the CVR which aided the investigation. However, the PA announcements were not recorded which would have provided useful information for this investigation. The operator’s pre-flight checklist required ACP selections to ensure the PA was recorded. It was not established why the CVR did not record the PA audio. Conclusions The left engine experienced a contained engine failure. All the damage found in the engine was consistent with the release of one or more high-pressure compressor stage 1 blades as a result of high-cycle fatigue arising from aerodynamic excitation of the blades. A single inlet guide vane lever arm, which had been improperly assembled in the connecting

44 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 link on the inlet guide vane actuation ring, was identified as the source of the stimulus that resulted in the blade release. As a result of the engine failure and subsequent rejected takeoff, the Senior Flight Attendant commanded an emergency evacuation that was not necessary in the circumstances. This was probably the result of a combination of factors that heightened her emotional response to the event and affected her decision making. The factors included inexperience as a flight attendant, weaknesses in her training and communication difficulties during the event. As a result of the flight crew not being consulted before the evacuation was commenced, the right engine remained running for the first few minutes of the evacuation. This led to an increased risk of serious injury to those passengers that evacuated on the right side of the aircraft. Indeed, several passengers sustained minor injuries having been blown over by the exhaust. During the evacuation several passengers hindered the evacuation by taking their cabin baggage with them. While some were removed by the flight attendants at the supervised exits, this was not possible at the overwing exits. Two Safety Recommendations are made regarding passengers evacuating with carry-on baggage. Safety actions As a result of this event the operator has stated that several safety actions have been or will be completed, including: Procedures ● ● The operator sent a Memo, on 19 May 2020, to all its Airbus pilots instructing them to ensure the PA recept is selected on an Audio Control Panel, thus ensuring the CVR records any PA announcements. ● ● The operator’s Flight Safety Manual will be amended to instruct the Flight Attendants to attempt to establish communications with the flight crew to check that an evacuation is safe and necessary before commanding it independently. Training The operator has taken the following safety actions in relation to its flight attendant training. The operator has: ● ● Augmented the team responsible for training with the addition of a deputy manager of flight attendant training. ● ● Introduced a maximum limit of 25 trainees in initial flight attendant training courses. After approval from the operator’s competent authority, it was subsequently increased to 30 in April 2020.

45 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 ● ● Added practical training in the CEET to the senior flight attendant course as standard. Practical training has also been incorporated in their annual recurrent training. ● ● Improved variety of training scenarios in the CEET, including scenarios that result in a return to normal operations rather than an evacuation. ● ● Improved the syllabus of flight attendant training to include the performance effects of startle, an improved 30-second review15 technique and enhanced communication training. ● ● Produced a video training aid that will introduce flight attendants to the actions of the flight crew after a rejected takeoff. ● ● Extended the aeroplane familiarisation phase during initial training with additional familiarisation flights. Crew composition ● ● The operator has introduced a requirement in the Operations Manual regarding flight attendant team composition. A minimum of two experienced flight attendants shall be part of the operating crew’s complement. This is 50% of the operating crew members, as their A320s are operated with four flight attendants. The engine manufacturer has stated the following safety actions have or will be taken: ● ● Provided a presentation on the subject of improper IGV/VSV lever arm assembly and its consequences at an All Operators Conference in June 2019 and published an article in its monthly publication ‘Fleet Highlites’ in January 2020. ● ● Highlight the issue of improper IGV/VSV lever arm assembly during calls with its field service representatives for onward dissemination to operators and overhaul facilities. ● ● Evaluate the use of a HPC performance analytic tool to determine if the effects of a mis-assembled lever arm could be identified from a detectable shift in engine performance. Published: 6 August 2020. Footnote 15 A process where FA mentally rehearse the steps they would have to take during an evacuation before each takeoff and landing.

46 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Aircraft type Location Date Registration Comments Link B747-200 London Gatwick, UK 07/08/1990 N303TW Tailpipe fires in three engines. Witnesses reported that passengers attempted to carry hand baggage to the exits and to re-stow it in the overhead lockers when instructed not to take it. Some passengers carried baggage down the emergency slides. The time taken to complete the evacuation exceeded 90 seconds. https://assets.publishing. service.gov.uk/ media/5422fca2e5274a13170008ef/ Boeing_747-200__N303TW_11-90. pdf McDonnell Douglas MD-80 San Francisco, USA 19/12/1997 N932AS Noxious fumes during taxi. Flight attendants reported they had to remove carry-on baggage from passengers during the evacuation. https://app.ntsb.gov/pdfgenerator/ ReportGeneratorFile.ashx?Event ID=20001208X09328&A Key=1&RType=Final&IType=IA McDonnell Douglas MD-11 Hong Kong 22/08/1999 B-150 Crashed on landing in poor weather, caught fire and became inverted. Some passengers commented that their evacuation was slowed by other passengers trying to recover their hand baggage. https://reports.aviation-safety. net/1999/19990822-0_MD11_B-150. pdf A330-243 Terceira- Lajes, Azores, Portugal 24/08/2001 C-GITS Emergency landing after double engine failure due to fuel exhaustion. Many passengers attempted to leave with carry- on baggage. https://reports.aviation-safety. net/2001/20010824-1_A332_C-GITS. pdf McDonnell Douglas MD-88 Groningen Airport, Netherlands 17/06/2003 TC-ONP Rejected takeoff above decision speed and runway overrun. Most passengers took their hand baggage with them or re- entered the aircraft to retrieve their hand baggage. Some passengers reported that the evacuation took too much time and attributed this to people collecting their baggage before leaving. Identified in the EASA study as taking longer than 90 seconds to complete the evacuation. https://www.onderzoeksraad.nl/en/ page/750/runway-overrun-after- rejected-take-off-md-88-groningen- airport-eelde Appendix 1 Previous accidents and incidents where passengers evacuated with baggage

47 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Aircraft type Location Date Registration Comments Link B747-438 Sydney, Australia 02/07/2003 VH-OJU Landing gear fire. Some passengers evacuated with cabin baggage. Cabin crew reported they were unsure whether to remove baggage or not. Those that did remove baggage reported a build-up of baggage that potentially slowed passenger movement from the aircraft. https://www.atsb.gov.au/ media/24408/aair200302980_001.pdf DC10-10F Memphis, Tennessee 18/12/2003 N364FE Cargo flight, fire following a hard landing. Non-revenue pilots travelling as passengers threw their bags out during the evacuation because they contained travel documents, clothes and baggage. https://www.ntsb.gov/investigations/ accidentreports/reports/aar0501.pdf B737-406 Barcelona, Spain 28/11/2004 PH-BTC Runway departure after a bird strike to the nosewheel. The report stated ‘A lot of passengers took baggage and personal items with them despite of the commands and instructions of the cabin attendants. This somewhat delayed the evacuation’. Safety cards did not contain an instruction to leave baggage behind in an emergency and no specific pre-flight instructions were provided to that effect. Identified in the EASA study as taking longer than 90 seconds to complete the evacuation. https://www.fss.aero/accident-reports/ dvdfiles/ES/2004-11-28-ES.pdf A340-3300 Toronto, Canada 02/08/2005 F-GLZQ Runway overrun and fire. TSB reported 49 percent of passengers stated they attempted to take carry-on baggage when leaving the aircraft and 48 percent reported that this slowed the evacuation. Identified in the EASA study as taking longer than 90 seconds to complete the evacuation. https://www.tsb.gc.ca/eng/rapports- reports/aviation/2005/a05h0002/ a05h0002.pdf Appendix 1 (Cont) Previous accidents and incidents where passengers evacuated with baggage

48 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 OE-LOA AAIB-25599 Aircraft type Location Date Registration Comments Link B737-319 Auckland, New Zealand 12/09/2006 ZK-NGJ Electrical failure and smoke in the cabin on takeoff. Some passengers took their carry- on bags with them and were allowed to take them down the slides rather than block the exits with discarded bags. Identified in the EASA study as taking longer than 90 seconds to complete the evacuation. https://www.taic.org.nz/sites/default/ files/inquiry/documents/06-003.pdf A330-300 London Gatwick, UK 16/04/2012 G-VSXY Smoke warnings from the cargo hold. A number of passengers took their hand baggage with them and others commented that passengers retrieving hand baggage delayed the evacuation. https://assets.publishing.service. gov.uk/media/54230155e5274a13 14000a95/AAIB_1-2014_G-VSXY.pdf A320-200 Halifax, Canada 29/03/2015 C-FTJP Aircraft crashed landing short of the runway in bad weather. Despite a pre-departure briefing that included instructions to leave carry-on baggage behind and pictorial instructions on the safety card, some passengers exited the aircraft with their carry-on baggage. https://www.tsb.gc.ca/eng/rapports- reports/aviation/2015/a15h0002/ a15h0002.pdf B777-200 Las Vegas, USA 08/09/2015 G-VIIO Uncontained engine failure during takeoff roll and fire. Cabin crew reported that some passengers evacuated with carry-on baggage. It was not thought to slow the evacuation in this case, but the flight was only 55% percent full. https://app.ntsb.gov/pdfgenerator/ ReportGeneratorFile.ashx?Event ID=20150908X35241&AKey=1&R Type=HTML&IType=FA B777-300 Dubai, Emirates 03/08/2016 A6-EMW Aircraft crashed during attempted go- around with thrust at idle. Although passengers were instructed to leave their carry-on baggage behind and evacuate, several passengers exited with their carry-on baggage. The evacuation took approximately 6 minutes and 40 seconds for 298 passengers and flight crew. https://www.gcaa.gov.ae/en/ ePublication/admin/iradmin/Lists/ Incidents%20Investigation%20 Reports/Attachments/125/2016- Published%20Final%20Report%20 AIFN-0008-2016-UAE521%20on%20 6-Feb-2020.pdf Appendix 1 (Cont) Previous accidents and incidents where passengers evacuated with baggage

FD06686 ｜ 2020_英国_aaib-investigation-to-airbus-a320-232-g-euyb__Airbus_A320-232_G-EUYB_09-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

49 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 SERIOUS INCIDENT Aircraft Type and Registration: Airbus A320-232, G-EUYB No & Type of Engines: 2 International Aero Engine V2527-A5 turbofan engines

Year of Manufacture: 2008 (Serial no: 3703) Date & Time (UTC): 23 September 2019 at 0710 hrs Location: On approach London Heathrow Airport Type of Flight: Commercial Air Transport (Passenger)

Persons on Board: Crew - 6 Passengers - 139 Injuries: Crew - 2 (Minor) Passengers - None Nature of Damage: None Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 43 years Commander’s Flying Experience: 12,700 hours (of which 6,000 were on type)

Last 90 days - 150 hours

Last 28 days - 52 hours Information Source: AAIB Field Investigation Synopsis During approach to London Heathrow Airport the flight crew detected strong acrid fumes on the flight deck. They both donned oxygen masks and continued to land at Heathrow. After shutting down on a taxiway and removing their masks, the co-pilot became incapacitated and the commander felt unwell; both pilots were taken to hospital but released later that day. Investigations carried out by the AAIB and the operator did not identify the source of the fumes. Numerous other similar fume events have been reported to the AAIB and the CAA. This report reviews five other similar events which occurred with the same operator on the same aircraft type. It was not possible to identify the cause of these events, but, several common features have been identified. The operator and aircraft manufacturer have taken action to try to reduce the number of events, which includes; the development of detailed maintenance procedures to identify the source of fumes, changes to flight crew operating procedures and the evaluation of modifications to enhance cabin air recirculation filtration systems.

50 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 History of the flight On the day prior to the incident, the flight crew operated three flights together in a different aircraft. The first two sectors were return flights from Heathrow to Paris Charles de Gaulle Airport, the third sector was from Heathrow to Zurich Airport. The crew arrived in Zurich at approximately 1330 hrs and spent the night in the crew hotel. Both flight crew had previously been involved in separate fume events on the same aircraft type. They reported that they had discussed these events during the evening. G-EUYB was flown, by a different crew, from Heathrow to Zurich on the day prior to the incident. The aircraft landed at 2043 hrs and was parked at Zurich overnight. There were no deferred defects with the aircraft. It rained overnight and the temperature was approximately 13°C. The incident crew reported for the return sector to Heathrow at 0345 hrs for a scheduled departure at 0510 hrs. Both flight crew reported that they were well rested. The initial departure from Zurich was uneventful. It was still raining during the departure and the aircraft entered cloud at approximately 1,000 ft agl and remained in cloud for the majority of the climb. Shortly after passing through FL100 the flight crew detected a slight odour on the flight deck. The commander initially thought the smell was coming from the galley ovens. The co-pilot described it as a “sweaty socks” smell; he reported that he had smelt similar smells on this type of aircraft before, but this was stronger than he had previously experienced. The commander was concerned that they were preconditioned to detect fumes because of their previous experience of fume events and their discussion the evening before. He proposed they waited 30 seconds prior to taking any action to see if the smell dissipated. After 30 seconds the smell had gone. The crew discussed further options and agreed to continue the flight. The flight crew’s previous experience suggested that if the smell was going to reoccur it was most likely to occur when thrust was reduced for descent so, during the cruise, they discussed their actions if the smell returned and reviewed the SMOKE / FUMES / AVNCS SMOKE checklist. They briefed for the co-pilot to fly the descent and approach for the commander’s landing. The initial descent into Heathrow was uneventful. There were clear skies throughout the descent. The aircraft held briefly at BIGGIN HILL and was then radar vectored for an ILS approach to Runway 27L. As the aircraft intercepted the localiser ATC requested the aircraft to reduce speed to 160 kt. The aircraft was slightly above the glideslope so the co‑pilot used speed brake to intercept the glideslope from above and decelerate. Having intercepted the ILS, as the aircraft passed through 4,000 ft both flight crew detected a sudden, very strong smell. The commander described it as a “manure smell”; “like a field which had just been muck spread”. He described the smell instantly “hitting him” in the back of the throat. There was no smoke and no obvious source of the smell. The co-pilot described it as a “strong sweaty socks” smell. He reported feeling itchy skin around his eyes and a scratchy throat. The commander took control and instructed the co-pilot to put on his

51 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 oxygen mask. Once the co-pilot was on oxygen and communication was re-established the co-pilot took control whilst the commander donned his oxygen mask.

The commander requested an early hand-over from the approach controller to the tower controller, which was granted. He then made a PAN call to Heathrow Tower; he reported that they had fumes on the flight deck and required a priority landing. The flight crew then selected the landing gear down and landing flap then decelerated to the final approach speed. ATC advised the two aircraft ahead of G-EUYB and one behind to expect a go‑around and then instructed them to go-around in sequence. The flight crew discussed options and agreed the safest course of action was to continue the approach. The aircraft was stable at 1,000 ft agl. The commander elected to use Autoland. He advised ATC that they would vacate onto the parallel taxiway where they would require an inspection from the emergency services. The aircraft landed at 0644 hrs, vacated the runway at N6 and stopped on Taxiway A. Once the aircraft had stopped the commander asked the co-pilot to complete the after landing procedure and the initial actions of the SMOKE / FUMES / AVNCS SMOKE checklist. The co-pilot made initial contact with ‘Fire 1’1 and advised them that they had fumes on the flight deck and were completing some checklists. The commander made the Alert Call2 and gave the Senior Cabin Crew Member (SCCM) a NITS3 briefing via the interphone. The SCCM confirmed there was no smell in the cabin and the passengers were not aware of anything unusual. The commander then spoke to Fire 1 and made an announcement to the passengers to explain what was happening. The co-pilot removed his oxygen mask briefly to confirm if the fumes were still present. He confirmed the fumes were still present so the flight crew decided to shut down both engines and open the flight deck windows. At this stage the co-pilot started to feel nauseous. The Auxiliary Power Unit (APU) was started for electrical power and the engines were shutdown. The co-pilot then vomited out of the flight deck window. The commander initially planned for the aircraft to be towed to a parking stand but as it became apparent that the co-pilot needed urgent medical attention, he requested steps be brought to the aircraft. The co‑pilot went to the aircraft toilet and continued to vomit. The SCCM came on to the flight deck to assist the commander. The SCCM reported that he smelt a “chemical smell”, “a clean clinical smell” on the flight deck. He confirmed that there was no smell in the cabin. The fire service brought access steps to the aircraft. Communication between the fire service and the flight crew was challenging due to the wind noise with the flight deck windows open. The fire service initially thought the co-pilot was trying to exit the aircraft via the flight deck window so positioned the step adjacent to the window. However, after further discussion Footnote 1 ‘Fire 1’ is the callsign used by the lead fire service vehicle. 2 The Alert Call is a standard PA made by the flight crew to alert the cabin crew to a non-normal situation – ‘Will the Senior Cabin Crew Member please report to the flight deck, via the interphone’. The ‘via the interphone’ is added when the flight crew are on oxygen as it is difficult to communicate if the SCCM comes onto the flight deck. 3 NITS is an acronym used for cabin crew briefings in non-normal situations. It stands for Nature, Intentions, Time and Special Instructions.

52 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 the steps were repositioned to Door 1 right. It took the fire service some time to position the steps at the door due to the turning circle of the vehicle, limited space on the taxiway and a concern that the vehicle would become stuck in soft grass at the side of the taxiway. The aircraft door was opened at approximately 0706 hrs and fire crews and paramedics entered the aircraft. The fire crew inspected the aircraft and reported that they could not detect any unusual smells or fumes. A member of the operator’s engineering staff also boarded the aircraft after the event and did not detect any fumes or odours. The co-pilot and commander were assessed by the paramedics and both taken to hospital. The passengers subsequently disembarked via steps onto coaches and were transported to the terminal. None of the passengers or cabin crew reported any ill effects. The co-pilot and commander were released from hospital later the same day. Recorded information Recorded information was available from the FDR, CVR and Digital ACMS recorder (DAR)4. Analysis of parameters related to the control of the engine pneumatic bleed and air conditioning system did not identify any anomalous operation during the incident flight. Weight and balance The aircraft departed Zurich with 7,000 kg of fuel at a takeoff weight of 65,300 kg. The aircraft weight was approximately 62,000 kg when it landed at Heathrow. There were no dangerous goods loaded on the aircraft. Flight crew Both flight crew had previously been involved in separate fume events. The commander had experienced a similar fumes event to this incident on 21 December 2018 during a flight from Heathrow to Geneva. Fumes were detected on the flight deck during descent into Geneva. After landing the commander required hospital treatment. The co-pilot was involved in a serious incident during landing at Valencia Airport on the 5 August 2019 which is being investigated by the Spanish State Investigation Authority5. Aircraft information The Airbus A320 is a twin engine, narrow-body passenger aircraft, designed for short to medium haul operations. The aircraft internal layouts are generally similar and consist of the four main areas within the fuselage: the flight deck, the forward galley, the main passenger cabin with moveable curtain divide and the rear galley. The flight deck is divided from the rest of the cabin by a reinforced cockpit door. Footnote 4 Digital ACMS Recorder that recorded additional parameters than the FDR. 5 Available at https://www.mitma.gob.es/organos-colegiados/ciaiac [accessed 30 March 2020].

53 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 Air conditioning system The aircraft is fitted with a fully automatic air conditioning and pressurisation system known as the Environmental Control System (ECS). It separates the fuselage into three independently controlled zones which are: the flight deck, the forward cabin and the aft cabin. A schematic of the ECS is shown in Figure 1. Figure 1 ECS schematic

54 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 In normal operations, the left engine supplies bleed air to the left pack6 and the right engine supplies bleed air to the right pack. When the engines are not running, the APU can supply bleed air to both packs. The bleed air from the engines or APU passes through electronically controlled heat exchangers, valves and mechanical devices to produce conditioned air. The conditioned air is at a temperature and flow rate that is suitable to enter the mixer unit where it is mixed with the recirculated cabin air prior to distribution to the flight deck and cabin to maintain a comfortable environment. Trim valves allow hot bleed air to mix downstream of the mixer units to optimise temperature regulation. During normal pack operation with the trim air system operative the cockpit is only supplied with air from pack 1 mixed with the recirculated air. The temperature in each zone can be selected and set from the air cond panel on the flight deck and can be fine-tuned for each cabin zone through the temperature control panel installed on the Flight Attendant Panel (FAP). Cabin pressurisation is automatically maintained by the outflow valves which are controlled by the aircraft pressurisation controller. There is a constant movement of air throughout the aircraft cabin via a system of ducts, louvres and vents. The ECS is designed to produce a slightly higher air flow per occupant on the flight deck. Auxiliary power unit (APU) The APU is a self-contained gas turbine engine mounted within the tail section of the fuselage. The APU is normally used on the ground, when the engines are not running, to supply air and electricity. The APU provides power via an accessory gearbox to drive a generator supplying the aircraft electrical systems and a load compressor to produce bleed air for the ECS and other systems. It uses fuel from the aircraft fuel system and is started using the aircraft batteries. It is started from the flight deck and its operation is automatically controlled by an electronic control unit. Once it is running, electrical power and bleed air is manually selected from the flight deck as required. A schematic of the APU is shown at Figure 2. Footnote 6 A ‘pack’ consists of an air cycle machine, heat exchangers and valves which adjust the temperature of the bleed air supplied from the engine or APU to a temperature suitable for the cabin air conditioning.

55 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 Figure 2 APU schematic Aircraft examination After the passengers had disembarked with their hand baggage, the aircraft was towed to a remote stand. Once catering, hold baggage and cargo had been removed the aircraft doors were closed. However, the flight deck side windows were left open. When the AAIB Inspector boarded the aircraft approximately six hours after the incident, there were no residual abnormal odours or fumes apparent. With assistance from the operator’s engineering staff the aircraft systems were run in various combinations using the battery, the APU and the engines to try to establish the source of the fumes and odour. At various points during the testing, the left, right and forward avionics bays were accessed. There was no abnormal odour or fumes in these bays and there was no evidence of wiring, line replaceable units or avionics equipment cooling system failure. There was also no evidence of excessive dust, moisture or microbiological growth in the bays. Whilst the systems were being operated a handheld air testing device was used but showed no evidence of organic substances within the cockpit atmosphere. The aircraft was then handed back to the operator to carry out further testing. Based on the previous experience of fume and odour events the operator had developed a series of post fume event Work Packages (WP). These comprised of a set of conditional inspections that were to be carried out based on the evidence and data available: ● ● Work package 0 – Inspection in case of localised odour event within the cockpit or cabin. This WP lists a set of steps looking for localised domestic

56 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 causes within the cockpit and cabin areas including fluid spillages and residue on surfaces and in ancillary catering equipment. It also draws attention to the possibility of electrical equipment failure sources which requires circuit breakers, light fittings, power sockets and avionic cooling fans to be checked. ● ● Work package 1 is subdivided into 1A, 1B and 1B Plus and sets out a methodical step by step approach as follows; ○ ○ Work package 1A – Basic exterior visual inspection from the ground. This set of checks focusses on hydraulic, APU and engine fluid levels. It also details a series of visual examinations for signs of fluid leakage on or around the engine fan blades and nose landing gear. In addition, it requires inspections for leakage apparent from the APU bay and on the rear fuselage and lower surfaces, looking specifically for leakage from fairings, overboard drains and panel seals. ○ ○ Work package 1B – Includes all of WP 1A with the addition of access to the APU bay to carry out detailed inspections of the APU and its associated equipment. It also requires an inspection of the rudder yaw damper servo and the cargo door operating switch for signs of hydraulic leakage. ○ ○ Work package 1B Plus – Includes WP 1A and 1B with the addition of comprehensive inspections of the APU bleed system and ECS system components. This requires detailed inspections of the APU and the left and right ECS air conditioning pack components, accessory seals and drains. To enhance detection of leakage and contamination this WP requires most of the inspections to be carried out using black light7. ● ● Work package 2 – This set of inspections follow WP 1 where evidence is suggesting the air contamination originates from the APU or engines. It requires internal inspections using borescopes in accordance the Aircraft Maintenance Manual (AMM). ● ● Work package 3A – This WP requires an ECS check with the APU and engines at idle and is used to confirm the presence or absence of any smells or fumes following nil findings during WP 1A, 1B or 1B Plus. ● ● Work package 3B – This WP requires an ECS check with the APU and engine bleeds at higher power settings and is designed to isolate an odour when it is suspected to be originating from one of the engines. It is carried out on the ground with both engines and the APU running and the aircraft doors closed. There are various safety notes within this WP. Those onboard the aircraft are restricted to essential personnel only and all should have Footnote 7 Black light. An inspection light source producing ultraviolet light in the safe UVA wavelength. This causes traces of many types contaminant to fluoresce and become visible to the naked eye.

57 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 access to a portable oxygen bottle and mask. It includes the requirement to allow sufficient time between each engine and ECS configuration test to allow them to clear through prior to each stage in the testing. ● ● Work package 4 – ECS system decontamination requirements. This WP is carried out when the ECS system is found to have been contaminated and requires the ECS and APU bleed duct to be internally clean in accordance with the appropriate AMMs. It also directs that removed components must be quarantined for incident investigation. G-EUYB was withdrawn from service and all the work packages were completed. No fumes or abnormal odours manifested themselves during these tests and the aircraft was released to service. However, four further events were reported up to the end of December 2019. In each case no faults could be found during the troubleshooting. Actions taken by the aircraft manufacturer The aircraft manufacturer has been collating data from operators relating to past and current fume events and has carried out research to identify the source and identify solutions. In reviewing the data, they observed that the presence of fumes dissipates at higher altitudes. In many cases their advice, used in conjunction with the steps set out in the various AMMs, have led to a decrease in the number of fume events. However, in some cases the source of the fumes could not be found. As a result, the manufacturer has initiated several work programmes to further alleviate odour and fume events. This includes the introduction of an enhanced ECS filtration system, to be made available as a modification, and providing active support to supplier led investigations into further filter enhancements. In order to address the issue of fume events the manufacturer has taken the following action: Project FRESH has been initiated to investigate and regularly inform operators of fume event arisings. The manufacturer has published an In-Service Information paper (Ref ISI 21.00.001.139) setting out all the known aspects of fumes and smoke events and includes the details of a filter and sensor product research and development programme. The operator of G-EUYB, and the other aircraft detailed in this report, has joined this project which provides regular updates to operators from the manufacturer’s customer services team. In addition, they have issued an In-Service Information paper to inform all operators of the background information, mitigations available (or ongoing) and best practices to address fume events.

58 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 Other similar events During the investigation into the circumstances surrounding G- EUYB, the operator reported many similar events on their Airbus A320 fleet8. Figure 3 shows the number of events reported during 2019 and the start of 2020. Summaries of five of these events, all of which occurred during the latter part of 2019, are included below to show the circumstances, the various outcomes and common factors. Fume events are not unique to this operator or to the Airbus A320. In the past 12 months the AAIB had received 37 reports of fumes events in Commercial Air Transport aircraft from various operators and aircraft types (including the six events included in this report). In the last five years 107 events have been reported. In the last year the AAIB has published two other reports on fume events (EI-DEO - AAIB Bulletin 2/2020 and G-YMMU – AAIB Bulletin 12/2019).

The CAA mandatory occurrence reporting (MOR) scheme has received 674 reports of smell, smoke or fumes events in the past 12 months and 3,166 in the last five years. In 2019, the operator involved in this event reported 536 smell, smoke or fumes events to the CAA, of these 398 involved the Airbus A320 series aircraft. 0 20 40 60 80 100 120 140 Number of Fume & Odour Events Figure 3 Fume and odour events on the operator’s Airbus A320 fleet in 2019 and early 2020 Footnote 8 Airbus A320 fleet in this report refers to A318/A319/A320 and A321 narrow body aircraft.

59 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 Airbus A320-232 G-EUUK The aircraft had been parked overnight at Copenhagen Airport and was scheduled for a return flight to Heathrow on the morning of 1 October 2019. After completion of boarding the APU was started and run for one minute with its air bleed selected off. The air bleed was then selected on, and after a further minute, the right air conditioning pack was selected on. Almost immediately a strong odour, described as being like “sweaty socks” became apparent on the flight deck. The left pack was selected on and a similar odour but to a lesser extent was apparent throughout the cabin. Both packs were selected off and the cockpit windows opened to vent the fumes which dissipated in approximately seven minutes. After a 30 minute delay, the aircraft preparations for departure were completed and the aircraft flew without incident until the final approach to Heathrow. As the aircraft commenced final approach to Runway 27 at Heathrow, at about 5,000 ft, a “sweaty sock” odour was detected throughout the aircraft. The smoke and fumes abnormal and emergency procedures were completed and, within 60 to 90 seconds, the fumes dissipated from the flight deck. Fumes were still apparent in the cabin, so engineering and medical assistance was sought. Some of the cabin crew reported a “fuzzy headed” feeling, tingling throats and nasal congestion. This alleviated in fresh air and medical assistance was not required. G-EUUK pilots’ observation The pilots of G-EUUK had noted that another fume event had taken place on the previous afternoon during descent into Heathrow and was recorded in the maintenance log. The log showed that the prescribed post event work pack had been completed and the aircraft had been released to service. It then flew to Copenhagen without incident prior to its overnight stop. Airbus A320-232 G-EUUM G-EUUM had a fume event on route to Fiumicino Airport (Fiumicino) in Rome. After this event the operator’s post smoke and fume events work package had been carried out with no conclusive results. However, during the checks the APU lubricating oil level had been found to be slightly above maximum and so a small amount of oil had been removed to re‑establish the correct level. No contamination was found in the APU ducts and passages. The aircraft was repositioned on a non-revenue flight from Fiumicino to Heathrow. The flight was uneventful until the aircraft was approaching Heathrow. During descent there was some atmospheric electrical activity, but the aircraft did not enter cloud until FL150. The aircraft was in and out of cloud until approximately 1,200 ft aal. Engine anti-ice was used whilst in cloud along with a single use of the igniters9 once the total air temperature had increased above 10°C. Footnote 9 Engine ignition should be on whenever severe turbulence or heavy rain is encountered. Engine ignition is automatically selected on when engine anti-ice is selected on. If engine ignition is required when anti-ice is not being used it must be selected manually.

60 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 Whilst heading downwind to Heathrow, the pilots became aware of an unusual odour, described as being like a “mouldy, wet laundry” smell. At this stage in the flight, the pilots were unable to determine whether it was throughout the aircraft or just on the flight deck. The odour remained and the pilots decided to don oxygen masks which they did, albeit with some difficulty due to the air hoses being incorrectly clipped over the nose piece at the front of the mask. They carried out the smoke and fumes abnormal and emergency procedures. A PAN was declared, and the pilots completed a normal approach and landing at Heathrow. The flight crew did not require any medical treatment. G-EUUM pilots’ observations No passengers were carried, but the air conditioning systems were operated normally during the flight. However, the galley and cabin electrical systems were turned off. As it was a non-revenue flight there were only the two pilots on board and the cockpit door remained latched open. Despite the fume event the pilots’ main concern was that they discovered the oxygen masks incorrectly stowed. The way in which the hoses had been clipped together prevented donning of the mask until they had been undone. In this situation it had a minor effect. However, in a depressurisation event at high altitude, it could potentially be more of a problem. The operator investigated the incorrectly stowed oxygen mask. There was no record of restowing the masks in the aircraft maintenance log and the maintenance provider in Rome did not have a record of restowing the mask. It could not be determined who restowed the masks. The AMM instructions for restowing the mask contained the following note: ‘When you put the oxygen mask in its stowage box, the harness upper spacer and the harness lower spacer can become caught on the oronasal cone. To prevent this, you must not put the inflatable harness in the oxygen mask.’ The following safety action was taken to prevent reoccurrence: The operator carried out a fleet-wide check to confirm that oxygen masks were correctly stowed and issued a Quality Alert Bulletin to all engineering staff to remind them of the importance of stowing the masks in accordance with the AMM. Airbus A319-131 G-EUPG The aircraft was climbing out from Brussels Airport when an unusual odour became apparent within the flight deck. The SCCM contacted the pilots and advised that a “plasticine” like odour had become apparent in the forward galley area. In addition, the SCCM reported that the cabin staff in the rear galley area were beginning to experience headaches and dry throats. The initial actions of the smoke and fumes abnormal and emergency procedures were carried out and the fumes began to dissipate. The aircraft continued its transit to Heathrow and during descent, the cabin crew advised that the same odour had returned but this time it was more pronounced. A PAN was declared,

61 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 and the commander and co-pilot donned their oxygen masks. The aircraft landed and taxied to stand. The passengers were unaffected and disembarked normally. The affected crew were treated by paramedics and taken to a local hospital for further checks but were all later medically discharged. Subsequently, the likely cause was found to be a burnt pastry in an aft galley oven. Airbus A320-232 G-EUUP During the cruise over France on route to Heathrow the purser reported that one of the cabin staff had noticed an unusual odour in the rear galley area. It was described as being similar to “cheesy feet” and that initially it was quite a strong smell but had become less pronounced. It only seemed to be apparent in the rear galley area and had made one of the cabin staff feel “heady”. One of the passengers, who had been in that area also commented on it. The other passengers in the main cabin appeared not to have noticed anything unusual. The exact source of the smell could not be identified and as a precaution the commander initiated the smoke and fumes abnormal and emergency procedures. As the flight deck was not affected, the pilots decided not to go onto oxygen. An option to divert was also considered and preparations were made should it have been necessary. The odour appeared to have dissipated to the extent it was barely detectable. However, one member of the cabin crew still felt unwell and moved to the flight deck to see if her condition improved. In the meantime, the odour appeared to return, and a second cabin crew member started to feel unwell. The commander declared a PAN to air traffic control, proceeded to Heathrow and landed without further incident. The presence of the fire service and paramedics prompted the commander to inform the passengers about the situation and that the crew had been dealing with an issue. The passengers disembarked as normal with no comment being made. Paramedics attended to the crew member who was feeling unwell. During the wait, some of the cabin crew commented on varying degrees of itchy eyes and sore throats. No odours or symptoms were experienced on the flight deck. After carrying out the troubleshooting process the No 1 engine was replaced. Airbus A319-131 G-EUPO The aircraft was flying from Brussels Airport to Heathrow when, at approximately 4,000 ft on final approach, the flight crew noticed acrid fumes within the flight deck, described as smelling like “strong sweaty socks”. The Smoke and Fumes Abnormal and Emergency Procedures were actioned and both pilots donned oxygen masks. A PAN was declared and the approach was completed to a normal landing with the airport fire service in attendance. The aircraft was stopped on the taxiway and the pilots carried out the after landing checklist. The flight deck side window was opened, and the oxygen masks removed.

62 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 During the NITS brief the SCCM reported a very faint odour on entering the flight deck. Discussion with the cabin crew established that none of the other crew members or passengers had been affected. G-EUPO commander’s observations The absence of any effects on the cabin crew or passengers confirmed that the fumes were confined to the flight deck. The fumes were very noticeable and “difficult to ignore” but they were not debilitating. The commander had detected a very faint odour on the climb out from Brussels and discussed it with the co-pilot. The commander’s experience suggested that the faint fumes on climb out were a precursor to fumes during descent as had occurred in this case. Their experience also showed that this sort of event was more prevalent in damp humid conditions such as mizzle, as had in fact been encountered in Brussels. The commander also considered that the main cabin is less susceptible to lingering fume events because the outflow valve has opened, reducing the effect in the cabin. Summary of common factors The evidence does not appear to show an obvious single precursor to all these events. However, several common traits were reported by the crews: ● ● The incidents took place both on the short haul European inter-city flights and with regional flights of less than two hours duration. ● ● The aircraft often arrived in, and stayed for varying periods of time, usually overnight, in damp humid environments with drizzle or rain present. ● ● In many cases the pilots described a faint smell during climb out on departure. ● ● The flights usually continued normally with no signs of any fumes during the cruise phase. ● ● When events occurred, the pilots described the fumes and odours reappearing on descent and in a number of cases at about 4,000 ft AGL in stable flight. ● ● The presence of fumes can have a rapid and adverse effect on flight crew. ● ● The crews described similar smells and odours, such as sweaty socks, manure and farmyard smells, which were unpleasant and distinctive. ● ● The fumes described in these events were invisible. ● ● FDR recordings did not show any correlation between the engine settings or other system selections or settings and the point in the flight at which the fumes appeared. ● ● In most cases the cabin crew were unaware, until they were told, of any fumes or odours; the problem seemed to be confined to the cockpit. ● ● When the fumes were detected by the cabin crew, they appear to linger in the galley areas.

63 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 ● ● In those cases, the passengers were usually unaware and unaffected. ● ● In the more severe cases, the fumes prompted the pilots to declare a PAN and go onto oxygen. ● ● The generation of fumes appeared to be transient and dissipated very rapidly, in some cases before landing and in others very shortly after landing. ● ● In most cases when other individuals were given access to the flight deck after landing, they could not detect any smell or odour. ● ● In the small number of cases where those entering the flight deck were initially able to detect something, it did not have any adverse effect on them and seemed to go away very quickly. ● ● There were no detectable traces of condensate, solid compound or dust present in the flight deck afterwards. ● ● The use of the smoke and fumes abnormal and emergency procedures appeared to alleviate, but not completely eradicate, the effects in the main cabin. ● ● The use of aircraft washing fluids, detergents and anti-icing fluids. In most cases washing or anti-icing operations had not been carried out prior to the flights in which the events occurred. To date, operators have not been able to reproduce the exact symptoms on the ground. It has not been possible to capture a sample of the fumes because of the rapid onset and transient nature of the fumes which do not linger after the event. Other information The human olfactory system is extremely sensitive and complex and can detect minute concentrations of airborne compounds; as few as four molecules can give a recognisable smell10. The ability of a person to interpret a smell requires a cognitive process and therefore the perceived intensity and the effect of a smell will vary between individuals11. When exposed to an unusual or stressful situation a person will experience an unconscious ‘stress’ response based on several factors, including: the context of the event, any prior anticipation of the situation, the perceived level of danger the situation presents and previous experiences of a similar situation. This reaction can produce physiological effects which differ markedly from person to person12 13. For example, the act of cutting up an onion often causes an extreme reaction resulting in excessive tear production, stinging and Footnote 10 https://journals.plos.org/plosbiology/article?id=10.1371/journal.pbio.0020146 [accessed 14 April 2020]. 11 https://www.frontiersin.org/articles/10.3389/fpsyg.2013.00819/full#B125 [accessed 14 April 2020]. 12 https://www.simplypsychology.org/stress-biology.html [accessed 14 April 2020]. 13 https://psychologyhub.co.uk/the-physiology-of-stress-including-general-adaptation-syndrome-gas-the- hypothalamic-pituitary-adrenal-system-hpa-and-the-sympathomedullary-pathway-sam-and-the-role-of- cortisol/ [accessed 14 April 2020].

64 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 watering of the eyes. In a kitchen environment where cutting up an onion is quite normal the affected individual can quickly and easily understand what is happening and, although uncomfortable, it is not a cause for concern. However, if the same adverse stimuli, watering and stinging of the eyes, occurs in a situation that cannot be explained by the context of the environment, a person will experience an increased level of stress and associated physiological response. Other safety investigations Smoke and fume events have been sporadically occurring in recent years in various types of commercial aircraft. These have been reported via the normal channels and have led to investigations being carried out. To date these investigations have not been able to determine the exact cause in all but a few events. Those that have been able to establish the exact cause, have often identified a precursor fault such as an engine oil seal failure that allowed oil residue into the gas path within compressors upstream of the air bleeds. The investigations that have not identified a source were of great concern and so the German Federal Bureau of Aircraft Accident Investigation (BFU)14 carried out a safety study which focussed on the potential health impairments of such events. Despite a large range of data and evidence, a common physical cause of these events could not be identified. The report concluded that in the events that were examined no significant reduction in flight safety occurred. It also found that fume events can result in health impairments, but it had not been possible to assess the long-term effects. In 2004 the AAIB published Aircraft Accident Report 1/2004, an investigation into a serious incident involving cabin air contamination on a BAe 146, registration G-JEAK, which resulted in the incapacitation of one flight crew member. The report also examined other reported events across a number of different aircraft types. Sections 2.3.2 and 2.3.3 contained the following statements: ‘Irritants may affect people in different ways, due to slight physiological differences and their individual sensitivities to different substances. This may explain why in some reported events, where flight crews are exposed to the same environment, one person is affected more than another.’ and: ‘The research so far indicates that substances acting as an irritant(s) may be the cause of the effects experienced by the flight crew on G-JEAK, and possibly during other incidents. The donning of oxygen masks at the first indication of the problem would have reduced the exposure time to these suspected irritants, reducing their effects, and may have prevented the apparent incapacitation of the first officer and the reduced capacity of the commander to operate normally.’ Footnote 14 https://www.bfu-web.de/EN/Publications/Safety%20Study/Studies/140507_Fume_Events. html?nn=817288 [accessed 30 March 2020].

65 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 In addition, the AAIB made Safety Recommendation 2001-47 in May 2001: It is recommended that the CAA should consider issuing additional advice to the crews of jet transport aircraft on the best operational practice when there is a suspicion of flight deck or cabin air contamination. The advice should include the necessity for all flight crew to use oxygen masks selected to 100% and the importance of cabin crew taking an active part in monitoring the flight crew in such circumstances. This resulted in the CAA publishing a number of FODCOMS15 on the subject and subsequent changes to flight crew operating manuals instructing flight crew to don oxygen masks when contamination of cockpit or cabin air is suspected Analysis This event was one of many very similar occurrences that had taken place with this operator and other operator’s fleets of aircraft. These events had been reported via the operator’s safety system and as MORs to the CAA. With the majority of these events, no immediate adverse effects on the flight crew were reported. It is not known if there are or will be any long-term health effects. The fumes and odours are usually not visible but have a similar characteristic pungent smell. In some cases, this has resulted in stinging eyes and the sensation of “catching in the throat”. However, it does not have the same effect on every individual. In this case, G-EUYB, one of the flight crew was affected to the extent they were incapacitated by feelings of nausea. After removing their oxygen mask, they vomited and were eventually taken to hospital for checks. Regarding the wider issue, crew opinions vary; some individuals describe it as an irritation and as “an annoying” trait of the aircraft type, whereas others consider it a significant flight safety hazard and a cause for concern. Abnormal events in the cockpit, such as the presence of smoke and fumes, could be the first indication to the flight crew of a hazard which threatens the safety of the aircraft and requires an immediate response from the flight crew. The unique way individuals interpret smells, coupled with their unconscious response to a stressful situation can result in markedly different physiological reactions between flight crew members. The donning of oxygen masks as part of the flight crew actions when smoke or fumes are detected should isolate them from the source of the smoke and fumes. Outside influences In all the cases mentioned in this report, the possibility of influences from outside the aircraft has been considered, such as the use of aircraft washing fluids and detergents or anti-icing fluids. However, in most cases, washing or anti-icing operations had not been carried out prior to the flight in which the event occurred. Footnote 15 CAA Flight Operations Division Communications.

66 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 Damp and rainy conditions were often reported during these events and so is considered a potential factor. It is not known specifically why this is the case but ambient humidity around or within the aircraft and its systems may be a contributory factor. Actions by the manufacturer The manufacturer has been investigating fume events based on reports and information received from operators. The nature of the unidentified fume events has meant there has been no residual physical evidence of the fumes which could be identified as the source and thereby lead to specific measures to address the causes of these events. The unpredictable nature of the events has also meant that it has not been possible to construct an experimental flight test schedule to capture more data. This has left the manufacturer reliant on reported data, making the issue difficult to resolve in practical terms. Technical cause It has not been possible to obtain a sample of these fumes for scientific analysis. However, there are a few features and characteristics which may be relevant. The evidence indicates that it is likely that these fumes are derivatives of contaminants entering the ECS. It may not be a single compound but a combination of compounds which react and then become airborne in the bleed air supplies passing through the ECS. The fumes may have similar traits to hydrocarbon compounds combined with water vapour in low concentration which are liberated as water vapour condenses when it enters cooler conditions, for example as it passes into the flight deck or cabin via ducts. The suggestion that aircraft operating in damp or rainy conditions are more susceptible to fume events may add some weight to this theory. This is supported by the manufacturer’s observation that the fumes decrease, or in many cases disappear, when the humidity of the air in the cabin decreases at higher cabin altitudes. Consideration has also been given to whether the source may have been from plastic materials used within the ECS ducting, but this is thought less likely because the plastics tend to be used in the delivery of ECS air to the cabin rather than in production where hot and high energy air is used. The aircraft sub-variants, engine types and ages of the aircraft in which fume events occurred was also considered. This produced no conclusive evidence linking these events to a specific aircraft subset. The operator of G-EUYB had developed a post fume/odour and smoke event maintenance procedure to tackle the issue. Its development was based on experience and findings over several years and has been successful in identifying the source of many of the previous events. The procedure is based around looking for evidence within supplier and receiver systems. It directs maintenance staff to look for evidence to establish whether engine air/ oil seals have malfunctioned. However, in the most recent set of cases, the operator’s post‑fume check procedure has not been able to pinpoint faults or malfunctions which could have generated fumes. In all but one of these recent cases the engines have not been the source of the fume events.

67 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 The procedure for start-up and shutdown of the APU seems to have an effect. The operator has recently advised all flight crew to ensure the correct delay is applied between starting the APU and selecting bleed air and this seems to have reduced the number of events. The theory is that at APU start the generator and load compressor run-up from cold. It then takes a short amount of time for the bearings and seals to ‘warm’ up and stabilise to be effective. If bleed air from the load compressor is selected early, oil mist or residues can be released and drawn into the ECS airflow. It does not seem logical that the APU can be a source of these events particularly as they often occur on descent whilst the APU is not in use. However, it is possible that entrained contaminants generated on initial APU start may linger, either as vapours or condensate, upstream of the ECS packs whilst the more predominant bleed air from the engines supplies the system. These contaminants are then entrained into the ECS system as air flow and temperature changes take place during descent. ECS system schematic diagrams are not able to show where and how this may take place. However, in practice the ECS consists of numerous straight, bent and curved ducts, leading to and from valves and conditioning components positioned and shaped alongside numerous other unrelated components. It is therefore possible that small amounts of contaminants could adhere to various internal surfaces or become trapped in ‘pockets’ within the system. Conclusion While it has not been possible to positively identify the compound that was responsible for the fumes and odours experienced in G-EUYB, or any of the other recent events, a number of common factors have been identified. The majority of events occurred after the aircraft had been parked or operated in precipitation. The fumes become apparent during the later stages of the descent, sometimes preceded by a minor event during the climb phase. The generation of fumes appears to be transient; they dissipate rapidly and leave no detectable trace. No link between changes to engine power or changes in other system settings and the generation of fumes was identified. In some cases, the presence of fumes has resulted in physiological reactions which have interfered with a flight crew member’s ability to carry out their normal duties. However, by following the smoke and fume checklist, and donning oxygen masks the flight crew were able to ensure the continued safety of the aircraft.

Safety actions Although a specific cause has not been found in these and other recent events, the operator and aircraft manufacturer have taken several actions based on current knowledge to alleviate the odour and fume events. Safety actions undertaken by the manufacturer: Project FRESH has been initiated by the manufacturer to investigate and regularly inform operators of fume event arisings.

68 © Crown copyright 2020 All times are UTC AAIB Bulletin: 9/2020 G-EUYB AAIB-26125 Published an In-Service Information paper (Ref ISI 21.00.001.139) setting out all the known aspects of fumes and smoke events and includes the details of a filter and sensor product research and development programme. Safety actions undertaken by the operator: Developed the post-smoke and fume events maintenance procedure. Taken action to ensure that the correct APU start up bleed air selection and shut down procedures are used. Will consider the installation of the manufacturer’s ECS air filtration modification when it becomes available Carried out a fleet-wide check to confirm that oxygen masks were correctly stowed and issued a Quality Alert Bulletin to all engineering staff to reminded them of the importance of stowing the masks in accordance with the AMM. Published: 30 July 2020.

FD06687 ｜ 2020_英国_aaib-investigation-to-bell-407-n120hh__N120HH_Safety_Recommendation_Document.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Updated 31/May/2022 Bell 407, N120HH Long Marston, Stratford-upon-Avon, Warwickshire 24 June 2020 Accident

Investigation Synopsis The pilot and passenger were returning to Thruxton Aerodrome following a short flight over the Malvern hills when the engine failed. The pilot executed an autorotation landing in a field near Long Marston, after which they were both able to exit the helicopter without injury. However, the tail boom was severed during the landing and the helicopter was destroyed by fire.The investigation found that the engine suffered an uncontained failure of the gas producing turbine disc due to insufficient oil reaching the bearings as a result of an oil leak. Due to the extensive damage to the helicopter it was not possible to determine the cause of the oil leak. Two Safety Recommendations were made regarding the Failure Mode and Effects Analysis for the engine, and the fire resistance and crashworthiness of aircraft components. The helicopter manufacturer undertook two Safety Actions regarding advice to pilots, and one Safety Action regarding analysis of the airframe fuel filter.

Safety Recommendation 2021-047 Justification The accident sequence has shown that a loss of oil can lead to a burst of the GP2 rotor, the debris of which would not have been attenuated by the energy absorbing ring. Because the axial movement of the GP turbine is outside of the Rolls Royce design intent and certification criteria, the Failure Modes and Effects Analysis for the engine may not fully capture the linkage between loss of engine oil and uncontained bursting of the GP2 rotor. Therefore, the following safety recommendation was made:

Safety Recommendation 2021-047

It is recommended that Rolls-Royce Corporation includes the scenario of a loss of engine oil leading to the uncontained failure of both Gas Producer Turbine Discs in the Failure Mode and Effects Analysis for the Rolls-Royce M250 Series 4 engines.

Date Safety Recommendation made: 23 September 2021

LATEST RESPONSE Response received:

29 November 2021 The M250-C47B FMECA was reviewed by Rolls Royce and found to contain two entries for insufficient oil supply to the No. 8 bearing; one which properly described the potential for T2 wheel burst and one with the highest level effect being in-flight shutdown. This FMECA was revised to eliminate the duplicate entry, maintaining the line with the proper description (i.e. T2 wheel burst). Additionally, the M250 Series IV Baseline FMECA was also reviewed and found to only describe in-flight shutdown as the highest level effect of insufficient oil supply to the No. 8 bearing. This FMECA was also revised to properly describe the potential for T2 wheel burst. These FMECAs have now been formally updated within Rolls-Royce and are live documents.”

Updated 31/May/2022

Safety Recommendation Status Closed

AAIB Assessment Adequate Action Status Planned Action Completed

RESPONSE HISTORY N/A

Updated 31/May/2022 Safety Recommendation 2021-048 Justification The guidance for 14 CFR Part 27 does not appear to clearly articulate the need for components to be able to meet their crashworthiness requirements after exposure to fire and heat. Therefore, the following safety recommendation was made:

Safety Recommendation 2021-048

It is recommended that Transport Canada assess its guidance material for 14 CFR Part 27 and Part 33 requirements on fire resistance and crashworthiness such that fuel system components certified to be fire resistant also retain sufficient residual material integrity to meet their crashworthiness requirements.

Date Safety Recommendation made: 23 September 2021

LATEST RESPONSE Response received:

18 October 2021 The conditions for fire resistance are addressed in the FAR part 1.1 definition, AC 20-135 Change 1 and AC 33.17-1A. Per FAA AC 33.17-1A, the intent of shielding per FAR 33.17(b) may be applied to engine fuel system components to minimize the possibility of leaking flammable fluid and also retain sufficient residual material integrity to meet their crashworthiness requirements in a fire situation. The fire resistant criteria has been applied to engine fuel system components because the 5 minute exposure provides a reasonable time period for the flight crew to recognize a fire condition, close the appropriate fuel shutoff valve(s), and shutdown the engine, thereby cutting off the fuel source. At the aircraft level, per FAR 27.1183(a), fuel system components may have a fireproof shield or be located so as to safeguard against the ignition of leaking flammable fluid. The partial text of FAR 33.17(b) and 27.1183(a) read similar. Per FAA AC 21-16G, the FAA encourages the use of RTCA DO-160 Environmental Conditions and Test Procedures for Airborne Equipment as one acceptable document for environmental qualifications to show compliance with certain airworthiness requirements. Specifically, DO-160 Section 7.0Operational Shocks and Crash Safety contains requirements for a crash safety test of components to make sure they will not detach during an emergency landing. Aircraft fuel system components within the engine area (powerplant installation) may be subject to such DO-160 test and also to FAR 27.952 requirements, which considered the recommendations of report NTSB-AAS-80-2. The FAR section 27.952 is not specific to powerplant installation fuel components but it may be made to apply because, for example, a fuel filter located in the engine area, is an airframe mounted fuel system component. For future certification programs, TC and an Applicant may agree on a means to improve powerplant installation fuel components’ crashworthiness.

The FAA AC 27-1B contains acceptable methods of compliance to each relevant FAR section 27.XXXX and are provided to guide the Applicant on how to retain sufficient residual material integrity to meet the crashworthiness requirements. During a certification program, a detailed review of the design is conducted to identify and quantify all fuel system components in areas subject to engine fire conditions such as engine compartments and other fire zones. Once these items are identified, the design means of fire protection and residual material integrity are selected and validated, as necessary, during the certification process and agreed by TC.

Updated 31/May/2022 For components that cannot be qualified as fire resistant by similarity or by known material standards, testing to severe fire conditions (see paragraph AC 27.859 definition and AC 20-135 for detailed requirements) are conducted on full-scale specimens or representative samples to establish their fire resistance capabilities and sufficient residual material integrity. Transport Canada supports the TSB/AAIB Safety Recommendation 2021-048 objective of reducing post landing fires in small helicopters. TC has used the above FAA AC’s as acceptable means of compliance in its regulatory system and deems that the current FAR standards in Table 1 (which are harmonized with Airworthiness Manual (AWM) Chapters 527 and 533) and means of compliance are sufficient to address the safety recommendation. TC will continue to monitor post landing fire events as part of on-going certification work. TC has no further activities planned at this time, is satisfied with measures taken and suggests this safety recommendation be closed.

Safety Recommendation Status Closed

AAIB Assessment Adequate Action Status Planned Action Completed

RESPONSE HISTORY N/A

FD06688 ｜ 2020_英国_aaib-investigation-to-boeing-777-36-g-stbb__Boeing_777-36_G-STBB_02-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

36 © Crown copyright 2020 All times are UTC AAIB Bulletin: 2/2020 G-STBB EW/G2019/08/29 INCIDENT Aircraft Type and Registration: Boeing 777-36, G-STBB No & Type of Engines: 2 General Electric Co GE90-115B turbofan engines Year of Manufacture: 2010 (Serial no: 38286) Date & Time (UTC): 24 August 2019 at 1740 hrs Location: En route from London Heathrow Airport to JFK Airport, New York Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 17 Passengers - 302 Injuries: Crew - None Passengers - None Nature of Damage: Burnt out oven motor in aft galley Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 53 years Commander’s Flying Experience: 13,899 hours (of which 4,827 were on type)

Last 90 days - 173 hours

Last 28 days - 39 hours Information Source: Aircraft Accident Report Form submitted by the pilot Whilst in the initial part of the cruise, the captain was called by the senior cabin crew member informing him that there was a suspected fire in the aft galley. Shortly afterwards the cabin crew member confirmed that blue smoke was emanating from the oven unit. The cabin crew carried out their fire drill and the flight crew completed the ‘smoke, fire or fumes’ checklist. The flight crew then informed ATC of the event. After electrically isolating the aft galley the rate of smoke production reduced; however, smoke remained in the area. The captain made the decision to divert to Shannon, where an uneventful overweight landing and disembarkation took place. There were no injuries to any of the passengers. Examination of the aft galley oven by the operator’s engineers found that an electrical fault in an oven fan unit had caused the smoke. The fan unit was replaced and the aircraft returned to service. No further investigation of the oven fan unit was conducted by the operator.

FD06689 ｜ 2020_英国_aaib-investigation-to-boeing-787-9-g-zbkf__G-ZBKF_Safety_Recommendation_Document.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Updated 30/January/2024 Boeing 787-9, G-ZBKF London Heathrow Airport 01 October 2020 Serious Incident

Investigation Synopsis The aircraft was approaching the top of descent when the cabin crew saw smoke emanating from a passenger seat. It was discovered that a mobile phone had fallen down the side of the seat and had been crushed in the seat mechanism. The cabin crew extinguished the fire and the aircraft continued to its destination. There was no damage to the aircraft.

There have been several reports of similar events occurring leading to smoke in the cabin. There are currently no seat design requirements to prevent electronic devices from becoming trapped in seats. Manufacturers and regulators are aware of this issue but it has proven challenging to find a workable solution. The EASA and the SAE International Seat Committee have taken safety action to develop new design standards and recommended practices. A safety recommendation is made to the CAA to improve seat design regulations.

Safety Recommendation 2021-017 Justification Portable electronic devices becoming crushed in seat mechanisms are a fire hazard. There are currently no requirements to prevent this. Therefore, the following safety recommendation was made:

Safety Recommendation 2021-017

It is recommended that the Civil Aviation Authority require that passenger seats in commercial air transport aircraft are designed to minimise the chance of portable electronic devices becoming crushed in mechanisms.

Date Safety Recommendation made: 08 April 2021

LATEST RESPONSE Response received:

23 November 2023 The UK CAA design and certification specialists are actively attending the SAE1 International Seat Committee meetings to discuss the entrapment of Portable Electronic Devices (PED) and how this can be mitigated. In addition, guidance is being drafted to prevent entrapment of occupant limbs within seat mechanisms, and many of the mitigating factors would have a positive impact on PED entrapment.

The committee are reviewing the minimum performance standards for seats, with the view to taking recently published recommended practise from (Society of Automotive Engineers Inc) SAE ARP5526 Rev F, section 3.30 (object entrapment) and including as a requirement within SAE AS8049, which would be referenced in a future revision of (Certification Specification - European Technical Standard Order) CS-ETSO2 (ETSO- C127). AS 8049 is currently being re-worked to convert the document into a set of requirements shown in a compliance matrix format.

Updated 30/January/2024 For reference, the current revision of seat TSO within the UK system is currently C127b, which references ARP5526 Rev C. We are currently consulting on the introduction of C127c, which references ARP5526 Rev D, which aligns us with both EASA and the FAA. Note that object entrapment is not introduced until ARP5526 Rev F, so this update would not levy any requirements relating to object entrapment.

It should also be noted that referencing object entrapment within the TSO minimum performance standards would only be applicable to the equipment so would not fully mitigate scenarios involving other installations (e.g. seat furniture, monuments etc). To fully mitigate this, we are investigating including requirements at the installation level (e.g. CS-23/25/27/29 etc).

The UK CAA specialists have also started to engage with other regulators with a view to harmonise the approach to introducing requirements to prevent PED entrapment. The FAA have recently released an AMOC (https://www.govinfo.gov/content/pkg/FR-2023-08-04/pdf/2023-16094.pdf) which allows the use of SAE AS6960, section 3.2.3 (object entrapment) as an acceptable means of compliance to 25.601 and 25.1301(a)(4). EASA are considering other options such referencing PED entrapment (not just for seats) in the next issue of CS25 as an AMC to 25.601 and/or 25.1301(a)(4) and/or referencing ARP5526 Rev F 3.30 in their up-issue of CS-ETSO 127c to CS-ETSO 127d as an amendment to the standards. It is the UK CAA intention to work closely with EASA as UK CAA share concurrence in the approach which will ensure harmonisation.

The UK CAA will continue to monitor PED entrapment events through the requirements of CAA Regulation UK Reg (EU) 376/2014 (as retained and amended in UK domestic Law under the European Union withdrawal Act 2018), through its engagement in the SAE seat committee and discussion with other regulators.

In light of the aforementioned, we propose the next update to AAIB is provided before the end of May 2024.

Safety Recommendation Status Open

AAIB Assessment Partially Adequate Action Status Planned Action Ongoing Update Due 31 May 2024 Feedback rationale The AAIB acknowledges the detailed update and the progress reported to date, and looks forward to a further update at the end of May 2024.

RESPONSE HISTORY Response received: 03 May 2023

The UK CAA design specialist has now started to attend SAE1 International Seat Committee meetings to raise and discuss the entrapment of Portable Electronic Devices (PED) and how this can be mitigated.

The committee have agreed to review and discuss the minimum performance standards for seats, with the view to amending either SAE ARP5526 or SAE AS8049, which may be referenced in a future revision of CS-ETSO - Certification Specification - European Technical Standard Order (ETSO-C127).

The CAA will continue to monitor PED entrapment events through the requirements of CAA Regulation UK Reg (EU) 376/2014 (as retained and amended in UK domestic Law under the European Union withdrawal Act 2018) and through its engagement in the SAE (Society of Automotive Engineers, Inc) seat committee.

Updated 30/January/2024 Considering the aforementioned, we propose the next update to AAIB is provided before the end of November 2023.

AAIB Assessment – Partially Adequate Open

Response received: 02 September 2022

As previously stated, the CAA has strengthened the UK State of Design capability by recruiting design specialists who are collaborating with other authorities and participating in the SAE (Society of Automotive Engineers, Inc) International Seat Committee which is engaged in the design of seats for commercial air transport aircraft, and where appropriate, are making recommendations to minimise the chance of portable electronic devices becoming crushed in mechanisms.

The SAE seat committee and other international regulators recognise the risks that Portable Electronic Devices (PED) entrapment present and these risks have been discussed. The SAE seat committee have developed the following guidance material after presentations were provided by EASA on serious incident G-ZBKF:

“Small objects brought by the passenger (i.e., cell phones, PC tablets, computers, wallets, chargers, cords, keys, etc.) shall not be able to migrate to a location in the seat or furnishing where the object may prevent the return of critical features to a TTL (Take off, Taxi, Landing) position or create a potential fire hazard due to being crushed.

Seat furnishings shall be designed so that small objects are easily retrievable if they migrate into the seat or furniture structure. This may be done by prevention (seals, brushes, or shrouds), or the object can fall into an accessible area for retrieval. For any area that allows items to fall to the floor under or around a Seat Furnishing, there must be adequate access (removal of panels by crew member, by extending features such as a legrest, etc.) to allow the crew member to retrieve them.”

Currently this guidance material is located within SAE AS6960 - Performance Standard for Seat Furnishings in Transport Aircraft. The intention from the international regulatory community is for this material to be included within the minimum performance standards for seats, within either SAE ARP5526 or SAE AS8049, which may be referenced in a future revision of CS-ETSO (Certification Specification – European Technical Standard Order) (ETSO-C127).

The CAA continue to monitor PED entrapment events through the requirements of CAA Regulation UK Reg (EU) 376/2014 (as retained and amended in UK domestic Law under the European Union withdrawal Act 2018) and through its engagement in the SAE seat committee. The next steps for the SAE committee is to revise SAE ARP5526 or AS8049 after which the CAA would consider how to adopt the revised standards.

We will continue to monitor progress and changes through the SAE working group, with the next committee meeting taking place in March 2023. In addition, our design and certification specialists are raising the risks of PED entrapment with UK state of design organisations for their awareness and consideration during their certification projects.

In light of the aforementioned, we propose the next update to AAIB is provided before the end of April 2023.

AAIB Assessment – Partially Adequate Open

Updated 30/January/2024 Response received: 08 February 2022

The CAA has continued to strengthen the UK State of Design capability recruiting Design Specialists who will be able to engage with other authorities and seek participation in the SAE International Seat Committee to the design of seats for commercial air transport aircraft and where appropriate to make recommendations to minimise the chance of portable electronic devices becoming crushed in mechanisms.

The evolution of seat design standards will only be effective when agreed on a global basis. The UK CAA will continue to work with other lead international regulatory authorities to review and support future amendments and updates to the Certification Specifications and / or recommended practices.

The CAA continue to monitor similar PED entrapment events through the requirements of CAA Regulation (EU) 376/2014 (as retained and amended in UK domestic Law under the European Union withdrawal Act 2018) and through its engagement in the SAE committee. Currently the CAA do not envisage an immediate change to the Certification Specifications or Recommended Practices to aircraft seat design. We will continue to monitor progress and changes through the SAE working group.

AAIB Assessment – Not Adequate Open

Response received: 14 July 2021

The CAA partially accepts this recommendation and supports the Safety Action taken by EASA in regard to requesting the SAE International Seat Committee develop design standards and/or recommended practices in relation to the design of seats for commercial air transport aircraft to minimise the chance of portable electronic devices becoming crushed in mechanisms.

Evolution of seat design standards will benefit from a global position and the CAA will work with the international regulatory community to review supporting evidence and global data that may support future amendments to global and UK Certification Specification and/or recommended practices.

AAIB Assessment – Partially Adequate Open

FD06690 ｜ 2020_英国_aaib-investigation-to-britten-norman-islander-vp-mni__Britten-Norman_Islander_VP-MNI_06-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

25 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 ACCIDENT Aircraft Type and Registration: Britten-Norman Islander, VP-MNI No & Type of Engines: 2 Lycoming 0-540-E4C5 piston engines Year of Manufacture: 1971 (Serial no: 183) Date & Time (UTC): 23 September 2019 at 2020 hrs Location: John A Osborne Airport, Montserrat Type of Flight: Commercial Air Transport (Passenger)

Persons on Board: Crew - 1 Passengers - 6 Injuries: Crew - None Passengers - None Nature of Damage: Left tailplane spar and elevator bent, left wingtip and aileron damaged Commander’s Licence: Commercial Pilot’s Licence with Montserrat Certificate of Validation Commander’s Age: 30 years Commander’s Flying Experience: 660 hours (of which 303 were on type)

Last 90 days - 85 hours

Last 28 days - 21 hours Information Source: AAIB Field investigation Synopsis The aircraft was flying from Antigua to Montserrat, which was experiencing a heavy rain shower. After the shower had passed the aircraft made a normal approach in a light tailwind to Runway 10, which was still wet from the rain. The pilot made a positive touchdown and applied appropriate braking but was unable to stop the aircraft. The pilot steered the aircraft to the right but it skidded through 180° and departed the level surface of the airfield backwards, down a steep incline at the end of the runway, before coming to a stop when the tail caught in the airport security fence. The pilot and passengers were able to exit the aircraft and the airport rescue and firefighting service responded promptly.

No aircraft defects were found that would have contributed to the outcome. The touchdown groundspeed was 79 kt, which was higher than appropriate, either because the approach was flown at an airspeed greater than the normal 65 kt, or because of a significant change in windspeed and direction during the approach. This, combined with a wet runway and skidding, resulted in the aircraft requiring more distance to stop than was available on the runway. Three Safety Recommendations are made regarding aircraft operation, access for rescue and firefighting vehicles, and a means of arresting aircraft that overrun the runway.

26 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 History of the flight The pilot had flown the aircraft from Montserrat Airport to Antigua earlier in the day and was on the scheduled return flight to Montserrat Airport. The weather was good but with heavy rain showers passing over the destination, the progress of which the pilot was monitoring using an aviation weather service. With all six passengers ready, the aircraft departed early, with the intention of holding close to the island and waiting for any rain showers to pass through. The normal pre-flight checks were carried out, including an external inspection of the wheel brake systems and functional checks prior to and during the taxi to the runway. The brakes operated normally as they had done on the previous flight. Before starting the engines, the pilot gave a safety briefing covering all the required items, including the use of seat belts and emergency exits. The departure was normal, and the aircraft climbed in VMC to a transit altitude of 2,000 ft, but it was not possible to fly a direct track due to the rain showers. The aircraft held to the north of the island where the pilot could maintain visual contact with the surface of the sea. This required the aircraft to descend on occasions to remain clear of cloud but in sight of the surface, in turbulent conditions. As the showers moved away the rain cleared, and the island became visible. There was some low stratus, reported as FEW1 clouds at 100 ft, and with wind indicated as 140° at 6 kt, the pilot obtained a clearance to join left hand downwind for Runway 10. The runway edge lights were illuminated, and the pilot established on the final approach describing the weather as ‘rough’, with full flap selected and an approach speed of 65 KIAS by 1,000 ft above the airfield elevation. The air traffic controller passed an updated surface wind of 210° at 6 kt, stated that the runway was wet and offered Runway 28 for landing. The pilot elected to continue for Runway 10 and made the normal 6° glidepath approach, touching down positively but, according to several witnesses, faster than normal. The aircraft was not fitted with GPS equipment and no groundspeed information was available. The pilot applied the toe brakes with the pressures appearing normal and then released them momentarily, as they had little effect, before applying them again. The aircraft was not slowing down and as it passed the taxiway intersection, the brakes were applied much harder, again with little effect. With the end of the runway approaching, the pilot applied full right aileron and right rudder, intending to turn onto the grass area alongside the runway in order to avoid going off the end. The aircraft entered a skidding motion and turned through 180˚ to the right before going backwards over the edge of the airfield, stopping when the tail section struck the perimeter security fence (Figure 1). The pilot selected the engine mixture levers, magnetos, fuel and electrical master switch all off. After the pilot had established that none of the passengers were hurt, all the occupants evacuated the aircraft through the normal doors and made their way back onto the airfield where the RFFS was in attendance. Footnote 1 Obscuring up to a quarter of the sky.

27 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 Accident site Faint scald marks made by the tyres on the runway showed the aircraft skidded approximately 150 m before veering on to the grass approximately 19 m from the end of the runway. The aircraft continued across the grass whilst braking, leaving discoloured tyre marks in the grass. The right main wheels struck one of the runway threshold lights. During the transit across the grass the aircraft rotated through 180° immediately before dropping backwards down the sloping side of the ravine at the end of the runway. The aircraft’s rearward motion was slowed by dense reeds and bushes on the sides of the ravine. It stopped when the left tailplane and wingtip hit the barbed wire and chain link perimeter fence approximately 8 m below the level of the runway. As the aircraft stopped the Bendix-King KX165 Nav-Comm unit fell out of its rack mount onto the cockpit floor. Figure 1 shows the aircraft after the accident held by the fence and at an approximate angle of 30°. Figure 1 Aircraft accident site Recorded information A CCTV camera was mounted on the ATC tower and recorded the latter stages of the final approach and touchdown. From these images, the touchdown groundspeed was estimated to be 79 kt. Figure 2 shows a single frame of the recording at the point of touchdown with the wet runway and water spray being produced by the main landing gear wheels.

28 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 Figure 2 VP-MNI at the point of touchdown on Runway 10 Aircraft information The Islander is an all metal twin piston engine high wing monoplane. It has fixed tricycle landing gear with a single nosewheel and twin main wheels. It is fitted with conventional mechanical flying controls and electrically driven flaps. VP-MNI can carry up to nine passengers and has a baggage hold at the rear with a maximum load of 400 lb. Access to the cabin is via a door on the left side rear of the fuselage for the rearmost two rows of seats. A door on the right side of the fuselage opposite the engine nacelle gives access to the two rows of seats immediately behind the pilot’s seats. The left and right pilot’s seats are accessed via a door in the front left side of the fuselage. The doors are held closed by latches operated by lockable handles and, in the case of the pilot’s door, have an interlock preventing them from being opened when the magnetos are on. All the doors are available as emergency escape routes and their windows can be jettisoned in the case of a door jamming closed. Wheel brake system The wheel brake system consists of a single disk attached to each wheel with multi piston callipers. Master cylinders and fluid reservoirs are attached to each pedal on the rudder bar. The brakes are operated by foot pressure acting on the upper articulated part of the foot pedal. Each pedal can be operated independently to facilitate differential braking. The brake operating system is duplicated on the co-pilot (right) side of the aircraft. The wheel brakes are not fitted with an anti-lock or anti-skid system and there is no indication to the pilot of brake pressure or force when the brakes are applied.

29 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 Tyres The aircraft was fitted with tubeless pneumatic tyres and on the main wheels have a normal inflation pressure of 35 psi. Aircraft examination Most of the damage was to components and structure at the rear of the aircraft. The left side of the tailplane main spar had broken at the root and was bent upwards (Figure 3). The elevator structure had also been damaged and bent in the same way. The rear anti-collision light had been displaced and was held only by its wiring. The left wingtip fairing and outer end of the aileron was dented and distorted. Figure 3 Tailplane damage The landing gear and wheel brakes were undamaged. The tyres did not deflate but the nose and right inner mainwheel had tufts of grass trapped between the tyre bead and rim. Blistering was present on three of the mainwheel tyres; the right outer tyre rolling surface showed evidence of blistering, approximately 75 to 100 mm long, at its edges and to a lesser extent on its centre tread (Figure 4). In general, the tyres showed wear commensurate with normal use. The right main landing gear strut appeared to have been displaced outwards very slightly and had displaced the rubber seal between the strut fairing and lower rear engine cowl panel. The nav-comm unit mounting rack and its Allen head locking screw did not appear to be damaged. The rear covering panel of one of the passenger seats had detached during the accident. This was found to have occurred when one of the passengers hurriedly exited the aircraft.

30 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 Figure 4 Tyre wear and damage Weight and balance The aircraft was below its maximum landing weight and within the required CG limits. Landing performance The landing performance for the aircraft is obtained from the Aircraft Flight Manual, Performance section. At the estimated landing weight of approximately 6,220 lbs, the Landing Distance Required (LDR)2 for a dry, level runway with no head or tailwind component at an elevation of 550 ft and an OAT of 30°C, is 448 m. For a wet runway, 15% must be added giving an LDR of 515 m. This is predicated on the approach speed of 65 KIAS being reduced to a threshold speed of 58 KIAS. The operator stated that it expects its pilots to touch down as close as safely possible to the threshold of the runway, to make the maximum use of the LDA. Footnote 2 The LDR obtained from the AFM includes a safety factor of 1.3. The LDR is from a height of 50 feet above the Touch Down Point (TDP) and not the length of the ground run.

31 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 Aerodrome information Montserrat John A Osborne Airport is operated by the Government of Montserrat under the Air Navigation (Overseas Territories) Order with regulatory safety and security oversight and inspection provided by UK based Air Safety Support International Limited. Aircraft movements are only permitted by day under Visual Flight Rules. Strict operating conditions are applied to the classes of aircraft which may use the airport and on pilot training, experience and qualification to operate them at the airport. The airport is sited on a hill with a single runway orientated 10/28 (Figure 5). The thresholds of Runway 10 and 28 are 550 ft amsl. Runway 10 has Precision Approach Path Indicators (PAPIs) set to an approach angle of 6° and Runway 28 has Abbreviated PAPIs (APAPIs) set to an approach angle of 4°.

Figure 5 The Aeronautical Information Publication chart for Montserrat, John A Osborne Airport A significant aspect of the airport and its surroundings is the graded, downslopes at both ends of the runway, which in the event of an overrun have the potential to cause damage to an aircraft and injury to those onboard. Runway 28 has a clearway of 277 m and an open departure towards the sea; Runway 10 has a clearway of 70 m over a ravine, at the end of which is a hill rising to 67 ft above the threshold elevation, 350 m from the end of the runway.

32 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 The airport is affected by variable wind direction and the resulting turbulence from the surrounding terrain, hence the steep approach angle of the PAPIs on Runway 10 and the stringent pilot qualification requirements for operating there. Figure 6 shows the airport from south-west of the Runway 10 threshold end, revealing the proximity of the graded bank to the runway end and the hill at the far end. Figure 6 Montserrat John A Osborne Airport looking towards the north-east Runway condition The runway has an asphalt on concrete surface 596 m long and 18 m wide. Over most of the runway surface the asphalt has been applied uniformly but showed evidence of mis‑application and wear in some areas, examples of which are shown in Figure 7. Airfield staff carry out regular runway surface friction testing in accordance with the maintenance policy using a friction test trailer (Grip Tester GT625) towed behind a large pick-up truck. The testing is done at 65 km/h along the landing distance available (LDA) on the runway. The Grip Tester produces data which is shown on a colour coded friction map, with runway friction characteristics shown as blue, green, yellow or red blocks on the map (Figure 8). At the time of the accident the runway surface was described as ‘wet’, which is defined as the surface being soaked but with no standing water. Observers who visited the scene of the accident later in the day whilst the runway was still damp, described some of the areas at the ends and edge of the runway as “slippery under foot”.

33 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 Figure 7 Examples of areas of surface degradation on the runway Figure 8 shows that the runway surface friction varied over its length. ICAO Annex 14 - ‘Aerodromes’, Section 10.2.5 states that: ‘Corrective maintenance action shall be taken to prevent the runway surface friction characteristics for either the entire runway or a portion thereof from falling below a minimum friction level specified by the State.’ Guidance for evaluating runway surface conditions is contained within ICAO Doc 9137, Airport Services Manual Part 2. The numerical results from the friction test trailer towed at 65 km/h should be interpreted against the figures set out in Table 3-1 of this manual and are as follows: ● ● Minimum design objective for a new surface 0.74 ● ● Maintenance planning level 0.53 ● ● Minimum friction level 0.43 (These band are not the same as those in the colour key produced by the Grip Tester) The test on 24 September 2019 showed that 54% of the surface was ‘green’ with a reading of above 0.63. There was insufficient information available to determine how much, if any, of the surface was also above the minimum design objective level of 0.74. 31% of the surface was ‘yellow’ with a reading between 0.55 and 0.63, indicating that it was above the minimum of 0.53 below which corrective maintenance activity should be considered. 15% of the surface was ‘red’ between 0 and 0.55. There was insufficient information available to determine how much of that surface was below the 0.53 maintenance planning level, and how much was below the minimum friction level.

34 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 Figure 8 Runway surface friction map (24 Sep 19) and colour key

35 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 Overseas Territories Aviation Circular (OTAC) 139-23 – ‘Runway pavement characteristics and maintenance’, issued on 15 January 2020, states: ‘7.1 The aerodrome operator should review the results of each runway friction assessment and take the following action. ● ●If the friction level value falls below the Maintenance Planning Level, maintenance should be arranged to restore the relevant friction level to a value greater than the Maintenance Planning Level or ideally, to a value equal to or greater than the Design Objective Level. ● ●If the friction level value falls below the Minimum Friction Level, maintenance should be  urgently  arranged in order to restore the relevant friction level value at least to a value greater than the Maintenance Planning Level and, ideally, to a value equal to or greater than the Design Objective Level. ● ●If the friction level value falls below the Minimum Friction Level it is important that pilots are warned that aircraft performance calculations may no longer be valid.  In this case the aerodrome operator must issue a NOTAM advising only that the runway may be slippery when wet. ● ●If a runway friction assessment indicates that the friction level falls below the Maintenance Planning Level or the Minimum Friction Level, the aerodrome operator should increase the frequency of runway friction assessments in order to enable any further or rapid deterioration of the runway surface friction characteristics to be identified and, if appropriate, for additional action to be taken. ● ●If a runway friction assessment falls below the Minimum Friction Level and remedial action cannot be conducted urgently the aerodrome operator should consider withdrawing the runway from use for take-off and/or landing.’ OTAC 139-23 states that ‘The friction level values produced by different CFME vary slightly for any given runway surface friction characteristics.’ Given the runway surface condition there was a plan to resurface the runway in the future. At the time of the event, the runway had a NOTAM in place warning pilots that the runway may be slippery when wet. Pilots were asked for their impression of the braking action on each landing and these assessments were logged with ATC.

36 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 Aerodrome rescue services The airfield usually provides a Category 2 RFFS during Islander operations. The RFFS has two fire appliances, a Category 2 tender and a Category 5 tender3. At the time of the accident the Category 5 tender was unserviceable awaiting spares. Twin Otter aircraft occasionally operate at the airfield and require an enhanced fire and rescue capability. This is achieved by an additional fire fighter who is ‘loaned’ from the civil fire service based in the nearby town of Brades. When an incident or accident occurs, regardless of the aircraft type, the airfield fire service receives backup from the civil fire service, which automatically deploys a tender. This was the case for the VP-MNI accident response. Organisational information The aircraft departed the level surface of the airfield and moved backwards down the vegetation covered slope at the end of Runway 10, adjacent to the Runway 28 threshold. This area is considered ‘Difficult Environs’ within the meaning of ICAO Annex 14, which states the following concerning the content of the Airport ‘Emergency Plan’: ‘Emergencies in difficult environments 9.1.14 The plan shall include the ready availability of, and coordination with, appropriate specialist rescue services to be able to respond to emergencies where an aerodrome is located close to water and/or swampy areas and where a significant portion of the approach or departure operations takes place over these areas. 9.1.15 Recommendation.- At those aerodromes located close to water and/ or swampy areas, or difficult terrain, the aerodrome emergency plan should include the establishment, testing and assessment at regular intervals of a predetermined response for the specialist rescue services. 9.1.16 Recommendation.- An assessment of the approach and departure areas within 1,000 m of the runway threshold should be carried out to determine the options available for intervention. Note.- Guidance material on assessing approach and departure areas within 1,000 m of runway thresholds can be found in Chapter 13 of the Airport Services Manual (Doc 9137) Part 1.’ Footnote 3 OTAR Part 139 and ICAO Annex 14 sets out the categories of rescue and firefighting services required by an aerodrome. Category 2, required for aircraft from 9 m to 12 m in length, involves a fire tender with three crew and capable of delivering foam at 370 lt/min.

37 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 ICAO Document 9137, The Airport Services Manual, Part 1, Chapter 13 states: ‘Consideration should be given to the following: a) provide direct access to the operational runway(s); b) designate access routes to the response area (consider debris and casualties); c) maintenance of roads and access routes (including construction activities); d) mitigate the possibility of any public and/or private non-emergency vehicle blocking the progress of responding emergency vehicles; e) take into account the gross weight and maximum dimensions of the RFFS vehicle(s) expected to use them; or any other responding vehicles; f) that roads are capable of being traversed in expected conditions; g) exit/access gates or frangible sections in the security fence that are constructed to allow RFFS vehicles to safely pass through with minimal delay; h) exit/access points will need to be clearly identified. Retro-reflective tape or markers will be of assistance where the aerodrome may need to be accessible during the hours of darkness or conditions of low visibility; i) the mitigation of impediments to RFF vehicle mobility; and j) provide sufficient vertical clearance from overhead obstructions for the largest RFFS vehicle/s.’ Airport Emergency Plan Chapter 3 of the Airport Emergency Plan for John A Osborne Airport sets out procedures for responding to an accident within the 1,000 m ‘Difficult Environs’. An exercise of the airport Emergency Plan is held every two years, involving the emergency service and other stakeholders. Included in this chapter are the actions required of the RFFS, which includes: ‘3.2.2 Airport Rescue and Fire Fighting Service shall:’ ‘a) Proceed via the most suitable access routes to the off-airport accident site in co-ordination with the police responsible for ingress and egress roads;’ Whilst the airport area is level and accessible to vehicles and fire and rescue personnel, the surrounding area within the 1,000 m requirement has differing levels of access. Regarding a runway overrun, as with this accident, both the undershoot areas for Runway 10 and 28 thresholds have steep inclines of about 45˚ in places.

38 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 The Runway 10 undershoot can be reached from the airfield boundary from above and by vehicles accessing the base of the slope from below. There are various level or gently sloping areas navigable by RFFS vehicles, and access roads in the immediate area of the base of the slope. The Runway 28 undershoot has a ravine, some 260 m across, and is more difficult for vehicle access, which is limited to the level area of the airport and possibly as far as the security fence. Any other access to the ravine would be by rescue and firefighting personnel only, with hand carried equipment. Figure 9, shows the airport runway (North is at the top of the figure) with the yellow centrelines extending 1,000 m from each runway threshold. Figure 9 John A Osborne Airport, showing centrelines extended 1,000 m from each runway threshold This investigation has focussed on an aircraft in the landing or abandoned takeoff phase of flight being unable to stop in the remaining distance available4. Previous accident On 17 April 2011, VP-MNI was also involved in a landing accident, which on that occasion was due to failure of the right brake system. The runway was dry and the touchdown Footnote 4 The BN2A Islander is a Performance Group B aircraft and no accelerate/stop distance information is provided in the Flight Manual.

39 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 normal, but when the pilot applied the brakes, there was no resistance from the right brake pedal. The pilot tried pumping the right brake pedal, but it had no effect on the right brake. To avoid departing the end of Runway 10, the pilot applied full left brake and allowed the aircraft to veer left onto the grass alongside the runway where it struck a low bank at low speed and came to a stop. Personnel information The pilot commenced flying training in Trinidad and was issued with a PPL/A in November  2013, then completed a Professional Pilot’s course and was issued with a CPL/IR. From November 2015 until joining the current operator the pilot operated light twin engine Piper Seneca III and Cessna 421 aircraft on inter island flights around the Caribbean. In November 2018 the pilot was issued with a Montserrat Certificate of Validation and commenced line training as a First Officer (FO) with the Montserrat based operator. After completing all the requirements for operating from John A Osborne Airport the pilot flew 172 hours as an FO before a transition to aircraft commander was completed on 4 May 2019, after another 45 hours flight time. At the time of the accident, the pilot had flown 445 hours on multi piston-engine aircraft. Other information Aquaplaning Aquaplaning is a phenomenon which affects tyre grip on a surface where standing water is present having a 1 mm or greater depth over the entire surface or where there are multiple areas of puddled water. Aquaplaning occurs at higher speeds when the weight of the aircraft becomes wholly supported by the dynamic reaction of water so the tyre rolling surface loses contact with the ground and instead rides on the surface of the water. In this situation braking and steering are significantly affected, and loss of directional stability and control is highly likely. The speed at which it occurs is a derivative of tyre pressure and a numerical constant; for a rotating wheel, Va=9√p and for a non-rotating wheel, Va=7√p. Va is in knots and p, tyre pressure, is in pounds per square inch (psi). Calculations for this aircraft type, based on the normal tyre pressure of 35 psi, show that the minimum aquaplaning speed for a rotating wheel is 53 kt. For a locked non-rotating wheel, it is 41 kt. Analysis Operations Before departing Antigua, the pilot had reviewed the weather and had planned to remain clear of Montserrat in VMC until the rain shower had passed. The aircraft was being operated within the permitted maximum landing weight and was fully configured for the landing on Runway 10, which with the wind passed by ATC of 210° at 6 kt, gave a small tailwind component of about 2 kt. The LDR was 515 m and the LDA was 540 m with no head or tailwind component. The pilot’s recollection was that the approach airspeed was

40 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 indicating about 65 KIAS with no reduction to the threshold speed of 58 KIAS, but the touchdown groundspeed determined from the control tower image recording was 79 kt. At that speed on a wet runway, the LDR would have increased significantly and when combined with skidding, led to the aircraft overrunning the end of the runway. The pilot was aware of the hazard presented by the ravine and made a positive turn to the right in an attempt to avoid it. This succeeded in turning the aircraft around and probably reducing the speed at which it left the level surface of the airport and entered the downslope. The descent was then arrested by the security fence preventing further movement and possible damage. The pilot of the aircraft involved in the 2011 right brake failure event responded similarly, and on that occasion avoided overrunning the end of the runway by turning left, probably because only the left brake was working. Due to its elevated position and the surrounding terrain, the airport does present significant challenges due to the local variation in wind direction and strength, which may have contributed to the accident. Therefore, the following Safety Recommendation is made: Safety Recommendation 2020-014 It is recommended that Air Safety Support International Ltd ensure that pilots and operators intending to use John A Osborne Airport take account of local wind variations, and require operators to demonstrate how they will achieve this. Aircraft systems, wheels tyres and brakes The damage sustained by the aircraft during the accident is consistent with it skidding off the paved area of the runway onto the grass and being arrested by the bushes, reeds and the airfield perimeter fence. The landing gear, wheels, brakes and tyres were in good condition and operated correctly in accordance with the demands made by the pilot. Of note was the avionic unit unshipping from its rack. The sudden rearward deceleration as the aircraft was brought to a stop and the 30° angle it came to rest, caused it to release from its rack within the instrument panel. The absence of apparent damage to the nav-comm unit rack and locking screw, suggest that the locking screw may not have been correctly engaged. Although this was undesirable, it only manifested itself as an issue in the unusual circumstances of this accident and is therefore not of any consequence. Runway surface The Grip Tester map (Figure 8) shows that the friction characteristics of part of the runway may have been below the maintenance planning level or below the minimum friction level, especially to the right of the centre line on Runway 28 adjacent to the ‘28’ marking. Surface friction was not uniform and the surface preparation was wearing out, so plans were in place for resurfacing. A NOTAM was issued warning pilots the runway may be slippery when wet

41 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 Landing and skidding The evidence derived from the CCTV recording shows the aircraft to be landing at 79 kt. On landing the wheel brakes were applied but were ineffective. The tyre marks on the runway, the very faint white tyre edge lines, show the tyres were locked and skidding on the tarmac surface. They were generating enough heat to scald and blister the vulcanised rubber of the tyres. The tyres were therefore in contact with the surface and created superheated steam from the moisture present hence the white marks. This evidence leads to the conclusion that the aircraft was skidding but not aquaplaning but is consistent with the description of the runway being ‘wet’. Skidding was inevitable when the aircraft touched down at this higher than normal speed, at which a significant proportion of the aircraft weight is supported by wing lift. Therefore, contact pressure exerted by the tyres on the runway is greatly reduced. This probably remained the case until such time that the speed reduced to below approximately 50 kt but by this time, the aircraft would had travelled further along the runway all the time encroaching on the required stopping distance. In this situation the distance travelled was made worse by the reduced retardation produced by a locked and skidding tyre rather than a rotating tyre under braking. Rescue and location Due to the topography of the airfield location, the land falls away steeply at the runway ends. This aircraft travelled down the 45° slope at the end of the runway and was brought to a stop by the vegetation and fence. Had this not been the case the aircraft could have travelled a considerable distance further down into the ravine. The forces on the aircraft and its occupants could have been significantly higher and may have led to more significant damage to the aircraft and increased the risk of fire had the fuel system been compromised. Immediate rescue would have been much more difficult due to the potential problems in accessing the aircraft. The two fire appliances at the airfield do not have the capability to be driven down into the ravine. Therefore, they would have to apply foam firefighting media from above with a risk that it would not reach or be affective on a crashed aircraft. In the scenario, getting to a crashed aircraft on foot is potentially difficult and in the case of an aircraft fire, would put those individuals trying to approach the aircraft in a dangerous position. This is because the escape route for rescuers and injured survivors would be made difficult or even prevented by the overgrown and steep terrain. The steep slopes and terrain at each end of the runway present significant hazards to an aircraft if it fails to stop in the distance available. Significant damage is possible, with the associated risk of fire and injury to those onboard. Dense vegetation and difficult terrain present the airport RFFS with considerable difficulty reaching a crashed aircraft in the immediate undershoot area of the Runway 28 threshold and may cause significant delay in rescue and firefighting operations. Access to the ravine beyond is severely restricted, with no roads available for RFFS vehicles. Accordingly, the following Safety Recommendation is made:

42 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 VP-MNI AAIB-26130 Safety Recommendation 2020-015 It is recommended that the operator of John A Osborne Airport provide adequate access to the Difficult Environs at the east end of Runway 10 to ensure that emergency services can reach expeditiously the location of an aircraft which has overrun the end of the runway. Whilst the immediate area of the Runway 10 undershoot has better access for RFFS, the risk of serious damage, fire and injury to those onboard an aircraft departing during a landing or abandoned takeoff, is the same for both ends, indicating that it is necessary to limit the progress of an aircraft that is unable to stop in the distance available. Therefore, the following Safety Recommendation is made: Safety Recommendation 2020-016 It is recommended that the operator of John A Osborne Airport install a means of arresting the progress of an aircraft that has overrun either end of the runway in order to minimise the risk of injury to those onboard and to ensure that emergency services can reach them expeditiously. Conclusion There were no faults or malfunctions of systems or equipment within the aircraft contributory to this accident. It appears that either increased airspeed over the normal approach speed of 65 kt was used or a significant change in windspeed and direction led to an increased tailwind component, causing a touchdown groundspeed of 79 kt. This, combined with a wet runway and skidding, greatly increased the LDR beyond that available and led to the overrun. Safety recommendations are made regarding aircraft operations at John A Osborne Airport, access for rescue and firefighting vehicles, and a means of arresting aircraft that overrun the runway. Published: 21 May 2020.

FD06691 ｜ 2020_英国_aaib-investigation-to-cessna-152-g-bmxa__Cessna_152_G-BMXA_03-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

40 © Crown copyright 2020 All times are UTC AAIB Bulletin: 3/2020 G-BMXA EW/G2019/10/06 INCIDENT Aircraft Type and Registration: Cessna 152, G-BMXA No & Type of Engines: 1 Lycoming O-235-L2C piston engine Year of Manufacture: 1977 (Serial no: 152-80125) Date & Time (UTC): 3 October 2019 at 1445 hrs Location: Bridge of Earn, Perthshire Type of Flight: Training Persons on Board: Crew - 2 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: None Commander’s Licence: Private Pilot’s Licence Commander’s Age: 25 years Commander’s Flying Experience: 388 hours (of which 59 were on type)

Last 90 days - 78 hours

Last 28 days - 31 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis While en route to Edinburgh during a training flight, thick white smoke began to enter the cabin through the heating vents. The instructor followed the aircraft checklist drills and made a successful forced landing near Bridge of Earn. Both occupants were uninjured, and the aircraft suffered no damage but an engine oil leak was found that had led to the smoke entering the cabin. History of the flight The aircraft departed Perth on a training flight and the plan was to route to Edinburgh and then return to Perth. Approximately 15 minutes after takeoff, thick white smoke began to enter the cabin through the heating vents. The instructor took control from the student and began the checklist drills for an engine fire. He retarded the fuel mixture lever to idle cut off and accelerated to VNE. However, he quickly realised that there were no signs of flames, only smoke. He therefore re-advanced the fuel mixture to fully rich to keep the engine running. He made a MAYDAY call to Perth Radio, appraised them of the situation and informed them of his intention to make a precautionary forced landing. The instructor then told the student to liaise with ATC. The student entered the emergency code, 7700, on the transponder and kept ATC updated on the aircraft’s position. The instructor selected a field for landing and positioned the aircraft for the forced landing. At approximately 400 ft agl, when sure of reaching the chosen field and of its suitability,

41 © Crown copyright 2020 All times are UTC AAIB Bulletin: 3/2020 G-BMXA EW/G2019/10/06 the instructor selected full flap and shut down the engine. The aircraft landed in a field of recently planted crops, and the crew vacated and moved upwind taking the fire extinguisher with them. Neither crewmember was injured, and the aircraft suffered no damage. After vacating the aircraft, the crew could see that there was oil streaking down the left side of the aircraft and dripping to the ground from beneath the engine cowling. A subsequent examination of the engine revealed a crack in the engine crankcase. Analysis The crack in the engine crankcase caused a significant oil leak and this was the source of the smoke entering the cockpit. The instructor recognised there were no flames and decided to keep the engine running until he was certain of achieving a landing in his chosen field. Given the scale of the leak it is unlikely the engine would have kept running sufficiently long for the aircraft to reach an airfield. The field landing was an appropriate choice and was well executed.

FD06692 ｜ 2020_英国_aaib-investigation-to-cirrus-sr22t-2-roro__Cirrus_SR22T_2-RORO_07-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

17 © Crown copyright 2020 All times are UTC AAIB Bulletin: 7/2020 2-RORO AAIB-25734 ACCIDENT

Aircraft Type and Registration: Cirrus SR22T, 2-RORO No & Type of Engines: 1 Continental Motors TSI0-550-K piston engine Year of Manufacture: 2014 (Serial no: 701) Date & Time (UTC): 12 May 2019 at 0950 hrs Location: A40, near Abergavenny, Wales Type of Flight: Private Persons on Board: Crew - 1 Passengers - 2 Injuries: Crew - 1 (Minor) Passengers - 2 (Minor) Nature of Damage: Aircraft destroyed Commander’s Licence: Commercial Pilot’s Licence Commander’s Age: 52 years Commander’s Flying Experience: 1,600 hours (of which 700 were on type)

Last 90 days - 70 hours

Last 28 days - 30 hours Information Source: AAIB field investigation Synopsis On takeoff from Abergavenny Airfield the engine of 2-RORO started to produce varying amounts of power, which the pilot and witnesses described as the engine “surging”. The power available was insufficient to allow the aircraft to climb away, and it contacted power lines before pitching down and striking a dual carriageway. The aircraft came to rest inverted and was quickly consumed by fire. All three occupants were helped to escape by a passing motorist. The loss of engine power was probably caused by too much fuel being delivered to the cylinders. Due to the significant damage to the aircraft and parts of the engine, the investigation was unable to determine the cause of the over-fuelling. History of the flight The pilot had flown 2-RORO from Denham Aerodrome to Abergavenny Airfield to pick up two passengers. The group would then fly to Manchester for an event later that day. They arrived in Abergavenny around 0930 hrs and were ready to depart at around 0950 hrs; the aircraft was not refuelled. As the pilot prepared for departure, he noted that all the engine indications were normal and completed his pre-takeoff checks, including selecting the electric fuel booster pump on. The aircraft accelerated normally along the runway and at around 75 kt lifted off as normal and began to climb. Almost instantly the pilot recognised that the engine was not delivering

18 © Crown copyright 2020 All times are UTC AAIB Bulletin: 7/2020 2-RORO AAIB-25734 the expected power. He could hear the sound of the engine rising and falling like it was “surging”, and this sound was also confirmed by other witnesses at the airfield. The pilot felt there was insufficient runway remaining ahead on which to land the aircraft so decided there was little option but to continue the departure, climb away from the ground and carry out a forced landing at the earliest opportunity. The pilot was aiming to land the aircraft on the dual carriageway, which runs parallel to the airfield, if he could clear the trees running parallel to the runway. However, the aircraft struck the trees and a power cable with its landing gear and this pitched it down rapidly so that it struck the road heavily. Either the initial impact or contact with the central barrier caused the aircraft to invert, and it came to rest against the central barriers on the far carriageway. A fire started during the accident sequence. Figure 1 shows the accident site with the airfield in the background. Airfield Accident site  Figure 1 Accident site with Abergavenny Airfield in the background All three occupants were trapped in the aircraft due to the inverted attitude jamming the doors closed. Whilst the aircraft is equipped with a hammer to break the windows during such an event, the occupants were unable to find it in the confusion and disorientation of being upside down. One of the passengers and a passer-by who rushed to help were able to break one of the windows. The passer-by pulled out the three occupants one by one who were then able to run away from the fierce fire. The occupants suffered only minor injuries. Figure 2 shows the aircraft on fire after the occupants escaped. The pilot estimated that the flight time from lift off to striking the road was less than 30 seconds. The aircraft was equipped with a ballistic recovery system (BRS) as well as an oxygen bottle and both items were consumed in the fire. The oxygen bottle caused a significant explosion shortly after all the occupants had been assisted from the wreckage. On arrival at the scene the fire brigade was advised about the BRS by the pilot and as a result, once

19 © Crown copyright 2020 All times are UTC AAIB Bulletin: 7/2020 2-RORO AAIB-25734 the fire was under control, they contacted the AAIB for advice to ensure that the BRS was safe and that no additional precautions were needed. Figure 2 Aircraft fire after the occupants’ escape Accident site The aircraft came to rest against the central reservation barriers of the northbound carriageway of the A40 approximately one mile south of Abergavenny, Monmouthshire. There were clear witness marks on the carriageway indicating that the aircraft slid from the initial impact point to its final resting place. Figure 3 shows the accident site and the marks on the road. The majority of the aircraft was consumed by fire, with little behind the engine firewall surviving. The engine, however, was relatively intact. The wreckage was recovered by the emergency services so that the road could be re-opened, it was then moved to the AAIB at Farnborough for further examination.

20 © Crown copyright 2020 All times are UTC AAIB Bulletin: 7/2020 2-RORO AAIB-25734 Figure 3 Accident site showing the ground marks Recorded information 2-RORO was fitted with a recoverable data module (RDM) in the tail. However, neither the recorder nor the protected memory module within it could be located. The wreckage had been recovered from the roadside and moved to a storage yard before subsequently being transported to the AAIB. It could not be established if the memory module had not survived the intense fire in the area of the tail, or if it was lost in the subsequent movements of the wreckage. The RDM would have recorded flight and engine data. The aircraft was fitted with a Mode S transponder, but the aircraft did not reach a height at which its transmissions were picked up by any receiver. Aircraft information The Cirrus SR22T is a four-seat aircraft largely constructed from composite material. The aircraft is fitted with a Continental TSIO-550-K1B six-cylinder twin turbocharged piston engine. The cylinders are numbered one to six1. The ignition system consists of two engine‑driven magnetos and two spark plugs per cylinder. Ignition and magnetos are controlled by a four‑position switch in the cockpit. The engine drives a three-blade, composite, variable-pitch constant speed propeller. Aircraft fuel system The SR22T is fitted with an integral fuel tank in each wing. Fuel is fed by gravity to the associated tank collector sump, where an engine-driven pump draws fuel through a filter and a selector valve (with positions left/right/off) to pressure feed the engine fuel injection Footnote 1 No 1,3 and 5 cylinders are on the right side of the engine as seen from the pilot seat with No 2,4 and 6 on the left side of the engine. No 1 and 2 cylinders are closest to the pilot at the back of the engine.

21 © Crown copyright 2020 All times are UTC AAIB Bulletin: 7/2020 2-RORO AAIB-25734 system. An electric fuel pump is fitted upstream of the engine-driven pump to provide fuel for engine priming and for vapour suppression. A schematic diagram of the aircraft fuel system can be found in Figure 4. In high boost/prime mode, relay allows fuel pump operation only when manifold pressure is greater than 24 in Hg and altitude is greater than 10,000 ft, or (to facilitate engine starting) when engine speed is less than 500 RPM Figure 4 Cirrus SR22T fuel system incorporating software update v0764.36 Electric fuel pump operation is controlled through a fuel pump rocker switch in the cockpit. The switch has a lower pressure boost position and a higher-pressure high boost/prime position. Selecting boost energizes the fuel pump in low-speed mode regardless of engine speed or manifold pressure to deliver a continuous 4-6 psi boost to the fuel flow for vapour suppression in a hot fuel condition. The manufacturer’s checklist suggests selecting the pump to boost before engine start (high boost/prime before boost for a cold weather start) and leaving it at boost until the aircraft reaches cruise altitude. The pump should then be selected to boost before landing. The manufacturer also recommends the pump be selected to boost for any manoeuvring flight. The system is fitted with a lockout relay to ensure that high boost/prime is only used for engine start (when the engine speed is less than 500 rpm) or for operation at high power settings (when the manifold pressure is greater than 24 in Hg). A software modification was introduced in November 2018 which also locked out the high boost setting below 10,000 ft. This software update was embodied in 2-RORO in January 2019.

22 © Crown copyright 2020 All times are UTC AAIB Bulletin: 7/2020 2-RORO AAIB-25734 The lockout relay limits the electric fuel pump to the lower pressure boost even if the switch is selected to high boost/prime. During takeoff, although the manifold pressure would have been in excess of 24 in Hg, the aircraft was below 10,000 ft altitude and therefore the lockout relay should have limited the fuel flow. The altitude restriction was introduced by a software update after several incidents with this aircraft type where the electrical fuel boost system was suspected of causing over-fuelling2 to the engine resulting in black soot deposits and reported engine “surging”. The fuel supply is metered in the throttle metering valve which selects the appropriate fuel flow for the demanded power and environmental conditions. Excess fuel is then returned to the selected tank via the return line. The metered fuel passes to a flow divider and is delivered to the individual cylinders. Ballistic recovery system The SR22T is fitted with a BRS that can be deployed in the event of loss of control, failure of the aircraft structure, or other in-flight emergencies. Once deployed, a large parachute lowers the aircraft to the ground. The aircraft did not reach a height at which deployment of the system would have been a successful option. Maintenance history 2-RORO held a valid Certificate of Airworthiness and had been maintained in accordance with an approved maintenance programme. The aircraft had its last Annual Inspection on 8 August 2018. This included a magneto timing check and an inspection of the spark plugs, which were all recorded as serviceable and within limits. The pilot had flown the aircraft during the previous week and noted no anomalies with, or adverse performance from the engine. The flight to Abergavenny on the morning of the accident was also normal. Survivability The pilot reported that because the aircraft was inverted he found it difficult to locate the emergency egress hammer, which was in the central armrest, to break the windows. Disorientation when an aircraft is in an abnormal attitude can mean people find it difficult to locate seat belt releases and emergency equipment. The cabin space remained intact through the accident sequence, and once the window had been broken the occupants found they could escape relatively easily despite being inverted. Weight and balance The aircraft was under its maximum takeoff weight and within its centre of gravity limits. Footnote 2 Over-fuelling is where the fuel-to-air mixture delivered to the engine is too rich in fuel for the conditions.

23 © Crown copyright 2020 All times are UTC AAIB Bulletin: 7/2020 2-RORO AAIB-25734 Aircraft performance Calculations of the aircraft takeoff performance, using figures provided by the aircraft manufacturer and assuming a normally operating engine, indicated that the runway available was more than adequate for the takeoff distance required. These calculations also showed that the aircraft should have had no difficulty in clearing the trees in the departure route. Meteorology Weather conditions at the airfield are automatically recorded. At the time of the accident the wind was from 140° at 5 kt, with a temperature of 13°C. There was no cloud below 5,000 ft aal and the QNH was 1033 HPa. There had been no rain in the previous 24 hours and the grass was dry. Engine examination The engine was examined externally prior to strip down. Although it sustained thermal damage from the post-accident fire, this was concentrated at its bottom and rear. There were no external pre-accident anomalies visible with any of the components. The spark plugs were removed and examined. All were coated in a dark black soot with oil also coating all but the No 2 top and No 5 bottom sparkplugs (Figure 5). The No 1 top, No 4 bottom and the No 6 bottom sparkplugs had fractured centre insulators. All the sparkplugs displayed what the engine manufacturer described as a ‘severe worn-out wear condition’, as the central electrodes on all sparkplugs had eroded to an elliptical or diamond shape. The sparkplugs were tested and the ones with the cracked insulators failed to produce a spark. Figure 5 Spark plugs removed during engine strip The engine exhaust system risers and manifolds remained attached to the engine. The turbochargers and wastegates were removed and examined. No pre-accident anomalies were evident. The turbocharger turbines and their respective impellers rotated normally.

24 © Crown copyright 2020 All times are UTC AAIB Bulletin: 7/2020 2-RORO AAIB-25734 Both magnetos remained secured to the engine. Examination showed that the magneto‑to‑engine timing was not to specification. It was not established if this was also the case before the accident. However, on removal from the engine both the left and right magneto internal timing were also not to specification. The magnetos were placed on a test stand and functionally tested. Both produced a spark from each lead in the correct firing order throughout the operational speed range. The engine-driven fuel pump had sustained significant thermal damage and it was not possible to functionally test it. Disassembly revealed there were no pre-accident anomalies with its internal components. The throttle body was intact and after removal from the engine it was tested against the production specifications. Although the results showed that it was not calibrated to the Aircraft Maintenance Manual specification, the differences were slight with a somewhat leaner condition in the mid-throttle range. The fuel manifold valve functioned as designed. All the fuel nozzles were clear and free from obstructions. The engine oil system was normal with no signs of pre-accident anomalies. Neither the fuel pump rocker switch nor the electric fuel pump and its associated lockout relay were located in the wreckage, and it was considered likely that they had been destroyed in the post‑accident fire. All six cylinders remained attached to the crankcase and produced compression when the crankshaft was manually rotated, and all rockers/valves moved normally. None of the cylinders’ internal components showed any significant combustion deposits. On removal it was seen that all cylinder heads and intake valves were covered in black soot. Cylinder No 5 also displayed evidence of lean-mixture piston head and cylinder head erosion as shown in Figure 6. Figure 6 Cylinder No 5 showing the dark soot deposit and the lean-mixture piston face and cylinder head erosion The crankcase, crankshaft, connecting rods, camshaft and assessor gears were all intact and showed no mechanical anomalies. The propeller governor was stripped, and it showed no pre-accident anomalies and that the propeller was rotating when the aircraft struck the ground. Assessment of the propeller

25 © Crown copyright 2020 All times are UTC AAIB Bulletin: 7/2020 2-RORO AAIB-25734 pitch change mechanism confirmed that the propeller was in fine pitch at the time it struck the ground. Analysis On takeoff from Abergavenny Airfield, 2-RORO suffered a loss of engine power and could not climb away adequately. The aircraft struck power cables, pitching it down onto the dual carriageway which runs alongside the airfield. The aircraft came to rest inverted and a fire developed which quickly consumed much of the aircraft. The pilot and two passengers were helped from the aircraft by a passing motorist. The pilot and witnesses described the engine sounding like it was “surging” with varying power. The propeller and its governing system were examined and considered not to exhibit any pre-impact damage, and therefore the governing system was ruled out as a possible cause of the loss of power. The pilot’s description, together with the soot on the cylinders and intake valves, suggested the engine was running with a rich fuel mixture (over-fuelling). However, the engine itself revealed a longer-term issue with magneto timing, lean running (under-fuelling) and spark plug damage. These longer-term faults could all be linked with the magneto timing issues causing both the spark plug damage and the cylinder damage but could not explain the engine malfunction on the day of the accident. The longer-term faults may have eventually caused a loss of power on the engine, but they were not the cause of the failure on the accident flight. Rich running could have been caused by a malfunction in the electric fuel pump system or fuel metering system, or by a blockage or restriction in the fuel return lines, possibly elevating the fuel delivery pressures and flows to the engine. The electric fuel pump and its associated lockout relay were destroyed in the post-accident fire so could not be examined or tested. The throttle body was tested and found to be outside production specifications, although the differences were slight and tended towards lean running rather than rich. 2-RORO had software which, to prevent over-fuelling on takeoff, added an altitude restriction to the conditions in which the high boost/prime relay would allow increased fuel flow. It should not therefore have been possible for over-fuelling from the electric fuel pump to occur even if the switch had been selected to high boost/prime. The aircraft and engine examination did not establish if there was any fault or malfunction in the relay or the rest of the fuel system. It was not therefore possible to identify the cause of the over-fuelling on the takeoff at Abergavenny. Had the memory module of the recorder been recovered, it would have helped the investigation understand the accident flight and the long-term health of the engine through trends in temperatures and pressures over time. Without it, the investigation was left with physical evidence in the engine of longer-term issues related to lean running (under‑fuelling) and short-term issues related to over-fuelling. It became clear from the engine examination that the loss of power on the accident flight was unrelated to the longer-term engine issues.

26 © Crown copyright 2020 All times are UTC AAIB Bulletin: 7/2020 2-RORO AAIB-25734 Conclusion The loss of power after takeoff experienced by 2-RORO was probably caused by over-fuelling leading to a mixture too rich for the engine. Both the engine and aircraft manufacturers have investigated cases where an engine has been over-fuelled when the aircraft is at a low altitude but with a high power setting, such as with the accident takeoff. The manufacturer developed a software modification to remove this risk by preventing the high boost/prime function being active below 10,000 ft altitude with the manifold pressure above 24 in Hg. This software modification was embodied on 2-RORO at the time of the accident. The cause of the over-fuelling was not determined because many components of the fuel system as well as the data recorder were not located or were destroyed in the post-impact fire. Published: 18 June 2020.

FD06693 ｜ 2020_英国_aaib-investigation-to-colibri-mb2-g-budw__Colibri_MB2_G-BUDW_11-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

45 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 ACCIDENT Aircraft Type and Registration: Colibri MB2, G-BUDW No & Type of Engines: 1 Volkswagen 1834cc piston engine Year of Manufacture: 1992 (Serial no: PFA 043-10644) Date & Time (UTC): 15 December 2019 between 1228 and 1328 hrs Location: Northfield Farm, Spilsby, Lincolnshire Type of Flight: Private

Persons on Board: Crew - 1 Passengers - None Injuries: Crew - 1 (Fatal) Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 55 years Commander’s Flying Experience: 1,300 hours (of which 221 were on type)

Last 90 days - 11 hours

Last 28 days - 1 hour Information Source: AAIB Field Investigation Synopsis The pilot, who owned G-BUDW, was planning a short flight to test a modification to the aircraft’s fuel system. As the aircraft took off a witness heard the engine running roughly before it disappeared from view. The accident site was found approximately one hour later to the north of the runway. It is likely the pilot had attempted to fly a circuit to land back at the airfield. The investigation found the engine was in poor condition with several defects including a crack in the cylinder head, a split in the inlet manifold joint and deposits on the valve seats. Any of these on their own or a combination of these, could explain the rough running. The report highlights the guidance issued by the LAA regarding pilot maintenance, on‑condition engine monitoring, development of a maintenance schedule and the requirements relating to approval of modifications. History of the flight The owner of G-BUDW kept his aircraft at a small farm airstrip near Mavis Enderby in Lincolnshire. In the months leading up to the accident it was reported that G-BUDW had been experiencing a rough running engine and loss of engine power in flight. In April 2019, he had an engine failure and landed in a field. He was able to fix the problem and took off again 40 minutes later. It was reported that he had aborted several flights in recent months and returned to the airfield due to engine problems. The owner had tried several solutions

46 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 to resolve the engine problems including fitting an additional electric fuel pump. On the day before the accident the owner had modified the fuel system to change the arrangement of the electrical and mechanical fuel pumps. On the day of the accident, it was reported that the owner intended to undertake a short flight to test the modified fuel system. An old grain shed, at one end of the runway, was used to store G-BUDW and three other aircraft. When the owner of G-BUDW arrived at the airfield, another pilot was working on their aircraft. The other pilot was busy with his own aircraft so, other than exchanging some pleasantries, they did not speak. However, the other pilot was aware of G-BUDW’s owner preparing his aircraft. The other pilot later heard the aircraft start and reported that “the engine sounded fine”, a few minutes later he saw the aircraft taxi away. When he heard G-BUDW start its takeoff, he walked out of the hangar to watch and recalled it was 1232 hrs. He reported that when he saw the aircraft come over the crest of the runway it was at about 5 – 10 ft and the engine sounded “good”. He then heard the engine go much quieter “as if it had been altered to tick over” and was aware the aircraft was no longer climbing normally. He heard the engine “get loud again then hesitate and get quiet again” and described the engine as “fizzing and popping”. The aircraft passed directly over his head, clearing the shed roof by 20 – 30 ft. As the aircraft went out of sight, he could no longer hear the engine and assumed the pilot would be attempting a forced landing in a field. He ran around the shed but could not see the aircraft. He returned to his car and started a search of the surrounding area but was unable to locate the aircraft. At 1252 hrs, he called the pilot of one of the other aircraft in the hangar and asked if he could come to the airfield and use his aircraft to search the area. At 1315 hrs, the other pilot arrived, prepared his aircraft for flight and started to taxi to the far end of the airfield for takeoff. As he taxied over the crest of the runway, he saw the wreckage of G-BUDW in the field to the north of the runway. They alerted the emergency services and attempted to revive the owner but there were no signs of life. The call to the emergency services was made at 1328 hrs. The police, paramedics and air ambulance attended but the owner was declared deceased at the scene. Two other people witnessed parts of the aircraft’s flight. One witness, who was to the south of the airfield (Figure 1 - Witness A), saw the aircraft track east to west then saw it turn to the north. He reported the engine sounding rough, describing it as “stuttering a bit” and making a “putt, putt, putt” sound. A second witness, to the north-east (Figure 1 - Witness B) of the airfield reported hearing the aircraft starting its takeoff. He reported that the aircraft sounded “lovely, smooth and sweet”.

47 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 Runway Figure 1 Location of witnesses Several other people in the surrounding area reported hearing aircraft with engine problems, but the times and distance from the airfield suggest these were unlikely to be the accident aircraft. Accident site Grass Runway (630m, 05/23) Approximate Accident Location Grain Shed Figure 2 Farm strip showing the accident site location

48 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 The aircraft wreckage was discovered approximately 50 m to the north of the grass runway and from the ground marks it was apparent that the aircraft was heading in a south south‑westerly direction. The accident site was hidden from the grain shed due to the ground rising and falling around the midpoint of the runway. The right wing and landing gear had detached from the aircraft during the impact sequence. Ground markings showed that the right wingtip and wheel were the first points to contact the soft, sticky, clay soil (Figure 3). Both blades of the wooden propeller had detached and were found, embedded in the ground where the engine had first struck the ground. The engine was detached from the fuselage. The fuselage was relatively intact and had come to rest 2-3 m from the right wing, adjacent to the left wing, which had also detached. The cockpit area had been severely disrupted. The fuel tank had been moved away from the aircraft by the first responders to minimise the risk of fire as they stated there was still fuel in the tank. No fuel remained in the tank when it was recovered by the AAIB. The wreckage was removed and taken to the AAIB facilities for further examination. Right wingtip ground mark Propeller blades Engine Right wing Right wheel ground mark Figure 3 Accident site with ground marks Recorded information Radar No radar recordings existed for the accident flight suggesting that the aircraft was flying at a height of no more than 400 ft agl to be below radar coverage for that area.

49 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 GPS devices An Airbox Aware 5 GPS device was recovered from the accident site which had been active during the flight; however, the file that was downloaded from the device was corrupt and no data for the flight was recovered. A handheld Yaseu radio with an integrated GPS receiver and recording capability was also recovered from the accident site. However, on examination, no recording was found for the flight because the recording function was in the default off position.

Radio transmissions The aircraft’s handheld radio was found tuned to a frequency of 135.465 MHz. The local airfield frequency was 135.480 MHz. The radio’s frequency could be changed easily with a little touch on the rotary control knob. It is, therefore, likely that the radio was tuned to the local airfield frequency prior to the accident and that the frequency was knocked slightly during the accident sequence. Transmissions on this frequency are not recorded. No record was found of any radio transmissions from the aircraft on any other frequency used in the surrounding area. Aircraft information The Colibri MB2 aircraft is a homebuilt single seat light aircraft with fixed landing gear, constructed predominantly from spruce and plywood and is operated under a Permit to Fly issued by the LAA. A set of construction drawings for the aircraft was obtained by the AAIB, however these only give construction details for the airframe structure and some other key components such as the flying controls. There were no drawings for the electrical or fuel systems. G-BUDW was built in 1992 and the original owner and builder flew the aircraft until 2000 when the aircraft was damaged during a forced landing on Taunton Racecourse1. Following the accident, the airframe was repaired, and the engine was rebuilt with its capacity increased from 1600 cc to 1834 cc. Once airworthy it was sold, and the new owner converted the ignition system from magnetos to a Leburg electronic ignition system. The current owner purchased the aircraft in 2007 and flew it regularly. He undertook the maintenance of the aircraft himself, but no evidence of a maintenance programme was found. The aircraft’s annual inspection was carried out by a local LAA inspector, as required to maintain the Permit to Fly. Since the engine had been rebuilt, 605 hours of running time had been logged. Fuel system The fuel tank was positioned behind the engine bulkhead and was the only fuel system component included in the construction drawings. The outlet from the tank was connected Footnote 1 https://www.gov.uk/aaib-reports/colibri-mb2-g-budw-12-august-2000 (accessed 4 June 2020).

50 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 to a filter / drain assembly attached to the bulkhead and fuel was fed to a Minnow Fish carburettor, positioned on top of the engine, by the fuel pumps. Non-return valves were fitted between the pumps and the carburettor inlet. The air intake to the carburettor was unfiltered and was fitted with a manually operated, carburettor heating system on the exhaust silencer. The intake manifold split the fuel air mixture to both cylinder heads and had flexible joints to allow for alignment and vibration (Figure 4). Carburettor Induction manifold Mechanical fuel pump Electrical fuel pump Hot air intake Cold air intake Figure 4 Engine at AAIB facilities Aircraft examination The aircraft wreckage was laid out at the AAIB facilities and it was confirmed that there was no evidence of a pre-accident defect or restriction of the flying controls. All the damage found was consistent with the accident. The ignition and fuel systems were removed from the engine, along with the propeller and exhaust system to facilitate a detailed inspection. No anomalies were found during their removal. Ignition system The ignition system was sent to a specialist company for testing. It was noted that the coil packs were not the normal type used with the system, but the system functioned correctly. It is probable that these non-standard coil packs were used as this was the prototype installation of the Leburg system and there are no entries in the maintenance logbooks related to their replacement.

51 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 Fuel system The fuel system was removed from the engine and each component individually examined. The copper pipe from the fuel tank to the filter bowl had sheared by twisting, which most likely happened during impact. The rest of the fuel pipes were new fabric-reinforced rubber pipes retained by band clamps and lagged with a fire resistant fibre glass and silicon blanket. This material was wrapped and then held in place by cable ties. The unions (T-pieces, component connectors, etc.) were of a variety of diameters with some push fit, others threaded. Some joints used PTFE tape to aid sealing however this is not recommended because of the risk of slivers of the tape cut by the threads, causing blockages in the fuel system. The fuel filter bowl contained a small quantity of fine particles and some residual fuel. The filter element was in good condition. The outlet of the filter bowl was connected to a T-piece from which one pipe was connected to the engine driven mechanical fuel pump and the other to an additional electrical fuel pump. The electrical fuel pump was fitted to the bulkhead and could be switched on from a switch on the instrument panel. A non-return valve was fitted into the outlet pipe from each pump to ensure fuel flow to the carburettor. The electrical fuel pump2 was a Facet Cube 40106 solid state 12v fuel pump (Figure 5). The manufacturer’s datasheet states it is compatible with ‘gasoline, diesel, biodiesel, blended alcohol fuels and fuel additives’ and is capable of 32 US Gallons per hour and between 4-7 psi. The manufacturer’s data sheet also states that it is not intended for aircraft use however this is probably due to certification requirements rather than its functionality. Figure 5 Additional electrical fuel pump There are a wide variety of pump capacities available and there was no evidence that any calculations had been made to size the pump. If the owner had applied to the LAA for a modification he would have been required to present a rationale for the choice of pump. The pump was tested and operated normally. Footnote 2 https://www.facet-purolator.com/cube/ (accessed 5 June 2020).

52 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 The mechanical fuel pump was driven by an auxiliary engine shaft and quill drive. It was a diaphragm pump and records show that the diaphragm and springs were replaced in August 2018. The pump and the fuel priming system functioned correctly and there was a small quantity of fuel remaining in the pump. An internal filter mesh had a small tear (Figure 6 left), it is thought probable that this happened during removal of the mesh when the pump was overhauled. The drive components were examined and found to be worn (Figure 6 lower) to the extent that part of the pump had clashed with the housing (Figure 6 right). This would have limited the volume of fuel pumped on each stroke.

Figure 6 Mechanical fuel pump – Filter damage, housing damage and drive component wear Fuel samples Three metal cannisters of fuel were recovered from the hangar where the aircraft was kept and tested by a fuel laboratory. The laboratory confirmed that the fuel was consistent with Mogas and met the relevant specification3. There are many entries in the aircraft logbooks referring to the use of Avgas and so it is likely that the engine was run on both fuel types and mixtures of Avgas and Mogas of varying proportions. Induction system The carb heat flap valve and carburettor were examined with no faults found however, there was evidence of small dirt particles in the valve, carburettor venturi and butterfly valve. The Footnote 3 BS EN 228:2012+A1:2017 Automotive fuels. Unleaded petrol. Requirements and test methods.

53 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 level and size of the particles was consistent with normal operation without an air filter. It was noted that the external surface of a flexible joint in the inlet manifold to the left cylinder head was cracked. Upon closer examination it was found that the crack went all the way through and was approximately 10 mm in length (Figure 7). This crack would have resulted in air entering the system ‘leaning’ the fuel air mixture. When the interfaces between the inlet manifolds and the engine cylinder heads were disassembled it was found that, in addition to the metal gasket, there was large amounts of silicone instant gasket material. It was not possible to determine whether the metal gasket alone would have provided a suitable seal. No leak paths could be identified. Figure 7 Inlet manifold flexible joint Engine An external inspection of the engine (Figure 8) revealed that the right side had struck the ground, the right rocker cover was missing and the two push rod guide tubes for cylinder 1 were crushed. The rocker cover was found on the accident site and, although covered with soil, was not visibly damaged. The left rocker cover and rocker assembly were removed, and it was noted that the thread on one of the rocker attachment studs differed from the other three suggesting it had been replaced. Furthermore, the nut had been cross threaded onto the stud damaging the thread profile, but it is not considered that this impaired the function of the rocker assembly. All the rocker valve clearance adjusters showed signs of wear. The engine logbooks showed that the valve clearances were checked and adjusted by the owner approximately every 50 hours. The spark plugs were examined, and they all showed signs of use with some build-up of black and light brown coloured deposits.

54 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 Cylinder No 1 Cylinder No 2 Cylinder No 3 Cylinder No 4 Engine right Engine left Engine front Engine rear Figure 8 Engine labelling convention With the rocker assemblies removed, the cylinders were pressure tested to verify cylinder head, piston ring and valve sealing. High pressure air at 50 psi was applied to each cylinder with the piston at bottom dead centre. Air could be heard and felt escaping through the exhaust ports during the test of cylinders 1 and 2. The results are shown in Table 1. Cylinder Residual pressure Cylinder 1 10 psi Cylinder 2 10 psi Cylinder 3 37 psi Cylinder 4 48 psi Table 1 Cylinder differential pressure test Both cylinder heads were removed and examined along with the crowns of the pistons (Figures 9 & 10). All the cylinders had evidence of the build-up of combustion deposits. The largest build-up was seen in cylinder 1 with black and white deposits on both the piston crown and the head. Cylinders 2 & 4 showed some build-up of a hard, light brown deposits, whereas cylinder 3 was predominantly a soft black deposit.

55 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 1 4 3 2 Figure 9 Cyclinder heads 1 4 3 2 Figure 10 Piston crowns The valves were removed to facilitate an examination of the valves and their seats. The exhaust valves from cylinders 1, 2 and 3 all showed signs of localised overheating and evidence of uneven seating in the valve seat (Figure 11). All the inlet valves showed signs of carbon build-up on the back face which is thought to be typical for an engine of this age.

Figure 11 Exhaust valve from cylinder 1

56 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 The valve seats were examined, and it was noted in cylinder 2 there were crushed light brown deposits on the valve seat sealing face and in the exhaust port. A crack was identified between the inlet port and the larger spark plug hole (Figure 12) with carbon deposit on the exterior surface. All spark plug holes had a helical threaded insert fitted. Crack Exhaust port Figure 12 Deposits and crack in cylinder 2 Meteorology RAF Coningsby is 9 nm south-west of the accident site. At 1150 hrs they reported the surface wind was from 250° at 16 kt, visibility was greater than 10 km, clouds were few at 2,500 ft, temperature was 7°C, dew point 2°C and sea level pressure was 992 hPa. The wind report at 1050 hrs was similar but with gusts to 24 kt. The weather did not change significantly during the time the aircraft was possibly airborne. Pilot information The owner of G-BUDW held a valid UK Private Pilot’s Licence with a valid Single Engine Piston (Land) rating. He had previously held an Instrument Metrological Conditions (IMC) rating but this was no longer valid. The pilot’s logbook recorded that he had a total of 1,300 flying hours. Since April 2016, when his current logbook started, he had completed 221 hours in G-BUDW. He had completed a pilot medical declaration on the 15 December 2017 which was valid until he reached the age of 70. Post-mortem The post-mortem concluded that the pilot died from multiple injuries. There was no evidence that the accident was caused by any medical condition. Toxicology found no evidence of any substance which may have contributed to the accident.

57 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 Other information Partial engine power loss after takeoff A partial engine power loss is a situation when the engine is producing less than full power but more than idle power. In 2013, the Australian Transport Safety Board (ATSB) published a safety study highlighting the challenges of partial engine power loss after takeoff4. The study suggests that pilots are usually trained to deal with a total loss of engine power but often receive little training on partial failures. It highlights that partial failure can be much more difficult to manage because of the choices confronting the pilot and the decisions which need to be made immediately. There can be a strong desire to try to return to the runway to avoid aircraft damage associated with a forced landing on an unprepared surface. However, it can be challenging to judge how far the aircraft will glide and how much height will be lost in the turns. The pilot must also allow for the possibility of further power loss. The study highlights the importance of including partial power loss scenarios in pre-flight planning and pre-takeoff briefings and, if a failure occurs, maintaining aircraft control. CAA Safety Sense Leaflet 1e Good Airmanship5 explains that attempts to turn back with insufficient energy can result in significant height loss and has resulted in many fatalities. Carburettor icing Carburettor (carb) icing is caused by a combination of the sudden temperature drop due to fuel vaporisation and pressure reduction as the mixture passes through the carburettor venturi and past the throttle valve. If the temperature drop brings the air below its dew point, condensation results, and if the drop brings the mixture temperature below freezing, the condensed water will form ice on the surfaces of the carburettor. This ice gradually blocks the venturi, which upsets the fuel/air ratio causing a progressive, smooth loss of power and slowly ‘strangles’ the engine. Figure 13 is extracted from the CAA Safety Sense Leaflet 14 about carb icing6, it shows that for the air temperature and dew point on the day of the accident serious carb icing was likely at any power setting. The grass runway was wet with dew which would have increased the likelihood for carb ice forming during the taxi along the runway. Selecting carburettor heat ON before takeoff, including as part of a power check, may reveal the presence of carburettor ice that might then be removed by more prolonged application. It is not known if the pilot did this prior to takeoff or if the engine temperature would have been high enough for the carb heat system to melt any ice that may have accumulated. Footnote 4 ATSB – ‘Managing partial power loss after takeoff in single-engine aircraft’ – available at https://www.atsb. gov.au/media/4115270/ar-2010-055_no3.pdf (accessed 11 May 2020). 5 http://publicapps.caa.co.uk/docs/33/20130121SSL01.pdf (accessed on 1 Jul 2020). 6 http://publicapps.caa.co.uk/docs/33/20130121SSL14.pdf CAA Safety Sense Leaflet 14 - PISTON ENGINE ICING (accessed 9 July 2020).

58 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 Figure 13 Carburettor icing conditions Permit to fly aircraft - design changes In the months preceding the accident it was reported that the engine had been suffering from ‘rough running’ and a lack of power. To remedy this issue, the owner had fitted the additional electric fuel pump as he believed there to be a fuel starvation issue. It was reported that the electrical pump was originally fitted in series with the engine driven pump, but that the day before the accident flight the fuel system was changed to a parallel configuration. There was no evidence that the pilot had contacted LAA Engineering or an LAA inspector to approve these design changes. Any modification to an LAA aircraft’s design requires approval of the LAA Engineering department. The drawings for the Colibri MB2 do not detail the fuel system so the details of each installation, and each subsequent change, are individually checked by LAA Engineering. So, it would be expected that any pilot/owner would consult with the LAA prior to making any significant design changes, such as fuel system modifications, to their aircraft. The LAA produce a guidance document titled ‘When modification approval is not required’7 which specifies when approval is not necessary. The guidance concludes by stating ‘if there is any doubt over whether LAA Engineering approval is required then clarification should be sought from LAA Engineering’. Footnote 7 LAA TL 3.10 ‘When modification approval is not required’ available at http://www.lightaircraftassociation. co.uk/ engineering/TechnicalLeaflets/Mods%20and%20Repairs/TL%203.10%20When%20Modification%20 Approval%20Is%20Not%20Required.pdf (accessed 11 May 2020).

59 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 Permit to Fly aircraft – maintenance CAA Permits to Fly include a condition that all work carried out on the aircraft must be certified by a person authorised by the CAA. For LAA aircraft this person is normally an LAA inspector. There is an exception to this requirement which allows pilots to conduct some maintenance without the need to be certified. The LAA published a guidance document title ‘Pilot Maintenance’8 which specifies what maintenance a pilot can undertake without the need for further inspection. However, the work undertaken on G-BUDW was beyond that specified in this document so should have been inspected and certified by an LAA inspector prior to flight. Permit to fly aircraft - maintenance plan The Air Navigation Order requires that Permit to Fly aircraft are maintained in an airworthy condition. This is achieved by carrying out regular checks on the aircraft’s physical condition and undertaking whatever servicing tasks are needed to preserve its condition. Simple servicing tasks are required at regular intervals, typically 50 hours, and more in‑depth checks required less frequently. The programme of work needed to maintain an aircraft is called a maintenance schedule. For aircraft with a Certificate of Airworthiness the maintenance schedule is usually specified by the manufacture but for many Permit to Fly aircraft it is left to the owner to develop a suitable schedule. The LAA provide guidance on how to develop a maintenance schedule in their Technical Leaflet TL 2.19 titled ‘The LAA Generic Maintenance Schedule’9 and their website provides a generic schedule for a 50-hour, annual and 3-yearly check10. For G-BUDW, the aircraft logbooks recorded that the pilot had changed the engine oil and spark plugs and checked the valve clearances every 50 hours. However, no evidence was found of longer-term maintenance tasks such as engine top-end or complete overhaul. Permit to Fly aircraft - engine health monitoring The engine fitted to G-BUDW had accumulated 605 hours since it was last rebuilt. The LAA provide guidance to owners on how to monitor the health of their engine to ensure it continues to be airworthy. LAA Technical Leaflet titled ‘Engine overhaul life and operating on-condition’11 describes the parameters which should be regularly recorded to detect trends and determine if the engine performance is deteriating. These include, for example, maximum static rpm, rate of climb at best climb speed, oil pressure at a particular cruise rpm, oil consumption and compression in each cylinder. Footnote 8 LAA TL 2.05 ‘Pilot Maintenance’ – available at http://www.lightaircraftassociation.co.uk/engineering/Technical Leaflets/Operating%20An%20Aircraft/ TL%202.05%20Pilot%20Maintenance.pdf (accessed 11 May 2020). 9 LAA TL 2.19 ‘The LAA Generic Maintenance Schedule’ available at http://www.lightaircraftassociation.co.uk/ engineering/TechnicalLeaflets/Operating%20An%20Aircraft/TL%202.19%20The%20LAA%20Generic%20 Maintenance%20Schedule.pdf (accessed 11 May 2020). 10 http://www.lightaircraftassociation.co.uk/engineering/Maintenance/Aircraft_Maintenance.html (accessed 11 May 2020). 11 LAA TL 2.23 ‘Engine overhaul life and operating on condition’ – available at http://www.lightaircraftassociation. co.uk/engineering/TechnicalLeaflets/Operating%20An%20Aircraft/TL%202%2023%20Engine%20 overhaul%20life%20and%20operating%20on-condition.pdf (accessed 5 May 2020).

60 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 No evidence was found of regular engine parameter monitoring of G-BUDW’s engine. If this type of monitoring had been conducted it is likely that the low compression on cylinders 1 and 2 would have been detected. The LAA Inspector who completed the previous annual inspection reported that he did an engine compression test by rotating the propeller by hand and did not detect any abnormality. Analysis Accident flight The aircraft was seen taking off and turning to the north. Two witnesses reported hearing the engine running rough. The accident site was discovered approximately one hour later. It is not known for certain when the accident occurred or where the aircraft flew after the initial sightings but the fact that the aircraft was not recorded on radar suggests it did not gain significant altitude. There was no record of the pilot contacting any of the air traffic control frequencies in the surrounding area which suggests he did not travel far from the airfield. Additionally, from the witnesses’ descriptions of the rough running engine, it is likely that the pilot would have been looking to land as soon as possible. Therefore, the most likely scenario is that after the turn to the north the pilot tried to fly a circuit to the north of the airfield in an attempt to land back on the runway. The impact marks suggest the aircraft was turning to align with the runway when it struck the ground. Loss of engine power The investigation identified that the engine was in poor condition with multiple defects which could have caused the loss of engine power and rough running. The most significant of these were the crack in the cylinder head, the split in inlet manifold joint and deposits on the valve seats. The crack in the head of cylinder 2 would have resulted in a reduction in compression and engine power. The split in the manifold would allow air into the manifold, weakening the mixture and causing the engine to run hot. The deposits on the valves were most likely a mixture of carbon and oil and not untypical for an engine of this age. In cylinders 1 and 2 it was noted that some of the deposit had flaked off the head and there was evidence that these flakes had been caught and crushed in the valve seats. This would have prevented the valves from sealing, resulting in low compression and loss of engine power. From the sealing checks, only cylinder 4 sealed effectively. The original power output of the engine was not known but with the defects identified during the examination its power would have been severely reduced. The weather conditions on the day were also conducive to carburettor icing and following the long taxi over wet grass, this may have further reduced engine power. The long-term engine problems are likely to have been caused by the crack in the head of cylinder 2 and the split in the inlet manifold joint. However, it is believed that on the accident flight, a detached carbon flake caught under the exhaust valve of cylinder 1 further reducing the engine’s performance to a point where flight could not be sustained.

61 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 Approved maintenance planning Although the checks for the permit to fly had been signed off by the LAA inspector, no evidence of long-term maintenance planning was identified. The engine logbooks recorded the completion of regular annual tasks which were predominantly oil changes and tappet adjustment. The LAA Technical Leaflet TL 2.23 regarding on-condition monitoring of aero engines, covers the use of automotive engines in light aircraft applications. The manufacturer’s recommendations for service and overhaul intervals do not apply to the duty cycle of a light aircraft. The LAA therefore recommends monitoring of various engine parameters and taking appropriate action when deviation from the ‘norm’ is noted. During the investigation no evidence was found that engine parameters were being regularly recorded. This investigation demonstrated that a compression check by feel rather than using compression test equipment is not a reliable indication of the condition of the cylinders. The LAA advise in TL 2.23 ‘Other enthusiasts manage without an air supply, simply by turning the engine by hand and feeling the amount of ‘bounce’ in the propeller, but its much harder to work out where leaks are occurring with this method.’ Had the checks and servicing been carried out using the LAA guidance in TL 2.19 and TL 2.23 it is likely the crack in Cylinder 2 and the inlet manifold leak would have been identified. While there was no defined overhaul period for G-BUDW’s engine its poor condition indicated that it required a top-end overhaul. Approval of design changes The pilot had made several changes to the aircraft fuel system whilst attempting to resolve an engine problem. There was no evidence that these changes had been inspected by a LAA inspector or that they had been discussed with, or approved by, LAA Engineering. Whilst there is no evidence that these contributed to the accident, it is important that owners/ pilots should follow the correct inspection and approval process when making changes to the aircraft configuration. The LAA provide guidance on this process and LAA Engineering should be contacted if there is any doubt on whether approval is required. Partial engine failure An engine problem in a single engine aircraft need not necessarily result in a fatal accident. If an engine loses power in flight it may be possible to land in a suitable field. However, during this flight it is likely that the pilot experienced a partial engine power loss. This can be particularly difficult to manage. The ATSB report describes the challenge of judging how far the aircraft can fly with partial power.

62 © Crown copyright 2020 All times are UTC AAIB Bulletin: 11/2020 G-BUDW AAIB-26306 In this accident it is likely that the pilot felt he had enough height and power to return to the runway. It is possible that whilst trying to fly back to the runway the engine lost further power reducing the glide distance causing the aircraft to impact the ground before reaching the runway. Many fatal accidents have occurred whilst pilots attempt to turn back to the runway following an engine failure on take off. CAA Safety Sense Leaflet 1e ‘Good Airmanship’ advises: ‘In the event of engine failure after take-off, achieve and maintain the appropriate approach speed for your height. If the runway remaining is long enough, re‑land; and if not, make a glide landing on the least unsuitable area ahead of you.’ Conclusion The aircraft suffered a partial engine failure shortly after taking off. The evidence suggests that the pilot flew a circuit to the north of the airfield attempting to return to the runway but struck the ground just to the north of the runway. The investigation found the engine was in poor condition with several defects which could explain the loss of engine power. This included a crack in the head of cylinder 2 and a leak in the manifold. The pilot had made several modifications to the fuel system, but no evidence was found that these had been approved in accordance with LAA requirements. No evidence was found of on-condition engine health monitoring or an established maintenance schedule for the aircraft. Published: 1 October 2020. Bulletin correction After publication it was noted that the captions for figures 9 and 10 were transposed. The captions in this report have now been corrected. The online version of this report was corrected on 19 November 2020.

FD06694 ｜ 2020_英国_aaib-investigation-to-dhc-8-402-dash-8-g-prph__DHC-8-402_Dash_8_G-PRPH_06-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

83 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-PRPH EW/G2020/01/05 SERIOUS INCIDENT Aircraft Type and Registration: DHC-8-402 Dash 8, G-PRPH No & Type of Engines: 2 Pratt & Whitney Canada PW150A turboprop engines Year of Manufacture: 2010 (Serial no: 4323) Date & Time (UTC): 10 January 2020 at 1956 hrs Location: Leeds Bradford Airport Type of Flight: Commercial Air Transport (Passenger)

Persons on Board: Crew - 4 Passengers - 51 Injuries: Crew - None Passengers - None Nature of Damage: None reported Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 49 years Commander’s Flying Experience: 10,541 hours (of which 10,163 were on type)

Last 90 days - 187 hours

Last 28 days - 28 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis After a normal engine start the Auxiliary Power Unit (APU) was switched off, however the ‘APU STARTER’ light illuminated. The aircraft systems were shut down and a re-start attempted using a ground power unit. During this time smoke was seen emanating from the rear of the aircraft so the crew initiated a rapid passenger disembarkation. Examination of the aircraft found that the APU starter/generator had overheated probably as a result of an APU contactor failure. History of the flight The aircraft was completing a normal turnaround at Leeds/Bradford Airport with the Auxiliary Power Unit (APU) running. Approximately 5 minutes before pushback a strong smell, described by the crew to be like a burning clutch, was apparent in the flight deck and the front of the cabin. The captain asked the dispatcher to check the rear of the aircraft for evidence of anything unusual and nothing was found. The smell cleared within 10 to 15 seconds and was considered to have been associated with a truck which had passed the aircraft around that time. The aircraft pushed back at 1956 hrs and successfully started the right engine in preparation for a single engine taxi. Once the engine had started and all electrical systems were powered, the APU was switched off. During the subsequent ‘AFTER START’ checks it

84 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-PRPH EW/G2020/01/05 was identified that the starter light had illuminated on the APU panel, even though all the switches were in the off position.

The captain immediately referred to the Quick Reference Handbook for ‘APU STARTER FAILURE’ drills. As he went through the drills other caution lights began to appear on the primary flight displays, the engine display and the central warning panel, with the APU starter light remaining illuminated throughout. The aircraft and engine were therefore shut down. The captain then contacted maintenance control who suggested re-setting the system using a ground power unit (GPU). This was called for and when it arrived the captain requested that the senior cabin crew member (SCCM) open the forward left door. This would then allow communication with the ground crew from the flight deck if electrical power was lost. After the GPU was connected and operating correctly, the aircraft batteries were turned back on. After about 5 seconds the batteries began to discharge rapidly and three display screens on the flight deck went blank, however the APU starter light remained illuminated. The captain informed maintenance control that he intended to completely shut down the aircraft. As he was having this discussion, the ground crew informed the flight crew that smoke was rising from the tail of the aircraft. ATC was informed and the fire crews were called. There was no smoke reported in the cabin or flight deck, however the fire crews, after arriving at the aircraft, saw smoke rising from its rear and recommended via ATC that a controlled evacuation be initiated. The captain switched off the battery master switch and gave the order to the SCCM to initiate a rapid disembarkation. As the aircraft systems had been shut down, this was done without use of the PA. The passengers left the aircraft via the forward left door quickly and orderly, leaving their belongings behind. Aircraft examination Examination of the aircraft by engineering staff from a Part 145 maintenance organisation at the airport identified that APU starter/generator showed signs of heat damage. The starter/generator and the K26 contactor, which connects the starter/generator to the right main bus, were replaced and the aircraft returned to service. Discussion The cause of the failure was not determined but the description of the event and experience highlighted by the aircraft manufacturer suggests that the main contacts within the K26 contactor may have welded themselves together. This would have resulted in the starter/ generator remaining powered whenever the right main bus was live. With this known problem, the manufacturer has introduced a procedure to inspect the main surfaces of the contacts within the contactor at every C check. An assessment of the aircraft’s maintenance records was not possible and therefore it could not be determined whether the contacts had been checked during G-PRPH’s last C check.

FD06695 ｜ 2020_英国_aaib-investigation-to-erj-190-200-lr-embraer-195-g-fbej__ERJ_190-200_LR_G-FBEJ_10-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

11 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 ACCIDENT Aircraft Type and Registration: ERJ 190-200 LR (Embraer 195), G-FBEJ No & Type of Engines: 2 General Electric Co CF34-10E7 turbofan engines Year of Manufacture: 2007 (Serial no: 19000155) Date & Time (UTC): 28 February 2019 at 0745 hrs Location: Exeter Airport, Devon Type of Flight: Commercial Air Transport (Passenger)

Persons on Board: Crew - 5 Passengers - 100 Injuries: Crew - 1 (Minor) Passengers - 1 (Serious) Nature of Damage: None Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 61 years Commander’s Flying Experience: 13,211 hours (of which 3,069 were on type)

Last 90 days - 77 hours

Last 28 days - 15 hours Information Source: AAIB Field investigation Synopsis As the thrust levers were advanced for takeoff, on an early morning scheduled passenger flight, the flight crew detected an unusual odour and observed smoke entering the cockpit. They then moved the thrust levers to the idle position and applied the parking brake. The cabin crew subsequently reported that there were smoke and fumes in the cabin. Following an assessment of the situation, the commander initiated an emergency evacuation. During the evacuation, passengers who evacuated via the overwing exits reported being unsure of how to get down from the wing to the ground and several re-entered the cabin and exited via one of the escape slides. The smoke and fumes were subsequently attributed to an incorrectly performed engine compressor wash procedure, which was carried out by maintenance personnel the night before the occurrence flight. As a result of the findings of this investigation, the European Union Aviation Safety Agency (EASA) has undertaken two safety actions relating to the certification requirements for overwing emergency exits. The operator has also undertaken several safety actions relating to passenger safety briefings, processes for maintenance planning, engineer training, competency and welfare and monitoring of ground equipment. Four Safety Recommendations are made relating to the certification requirements for overwing exit markings and the height requirement for overwing exits to be equipped with an assisted means of escape.

12 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 History of the flight The aircraft was operating the first sector of the day and was scheduled to fly from Exeter Airport, UK to Alicante Airport, Spain. While the aircraft was being prepared for flight, both pilots reported being aware of a sweet-smelling odour after the APU and APU bleed had been turned on to heat the cabin. They described the smell as being like caramel but considered that such odours were not unusual after the APU is started and the air conditioning is switched on at the beginning of the day. Following completion of passenger boarding, the aircraft pushed back and taxied before being cleared to enter Runway 26, back-track and line up for takeoff. It was daylight, the visibility was in excess of 10 km and the wind was from 210° at 5 kt. The APU was shut down as the aircraft entered the runway and the air conditioning packs remained on with air supplied from the engines. A few seconds later, while back-tracking, both pilots became aware of fumes in the flight deck with a different odour, which the co‑pilot described as being like paint or white spirit. The wind was behind the aircraft at this point, so they initially thought the fumes were due to exhaust gas ingestion. Upon lining up at the runway threshold the flight crew had a brief discussion about whether the fumes were decreasing and decided that they were. Upon receiving takeoff clearance, the co-pilot advanced the thrust levers to 40% while holding the aircraft on the brakes and checked the engine indications, which were all normal. He then slowly advanced the thrust levers towards the takeoff setting, while still holding the aircraft on the brakes. As the engines reached approximately 55% power, he saw something out of the corner of his eye which he believed to have been a puff of smoke coming from an air conditioning vent. He immediately stated that he was not happy with the situation and retarded the thrust levers to idle. By then the smell of fumes had grown worse and smoke was visibly entering the flight deck. The commander set the park brake and asked the co-pilot to turn the engine bleeds and air conditioning packs to off and the flight deck windows were opened to ventilate the flight deck. There were no EICAS messages or warnings. The commander established contact with the senior cabin crew member (SCCM), who had simultaneously been trying to contact the flight deck. The SCCM reported that there was smoke and fumes in the cabin, but that the cabin crew could not identify the source. The commander decided to evacuate the aircraft. The co-pilot immediately selected flap 5, notified ATC of the intention to evacuate and requested assistance. Both pilots then carried out the Emergency Evacuation ‘vital actions’. After the commander had given the order to evacuate over the passenger address system, the flight crew followed the EMERGENCY EVACUATION checklist on the back of the QRH. The Airport Rescue Fire Fighting Services (ARFFS) arrived at the aircraft and were briefed on the nature of the emergency by the co-pilot through the flightdeck window. The ARFFS then assisted passengers on the ground as they exited the aircraft.

13 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Aircraft evacuation General The aircraft was equipped with six emergency exits: four doors fitted with inflatable slides, two at either end of the cabin, and two ‘Type III’ emergency exits located approximately midway along the cabin, over the wings. On hearing the order to evacuate, the cabin crew opened their allocated doors and all four escape slides inflated automatically. Passengers opened the overwing exits. The cabin crew reported that the passengers remained calm. The vast majority of passengers reported being able to hear and follow the announcements made by the flight and cabin crew, and the instructions contained therein. Some passengers attempted to take baggage with them, but most complied with the emergency evacuation instructions and left their belongings behind. Several passengers commented that the cabin crew were calm throughout and acted efficiently and professionally. Overwing exits Passengers evacuating via the overwing exits reported that once out on the wing, there was confusion as to how they should get off the wing down to the ground. Passengers still in the cabin reported that this led to a bottle-neck forming around the overwing exits. Two passengers who evacuated via the left overwing exit were able to jump down from the wing and assist other passengers to the ground. Despite this, several passengers commented that it was a very long drop to the ground and some landed awkwardly, sustaining minor injuries. Many of the passengers who exited via the overwing exits commented that the wing surface was “very slippy” and one fell over resulting in a minor injury. The overriding comment from those who had exited via the overwing exits was that it was not obvious to them that they were meant to climb off the wing via the trailing edge and some re-entered the cabin to find an alternative exit route. A 61 cm-wide walkway was demarcated at the wing root in black paint, with arrows pointing towards the trailing edge (Figure 1). None of the passengers mentioned noticing this, but several did mention a lack of instructions, support or guidance once they were out on the wing. Escape slides Several passengers commented that they found the rear slides very steep and were surprised by the speed at which they slid down them. The slides at the rear do not round out at the bottom unlike the front slides, which means that individuals slid very fast onto the ground. This, and attempts by passengers to slow themselves on the slides, were the principal causes of the reported injuries. Two passengers assisted other passengers at the bottom of the rear slides. A number of passengers suffered minor cuts and grazes and one elderly passenger who had exited via D2R sustained a broken ankle. Two cabin crew members who exited via the rear slides, one carrying the megaphone and the other carrying the first aid kit, reported that this made it difficult to slow themselves down and one sustained an ankle injury. Cabin crew noticed that some passengers hesitated when instructed to jump and slide. They therefore advised the passengers to sit and slide rather than jump and slide.

14 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Figure 1 Overwing exit escape route markings on E195 (view towards wing trailing edge) When the cabin crew believed that all passengers had left the aircraft, they checked the cabin and found several passengers stood on the wings unwilling to jump due to the height above the ground. These passengers were escorted back into the cabin and subsequently exited via the rear slides. On completing the emergency evacuation checklist, the commander left the flight deck and confirmed with the SCSM that all the passengers and other cabin crew members had evacuated. They were joined by the co-pilot and all three left the aircraft via the forward left slide. Out of the 100 passengers on board G-FBEJ, 93 completed AAIB questionnaires regarding the evacuation. Figure 2 illustrates the exits used by the passengers, correlated by seat position. Post-evacuation Following the evacuation, the ARFFS entered the aircraft with protective breathing equipment and a thermal imaging camera but were unable to identify the source of the smoke and fumes. The flight crew later returned to the aircraft to retrieve personal belongings and the commander noted that although the slat/flap selector was set to flap 5, the EICAS showed that the movement of the flaps and slats had not been completed. He concluded that insufficient time had elapsed between selecting flap 5 and shutting down the engines for the slats and flaps to deploy to the selected positions. The commander commented that this was not a situation he had encountered during simulator training before, when an evacuation most commonly occurs following a rejected takeoff scenario. In that scenario, flap 5 is selected as soon as the decision to reject is made and the flaps have time to travel to the selected position while the aircraft is slowed, turned into wind and stopped, before the emergency evacuation drill is actioned.

15 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 The flap 5 selection is made to facilitate passengers, exiting via the overwing exits, to get off the wing by sliding down the extended flaps. Figure 3 shows the drop to the ground from the left wing during the evacuation. The operator subsequently measured the height of the wing trailing edge above the ground when the flaps were not deployed and determined that it would be in excess of 2 m, depending on the aircraft weight and fuel load. D1L SLIDE RIGHT OWE D1R SLIDE D2L SLIDE D2R SLIDE LEFT OWE Evacuation Routes Used Unoccupied seats Questionnaire not completed (7) or seat number not recorded (2) Unknown which slide used Where two colours are shown, it is unknown which of the two exits were used Where there is a solid outline, passengers first used left or right overwing exit and then used an alternative exit Figure 2 Evacuation routes used by passengers, correlated by seat position

16 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Figure 3 Drop to the ground from wing trailing edge with flaps in flap 1 setting Pre-flight emergency briefing Prior to departure, passengers seated next to the overwing exits were briefed by the cabin crew on how to operate the exit. While the cabin crew passenger brief for the overwing exits included mention of the height between the exit and the wing surface and instructions on the direction of evacuation, it did not provide instructions on how the passengers should get off the wing (eg jump, or sit and slide). The passenger safety information cards, provided for all passengers, included diagrams showing the direction of evacuation from the wing but it was not clear whether passengers would understand that they need to slide off the wing from the information depicted on the card. Following this accident, the operator revised its briefing to passengers seated next to the overwing exits of the Embraer 195 (E195). Changes included: simplifying terminology, instructing those passengers of the need to be first out on the wing, informing them of the need to help and direct other passengers, and highlighting that there is no escape slide attached to the overwing exits. Recorded information A review of the DFDR data confirmed that the flap selector lever was moved from the takeoff flap setting (flap 1) to flap 5. Although the flaps started moving in response to this selection, the engine 1 and 2 selectors were set to the off position approximately 2 seconds later when the flight crew shutdown the engines. This removed electrical power to the flaps and prevented them from travelling to the selected position. In the flap 1 position the flap angle had been 6.9o; the flaps reached 7.2° before stopping.

17 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Evacuation procedures The operator’s Emergency Evacuation vital actions and callouts, assigned by flightcrew member are shown in Figure 4: Figure 4 Emergency Evacuation actions from operator’s operations manual The E195 QRH EMERGENCY EVACUATION checklist is shown in Figure 5. The flight crew did not action the QRH SMOKE/FIRE/FUMES checklist. Figure 5 QRH Emergency evacuation checklist

18 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Certification requirements The E195 is a derivative model of the E190 and both have been certificated by the FAA and the EASA. Certification requirements for emergency egress and escape routes on large transport aircraft, specified in FAR 25.8101 and CS 25.8102 respectively, only require provision of evacuation slides for exits or escape routes, overwing or otherwise, that are 1.8 m (6 ft) or more above the ground. For lesser heights, passengers are expected to jump down to the ground. Information from the aircraft manufacturer The aircraft manufacturer was not aware of any previous events involving delays in emergency evacuation due to the flaps not reaching a surface deflection of 20o, which corresponds to flap 3, 4 and 5. It stated that it did not consider the evacuation checklist required amendment as a result of this incident, because the normal flow of actions allows enough time for the flaps to reach a position beyond flap 1, which has a flap surface deflection of 7o. It indicated that, among the available takeoff and landing configurations, flap 1 results in the greatest flap trailing edge height above ground and complies with the maximum of 6 ft certification requirement of FAR 25.810(d), under which the E190/195 aircraft were certified.  Additional information Previous evacuation incidents The AAIB investigated a serious incident on 1 August 2008, in which the cabin of an E195 G-FBEH (EW/C2008/08/01) filled with smoke and fumes during flight. An emergency evacuation was subsequently carried out, during which passengers using the overwing exits experienced similar problems getting from the wing to the ground. As a result of that investigation the AAIB made Safety Recommendation 2010-007. Safety Recommendation 2010-007 It is recommended that the European Aviation Safety Agency review the design, contrast and conspicuity of wing surface markings associated with emergency exits on Public Transport aircraft, with the aim of ensuring that the route to be taken from wing to ground is marked unambiguously. Safety Recommendation 2010-007 was a re-issue of previous Safety Recommendation 2002‑42, which had been made to the Civil Aviation Authority (CAA) and Joint Aviation Authority (JAA), following an AAIB investigation into an incident on 1 April  2002 (EW/ C2002/4/1), in which the cabin of a Fokker F28 filled with smoke. In FACTOR F7/20033, the CAA accepted Safety Recommendation 2002-42 and indicated that action was due to be taken by the end of October 2003. But no response was received from the JAA and the responsibility for aircraft certification within Europe subsequently passed to the EASA. Footnote 1 US Federal Aviation Regulations (FAR), 14 Code of Federal Regulations (CFR), Part 25.810. 2 EASA Certification Specification (CS) 25.810. 3 https://publicapps.caa.co.uk/docs/33/FACTOR200307.PDF [accessed 23 June 2020].

19 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 In its initial response to Safety Recommendation 2010-007, the EASA agreed to review ways of improving the specifications relating to emergency exit escape routes.  In its final response on this matter EASA indicated that a study it had commissioned in 2009 into cabin safety threats4 (the 2009 EASA study) did not identify any issues relating to overwing exit markings, and on that basis could not justify changing the existing specifications of CS 25.810(c) on markings for overwing exits. Royal Aeronautical Society paper on Emergency evacuation In April 2018, the Royal Aeronautical Society (RAeS) published a paper titled ‘Emergency evacuation of commercial passenger aeroplanes’ (RAeS paper). The intention of the paper was to provide aviation authorities, aircraft manufacturers, operators, and air accident investigation authorities, with a wide range of information on evacuation issues. With respect to aircraft which are not required to be equipped with evacuation slides, the paper states: ‘For aeroplanes that are not required to be equipped with evacuation slides, passengers and crew will have to jump down from a height which some will find challenging or even injurious. Delays in an evacuation are possible if passengers decide to sit on the emergency exit sill and jump, or sit and slide at exits equipped with evacuation slides. This is more likely to be the case for elderly and infirm passengers, for children, as well as for adults with infants. The 1.8 metre maximum height limit for evacuation slides might be too high for such passengers to manage without serious injury.’ With respect to overwing exits, the paper states: ‘Having evacuated via a Type III or Type IV emergency exit, passengers usually have to reach the ground without any supervision from the aeroplane crew. Such an evacuation would normally be achieved by use of the trailing edge of the wing. Arrow markings are required to be on the surface of the wing to indicate the evacuation route but these are not always readily identifiable to evacuating passengers, and even less identifiable in conditions of darkness. For all aeroplanes, including those that have Type III or Type IV emergency exits installed over the wings, and do not need to meet the 1.8 metre (6 foot) CS 25 criteria for evacuation slides, the usual route for passengers to evacuate is by the trailing edge of the wing. In order to facilitate evacuation, the flight crew have to retract the wing spoilers and extend the trailing edge wing flaps. Failure to do so will hinder the evacuation and may cause injury to passengers and crew. Flight crew emergency evacuation checklists usually specify such actions; for example, the Boeing 737 evacuation checklist states: “Verify that the flaps are 40 before the engine start levers are moved to cutoff”. Some operators have decided that this should be a checklist ‘memory’ item.’ Footnote 4 ‘Study on CS-25 Cabin safety requirements’, Issue 6, dated December 2009, prepared for the EASA.

20 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 The RAeS paper referenced an NTSB Safety Study on ‘Emergency evacuation of commercial aeroplanes’ published in June 2000 (the NTSB safety study). Safety Recommendation A-00‑79 made in the NTSB safety study, recommended that the FAA: ‘Review the 6-foot height requirement for exit assist means to determine if 6 feet continues to be the appropriate height below which an assist means is not needed. The review should include, at a minimum, an examination of injuries sustained during evacuations.’ The RAeS paper also identified that the 2009 EASA study addressed similar issues and quoted the following extract from it: ‘The evidence available from accidents and research studies suggests that the requirement to jump to the ground from a height of 1.8m (6 feet) during evacuation, without assist means, may potentially cause serious injury or may delay the progress of an evacuation due to hesitation or unwillingness to jump.’ Overwing escape route markings As a result of the issues identified in the accident, the AAIB asked the EASA to review the subject of markings on overwing emergency exits. In its initial response the EASA indicated that all applicable certification requirements for the E195 with respect to evacuation from overwing emergency exits had been met. It stated: ‘In general, EASA finds that the requirements applicable to the marking of evacuation paths over the wings of CS-25 types are adequate and ensure that evacuees are effectively directed to the safest location from which they can descend from the wing onto the ground. However, based on the experience gathered in certification projects in recent years, EASA considers to introduce a new [acceptable means of compliance] AMC 25.810(c) in order to identify acceptable guidelines and options for the measurement of the contrast between the marking of the escape path located over the wing and the background colour of the wing surface.’   With regards to the requirement for the provision of escape slides in CS 25.810(a) and (d), the EASA indicated that it intended to discuss and coordinate with other aviation authorities and with the aviation industry.  It outlined its intention to discuss these issues at an FAA Aviation Rulemaking Committee (ARC) on Emergency Evacuation Standards5, which had been tasked to review data from commercial air transport accidents and incidents involving passenger evacuations in the past ten years, to identify safety issues. The EASA indicated that the ARC would provide a forum for participants to discuss and provide recommendations to the FAA on the certification of emergency evacuation Footnote 5 https://www.faa.gov/regulations_policies/rulemaking/committees/documents/index.cfm/document/ information/documentID/3983 [accessed 23 June 2020].

21 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 systems and procedures which may in the future be translated in harmonized rulemaking tasks by the participating Aviation Authorities. It stated that:   ‘EASA will propose to the ARC to evaluate to which extent we can consider reasonable that evacuees may jump from a 1.8 m height to reach the ground instead of benefitting from the installation of a properly designed emergency egress assisting [sic].’ In April 2020, the EASA stated that its cabin safety expert had participated in the ARC meetings and provided the following update: ‘The ARC has reached consensus to include in the report a recommendation to the FAA to consider, in coordination with other Aviation Authorities, if changes need to be introduced to the requirements currently included in 25.810 with the scope to allow easier identification of the evacuation path by the evacuees and their faster and safer transition from the wing to the ground. The regulatory changes may involve a combination of one or more of the following options:

1. Improvement of the marking that for each overwing exit describes the proper

method of opening the exit (ref. 25.813(c)), to include, if the exit is over a wing, and the aircraft design does not include an off-wing assist means per 25.810(d), indication of the evacuation route on the wing.

1. improvement of marking visibility/design to facilitate better recognition by

passengers evacuating through overwing exits of proper direction to exit from wing.

1. revision of the requirements under 25.810 to define conditions that would

require an escape slide.  Other factors may drive different recommendations for overwing exits (25.810(d)) verses non-overwing exits governed by 25.810(a). The report will include another recommendation that will address the need to improve passenger briefing materials in regards to egressing an overwing exit without assist means.’ Aircraft maintenance Engine compressor wash - general During overnight maintenance on the night before the accident, an engine compressor wash was carried out on G-FBEJ’s No 1 engine. Aircraft gas turbine engines can accumulate substances such as dust, sand and salt on the compressor blades and stator vanes. This can lead to a reduction in compressor performance and increased fuel consumption. The engine manufacturer recommends engine cleaning to reduce contaminant build-up and counteract these effects. Compressor washes are performed by maintenance personnel, using a wash rig, which uses either water or a water and detergent mix.

22 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Compressor wash rig used on G-FBEJ The engine wash rig used on G-FBEJ was fitted with two pressurised fluid tanks, one which contained water and the other a water/detergent mix. During operation, the fluid can be directed into a water-wash manifold installed on the engine, to dispense water/detergent into the compressor. Compressor wash procedure The Engine Service Manual (ESM) task used by the maintenance personnel was 72‑00‑00‑100-801 ‘Engine performance recovery,’ revision date 31 March 2016. The following general information is included at the beginning of the ESM task: ‘For some environments, washing with a cleaning solution … may be more effective than washing with water only….If a cleaning solution is used, it is important to follow instructions for rinsing and drying-out the bleed systems.’ The ESM task lists several approved detergents6 and indicates that the cleaning solution should be mixed according to a ratio of one part detergent to four parts water and rinses should be conducted with fresh water. The task requires a minimum of two people, one to operate the engine and system controls in the cockpit and one to operate the compressor wash rig. One subtask describes the procedure to wash the internal engine airflow components with water only and an alternative subtask7 describes the procedure to do the wash with a cleaning solution. It recommends that to get the best cleaning results, two washes should be done as well as a soak period between application of the cleaner, followed by two rinses to make sure that the cleaning solution is removed. A further subtask8 describes the rinse procedure and states that any remaining cleaning solution should be drained from the compressor wash rig and the fluid tanks filled with rinse solution (water). Post compressor wash engine drying procedure Following completion of the engine wash and disconnection of the compressor wash rig, a further subtask9 describes the procedure to dry the internal engine airflow components. A caution in the procedure states: ‘FAILURE TO ADEQUATELY DRY THE INTERNAL ENGINE AIRFLOW COMPONENTS AFTER AN ENGINE WASH CAN RESULT IN ODOR-IN‑CABIN EVENTS WHICH HAVE CONTRIBUTED TO SITUATIONS SUCH AS AIR TURNBACKS AND ABORTED TAKEOFFS. PROPER ENGINE DRY-OUT IS IMPORTANT TO PREVENT THOSE SITUATIONS.’ Footnote 6 The detergent used by the operator was Turco 5884. 7 ESM Subtask 72-00-00-110-009. 8 ESM Subtask 72-00-00-170-004. 9 ESM Subtask 72-00-00-410-004.

23 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 The procedure instructs personnel to run the engine at idle for five minutes before operating the anti-ice and engine bleed systems, while the engine continues to be run at idle. The aircraft’s pneumatic and environmental control (ECS) systems use bleed air extracted from the high pressure compressor (HPC). The purpose of this procedure is to purge fluid which may be trapped in the engine bleed ducts or ECS. A note in the procedure states: ‘… If the engine is installed on an aircraft, the idle speed cannot fully dry-out the aircraft ECS system. If the ECS system can be verified to be dry or a water-wash without cleaner was done, engine run at 65 percent N110 can be considered optional. If not, drying-out the ECS system via operation up to 65 percent N1 is recommended.’ At low engine power settings engine bleed air is extracted from the ninth stage of the HPC while at high engine power settings, bleed air is extracted from the fifth stage of the HPC. The purpose of reaching 65 % N1 during the engine dry-out ground run is so that the engine speed is high enough that the ECS bleed source has switched to HPC fifth stage bleed, so that the fifth stage bleed ducts are dried out. A further caution states: ‘OPERATORS MAY OBSERVE SOME RESIDUAL VAPOR IN THE CABIN AS A RESULT OF THE WASH DURING ENGINE DRY-OUT. IF VAPORS ARE OBSERVED IN THE CABIN DURING ENGINE DRY-OUT, IT IS RECOMMENDED THAT THE OPERATOR EXTENDS THE ENGINE DRY‑OUT UNTIL VAPOR EVAPORATES. THESE VAPORS ARE THE RESULT OF RESIDUAL DETERGENT IN THE BLEED SYSTEM, WHICH IS NON-TOXIC BUT CONSIDERED A NUSIANCE TO OPERATORS.’ 5TH STAGE BLEED DUCT Figure 6 Engine schematic showing location of high pressure compressor fifth stage bleed duct Footnote 10 Engine fan speed.

24 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 The procedure requires that an observer is positioned in the aircraft cabin to detect any odour or detergent after completion of the ECS and anti-ice dry-out procedure. If odours or fumes are detected, the engine dry-out should be continued until none are detected. Operator’s internal safety investigation General The operator conducted an internal safety investigation into the circumstances around the compressor wash on G-FBEJ. This included interviewing the maintenance personnel involved and reviewing relevant procedures, policies and training records. The findings of the internal safety investigation are described in the subsequent paragraphs. Information from interviews with maintenance personnel Several engineers were involved in this task. Engineer 1 carried out the engine ground runs from the cockpit and certified the task. Two safety personnel were positioned outside the aircraft, one to operate the compressor wash rig and communicate with Engineer 1 via a headset and the other to check the engine. When Engineer 1 arrived at the aircraft, the compressor wash rig fluid tanks were full and it was already attached to the No 1 engine, having been attached by the day shift. One compressor wash cycle was carried out using a water/detergent mix and four rinse cycles using water. Engineer 1 then performed the engine drying procedure using idle power only. He could not recall any warnings or cautions for the ECS when carrying out the dry-out run. Although he could smell the cleaning solution when the dry-out run began, he could no longer smell it after the run had finished but the aircraft doors had been opened to aid venting. Engineer 1 commented that when compressor washes had previously been done by the night shift, they were part of a larger maintenance input rather than a stand-alone task; this allowed for the high-power engine dry-out runs to be carried out by the oncoming day shift. He considered that the night shifts were generally undermanned and there was a lack of support functions that would be present during the normal working day. Engineer 2 was the hangar bay supervisor and allocated the compressor wash task to Engineer 1. He stated that the night shift was normally pushed for time, with aircraft often not arriving in the hangar until 2200 hrs and needing to be back on-stand by 0300 hrs. He stated that he does not have the opportunity to review resources and required materials before work is carried out and it is often left to him to address any issues with the work packs, missing materials or tasks that cannot be performed. Engineer 4 accepted the aircraft into the hangar for the compressor wash. Although he attempted to check if the engineers on the oncoming shifts had the approval to carry out the task, the databases he consulted were out of date and he did not have the knowledge to verify the approvals by other means. The work had been planned in for the day shift but problems encountered with sourcing a serviceable compressor wash rig meant the task had to be carried out by the night shift.

25 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Preparations for the compressor wash had been undertaken by the hangar day shift. This included replenishing the compressor wash rig with air, detergent and water and attaching it to the No 1 engine. Engineer 3 had undertaken these actions. He reported that prior to replenishment, the cylinder with the detergent/water mix was already approximately half full, with what he assumed to be the correct concentration of detergent/water. He then continued to add to the liquid already in the cylinder using a ratio of four parts water to one part detergent. Engine ground runs There were only two engineers (including Engineer 1) on the night shift who were qualified to conduct engine ground runs on the E195. Both had limited experience in doing so and were only approved to conduct low power engine ground runs. Engineer 1 was an experienced engineer who held company approvals for the E195 and another aircraft type in the operator’s fleet. He predominantly worked on the other aircraft type, on which he was experienced in conducting engine compressor washes, but these required only idle power engine runs. He did not have any recent experience carrying out engine ground runs on the E195 and had not performed a compressor wash on an E195 before. There were only two engineers within the operator’s maintenance organisation company who were qualified to train others on conducting engine ground runs on the E195. A lack of trainers, training opportunities and access to simulators had resulted in a reduction in the number of competent authorised engineers available. The engineers involved, and others consulted, considered that the ESM task used to carry out the compressor wash was poorly laid out and difficult to interpret. The maintenance organisation typically used process sheets for complicated maintenance tasks but did not have a specific process sheet for performing compressor washes. Ground equipment Prior to being replenished by Engineer 3, it was not determined when or by whom the compressor wash rig had last been used. When the rig was examined after the accident the water cylinder was empty and the water/detergent cylinder was half full. It was found that the organisation had limited processes in in place to trace ground servicing equipment such as the compressor wash rigs. No records were kept of when, or on which aircraft, the rigs had been used, when they were last replenished and with what type or concentration of fluid. The limited and simple instructions shown on placards on the compressor wash rigs were considered insufficient and no detailed instructions or training on how to use the rigs was available. The operator identified that this was a specific type of maintenance task that would benefit from on-the-job training. An audit of compressor wash rigs following the accident found that many were in poor condition and that the fluid tanks did not have sight glasses or any method of establishing the correct fluid concentration. The compressor wash rigs were subsequently quarantined until they had been drained, flushed and replenished with a known concentration of fluids.

26 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Maintenance planning The requirement for the compressor wash had been identified by the operator’s maintenance control department on the preceding afternoon, to rectify a decreasing trend in engine turbine temperature, which had been highlighted by routine engine performance monitoring. Maintenance planning for the task did not identify the time, resources or competence required for the compressor wash task, nor confirm that the required resources were available. There was no process in place for the acceptance of aircraft maintenance at short notice. Engineer 4 accepted the aircraft into the hangar on the understanding that the compressor wash would be completed by the day shift, which had appropriately authorised engineers available. Due to the poor condition of the compressor wash rig engineers on the day shift spent considerable time getting it ready and as a result, the task was handed over to the night shift for completion. Engineer 2 allocated the compressor wash task to Engineer 1, without fully understanding the requirements of the task. The night shift did not have engineers available with the correct authorisations to complete the task. Information regarding approvals and authorisations held by engineers was not readily accessible by managers, shift supervisors and maintenance planners which made it difficult to plan resources and assess the capabilities of the current or oncoming shift. This information was normally accessible by staff working core office hours. Engineer 1 did not hold the necessary approvals to conduct high powered engine ground runs on E195 aircraft, and thus was not qualified to carry out all the required maintenance actions described in the ESM compressor wash and engine dry-out procedure. Engineer 1 certified the task despite several elements of the task not being completed. Engineer 2 signed the certificate of release to service following the compressor wash despite not holding the correct approvals to release E195 aircraft to service. Nature and scope of maintenance work In the months preceding this incident, the nature and volume of the maintenance work carried out by the night shift at the operator’s base had changed considerably. Termination of a contract with an external maintenance provider had resulted in an increase in maintenance work being undertaken at the operator’s own maintenance facility. Previously the bulk of the work undertaken was in-depth planned maintenance tasks, but in the period preceding the accident most of the maintenance undertaken was reactive with short turnaround times and little prior notice of the type of work required. Engineers considered that the maintenance was often not correctly resourced with respect to spares, tooling or manpower and the time allocated for tasks was often incorrect and did not take account of the time needed to tow the aircraft from its location to the hangar and back. While the operator had implemented a change management process to support the transition of maintenance from the external maintenance provider to its own maintenance facility, the internal investigation identified that procedures and processes had not been adapted to cater for the change in maintenance type.

27 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 In common with other shifts, on the night shift a small number of engineers, often in supervisory roles, held the majority of approvals and authorisations for conducting maintenance such as engine ground runs, certifying maintenance and certifying the release of aircraft to service. This placed substantial responsibility on a small number of individuals. Maintenance culture Although the aircraft required a compressor wash, this was not an urgent requirement and could have been allocated to a suitably resourced shift. The operator’s investigation identified that there was a ‘can do’ culture throughout its engineering departments and a ‘willingness to get the job done’. This may have contributed to several opportunities being missed, to prevent the improperly authorised maintenance, at the maintenance planning, task acceptance and task allocation stages and during the task itself. Company policies implemented as part of its change management process had endeavoured to empower engineers to call ‘stop’ if they felt they could not complete maintenance safely but in the absence of supporting procedures, these were found to place an over-reliance on the individuals. Welfare During the investigation Engineer 1 and Engineer 2 disclosed that they were each experiencing personal issues which had been occupying their thoughts, but each considered that they were fit to continue working and to certify maintenance. Although their managers had been aware of their circumstances, no specific support had been put in place, nor any restrictions on what they could supervise or certify. Supervisors and managers had received only minimal training in how an individual’s welfare can affect their performance. Fatigue The engineers on the night shift worked a permanent shift pattern of four 12-hour night shifts, followed by four nights off. The compressor wash was carried out on the third night of the shift and the work was performed between 2300 hrs and 0300 hrs. The operator did not determine whether fatigue was a factor in how the compressor wash was performed, but its internal investigation identified that although the operator had a fatigue risk management system in place for flight crew, no such system was in place for engineers. Post-accident maintenance Before the aircraft was returned to service the operator’s maintenance staff, in consultation with the engine manufacturer, performed several additional compressor rinse cycles to flush any residual detergent from the No 1 engine and fifth stage bleed ducts. Despite this, detergent bubbles continued to come out of the engine during idle power engine runs, which led the operator to consider that the dilution of the cleaning solution used may have been incorrect. A sample of the detergent/water mix taken from the compressor wash rig was subjected to FTIR11 analysis and compared to a calibration curve for the detergent. Footnote 11 Fourier transform infrared spectroscopy.

28 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 This determined that the concentration of the sample was 31.3% detergent. It could not be determined if and to what extent the compressor wash rig had been topped up during the compressor wash and rinse cycles, which could have altered the dilution from that used on G-FBEJ’s engine. Given the difficulty purging the residual detergent from the engine, and the result of the sample analysis, the operator considered that the compressor wash rig may have contained an overly strong concentration of cleaning solution, prior to being replenished by Engineer 3. As the precise concentration of cleaning solution used could not be established, nor the effect of its long exposure to engine parts, the engine was withdrawn from service on the engine manufacturer’s recommendation. Analysis General On the aircraft’s first flight of the day fumes became apparent in the cockpit during the latter stages of the taxi out and were subsequently accompanied by smoke as the thrust levers were advanced for takeoff. The takeoff was discontinued after which the intensity of the smoke and fumes increased. Following the flight crew’s assessment of the situation, and confirmation from the SCCM of fumes and smoke in the cabin, the commander made the decision to evacuate. An engine compressor wash had been performed on the aircraft’s No 1 engine during overnight maintenance on the night before the accident. A high-power engine ground run was not performed following the compressor wash, resulting in residual cleaning solution remaining in the compressor bleed air ducts. This can lead to fumes or unusual odours entering the cockpit and cabin. Source of the smoke and fumes During the engine dry-out procedure following the compressor wash, the engines were run only at idle power. At idle power the engine power setting would have been insufficient for the engine bleed source to switch to the HPC fifth stage bleed. To dry out the fifth stage bleed ducts, the procedure recommended running the engine up to 65% N1. By not performing a high-power engine ground run, residual cleaning solution remained within the fifth stage bleed ducts. As the thrust levers were advanced for takeoff the ECS bleed source would have switched to HPC fifth stage engine bleed, allowing smoke and fumes from the residual detergent to enter the cockpit and cabin. Compressor wash and dry-out procedure The ESM task for ‘Engine performance recovery’ is comprised of many subtasks covering several wash, rinse and drying scenarios. It contains multiple notes and cautions, not all of which stand out from the main text and some of which contain critical information. In particular, the information relating to the need to perform a high-power engine run during the dry-out procedure is included in a note rather than in a procedural step. The ESM indicated that this was a recommended rather than required action. The AAIB questioned the engine manufacturer’s rationale for this step being recommended rather than required.

29 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 They advised that for consistency with the other strong cautions throughout the ESM task, conducting a high-power engine run should be a required step following a compressor wash with detergent. In June 2020, it updated ESM subtask 72-00-00-410-004 task to reflect this. Engineer 1 was more accustomed to working on another aircraft type. He had never performed a compressor wash on an E195 before, had limited experience in conducting engine runs on the E195 and was not qualified to conduct high-power engine runs. This, coupled with the fact that the procedure only recommended rather than required, a high‑power engine run, likely influenced his decision to proceed with and certify the task without alerting his supervisors of the need for a high-power ground run. The operator’s internal investigation identified that complex maintenance tasks, such as that for a compressor wash would benefit from a company process sheet to supplement manufacturer’s procedures. Organisational factors Maintenance planning, both at the operator and hangar level, did not adequately identify the resources required to undertake the compressor wash, nor attempt to match the requirements of the task to the capabilities of the oncoming hangar shifts. Systems in place did not assist maintenance planners and managers to easily establish the competence and approval status of individual engineers. As a result, this maintenance task was allocated to a shift which did not have the correct competence and approvals to carry out and certify the task, or to release the aircraft to service. Had Engineer 2 fully understood the requirements of the task, the resources required to complete it and the approval status of the engineers on the night shift, it is likely that the task would have been rejected by the night shift instead of being allocated to Engineer 1. Similarly, had Engineer 4 understood these aspects, it is likely the task would have been deferred when it could not be completed by the day shift. The operator’s internal investigation found that willingness to get the job done, may have led to opportunities to stop the task being missed and existing policies may have placed too much reliance on individual engineers to identify tasks that could not be safely accomplished. With regard to conducting engine ground runs, the operator’s internal investigation identified a lack of suitably trained engineers, trainers and training opportunities. It also identified a lack of specific training or assisting documentation for conducting engine compressor washes and using compressor wash rigs. Many of the compressor wash rigs were found to be in poor condition. There were no records of when they were last replenished, the type or concentration of detergent used or on which aircraft they had been used. The lack of records meant that it was not possible to determine the concentration of cleaning solution that had been in the rig, prior to its replenishment by Engineer 3.

30 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Although night shift engineers permanently worked nights, no fatigue risk assessment had been carried out to understand the potential impact on individual performance. Both Engineer 1 and 2 disclosed that they had been experiencing personal issues, which could have been affecting their mental state. Although aware, it was not determined whether their managers had taken any steps to determine whether they were capable of being on duty and certifying aircraft, and the operator’s internal investigation identified that only minimal training was available for supervisors and managers in this regard. The operator had taken several safety actions to address these and other issues. However, it ceased operations before all intended safety actions could be fully implemented. Evacuation The commander’s decision to evacuate was based on his concern that there may have been a fire on the aircraft and was likely influenced by the increase in intensity of the fumes, the appearance of smoke in the cockpit and confirmation of smoke and fumes of unknown origin in the cabin. The flight crew actioned the emergency evacuation vital actions (memory items) followed by the QRH EMERGENCY EVACUATION checklist. Both the memory actions and the QRH checklist require the flight crew to set the emergency/parking brake to on, select flap 5 and then move the thrust levers to idle. In this case, as the aircraft was stationary the thrust levers had already been retarded to flight idle and the parking brake set. The vital actions were therefore performed somewhat out of sequence and proceeded more rapidly than might be expected if an emergency evacuation followed a rejected takeoff or emergency landing scenario. Therefore, despite selection of flap 5, the flaps had insufficient time to travel to the selected position before the engines were shutdown. This resulted in an increased drop to the ground for passengers evacuating via the overwing exits, with many reluctant to jump or slide off the wing, leading to an increase in the time taken to complete the evacuation. The emergency evacuation vital actions use the term ‘confirm flap 5,’ which suggests that this action requires the flight crew to confirm that the flaps have already travelled to flap 5. The commander commented that in training, an emergency evacuation is most often practiced following a rejected takeoff scenario and flap 5 is selected as soon as the decision to reject is made and before the aircraft has been brought to a stop. The flaps would therefore have travelled to the selected position by the time the emergency evacuation vital actions were actioned. The aircraft manufacturer did not consider that any amendment of the QRH EMERGENCY EVACUATION checklist was required as a result of this occurrence. It considered that the normal flow of actions allows enough time for the flaps to reach a position beyond flap 1 and even if this did not occur, the drop to the ground from the flap 1 setting was still within with the maximum of six feet certification requirement of CS/FAR 25.810(d). Some passengers attempted to take their baggage with them during the evacuation. This can slow down an evacuation, as cabin crew attempt to remove baggage from the

31 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 passengers. Removed baggage can also create an obstruction in the cabin for others. In its report into the accident involving A320 registration OE-LOA on 1 March  2019 (AAIB  report AAIB-25599, published in September 2020) the AAIB discussed the increasing trend in passengers attempting to carry cabin baggage with them during emergency evacuations. The AAIB made Safety Recommendations SR 2020-018 and SR 2020-019 to the EASA on this subject. Overwing escape route markings Despite the presence of a marked exit route on the wing with a non-slip surface, many passengers who exited via the overwing exits reported being uncertain where to go once out of the aircraft. None of them mentioned noticing the marked walkway on the wing. The evacuation took place during daylight hours with good visibility. As noted in the RAeS paper, overwing exit route markings are not always readily identifiable and may be even less so in darkness. Poor weather conditions or the presence of smoke could also hinder identification of an exit route. The large drop to the ground and the absence of obvious immediate danger meant that passengers did not feel compelled to jump or slide off the wing. This led to passengers gathering on the wing surface, which was reported as slippery, increasing the risk of slips and falls. A bottle-neck also formed in the cabin around the overwing exits creating a delay for those still trying to exit. It is apparent from this accident and the RAeS paper that the issue of ambiguous overwing escape route markings that resulted in previous AAIB Safety Recommendations 2002‑42 and 2010-007 still exists. It is therefore appropriate that this matter is re-examined. The AAIB asked the EASA to review the issues identified relating to overwing escape route markings. The EASA indicated that while it considered all applicable certification requirements for the E195 relating to evacuation from overwing emergency exits had been met, it intended to consider introducing a new AMC to: ‘identify acceptable guidelines and options for the measurement of the contrast between the marking of the escape path located over the wing and the background colour of the wing surface.’ The EASA also outlined its participation in the FAA Emergency Evacuation Standards ARC, which was expected to produce its final report on 15 May 2020. The EASA stated that the ARC will recommend that the FAA, in conjunction with other Aviation Authorities, considers changes to the certification requirements for overwing exits, to allow easier identification of the evacuation path by passengers and a faster safer transition from the wing to the ground. As this regulatory process is ongoing at the time of publication of this report, and it is not known to what extent the FAA will accept the recommendations of the ARC, the following Safety Recommendations are made:

32 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Safety Recommendation 2020-020 It is recommended that the European Union Aviation Safety Agency amends the certification requirements relating to the  design, contrast and  conspicuity  of  overwing  exit escape route markings on commercial air transport  aircraft,  to  ensure  that the route to be taken from wing to ground is immediately apparent to evacuating passengers, in a range of emergency scenarios. Safety Recommendation 2020-021 It is recommended that the Federal Aviation Administration amends the certification requirements relating to the  design, contrast and  conspicuity  of  overwing  exit escape route markings on commercial air transport  aircraft,  to  ensure  that the route to be taken from wing to ground is immediately apparent to evacuating passengers, in a range of emergency scenarios. Provision of evacuation slides Emergency exits that do not meet the 1.8 m maximum height criteria of FAR/CS 25.810 are not required to be equipped with an evacuation slide. This applies equally to overwing and non-overwing exits. The RAeS paper identified that jumping from heights of up to 1.8 m can be challenging for many passengers and has the potential to cause injury. Similar findings were documented in the 2009 EASA study and prior to that, the NTSB safety study, which made a Safety Recommendation to the FAA on this subject. Overwing exits on many aircraft types rely on the trailing edge wing flaps being lowered to reduce the drop to the ground below 1.8 m. As this accident, and the findings of the RAeS paper demonstrate, this condition is not always achieved. Failure to lower the flaps, for whatever reason, can hinder an evacuation and may cause injury to passengers and crew. In addition to the subject of overwing exit markings, the ARC evaluated the extent to which it is reasonable to expect passengers to jump to the ground from a height of 1.8 m, instead of benefitting from the installation of a properly designed emergency egress system. As a result, the ARC proposed that the FAA consider reviewing the requirements of FAR  25.810  (a) and (d) to define conditions that would require the provision of an escape slide at such exits. As this regulatory process is ongoing at the time of publication of this report, and it is not known to what extent the FAA will accept the recommendations of the ARC, the following Safety Recommendations are made:

33 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Safety Recommendation 2020-022 It is recommended that the European Union Aviation Safety Agency, re-evaluate and reduce the 1.8 m height criteria in CS 25.810(a) and (d), for the provision of an assisted means of escape at emergency exits, to minimise passenger injuries and reduce egress time during emergency evacuations. Safety Recommendation 2020-023 It is recommended that the Federal Aviation Administration, re-evaluate and reduce the 1.8 m height criteria in FAR 25.810(a) and (d), for the provision of an assisted means of escape at emergency exits, to minimise passenger injuries and reduce egress time during emergency evacuations. The operator also updated the content of its briefing to passengers seated in the overwing exits of the E195 as a result of this occurrence. Changes included: simplifying terminology, instructing those passengers of the need to be first out on the wing, informing them of the need to help and direct other passengers, and highlighting that there is no escape slide attached to the overwing exits. Conclusion A lack of maintenance planning, training and control of resources led to an undesirable situation where a maintenance task was allocated to an engineer who was neither qualified nor competent to complete the task. A key step in the engine drying procedure was only described as ‘recommended’ and the engineer did not complete all the elements of the task. This resulted in residual cleaning solution remaining within the ECS system, causing smoke and fumes within the cabin and cockpit and leading to an emergency evacuation. The engine drying procedure has since been amended to require this step to be carried out. Due to the order in which the emergency evacuation vital actions were performed, the flaps had insufficient time to travel to the selected position. This resulted in an increased drop to the ground for passengers evacuating via the overwing exits, with many reluctant to jump or slide off the wing. Additionally, despite the presence of a marked exit route on the wing with a non-slip surface, many passengers who exited via the overwing exits were uncertain where to go once out of the aircraft. Both of these factors increased the time taken for emergency evacuation to be completed. Safety Actions/Recommendations As a result of this accident the operator undertook the following safety actions: ● ● Updated the content of its briefing to passengers seated in the overwing exits of the E195. ● ● Enhanced the control and tracking of maintenance ground support equipment to enable calibration expiry dates to be managed more effectively.

34 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 ● ● Introduced a maintenance planning procedure so that maintenance requirements are identified earlier in the working day to allow appropriate resources to be identified and allocated. ● ● Undertook a review of tasks performed within the hangar to identify specific training requirements with a view to developing training programmes. ● ● Launched an engineer’s competency passport scheme to enable maintenance planning departments to allocate specific maintenance tasks to maintenance stations where the correct resources are available. ● ● Introduced additional simulator training for engineers to undertake engine ground runs and committed to review the its recency period for conducting engine ground runs. ● ● Introduced a programme to verify that engineers have the correct procedures, records, equipment and tooling, personnel requirements, approvals, replacement parts, environment and information before commencing a maintenance task. ● ● Committed to undertake fatigue risk assessments for night shift maintenance personnel and initiated an engineer welfare programme.

● ● Updated its change management process to ensure appropriate management of the risks associated with the changing nature of maintenance being conducted in its base hangar. In June 2020, the engine manufacturer updated ESM subtask 72-00-00‑410‑004 to require, rather than recommend, that a high-power engine dry-out run is conducted after a compressor wash using detergent. Additionally, the following Safety Recommendations have been made to the EASA and the FAA: Safety Recommendation 2020-020 It is recommended that the European Union Aviation Safety Agency amends the certification requirements relating to the  design, contrast and  conspicuity of overwing exit escape route markings on commercial air transport  aircraft, to ensure that the route to be taken from wing to ground is immediately apparent to evacuating passengers, in a range of emergency scenarios. Safety Recommendation 2020-021 It is recommended that the Federal Aviation Administration amends the certification requirements relating to the  design, contrast and  conspicuity of overwing exit escape route markings on commercial air transport  aircraft, to ensure that the route to be taken from wing to ground is immediately apparent to evacuating passengers, in a range of emergency scenarios.

35 © Crown copyright 2020 All times are UTC AAIB Bulletin: 10/2020 G-FBEJ AAIB-25591 Safety Recommendation 2020-022 It is recommended that the European Union Aviation Safety Agency, re-evaluate and reduce the 1.8 m height criteria in CS 25.810(a) and (d), for the provision of an assisted means of escape at emergency exits, to minimise passenger injuries and reduce egress time during emergency evacuations. Safety Recommendation 2020-023 It is recommended that the Federal Aviation Administration, re-evaluate and reduce the 1.8 m height criteria in FAR 25.810(a) and (d), for the provision of an assisted means of escape at emergency exits, to minimise passenger injuries and reduce egress time during emergency evacuations. Published: 17 September 2020.

FD06696 ｜ 2020_英国_aaib-investigation-to-glos-airtourer-150-g-axix__Glos-Airtourer_150_G-AXIX_06-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

90 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-AXIX AAIB-26479 ACCIDENT Aircraft Type and Registration: Glos-Airtourer 150, G-AXIX No & Type of Engines: 1 Lycoming O-320-E2A piston engine Year of Manufacture: 1969 (Serial no: A527) Date & Time (UTC): 25 March 2020 at 1619 hrs Location: Almeley Wootton, Herefordshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - None Passengers - None Nature of Damage: Nosewheel, propeller, wing and canopy damaged Commander’s Licence: Private Pilot’s Licence Commander’s Age: 73 years Commander’s Flying Experience: 1,101 hours (of which 760 were on type)

Last 90 days - 3 hours

Last 28 days - 2 hours Information Source: Aircraft Accident Report Form submitted by the pilot The pilot and passenger were flying from Shobdon Airport in Herefordshire to a grass airstrip near Almeley Wootton (approximately 5 nm south-west of Shobdon). After flying in the local area for an hour the pilot made an approach to land on the north-westerly runway. The wind was approximately 5 kt across the runway. The pilot reported he landed on the main wheels but as the nosewheel touched down the aircraft started to oscillate in pitch. The nosewheel detached, the propeller struck the ground and the aircraft came to a sudden stop. Neither occupant was injured and they were both able to exit the aircraft normally. The pilot believes the accident was caused by a slightly higher groundspeed than he was use to, due to the lack of headwind, and him closing the throttle slightly early causing the aircraft to drop onto the runway. He was aware he was landing on a short runway so did not want to land too far along it. The pilot reported that as the aircraft came to a sudden halt the fire extinguisher, which was mounted at the back of the baggage compartment, came loose and travelled past the passenger’s head and through the windscreen. When the aircraft is repaired, he intends to relocate the fire extinguisher behind the seats to ensure it is secure.

91 © Crown copyright 2020 All times are UTC AAIB Bulletin: 6/2020 G-AXIX AAIB-26479 Figure 1 G-AXIX after the accident

FD06697 ｜ 2020_英国_aaib-investigation-to-guimbal-cabri-g2-g-cilr__Guimbal_Cabri_G2_G-CILR_04-20.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

13 © Crown copyright 2020 All times are UTC AAIB Bulletin: 4/2020 G-CILR EW/C2019/07/04 ACCIDENT Aircraft Type and Registration: Guimbal Cabri G2, G-CILR No & Type of Engines: 1 Lycoming O-360-J2A piston engine Year of Manufacture: 2015 (Serial no: 1090) Date & Time (UTC): 22 July 2019 at 1730 hrs Location: Wycombe Air Park Type of Flight: Private Persons on Board: Crew - 1 Passengers - None Injuries: Crew - None Passengers - N/A Nature of Damage: Destroyed Commander’s Licence: Private Pilot’s Licence (Helicopters) Commander’s Age: 21 years Commander’s Flying Experience: 174 hours (of which 110 were on type)

Last 90 days - 22 hours

Last 28 days - 9 hours Information Source: AAIB Field Investigation Synopsis The helicopter had flown from Dunkeswell, Devon, to Wycombe Air Park, Buckinghamshire. As the pilot was shutting down the helicopter, he noticed smoke emanating from the left side of the rotor mast. He evacuated the helicopter and tried, unsuccessfully, to extinguish the fire with the helicopter’s on-board fire extinguisher. The helicopter was destroyed. Examination of the wreckage identified that the electrical cable connecting the alternator to the starter relay had short circuited against the aluminium baffle that surrounds the engine, probably as a result of the cable clips being incorrectly fitted. As a result of this investigation the helicopter manufacturer issued a service bulletin to instruct operators to inspect for correct installation of the cable clips and has also completed a redesign of the clips to ensure they cannot be fitted incorrectly. History of the flight The helicopter was being flown from Dunkeswell Airfield, Devon, to Wycombe Air Park, Buckinghamshire. Prior to the flight, the helicopter had last flown on 17 June 2019 with no reported issues. The pilot conducted the pre-flight checks and found the helicopter to be in a satisfactory condition. The fuel level was below the minimum to hover-taxi to the pumps, so the pilot

14 © Crown copyright 2020 All times are UTC AAIB Bulletin: 4/2020 G-CILR EW/C2019/07/04 used a jerry can to uplift 20 litres of fuel before initiating the start procedure. When he attempted to start the engine the starter motor would not turn. The pilot thought that the battery may be low on charge due to the elapsed time since the helicopter’s last flight so he charged it using a dedicated 12V DC charger. After charging the battery for approximately 2.5 hours the engine was successfully started. The pilot let the engine to idle for approximately 15 minutes, to further charge the battery, before he hover-taxied to the fuel pumps. Whilst waiting for the battery to charge the pilot contacted Wycombe tower to ask permission to land at the airfield outside of normal operational hours, which was granted. Once the helicopter was fuelled, the pilot completed inter-flight1 checks, started the engine and departed Dunkeswell at 1600 without issue. During the flight the pilot made specific note of the ammeter indication to confirm that the alternator was charging the battery. He noticed nothing unusual during the flight. The pilot made a blind radio call on the Wycombe frequency before the helicopter entered the ATZ to the north of the airfield. After crossing Runway 06/24 the helicopter landed on helicopter pad 10. After landing the pilot commenced the normal shutdown procedure. He bought the engine to idle, disengaged the clutch, waited 10 seconds and then shut the engine down. As he did so he noticed a static noise being received on the radio. He also noticed that the ammeter was at its full negative deflection for approximately 2 seconds before stabilising at around 1/3 negative deflection. In addition the Exhaust Gas Temperature (EGT), which would normally read ‘- - -’2 shortly after shutdown, indicated approximately 350°C and the carburettor temperature reading was steadily increasing from 30°C to above 50°C. The pilot applied the rotor brake and shortly before the rotor had stopped the he observed smoke rising over the left side of the helicopter. He left the helicopter and saw flames coming from within the cowling around the left side of the main rotor mast. He went back to the helicopter and pulled the emergency fuel shut-off and switched off all electrical switches before retrieving the on-board fire extinguisher. He expended its contents, half into the mast cowling and half onto the underside of the engine, but this had no effect. He then retrieved a personal bag from the cockpit before retreating to a safe distance.

A witness called the emergency services and a local fire and rescue appliance arrived approximately ten minutes later. The fire was extinguished but by this time the helicopter had been destroyed. There were no injuries. Footnote 1 Inter-flight checks are defined in the Guimbal Cabri Flight Manual as those to be conducted between flights after completion of the Daily or Pre-flight inspection. 2 When the EGT is below its normal operating range and operating below the temperature sensing capability of the thermocouples the EGT reading on the display reads ‘---’.

15 © Crown copyright 2020 All times are UTC AAIB Bulletin: 4/2020 G-CILR EW/C2019/07/04 Accident site The helicopter was located at helicopter landing pad 10 at Wycombe Air Park. The entire helicopter, except the tail boom had been consumed by fire (Figure 1). Figure 1 G-CILR prior to being moved The engine remained attached to its support frame. The battery had been destroyed, however the electrical cables that had been connected to the battery were present. The insulation on the cables had been consumed by fire. The cable connecting the alternator output to the starter relay in the battery compartment was found to be in two pieces. Where it had broken the cable material had fused together, creating a globule of re-solidified molten material (Figure 2). Both ends of the broken cable was removed from the wreckage and taken to the AAIB for further assessment. A section of the helicopter’s power generation and distribution circuit diagram can be found in Figure 3. Alternator to starter relay cable – starter relay end Re-solidified molten material at break Figure 2 Helicopter cables within the wreckage

16 © Crown copyright 2020 All times are UTC AAIB Bulletin: 4/2020 G-CILR EW/C2019/07/04

Alternator to starter relay cable Figure 3 Section of Power Generation and Distribution diagram for Guimbal Cabri G2 Recorded information A closed-circuit television camera captured the landing and subsequent fire. The first noticeable smoke coming from the rotor mast was observed approximately 244 seconds after the aircraft landed. At this time the rotor blades were slowing and the tail mounted strobe light was flashing, indicating that the master switch was on. Aircraft information The Guimbal Cabri G2 is a light two-seat helicopter primarily used to train private pilots and for aerial photography and observation. It is the first helicopter to be primarily certified to EASA CS27 and then to achieve FAA FAR-27 certification for helicopters with a maximum takeoff weight of less than 3,175 kg (7,000 lbs). The airframe is composed of three sections; main fuselage, engine section, and tail boom. The main fuselage is a carbon-fibre reinforced monocoque, constructed in five parts. In the cabin there are two side-by-side seats, with the pilot occupying the right position. The main fuselage also includes a central structure, baggage compartment and fuel tank. The engine section is isolated from the cabin by a firewall with the engine supported on a tubular steel frame. The composite tail boom incorporates a Fenestron tail rotor, vertical fin and a horizontal stabilizer. The engine is mounted to the rear of the passenger compartment and drives a pulley at the front of the engine. A belt transmits the drive from the engine pulley to the main input drive of the rotor system via a pulley and freewheel coupling. A clutch mechanism is used to engage the drive from the engine to the rotor system. This is achieved by pivoting the

17 © Crown copyright 2020 All times are UTC AAIB Bulletin: 4/2020 G-CILR EW/C2019/07/04 engine about its rear mounts; an actuator lowers front of the engine which tensions the belt, allowing drive to be transmitted to the rotor system. When the clutch is disengaged, the actuator retracts, lifting the output pulley and disengages the drive. The engine output pulley moves approximately 15 mm when the clutch actuator moves from engaged to disengaged. An aluminium baffle is mounted to the front of the engine to aid cooling around the engine. The starter and alternator cables, which run from the battery compartment, on the left of the aircraft behind the firewall, to the engine mounted starter and alternator, pass through the baffle and are held in place by two cotton impregnated phenolic clips either side of the baffle. (Figures 4 and 5) Starter cable Alternator cable Rear cable clip Forward clip visible through cut-outs Figure 4 Starter and alternator cables passing through engine baffle (viewed from rear) Figure 5 Exploded view of correct installation of cable clips

18 © Crown copyright 2020 All times are UTC AAIB Bulletin: 4/2020 G-CILR EW/C2019/07/04 The clips are designed to hold the cables centrally within the pre-drilled holes in the baffle. The clips themselves are identical and should be fitted in opposition to each other, so they retain the cables between the bottom of each cut out. A cooling fan, with a carbon fibre housing, is mounted in front of the engine baffle (Figure 6). Forward cable clip Engine cooling fan housing Starter cable Alternator cable Engine baffle Figure 6 Starter and alternator cables passing through front of engine baffle (view from below) G-CILR held a valid Airworthiness Review Certificate and was up to date with its required regular inspections. A review of its technical documentation found that the engine had been removed on 18 December 2018, 102.5 hours prior to the event, and that the ‘engine cooler baffle’ had been repaired on 21 March 2019, 47.6 hours prior to the event. As part of the engine removal the starter and alternator cables and clips would have been removed and replaced. Records were not available to determine whether the cables and clips were removed during the baffle repair. Cable examination Laboratory analysis of the cable removed from the aircraft found that the re-solidified molten material (Figure 7) was predominantly copper and nickel, the material of the cable itself. The cause of the fusing was as a result of extreme localised heating associated with electrical arcing. There were no traces of any other metallic elements within the re-solidified molten material to identify the component that the cable had arced against. Measurement of the cable fragments against a cable of the same part number from another Guimbal Cabri G2 identified that the location of the break was coincident with the location that the wire passed through the aluminium baffle. The baffle on G-CILR had been destroyed in the fire and therefore could not be examined as part of the investigation.

19 © Crown copyright 2020 All times are UTC AAIB Bulletin: 4/2020 G-CILR EW/C2019/07/04

Alternator End (front view) Starter Relay End (front view)

Alternator End (rear view) Starter Relay End (rear view) Figure 7 Alternator cable break location The starter cable, which ran above the alternator cable as it passed through the baffle, was still present and showed no evidence of arcing. The cotton impregnated phenolic clips that supported the cables as they pass through the baffle were not recovered. It is considered likely that they were destroyed in the fire. Analysis The laboratory analysis of the failed alternator to starter relay cable confirmed that localised heating of the cable was associated with arcing. The location of the failure along the length of the cable was coincident with where it passed through the aluminium baffle; therefore, the baffle is most likely to have been the component that the cable arced against. The arcing will have heated the aluminium baffle material and generated sparks. This would have been sufficient to ignite the cotton impregnated phenolic clips and then the carbon fibre fan housing forward of the engine baffle. Once the fan housing had ignited the fire would have propagated quickly. To allow the core of the cable to contact the aluminium baffle, the cable must have been able to move against the baffle. This could have been due to the clipping either failing, being installed incorrectly or not being present at all. Once the cable had contacted the

20 © Crown copyright 2020 All times are UTC AAIB Bulletin: 4/2020 G-CILR EW/C2019/07/04 baffle material, the cable insulation would have to have been breached to allow an electrical circuit to be made. The ammeter reading observed by the pilot during the flight was positive, suggesting that the cable had not short circuited at this time. Only when the aircraft had landed did the ammeter read negatively suggesting that, in this case, the short circuit occurred whilst on the ground. The clips that should have been fitted to the cable in the location of the baffle were not recovered from the accident site and, if fitted, were likely to have been consumed in the fire. It is therefore not possible to determine how they were fitted, or if they were fitted at all. An assessment of the clip design identified that it was possible to fit the clips in the same orientation, rather than in opposition, resulting in the cable not being retained as intended. In this situation the cable has sufficient freedom of movement to contact the unprotected edge of the pre-drilled hole in the baffle. The subject cable uses a polymer tape insulation wound around the wire bundle. The insulation was consumed during the fire but was probably cut or worn away by contact with the edge of the hole. During the shutdown procedure the clutch is disengaged, pivoting the engine around its rear mounts. As it pivots, the baffle moves upward approximately 15 mm. With the cable being attached at its forward end to the starter relay, mounted in the battery compartment, and at its rearward end, the alternator, when the clutch is engaged or disengaged, there is relative movement that will flex the cable. The intent of the design is to allow the flex to be accommodated between the starter relay terminal and the cable clips mounted on the engine baffle. Without the clips holding the cable, engagement or disengagement of the clutch will have allowed relative movement between the cable and baffle. This relative movement would have been sufficient, over time, to wear through the insulation. It is likely that during clutch engagement or disengagement the cable was able to move through the baffle hole, as it was unrestrained by the clips. As the clutch was disengaged the baffle would move upward and away from the battery compartment, tensioning the cable. It is likely that this relative movement allowed the cable to contact the hole edge, damaging the insulation and initiating the short circuit. In this instance the issue manifested itself on the ground, however in different circumstance, it may have occurred whilst the clutch was engaged and the helicopter was in the air. It is not possible to determine whether the low battery charge prior to the accident flight was associated with the short circuit event, however it is considered unlikely to have been linked.

21 © Crown copyright 2020 All times are UTC AAIB Bulletin: 4/2020 G-CILR EW/C2019/07/04 These findings were highlighted to the helicopter manufacturer and as a result it has taken the following safety action: A Service Bulletin was issued by the helicopter manufacturer to inspect the clips to ensure correct installation. The helicopter manufacturer has completed a redesign of the clipping system to ensure the cable clipping cannot be installed incorrectly. The new design of clip is being fitted to new production helicopters and will be available via service bulletin from the manufacturer. Conclusion The helicopter caught fire shortly after landing because the heat generated from a short circuit in the engine compartment ignited a nearby carbon fibre structure. The short circuit was made between the cable that connected the output of the alternator to the starter relay and the aluminium air baffle through which the cable passed. It is likely that the cable clips that should have held the cable as it passed though the baffle were either not present or, most likely, incorrectly fitted. The upward movement of the engine as a result of the clutch disengagement was sufficient to allow the unsecured cable to contact the unprepared edge of the aluminium baffle, allowing the insultation to be cut and initiate the short circuit. Report published: 19 March 2020.

FD06698 ｜ 2020_英国_aircraft-accident-report-aar-1-2020-piper-pa-46-310p-malibu-n264db-21-january-2019__AAR_1.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

AIRCRAFT ACCIDENT REPORT 1/2020 Report on the accident to Piper PA-46-310P Malibu, N264DB 22 nm north-north-west of Guernsey on 21 January 2019 AIRCRAFT ACCIDENT REPORT 1/2020 N264DB AAIB Air Accidents Investigation Branch

AIRCRAFT ACCIDENT REPORT 1/2020 Air Accidents Investigation Branch Report on the accident to Piper PA-46-310P Malibu, N264DB 22 nm north-north-west of Guernsey on 21 January 2019 This investigation has been conducted in accordance with Annex 13 to the ICAO Convention on International Civil Aviation, EU Regulation No 996/2010 and The Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 2018. The sole objective of the investigation of an accident or incident under these Regulations is the prevention of future accidents and incidents. It is not the purpose of such an investigation to apportion blame or liability. Accordingly, it is inappropriate that AAIB reports should be used to assign fault or blame or determine liability, since neither the investigation nor the reporting process has been undertaken for that purpose.

ii © Crown Copyright 2020 Printed in the United Kingdom for the Air Accidents Investigation Branch This report contains facts which have been determined up to the time of publication. This information is published to inform the aviation industry and the public of the general circumstances of accidents and serious incidents. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and it is not used in a derogatory manner or in a misleading context. Published 13 March 2020

iii Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Contents © Crown Copyright 2020 Contents Contents Summary........................................................................................................................... 1

Factual information................................................................................................ 5 1.1 History of the flight........................................................................................... 5 1.2 Injuries to persons........................................................................................... 7 1.3 Damage to the aircraft..................................................................................... 7 1.4 Other damage.................................................................................................. 7 1.5 Personnel information...................................................................................... 8 1.5.1 Pilot.................................................................................................... 8 1.5.2 Pilot’s licence..................................................................................... 8 1.5.3 Colour vision deficiency..................................................................... 9 1.5.4 Pilot’s recent flying experience.......................................................... 9 1.6 Aircraft information........................................................................................ 10 1.6.1 Leading particulars.......................................................................... 10 1.6.2 General description of the aircraft................................................... 10 1.6.3 Engine information............................................................................11 1.6.3.1 General description of the engine..................................11 1.6.3.2 Engine history............................................................... 14 1.6.4 Previous failures of turbocharger turbines....................................... 14 1.6.5 Minimum equipment list (MEL)........................................................ 14 1.6.6 Limitations....................................................................................... 15 1.6.7 Safety equipment............................................................................. 15 1.6.8 Ice protection system....................................................................... 16 1.6.9 Autopilot........................................................................................... 16 1.6.10 Nosewheel steering......................................................................... 17 1.6.11 Wheel brakes................................................................................... 18 1.6.12 Audio warnings................................................................................ 18 1.6.13 Cabin environmental system........................................................... 18 1.6.13.1 General description....................................................... 18 1.6.13.2 Pressurised operation................................................... 19 1.6.13.3 Unpressurised operation............................................... 20 1.6.13.4 Cabin air distribution..................................................... 22 1.6.14 Maintenance and fault history.......................................................... 22 1.6.14.1 Registration and recent maintenance........................... 22 1.6.14.2 Annual inspection and 100-hour maintenance.............. 22 1.6.14.3 Inspection of the engine exhaust system...................... 23 1.6.14.4 Recent fault history....................................................... 24 1.6.14.5 Faults arising during the flight to Nantes....................... 25 1.6.15 Weight and balance......................................................................... 27

iv Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Contents © Crown Copyright 2020 Contents 1.7 Meteorological information............................................................................ 27 1.8 Aids to navigation.......................................................................................... 28 1.9 Communications............................................................................................ 29 1.9.1 Flight plan........................................................................................ 29 1.10 Aerodrome information.................................................................................. 29 1.11 Recorded information.................................................................................... 29 1.11.1 Sources of recorded information..................................................... 29 1.11.2 Passenger’s voice mail message.................................................... 30 1.11.3 The flight from takeoff until approximately 2005 hrs........................ 30 1.11.4 The flight after 2012 hrs................................................................... 31 1.11.5 Mode C altitude validity................................................................... 32 1.12 Wreckage and impact information................................................................. 33 1.12.1 General information on wreckage.................................................... 33 1.12.2 Initial survey..................................................................................... 33 1.12.3 Specific damage ............................................................................. 33 1.13 Medical and pathological information............................................................ 38 1.13.1 Post-mortem examination result ..................................................... 38 1.13.2 Toxicology........................................................................................ 38 1.14 Fire................................................................................................................ 39 1.15 Survival aspects............................................................................................ 40 1.16 Tests and research........................................................................................ 40 1.16.1 Simulation of the final manoeuvres................................................. 40 1.16.2 NTSB investigations into in-flight structural failures of

PA-46 aircraft................................................................................... 43 1.17 Organisational and management information................................................ 44 1.17.1 Airworthiness requirements for operating a US-registered aircraft

in the UK.......................................................................................... 44 1.17.1.1 Applicable regulation..................................................... 44 1.17.1.2 Inspection and maintenance - general.......................... 45 1.17.1.3 Inspection and maintenance – Aircraft Maintenance

Manual.......................................................................... 45 1.17.1.4 Inspection and maintenance – Engine Manuals and

Service Documents....................................................... 46 1.17.1.5 Ownership and responsibility for airworthiness............. 47 1.17.1.6 Airworthiness oversight................................................. 48 1.17.1.7 Safety of foreign-registered aircraft operating

in the UK....................................................................... 48

v Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Contents © Crown Copyright 2020 Contents 1.17.2 Chartering of aircraft........................................................................ 49 1.17.2.1 Organisation of the accident flight................................. 49 1.17.2.2 Assessment of risk........................................................ 49 1.17.2.3 Unlicensed charters...................................................... 49 1.17.2.4 UK regulatory approach to unlicensed charters............ 50 1.17.3 Flight crew licensing requirements.................................................. 51 1.17.3.1 CAA licensing records................................................... 52 1.18 Additional information.................................................................................... 53 1.18.1 Carbon monoxide ........................................................................... 53 1.18.1.1 CO detector fitted to N264DB....................................... 53 1.18.1.2 Source of CO in the cabin of light aircraft..................... 53 1.18.1.3 FAA report on detection and prevention of CO

exposure....................................................................... 54 1.18.1.4 Accidents and occurrences in the UK involving CO...... 55 1.18.1.5 Recent significant events involving CO in cabins.......... 55 1.18.1.6 Safety Recommendations made by the NTSB.............. 56 1.18.1.7 Safety Recommendation made by the BEA (France) .. 57 1.18.1.8 Safety Recommendations made by the AAIB

on CO monitoring.......................................................... 58 1.18.1.9 Response from the CAA to a Coroner on exposure

to CO............................................................................. 59 1.18.1.10 EASA actions to address the risk of CO poisoning....... 61 1.18.1.11 Engine manufacturer’s best practice on inspecting

exhaust systems........................................................... 62 1.18.1.12 FAA action relating to CO detectors.............................. 63 1.18.1.13 Transport Canada Airworthiness Directive.................... 63 1.18.1.14 Aircraft CO detectors .................................................... 63 1.18.2 Flying at night.................................................................................. 63 1.18.3 CAA Review of General Aviation Fatal Accidents............................ 64

Analysis................................................................................................................. 65 2.1 The flight from Nantes................................................................................... 65 2.1.1 Meteorological conditions................................................................ 65 2.1.2 Qualifications of the pilot................................................................. 65 2.1.3 Basis of the flight............................................................................. 67 2.2. Final manoeuvres ......................................................................................... 68 2.2.1 Pilot’s use of the autopilot................................................................ 68 2.2.2 Final descending turn...................................................................... 69 2.2.3 In-flight breakup............................................................................... 70 2.2.3.1 Structural damage to the aircraft................................... 70 2.2.3.2 Loads on the aircraft..................................................... 71

vi Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Contents © Crown Copyright 2020 Contents 2.3 Airworthiness of N264DB before departing from Cardiff............................... 72 2.4 Technical faults at Nantes.............................................................................. 72 2.5 The flow of CO into the cabin........................................................................ 75 2.6 The loss of control......................................................................................... 80 2.6.1 CO in the cabin................................................................................ 80 2.6.2 Aircraft control during manoeuvring beginning at 2012 hrs............. 80 2.6.3 Aircraft control during the final turn.................................................. 81 2.7 Measures to reduce the risk of CO poisoning .............................................. 82 2.8 Guidance in maintenance manuals............................................................... 85

Conclusions.......................................................................................................... 87 3.1 Findings......................................................................................................... 87 3.2 Causal factors................................................................................................ 89 3.3 Contributory factors....................................................................................... 90

Safety Recommendations and Action................................................................ 91 4.1 Safety Recommendations............................................................................. 91 4.2 Safety Action.................................................................................................. 92 Appendices Appendix A Scheduled maintenance and fault history................................................. 93 Appendix B Search for, and survey of the aircraft wreckage........................................ 98 Appendix C CAA Campaign on Unlicensed Charters................................................. 108 Appendix D Extract from Continental Aircraft Engine Maintenance Manual:

Standard Practice for Spark Ignited Engines...........................................110

vii Glossary of Abbreviations Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 GLOSSARY OF ABBREVIATIONS USED IN THIS REPORT Glossary of abbreviations 14 CFR Title 14 of the Code of Federal Regulations AAIB Air Accidents Investigation Branch A&P Aircraft and Propulsion AD Airworthiness Directive AMC Acceptable Means of Compliance amsl above mean sea level aal above airfield level AOC Air Operator’s Certificate ARA Authority Requirements for Aircrew ATC Air Traffic Control CAA Civil Aviation Authority CAP CAA publication CB Cumulonimbus CWS Control Wheel Steering CO Carbon Monoxide COHb Carboxyhaemoglobin CS Certification Specification CS-STAN Certification Standard BEA Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile EASA European Union Aviation Safety Agency ELT Emergency Locator Transmitter ETSO European Technical Standards Order FAA Federal Aviation Administration FAR Federal Aviation Regulations FCL Flight Crew Licensing F.S. Fuselage Station fpm Feet per minute g Acceleration due to gravity GA General Aviation gal Gallon GPS Global Positioning System hPa Hecto-Pascal hrs Hours IA Inspector Authorization IFR Instrument Flight Rules IMC Instrument Meteorological Conditions IR Instrument Rating IR(R) Instrument Rating (Restricted) JIAAC Junta de Investigación de Accidentes de Aviación Civil KIAS Knots Indicated Airspeed LOC Loss of Control m Metres MMEL Master Minimum Equipment List nm Nautical miles NTSB National Transportation Safety Board PIC Pilot-in-Command PPL Private Pilot’s Licence ppm parts per million psi pounds per square inch ROV Remotely Operated Vehicle rpm Revolutions per minute SAIB Special Airworthiness Information Bulletin SALMO Ministry of Defence Salvage and Marine Operations Project Team SB Service Bulletin sec Second SEP Single Engine Piston SIB Safety Information Bulletin TC Transport Canada TIT Turbine Inlet Temperature TSO Technical Standards Order UTC Coordinated Universal Time VA Design manoeuvring speed VNE Never-exceed speed VNO Maximum speed in normal operation VS Stall speed VFR Visual Flight Rules VMC Visual Meteorological Conditions W.S. Wing Station

Intentionally left blank

ix Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Correction AIRCRAFT ACCIDENT REPORT CORRECTION AAIB Aircraft Accident Report 1/2020 refers On 13 March 2020, the AAIB published Air Accident Report 1/2020 into the loss of Piper Malibu, N264DB, on 21 January 2019. The aircraft took off from Nantes Airport, France, at 1915 hrs and was lost from radar 22 nm north-north-west of Guernsey at approximately 2016 hrs. The aircraft was found on the seabed on 3 February 2019, and the body of the passenger was recovered from the wreckage and passed into the care of Her Majesty’s Senior Coroner for Dorset. The body of the pilot was not found. During the Senior Coroner’s pre-inquest review process ahead of the full inquest hearing touching upon the death of the passenger, information was provided to the Senior Coroner related to the maintenance carried out on the aircraft during the annual inspection completed on 30 November 2018. This information was contrary to Finding 28 of AAR 1/2020, which stated: ‘A pressure test of the heater muff was not carried out during the previous two Annual maintenance inspections.’ The AAIB carried out further enquiries and established that there is doubt about the maintenance actions carried out during the last annual inspection. Consequently, the following sections of the report have been amended: Page 23: Section 1.6.14.3 (first paragraph) Original text: The maintenance organisation informed the investigation that the heater muff shroud was removed, and a visual inspection was carried out using mirrors and a light source in accordance with the guidance in the engine manufacturer’s Service Bulletin, SB10-1A. The SB also contains guidance on how to pressure-test the exhaust system, but this was not done because the mechanic and inspector were satisfied that they could establish the condition of the exhaust and heater muff by the visual inspection alone. Corrected text: The maintenance organisation informed the investigation that the heater muff shroud was removed, and an inspection would have been carried out in accordance with the guidance in the engine manufacturer’s Service Bulletin, SB10-1A, which included a pressure test of the exhaust. However, there was no record of the

x Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Correction SB having been called up or actioned, and it was not possible to determine if a pressure test of the muffler had been carried out. Page 24: Section 1.6.14.3 (Engine Group, point 38, and footnote 29) Original text: 81-2-00 Corrected text: 81-20-00 Page 85: Section 2.8 (second paragraph) Original text: During the Annual maintenance of N264DB, two separate maintenance organisations carried out a detailed visual inspection of the exhaust system which they believed was sufficient to establish its condition. A pressure test would only have been carried out if they were unable to visually examine all parts of the heater muff or there was evidence of damage or deterioration. Moreover, because the aircraft manufacturer’s maintenance schedule (which they used) did not call for the exhaust system to be pressure tested, they believed they were only required to carry out a visual inspection. There was no AD for the exhaust system on the PA-46-310P to be pressure tested when operating in accordance with 14 CFR Part 91. Corrected text: During the last two Annual maintenance inspections of N264DB, two separate maintenance organisations carried out an inspection of the exhaust system. Both stated that their normal practice was to pressure test the exhaust, but neither had records to show that such a test had been carried out. The aircraft manufacturer’s maintenance schedule (which they used) did not call for the exhaust system to be pressure tested, and there was no AD for the exhaust system on the PA-46-310P to be pressure tested when operating in accordance with 14 CFR Part 91.

xi Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Correction Page 89: Finding 27 (first sentence) Original text: The exhaust system, including the heater muff was visually inspected during the Annual maintenance 11 flying hours before the accident. Corrected text: The exhaust system, including the heater muff, was inspected during the Annual maintenance 11 flying hours before the accident. Page 89: Finding 28 (first sentence) Original text: A pressure test of the heater muff was not carried out during the previous two Annual maintenance inspections. Corrected text: There was no record that a pressure test of the heater muff was carried out during either of the two previous Annual maintenance inspections. The online version of this report was corrected on 4 February 2022.

Intentionally left blank

1 Introduction and Summary Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Introduction and Summary Air Accidents Investigation Branch Aircraft Accident Report No: 1/2020 (EW/C2019/01/03) Registered Owner: Southern Aircraft Consultancy Inc. Operator: Private owner1 Aircraft Type: Piper PA-46-310P Malibu Nationality: United States of America Registration: N264DB Place of Accident: 22 nm north-north-west of Guernsey Date and Time: 21 January 2019 at 2016 hrs (all times in this report are UTC unless stated otherwise) Summary The Air Accidents Investigation Branch (AAIB) became aware on 21 January 2019 at 2122 hrs that the aircraft had gone missing at approximately 2016 hrs. The search for survivors, coordinated by the authorities in Guernsey, was called off at 1515 hrs on 24 January 2019. The aircraft was lost in international waters and, in such circumstances, Annex 13 to the Convention on International Civil Aviation places a responsibility on the State of Registration of the aircraft, in this case the USA as represented by the National Transportation Safety Board (NTSB), to commence an investigation. However, the State of Registration may, by mutual agreement, delegate the investigation to another State. On 22 January 2019, in anticipation that an accident investigation would be required, the NTSB delegated responsibility for the investigation to the State of the Operator, in this case the UK as represented by the AAIB. In exercise of his powers, the Chief Inspector of Air Accidents ordered an investigation to be carried out in accordance with the provisions of Regulation (EU) 996/2010 and the UK Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 2018. The sole objective of the investigation of an accident or incident under these Regulations is the prevention of accidents and incidents. It shall not be the purpose of such an investigation to apportion blame or liability. 1 Ownership through a UK Limited company.

2 Introduction and Summary Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Introduction and Summary In accordance with established international arrangements, both the NTSB, representing the State of Design and Manufacture of the aircraft, and the Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (BEA) in France, which had been supporting search activities, appointed Accredited Representatives to the investigation. The Junta de Investigación de Accidentes de Aviación Civil (JIAAC) in Argentina, representing the State of Nationality of the passenger, appointed an Expert. The European Union Aviation Safety Agency (EASA) and UK Civil Aviation Authority (CAA) assisted the investigation, and the NTSB was assisted by Advisors from the aircraft and engine manufacturers. Prior to this Final Report, the AAIB published Special Bulletins on 25 February 20192 and 14 August 20193. The investigation established that the aircraft departed from Nantes Airport, France, at 1906 hrs on 21 January 2019 carrying a passenger on a commercial basis to Cardiff Airport in the UK. At 2016 hrs, probably while manoeuvring to avoid poor weather, the aircraft was lost from radar and struck the sea 22 nm north-north-west of Guernsey. Neither the pilot nor aircraft had the required licences or permissions to operate commercially. The investigation identified the following causal factors:

The pilot lost control of the aircraft during a manually-flown turn, which was probably initiated to remain in or regain Visual Meteorological Conditions (VMC).

The aircraft subsequently suffered an in-flight break-up while manoeuvring at an airspeed significantly in excess of its design manoeuvring speed.

The pilot was probably affected by carbon monoxide (CO) poisoning. The investigation identified the following contributory factors:

A loss of control was made more likely because the flight was not conducted in accordance with safety standards applicable to commercial operations. This manifested itself in the flight being operated under Visual Flight Rules (VFR) at night in poor weather conditions despite the pilot having no training in night flying and a lack of recent practice in instrument flying.

In-service inspections of exhaust systems do not eliminate the risk of CO poisoning. 2 https://assets.publishing.service.gov.uk/media/5c73c02bed915d4a3d3b2407/S1-2019_N264DB_Final.pdf

[accessed February 2020] 3 https://assets.publishing.service.gov.uk/media/5d53ea15e5274a42d19b6c2e/AAIB_S2-2019_N264DB.pdf

[accessed February 2020]

3 Introduction and Summary Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Introduction and Summary

There was no CO detector with an active warning in the aircraft which might have alerted the pilot to the presence of CO in time for him to take mitigating action. Safety action was taken to: raise awareness of the risk associated with unlicensed charter flights; and improve the guidance given to personnel undertaking inspections of exhaust systems. Five Safety Recommendations have been made in this report concerning: flight crew licensing records; the carriage of CO detectors; and additional in-service inspections of exhaust systems. Aircraft Accident Report Correction On 4 February 2022, a correction was issued to the online version of this report. All the amendments cited in that correction have been actioned in this version of the report and a full explanation can be found on pages ix - xi.

Intentionally left blank

5 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information

Factual information 1.1 History of the flight The pilot of N264DB flew the aircraft and the passenger from Cardiff Airport to Nantes Airport on 19 January 2019 with a return flight scheduled for 21 January 2019. The pilot arrived at the airport in Nantes at 1246 hrs on 21 January to refuel and prepare the aircraft for the flight. At 1836 hrs the passenger arrived at airport security, and the aircraft taxied out for departure at 1906 hrs with the passenger sitting in one of the rear, forward-facing passenger seats. Figure 1 shows the aircraft on the ground before departure. Figure 1 N264DB on the ground at Nantes prior to the flight The pilot’s planned route would take the aircraft on an almost direct track from Nantes to Cardiff, flying overhead Guernsey en route (Figure 2). The Visual Flight Rules (VFR) flight plan indicated a planned cruise altitude of 6,000 ft amsl and distance of 265 nm.

6 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information Figure 2 Planned route from Nantes to Cardiff The aircraft took off from Runway 03 at Nantes Airport at 1915 hrs, and the pilot asked Air Traffic Control (ATC) for clearance to climb to 5,500 ft. The climb was approved by Nantes Approach Control and the flight plan was activated. The aircraft flew on its planned route towards Cardiff until it was approximately 13 nm south of Guernsey when the pilot requested and was given a descent clearance to remain in Visual Meteorological Conditions (VMC)1. Figure 3 shows the aircraft’s subsequent track. The last radio contact with the aircraft was with Jersey ATC at 2012 hrs, when the pilot asked for a further descent. The aircraft’s last recorded secondary radar point was at 2016:34 hrs, although two further primary returns were recorded after this2. The pilot made no distress call that was recorded by ATC. 1 Pilots must remain in VMC to continue flight under VFR, the rules under which this flight was undertaken. The aircraft was in Class D airspace and so the pilot was required to remain 1,500 m horizontally and 1,000 ft vertically clear of cloud, and have an in-flight visibility greater than 5,000 m. 2 See section 1.11, Recorded information, for an explanation of the radar data.

7 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information

Figure 3 Aircraft track in the vicinity of Guernsey 1.2 Injuries to persons Injuries Crew Passengers Other Fatal

1 Missing 1 Serious

Minor/None

The pilot’s body was not recovered. The accident was not considered to be survivable. 1.3 Damage to the aircraft The aircraft was destroyed. 1.4 Other damage There was no other damage.

8 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.5 Personnel information 1.5.1 Pilot Age: 59 years Licence: FAA Private Pilot’s Licence

EASA Private Pilot’s Licence Flying Experience: Total on all types: Approximately 3,500 hours Total on type: Approximately 30 hours Last 24 hours 0 hours Last 7 days: Approximately 3 hours Last 90 days: Approximately 20 hours The pilot did not fly between arriving at Nantes on 19 January 2019 and departing on the accident flight and was therefore considered to be well-rested. 1.5.2 Pilot’s licence The pilot of N264DB held an EASA Private Pilot’s Licence (PPL), issued by the CAA, and a Federal Aviation Administration (FAA) PPL, issued based on his EASA PPL3. He held a valid Instrument Rating (Restricted) (IR(R))4 on his UK EASA licence but no Night Rating. An EASA Single Engine Piston (SEP) Rating is valid for 24 months and can be renewed either by completing a proficiency check with an examiner or by experience5. The accident pilot’s SEP rating was due to expire in November 2018 and the investigation found no record of it being renewed. The pilot had undertaken EASA ‘differences training’ to enable him to fly PA‑46 aircraft using an SEP Rating. Images of his logbook stored on a computer showed that, following the training, he had been authorised in error to fly the PA-46 as pilot-in-command (PIC) during both the day and night. It was not established whether the pilot had undertaken the FAA’s equivalent ‘complex aircraft training’ for the PA-46. The FAA requires that pilots complete a ‘Flight Review’ with an authorised instructor or examiner every 24 months in order to maintain the validity of 3 See section 1.17.3, Flight crew licensing requirements. 4 The IR(R) is a UK-only instrument qualification, that permits the holder to operate a single-pilot, single or multi engine, non-complex, non-high performance aeroplane under IFR except in Class A Airspace. 5 Renewing by experience requires the pilot to have completed in the 12 months before the rating expiry date: at least 12 hours of flying in aircraft of the relevant class of which at least 6 hours must be as pilot-in-command; 12 takeoffs and landings; and a training flight of at least an hour with an instructor or examiner. EASA Part FCL.740.

9 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information their licence6. The accident pilot had completed a flight review in the previous 24 months. A PPL, whether issued by EASA or the FAA, does not allow a pilot to carry passengers for reward; to do so requires a commercial licence. The pilot did not have a commercial licence and was not operating under the provisions of an Air Operator’s Certificate (AOC)7. 1.5.3 Colour vision deficiency At his initial medical in 2001, it was identified that the pilot had colour vision deficiency (CVD) and a restriction was placed on his CAA-issued medical certificate. In 2012, the pilot underwent more detailed tests which showed he had mild-to-moderate protan deficiency, which meant that the receptors in his retinas were less sensitive to light in the red wavelengths. The pilot’s colour vision was sufficient to pass these more detailed tests as ‘colour safe’ for the purposes of flying and the restriction was removed. CVD has no effect on night vision. At the time of the accident, there was no restriction on his licence or medical certificate which would have prevented him from completing the required training for a night rating and holding such a qualification. However, the investigation found no evidence of the pilot completing any night flying training. 1.5.4 Pilot’s recent flying experience Evidence from previous logbooks and from witnesses showed that the pilot gained a large percentage of his flying experience dropping parachutists from single and twin-engine aircraft. He had little experience of flying in Instrument Meteorological Conditions (IMC) or operating under Instrument Flight Rules (IFR)8. The pilot last renewed his IR(R) in May 2017, which meant the rating was valid at the time of the accident. All his recorded flying since the renewal had been recorded as single pilot operating under VFR, so it was unlikely he had practised much instrument flying since then. The pilot began flying N264DB in June 2018. He flew it and another similar type regularly around the UK and Europe. The pilot’s records showed that he had been paid a fee for flights on numerous occasions. Other evidence showed that he was to be paid a fee for the accident flight. Although the pilot did not hold a Night Rating, his records indicated that he had flown several flights at night over the preceding 12 months. 6 Title 14 of the Code of Federal Regulations Part 61.56. 7 Air Operators Certificate – a certificate authorising an operator to carry out specific commercial operations. 8 See Footnote 2. If a flight cannot remain within VMC, the aircraft will, by definition, be flying in IMC and the pilot must operate under IFR.

10 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.6 Aircraft information 1.6.1 Leading particulars Manufacturer: Piper Aircraft, Inc Type: PA-46-310P Malibu Engines: One Teledyne Continental TSIO-520-BE Date of manufacture: 1984 Airworthiness Certificate: 27 April 1984 Last maintenance check: Annual / 100-hour 30 November 2018 Total airframe hours: 6,636 hours on 30 November 2018 Maximum takeoff weight: 4,100 lbs Takeoff weight (actual): Not known 1.6.2 General description of the aircraft The PA-46 is produced in several versions two of which are: the PA-46-310P (Malibu) equipped with a Teledyne Continental TSIO-520-BE engine rated at 310 hp; and the PA-46-350P (Malibu Mirage) equipped with a Textron Lycoming TI0-540-AE2A engine rated at 350 hp. The aircraft was designed and initially certified under the provisions of Title 14 of the Code of Federal Regulations (14 CFR) Part 239. The Type Certificate for the PA-46-310P was approved on 27 September 1983. The PA-46-310P (Malibu) is a single engine, all-metal airframe, low wing, pressurised aircraft certified for flight up to 25,000 ft. It is fitted with retractable landing gear and a turbocharged piston engine driving a two-blade constant speed propeller.  The primary flight controls are conventional in operation and the control surfaces are operated by the pilot’s control wheel and rudder pedals through a system of cables and pullies.  The aircraft has a fuel capacity of 122 gal (US), stored in an integral fuel tank located in each wing, of which 120 gal (US) is useable.  A forward baggage compartment is located between the engine firewall and forward pressure bulkhead. Hydraulic pressure is supplied by an electric motor-driven pump assembly installed in the aft portion of the aircraft cabin, inside the pressure bulkhead. The undercarriage is held in the retracted position by hydraulic pressure and, if the pressure drops below a minimum level, a pressure switch automatically energises the pump to restore the pressure. 9 14 CFR Part 23 – Airworthiness Standards: Normal Category Airplanes.

11 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information N264DB was equipped with two alternators, four-position hydraulically operated flaps, an electrically heated stall warning device and an electrically heated pitot probe. It was also equipped with an ice protection system that allowed it to fly into known icing conditions, and avionics equipment that allowed it to be flown at night in IMC. 1.6.3 Engine information 1.6.3.1 General description of the engine The TSIO-520-BE is a fuel-injected, twin-turbocharged, air-cooled, horizontally‑opposed, six-cylinder engine. The engine oil is cooled by ram air10 passing through the oil cooler fitted on the rear of the engine. Oil is distributed throughout the engine to provide lubrication and cooling, and to operate the propeller governor. Engine crankcase gasses are discharged through an air / oil separator located behind the oil cooler and vented out of the left exhaust stack. The purpose of the turbochargers is to maintain a desired manifold air pressure at a given throttle setting regardless of varying conditions of ambient air temperature and pressure. Air from the turbocharger compressor is cooled in the intercooler before entering the manifold air distribution system mounted on top of the engine where it is distributed to the cylinder intake ports (Figure 4). The turbocharger consists of a compressor driven by a turbine, both of which are mounted on a single shaft supported by bearings lubricated by the engine oil system. Labyrinth seals prevent the engine oil leaking along the shaft into the compressor or turbine. The exhaust system, which on N264DB was made from stainless steel, consists of a right and left exhaust tailpipe, each connected to its respective turbocharger. Exhaust gasses from the left and right side of the engine are connected to a common duct which bypasses the turbochargers and directs gas through a wastegate into the left tailpipe (Figure 4). The purpose of the wastegate is to control the speed of the turbines by directing excess exhaust gas away from them. 10 Ram air: air ‘rammed’ into the engine through a forward-facing inlet. ‘Ram’ refers to the increase in air pressure as a result of the aircraft speed through the atmosphere.

12 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information Figure 4 Engine induction and exhaust system A heater muff is attached via spot welds to the right exhaust tailpipe. Ram air ducting and a removable shroud are placed over the heater muff to provide hot air for cabin conditioning (Figure 5). The shroud is secured in place by four fasteners. Figure 6 shows another tailpipe from a PA-46-310P aircraft with the shroud unfastened and slid to the end of the tailpipe to allow it to be inspected. The ‘heated ram air out’ and ‘exhaust gas in’ ducts are spot welded and brazed onto the tailpipe and covered with a fixed cover. In Figures 5 and 6 the red arrows show the flow of exhaust gas through the tailpipe. The yellow arrows show ambient ram air, which flows in the space between the tailpipe and the heater muff.

13 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information Tailpipe Ambient ram air IN Exhaust gas Exhaust gas OUT Heated ram air OUT Detail A see Figure 6 Figure 5 Right tailpipe and heater assembly removed from a PA-46-310P aircraft Exhaust gas IN (red) Exhaust gas OUT (red) Tailpipe Detail A Fixed cover Flow of conditioned air (yellow) Shroud Heater muff Figure 6 Ram air shroud removed from exhaust tailpipe / heater muff from a PA-46-310P tailpipe

14 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information The engine instruments are located to the right of the pilot’s instrument panel and consist of: a manifold air pressure and fuel gauge; rpm gauge; Turbine Inlet Temperature (TIT) gauge; and a single gauge that shows the oil pressure, oil temperature and cylinder head temperature. The minimum permitted oil pressure is 10 psi at idle and 30 psi at normal cruise power. The oil pressure annunciator forms part of the annunciator panel located above the engine gauges and illuminates when engine oil pressure drops below 20 ± 4 psi. 1.6.3.2 Engine history The engine fitted to N264DB was built on 9 December 1998 and initially fitted to another PA-46-310P aircraft, registration VH-BGK. After a modification11 in March 2003, the engine was fitted to N264DB on 28 May 2004 at 585.8  engine hours. Both turbochargers were replaced with overhauled12 items during the Annual maintenance completed in December 2017. At the Annual maintenance carried out in November 2018, the engine had used 1,195.12 hours of its 1,400‑hour overhaul life. 1.6.4 Previous failures of turbocharger turbines While the investigation into the loss of N264DB was taking place, the NTSB was investigating two events on a different aircraft type with a similar exhaust system where the turbine on a turbocharger separated from the compressor and exited through the exhaust. The turbines left score marks on the inside of the exhaust but did not puncture the exhaust tailpipe. There was no oil residue in the exhaust tailpipe. These turbochargers, which had been overhauled at a different facility, were similar to the turbochargers fitted to N264DB. As part of the NTSB investigation, a Teledyne Continental TSIO-550 engine was run with two turbochargers, one of which was missing its turbine. The tests showed that without the turbine fitted to the turbocharger the engine would continue to run at cruise power setting, but would lose all its usable oil (five quarts) in two minutes. Similar results would be expected from a failure of the turbocharger on the engine fitted to N264DB. 1.6.5 Minimum equipment list (MEL) The aircraft manufacturer has not issued an MEL13 for the PA-46-310P, nor was an MEL required for N264DB as it was only permitted to operate for non-commercial purposes in accordance with 14 CFR Part 9114. It is the 11 The engine logbook records that the engine was converted to ‘Jet Prop Delux’. 12 Both overhauled turbochargers were supplied with an FAA Form 8130-3 Authorized Release Certificate. 13 A minimum equipment list (MEL) is required by the FAA when operating under 14 CFR Part 125 (Non-airline large aircraft operations) and 14 CFR Part 135 (commuter and on-demand operations) or when operating turbine powered aircraft. 14 14 CFR Part 91 – General Operating and Flight Rules.

15 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information responsibility of the aircraft commander to consider any faults or deficiencies before commencing a flight to ensure that it can be completed safely. 1.6.6 Limitations Section 2 of the Pilot’s Operating Handbook specifies operating limitations for the aircraft. Relevant limitations are set out below. Airspeed limitations: KIAS KCAS VNE 15 203 200 VNO 16 173 170 VA 17 (4,100 lb) 135 133 VA (2,450 lb) 103 102 VS 18 (1g clean) 69 Manoeuvre limitations: No aerobatic manoeuvres, including spins, are approved. Flight load factors: The approved maximum positive load factor is 3.8 g with the flaps up. There is no approved maximum negative load factor. Inverted manoeuvres are not approved. 1.6.7 Safety equipment N264DB was equipped with six seats: two forward-facing pilot seats at the front of the aircraft; two rearward-facing passenger seats in the middle; and two passenger seats at the rear of the cabin facing forwards. All passenger seats had adjustable backs (recline) with built-in headrests. The rearward-facing passenger seats were equipped with lap straps and all the forward-facing seats with three-point harnesses (car style). Entry to the aircraft was through a rear door on the left side of the cabin. An emergency exit was located on the right side of the cabin adjacent to the rearward facing passenger seat. 15 Never exceed speed. Do not exceed this speed in any operation. 16 Maximum structural cruising speed. Do not exceed this speed except in smooth air and then only with caution. 17 Design manoeuvring speed: the speed above which full or abrupt control movements are not permitted. 18 Stall speed with flaps up and landing gear retracted.

16 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information An Emergency Locator Transmitter (ELT) was installed in the rear fuselage and was accessible through a panel on the bottom right side of the fuselage. The ELT had a three-position switch: on, off, arm. When selected to arm the ELT would automatically start to transmit when it detected an impact. The ELT was not designed to work under water. The aircraft was equipped with a life jacket for each occupant and a six-man life raft, kept in the rear baggage compartment and accessible from the cabin. The passenger was not wearing a lifejacket when his body was recovered. 1.6.8 Ice protection system The ice protection system was designed and tested for operation in the meteorological conditions specified in 14 CFR Part 25, Appendix C, for continuous-maximum and intermittent-maximum icing conditions. N264DB was not permitted to fly in severe icing conditions. The ice protection system consisted of pneumatic wing and empennage19 boots20, a wing ice detection light, electrothermal propeller de-icing pads, an electrothermal windshield panel, a heated lift detector (stall warner) and a heated pitot head. It was demonstrated during certification that ice did not accumulate on the static pressure pads. However, if the static ports did become blocked by ice, an alternative static source located below the instrument panel could be selected. The ice protection system on N264DB was found to be serviceable at the Annual maintenance completed on 30 November 2018, approximately 11 flight hours prior to the accident flight. 1.6.9 Autopilot N264DB was equipped with a Bendix/King KFC150 3-axis autopilot system, incorporating a KC192 Flight Computer and a KAS297B altitude/vertical speed (VS) selector mounted on the forward instrument panel. The autopilot was engaged by pressing the ap eng button on the flight computer, which engaged an attitude hold mode unless another mode button was also pressed. Selecting alt engaged the altitude hold mode and the autopilot would maintain the selected altitude. Selecting hdg engaged the heading mode and the autopilot would turn the aircraft to the pilot’s selected heading. 19 The empennage consists of the fin, rudder, stabiliser and elevators. 20 Flat array of flexible tubes bonded to the leading edge of wings, fins and other surfaces that are inflated to break up ice.

17 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information In hdg mode, this autopilot will turn an aircraft to a newly selected heading with a maximum bank angle of 22° +/- 2° which, at an airspeed of 150 kt, will result in a rate one turn ie 3.0º/sec. The maximum bank angle will be commanded whenever the heading bug is moved more than about 15° away from the current heading. If a smaller heading change is selected, a reduced bank angle is used resulting in a reduced turn rate. The KAS297B Altitude / VS Selector is used to select a climb or descent rate and can be set to capture a selected altitude. The maximum climb or descent rate that can be selected is 3,000 fpm, with the flight director commanding a pitch attitude of between +15° and -10°. A Control Wheel Steering (CWS) function is selected by depressing a switch on the pilot’s control wheel. When the CWS switch is depressed and held, it disengages the autopilot’s pitch, pitch trim, and roll servos and allows the pilot to control the airplane; it does not disengage the autopilot or the flight director. When the CWS switch is released, the autopilot and flight director are automatically synchronised to the aircraft’s existing pitch attitude and altitude, if the alt mode was previously selected. If the vertical speed mode was previously selected, the autopilot would control the vertical speed to the previously set value. The autopilot automatically disengages if roll rates exceed 14°/sec or if the pitch rate exceeds 8°/sec. 1.6.10 Nosewheel steering The nose gear is steerable through a 60° arc by use of the rudder pedals. Control rods connected to the rudder pedals pass through the pressurised bulkhead to the steering arms, which operate the nosewheel through a bungee assembly (Figure 7). The orifice in the pressurised bulkhead through which the control rods pass is sealed by a bellow assembly.

18 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information Bellow assembly Bungee assembly Steering arm Pressurised bulkhead Figure 7 Nosewheel steering linkages on a PA-46-310P 1.6.11 Wheel brakes Each main wheel is fitted with a single-disc brake assembly operated by toe brake pedals mounted on each pilot’s rudder pedals. The brake hydraulic system, which has its own reservoir, is independent of the aircraft hydraulic system powering the undercarriage and flaps. 1.6.12 Audio warnings Other than the momentary autopilot disengage warning, there are three audio warnings on the aircraft: stall warning, landing gear warning and a warning for operation of the ELT. The stall warner is the only warning to be provided by electrical power from the Main Busbar through the stall warn circuit breaker. 1.6.13 Cabin environmental system 1.6.13.1 General description The PA-46-310P is equipped with an environmental system consisting of an engine bleed air and conditioning system, cabin air distribution system, pressurisation and control system, and a ventilating system.

19 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.6.13.2 Pressurised operation The main components of the pressurisation control system are an outflow valve, a safety valve mounted on the aft pressure bulkhead, a cabin altitude controller and rate selector, and a triple gauge indicating cabin altitude, cabin rate of climb or descent, and differential pressure. The cabin pressurisation (cabin press) control and cabin dump switches are mounted on the lower left side of the instrument panel with the cabin temperature (cabin temp) control.

Pressurised air is taken from the compressor side of both engine turbochargers and routed to the pressurised side of the heat exchanger, where the temperature is controlled by the pilot operating the cabin temp control (Figure 8). When the cabin press control is pulled out, the firewall shutoff valve closes on the pressurised side of the heat exchanger, preventing pressurised bleed air entering the air distribution system. At the same time, the dump valve opens allowing the pressurised bleed air to escape into the engine compartment. When the cabin press control is pushed in, these valves change position allowing conditioned, pressurised bleed air to enter the cabin through the air distribution system. The cabin press control also moves the ram air selector valve to allow conditioned ram air to flow across the heat exchanger matrix and out of a vent on the right side of the aircraft. The pressure in the cabin is controlled by the pilot, who modulates the amount of air escaping through the outflow valve by selecting the desired cabin altitude on the cabin altitude controller. The cabin altitude will remain at the selected altitude until the maximum cabin differential pressure of 5.5 psi is reached, at which time the cabin altitude will begin to climb until, at 25,000 ft, the cabin pressure will be approximately 8,000 ft. The cabin altitude rate‑of‑change (climb / descent) is controlled using the rate selector on the cabin altitude controller. The safety valve is independent of the pressurisation system and operates if the differential pressure exceeds 5.6 psi. The safety valve can also be selected fully open using the cabin dump switch to rapidly depressurise the cabin or to allow unpressurised operation.

20 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information Pressurised conditioned air Bleed air Fresh air Hot fresh air Temperature controlled air Figure 8 Cabin conditioning - pressurisation 1.6.13.3 Unpressurised operation When the aircraft is unpressurised, fresh ram air enters the ventilation system through a NACA duct21 located on the right side of the engine cowling (Figure 9). 21 NACA is the National Advisory Committee for Aeronautics, and a NACA duct is a low drag air inlet.

21 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information Some of this cold air is directed through a heater muff fitted around the engine’s right exhaust tailpipe, which raises the temperature of the fresh air. This heated air is then re-mixed with the colder fresh air and directed through the cabin ventilation system. Air exits the cabin through the safety valve located on the aft pressure bulkhead. Bleed air Fresh air Hot fresh air Temperature controlled air Figure 9 Cabin conditioning – unpressurised

22 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information For unpressurised flight, the cabin press control should be pulled to off and the cabin dump switch selected on, to open the safety valve, thereby providing maximum airflow through the cabin. The unpressurised ventilation system is designed such that the pressure of the fresh ram air in the heater muff / shroud is higher than the ambient pressure of the exhaust gas. This design feature is intended to prevent fumes from entering the air distribution system via the heater muff should a crack occur in the exhaust tailpipe. 1.6.13.4 Cabin air distribution The cabin air distribution system consists of left and right-side panel ducting, windshield defrosting, pilot foot warmers and ventilation blowers. The side panel ducts provide for overall air distribution throughout the length of the cabin near floor level. Two recirculation blowers, situated behind the rear passenger seats, supply airflow to the portion of the sidewall ducts containing the individual adjustable seat outlets (eyeballs). The pilot can select the recirculation blower to off, low or high. 1.6.14 Maintenance and fault history A description of the recent scheduled maintenance and fault history of N264DB is at Appendix A. 1.6.14.1 Registration and recent maintenance N264DB was manufactured in 1984, and on 30 November 2018 the aircraft had flown 6,636 hrs and the engine had operated for 1,195 hrs since overhaul.  The Certificate of Registration was issued on 11 September 2015 with an expiry date of 30 September 2021.  The Airworthiness Certificate was dated 27 April 1984.  Airworthiness Certificates22 remain valid if aircraft maintenance is performed in accordance with 14 CFR Parts 21, 43 or 91, as applicable.  The last significant maintenance of N264DB was an Annual / 100-hour maintenance completed on 30 November 2018; the Certificate of Release to Service was signed by the holder of an FAA Inspector Authorization (IA)23. 1.6.14.2 Annual inspection and 100-hour maintenance The last Annual inspection and 100-hour maintenance was completed on 30  November 2018 at 6,636.2 airframe hours, which was approximately 11 flying hours before the accident flight. The undercarriage circuit breaker 22 CFR Part 91.203 (b) states ‘No person may operate a civil aircraft unless the airworthiness certificate …is displayed at the cabin or cockpit entrance so that it is legible to passengers or crew’. 23 See sections 1.17.1.2 to 1.17.1.4 Inspection and maintenance.

23 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information was replaced during this maintenance activity. The Certificate of Release to Service included a statement that: ‘the Altimeter and Transponder were due 24/07/17’. FAA regulations only permit aircraft to fly in controlled airspace under IFR providing each altimeter and automatic pressure altitude reporting system has been tested and inspected within the previous 24 months. The FAA IA reported that the instruments had not been placarded to highlight this limitation because it was an operational and not an airworthiness requirement. For the same reason, this limitation was not annotated in the aircraft logbook or Release to Service. The FAA IA advised that a copy of the Release to Service was attached to the aircraft journey log. The previous Annual inspection and 100-hour maintenance were completed by a different maintenance organisation on 15 December 2017, at 6,583.4 airframe hours. During this maintenance activity, both turbochargers were replaced, two cylinders were overhauled, and parts of the exhaust system were replaced. The right tailpipe / heater muff would have been removed during this activity. A considerable amount of other maintenance work was carried out, and the following statement was recorded on the Certificate of Release to Service: ‘FAA FAR 91.411, Altimeter calibration insp NOT carried out. No IFR flight permitted. FAR 91.413, Transponder calibration insp NOT carried out, No flight in Class A, B or C airspace permitted.’ 1.6.14.3 Inspection of the engine exhaust system The last Annual inspection was carried out in accordance with the 100-hour inspection schedule specified in the aircraft manufacturer’s maintenance manual24. The exhaust tailpipes were removed from both turbochargers during the inspection in order to examine the turbines. The maintenance organisation informed the investigation that the heater muff shroud was removed, and an inspection would have been carried out in accordance with the guidance in the engine manufacturer’s Service Bulletin, SB10-1A, which included a pressure test of the exhaust. However, there was no record of the SB having been called up or actioned, and it was not possible to determine if a pressure test of the muffler had been carried out. The following inspections were annotated on the maintenance schedule as having been carried out to ensure the integrity of the engine exhaust, firewall and ventilation system. 24 Piper Aircraft PA-46-310P /350P Maintenance Manual. Note: Section 1.6.14.3 The second half of this section was amended on 4 Feb 2022. Full details can be found in the correction on page ix of this document.

24 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information ‘B. Engine Group

Inspect exhaust stacks for cracks, hot spots, and security. Inspect gaskets for leakage and condition (Replace gaskets as required).

Inspect exhaust pipe and heater exchanger.

(refer25 to 81-20-00, Turbocharger and Exhaust System Visual Inspection).

Inspect exhaust heat shield and cross-over tubes for cracks and conditions.

Inspect firewall for cracks, condition, and security.

Check condition of firewall sealing. C. Turbocharger Group

Visually inspect system for oil leaks, exhaust system leaks and general condition. (See 81-20-00, Turbocharger and Exhaust System Visual Inspection)

Inspect induction and exhaust components for worn or damaged areas, loose clamps, cracks and leaks. D. Cabin and Cockpit Group

Check condition of environmental system ducts.’ 1.6.14.4 Recent fault history It is good practice to use a technical log on aircraft which are flown by different pilots to record details of flights, airframe and engine hours, faults, and equipment which is not serviceable. However, this is not mandatory for private aircraft operated under the provisions of 14 CFR Part 91. Therefore, N264DB was not required to have a technical log and one was not used; instead the aircraft had a journey log which recorded the destinations and hours flown.

The person who managed the operation of N264DB informed the AAIB that pilots would verbally inform him of any faults on the aircraft and he would either arrange for them to be rectified or verbally inform the next pilot of any outstanding faults or limitations. He stated that he was not aware of any faults on the aircraft, other than the faults reported by the pilot when the aircraft was at Nantes. As far as he was aware, the anti-ice system and autopilot were serviceable and there was no limitation on the operation of the aircraft when it departed Retford Gamston Airport to collect the passenger from Cardiff for the outbound flight to Nantes. 25 Piper Aircraft PA-46-310P / 350P Maintenance Manual, Chapter 81-20-00. Turbines. Note: Point 38 This was amended on 4 Feb 2022. Full details can be found in the correction on page ix of this document. Note: Footnote 26 This footnote was amended on 4 Feb 2022. Full details can be found in the correction on page ix of this document.

25 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information A description of significant faults discovered on the aircraft during the previous three years and the rectification carried out is at Appendix A. The aircraft documentation showed that on 12 July 2017 there was a fault with the flight director and autopilot, which often disengaged uncommanded. The fault was subsequently investigated by an avionic technician who recommended that the autopilot computer should be replaced with a later model. He also placarded the autopilot and flight director as ‘INOP’ (inoperative). The FAA IA who inspected the aircraft in 2018 recalled that there was a placard for ‘no autopilot’. The investigation found no evidence that the computer had been replaced or the intermittent fault rectified. 1.6.14.5 Faults arising during the flight to Nantes The investigation established that there were several faults on the aircraft which became apparent to the pilot during the flight to Nantes:

● After the flight, the pilot reported to Witness ‘A’ that during the cruise mid-way across the English Channel there had been a ‘bang’, which he also described as a ‘boom’. At the same time as the bang, he sensed a low-level mist throughout the airframe, which he indicated he had occasionally experienced before. The pilot pushed the throttle, mixture and propeller control levers forward and checked the engine parameters which were all within normal operating limits. The pilot described the same event to an FAA IA in the UK as a ‘muffled thud’ that occurred on the approach to Nantes, making no mention of the mist. The following day, the pilot removed the engine cowlings, examined the engine and carried out a ground run. All the engine pressures and temperatures were within limits and the pilot reported to Witness ‘A’ that there was no problem with the engine.

● After landing and while taxiing, the pilot experienced a loss of pressure in the left brake pedal. By pumping the brake pedal he was able to gain sufficient pressure to operate the brakes. He mentioned the problem to ATC while taxiing along the runway and subsequently spoke to the FAA IA who advised him to seek engineering advice in Nantes. The pilot arranged for a mechanic at Nantes to check the brakes, who arrived at the aircraft on 21 January 2019 at approximately 1300 hrs. The mechanic said that they communicated in French and, while it was difficult to understand some of the words or sentences, he understood what the pilot was asking him to check. The mechanic reported that he identified only

26 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information a slight difference of pressure between the brakes, with the right brake pedal slightly firmer than the left. No payment was made, or documentation completed. The pilot made no mention of any other problems with the aircraft, which the mechanic considered to be very clean on the inside and outside. While the mechanic held an EASA Part 66 licence, he did not hold any FAA licences.

● The pilot discussed with Witness ‘A’ an audio warning that sounded during the last 10 minutes of the flight and which the passenger could hear. The pilot stopped the warning when he was taxiing off the runway by pulling the circuit breaker for the stall warner. It was not determined if the circuit breaker was reset prior to the accident flight. Following the engine ground run carried out at Nantes to investigate the bang on the outbound flight, the pilot noticed what he thought might be a small oil leak from the top of the oil accumulator, which he believed had been present for some time. The pilot took photographs, which he sent to the individual who managed the aircraft who then forwarded them to the FAA IA. From one of the photographs, the component was identified by the engine manufacturer as the air / oil separator assembly (Figure 10).

Figure 10 Photograph sent by pilot showing location of oil leak from the air / oil separator (item 101 in the left image) The pilot brought some of these faults to the attention of the person who managed the aircraft, and the FAA IA who told the AAIB that he advised the pilot to have an engineer look at the aircraft. Apart from the mechanic at Nantes who tested the brakes by pressing the pedals, there was no evidence that an engineer examined any of the other faults before the aircraft departed on the accident flight.

27 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.6.15 Weight and balance The AAIB could not determine how much fuel was in N264DB when it departed from Nantes. Using estimates of the weights of the pilot, passenger and luggage, it was calculated that the aircraft would have been under the maximum takeoff weight even if the fuel tanks had been completely full. It was also determined that the aircraft would have been within the centre of gravity limits at the time of the accident regardless of the fuel load at takeoff. 1.7 Meteorological information Before departing from Nantes, the handling agent gave the pilot a weather pack which included reported and forecast weather for departure, destination and en-route airports, as well as weather charts for the route. It is not known if the pilot looked at these, but information from a witness who spoke to the pilot on the morning of the flight confirmed that he was aware of the weather situation. It is likely, based on his usual practice, that he used his tablet or mobile telephone to access weather information. A weather forecast was issued by the Jersey Meteorological Department at 1502 hrs on 21 January 2019, valid for the period between 1600 hrs and 2200 hrs. This forecast showed a cold front moving in from the northwest, which was forecast to bring rain overnight. The forecast included the possibility of isolated showers for the whole period of validity. Observations at Guernsey Airport for 1950 hrs showed that the visibility was in excess of 10 km and the cloud was Few at 1,000 ft above airfield level (aal). At 2020 hrs, Guernsey was reporting light showers of rain and Few clouds at 1,000 ft aal. The rainfall radar picture at 2015 hrs showed a band of showers, some heavy, passing through the area of flight as shown in Figure 11. The crew of an aircraft flying in the area at the same time as N264DB reported that there were some cumulonimbus (CB) cells and that they had encountered some rain after descending below the bottom cloud layer. Data from the UK Met Office indicated that the freezing level around the Channel Islands was forecast to be between 3,000 ft and 4,000 ft amsl. The forecast indicated that any icing encountered would be light to moderate. Pilots in the area at the time reported encountering little or no ice at the altitudes that N264DB was flying. There was a layer of complete cloud cover which had a base of between 11,000 ft and 13,000 ft amsl. Below that were a succession of layers of varying cover and thickness as the cold front approached. Forecasts from Jersey indicated that this cloud would have contained layers with bases between

28 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 4,000 ft and 6,000 ft, and between 1,500 ft and 3,000 ft amsl. Showers were forecast in the area from clouds with a base of between 1,000 ft and 1,500 ft. Other pilots who were flying in the area at the time suggested that there was little distinguishable horizon between the cloud layers. Figure 11 Rainfall radar and position of N264DB at 2015 hrs Although there was a full moon, the sky was obscured by the high-level cloud and it would have been very dark below the main cloud base where N264DB was flying. Once the aircraft had passed to the north of Guernsey, there would have been few lights visible from the surface except for lights from surface vessels in the Channel. At the altitude at which the aircraft was flying, the horizon would have been visible between 80 and 90 nm away in perfect conditions, but there was rain and moisture in the atmosphere which would have obscured the horizon or reduced this distance significantly. The lights of the south coast of England were at least 43 nm away and it is likely that, given the conditions, they were not visible to the pilot. 1.8 Aids to navigation A combined radio communications and GPS navigation unit26 was fitted to the instrument panel of the aircraft. The unit could display aircraft position and the planned route overlaid on a moving map. 26 GNS530 manufactured by GARMIN.

29 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.9 Communications 1.9.1 Flight plan The initial flight plan submitted for the flight from Nantes to Cardiff was for a departure time of 0900 hrs. This was refiled several times over 45 hours with the final flight plan being filed for a departure time of 1830 hrs. The investigation did not establish the reason for the delays to the departure time, or when the changes in time were conveyed to the pilot. Evidence from emails to the handling agents in both Cardiff and Nantes showed that the pilot was aware of the planned night-time return by the afternoon of 20 January 2019.

1. 10

Aerodrome information Nil. 1.11 Recorded information 1.11.1 Sources of recorded information Recorded radar information (primary, and secondary Modes A and C27) was available from separate ground-based sites in Guernsey, Jersey and France. The radar data provided an almost complete record of the accident flight, starting as the aircraft took off and ending shortly before it struck the sea. The radar tracks derived from data from the different sites predominantly aligned28, corroborating the relative accuracy of the independent data sources. Recordings of radio communications between the pilot and ATC were available, including radio transmissions made during the approach and landing at Nantes on 19 January 2019, and all transmissions during the accident flight. CCTV at Nantes Airport also captured the period when the aircraft taxied to Runway 03 for takeoff. The pilot used a flight planning and navigation software application installed on his portable tablet computer to create a route between Nantes and Cardiff and file the VFR flight plan. This information was uploaded to his cloud account. If used during flight, the tablet computer would have displayed aircraft position and planned route overlaid on a moving map, and recorded GPS-derived position information. The tablet computer was not seen in the wreckage. The aircraft was not, and was not required to be, fitted with an accident‑protected flight data recorder, image recorder or cockpit voice recorder. 27 Mode A refers to the four-digit ‘squawk’ code set on the transponder, and Mode C refers to the aircraft’s pressure altitude which is transmitted in 100 ft increments. Secondary radar typically provides greater accuracy than primary radar. 28 The radar positions captured from Guernsey, Jersey and France were typically within less than 100 m of each other.

30 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.11.2 Passenger’s voice mail message A copy of a voice message reported as being sent by the passenger of N264DB on the evening of 21 January 2019 was available and contained references to the flight. Information from the provider of the passenger’s voice mail application29 showed that the last message from the passenger’s account was received by the network at 1910:39 hrs UTC on 21 January 2019. This coincided with the period when N264DB taxied prior to takeoff. The voice mail recording contained background sounds that were consistent with normal operation of N264DB’s engine on the ground. 1.11.3 The flight from takeoff until approximately 2005 hrs The text below describes the flight from takeoff until approximately 2005 hrs and includes the track south of Guernsey shown in Figure 3. Altitude is derived from Mode C data (transmitted in 100 ft increments with a tolerance of ±50 ft), corrected for local atmospheric pressure (QNH)30. After departure from Nantes, N264DB climbed progressively to 5,500 ft amsl and its average ground speed was about 170 kt, equivalent to an estimated airspeed of about 160 KIAS based on a calculated wind from 250° at 25 kt. When the aircraft was about 20 nm south of Jersey, the pilot was transferred to the Jersey ATC frequency. On initial contact with Jersey ATC, the aircraft was cleared to enter controlled airspace and maintain FL5531, following which the pilot was asked to advise ATC if at any time he would not be able to “maintain vmc”; this was to enable ATC coordination with other aircraft in the area should it be necessary for N264DB to descend or climb. At 1958 hrs, the controller asked the pilot to check if the aircraft’s altimeter pressure setting was correctly set to 1013 hPa, because the information on the radar indicated FL53. The pilot acknowledged and, shortly afterwards, the aircraft climbed to FL55; the aircraft was about 11 nm south‑west of Jersey. At 2002:10 hrs, N264DB was about 11 nm west of Jersey and 13 nm south of Guernsey when the pilot requested clearance to descend to “maintain vmc” (Figure 3). The aircraft was cleared to FL50, with the instruction to advise ATC if a further descent was required. Shortly afterwards, the aircraft began 29 WhatsApp: https://www.whatsapp.com/ 30 Transmitted Mode C values are based on a standard pressure setting (see next footnote). This report has adjusted those values to reflect the local atmospheric pressure (QNH) so that they indicate altitude ie the vertical distance above mean sea level. 31 Flight Levels (FL) are referenced to the International Standard Atmosphere (ISA) pressure setting of 1013.25 hPa. FL55 is equivalent to 5,500 ft based on the standard pressure setting.

31 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information to descend whilst also making a right turn followed by a left turn (the calculated maximum bank angle during the right turn was about 22°, and during the left turn it exceeded 22°). This positioned the aircraft overhead Guernsey, displaced about 1.5 nm from, and parallel to the planned course. The controller then inquired if N264DB required a further descent, to which the pilot responded: “negative, just avoided a patch there but back on heading five thousand feet”. 1.11.4 The flight after 2012 hrs The following text describes the flight after 2012 hrs as shown in Figures 3 and 12. The altitudes were reported by the aircraft transponder with an accuracy of ± 50 ft. At 2012 hrs, N264DB was about 11 nm north of Guernsey when the pilot requested a further descent to maintain VMC. The aircraft was cleared to descend at the pilot’s discretion, and the pilot was given the Jersey QNH, which was 1017 hPa. The pilot acknowledged at 2012:32 hrs, and this was the last radio communication received from him. N264DB started to descend gradually and turned onto a track of about 060°T. Approximately 30 seconds later the aircraft turned left to track about 305°T. During these turns the aircraft descended from 4,800 ft to 4,300 ft, climbed to 5,000 ft, and then descended again to 3,900 ft. The aircraft then proceeded to climb to 4,200 ft on a track that was nearly parallel with the planned course of 343°T. Its estimated airspeed was about 168 KIAS. At 2015:30 hrs, N264DB started to make a gradual left turn, which was followed, at 2016:10 hrs, by a right turn of approximately 180°. During this turn, data from two independent radars (Guernsey and Jersey32) showed the aircraft descend from an altitude of 4,100 ft to an altitude of 1,600 ft in 28 seconds. As the aircraft descended, the aircraft’s descent rate and airspeed increased, reaching calculated maximums of about 13,000 fpm and more than 220 KIAS respectively (VNE 33 is 203 KIAS). Four seconds later, at 2016:34 hrs, the final secondary radar point was recorded indicating an altitude of 2,300 ft. Following the final secondary radar point, two primary radar points were recorded by the Guernsey radar at 2016:38 hrs and 2016:50 hrs respectively. The wreckage was subsequently found to be within 100 m laterally of the final secondary radar point and the primary radar point recorded at 2016:38 hrs. The primary radar point timed at 2016:50 hrs was 1 nm from the wreckage position. It was not possible to definitively confirm the validity of the two final primary radar points, but the evidence indicated that the point at 2016:38 hrs was probably valid. 32 Data points were recorded once every four seconds by the radar located at Guernsey and once every five seconds for the radar located at Jersey (Les Platons). 33 See section 1.6.6, Limitations, for a definition of VNE.

32 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information

Figure 12 Radar track of final section of flight (created from a combination of data from Jersey (Les Platons) and Guernsey radars) 1.11.5 Mode C altitude validity The digital altitude input to the transponder was provided by an altitude encoder installed behind the co-pilot’s instrument panel. The encoder was connected to the same static pressure input used by the left and right altimeters installed in the instrument panel. Static pressure for the altimeters, vertical speed and airspeed indicators was sensed by two static source pads, one on each side of the rear fuselage forward of the elevator. The pads were connected to a single line leading to the instruments. The dual sources were designed to balance out differences in static pressure caused by slight ‘side-slips’ or ‘skids’. During the accident flight, when the aircraft was about 11 nm south-west of Jersey, the controller noticed that the aircraft altitude indicated FL53 instead of the requested FL55. Having queried with the pilot if the altimeter pressure setting was correctly set to 1013 hPa, the aircraft subsequently climbed to FL55. This was consistent with the pilot changing the altimeter pressure setting to 1013 hPa from 1020 hPa (the pressure setting previously provided by Rennes ATC prior to transferring to Jersey ATC). This also showed that the transponder output was consistent with the reading on the altimeter in the cockpit. The investigation found no fault with the transponder data.

33 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.12 Wreckage and impact information 1.12.1 General information on wreckage The main wreckage of N264DB was located on 3 February 2019 approximately 22 nm north-north-west of Guernsey, at a depth of 68 m. This was within 100 m laterally of the final secondary radar position. A full description of the search for the wreckage is at Appendix B. 1.12.2 Initial survey An initial survey of the wreckage, carried out using a camera on an underwater Remotely Operated Vehicle (ROV), revealed the presence of a body which was later identified as the passenger. The body was recovered to the ship on 6 February 2019. Despite a search of the wreckage and surrounding seabed, the pilot was not found. A visual assessment of the wreckage was carried out using video footage taken from the ROV on 3 February 2019 and divers contracted by Blue Water Recoveries on 27 February 2019. There was a noticeable deterioration in the condition of the wreckage between the two dates. The aircraft was extensively damaged, and the wreckage was in three parts held together by electrical and flying control cables. The engine had disconnected from the cockpit area, and the rear section of the fuselage had broken away from the forward section adjacent to the trailing edge of the wing. The horizontal stabiliser and fin, and outboard section of both wings were missing. The cockpit area and instrument panel were badly disrupted such that it would not have been possible with any confidence to determine the position of controls and switches prior to the crash. There was no visual evidence of fire. 1.12.3 Specific damage The central fuselage had broken away from the nose section at Fuselage Station (F.S.)100 and from the tail section at F.S. 186.30 (shown in orange in Figure 13). The roof section of the central fuselage aft of the front seats was missing. There was significant compression damage along the top of the aircraft from the windscreens to the tail cone. There was no evidence of compression damage on the lower surface of the tail section. The fin and horizontal stabiliser assemblies had detached from the tail section at their attachment points (shaded blue).

34 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information Figure 13 PA-46 fuselage The left wing and flap had failed at Wing Station (W.S.) 107.56 (shown in orange in Figure 14) beneath the skin doubler plate where the inboard section of the wing joins the outer section (shaded blue) at the splice joint. The inboard section of the main wing spar appeared to be undamaged. The failure of the main spar splice joint and the adjacent structure was consistent with the wing failing due to a downward bending force. The top wing surface displayed evidence of a compressive force that had pushed the skins inwards with the edges having been torn away from the fasteners. The remainder of the wing structure and flaps were extensively damaged. Doubler plate Forward Figure 14 PA-46 left wing The damage to the right wing, which also displayed evidence of compressive damage on the upper wing skins, was not as severe as the left wing. The right wing had also failed in the same area as the left wing, although it was

35 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information not possible to determine from the video the direction in which the right wing failed. There was no evidence from the damage to either wing that the aircraft had been in a spin when it impacted the water. Apart from a slight rearward bend in one of the blades, the propeller blades were undamaged. The engine cowlings had detached and the engine and nosewheel had rotated 90° relative to the front of the cockpit. Several components had detached from the engine. The right tailpipe / heater shroud was still attached to the right turbocharger and video footage of part of the right tailpipe showed no evidence of scoring on the inside. There was no evidence of burnt oil residue on the inside of the exhaust. The induction, heating and ventilation pipes, and the engine baffles had been disrupted. The ignition harness was still connected to the engine. The cockpit and cabin area had been severely disrupted. The pilot’s seat was intact, though the harness was missing. The harness for the right front seat was still in place and had been secured in a manner suggesting that this seat had not been occupied during the flight. Figures 15 to 20 show some of the damage described in this section. Further images of the wreckage are in Appendix B. Doubler plate Inboard section of flap Disrupted leading edge Compression damage on upper surface Skins compressed and detached Figure 15 Damage to left wing

36 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information Main spar (inboard section) Doubler plate Part of splice joint Failure runs along rivet line. Figure 16 Failure of left-wing main spar at the splice joint (Image taken from a video provided by Blue Water Recoveries)

Pilot’s seat Cabin roof missing Compression damage Instruments and cockpit area disrupted Figure 17 Damage to cockpit roof

37 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information Compression damage Break Rear row of passenger seats Rear section of fuselage Central section of fuselage Figure 18 Break in central fuselage Upper surface Compression damage Figure 19 Damage to roof of rear section of the fuselage (This section of the fuselage has been rotated by the tidal flow)

38 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information

Engine detached from aircraft and lying on its left side Spinner Propeller blades undamaged Nosewheel Figure 20 Propeller and engine 1.13 Medical and pathological information 1.13.1 Post-mortem examination result Despite an extensive search of the wreckage and surrounding area the pilot’s body was not found, and he remained missing at the time of publication of this report. A post-mortem examination of the passenger recorded the cause of death as head and trunk injuries sustained in the accident impact. The pathologist reported that there was no evidence that the passenger had been exposed to a fire. 1.13.2 Toxicology Post-mortem tests on the passenger showed a blood carboxyhaemoglobin (COHb) level of 58%34, and the pathologist considered that he would almost certainly have been ‘deeply unconscious’ at impact. COHb is formed when carbon monoxide (CO) binds with haemoglobin in the blood. Haemoglobin is the oxygen-carrying molecule in red blood cells. CO is a colourless, odourless, tasteless gas, which is slightly lighter than air, and is a by-product of the incomplete combustion of carbon-containing materials. When inhaled, CO is easily absorbed into the bloodstream where it attaches itself to haemoglobin and has a direct effect on the performance of those 34 The pathologist confirmed that the COHb level could be relied upon despite the length of time the body had been under water.

39 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information parts of human physiology that rely on oxygen for proper functioning. CO inhalation can lead to damage to the brain, heart and nervous system, and this is known as CO poisoning. The symptoms of CO poisoning worsen with an increasing level of COHb as detailed in Table 1. COHb level Symptom Less than 10% None 20 to 30 % Drowsiness, headache, slight increase in respiratory rate 30 to 40% Impaired judgement, shortness of breath, blurring of vision, bad headache, increasing drowsiness 40 to 50% Confusion, marked shortness of breath, pounding headache, marked drowsiness, increasingly blurred vision Over 50% Unconsciousness and eventual death Table 1 Symptoms of increasing levels of COHb (Source, FAA Advisory brochure ‘Carbon Monoxide: A Deadly Menace’) As the passenger and pilot were sitting in the same cabin, the pathologist considered it likely that the pilot would have been exposed to similar levels of CO as the passenger. Similar levels of COHb in the pilot’s blood would have been expected to render him unable to fly an aircraft. Video footage of the pilot and passenger passing through airport security at Nantes showed no behaviour which might be considered symptomatic of CO poisoning, such as a loss of coordination. Moreover, none of the witnesses at the airport commented adversely on the behaviour of either occupant of the aircraft prior to the flight. 1.14 Fire The pilot made no mention of an airborne fire during his radio communication, there was no evidence of fire in any of the underwater videos, and the post‑mortem report on the passenger identified no evidence of him having been exposed to a fire.

40 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.15 Survival aspects The pilot and passenger did not speak a common language fluently and there was no written safety brief on the aircraft in any of the languages that the passenger spoke. Witnesses described the pilot and passenger communicating through hand gestures. Whilst the passenger may have regularly travelled on different types of aircraft, it would have been challenging for the pilot to have provided a comprehensive brief on the safety features on the aircraft and their use. Whilst the aircraft was fitted with an ELT, the signal cannot be detected once the ELT is underwater. No signal was received from the aircraft. The impact sequence was not considered survivable. 1.16 Tests and research 1.16.1 Simulation of the final manoeuvres The final manoeuvre was analysed by the AAIB and NTSB. The NTSB used a 6-axis simulation35 that calculated the aircraft’s flightpath during the final manoeuvre, based on the recorded radar positions and altitudes, and output expected values for aircraft parameters such as bank angle, speed and normal load36. Normal loads during the final pull-up manoeuvre were also calculated by the AAIB using different analysis tools and the results were consistent with those of the NTSB simulation. The NTSB simulation was run in two modes, referred to as ‘altitude mode’ and ‘position mode’. In altitude mode, the final secondary radar altitude of 2,300 ft was treated as real, ie it was assumed that the aircraft descended to 1,600 ft and then climbed. In position mode the final altitude of 2,300 ft was ignored, ie it was assumed that the aircraft continued its descent towards the sea. Results from the two simulations, and radar data from the accident flight, are plotted in Figures 21 and 22. During the right and left turns which started at 2013:32 hrs (Figure 12), it was calculated that the aircraft’s roll attitude reached maximums of about 36° right and 56° left. The pitch attitude reached about 10° nose up as the aircraft initially climbed at up to 3,000 fpm, and about 15° nose down as it descended at up to 5,000 fpm. The calculated airspeed also varied between about 150 KIAS and 200 KIAS during these manoeuvres. 35 The software simulation used a generic ‘unbreakable’ aircraft model that followed the laws of aircraft motion, from which data such as attitude, speed and normal loads could be derived. 36 Normal load is the load (force) on the aircraft due to acceleration along the normal axis ie the axis which would extend vertically through the aircraft CG while sitting on level ground.

41 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information

Figure 21 Radar and simulations data (commencing at 2012:40 hrs) The aircraft commenced the final turn from an altitude of 4,100 ft and a calculated airspeed of approximately 180 KIAS. As it entered the turn, the roll attitude progressively increased at an average rate of about 5° per second and the airspeed increased at about 1.4 kt per second. When the right bank reached about 30°, both simulations indicated that there was a slight pause of a few seconds before the roll angle began to increase again. When the aircraft was at 3,700 ft, the roll attitude had reached about 60°, the pitch attitude was

42 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information about 10° nose down, and the calculated airspeed was about 200 KIAS. There was another brief pause at this bank angle before it started to increase again. As the aircraft descended through 2,700 ft, the right bank had increased to about 90°, the pitch attitude was 30° nose down, and the estimated airspeed had increased to about 235 KIAS. Figure 22 Estimated normal loads from simulations of final manoeuvre (commencing at 2016:03 hrs) At an altitude of about 2,200 ft, the two simulations showed that the aircraft started to roll to the left, towards a wings level attitude. The results beyond this point diverged, due to the different flight paths required for the aircraft to have either climbed to 2,300 ft after reaching 1,600 ft, or to have continued to descend. The altitude mode simulation indicated that a maximum normal load

43 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information of about 11 g would have been required during the pull-up manoeuvre, and the position mode simulation indicated that a maximum normal load of about 5.6 g would have been required at about the time the aircraft rolled left towards wings level. The position mode also indicated that, at the final secondary radar position, the aircraft’s airspeed would have been about 280 KIAS and its altitude would have been approximately 800 ft. 1.16.2 NTSB investigations into in-flight structural failures of PA-46 aircraft Between 31 May 1989 and 17 March 1991, five fatal accidents occurred in the USA, and a further two in Mexico and Japan, involving PA-46-310P and PA‑46‑350P aircraft that departed from controlled flight. In July 1990, following the fourth accident in the USA, the NTSB initiated a special investigation37 into the causes of the accidents, which subsequently included all PA-46 accidents and occurrences that were reported during the period of the investigation. The special investigation reviewed relevant design features, including structural integrity, flight control systems and operating limitations. The report recorded that the probable causes of the accidents that occurred in the USA involved failure to use pitot heat in freezing IMC, possible misuse of the integrated flight guidance and control systems, loss of control, and in-flight airframe failures due to loads and stresses that substantially exceeded design limits. Of the five aircraft that had an in-flight breakup, four involved the PA-46-310P (Malibu) and one a PA-46-350P (Mirage). Three of the aircraft were found in an inverted attitude with the fuselage ‘flattened’. The other two aircraft crashed into trees and the attitude of the aircraft at impact was not determined. In all the accidents, parts of the horizontal stabiliser and vertical stabiliser (fin) separated in flight and sections of both wings failed in flight, with the failures mostly occurring in the area of the wing spar splice joint. In three of the accidents, one wing failed as the result of an upward deflection and the other wing as a result of a downward deflection. An examination of the failed structure on the five aircraft found no evidence of fatigue fractures, pre-existing cracks, or corrosion. The fractures were all typical of overstress (overload). In March 1990, the aircraft manufacturer performed supplemental static tests of a PA-46 stabiliser. The stabiliser was loaded until failure occurred and the test established that the load at which it failed exceeded the required ultimate loads for the ‘gust-maximum torsion’ and ‘maneuver-maximum bending’ conditions by 60% and 20% respectively. In May 1990, the aircraft manufacturer tested the elevator balance weights and found that failure loads exceeded design loads by 267%. 37 National Transportation Safety Board. Special Investigation Report: Piper Aircraft Corporation PA-46 Malibu/Mirage Accidents/Incident May 31, 1989 to March 17, 1991. PB92-917007. NTSB/SIR-92/03. Adopted July 21, 1992.

44 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information The manufacturer carried out a structural loads review of the wings and empennage. The review estimated that a minimum of 7.7 g would have been required to cause the wings to fail. Flight tests were also carried out on a PA‑46-310P with instruments and strain gauges fitted to the empennage; during the tests, an acceleration of 4.2 g and an airspeed of 200 KCAS (203 KIAS) were recorded. All the manoeuvres performed exceeded design certification requirements, and the measured flight loads and stresses were all below tested limit loads and allowable stresses. During the special investigation, NASA conducted an aeroelastic38 analysis of the wing and horizontal stabiliser of the PA-46 to determine potential modes of structural failure. The results indicated that the aircraft was free of aeroelastic instabilities, such as flutter and static divergence, within its flight envelope. The report also included the results of an FAA Special Certification Review39 of the PA-46-310P that was initiated following seven in-flight structural break- ups. The review reported that: ‘… the most likely accident scenario is one [involving an in-flight break-up] where the pilot loses control of the aircraft at altitude, the aircraft descends at increasing speed and breaks up as a result of dynamic pressure, or aerodynamic loads outside the certified flight envelope.’ It concluded that: ‘The structural substantiation40 for the PA-46-310P and PA-46- 350P was adequate for all conditions within the approved flight envelope.’ 1.17 Organisational and management information 1.17.1 Airworthiness requirements for operating a US-registered aircraft in the UK 1.17.1.1 Applicable regulation N264DB was registered and operated in accordance with 14 CFR Part 91, General Operating and Flight Rules. Small, N-registered aircraft used for Air Charter operations are required to be operated in accordance with 14 CFR Part 135, Operating requirements: Commuter and On Demand Operations and Rules Governing Persons On Board Such Aircraft. 38 Aeroelastic analysis is concerned with the aerodynamic forces and the deformation of the structure. 39 FAA report dated December 1991: Results of Special Certification Review of the Piper PA-310P (Malibu) and PA-46- 350P (Mirage). 40 Substantiation: Formal demonstration of compliance, eg with design fatigue-life requirements.

45 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information Part 91 allowed N264DB to be flown by private pilots holding an appropriate FAA or national licence, but the aircraft was not allowed to be used for commercial operations without the owner / operator first obtaining permission from the FAA and the CAA.  Such permission had not been sought from or granted by these regulatory authorities for N264DB.  Part 91.403 states that the owner or operator of an aircraft is responsible for maintaining the aircraft in an airworthy condition. 1.17.1.2 Inspection and maintenance - general Aircraft registered in the USA but resident in the UK and operated in accordance with 14 CFR Part 91 are maintained in accordance with Part 43. Part 91.409(a) states that an aircraft may not be operated unless within the preceding 12 calendar months it has had an Annual inspection and has been approved for Return to Service by a person authorised by Part 43.7. Part 43 provides the scope and detail of items to be included in the Annual and 100-hour inspections (Appendix D). Inspections can only be undertaken by a person holding an FAA Inspector Authorization (IA), of which there were 18 in the UK at the time of the accident. Preventive maintenance and rectification can be carried out by individuals holding an FAA A&P41 licence, and non-certified individuals can carry out maintenance and rectification provided they are supervised by an FAA A&P, who must be readily available. Private aircraft, such as N264DB, can be maintained within the limits of the FAA regulations by the owner or a mechanic who must hold an FAA A&P licence in order to certify the maintenance before the aircraft is returned to service. The Airworthiness Certificate must be validated in the aircraft logbook by the holder of an FAA IA and renewed at the Annual inspection. 1.17.1.3 Inspection and maintenance – Aircraft Maintenance Manual The PA-46-310P Maintenance Manual42 provides the following definitions for the term ‘inspection’: ‘A. Inspections - Must be performed only by persons authorized by the FAA or appropriate National Aviation Authority who are qualified on these aircraft, using acceptable methods, techniques and practices to determine physical condition and detect defects. 41 A&P: Aircraft and Propulsion. 42 Piper Aircraft PA-46-310P / 350P Maintenance Manual, Chapter 5-20-00.

46 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information Routine Inspection – Consists of a visual examination or check of the aircraft and its components and systems without disassembly. Detailed Inspection – Consists of a thorough examination of the appliances the aircraft and the component and systems with such disassembly as is necessary to determine conditions. Special Inspection - Involves those components, systems or structure which by their application or intended use require an inspection peculiar to, more extensive in scope or at a time period other than that which is normally accomplished during the event inspection.’ There were no specific requirements in the PA-46-310P aircraft maintenance schedule for the 50 and 100 hour inspection interval43, for the tailpipe / heater muff to be removed and the exhaust system to be pressurised to check for leaks. It only called for the exhaust to be inspected. However, the following warning was in the introduction of the Maintenance Manual and at the start of the section on Scheduled Maintenance (Chapter 5-20-00). ‘WARNING: FAILURE TO CONSULT APPLICABLE VENDOR PUBLICATION(S), WHEN SERVICING OR INSPECTING VENDOR EQUIPMENT INSTALLED IN PIPER AIRCRAFT, MAY RENDER THE AIRCRAFT UNAIRWORTHY. (SEE MAINTENANCE MANUAL – INTRODUCTION‑SUPPLEMENTARY PUBLICATIONS.)’ The introduction to the Maintenance Manual listed 26 components and stated: ‘The following is a list of the vendor publications, used in conjunction with the servicing, overhaul and parts information on various components.’ Continental Motors was listed as the vendor for the engine fitted to the PA-46-310P. 1.17.1.4 Inspection and maintenance – Engine Manuals and Service Documents The engine Standard Practice Maintenance Manual44 and the Maintenance and Overhaul Manual45 provide instruction and guidance for the continued airworthiness of the engine. The engine manufacturer may issue Service Documents in one of six categories ranging from mandatory (Category 1) to informational (Category 6). Service Bulletin SB10-1A, which the maintenance organisation referred to during the 43 Piper Aircraft PA-46-310P / 350P Maintenance Manual, Chapter 5-20-00. 44 Continental Aircraft Engine, Maintenance Manual, Standard Practice for Spark Ignited Engines, Publication M-O. 45 Continental Aircraft Engine, TSIO-520-BE Overhaul Manual (Part No30574).

47 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information visual examination of the exhaust system46, and which also contains guidance for pressure-testing the exhaust system, was a Category 3 Service Document. The content of SB10-1A had been incorporated into the Standard Practice Manual. The definition of a Category 3 Service Document is: ‘Category 3: Service Bulletin (SB) Information which the product manufacturer believes may improve the inherent Safety of an aircraft or aircraft component; this category includes the most recent updates to Instructions for Continued Airworthiness.’ In comparison with Part 91, Part 135 maintenance requirements are stricter. Part 135.421 sets out the additional maintenance requirements, and for aircraft with nine seats or less, excluding the pilot’s seat, operators must comply with the aircraft and engine manufacturer’s recommended maintenance programmes or a programme approved by the FAA. Consequently, SB10-1A would be mandatory for aircraft operating in accordance with Part 135, and the pressure‑test of the exhaust system would become a requirement. 1.17.1.5 Ownership and responsibility for airworthiness Ownership of N264DB was transferred to a US Citizen Corporate Trust on 7 August 2015 to enable it to operate on the US register. The Trust, known by the FAA as the Trustee and by the CAA as the Owner Trust, is represented in the UK by a Limited company of the same name. In this type of arrangement, the Trustee is responsible for registering the aircraft and passing all applicable airworthiness directives to a Trustor (known by the CAA as the beneficial owner). In the case of N264DB the Trustor was a UK company, and it was responsible for the operation of the aircraft and for ensuring it was maintained in accordance with applicable regulations. These responsibilities were recorded in a Trust Agreement and in an Aircraft Operating Agreement. Any further delegation of the Trustor’s responsibilities was required to be made in writing and with the approval of the Trustee. The Trustor informed the investigation that it had delegated some of its responsibilities to a third party although there was no written contract between the parties. Day-to-day management of the aircraft was carried out by the third party who also arranged scheduled maintenance and any necessary rectification. The Trustor paid any bills. 46 See paragraph 1.6.14.3, Inspection of the engine exhaust system.

48 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.17.1.6 Airworthiness oversight Oversight of the maintenance of aircraft operating in the UK which are registered in another state is the responsibility of the state of registration. A bilateral agreement is in place between the UK and USA for the oversight of organisations performing complex maintenance under 14 CFR Part 14547, and for operators of commuter and commercial aircraft under Parts 13548 and 12149. This bilateral agreement does not place any obligation on the CAA for regulatory oversight of Part 91 maintenance organisations or individual N-registered aircraft operating in the UK. Nevertheless, the CAA may be asked to assist the FAA with safety checks. 1.17.1.7 Safety of foreign-registered aircraft operating in the UK In 2016, the AAIB completed a Safety Study50 into fatal general aviation (GA) accidents involving aircraft registered overseas, which revealed several common airworthiness issues. As a result of this study, the following recommendation was made to the CAA: ‘Safety Recommendation 2015-040 It is recommended that the United Kingdom Civil Aviation Authority take urgent action to ensure that foreign registered aircraft, permanently based and / or operated in the United Kingdom, comply with the requirements of the Air Navigation Order and their Certificate of Airworthiness.’ The CAA subsequently undertook inspections of a sample of 24 non-UK registered aircraft with the results indicating that there was no significant difference in compliance between UK and foreign-registered GA aircraft resident in the UK. In 2013, EASA undertook an internal analysis of N-registered aircraft in Europe over a five-year period. The study identified no significant difference in safety between aircraft registered in the USA and in the EU. 47 14 CFR Part 145 Repair Stations. 48 14 CFR Part 135 Air Carrier and Operator Certificate (Rules for commuter and on-demand operations). 49 14 CFR Part 121 Air Carrier Certification (Rules for scheduled air carriers). 50 AAIB Safety Study – 1/2016, Airworthiness of Aircraft Registered Overseas and Resident in the UK.

49 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.17.2 Chartering of aircraft 1.17.2.1 Organisation of the accident flight The passenger on N264DB was transiting between his home in France and his new employer in Cardiff. The arrangements were made via a third party who asked the accident pilot whether he would be interested in flying the outbound and inbound flights. The passenger did not contribute to the cost of the flight, which was to be paid for by another party. The passenger was also not involved in booking the flight or in its arrangements beyond specifying the time at which he wished to depart from Nantes. 1.17.2.2 Assessment of risk Passengers are not expected to know about or understand the regulatory aspects of aviation, such as airworthiness or personnel licensing or approvals. This knowledge is required of the commander and the operator, if there is one, who must ensure they comply with all relevant regulations. For this reason, a passenger is not likely to wholly understand the relative risk of a flight they are undertaking, which may vary according to the operating regime in which the aircraft is being used. For example, an operator with an AOC is subject to more stringent safety oversight by the regulator when compared to a pilot operating on a PPL with a hired aircraft. A pilot operating for an EASA AOC holder will be subject to six-monthly flying or simulator assessments, whilst an EASA PPL holder might only need to renew a flying rating every 24 months. 1.17.2.3 Unlicensed charters Unlicensed charter flight operations, which can also be known as ‘grey charters’ are unregulated and may be uninsured. Evidence collected by The Air Charter Association indicated that such flights may have become more widespread within the UK and Europe. They are often associated with sporting events where there may be many small aircraft transporting passengers. Due to the unlicensed nature of such flights, it is difficult to gauge the level of activity accurately. Enforcement is challenging because it requires a large commitment of resources. It also requires the gathering of specific evidence against a pilot or broker which can be difficult to obtain. The Air Charter Association recommends specific steps51 that passengers can take before hiring an aircraft for a charter to verify that the flight will be legitimate. These include asking if the aircraft is licensed and asking to see an AOC and the insurance documents for the aircraft. 51 https://www.theaircharterassociation.aero/baca-warns-of-grey-charters-in-the-eu/

50 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.17.2.4 UK regulatory approach to unlicensed charters The CAA has looked at how unlicensed activity such as the accident flight can be stopped, taking a three-pronged approach. The first part of the approach is to educate the travelling public who may unwittingly use one of these flights without realising that it is unlicensed and illegal. They unknowingly increase the level of risk they are taking and may be uninsured. Following this accident, the CAA developed a campaign to raise awareness of unlicensed charters. As part of the campaign it would:

● Engage with major sporting associations, business organisations and professional sports organisations to raise awareness of the issues and seek their public support.

● Distribute leaflets and posters aimed at passengers, explaining what to ask / look for when buying a non-airline flight.

● Provide AOC holders with material to show prospective passengers how they are more highly regulated and what that means.

● Increase the amount of information available on its website, with the search facility for AOC holders made more prominent. A copy of the CAA Leaflet, Legal to Fly, is at Appendix C. The second part of the CAA approach is to educate those who are unwittingly breaking the law because they do not understand or are unaware of the regulations surrounding air charters. The CAA can support the development of companies, individuals or owners who seek to become compliant with the regulations. The final part of the CAA approach is to reduce the illegal activity by catching and / or prosecuting those involved. The CAA works together with other agencies such as the Border Force, Police and others to try and pinpoint where to target their resources. CAA inspectors regularly visit airfields as well as public events where aviation operations involving aircraft or helicopters take place. During such visits or inspections, the CAA monitors for any possible illegal activity. The CAA also carries out regular spot checks of flight plans. Reports from the public, especially from those within the legitimate aviation community can also provide useful intelligence to the investigators.

51 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information The CAA provides a form on its website where such reports can be filed, and they can be filed with ‘Whistle‑blower’ protections52. Should illegal activity be suspected, the CAA has powers to detain an aircraft and, where appropriate, take enforcement action. Enforcement activities include educating the operator about the regulations, formal warnings, revocation of licences / approvals or certificates, and criminal prosecutions. The CAA, together with partner agencies, continues to develop capabilities which increase the chance that those engaged in unlicensed activities will be caught and sanctioned. The sensitive nature of this work means it remains largely hidden from public view. The use of aircraft registered outside the UK does not prevent or deter the CAA from investigating, and it works closely with other worldwide regulators including the FAA. Whilst the CAA is not the regulator for these aircraft, it has sanctions available up to and including banning an aircraft from UK airspace. 1.17.3 Flight crew licensing requirements To fly an aircraft registered in the USA a pilot must hold a suitable licence, and licensing is governed by 14 CFR Part 61, Certification: Pilots, Flight Instructors, and Ground Instructors. Part 61.3(a)(vii) states: ‘When operating an aircraft within a foreign country, a pilot license issued by that country may be used.’ Aviation in the EU is regulated by EASA, but pilot licences issued in accordance with EASA regulations are issued by Member State National Aviation Authorities (the CAA in the UK). A pilot may only hold one EASA licence, issued by a single Member State. The USA does not consider the EU to be a State and so a flight between two EASA Member States is a flight between two foreign countries within the meaning of Part 61.3(a)(vii). Such a flight would require the pilot to hold an EU licence issued in each Member State, which is not possible within the EU. Therefore, when an EASA licence issued in an EU Member State is used to fly an aircraft registered in the USA, the flight must remain within the borders of that Member State. The corollary is that, to fly an aircraft registered in the USA between two EU Member States, as was the case with the accident flight, a pilot must operate using an appropriate FAA licence. Part 61 offers two routes to gain an FAA PPL and the first is laid out in Part 61.103. An FAA PPL would be gained this way by completing the FAA syllabus, examinations, flight training and flight test. Such a licence includes a night flying qualification because night flying is part of the FAA PPL syllabus. 52 The CAA is a “prescribed person” under the Public Interest Disclosure Act 1998 for the purpose of receiving “protected disclosures” (whistle-blowing) from the civil aviation industry.

52 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information The second way to gain an FAA PPL is through a certificate issued on the basis of a foreign pilot licence (‘piggybacking’). The rules for this are contained in Part 61.75 which state that such a certificate: ‘Is subject to the limitations and restrictions on the person’s U.S. certificate and foreign pilot license when exercising the privileges of that U.S. pilot certificate in an aircraft of U.S. registry operating within or outside the United States.’ It is possible for aircraft ratings and instrument ratings to be piggybacked onto an FAA licence from a foreign licence. For example, an FAA PPL issued on the basis of an EASA PPL could be used for night flying if the pilot held an EASA night rating (night flying is not included in the EASA PPL syllabus). Both the EASA and CAA stated that, whilst operating in EASA-regulated airspace on a piggyback FAA licence, a licence holder must comply with EASA regulatory requirements with regards to the underlying EASA licence privileges. For example, a pilot cannot fly an aircraft without a valid class or type rating as required by EASA, or fly at night without completing the night flying training under Part-FCL.810. A pilot may not exercise the privileges of an FAA PPL issued on the basis of an EASA licence unless the underlying EASA licence is valid and contains the ratings and/or training required under EASA rules. In effect such a pilot when operating using a piggyback FAA PPL must comply with both the rules of Part 61 and those of EASA Part FCL, whichever are the most restricting. 1.17.3.1 CAA licensing records Record-keeping related to personnel licences, certificates and ratings is a requirement under EU Regulation 2018/1119 (EASA Part ARA.GEN.220)53, which has an associated Acceptable Means of Compliance (AMC). AMC1  ARA.GEN.220(a)(5), Record-keeping, advises that records should include, as a minimum:

● The application for, or change to a licence, certificate or rating.

● A copy of the licence or certificate including any changes. Within the UK, pilot records are kept on an electronic database by the CAA. This database records ratings, renewals, medical details, and any applications pilots make to the CAA for alterations to their licence. The accident pilot’s licence and logbook were not recovered from the wreckage, although the investigation saw a scanned copy of the pilot’s licence from February 2018, 53 Part ARA, subpart GEN (General Information).220 and its associated Acceptable Means of Compliance at AMC1 ARA.GEN.220 (a)(5).

53 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information which had been sent to a third party by the pilot. This copy showed that the CAA records were incomplete because various revalidations had not been recorded on the database. Examination of the database also revealed ratings which had been entered on the pilot’s record which he did not hold.

The issuing of ratings and the processing of renewals requires examiners and candidates to complete paperwork as detailed by the CAA. This paperwork is then submitted to the CAA to be processed so that the details can be entered into the database. The renewals are also entered directly onto the licence by the examiner, and the licence is the authoritative document. It was not determined whether the paperwork for the accident pilot’s renewals was not submitted to the CAA or if it was not processed. It is AAIB experience that CAA licensing records provided to AAIB investigations often appear to be incomplete. 1.18 Additional information 1.18.1 Carbon monoxide 1.18.1.1 CO detector fitted to N264DB There was no record in the aircraft documentation of any type of CO detector having been fitted to N264DB. The individual who managed the aircraft believed that a strip detector was fitted to the right side of the instrument panel in front of the right seat although he had not fitted it. The maintenance organisations which undertook the Annual maintenance in November 2018, December 2017 and October 2016 had no record of a strip (spot) detector having been fitted to the aircraft. CO strip (spot) detectors are normally mounted on a card, which is then stuck to a surface, and consist of a beige background which turns black in the presence of CO. The life of these type of detectors can be between 3 and 18 months from when they are removed from their original packaging. 1.18.1.2 Source of CO in the cabin of light aircraft Piston engine aircraft produce high concentrations of CO that can potentially enter the cabin during flight as a result of cracks, holes or poorly fitted components in the exhaust system or intake ducting, or poor sealing of the firewall and critical areas of the fuselage / cabin. Both 14 CFR Part 23.831 and European Certification Specification (CS) 23.831 (a) require manufacturers to show that the concentration of CO in the cabin will not exceed 1 part per 20,000 parts of air. To demonstrate

54 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information compliance, the manufacturer usually installs a CO detector during the flight test programme, but there is no certification requirement for production aircraft to be equipped with a CO detector. 1.18.1.3 FAA report on detection and prevention of CO exposure In October 2009, the FAA issued a report54 on the detection and prevention of CO exposure in GA aircraft. The report looked at the design of exhaust systems and the protocols to alert users to the presence of excessive CO in the cabin and undertook an evaluation of inspection methods and maintenance practices. A total of 71,712 accidents between 1962 and 2007 were reviewed from the NTSB accident / incident database and categorised as: clearly related to CO exposure; potentially related to CO exposure; or not related to CO exposure. Of the 71,712 accidents, 62 cases were clearly related to CO exposure. The ‘potentially related’ category included accidents where the probable cause involved engine failure, engine power loss, defective valves etc. However, without further analysis it was not possible to determine if CO poisoning was a factor. A search of the database using keywords related to the exhaust system identified approximately 400 cases which were related to the ‘muffler’55 (clearly and potentially related). The report also recorded that ‘when the muffler was implicated as the cause of a CO related accident, the vast majority had muffler usage greater than 1,000 flying hours’. The report noted that piston engine exhaust gas typically contains 5% to 7% CO and extreme exposure can result in death in one to three minutes. Aircraft exhaust systems operate in a harsh environment and contain components and connections which can deteriorate and fail, allowing CO to enter the cabin. Some of the environmental factors that can cause a deterioration of an exhaust system include:

● Engine vibration, which may eventually cause metal fatigue.

● Thermal cycling during engine operations.

● High temperature and the corrosive effect of engine exhaust gasses. The report highlighted that in the year 2000 the average age of the USA’s 150,000 single-engine aircraft was over 30 years and that while the CO hazard is not limited to aging aircraft alone, the risk of exhaust system failure naturally increases with older aircraft. The report also noted that half of the exhaust system failures occurred within the first 400 hours of use. 54 U.S Department of Transportation, Federal Aviation Administration, DOT/FAA/AR-09/49, Detection and Prevention of Carbon monoxide Exposure in General Aviation Aircraft, October 2009. 55 A muffler is described by the engine manufacturer as a ‘heater muff’.

55 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information The report included a finding by the NTSB that CO exposure can occur soon after an aircraft has completed its Annual or 100-hour inspection. Part of the reason for this might be that a crack is difficult to see in a simple visual inspection. The densely-packed engine compartment makes it difficult to perform a thorough inspection unless some parts are disassembled and removed. Even if the exhaust system is intact and without leaks during an inspection, it is possible for a crack or failure to occur soon after inspection. Service Difficulty Reports cited in the report highlighted exhaust system failures found after disassembly and pressure testing, even though the exhaust system had passed its Annual inspection a short time earlier. The report found that:

● CO exposure is a serious hazard that can occur suddenly at any time.

● There is a high likelihood of a hazard from CO whenever there is an exhaust system failure.

● The best location for a CO detector is on the instrument panel. 1.18.1.4 Accidents and occurrences in the UK involving CO Records of accidents and other occurrences in the UK since 2000 were reviewed to identify whether CO might have been a causal factor. The review identified two aircraft accidents56, each with two fatalities, and fifteen other events recorded on the CAA occurrence reporting system. On 11 of those occasions, a CO monitor alerted the crew to the presence of CO; one crew was reported to be nearly unconscious when the aircraft landed; and the occupants on another four flights experienced nausea and light-headedness. There were seven other reported occurrences of exhaust fumes in the cockpit where the aircraft was not fitted with a monitor. 1.18.1.5 Recent significant events involving CO in cabins 29 August 2018 (N6500W) On 29 August 2018 a Cessna P210N crashed just short of the runway in Prescott, Arizona, fatally injuring the pilot. The aircraft, which was destroyed by fire, is subject to an NTSB investigation57. The single engine piston aircraft was operating under the provision of 14 CFR Part 91. The pilot had intended to acquire his night 56 G-BGEW; accident occurred on 20 September 2009. AAIB reference EW/C2009/09/20. G-ARIE; accident occurred on 12 May 2001. AAIB reference EW/C2001/05/03. 57 National Transportation Safety Board Aviation Accident Investigation, N6500W, 29 August 2018.

56 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information rating currency by performing three practice touch-and-go takeoffs but crashed on his first approach. The investigation established that there was a crack approximately 1.81 inches long with a maximum gap of approximately 0.20 inches wide along the exhaust manifold flange. The pilot had a COHb level of 35% which was not thought to have occurred as a result of the fire. The total engine running time for the flight was 18 minutes. 9 November 2018 (N91770) On 9 November 2018, a Piper PA-28-236 collided with terrain about two miles south of Guthrie County Regional Airport, Iowa, USA. The four occupants onboard sustained fatal injuries. The accident is being investigated by the NTSB58. Examination of the wreckage revealed a crack, 2 inches long, in the engine’s aft exhaust ‘muffler’ (heater muff). A toxicology report revealed that the COHb level of the occupants varied between 20% and 58%. The aircraft was being operated in accordance with the provisions of 14 CFR Part 91. 1.18.1.6 Safety Recommendations made by the NTSB On 23 June 2004, the NTSB made a Safety Recommendation (A-04-028) to the FAA as a result of a fatal accident involving a Beech BE-23 aircraft where the pilot was probably incapacitated due to CO poisoning caused by a fractured ‘muffler’. The NTSB investigation revealed that oxidation (corrosion) had penetrated the wall of the ‘muffler shroud’ and extended around 20% of the ‘muffler’s’ circumference. The oxidized areas of the fracture appeared black, which was consistent with a pre-existing fracture that was exposed to the environment for an extended period. The ‘muffler’ had been fitted to the engine for 27 years and 1,218 flight hours, and the accident occurred six flying hours after the aircraft’s Annual inspection, which had been completed approximately three months earlier. The Safety Recommendation stated: ‘Safety Recommendation A-04-028. ‘TO THE FEDERAL AVIATION ADMINISTRATION: Require the installation of carbon monoxide (CO) detectors meeting the standards developed as a result of Safety Recommendation A-04-27 in all single-engine reciprocating-powered airplanes with forward-mounted engines and enclosed cockpits that are already equipped with any airplane system needed for the operation of such a CO detector.’ 58 National Transportation Safety Board Aviation Accident Investigation, Number WPR19FA022, N91770, 9 November 2018.

57 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information The FAA response to the NTSB Safety Recommendation and the NTSB’s assessment of their response are recorded respectively on the NTSB website as follows: ‘As the proper inspection and maintenance of mufflers and exhaust system components is the primary method of preventing CO contamination, installing a CO detector is not necessary to correct an unsafe condition as defined by 14 CFR Part 39. Accordingly, the FAA does not plan to require the installation of such devices in all single-engine reciprocating-powered airplanes with forward‑mounted engine and enclosed cockpits, as recommended.’ ‘Although SAIB CE-10-19 R1 recommends that owners and operators of these aircraft review the FAA’s technical report and also use a CO detector while operating their aircraft, the NTSB does not believe that issuance of the SAIB alone is satisfactory. Accordingly, because the FAA indicated that its actions in response to this recommendation are complete, Safety Recommendation A-04-28 is classified CLOSED—UNACCEPTABLE ACTION. 1.18.1.7 Safety Recommendation made by the BEA (France) In 2002, the BEA made Safety Recommendation FRAN-2003-002 (BEA) to the Direction Générale de l’Aviation Civile (DGAC), the French National Aviation Authority: ‘Safety Recommendation FRAN-2002-002 (BEA). The BEA recommends that the DGAC require the presence of a carbon monoxide detector on general aviation aircraft.’ The recommendation was addressed through EASA Rule Making Tasks (RMT) 0329 and 0330 which considered the proposal to fit CO detectors on board all piston engine aircraft. Work on these RMTs was suspended in 2013. Instead, it was proposed to ensure that there was an appropriate specification in CS 2359. With regard to this Safety Recommendation, EASA reported in their Annual Safety Review 2014: ‘Although the safety risk from carbon monoxide (CO) ingress into the cabin of general aviation aircraft exists, the number of accidents where CO poisoning is determined as the root cause remains low compared to other root causes categories. CO detectors are also available on the market and as such many 59 CS 23, Certification Specifications for Normal-Category Aeroplanes.

58 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information operators already make use of them, even though there is no rule requiring the installation of CO detectors. The Agency considers that this issue may be treated by other means than by the creation of a new rule, and rulemaking task RMT.0329/.0330 has been cancelled. For instance, in June 2010, the Agency published Safety Information Bulletin (SIB) 2010‑19 highlighting the importance and need to properly inspect and maintain the exhaust mufflers of piston engine powered Aeroplanes and Helicopters in accordance with the specifications for Inspection and Checks of the Appendix to the SIB. Finally, in the frame of rulemaking task RMT.0498 on the re-organisation of the Certification Specifications for small aeroplanes (CS-23 and FAR Part-23), the Agency proposed to include a  provision recommending the installation of CO detectors whenever the design of the aircraft presents a risk of contamination of the cabin air; such provision would be found in the ASTM standard which will be used in the future Book 2.’ 1.18.1.8 Safety Recommendations made by the AAIB on CO monitoring Following a fatal accident on 12 May 2001, the AAIB made the following Safety Recommendation to the CAA: ‘Safety Recommendation 2002-23 The Civil Aviation Authority should develop an appropriate recognised performance specification against which carbon monoxide detectors can be assessed and approved, with the eventual aim of mandating their use on all piston engine aircraft.’ The CAA partially accepted this recommendation and undertook a feasibility study to determine whether an appropriate airworthiness specification could be developed that would form the basis for a practicable and cost-effective CO detector for aviation use. The study proposed a revision60 to updated ETSO61 2C48a which addressed the use of CO detectors. The study was circulated within the CAA Safety Regulation Group and provided to the EASA. 60 Revised ETSO for Carbon Monoxide Detectors, March 2005, Document 0529/R/000287/KK. 61 European Technical Standard Order (ETSO) is one process to have parts approved for use on aircraft.

59 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information The following Safety Recommendation was also made: ‘Safety Recommendation 2002-30 In the absence of it being mandatory for all piston engine aircraft to carry a carbon monoxide detector, the Civil Aviation Authority should vigorously promote that all such aircraft should have a current carbon monoxide detector fitted to facilitate an early warning of the presence of the gas.’ The CAA accepted this recommendation. 1.18.1.9 Response from the CAA to a Coroner on exposure to CO Following an accident62 in November 2017 in which the pilot was found to have a COHb level of 24%, the Senior Coroner for Buckinghamshire raised a number of concerns with the CAA regarding exposure to CO63. The CAA responded64 that the potential for CO contamination in small aircraft is addressed through regulations that concern design, maintenance and operation of such aircraft. While N264DB was subject to FAA regulations, the CAA made the following comments with regards to aircraft registered in the UK: ‘Aircraft Design. The European Union Aviation Safety Agency (EASA) has oversight of the design requirements for aircraft designed under code CS-23 (Small Light Aircraft), which contain specific requirements on cockpit contamination prevention measures. The codes address the required levels of ventilation, the maximum acceptable CO content in the cockpit and the design of heating systems (notably exhaust-related heat exchangers) with a view to preventing CO contamination in the cockpit. The codes do not require CO detectors to be fitted as part of the design. Similar design requirements exist in the United States, which is the primary source of general aviation types. Maintenance.

Maintenance (Continuing Airworthiness) requirements and recommendations in the UK provide that aircraft exhaust systems are to be inspected in accordance with the manufacturer’s instructions. In the UK, there are two publications of specific relevance to this topic. CAA Publication (CAP) 56265 Leaflet B-190, CO Contamination provides generic expectations for maintenance-related measures which aim to minimise the 62 AAIB Bulletin EW/C2017/11/02, mid-air collision, G-WACG and G-JAMM. 63 https://www.judiciary.uk/wp-content/uploads/2019/08/Jaspal-Singh-Bahra-2019-0160.pdf [accessed February 2020] 64 Civil Aviation Authority response to a report on action to prevent other deaths pursuant to Regulation 29 of the Coroners (investigations) Regulations 2013. 65 CAP 562 Civil Aircraft Airworthiness Information and Procedures.

60 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information likelihood of such occurrences. It addresses the nature and effects of carbon monoxide, the causes of contamination, the importance of routine inspections and means of testing for contamination. CAP 74766, Generic Requirement (GR) No. 11 covers potential CO contamination from combustion heaters, which are only fitted to a relatively small number of light aircraft. GR No 11 addresses servicing and overhaul requirements intended to detect CO contamination.’ The CAA explained that some manufacturers have issued type-specific information that has been mandated by the responsible aviation authorities in the form of ‘Airworthiness Directives’. They also explained that the new European light aircraft maintenance requirements, proposed for adoption in late 2019 (Part M Light), would be expected to contain a requirement in the Minimum Inspection Programme67 to: ‘Inspect Cabin Heat Exchanger for improper condition and function. For exhaust heat exchanger check CO‑Carbon monoxide concentration.’ With regard to aircraft operations, the CAA wrote: ‘Operation. In the UK, the ‘Winter Flying’ Safety Sense Leaflet contains information on the use of ‘spot-type’ passive indicators. Such devices are small, widely-available and relatively inexpensive. They can be attached to a wall or panel in the cockpit and do not need to be professionally installed. There are a range of active CO detectors available that use audible, visible or vibration warnings when pre-determined CO levels are exceeded. These have the notable advantage of actively engaging the pilot’s attention and are accordingly more likely to be more effective than the ‘spot-type’ indicators. CO detectors may be fitted to UK-registered aircraft as ‘standard changes’ under the provisions of CS-STAN68 (for EASA aircraft) and CAP 1419 (for non-EASA aircraft). This removes the need for direct authority involvement, allowing equipment to be installed without the associated time and costs. CO detectors are not mandated for general aviation aircraft, as from an initial design viewpoint, the requirements for the certification of the aircraft are such that the system design should minimise the 66 CAP 747 Mandatory Requirements for Airworthiness. 67 At the time of this report, the draft legislation for the EASA Minimum Inspection Programme did not include a requirement to pressure test the exhaust, but it did call for a carbon monoxide check of the cabin heater system. 68 Certification Standard.

61 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information likelihood of CO contamination, but the maintenance of sometimes notably highly-utilised airframes and/or their ageing systems means that contamination can occasionally take place. The more widespread use of CO detectors is thus currently down to the pilot/ owner’s discretion’. The CAA concluded: ‘The Regulation 28 report to prevent future deaths has provided an opportunity to review available material on CO contamination avoidance. Notwithstanding the measures already in place and those expected in the near future, the CAA will consider the merits of additional information on best practice CO contamination avoidance in a ‘Safety Notice’ publication. To this end, the CAA will consult with members of the relevant stakeholder forum, the AOPA Maintenance Working Group, in making this decision by the end of the third quarter of 2019. If a decision be made to publish a Safety Notice, this is expected to take place by the end of 2019.’ 1.18.1.10 EASA actions to address the risk of CO poisoning. EASA acted to address the risk of CO poisoning as follows:

● In June 2010, EASA released Safety Information Bulletin (SIB) 2010-19 that highlighted the importance of properly inspecting and maintaining exhaust mufflers.

● In July 2015, EASA issued Certification Standard (CS-STAN) CS-SC107a which allows, under certain conditions, for the installation of CO detectors, either as panel-mounted devices or by a semi-permanent installation of ‘lifesaver’ badges held in place by adhesives. This CS-STAN was republished in March 2017 and April 2019.

● In March 2018, EASA promoted the use of CO detectors through a safety promotion ‘Sunny Swift69’

● On 27 January 2020, EASA issued SIB 2020-01, Carbon Monoxide (CO) Risk in Small Aeroplanes and Helicopters70. The SIB made recommendations on how to: avoid CO exposure; be actively warned if there is CO exposure; and how to react in case of CO exposure. The SIB stated: ‘At this time, the safety concern described in this SIB is not considered to be an unsafe condition that would warrant either an Airworthiness Directive 69 https://www.ease.europa.eu/newsroom-and-events/news/sunny-swift-co-intoxication [accessed February 2020] 70 https://ad.easa.europa.eu/blob/EASA_SIB_2020_01.pdf/SIB_2020-01_1 [accessed February 2020]

62 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information (AD) action under Regulation(EU) 748/2012, Part 21.A.3B, or a safety directive action under Commission Regulation (EU) 965/2012. Annex II, ARO.GEN.135C’71. 1.18.1.11 Engine manufacturer’s best practice on inspecting exhaust systems The engine manufacturer issued Service Bulletin SB10-1A on 28 January 2010 providing guidance on inspecting the exhaust and turbocharger system. The Service Bulletin was applicable to the engine fitted to N264DB. The information in the Service Bulletin was subsequently incorporated into the engine manufacturer’s M-0 Maintenance Manual (standard practice), which was issued on 15 April 2016. Extracts from this manual relevant to the inspection of the exhaust system are at Appendix D. The guidance recommended the inspection and tests that should be carried out at the Annual inspection / 100-hour maintenance. Of note, the guidance recommended that:

● The system should be pressure tested by applying air at a pressure of 5 psi to the exhaust tailpipe and using soapy water to check for leaks.

● The V-band clamps should be removed and inspected, which would entail the removal of the tail pipe / heater muff. While the engine manufacturer’s guidance (Appendix D) was to inspect the heat exchanger joints and seams, it did not explicitly advise that the shroud around the exhaust tailpipe should first be removed (although the shroud was removed during the last two Annual inspections carried out on N264DB). Without removing the shroud, it would not be possible to check for damage on the outside of the tailpipe, or to apply soapy water to check if air was leaking from the tailpipe in this area. The PA-46-310P aircraft maintenance manual made no specific references to the engine manufacturer’s guidance regarding the inspection and testing of the exhaust system, nor did it specifically require the shroud to be removed as part of the inspection. The engine manufacturer stated that it was not aware of any operational issues with the exhaust heater muff installed in the Piper PA-46-310P aircraft. It considered that a qualified aircraft mechanic following the inspection instructions outlined in the M-0 Maintenance Manual should be able to identify any potential unairworthy condition. 71 For a definition of ‘unsafe condition’, see AMC 21a.3B(b) to Part 21 in EASA ED Decision 20013/1/RM. Available: https://www.easa.europa.eu/sites/default/files/dfu/decision_ED_2003_01_RM.pdf [accessed February 2020]

63 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information 1.18.1.12 FAA action relating to CO detectors On 5 June 2009, the FAA produced a Technical Standards Order72 giving information on the minimum performance standards for a CO detector to be fitted in the cabin of GA aircraft. On 17 March 2010, the FAA issued a Special Airworthiness Information Bulletin (SAIB) (CE-10-19 R1) to advise owners and operators of GA aircraft on the need to inspect ‘properly’ and maintain the exhaust system to prevent leakage of CO into the cabin and to install commercially available CO detectors in the cabin. The FAA stated in this document that ‘they did not consider that at this time there was an unsafe condition73 that required an airworthiness directive’. 1.18.1.13 Transport Canada Airworthiness Directive On 31 August 1992, Transport Canada (TC) issued Airworthiness Directive (AD) CF-90-03R2. This AD mandated a detailed inspection of exhaust-type heat exchangers (‘mufflers’) used as a source of cabin and cockpit heat. The initial inspection was to be repeated at intervals not to exceed one year or 150 flight hours. Unlike TC, the FAA, EASA and CAA have not issued ADs stipulating how inspections and tests on the exhaust system should be carried out. 1.18.1.14 Aircraft CO detectors CO detectors designed to be carried in, or permanently installed on aircraft are commercially available. CO detectors are also installed as standard equipment on new aircraft by several light aircraft and helicopter manufacturers. These detectors provide an aural and visual warning when CO levels exceed a specified level. 1.18.2 Flying at night Night flying requires a combination of instrument and visual flying skills. On a clear moonlit night, over a well-lit built up area and with a clearly defined horizon, pilots may be able to use a high proportion of visual flying techniques. However, when flying below cloud cover or on a dark night over unlit areas, pilots must rely mostly on accurate instrument flying. There are a range of visual illusions that can affect a pilot at night such as flicker vertigo, relative‑motion illusion, reversable perspective illusion and false horizons caused by stars or ground lighting. The range of vestibular illusions that 72 Technical Standard Order TSO-C48a effective 05/06/09. 73 Unsafe condition is detailed in 14 Code of Federal Regulations Part 39.

64 Factual Information Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 1 - Factual information are most often associated with instrument flying also apply when flying at night and may be even more powerful when there are few, if any visual clues available to the pilot. Spatial orientation is the ability of human beings to orientate themselves within three dimensions against the surrounding environment. It requires the use of multiple sensory systems such as sight, hearing, pressure and touch as well as the vestibular system. The system is not infallible and flying stretches it to its limits and sometimes beyond. Visual and vestibular illusions can cause the pilot to lose spatial orientation in flight, especially when visual references are limited. This loss of spatial orientation can lead to a loss of aircraft control. Although humans have evolved to accept what their internal spatial orientation systems are telling them, instrument flying skills allow pilots to manage the inherent limitations of their internal perceptions by trusting and relying on flight instruments for orientation. 1.18.3 CAA Review of General Aviation Fatal Accidents CAP 667, Review of General Aviation Fatal Accidents 1985-199474, discussed the major types of GA fatal accidents, including loss of control (LOC) in IMC. The report found that:

● ‘Three quarters of the pilots involved were attempting to fly in IMC when not qualified to do so (no IR or IR(R)).

● More than two thirds of the pilots were flying outside the privileges of their licence, often leading to structural break-up.

● Almost two thirds continued flight into adverse weather, and more than half were thought likely to have suffered from disorientation.

● Almost a quarter experienced some kind of technical failure, thus distraction was likely.’ 74 http://publicapps.caa.co.uk/docs/33/CAP667.pdf [accessed February 2020]

65 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis

Analysis 2.1 The flight from Nantes 2.1.1 Meteorological conditions The weather forecast showed a cold front moving through overnight, preceded by scattered, sometimes heavy showers. Although the flight occurred ahead of the cold front, the rainfall radar reviewed after the flight showed numerous showers in the area north of the Channel Islands on the planned route. The lack of ambient light and the weather conditions meant that the pilot would have had to rely predominately on the aircraft instruments for orientation. Night flying presents pilots with difficulties in identifying weather ahead of the aircraft. The lack of moonlight and horizon on this flight would have made it difficult for the pilot to avoid inadvertent penetration of weather and clouds. A range of illusions can affect pilots when flying at night and / or with sole reference to aircraft instruments. These illusions can rapidly cause a loss of spatial orientation which can lead to a loss of control of the aircraft. The most effective way to counter these risks is to trust the information given by the aircraft instruments ahead of internal feelings about orientation, and this requires effective instrument flying skills. While the pilot held a valid IR(R), it was considered unlikely that he had been training or practising his skills since his last renewal in May 2017 because his recorded flying had been single pilot operating under VFR. Instrument flying is a perishable skill and regular practice is required for a safe standard to be maintained. Consequently, with an apparent lack of recent practice in instrument flying, the pilot’s skills may have been significantly degraded. N264DB was flying above the forecast freezing level. Had it entered cloud, it is possible that it may have started to accumulate ice. The aircraft was equipped for flight in icing conditions and the forecast was for only light to moderate icing conditions. Pilots flying in the area at the time of the accident indicated that they encountered little or no icing at the altitudes N264DB was operating.

1. 1.2

Qualifications of the pilot The pilot held an EASA PPL, and an FAA PPL issued on the basis of his EASA licence. To operate N264DB between France and the UK, the pilot was required to use his FAA PPL because of FAA restrictions in Part 61. The FAA licence relied upon the validity of his underlying EASA PPL, but the SEP rating on the EASA licence had expired. Legal opinion from both EASA and the CAA confirmed that the lack of a valid SEP rating and night qualification meant that the pilot was not qualified to fly the aircraft at the time of the accident.

66 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis The pilot’s FAA licence did not specifically contain a day-only restriction, and the instructor who completed the pilot’s differences training for the PA-46 erroneously signed the pilot’s logbook as qualified pilot-in-command day and night. This may have led the pilot to wrongly believe he was qualified to fly at night on his FAA licence. However, both the CAA and EASA were clear that a FAA piggyback licence cannot grant a pilot qualifications or validity that do not exist on the underlying EASA licence. The timing of the initial flight plan suggested that the pilot may have initially believed that the flight was to return during the day on 21 January 2019. Subsequent refiling of the flight plan, and communications between the pilot and third parties in both Cardiff and Nantes, showed that he was aware of the later flight time by the afternoon of 20 January 2019. As a PPL holder, the pilot was not permitted to be remunerated for the flight, yet there was significant evidence to show that he was expecting to be paid. Payment brings with it some pressures for a flight to be completed so that the fee will be paid and, perhaps, to realise the opportunity to secure work in the future. The CAA maintains a database of the licence details and qualifications of all pilots who hold a UK-issued flying licence as required under EASA Part ARA. GEN.220. As the accident pilot’s licence and logbook were not recovered from the wreckage, the database information was expected to be important in establishing his qualifications. It became clear during this investigation, however, that the CAA database for the pilot of N264DB was incomplete and contained numerous errors. The pilot had scanned a copy of his licence onto his laptop, which the investigation was able to access, but without this copy erroneous conclusions might have been reached about the pilot’s qualifications and entitlements. This mismatch between database records and a pilot’s licence is not unique, and previous AAIB investigations have encountered similar discrepancies. Although the authoritative document is the licence, the competent authority, in this case the CAA, should maintain accurate information as required by EASA regulation. Therefore the following Safety Recommendation is made: Safety Recommendation 2020-005 It is recommended that the Civil Aviation Authority ensure that the system in place to meet the requirements of EASA Part ARA. GEN.220 is effective in maintaining accurate and up-to-date records related to personnel licences, certificates and ratings.

67 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis 2.1.3 Basis of the flight N264DB was permitted to operate in accordance with Part 91, which is intended for private use only. Neither the Trustor nor the individual who managed the aircraft held an AOC, and no permission had been sought or granted from the FAA or the CAA to allow the aircraft to be operated on a commercial basis. The pilot did not hold a commercial pilot’s licence and, therefore, was not permitted to receive payment for the flight. Air Taxi or Air Charter flights are commercial operations, and regulatory safety standards are more stringent than for private flights. These standards include: more highly qualified pilots whose competence is checked more frequently; more stringent airworthiness requirements for aircraft; and more operational and engineering procedures to support operations. For example, if N264DB had been operating in accordance with Part 135, it would have been mandatory for the heater muff to have been pressure-tested. The effect of more stringent measures is to reduce the risk to those using commercial services. Because N264DB was not being operated in accordance with safety standards applicable to commercial operations, the risk-reduction measures above were not in place, and this manifested itself in the flight being operated under VFR at night in poor weather conditions despite the pilot having no training in night flying and a lack of recent practice in instrument flying. Evidence presented to the investigation from multiple sources suggested that the use of ‘grey charters’ could be relatively common and widespread, although, due to the nature of the activity, it can be difficult to determine the level accurately. In addition to being subject to increased risk, present because some of the regulated safety standards may not be applied, these flights may also be uninsured. The Air Charter Association recommends steps that passengers can take before hiring an aircraft to satisfy themselves that it is licensed for commercial operations. The CAA takes a three-pronged approach to the regulation of such flights. Firstly, it seeks to educate those who may use such flights through leaflets, posters and public campaigns. Reducing demand for unlicensed services supports legitimate aviation and, thereby, increases the proportion of the travelling public receiving the benefit of appropriate safety margins. Secondly, the CAA offers support to those who wish to operate legally but have not done so due to a lack of knowledge or understanding of the regulations. Finally, the CAA seeks to catch and prosecute those who are involved in illegal or unlicensed activity. The CAA and other agencies within the UK work closely together to share intelligence and target resources, but due to the nature of this

68 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis activity it can be challenging to detect. The wider legitimate aviation community can provide vital intelligence to assist the CAA and other agencies to reduce such activity. The public can report concerns through the CAA website and be protected as Whistle-blowers if required. Safety action Following this accident, the CAA developed a campaign to raise awareness of unlicensed charter flights, including publishing a Leaflet, Legal to Fly, to inform passengers about flying safely in light aircraft and business jets. The leaflet is in Appendix C. 2.2. Final manoeuvres 2.2.1 Pilot’s use of the autopilot The autopilot and flight director system had an intermittent fault whereby the autopilot disconnected without manual intervention and in July 2017 they were placarded as inoperative. There was no record of the fault having been rectified and the investigation was given conflicting information on whether a placard was actually fitted when the pilot flew to Cardiff to collect the passenger for the outbound flight to Nantes. Analysis of the radar data, however, in particular the accuracy with which the pilot maintained heading and altitude, suggested that as the aircraft approached Guernsey the pilot was flying with the autopilot engaged and with the hdg and alt modes selected. Shortly afterwards, at 2002:10 hrs, when the pilot initially manoeuvred the aircraft to “maintain vmc”, the right turn was consistent with the autopilot being used because the bank angle was calculated to be about 22°, the autopilot’s maximum bank angle. During the left turn that followed, the bank angle exceeded the limit of the autopilot and it is therefore likely that the aircraft was being flown manually by the pilot, either with the autopilot disengaged or using the CWS function (with the autopilot engaged). Following the left turn, the aircraft’s course and altitude stabilised, suggesting that the autopilot was engaged again. At 2012 hrs, when the aircraft was about 11 nm north of Guernsey, ATC gave permission for the pilot to descend below FL50, and this was the last communication with him. Shortly afterwards (Figure 12), a right, followed by left turn was flown, during which the bank angle reached about 56°, while the aircraft descended, climbed and then descended again at a vertical speed of about 5,000 fpm. This series of turns lasted about 90 seconds, and it was likely that they were flown to remain in, or regain VMC, but they resulted in a flightpath that was unstable and inconsistent with normal cruise flight or with use of the autopilot. The investigation concluded that the aircraft was being flown manually during this period, which was shortly before it entered the final descending turn to the right.

69 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis It was not possible to ascertain whether, in the manoeuvring prior to or during the final turn, the pilot deliberately flew manually or whether the autopilot disconnected unexpectedly forcing him to do so. If the latter, it is possible that the pilot became distracted in trying to re-engage the autopilot. The CAA study into LOC accidents in IMC reported that, in almost a quarter of accidents considered, distraction was likely because there had been a technical failure. 2.2.2 Final descending turn The simulations of the final descending turn were based on radar data which was considered valid. When the aircraft entered the final 180° turn, the simulations showed the bank angle increasing to about 30° right, at which point there was a pause of a few seconds. This angle of bank equates to a rate of turn of approximately 3.7° per second, about 20% higher than in a rate one turn. After the pause, the bank angle started to increase and the nose of the aircraft dropped, causing the aircraft’s airspeed to increase quickly (at an average rate of about 1.4 kt per second). By the time the aircraft had descended from about 4,100 ft to 2,700 ft, which took about 23 seconds, the bank angle was about 90° right and the estimated airspeed was 235 KIAS, 32 kt above VNE. The high bank angle and speed were so far from normal parameters that they indicated control of the aircraft had been lost. Both simulations showed that the aircraft then started to roll to the left towards wings level. Given that both simulations suggested the same roll to the left at the same time, it was concluded that the aircraft itself probably also rolled left, which would have required a control input ie the control wheel had to be rotated left. From this point, the estimated normal loads of the two simulations diverged due to the different potential flightpaths. If the aircraft had continued to descend towards the sea, the peak estimated normal load would have reached 5.6 g as the aircraft rolled towards wings level. Alternatively, if the aircraft had pitched up to climb from 1,600 ft towards 2,300 ft, a normal load of 11 g would have been required. The simulation was based on an indestructible-aircraft model, and the actual aircraft is likely to have exceeded its structural limits before such a pull-up manoeuvre could be completed. If exceeding structural limits did lead to an in-flight breakup, unpredictable pressure effects might have caused the aircraft’s transponder to report an incorrect altitude. This introduced the possibility that the aircraft did not actually climb to the 2,300 ft its transponder reported, but instead broke up at a lower altitude.

70 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis 2.2.3 In-flight breakup 2.2.3.1 Structural damage to the aircraft Analysis of the damage to N264DB was consistent with the aircraft impacting the water at high speed in an inverted, left wing low, nose high attitude. The left wing showed evidence of failing due to downward bending force. The right wing had failed in the same area as the left wing, but it was not possible from the video evidence to determine the direction in which the right wing failed. The lack of damage to the propeller and the front of the aircraft, and the extensive damage to the upper surfaces of the wings and fuselage, were evidence that the aircraft did not enter the sea in an upright attitude consistent with controlled flight. The damage to the aircraft also indicated that it was not in a spiral dive or a spin when it struck the sea. Neither of the outer sections of N264DB’s wings nor the empennage were found at the accident site. This indicated that either an in-flight structural break-up occurred, or these parts broke off when the aircraft struck the sea and became separated from the main part of the wreckage by the fast tidal flow. The damage to N264DB showed several similarities with the findings of the NTSB special investigation into in-flight structural failures of four PA‑46‑310P (Malibu) and one PA-46-350P (Mirage):

● Three of the aircraft in the study were found in an inverted attitude with the fuselage ‘flattened’. It was not possible to ascertain the attitude at impact for two of the aircraft. N264DB entered the sea in an inverted attitude.

● In all of the accidents in the study, sections of both wings had failed in flight, with the failures mostly occurring in the area of the wing spar splice joint. The failure of the wings on N264DB occurred at the same location.

● In all of the accidents in the study, parts of the stabiliser and fin had separated from the aircraft while still in flight. These parts were also missing from N264DB. It is probable, therefore, that N264DB experienced an in-flight structural failure rather than breaking up as the aircraft struck the sea. After such a failure, the aircraft would have descended rapidly and not travelled far laterally. This was consistent with the location of the wreckage, which was very close laterally to the last secondary and subsequent primary radar positions.

71 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis 2.2.3.2 Loads on the aircraft The NTSB’s special investigation determined that the structural damage in the previous accidents was typical of overstress (overload). As a result of this finding, the aircraft manufacturer carried out a structural loads review of the wings and empennage. The review concluded that a minimum of 7.7 g would have been required to cause the wings to fail, which was well beyond the design certification requirements. The simulation suggested two possible explanations for the breakup of the aircraft during the final manoeuvre:

● The transitory loading approached 11 g when the aircraft pulled up, resulting in the structural failure of the wings.

● The aerodynamic loads, resulting from the nose-up control input with the aircraft flying substantially above VA 75, caused the structural failure of the elevator and horizontal stabiliser. Had the wings failed as a result of a high positive loading, they would have failed in an upward direction possibly damaging the upper fuselage. Given the extensive damage to the upper fuselage when it impacted the sea, it was not possible to establish if any of the damage had been caused by the wings. However, the left wing failed due to bending in a downwards direction, which was inconsistent with the first possibility. If the elevator and horizontal stabiliser failed when the aircraft was flying at a relatively high speed, the change in the balance of forces would have pitched the aircraft nose-down rapidly causing a wing to fail due to an excessive bending force. In some previous accidents where the horizontal stabiliser failed first, it was noted that one wing failed as a result of an upwards force and the other as a result of a downwards force.

It was concluded that an abrupt nose-up control input, at a speed substantially greater than VA, led to aerodynamic loads on the elevator and horizontal stabiliser which were sufficiently in excess of their design limits to cause their structural failure. Following the failure of the horizontal stabiliser, the aircraft would have pitched rapidly nose down and the subsequent aerodynamic loading would have caused the wings to fail at the splice joints. 75 Design manoeuvring speed: the speed above which full or abrupt control movements are not permitted.

72 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis 2.3 Airworthiness of N264DB before departing from Cardiff At the time of the accident, N264DB had all the necessary airworthiness documentation required to operate in accordance with 14 CFR Part 91. Maintenance records for the previous three years showed that the aircraft had undergone the scheduled maintenance required by the FAA and had regularly been certified as being in an airworthy condition by two FAA IAs who worked at different maintenance organisations. A review of the worksheets and Certificate of Release to Service showed that a considerable amount of rectification work had been carried out on the aircraft in the 13 months and approximately 65 flying hours prior to the accident flight. This included a new hydraulic pack and turbochargers as well as work to the engine, flaps and undercarriage. The last Annual / 100 hour scheduled maintenance was completed approximately seven weeks and 11 flying hours prior to the accident flight and identified no deficiencies with the aircraft. The altimeter and transponder required a calibration test but could still be used providing the aircraft did not operate under IFR in controlled airspace. The individual who managed the aircraft stated that he was unaware of any deficiencies or faults on the aircraft prior to the outbound flight from Cardiff to Nantes. At Cardiff Airport prior to the outbound flight, the pilot made no mention of any technical problems with the aircraft. Neither did he tell the three individuals in the UK, who he contacted from Nantes over the weekend, that there had been any technical problems with the aircraft before it left Cardiff. From the available evidence the investigation concluded that, prior to departing Cardiff, N264DB met the required airworthiness requirements and had no known technical faults that would have prevented it from departing on the flight to Nantes. 2.4 Technical faults at Nantes At Nantes, the pilot informed a number of individuals about four potential technical problems that had occurred on the aircraft after he departed from Cardiff. These were an engine oil leak, a loss of brake pressure, a spurious stall warning, and a ‘bang’ concurrent with a low-level mist sensed in the airframe. Over the weekend of 19 January 2019, the pilot discussed some of these problems with the individual who managed the aircraft, a UK based FAA IA, a mechanic at Nantes and Witness A. The pilot was also seen to remove the upper engine cowling and undertake an engine ground run before the return flight to Cardiff on 21 January 2019.

73 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis From photographs taken by the pilot, the engine oil leak was assessed as being no more than a ‘weep’ from the top of the air / oil separator. The pilot did not report a loss of engine oil. The radar data showed that the aircraft was operating at cruise speed until the loss of control and the pilot gave no indication during his last radio communication that he had an engine problem. Therefore, the oil leak was not considered to have been a factor in this accident. The mechanic who checked the brakes in Nantes was satisfied that they were “fine”, though the right pedal felt firmer than the left. Any brake problem was unlikely to have manifested itself until the landing at Cardiff, so the brake fault was not considered to have been a factor in this accident. The pilot pulled the circuit breaker for the stall warning system after landing at Nantes because it was operating continuously. It was not known if this fault was rectified or if the circuit breaker was reset prior to the accident flight. During the initial loss of control, the aircraft was not in a stalled condition and therefore a stall warning would not have been triggered. While a stall warning might have been triggered during the final pitch up, it would have been coincidental with the structural failure. It was not possible to establish the reason for the single bang and the mist the pilot sensed in the airframe. The pilot made no mention of the low mist to the FAA IA. He indicated that he had experienced the low mist before, but the investigation could identify no other individuals who had experienced it. To see a low mist, the pilot would either have had to look down into the footwell or rearwards into the cabin. Conditioned ram air would have been blowing out of the foot warmers onto the pilot’s feet and it is possible that what he sensed was a change in temperature of this air. The location where this event occurred was uncertain with the pilot telling a witness that it occurred mid-channel and the FAA IA that it occurred on the approach to Nantes. What was consistent was that the noise startled the pilot, whose immediate action was to check the engine, which continued to operate normally. The following causes for the loud bang and / or mist were considered:

● Bird strike

The pilot, who inspected the aircraft at Nantes, made no mention of any evidence of a bird strike.

● Failure of a turbocharger turbine

The pilot reported that he checked the engine performance in the air immediately after the event and while the aircraft was on the ground at Nantes, and it operated normally. Should a

74 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis turbine in one of the turbochargers become detached, some of the exhaust gas that would normally pass through the remaining serviceable turbocharger would pass through the common duct and into the turbine section of the turbocharger with the missing turbine. The result would be that the engine would not achieve maximum boost pressure or rpm. This was observed by the NTSB who established during testing that failure of a turbocharger turbine would affect the maximum boost and rpm of the engine and would therefore be noticeable.

● Mechanical failure of the engine

The engine continued to operate normally during the remainder of the flight. At Nantes, the pilot visually examined the engine with the top cowling removed and carried out full power ground runs, which were satisfactory.

● Cabin pressurisation

It was not possible to establish if the pressurisation controls had been correctly set or the outflow valve had stuck out of position. A sudden release of pressure through the outflow or safety valve, or a seal unseating, might have caused the noise. The resulting change in pressure, under the right atmospheric conditions, could then cause a mist to appear, which would be dispersed by the airflow through the cabin.

● Change in external atmospheric conditions

The possibility that changes in the atmospheric conditions might have generated some misting as the ram air entered the cabin through the low-level vents was considered. However, this would not have generated a noise, and the manufacturer, other operators and maintenance organisations had not heard of this occurring previously on the PA-46.

● Undercarriage settling

The undercarriage is held in the up position by hydraulic pressure. If the hydraulic pressure drops below a minimum, then the electric hydraulic pump operates to restore the pressure. The noise of the pump is distinctive, and the pump is located at the back of the cabin inside the pressure vessel, and therefore the pilot would have described the noise as coming from behind him.

75 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis

● Skin popping

Under certain pressure or temperature conditions, the skin on the flat lower part of the fuselage, below the seats, can ‘pop’ occasionally. This occurs because, under certain conditions, small changes to the skin can cause it to buckle.

● A failure of part of the exhaust system or other engine component

The pilot removed the cowlings at Nantes and examined the engine. He subsequently made no mention of having found anything unusual. Moreover, if the mist had been smoke from the exhaust entering the cabin then it should have been present for the remainder of the flight.

● Passenger’s baggage

Some of the passenger’s luggage might have been in the baggage hold located between the engine and cockpit, and it is possible that something in one of his bags made the loud noise. The pilot made no mention of damage to the passenger’s bags or the baggage hold. As the investigation was unable to determine the cause of the ‘bang’ and possible mist on the previous flight, it could not be determined if it was a factor in this accident. 2.5 The flow of CO into the cabin The level of CO in the blood of the passenger led the pathologist to conclude that he would have been deeply unconscious when the aircraft struck the water. Video footage of the passenger passing through the airport security at Nantes did not suggest that he was suffering from the effects of CO poisoning, and no witnesses commented adversely on his behaviour prior to the flight. It was therefore concluded that the passenger’s exposure to a high level of CO occurred during the accident flight. The ambient air temperature during the cruise was around 0°C, and to ensure the cabin was at a comfortable temperature the cabin heat control would have been open. With the cabin conditioning controls set correctly for either pressurised or unpressurised flight, air under pressure would have entered the cabin through the floor level vents and the windscreen demister. Providing the pilot had turned the circulation fan on, air from the back of the cabin would have been recirculated through the adjustable eyeball vents located at each seat. This air would then have passed out of the cabin

76 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis through the outflow or safety valve situated behind the rear seats where the passenger was sitting. For unpressurised flight the pilot should have set the cabin press control for unpressurised flight and the cabin dump switch in the on position. This would have allowed condition ram air to enter the cabin through the vents and to exit the cabin through the safety valve. However, if the cabin dump switch had not been selected on then the safety valve would have remained in the closed position. In this situation, the airflow through the cabin would be dependent on the position of the outflow valve. This valve would be controlled by the cabin altitude that had last been set on the altitude controller, and the differential pressure between the cabin and ambient pressures. The concentration of CO around the cabin of N264DB would have been affected by the flow and circulation of the contaminated air, which would have been dependent on how the pilot set the controls and whether individual seat vents (eyeball) had been turned on. Due to the extensive damage to the cockpit area and instrument panel that occurred during the accident sequence, the position of these controls after the accident was not a reliable indication of their in-flight setting. Possible causes of CO entering the cabin The following causes were considered that might potentially explain how CO entered the cabin or why the passenger had such high levels of COHb:

● The COHb in the passenger developed after the accident

Medical advice was that COHb cannot be produced naturally in a body after death.

● Cabin fire

The pilot did not report fire or smoke during his last radio call, there was no evidence in any of the underwater footage of a fire having occurred, and the post-mortem report on the passenger showed no evidence of a fire inside the cabin.

● Fire in forward baggage compartment

Some of the passenger’s luggage was in the forward baggage compartment located between the forward pressure bulkhead and the engine firewall. The ventilation and pressurisation pipes pass through this area before discharging the conditioned air into the cabin. CO from a fire in the baggage compartment should not pass through the pressurised

77 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis bulkhead. There was no evidence on the underwater videos of a fire having occurred in this area and no mention from the pilot of smoke or fumes entering the cabin.

● Gas from the engine exhausts entered the cabin through seals and gaps

The cabin is designed to be pressurised and therefore, even when unpressurised, it will be more resistant to this type of gas pathway than aircraft designed to be unpressurised. The accident flight lasted for approximately one hour and the aircraft flew for two hours on the outbound flight without any reports that either the pilot or passenger felt unwell. The extensive damage to the fuselage meant that it would not have been possible to identify failed seals and small gaps that were present before the accident occurred.

● Exhaust gas leak across the turbocharger

For this to be the source of CO, the cabin would need to be pressurised and exhaust gasses would need to leak along the shaft between the turbocharger turbine and compressor before entering the bleed air system, which provides pressurised air to the cabin. The pressure difference across the labyrinth seals on the turbine shaft is such that with a worn or damaged seal, oil would leak outwards along the shaft into either the turbine or compressor rather than exhaust gasses leaking inwards along the shaft. Should exhaust gasses leak past the labyrinth seal on the shaft, they would be removed by the lubricating oil and vent to atmosphere through the oil breather. It is therefore unlikely that the CO would have entered the cabin by this route.

● Leak from the exhaust system passing into the cabin.

Parts of the exhaust system might have leaked or failed allowing exhaust gasses to enter the engine compartment. For these gasses to have entered the cabin they would have needed to pass through the seals or cracks in both the firewall and the forward pressurisation bulkhead, which are separated by the baggage compartment. An inspection of the firewall and pressure bulkhead, which was carried out during the last Annual maintenance, identified no damage to either of these structures.

78 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis

● Leak through nosewheel steering bellow assembly

Exhaust gasses from the engine compartment could potentially leak through the nosewheel steering bellows into the pilot’s footwell. It is unlikely that gasses would be able to enter the cabin during pressurised flight. While there is a potential threat during unpressurised flight, the bellows and nosewheel steering controls were inspected during the Annual / 100-hour maintenance76 and it is unlikely that they would have deteriorated sufficiently in the short time before the accident flight.

● Internal failure of the Heat Exchanger

This failure mode would only occur when the aircraft was pressurised and would need two separate faults. CO from the exhaust gas would have to leak into the ram air; then the ram air in the heat exchanger would need to leak into the bleed air as it passed through the heat exchanger and into the cabin. The bleed air is at a higher pressure than the ram air, so if there was damage to the matrix in the heat exchanger the bleed air should leak into the contaminated ram air, which is then vented out of the right side of the aircraft. Therefore, this scenario was considered unlikely unless there had been significant damage to the matrix in the heat exchanger and the tailpipe heater muff.

● Failure of the right turbocharger

This failure mode would only occur during unpressurised flight. If the turbine on the right turbocharger detached in flight, there would be a possibility that it could puncture the exhaust tailpipe allowing exhaust gases to enter the ram air system through the heater muff. However, where turbochargers have previously failed in flight, the turbine has left marks in the tailpipe but not punctured it. Testing by the NTSB during another investigation revealed that following the loss of a turbine the engine would lose all its oil in a matter of minutes. Moreover, a single turbocharger would not enable the engine to obtain maximum boost and rpm.

A turbocharger failing in flight and puncturing the tailpipe might explain the loud bang and possible ‘low mist’ in the fuselage on the outbound flight to Nantes, providing the 76 PA-46-310P/350P Maintenance Manual 100 Hrs Interval Inspection, G. Landing Gear Group

79 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis

damage to the exhaust was significant enough. As neither the pilot nor passenger exhibited symptoms of high levels of COHb on arriving at Nantes, failure of the turbocharger could not have occurred mid-channel on the outbound flight. If the failure occurred at a late stage in the outbound flight, and the engine kept running, the pilot would have noticed the loss of oil and lack of performance when he carried out his ground runs at Nantes. He told several individuals that the engine performance was satisfactory. If the turbocharger failed before the aircraft departed Nantes, the loss of oil would have resulted in the engine failing soon after takeoff. Therefore, a failure of the turbine on the right turbocharger could not have occurred before the aircraft departed Nantes.

During the accident flight, the performance of the aircraft based on the radar data did not suggest that the engine had lost power. The pilot would have been alerted by a low oil pressure warning light and seen the reduction of oil pressure on the gauge, but he made no mention of an engine problem to ATC. There was also no evidence of score marks in the part of the right exhaust visible on the underwater video. It was therefore considered unlikely that the right turbocharger failed during the accident flight.

● Crack in the exhaust tailpipe

This failure mode could only occur if the aircraft was operating with the cabin unpressurised and the cabin heat on.

The pressure of the ram air passing through the heater muff is by design higher than the ambient pressure of the exhaust gas in the tailpipe. This is to ensure that in the event of damage or a crack in the tailpipe, ram air will leak into the tailpipe rather than exhaust gasses leaking into the ram air and then into the cabin. For exhaust gases to have leaked into the heater muff and pass into the cabin, there would have needed to have been a significant crack or damage to the tailpipe to allow the pressure of the ram air and exhaust gas to equalise. Given that there were no reports of the pilot or passenger feeling unwell on the outbound flight, this failure mode would have required a sudden deterioration in the exhaust during the later stage of the outbound flight or during the accident flight.

80 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis

The exhaust system was last inspected during the Annual maintenance completed on 30 November 2018, 11 flying hours before the accident. Despite the requirement to inspect exhaust systems annually, there is evidence of these types of items cracking in service between inspections. The NTSB’s Safety Recommendation to mandate the carriage of CO detectors was made following the failure of a heater muff (fitted to a different type of piston engine and aircraft) which failed six flying hours and three months after its Annual inspection. Most probable cause of CO entering the cabin From an assessment of the possible routes for CO having entered the cabin during the accident flight, the most probable cause was considered to be exhaust gasses leaking into the heater muff with the cabin heating selected on. This would have required significant damage / disruption to have occurred to the tailpipe/ heater muff during the accident flight . 2.6 The loss of control 2.6.1 CO in the cabin The pathologist considered that the passenger would have been deeply unconscious at the time of the accident and the pilot would have been exposed to similar levels of CO to the passenger. The toxicology results of the four occupants fatally injured in an accident involving a PA-28 showed that individual levels of COHb can vary between individuals occupying a compartment contaminated with CO. Although the available information did not allow a quantitative determination to be made, it is likely that the pilot was affected to some extent by the effects of CO poisoning. 2.6.2 Aircraft control during manoeuvring beginning at 2012 hrs Four minutes prior to the accident, at 2012 hrs, the pilot was talking lucidly on the radio explaining that he was going to manoeuvre to avoid poor weather. This suggested that, if he had already been exposed to CO, the symptoms were at the lower end of the scale. The flightpath over the following 90 seconds was unstable and included high bank angles and rates of climb and descent inconsistent with normal cruise flight. There were four scenarios which might have accounted for this erratic flying:

● The pilot manoeuvred in this way deliberately, probably to avoid IMC or to regain VMC (having inadvertently entered IMC).

81 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis

● The pilot was having difficulty in controlling the aircraft, probably while manoeuvring to avoid IMC or regain VMC. His lack of training in night flying and his lack of recent practice in instrument flying support this possibility because they are likely to have made him more susceptible to disorientation through visual and / or vestibular illusions.

● The pilot was beginning to suffer from the symptoms of CO poisoning, which were affecting his ability to control the aircraft.

● A combination of some, or all the scenarios above. 2.6.3 Aircraft control during the final turn Shortly after the aircraft flightpath stabilised from this manoeuvring, the pilot entered the final turn, and it was likely that this turn was flown either to avoid IMC or to regain VMC. It was concluded earlier that the high bank angle and speed in that turn were so far from normal parameters that they indicated control of the aircraft had been lost. Considering the four scenarios in paragraph 2.6.2:

● It was unlikely that the pilot manoeuvred in this way deliberately to avoid poor weather because the flightpath was so extreme that it represented a greater risk than the weather he would have been trying to avoid.

● The CAA review of fatal LOC accidents in IMC showed that common factors were:

– Pilots having no IR or IR(R).

– Pilots flying outside the privileges of their licences.

– Pilots flying outside limits, often leading to structural break-up.

– Disorientation.

– Distraction due to technical failure.

It was likely, therefore, that the pilot’s lack of training in night flying and his lack of recent practice in instrument flying were, in themselves, sufficient to increase the risk of loss of control while manoeuvring manually at night in the vicinity of poor weather.

82 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis

● It was likely that the pilot was by this stage suffering from the symptoms of CO poisoning to an extent that was inhibiting his ability to control the aircraft.

● It was concluded in paragraphs 2.2.2 and 2.2.3 that the end of the flight was marked by the aircraft rolling left and pitching upwards before breaking up. The roll left would have required the control wheel to be rotated left, and this motion might have been achieved by the pilot consciously or by him slumping onto the left side of the control wheel. The pitch up, however, would have required the control wheel to be moved rapidly aft, which would not have been possible if the pilot was completely unconscious. It appeared likely, therefore, that the pilot had at least some level of function at this point in the flight.

The roll and pitch inputs on the control wheel were consistent with an attempt to recover the aircraft from its extreme attitude and rate of descent. If both inputs were made consciously, it was possible that the pilot regained some level of situational awareness and tried to recover the situation, albeit perhaps with excessive control inputs. In summary:

● The pilot’s ability to control the aircraft was probably impaired by the effects of CO poisoning, but he appeared to have some level of function at a late stage of the flight.

● The pilot’s lack of training in night flying and recent practice in instrument flying is likely to have increased the risk of loss of control. It was not possible to quantify the extent to which either factor contributed to events, but it was likely that the loss of control was made significantly more likely by the probability that the pilot was affected by CO poisoning. 2.7 Measures to reduce the risk of CO poisoning N264DB had not been fitted with a CO detector with an active warning, but might have been fitted with a passive, spot (strip) detector, which could have been out of date. Even if it had been in date, its location in front of the right seat would have been of little use in alerting the pilot to the presence of CO when flying at night. Had the pilot been aware of the presence of CO, he would have been able to take measures to reduce the risk to himself and his

83 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis passenger, such as those detailed in SIB 2020-01, but there is no requirement for GA aircraft to be fitted with a CO detector. Instead, it is the owner’s / pilot’s discretion as to whether they fit or carry a detector in the aircraft. CO poisoning has been established as a factor in a number of accidents and serious incidents involving single engine piston aircraft. It is possible that there might have been more events, but detection is dependent on toxicology tests having been carried out, and the evidence of CO poisoning can be masked if there has been a post-crash fire. Mechanical evidence can also be destroyed in an accident. Assessing the true extent of the risk is also difficult because it relies predominantly on private pilots raising an occurrence report for a hazard that cannot be seen or smelt. It is also difficult to establish how often key components, such as heater muffs, are repaired or replaced because there is no requirement to collate this information. The BEA and NTSB have made Safety Recommendations to aviation regulators to mandate the carriage of CO detectors, but they were not accepted, and the AAIB previously made a Safety Recommendation for the CAA to promote the carriage of detectors. While the CAA, EASA and FAA promote the carriage of CO detectors, many pilots still do not appear to understand the hazard and risk and at best only carry a strip or spot detector. Regulators mandate two barriers77 to prevent CO poisoning: initial design and regular in-service inspections. EASA has published a CS-STAN to facilitate the installation and replacement of CO detectors through standard changes, and many manufacturers have chosen to fit detectors to new aircraft. However, this is not a mandatory requirement and will not address the large fleet of ageing piston engine aircraft. The CAA, EASA and the FAA have all produced a specification for CO detectors and EASA has introduced a standard modification to make it easier for pilots to fit them to their aircraft; however, there is no requirement for pilots to do so. There is considerable evidence that the second barrier, regular inspections, is not entirely effective. Not only is it difficult to carry out a thorough inspection of all the exhaust components in the crowded engine compartment, it is possible that a mechanic will miss a small crack or subtle signs of a leak. This was noted in Service Difficulty Reports where exhaust systems passed a visual inspection but then failed a pressure test. Moreover, corrosion and erosion occur from the inside of the exhaust system and can be difficult to detect without first dismantling the system. Manufacturers and regulators have issued comprehensive advice and service bulletins on how to carry out an inspection of an exhaust system. However, 77 Safety barriers, or risk controls, attempt to prevent, control or mitigate undesired events.

84 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis for GA aircraft such as N264DB operating under the provision of 14 CFR Part 91 this advice is not mandatory, and it is for owners and their maintenance organisations to determine the depth and extent of the inspections. It would be difficult for regulators to mandate detailed inspections for the wide range of GA aircraft and exhaust systems currently in service. Moreover, it has been seen from other events that cracks and faults can initiate at any time. While periodic inspections can help reduce the risk, they will not catch every event. CO poisoning is known in the UK as the ‘silent killer’ as the gas cannot be seen, smelt or tasted and its effects can lead to a reduction in performance, permanent injury or death. Even the minor effects of CO poisoning can have a fatal consequence when operating an aircraft. As the existing two barriers to prevent CO poisoning (design and inspections) are not always effective, there is a need for a third barrier to alert pilots to the presence of CO in the cabin in time to take effective action. Low cost warning devices are readily available, and their carriage is actively encouraged by the regulators. Regulators have also produced specifications for CO detectors with active warnings. Although the carriage of a CO detector is at the owner’s and pilot’s discretion, it is unlikely that passengers, pilots under training and individuals who use cost sharing websites understand the risk. Therefore, the following Safety Recommendations are made: Safety Recommendation 2020-006 It is recommended that the Federal Aviation Administration require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide. Safety Recommendation 2020-007 It is recommended that the European Union Aviation Safety Agency require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide. Safety Recommendation 2020-008 It is recommended that the Civil Aviation Authority require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide.

85 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis 2.8 Guidance in maintenance manuals While the engine manufacturer produced guidance on how to examine its exhaust system, this guidance was not included or directly referenced in the aircraft manufacturer’s 100-hour / Annual maintenance schedule. There was a warning in the introduction of the aircraft maintenance manual about consulting vendor publications, but there was no specific requirement in the 100-hour / Annual maintenance schedule for the PA-46-310P to pressurise the exhaust system to check for leaks. During the last two Annual maintenance inspections of N264DB, two separate maintenance organisations carried out an inspection of the exhaust system. Both stated that their normal practice was to pressure test the exhaust, but neither had records to show that such a test had been carried out. The aircraft manufacturer’s maintenance schedule (which they used) did not call for the exhaust system to be pressure tested, and there was no AD for the exhaust system on the PA-46-310P to be pressure tested when operating in accordance with 14 CFR Part 91. The following Safety Recommendation is made to direct maintenance organisations and mechanics to the guidance in the engine manufacturer’s manual to pressure test the exhaust system during scheduled maintenance: Safety Recommendation 2020-009 It is recommended that Piper Aircraft Inc. ensure that the 100-hour / Annual maintenance schedule for the PA-46 variants references the engine manufacturer’s guidance, where available, on inspecting and testing the exhaust system. Detailed advice is readily available on how to inspect exhaust system components and check for leaks using pressurised air and soapy water. The engine manufacturer in its guidance document advised: ‘Inspect the heat exchanger seams, joints and transitions with a flashlight and mirror or a flexible borescope for physical damage, cracks, corrosion, and burn-through.’ While the shroud was removed on N264DB during the previous Annual maintenance, neither the aircraft maintenance schedule nor the guidance from the engine manufacturer explicitly specified that it should be removed as part of the inspection. Without first removing the shroud and any other jackets, it would be difficult to detect cracks, damage on the outside of the exhaust tailpipe, or leaks into the cabin conditioning system through the heat exchanger. Note: Section 2.8 Second paragraph This paragraph was amended on 4 Feb 2022. Full details can be found in the correction on page ix of this document.

86 Analysis © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 2 - Analysis Safety Action Following this accident, the engine manufacturer stated that it would:

Work with Original Equipment Manufacturers to determine the best way to convey the importance of thorough exhaust system inspections.

Review its maintenance and overhaul manuals to determine whether additional elaboration would increase the chance of a qualified mechanic finding a potentially unairworthy condition. It undertook to complete this review in order to have any amplifications implemented in the next FAA approved version of its Standard Practice Manual (M-0).

87 Conclusions Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 3 - Conclusions

Conclusions 3.1 Findings

There was no evidence to suggest the pilot and passenger were not fit and healthy prior to the flight or that the pilot was not well-rested.

The pilot was operating on an FAA PPL issued on the basis of his existing EASA PPL and subject to the validity of its ratings.

The SEP rating on the pilot’s EASA licence expired in November 2018 and he had no night rating, so he was not qualified to fly the aircraft at the time of the accident.

The pilot’s PPL did not permit him to receive remuneration for flying, but he was to be paid a fee for the accident flight.

It is likely that the pilot felt some pressure to complete the return leg of the flight even though it would be at night and in poor weather.

The aircraft had valid Registration, Airworthiness and Release to Service Certificates, and the required scheduled maintenance had been completed.

The aircraft was operated in accordance with 14 CFR Part 91, General Operating and Flight Rules, and maintained in accordance with Part 43, Maintenance, Preventive Maintenance, Rebuilding, and Alteration.

The regulations under which the aircraft was operated and maintained permitted it to be used for private use only. No permission had been sought or granted which allowed the aircraft to be operated commercially.

The aircraft was not being operated in accordance with safety standards applicable to commercial operations.

The autopilot and flight director had been diagnosed as having an intermittent fault and should have been placarded as inoperative.

Just after 2012 hrs, a series of turns was flown over about 90 seconds, probably so that the aircraft would remain in, or regain VMC. During the turns, the flightpath was unstable and inconsistent with normal cruise flight or with use of the autopilot.

88 Conclusions Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 3 - Conclusions

At 2016 hrs, the aircraft began a turn to the right and began to descend. As it descended through approximately 2,700 ft amsl, the angle of bank was approximately 90° and the airspeed was approximately 235 KIAS.

The aircraft attitude and speed were so far from typical values encountered in normal operations they indicated that the autopilot was not engaged and control of the aircraft had been lost.

At approximately 2016:30 hrs, as the aircraft descended below 2,700 ft, there was an abrupt nose-up pitch input when the airspeed was at least 100 kt above VA, the speed above which full or abrupt control movements are not permitted.

During the subsequent pull-up manoeuvre, aerodynamic loads exceeded design limits and caused the structural failure of the elevator and horizontal stabiliser, followed by the structural failure of both wings at the splice joints.

The last secondary radar contact with the aircraft was at 2016:34 hrs.

The aircraft struck the sea in an inverted, left wing low, nose-high attitude.

The impact with the sea was not survivable.

There was no evidence of fire.

While the possibility of aircraft icing could not be discounted, it is unlikely that icing was a factor in the accident.

It could not be determined what caused the reported ‘bang’ and mist on the previous flight, and whether it was a factor in this accident.

The faults with the stall warning, brakes and oil leak reported by the pilot at Nantes were not a factor in the accident.

At the time of the accident, the passenger’s blood had a very high level of COHb, and it was likely that the pilot was also affected to some extent by CO poisoning.

Although the level of COHb in the pilot’s blood could not be determined, it was likely that his ability to control the aircraft was impaired during the later stages of the flight, thereby significantly increasing the likelihood that control would be lost.

89 Conclusions Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 3 - Conclusions

The abrupt pull-up of the aircraft just before it broke up required the control wheel to be pulled aft, and therefore the pilot probably retained some level of function at this time.

The most likely reason for CO to have entered the cabin was a failure of the part of the exhaust tailpipe containing the heater muff, which allowed exhaust gas to mix with the ram air and enter the cabin through the cabin conditioning system.

The exhaust system, including the heater muff, was inspected during the Annual maintenance 11 flying hours before the accident. In a different accident, a muffler has been known to fail six flying hours after inspection.

There was no record that a pressure test of the heater muff was carried out during either of the two previous Annual maintenance inspections. Under 14 CFR Part 91, the 100‑hour / Annual maintenance schedule did not call for such a test to be carried out.

The 100-hour / Annual maintenance schedule did not directly reference the engine manufacturer’s guidance on how to examine the exhaust system.

In-service inspections of exhaust systems do not eliminate the risk of CO poisoning.

There is no requirement for CO detectors to be carried on piston engine aircraft, although regulators advise pilots to do so. 3.2 Causal factors

The pilot lost control of the aircraft during a manually-flown turn, which was probably initiated to remain in or regain VMC.

The aircraft subsequently suffered an in-flight break-up while manoeuvring at an airspeed significantly in excess of its design manoeuvring speed.

The pilot was probably affected by CO poisoning. Note: Findings 27 and 28 The first sentences of these two findings were amended on 4 Feb 2022. Full details can be found in the correction on page ix of this document.

90 Conclusions Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Section 3 - Conclusions 3.3 Contributory factors

A loss of control was made more likely because the flight was not conducted in accordance with safety standards applicable to commercial operations. This manifested itself in the flight being operated under VFR at night in poor weather conditions despite the pilot having no training in night flying and a lack of recent practice in instrument flying.

In-service inspections of exhaust systems do not eliminate the risk of CO poisoning.

There was no CO detector with an active warning in the aircraft which might have alerted the pilot to the presence of CO in time for him to take mitigating action.

91 Safety Recommendations © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 4 - Safety Recommmedations

Safety Recommendations and Action 4.1 Safety Recommendations

The following Safety Recommendations are made in this report: Safety Recommendation 2020-005 It is recommended that the Civil Aviation Authority ensure that the system in place to meet the requirements of EASA Part ARA. GEN.220 is effective in maintaining accurate and up-to-date records related to personnel licences, certificates and ratings. Safety Recommendation 2020-006 It is recommended that the Federal Aviation Administration require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide. Safety Recommendation 2020-007 It is recommended that the European Union Aviation Safety Agency require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide. Safety Recommendation 2020-008 It is recommended that the Civil Aviation Authority require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide. Safety Recommendation 2020-009 It is recommended that Piper Aircraft Inc. ensure that the 100‑hour / Annual maintenance schedule for the PA-46 variants references the engine manufacturer’s guidance, where available, on inspecting and testing the exhaust system.

92 Safety Recommendations © Crown Copyright 2020 Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 Section 4 - Safety Recommmedations 4.2 Safety Action Following this accident, the following safety action was taken: Safety action taken by the CAA The CAA developed a campaign to raise awareness of unlicensed charters, including publishing a Leaflet, Legal to Fly, to inform passengers about flying safely in light aircraft and business jets. Safety action taken by the engine manufacturer The engine manufacturer stated that it would:

Work with Original Equipment Manufacturers to determine the best way to convey the importance of thorough exhaust system inspections.

Review its maintenance and overhaul manuals to determine whether additional elaboration would increase the chance of a qualified mechanic finding a potentially unairworthy condition. It undertook to complete this review in order to have any amplifications implemented in the next FAA approved version of its Standard Practice Manual (M-0).

93 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix A Scheduled maintenance and fault history Maintenance organisations Work undertaken on N264DB during the three years before the accident was carried out predominately by three maintenance organisations, which will be referred to as organisation A, B, and C. Scheduled maintenance Annual / 100-hour maintenance, 30 November 2018 (Organisation A) The documentation1 for the last Annual / 100-hour maintenance recorded the scheduled inspection as having been carried out at 6,636.2 airframe hours, which was approximately 11 flying hours prior to the accident flight. The undercarriage circuit breaker was replaced during this maintenance activity. The Certificate of Release to Service signed by the FAA IA had a statement that ‘the Altimeter and Transponder were due 24/07/17’. FAA regulations2 only permit aircraft to fly in controlled airspace under IFR providing each altimeter and automatic pressure altitude reporting system has been tested and inspected within the previous 24 months. Annual / 100-hour maintenance,15 December 2017 (Organisation B) The previous Annual / 100-hr maintenance was completed on 15 December 2017, at 6,583.4 airframe hours. During the inspection the shroud around the right tail pipe was removed in order to inspect the tail pipe heater muff. The maintenance organisation stated that it normally carried out a pressure test of the heater muff but had no record of having done so on this occasion. However, had the inspection revealed any evidence of possible damage or deterioration then a pressure test would have been carried out. In addition to the scheduled maintenance called up in the Annual / 100-hr schedule, the following work was carried out:

● Replacement of both turbochargers, which would have entailed the removal of the tailpipe / heater muff.

● Replacement of several exhaust system parts.

● Testing of the pitot static system.

● Removal and refitment of the numbers 2 and 5 cylinders following overhaul. 1 Piper aircraft PA-46-310P / 350P Maintenance Manual 5-20-00. 2 Federal Aviation Regulation (FAR) Section 91.215 (a) and 91.411.

94 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix A (cont)

● Turbine Inlet Temperature probe replaced and system tested.

● Brake callipers cleaned and tested.

● Ailerons re-rigged.

● Flap actuators removed and inspected. Several flap bell cranks removed for rework. Flaps re-rigged.

● Nose landing gear trunnion replaced. Recent fault history There were no recent faults recorded in the aircraft or engine logbook, but the following faults were identified from worksheets completed outside of the Annual maintenance: 21 October 2018 (Organisation A) The following rectification work was carried out by the maintenance organisation which completed the Annual maintenance in 2018:

● ‘Circuit breaker trips on undercarriage selection. Undercarriage hydraulic powerpack replaced and retraction tests carried out satisfactory [sic]’. The work was certified by an FAA IA and A&P3 inspector.

● ‘Exhaust system TIT probe unserviceable. The probe was replaced, and a system ground run was carried out satisfactory [sic]’. The work was certified by an FAA A&P inspector. 28 July 2017 (Organisation B) The work below was carried out by the maintenance organisation that carried out the Annual maintenance in 2016 and 2017. The work order was signed by an FAA IA.

● ‘Work to be carried out: Carry out a full hydraulic system test’.

– ‘Aircraft placed on jacks, landing gear and flap hydraulic system tests carried out i.a.w PMM 27-50-00, 29-10-00 & 32-30-00 all found satisfactory for continued service.’ 3 A&P: airframe and propulsion.

95 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix A (cont) 12 July 2017 (Organisation C) In early July 2017, the aircraft was taken to Organisation C, which had not previously carried out an Annual maintenance on this aircraft, for an assessment of possible faults on the autopilot, undercarriage and flap system. An FAA IA recorded the following tasks and rectification in the FAA worksheets:

● ‘Jack aircraft.

– Aircraft jacked.

● Check Hydraulic System pump.

– Inspection of hyd [hydraulic] pack showed very low fluid level, pump removed, found pump drive shaft oil seal worn allowing oil into the motor, motor cleaned, hyd level set to full, system placarded inop [inoperative] until seal/motor changed work carried out iaw AMM Sect 29-10-0.

● Operation of flap system caused hyd over pressure to 2050 psig, excessive play in flap linkage.

– Flap system placarded inop aircraft released for (1) one ferry flight to its maintenance base at Coventry Airport.

● Undercarriage system operating satisfactory [sic].

– ‘Check of u/c [undercarriage] system iaw Sect 32-3-000 was satisfactory however excessive wear in all u/c. Placarded inop, until wear rectified, aircraft released for (1) one flight only to a Maintenance Base at Coventry airport.

● Check A/P [autopilot].

– ‘A/P System tested found F/D [flight director] not working correctly Tripping A/P out. A/P placarded inop, FD placarded inop.’ The completed work sheets were retained by Organisation C. No entry was made in the aircraft logbook regarding the unserviceable systems and no Certificate of Release to Service was issued. The FAA IA who made the entries in the worksheets stated that he verbally briefed the condition of the aircraft to the individual who managed the aircraft and tasked him with the work.

Organisation C also sent an e-mail to the individual who managed the aircraft explaining what had been found, saying that there were two airworthiness issues on the aircraft concerning the operation of the landing gear and flaps. Arrangements

96 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix A (cont) were then made for the aircraft to be flown with the undercarriage down and the flaps inoperative to another airfield for the faults to be repaired. However, as nothing was recorded in the logbook, Organisation B, which subsequently investigated these faults, said they were unaware of these findings. For the aircraft to undertake a ferry flight, it required a Special Ferry Permit issued by the FAA International Flight Standards Office Designated Airworthiness Represented (DAR-T) who is based in the USA. No Special Ferry Permit had been requested or issued. 17 February to 19 August 2016 (Organisation B, Independent avionic technician) Between 17 February and 19 August 2016 an avionic technician, who held an EASA Part 664 licence, investigated an intermittent fault on the autopilot and flight director system. During this period, the autopilot was removed and sent to the USA for testing, but no fault was identified. The autopilot and a replacement flight director were fitted to the aircraft and the intermittent fault remained the same. It was subsequently established that manipulation of the connector at the rear of the autopilot computer caused the system to work satisfactorily. A later model autopilot computer was tested on the aircraft and despite manipulation of the rear connector the fault did not reappear. The mechanic advised the individual who managed the aircraft of the finding and recommended that the autopilot computer should be replaced with a later model. However, it was decided to refit the original unit and placard it as INOP. A placard is a label that is attached either on the equipment or on the instrument panel next to the instrument or equipment to alert the pilot to any limitations. On 27 July 2017, the avionic mechanic received a phone call from Organisation C which was investigating an intermittent fault on the autopilot system. The mechanic informed Organisation C of his findings and recommendation to replace the autopilot computer. The investigation into the accident involving N264DB could find no documentation or evidence that the computer had been replaced or the intermittent fault rectified. 4 The technician’s Part 66 (B1 & B2) licence allowed him to certify avionic work on EASA regulated aircraft. He did not hold any FAA licences, and any work he carried out on N264DB would have to have been certified by the FAA IA at Organisation B.

97 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix A (cont) 7 January 2016 (Organisation A) An FAA IA inspector recorded the following work in a worksheet and signed a Certificate of Release to service.

● ‘Investigate poor performance from port brake.

– Brakes on port pedal failed. [Redacted] requested work to restore left foot motor. Drive to Gamston and back bleed brakes. Peddle restored. After third flight failed again. Trip back to Gamston. P1 & P2 foot motors removed, cleaned, resealed and refitted. Braking system bled of air. Brakes operated. P1 & P2 brakes now satisfactory.’

98 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix B Search for, and survey of the aircraft wreckage Search and rescue On 21 January 2019, at 2024 hrs, Jersey Air Traffic Control informed Guernsey Coastguard that they had lost radio and radar contact with a light aircraft, callsign N264DB, with two persons on board, flying at 2,000 feet approximately 15 nm north of Guernsey. A search operation commenced at 2055 hrs on 21 January 2019 and included: the lifeboats from Guernsey and Alderney; Channel Islands Air Search aircraft; three coastguard helicopters; a fixed wing aircraft from the UK; helicopters and fixed wing aircraft from France; a privately-owned helicopter based in Brechou Island; a number of fishing and merchant vessels; and searchers on foot. The search was coordinated by Guernsey Coastguard, assisted by: Alderney Coastguard; Jersey Coastguard; HM (UK) Coastguard; and CROSS Jobourg (France) and Guernsey air traffic control. A cumulative area of 1,800 square miles was searched but no wreckage or survivors were found. The Guernsey Coastguard made an announcement that the search had been suspended at 1515 hrs on 24 January 2019; broadcasts to shipping to look out for the wreckage continued for a further 48 hours. Surface wreckage In the week following the accident, members of the public found two seat cushions near Surtainville, an arm rest at Tréauville and a section of fuselage skin at Sainte-Maire de la Mer along the coast of the Cotentin Peninsula, France.  A seat cushion also washed up in Bonne Nuit Bay on the North Coast of Jersey (Figure B-1). Recovery of passenger seat by fishing boat On 26 September 2019, the crew of a trawler informed the French authorities that they had brought up what they believed to be an aircraft seat while conducting a trawl approximately 7 km to the west of the location of the main wreckage site. The seat was assessed by the AAIB as the left middle passenger seat from N264DB (Figure B-2).

99 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix B (cont) Figure B-1 Location of aircraft wreckage washed-up on shore Figure B-2 Passenger seat from N264DB

100 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix B (cont) AAIB activity to locate and survey the wreckage Following an aircraft accident at sea, an underwater search operation may be undertaken by the Safety Investigation Authority (SIA) leading an investigation to locate and gather evidence which may establish the cause of the accident.  The decision to conduct an underwater search is determined on a case-by-case basis, and a search is only carried out if it is considered safe and practical to do so.  The aim of a search is to determine the location of the wreckage and to undertake an underwater survey; wreckage is only recovered if it is considered safe, feasible and necessary in order to understand the cause of the accident. Probable location of the wreckage on the seabed On the morning of 22 January 2019, while the search and rescue operation was ongoing, the AAIB started to collect and analyse radar data to establish the probable location of the aircraft wreckage. At the same time, the Ministry of Defence’s Salvage and Marine Operations (SALMO) Project Team started working with the AAIB to determine options for locating the wreckage and the feasibility of conducting an underwater survey. The AAIB established the most likely location for where the aircraft struck the surface of the sea by analysing radar data and the flight profile during the final minutes of the flight.  SALMO then factored in the depth of water and tidal flow to determine the primary area for the seabed search, which was an area of 4 nm2 approximately 22 nm north-north-west of Guernsey.     Coordination of the seabed search Through SALMO, the AAIB contracted a specialist survey vessel, the Geo Ocean III, to undertake an underwater survey of the seabed to try to locate and identify wreckage from the aircraft. The ship was not equipped to recover the aircraft.  Close liaison was established with a privately funded search, conducted on behalf of the passenger’s family by Blue Water Recoveries, to maximise the probability of locating any wreckage and to ensure a safe search operation.  On 30 January 2019, the AAIB held a meeting with SALMO and a representative of Blue Water Recoveries to agree a strategy and protocols for the search. The search was planned to be conducted in two phases.  The first phase would be a survey of the seabed using towed side-scan sonar to identify objects of interest. This phase would be carried out by two vessels: the Geo Ocean III, contracted on behalf of the AAIB, and FPV Morven, contracted on behalf of the passenger’s family.  The second phase would be an examination of those objects when the tidal flow allowed, using the camera on a Remotely Operated Vehicle (ROV) deployed from the Geo Ocean III (Figure B-3). 

101 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix B (cont) Figure B-3 ROV on Geo Ocean III To ensure safe separation between the vessels and towed sensors during the first phase, and to maximise the efficiency of the search, the area was split into two parts and each vessel was allocated one part (Figure B-4). The prime area of interest would be searched by both vessels. 

102 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix B (cont) Figure B-4 Seabed search strategy Both vessels began their side-scan survey of the seabed on the morning of 3 February 2019.  Early in the search, the FPV Morven identified an object of interest at a depth of approximately 68 m and cleared the immediate area. The Geo Ocean III subsequently used its own side‑scan sonar to observe the object (Figure B-5). Figure B-5 Side-scan sonar image of N264DB

103 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix B (cont) Identification and survey of the wreckage The Geo Ocean III began a search of the seabed near the object of interest using its ROV, which was equipped with a video camera, and the object was identified as the wreckage of N264DB (Figure B-6). Figure B-6 Tail section of N264DB on seabed at a depth of 68 m The fast tidal flow limited the period that the ROV from Geo Ocean III could operate between tides in the area of the wreckage. Despite this restriction, the ROV undertook ten dives between 3 and 6 February 2019 before the weather deteriorated and the ship had to return to shore. During the dives a full video survey of the wreckage and surrounding area was carried out. The body of the passenger was found held in place by the wreckage and recovered to the ship, but there were no signs of the pilot in the wreckage or surrounding area. Subsequent video survey by Blue Water Recoveries On 27 February 2019, Blue Water Recoveries, acting on behalf of the pilot’s family, arranged for divers to search the wreckage to look for signs of the pilot, but he was not found. The AAIB provided the divers with a briefing on the investigation’s areas of interest in the wreckage, and they carried out a focused video survey using small handheld cameras. Three video recordings, lasting 21 minutes, were subsequently provided to the AAIB to assist with the assessment of the damage to the aircraft. Figure B-7 shows an image from one of the video recordings, showing the heater muff and turbocharger.

104 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix B (cont)

Figure B-7 Right tailpipe and heater muff / shroud (image taken from video provided by Blue Water Recoveries) Assessment of the wreckage The videos enabled an assessment of the wreckage to be undertaken to help determine the accident sequence and eliminate possible causes. They also enabled an assessment to be made of the potential benefits to the investigation in recovering the wreckage. Given the depth of water, strong tidal currents and poor sea conditions, it was considered that the benefits to the investigation in recovering the wreckage over the winter months were outweighed by the risks and cost involved. The wreckage was also expected to deteriorate during that period as a result of being in salt water and subject to fast tidal currents. The feasibility and potential benefit of recovering the wreckage was reviewed periodically during the investigation, with a major review taking place after the high level of COHb in the passenger’s blood was identified by the toxicology report. However, it was concluded that the poor condition of the wreckage meant its recovery was unlikely to add significantly to the investigation, and therefore the cost and risk involved were not justified. The relevant safety issue of CO entering the cabin had been identified and could be addressed with the evidence already collected. Images from the video recordings taken by the ROV from Geo Ocean III are shown in Figures B-8 to B-12.

105 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix B (cont)

Leading edge Fuselage Flap Figure B-8 Remains of right wing

Damaged firewall Forward baggage compartment Damaged pressure bulkhead Extensive damage to structure and skin on left side of cockpit Figure B-9 Forward of cockpit

106 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix B (cont)

Damage to engine, exhaust and induction systems Damage and disruption to cockpit area Figure B-10 Disruption to cockpit and engine Disruption to instruments and controls Figure B-11 Damage and disruption to instruments and controls

107 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix B (cont) Missing fin Missing horizontal stabiliser Figure B-12 Missing fin and horizontal stabiliser Correction: In April 2021, it was noted that Figure B-4, Appendix B, showed an error in the planned progression of the search vessels. This Figure has now been updated and the correct version is shown in this report. Full details of the correction can be found on the AAIB Website on the N264DB report page: (https://www.gov.uk/aaib-reports/aircraft-accident-report-aar-1-2020-piper-pa-46- 310p-malibu-n264db-21-january-2019) The online version of the report was corrected on 26 April 2021.

108 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix C CAA Campaign on Unlicensed Charters

What does it mean if  you are told that your  flight is a ‘cost sharing’  arrangement?  Non‐commercial pilots can carry passengers in  exchange for a fi  contribution to the costs of the  fl  without requiring an AOC. The costs must be  shared between everyone on‐board the fl  including  the pilot. Only the direct costs may be shared i.e.  fuel, landing and handling fees. These fl  can be  advertised online through dedicated fl  platforms which connect pilots  with passengers, but  the pilot has the right to amend or cancel the flight  at short notice. The pilot must deal directly with the  passenger, not through an intermediary and must  provide a full safety briefing ahead of the flight.  Cost sharing flights are regarded as private  arrangements and do not therefore meet the  same safety standards as AOC flights.    More details can be found at caa.co.uk/General‐  aviation/Aircraft‐ownership‐and‐maintenance/Cost‐  sharing‐flights/  You can also travel legally as a non‐paying passenger  in a light aircraft operated by a private pilot. The pilot  has sole responsibility for the conduct of the flight and  you fly at your own risk. However, no money must  change hands and the flight must be operated entirely  at the expense of the pilot.  Passengers can also pay for an ‘experience flight’ in  an historic aircraft, such as a Spitfire. The company  providing these flights does not need to hold an AOC  but will be specially approved by the CAA to ensure  they are operating safely.  Never assume your flight is legal and never accept a  flight on trust.        Make sure you’re safe – ask to see proof of an AOC Visit  caa.co.uk/flysafe  for more information  Everything you  need to know  about  flying safely  in light aircraft  & business jets 

109 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix C (cont) If you are a paying  passenger in an aircraft  other than a scheduled  airliner, how can you  be sure your flight is  legal and safe?     Whether you are flying as a passenger on  business or leisure, if you or your employer  has paid for a flight in a light aircraft or business  jet then that flight must meet certain safety  standards. Such a fl  often called an air taxi or  an air charter, is recognised in law as commercial  air transport and should never be considered  as a private arrangement. The organisation or  individual operating the flight must have the  correct certifi    insurance and licences. If you  pay for a fl  which is unlicensed there could  be serious consequences  for  your  safety  and  you may not be insured. If you knowingly use  an illegal operator you may also be breaking the  law and could be prosecuted.    Make sure your flight is  protected. Unscrupulous aircraft  operators do exist. These people  are only too willing to exploit the  good faith of paying passengers  for a quick profit. Help us stamp  out this illegal and dangerous  activity by only using approved  operators.        You should do your own  research by finding out the  name of the organisation  actually providing the flight (the  operator). The company who  sold you the flight (the ticket  seller) may be a different entity.  By law you must be told the  name of the operator. You can  then check if they are legal by  visiting  caa.co.uk/aocholders.  You should also ask for the name  and qualifications of the pilot.        If you cannot find out the  company name, contact us at   fod.admin@caa.co.uk and we  will look into it for you.    Any  company,  organisation  or individual that operates  public transport flights must  have permission from the Civil  Aviation Authority.  They will  need to hold an Air Operator’s  Certificate (AOC) to prove they  meet all relevant insurance  and  safety  requirements.  Such  operators will be regularly  inspected and audited by the  CAA, and the pilot will need to  have a  commercial  licence.        If a flight has been arranged for  you, and you are not sure about  the status of that flight, do not  assume it is legal. Do your own  research and find out if the  operator has an AOC. If you are  told the operator does not need  an AOC,  ask  why  not.        If you think you are being offered  an illegal flight report it to the  CAA  iet@caa.co.uk. We  will  prosecute illegal operators. 

110 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix D Extract from Continental Aircraft Engine Maintenance Manual: Standard Practice for Spark Ignited Engines The following extract is taken from the Continental Aircraft Engine Standard Practice Maintenance Manual (Publication M-0), which was first issued on 15 April 2016, to bring together in one document a number of standard practices. This Manual is applicable to the TSIO-520-BE engine fitted to N264DB. The introduction to the manual states: ‘This manual incorporates maintenance and service information contained in Continental Motors Service Documents common to the horizontally opposed, spark ignition, AvGas aircraft engines conforming to Type Certificate held by Continental Motors. This document is supplemental to the Instructions for Continued Airworthiness provided in the manuals listed in Section 1-1.1. Instructions contained in the Service Documents listed in Section 1-2.4 are superseded by instructions in this manual upon release, except for those Mandatory Service Bulletins (MSBs) and Critical Service Bulletins (CSBs).’ The extract is as follows: Engine Inspection and Service 6-4.21. Turbocharger and Exhaust System Inspection Purpose Verify the integrity of the turbocharger and exhaust system, including the heater muff (if installed). Isolate and correct cracks or leaks in the exhaust system. Frequency During 100-hour/Annual inspection CAUTION: Ensure the turbocharger and exhaust system components are cool before inspection to prevent burns. Procedure

Remove airframe items that hinder visual inspection of the exhaust and turbochargers.

111 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix D (cont)

Clean the exhaust system, removing oil and grease, by spraying the exhaust systems parts with Stoddard solvent. Allow the solvent to drain and wipe the parts with a clean cloth.

CAUTION: Cracks in the exhaust system can release carbon monoxide in the nacelle or the cabin; correct exhaust leaks before further flight.

Inspect the exhaust system components according to the instructions in Table 6-24. Part Inspection Action Stacks Risers Elbows Check parts for the following: Burned areas Cracks Loose parts/hardware Pay particular attention to welded areas and seams, checking for cracks. Replace parts that are cracked, burned, or worn Slip joints Check for bulges, cracks, or hot spots (see Figure 6-96) Multi-segment V-band clamps Inspect spot-weld (or rivet) areas for cracks or physical damage. Inspect the corner radii of clamp inner segments for cracks with a flashlight and mirror. Inspect the inner segment spacing. Inspect the clamp outer band for flatness using a straight edge, especially within 2 inches of spot-weld tabs that retain the T-bolt fastener - clearance must be less than 0.062 inches. Verify 100% inner and outer band segment contact. To replace a multi-segment V-band clamp, refer to the primary ICA. Ref: Section 1-1.1 Heater muff Inspect the heat exchanger seams, joints and transitions with a flashlight and mirror or a flexible borescope for physical damage, cracks, corrosion, and burn-through. Inspect connecting flanges for security and proper mating. Table 6-24 Exhaust Inspection Criteria

112 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix D (cont)

Connect a high volume, dust-free, air pressure source to the exhaust tailpipe outlet.

Apply five (5) psi of air pressure to the exhaust system. Apply soapy water to the exhaust system and check for bubbling in areas of the exhaust other than the slip joints. If bubbling is found, replace the leaking exhaust components according to the instructions in primary ICA (Ref: Section  1-1.1) or aircraft maintenance manual.

Visually inspect the exhaust stacks and transition unit for wear, leaks, cracks, or distortion. Replace worn, leaking, cracked, or distorted exhaust parts. Inspect the exhaust manifold connections at the cylinder to verify the physical security of

113 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix D (cont) the exhaust flange, gasket and exhaust manifold fasteners. Exhaust system removal and installation procedures may be found in the primary ICA (Ref: Section 1-1.1) or the aircraft maintenance manual, if disassembly is required.

Remove the multi-segment V-band clamps from the exhaust tailpipes according to instructions in the primary ICA (Ref:  Section 1-1.1) or the aircraft maintenance manual. Clean the outer band of the multi-segment V-band clamps with crocus cloth. Inspect the V-band clamps according to the instructions in Table 6-24.

Inspect the turbocharger oil reservoirs, oil inlet and outlet fittings and surrounding area for signs of leakage. Torque fasteners or fittings to Appendix B specifications or replace leaking parts, as required to remedy leaking reservoirs or fittings.

Remove the induction air supply from the turbocharger compressor according to the aircraft manufacturer’s instructions. Inspect the induction air supply duct for wear, deformation, cracks or other physical damage; replace, if necessary.

Remove the turbocharger compressor discharge duct from the induction system according to instructions in the primary ICA (Ref: Section 1-1.1) or the aircraft maintenance manual. Inspect the hardware for wear, deformation, cracks or other physical damage; replace, if necessary.

Inspect the turbine and compressor housings for cracks or physical damage, especially at the mounting flanges. If cracks or physical damage is discovered, replace the turbocharger with a new, rebuilt or serviceable unit.

Inspect the turbine and compressor wheel blades for damage. If turbine or compressor blades are damaged, replace the turbocharger with a new, rebuilt or serviceable unit.

Spin the turbine shaft to check for freedom of movement and end play. If the turbine or compressor blades touch the housing during rotation, if the shaft does not rotate freely, or if the shaft exhibits noticeable “wobble” during rotation, replace the turbocharger with a new, rebuilt or serviceable unit.

114 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix D (cont)

Inspect the interior of the turbine and compressor housings for oil, indicating oil seal damage or a faulty check valve. If oil is found inside the housing, troubleshoot to isolate cause of oil accumulation.

Inspect the wastegate for cracks or physical damage. If the wastegate is cracked or damaged, replace the wastegate with a new, rebuilt or serviceable unit. Inspect the security of the mounting flange fasteners, retorque if fasteners appear loose.

Inspect the wastegate actuator fittings for leaks and physical security; retorque loose fittings to Appendix B specifications. If leaks persist, replace O-rings, retorque fittings and repeat leak inspection after a ground engine run. Inspect the wastegate actuator hydraulic hoses for chafing, nicks, cuts or leaks; replace hoses exhibiting these conditions.

Inspect the wastegate actuator and butterfly valve for general condition and freedom of movement. Check the link rod pins and levers for wear. If the wastegate actuator, butterfly valve, link rod pins or levers are worn, binding, or damaged, replace the wastegate actuator.

Clean and lubricate the butterfly valve and associated linkages.

For applicable engine models: remove, disassemble, and inspect the turbocharger oil supply check valve according to the instructions in Section 6-4.21.1.

Inspect the wastegate controller and fittings for physical condition and security. If the wastegate controller exhibits physical damage, replace the wastegate controller with a new, rebuilt, or serviceable unit. Inspect the wastegate controller hoses, or tubes, for chafing, nicks, cuts or leaks; replace hoses exhibiting these conditions. Inspect the wastegate controller reference hoses or tubes for bends, dents, nicks or leaks; replace reference lines exhibiting these conditions.

Inspect the wastegate controller (Figure 6-56) housing for oil leaks around the diaphragm, check pressure sensing

115 Appendices Aircraft Accident Report: 1/2020 N264DB EW/C2019/01/03 © Crown Copyright 2020 Appendix D (cont) port, oil inlet, oil outlet, or adjustment screw. If oil is leaking from a fitting, remove the fitting and replace O-rings, install and torque the fitting to Appendix B specifications. If oil is leaking from the housing, replace the wastegate controller with a new, rebuilt, or serviceable unit.

Intentionally left blank

Unless otherwise indicated, recommendations in this report are addressed to the appropriate regulatory authorities having responsibility for the matters with which the recommendation is concerned. It is for those authorities to decide what action is taken. In the United Kingdom the responsible authority is the Civil Aviation Authority, Westferry Circus, Canary Wharf, London, E14 4HD or the European Union Aviation Safety Agency, Postfach 10 12 53, D-50452 Koeln, Germany.

N264DB Aircraft Accident Report 1/2020 Report on the accident to Piper PA-46-310P Malibu, N264DB 22 nm north-north-west of Guernsey on 21 January 2019

FD06699 ｜ 2020_英国_annual-safety-review-2020__Annual_Safety_Review_2020.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Annual Safety Review 2020 AAIB Air Accidents Investigation Branch

Air Accidents Investigation Branch Annual Safety Review 2020 AAIB Air Accidents Investigation Branch © Crown Copyright 2021 All rights reserved. Copies of this publication may be reproduced for personal use, or for use within a company or organisation, but may not otherwise be reproduced for publication. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and it is not used in a derogatory manner or in a misleading context. Published: 24 June 2021. Enquiries regarding the content of this publication should be addressed to: Air Accidents Investigation Branch Farnborough House Berkshire Copse Road Aldershot Hampshire GU11 2HH. enquiries@aaib.gov.uk This document is also available in electronic (pdf) format at www.aaib.gov.uk

Air Accidents Investigation Branch Annual Safety Review 2020 i AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Foreword and Contents Foreword I am pleased to introduce this Annual Safety Review which includes information on occurrences and the safety action taken or planned in response to AAIB investigations concluded in 2020. Although the coronavirus pandemic had a profound effect on both commercial and general aviation activity in 2020, the AAIB still received 553 occurrence notifications (compared to 826 in 2019) and opened 20 field investigations, 4 of which were into fatal accidents in the UK resulting in 4 deaths. A further 108 investigations were opened by correspondence. In addition, the AAIB appointed an accredited representative to 31 overseas investigations (compared to 96 in 2019), and made a notable contribution to major event investigations in Iran and Indonesia. The number of commercial air transport serious incidents was fewer than normal reflecting the reduction in air travel. However, several occurrences were attributed to factors associated with the return to flying, after a long pause which in some cases affected the aircraft or those that fly them. Despite the coronavirus restrictions, there was a growth in the reporting of unmanned aircraft system (UAS) occurrences in 2020 reflecting a greater awareness among UAS operators of the need to report occurrences. The AAIB undertook several UAS investigations and identified safety issues related to the overflight of 3rd parties that have not been fully addressed by the new regulations and recommendations have been made to the relevant authorities. The AAIB remained operational throughout the lockdowns, responding immediately to occurrences as they arose. Despite the many restrictions in place in the UK and around the world, the AAIB found effective ways to progress its investigations. This Review includes an article which describes how the AAIB adapted its working practices to continue to fulfil its important role. The Review also includes an article on the new cloud-based Case Management System that the AAIB has introduced to manage investigations from notification to closure. Fortuitously, after 2 years of development, the system went live in March 2020, just as the UK went into its first lockdown, greatly enhancing our ability to work collaboratively and remotely as required. Productivity remained high throughout the year and the branch published 30 Field and 199 Correspondence Investigation Reports. These included 30 Safety Recommendations covering diverse safety issues with commercial air transport, general aviation, unmanned air systems and glider flying. Full details of the recommendations and the responses

Air Accidents Investigation Branch Annual Safety Review 2020 ii AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk received from the responsible authorities, are provided in this Review. There are also details of 159 significant safety actions taken proactively by the industry in response to our investigations, representing a wide array of actions taken to improve aviation safety. I invite you to peruse this 2020 Annual Safety Review which I trust you will find interesting and useful.

Crispin Orr Chief Inspector of Air Accidents

Air Accidents Investigation Branch Annual Safety Review 2020 1 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Foreword and Contents Follow us on Twitter: @aaibgovuk Contents Foreword............................................................................................................................. i The Impact of Covid-19 On The Air Accidents Investigation Branch........................... 3 AAIB’s Case Management System ................................................................................. 9 CICTT factors on investigations by the AAIB in 2020................................................. 13 Field investigations.................................................................................................. 14 Correspondence investigations............................................................................... 15 UAS investigations................................................................................................... 16 Statistics for 2020........................................................................................................... 17 Category definition................................................................................................... 18 Notifications 2020.................................................................................................... 19 Notifications 2019.................................................................................................... 20 Notifications 2018.................................................................................................... 21 Safety Recommendations in 2020................................................................................. 23 Index of Safety Recommendations 2020................................................................. 29 Safety Actions from investigations reported on in 2020............................................. 79 Index of Safety Actions (by aircraft weight).............................................................. 79 Formal Investigations............................................................................................... 81 Special Bulletin........................................................................................................ 83 Field Investgations................................................................................................... 85 Correspondence Investigations............................................................................. 121 Appendix 1 - CICITT Occurrence Categories............................................................. 149

Air Accidents Investigation Branch Annual Safety Review 2020 2 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk

Air Accidents Investigation Branch Annual Safety Review 2020 3 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk The impact of Covid-19 on the AAIB The Impact of Covid-19 On The Air Accidents Investigation Branch Introduction Whilst flying is the safest form of transport on the planet (per mile travelled), as a high technology industry it has always been an enterprise susceptible to a lack of attention to detail. However, few could have anticipated the devastation that the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) particle, as small as 60µm, would have on aviation globally. One of the significant challenges for aviation has been how, after such a long hiatus, to safely get aircraft, pilots and passengers back flying. The statistics for the past year make interesting reading, and show that despite a disproportionate lack of flying, the amount of safety reporting has remained relatively high, at levels 86% of the year before. Despite huge efforts by regulators, operators and manufacturers to raise awareness of the potential hazards to enable a measured safe return to flying for all types of aviation there have inevitably been mishaps, serious incidents and, unfortunately, accidents. This article covers how the UK Air Accidents Investigation Branch (AAIB) has reacted to these events in the midst of a pandemic. The global challenge The global nature of Aviation is exposed in accidents. An aircraft accident in the UK could, for example, involve design organisations in the US, regulators from Canada and component manufacturers in Europe and could be of interest to operators of the type all over the world. Thus, Accident Investigation Authorities (AIAs) rely on relationships with other AIAs, manufacturers, operators and other government departments to conduct investigations. So, finding effective methods of sustaining these relationships in a pandemic has been key to sustaining operational viability of not just the AAIB, but every AIA. In response to these and many other types of challenge being encountered by investigators, AIAs had to establish codes of practice and recommendations of how to cope in a pandemic. These are comprehensive covering all phases of the accident investigation from notification of the accident, deployment, the post field phase through to the giving of evidence in an Inquest. Maintaining operational readiness Firstly, for the AAIB, it was critical to establish a safe and secure base from which to conduct operations. This required the AAIB Business Support team to overcome the challenge of rapidly implementing procedures and mitigations in accordance with UK Government and World Health Organisation guidelines to ensure that a covid-secure workplace was sustained. Communications and IT are a critical enabler and the AAIB has taken huge strides forward in enabling collaborative remote working whilst retaining its ability to manage sensitive and confidential information. Whilst the AAIB was well positioned in having the right type of Personal Protective Equipment (PPE), the same challenges were faced as with many other organisations of maintaining sufficient stocks in the face of overwhelming

Air Accidents Investigation Branch Annual Safety Review 2020 4 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk The impact of Covid-19 on the AAIB global demand for these products. Finally, we needed to protect the AAIB’s most valuable assets – its people. Firstly, those within the organisation most at risk were identified and shielded; all unnecessary travel was avoided, particularly by public transport and access to healthcare resources facilitated. For the staff that needed to travel, the AAIB ensured they were designated as critical safety workers, with freedom to move around and operate as required. A small accident in rural Britain will have multi-national interest Notification and deployment In taking the decision to activate an Investigative Team, AAIB Duty Coordinators (DCOs) assess an incident against a range of criteria and decide if it crosses a threshold which supports a deployment. Covid-19 has not changed those criteria, so in one regard the decision whether the AAIB should deploy has not changed. The more critical aspect has been if the team can deploy. Within the UK this was largely surmountable thanks to the skilled efforts of the AAIB Operations Centre team, who managed to resolve the logistics challenges such as availability of accommodation or flights during lockdown. However, overseas deployments presented more significant hurdles with the introduction of quarantine periods both on arrival and return. There was also the risk of contracting the virus whilst on deployment and having investigators stranded in far-off places. This potentially would impact on the wider AAIB capability if a major event occurred in the UK, as such events quickly consume the available resources of what is a capable but compact organisation. The decisions on deployment are more straightforward when there are fatalities involved, but more nuanced with less severe incidents and near miss events. It is the latter scenarios where DCOs are having to carefully weigh the potential safety benefits with the risks involved in deploying. Despite these challenges the AAIB has continued to successfully deploy teams to a wide range of scenarios, attending fatal accidents and serious incidents in the UK and overseas whilst sustaining its capability to respond to a large scale incident.

Air Accidents Investigation Branch Annual Safety Review 2020 5 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk The impact of Covid-19 on the AAIB At the accident scene In many ways conducting the physical investigation of the wreckage at the accident site posed the least challenge. With the numerous hazards inherent in aircraft accidents, of which inhalation hazards are often present, investigators were already well prepared from a PPE perspective for the hazards posed by SARS-CoV-2 (or Covid-19 as it more commonly known). The problems resided in the human side of the investigative process. Conducting interviews in-person with witnesses were made more difficult by the wearing of face masks, adding a barrier to the communication in which the ability of the investigator to build a rapport and gain trust is vital. On the accident site the calibration of risk from Covid-19 can be difficult to maintain, the team are focussed on the hazards presented by the site and much care is taken to protect themselves and anyone else from harm. It can be a difficult mental adjustment to consider that each member of the team and other stakeholders present at the accident site could potentially be presenting a hazard to each others health as well. When an investigative team has spent hours in full body suits and masks combing over an accident site, the last thing they wish to do after getting out of the PPE is to put on another mask! But that is the discipline required to protect each other and keep the team operational. One of the challenging aspects of field investigations is managing stakeholders from different organisations who may have different perspectives on risk. On a small accident site this is relatively easy to control but ensuring consistent level of PPE on a larger scale accident can be more challenging. Covid-19 poses a similar problem, whilst the guidance on facemasks and social distancing is clear, it is common to observe lots of variance in adherence to these rules. An important dynamic from the investigative team is to be able to meet together in the evening to discuss the day’s activities. Whilst the Engineering Inspectors will have spent most of the time on site, the Operations Inspectors will have been mobile, interviewing witnesses at varying locations. Similarly, the Recorded Data Group and Human Factors Inspectors may well have all spent time focussed on different areas. The opportunity to brief the investigator in charge and start to knit together the various strands of evidence and information into an initial concept of events is critical in enabling the investigation to focus its efforts in the right area. This time is also important after an investigative team has undertaken the critically important task with the emergency services and Disaster Victim Identification (DVI) teams to carefully extract fatalities from the accident scene. Following exposure to what can be harrowing experiences, it is vital to have the opportunity for the team to talk and support one another. Depending on the location of the accident this type of evening meeting was not always possible. On one deployment to the Channel Islands exemptions were granted from the quarantine with understandable strict conditions (given the Island had a zero incidence of Covid-19). Inspectors were required to go directly from the aircraft to their hotel rooms and only to leave to visit the aircraft. Technology can be used to try and overcome these issues, but there are some conversations that are not suited to the dynamics of video calls.

Air Accidents Investigation Branch Annual Safety Review 2020 6 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk The impact of Covid-19 on the AAIB Post field phase Whilst the actions taken at an accident site are often challenging, this element (known as the field phase) of the investigation tends also to be relatively short in duration. The post field phase, however, can last months, if not years and managing the investigation during this phase has raised its own challenges. Damaged or undamaged flight recorders have had to be transported to suitable laboratories, sometimes in a foreign state, to recover and analyse data. With international interest in recorder downloads, arrangements had to be considered to enable Accredited Representatives to participate in briefings and observe proceedings remotelyusing live video links. Similarly, novel techniques have had to be adopted to conduct detailed wreckage and component examinations. The AAIB was not able to travel to the United States with critical engine components from a Bell Helicopter, but were able to conduct the forensic examination with assistance from Rolls Royce (UK), with reach-back to the Type Certificate holder in the US who had the in-depth product knowledge. The effect of Covid-19 protocols So, as can be seen, the AAIB and other AIAs have introduced numerous protocols to sustain investigations through the pandemic, but what has been the cost of these? As is often the case in life, new challenges often re-present old problems in a different context. Some readers may be aware of the famous Prussian Military Officer Carl von Clausewitz and his writings on his experiences of war as France defeated Prussia at the twin battles of Jena and Auerstädt on October 14, 1806. It may seem odd to be drawing lessons from such a distant event. What relevance can the experience of a 19th century infantry officer hold for us today performing accident investigation? The central tenet of Clausewitz’s writings are about the attritional effect of reality on ideas and intentions in war, for which he introduced the term ‘friction’. In modern day air accident investigation, the investigative protocols are the embodiment of AIAs ideas and intentions to manage the risks associated with sustaining this important activity in a pandemic. Each mitigation, if applied correctly, is effective, but each brings its own friction in terms of a penalty of adding time, cost and increasing the energy needed to achieve the same level of effectiveness in an investigation. The effect of reality on all these protocols is that they also introduce delay, inertia and complexity at just about every step of an investigation. And it is not just the protocols that have introduced friction. As mentioned earlier, aviation is a global business, and the business of investigating accidents relies on long established relationships with safety staff at operators, manufacturers and regulators. These safety teams have not been immune from the effects of the pandemic on industry. The hollowing out of industrial resources has meant that some company’s ability to respond to incidents has been significantly diminished, and their own investigations have taken longer than normal, or not been possible at all because the company has ceased to operate.

Air Accidents Investigation Branch Annual Safety Review 2020 7 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk The impact of Covid-19 on the AAIB As well as the impact on investigations there has been the impact of the pandemic on individual’s health and wellbeing. There are the obvious first order consequences of personnel who have been unfortunate enough to contract Covid-19, both in its short and longer term effects. But more insidious has been the indirect effects of the pandemic on people’s sense of wellbeing. The effects of social distancing and the impediments to the mobility of people has the potential to affect people’s mental and physical health and undermine the morale and cohesion of the workforce. It is interesting to note that Clausewitz recognised the morale and will of a soldier as the most important component in warfare. For AIAs, which tend to be small organisations comprised of highly motivated individuals, maintaining these components is equally important. Unexpected side effects But what AIAs are also recognising is that the pandemic has expedited new ways of working and innovation that may have taken decades to progress otherwise. Home working is not a new concept, in fact it was common prior to the Industrial Revolution (and even sustained through it). However, the huge experiment in home working conducted over the past several months, has despite the understandable initial concerns of some, delivered surprising results. It has generated a resilience by significantly reducing the risk of losing a cohort of investigators to an outbreak of Covid-19. By exploiting the advantages technology can offer it has strengthened the ability of AIAs to conduct remote investigations, particularly overseas. Whilst undoubtedly certain aspects of business, particularly networking, are better conducted face to face, the innovative ways of working adopted through the pandemic have shown that many routine aspects can be conducted remotely. AIAs have had an advantage in that the provisions of Annex 13 to the convention on civil aviation - aircraft accident and incident investigation provide the statutory enabling framework for AIAs to assist one another. The working practices adopted under the pandemic have merely further exploited the co‑operation this enables.

Air Accidents Investigation Branch Annual Safety Review 2020 8 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk The impact of Covid-19 on the AAIB Glimmers of light in the darkness The importance of management and leadership, at all levels, in guiding the AAIB through this pandemic cannot be overstated. This demand is twofold. Firstly, there is the challenging task of trying to understand the cumulative effect of the friction generated by the Covid-19 protocols on the output of an AIA and the health and wellbeing of the workforce. The CIAA and the management team have gone to great lengths to sustain communication with their teams. As importantly, the wider AAIB team have needed to work to support each other across the psychological divides and barriers that can be created by social distancing protocols and remote working. Secondly, there is the responsibility to exploit the opportunities that have been presented by the pandemic to enhance the way the AIA works. If there is one certainty during these very unpredictable times it is that SARS Cov-2 will not be the last virus with which the world will wrestle. The AAIB management team are focussed on learning the lessons from this pandemic. Finding the right blend of traditional and distributed working models and building on the technological capabilities and investigation techniques developed during Covid-19 will be key to the AAIB’s ability to sustain operations in the next pandemic. Conclusion The AAIB has responded effectively to the pandemic; it has remained operational and continued to fulfil its important role of improving aviation safety. It has deployed personnel throughout the pandemic and sustained the currency of its experienced cadre. It has also effectively recruited and trained new inspectors and support staff. It has achieved all this by employing innovative ways of working, exploiting technology and working with its extensive network of fellow AIAs to develop safe protocols for investigations. If there is a truism in the field of accident investigation it is that every accident is different and presents unique challenges. It is in the DNA of the AAIB to overcome challenge and to solve problems and this attitude can be seen at every level and discipline in the AAIB. Ultimately, it has been the harnessing of this corporate attitude that has enabled the AAIB to successfully overcome the challenges and continue to operate during the SARS Cov-2 pandemic.

Air Accidents Investigation Branch Annual Safety Review 2020 9 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB’s Case Management System AAIB’s Case Management System As an investigative body there is a need to store appropriate records securely and to manage the investigation process from event notification to assessment of responses to recommendations. The legacy system was proving to be outdated and was not flexible enough to keep pace with changes in accident investigation regulations. In March 2020 AAIB went live with a new cloud-based Case Management System (CMS). This was fortuitous timing as it was the week before the UK went into lockdown due to Covid-19 and our legacy database system did not provide good remote access. The CMS programme was the result of two years of development and testing. It replaced the previous bespoke database, and importantly brought tracked emails and investigation evidence, such as images, into one cloud-based system. The system can be accessed from most mobile devices giving significant improvements for staff working remotely, which is routinely encountered during deployments, as well as during enforced home working during the Covid-19 pandemic. Agile project techniques were used to develop the system, and much of the core functionality was developed in conjunction with the UK Rail and Marine Accident Investigation Branches to reduce costs. Importantly AAIB case records from legacy systems have been migrated into CMS to provide a database of events spanning several decades.

Air Accidents Investigation Branch Annual Safety Review 2020 10 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB’s Case Management System Managing the Investigation The case management process starts with a notification to the AAIB. This might be from a pilot, an airport, an operator, the police or from a member of the public. The AAIB accident line is active at all times. During UK office hours the accident line is staffed by the AAIB’s Operations Centre, whilst out of hours the accident line is transferred to the DfT’s Duty Office who then contacts the AAIB’s Duty Coordinator. Information, gathered from the notification, such as contacts, event description, damage to the aircraft, is entered into CMS. Previously this info would have been recorded on an electronic form, however it is now input directly into CMS by whoever takes the call and is immediately available for the AAIB’s Duty Coordinator to make their assessment as to the AAIB’s response. Event notifications are triaged by the AAIB Duty Coordinator, who is an experienced investigator. This includes an assessment of the severity of the event according to international standards set out in Annex 13 to the Convention on International Civil Aviation and regulations, as well as an assessment of the appropriate response from AAIB. In a typical year AAIB receives just under 1,000 notifications and AAIB are very keen that they achieve an element on over-reporting so that all events from which safety lessons can be learned are captured. AAIB responses include:

● Deploying a team for a Field investigation

● Assigning an inspector for a correspondence investigation

● Conducting a wide-ranging Safety Study

● Completing a short (few lines of text) Record Only investigation

● Assisting a foreign state by appointing an Accredited Representative or “Expert”

● Referring the investigation to a UK sport aviation body

● No Further AAIB Action. Having captured the assessment in CMS the AAIB Operations Centre Team then support the investigation process with various activities such as sending formal notification emails to organisations such as State Investigation Authorities. The team assigned to the investigation are entered in CMS and thereafter automated alerts notify the case team of key milestones in the investigation process. Managing the Investigation A dedicated SharePoint site has been created as part of CMS where case information, such as documents, images and email attachments, are stored. This allows the case team to share case information throughout the investigation, including during the field phase where the deployed team are often not working at the same location. There is also functionality in CMS to record notes on investigation progress to assist management oversight.

Air Accidents Investigation Branch Annual Safety Review 2020 11 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk AAIB’s Case Management System A key part of the investigation is report creation. AAIB publish several report types such Formal Reports, Field Investigation Reports, Correspondence Investigation Reports, Special Bulletins and Record Only Reports; these are all managed from CMS and the linked SharePoint site. This includes managing the email process for formally requesting comments on draft reports in accordance with the ICAO Annex 13 standards. Managing Safety Recommendations Making Safety Recommendations is a key part of AAIB’s activities in improving aviation safety. The formal transmittal of Safety Recommendations, and the responses from the addressees to Safety Recommendations, is managed and monitored from CMS. This includes managing both the email process with external addressees as well as managing the internal assessment of responses. Evidence Management The tracking of evidence has been incorporated within CMS. Evidence can be logged into CMS during a field deployment using mobile devices and can be tracked as the investigation progresses. CMS has the functionality to manage ‘child’ evidence that is generated from ‘parent’ evidence during a component teardown for example. The system has the option to use barcode readers available on mobile phones. Management data The system has powerful search capabilities and the ability to tailor data presentation to various user needs using bespoke views. This is particularly useful for providing automated management information for example weekly event logs, inspector workload allocation and managing responses to Safety Recommendations. The Deputy Chief Inspector at AAIB, has been very pleased with the results, “not only has this been a real enabler to AAIB during lock down with the extended periods of home working, but it has also provided AAIB with the flexibility to evolve our business processes. The latter is particularly important for our key outputs and Safety Recommendations, as we are now required to monitor the responses and actions taken by organisations”.

Air Accidents Investigation Branch Annual Safety Review 2020 12 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk

Air Accidents Investigation Branch Annual Safety Review 2020 13 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2020 CICTT factors on investigations by the AAIB in 2020 Every occurrence in the UK is recorded and coded using the occurrence taxonomy defined by the CAST/ICAO Common Taxonomy Team (CICTT). This is a worldwide standard taxonomy to permit analysis of data in support of safety initiatives. It should be noted that they are recorded as multiple factors, for example turbulence (TURB) leading to loss of control in flight (LOC-I). Similarly, other (OTHR) is also used and may include aspects that do not have specific classifications.

LOCI 61 ARC 41 SCF-PP 4 F-NI 7 AMAN 2 OTHR 37 CTOL 24 RE 15 LOCG 24 SF-NP 21 SCF-PP 20 GCOL 12 FUEL 6 CABIN 3 USOS 4 BIRD 2 EVAC 2 MAC 1 LALT 1 UNK 1 ATM 1 GTOW 1 EXTL 1 ADRM 10 CFIT 9 WSTRW 5 AMAN 4 NAV 3 TURB 3 F-POST 2 UAS 2 Factors for all investigations reported on by AAIB in 2020 See Appendix 1 for category descriptions

Air Accidents Investigation Branch Annual Safety Review 2020 14 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2020 Field investigations OTHR 10 SCF-NP* 9 F-NI 5 LOCI* 7 ADRM 4 SCF-PP 4 ARC 2 RE 2 EVAC 2 F-POST 2 GCOL 2 RI 2 AMAN 2 LOCG* 5 CTOL 1 CFIT 1 CABIN 1 FUEL 1 ATM 1 LALT 1 MED 1 GTOW* 1 WSTRW 1

• - Categories connected with fatal accident

Factors for field investigations reported on by AAIB in 2020 In 2020 the AAIB published 30 field investigation reports, one of which was an investigation into a fatal accident and 29 were into non-fatal accidents or serious incidents. The 29 investigation reports published during 2020 into non-fatal events were balanced between commercial air transport (CAT) and general aviation (GA). See Appendix 1 for category descriptions

Air Accidents Investigation Branch Annual Safety Review 2020 15 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2020 Correspondence investigations OTHR 23 LOCI 22 SCF-PP 4 FUEL 3 AMAN 2 CTOL 14 ARC 14 SCF-PP 7 RE 7 GCOL 7 LOCG 6 SCF-NP 6 RAMP 6 ADRM 5 TURB 3 USOS 3 NAV 3 CABIN 2 CFIT 2 F-NI 1 BIRD 1 MAC 1 EXTL 1 MED 1 WSTRW 1 Factors for correspondence investigations reported on by AAIB in 2020 Correspondence investigations are usually conducted into non-fatal accidents on GA aircraft and to some serious incidents on CAT aircraft. See Appendix 1 for category descriptions

Air Accidents Investigation Branch Annual Safety Review 2020 16 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk CICTT Factors on Investigations by the AAIB in 2020 UAS investigations LOCI 41 SCF-PP 6 OTR 5 CFIT 6 CTOL 3 U-LINK 2 SCF-NP 4 GCOL 1 ARC 1 FUEL 1 BIRD 1 TURB 1 USOS 1 UNK 1 Factors for UAS investigations reported on by AAIB in 2020

The predominant cause of UAS accidents, was LOCI usually resulting from a sudden complete electrical power failure or loss of thrust from one or more lift propellors. In most of these cases failures such as this results in the machine rapidly becoming unflyable and unrecoverable. There is no resort to aerodynamic recovery techniques such as can be carried out in a conventional helicopter. Although the parachute recovery systems are becoming available, the AAIB has no data on the effectiveness or otherwise of these systems. See Appendix 1 for category descriptions

17 Statistics for 2020 An overview of what we were involved with during 2020 can be seen below: UK Registered Overseas 9 Average months to publication for a Field Investigation 10.92 5.34 Average months to publication for a Correspondence Investigation Number of Correspondence Investigation Reports published (incl UAS and Rec-only) 199 Total number of Correspondence (AARF) Investigations opened 108 Number of Safety Recommendations 30 Referred to Sporting Associations 34 Number of Field Reports published (incl UAS) 30 Overseas (no AAIB involvement) 10 UK Fatal Accidents 4 Number of Deaths 4 Foreign Registered Overseas 22 Number of Formal Reports published 1 No further AAIB action (Civil) 183 Number of Special Bulletins published 1 UK Field Investigations opened (incl UAS) 20 15 Average months to publication for a Formal Investigation Total Number of Notifications received by the AAIB 553 Number of Safety Actions noted 159 Number of UAS Correspondence Investigations opened 17 Military (AAIB assistance) 0 Joint Military & Civil Aircraft 0 Military (no AAIB involvement) 0 Record-only Investigations published 100 Record-only Investigations opened 118 Number of UAS Correspondence Investigations published 20 Investigation Statistics © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Air Accidents Investigation Branch Annual Safety Review 2020 AAIB Air Accidents Investigation Branch

Air Accidents Investigation Branch Annual Safety Review 2020 18 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Introduction The following pages provide the statistics for 2019, 2018 and 2017 for accidents and serious incidents notified to the Air Accidents Investigation Branch. An explanation of the categories is as follows: Category definition UK Aircraft overseas Investigations involving UK registered aircraft, or aircraft registered in one of the UK Overseas Territories or Crown Dependencies, occurring in a Foreign State where the AAIB has participated in the capacity of Accredited Representative in accordance with ICAO Annex 13. Foreign Aircraft overseas Accidents and serious incident investigations to Foreign registered aircraft occurring in a Foreign State where the AAIB has participated in the capacity of Accredited Representative or Expert in accordance with ICAO Annex 13. UK Field Investigations Investigations involving the deployment of a ‘Field’ team within the UK or to one of the UK Overseas Territories or Crown Dependencies and those investigations where a team has not deployed but Safety Recommendations are made. Also includes investigations which have been delegated to the AAIB by another State. Unnmanned Aircraft Systems (UAS) Accidents and serious incident investigations to UAS where they are operated under a CAA permission, or are privately operated with mass greater than 20 kg. Military with AAIB Assistance / Observer Where an MoD aircraft accident, serious incident Service Inquiry may be convened, an AAIB Inspector is appointed to assist or observe. AARF Investigations Investigations conducted by correspondence only using an Aircraft Accident Report Form (AARF) completed by the aircraft commander. Overseas (no AAIB involvement) Notifications to the AAIB of an overseas event which has no AAIB involvement. Referrals to Sporting Associations Investigations referred to the relevant UK Sporting Associations. No further AAIB action (Civil) Occurrences notified to the AAIB involving civil registered aircraft which do not satisfy the criteria of an accident or serious incident in accordance with the Regulations. Military (no AAIB involvement) Notifications to the AAIB concerning Military aircraft with no AAIB involvement. Record-Only Investigations An occurrence that if investigated fully has little likelihood of identifying new safety lessons that will advance aviation safety.

Air Accidents Investigation Branch Annual Safety Review 2020 19 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Notifications 2020 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 1 0 2 1 0 1 0 1 1 1 1 0 9 Foreign Reg Overseas 5 3 1 0 2 0 2 1 2 3 2 1 22 UK Field Investigations 0 1 1 0 3 1 0 4 4 3 2 1 20 Military (AAIB Assistance) 0 0 0 0 0 0 0 0 0 0 0 0 0 Total no of Correspondence Investigations (AARF) 4 5 8 2 9 13 18 15 15 6 4 9 108 Correspondence Investigations (AARF) involving UAS 0 0 3 3 1 2 1 0 0 0 0 0 10 Overseas (no AAIB involvement) 0 0 3 1 0 1 2 0 0 1 1 1 10 Referred to the appropriate Aviation Sporting Association 1 0 1 1 2 7 10 5 4 2 1 0 34 Record Only Investigations 7 7 9 4 10 4 17 18 20 3 9 10 118 Total no further AAIB action (civil) 32 31 8 5 3 8 15 22 28 12 8 11 183 Total no further AAIB action (civil) inv UAS 3 0 1 4 7 4 7 6 7 0 0 0 39 Military (no AAIB involvement) 0 0 0 0 0 0 0 0 0 0 0 0 0 Total 53 47 37 21 37 41 72 72 81 31 28 33 553 UK Fatal accidents 0 0 0 0 0 0 0 2 0 1 1 0 4 Number of deaths 0 0 0 0 0 0 0 2 0 1 1 0 4 UK Registered Overseas Foreign Reg Overseas UK Field Investigations Field Investigations  involving UAS Total no of Correspondance  Investigations (AARF) Correspondance  Investigations (AARF)  involving UAS Overseas (no AAIB  involvement) Referred to the  appropriate Aviation  Sporting Association Record Only Investigations Total no further AAIB action (Civil) Total no further  AAIB action (civil) inv UAS

Air Accidents Investigation Branch Annual Safety Review 2020 20 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Notifications 2019 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 3 1 5 1 8 6 8 6 4 2 0 1 45 Foreign Reg Overseas 3 1 5 4 7 4 5 6 1 6 4 5 51 UK Field Investigations 2 3 2 3 3 4 4 4 4 2 2 4 37 Military (AAIB Assistance) 0 0 0 0 0 0 0 0 0 0 0 0 0 Total no of Correspondence Investigations (AARF) 11 20 11 14 11 10 14 13 6 6 5 3 124 Correspondence Investigations (AARF) involving UAS 3 3 3 2 0 2 1 0 4 2 2 1 23* Overseas (no AAIB involvement) 2 0 2 1 1 1 0 1 2 2 0 1 13 Referred to the appropriate Aviation Sporting Association 3 1 3 5 6 5 8 7 6 1 2 1 48 Record Only Investigations 1 1 1 7 11 15 22 16 14 7 6 14 115 Total no further AAIB action (civil) 22 23 26 26 23 45 49 33 44 40 36 25 392 Total no further AAIB action (civil) inv UAS 0 0 0 0 0 0 0 0 1 2 1 7 11* Military (no AAIB involvement) 0 0 1 0 0 0 0 0 0 0 0 0 1 Total 47 50 56 61 70 90 110 86 81 66 55 54 826 UK Fatal accidents 1 1 0 0 1 0 2 1 0 0 1 1 8 Number of deaths 2 1 0 0 1 0 2 2 0 0 1 1 10 UK Registered Overseas Foreign Reg Overseas UK Field Investigations Total no of  Correspondance  Investigations (AARF) Overseas (no AAIB  involvement) Referred to the  appropriate Aviation  Sporting Association Record Only Investigations Total no further AAIB  action (Civil) Total no further AAIB  action (civil) inv UAS Military (no AAIB involvement)

• Included in the total

numbers of AARF and non-reportable investigations.

Air Accidents Investigation Branch Annual Safety Review 2020 21 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Investigation Statistics Notifications 2018 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 2 1 1 2 4 4 3 0 2 4 0 0 23 Foreign Reg Overseas 5 6 3 1 2 5 4 5 1 3 4 2 41 UK Field Investigations 2 4 0 3 2 3 4 2 0 5 1 0 26 Military (AAIB Assistance) 0 0 1 0 0 1 1 0 0 0 0 0 3 Total no of Correspondence Investigations (AARF) 7 14 9 16 28 29 34 24 20 20 12 8 221 Correspondence Investigations (AARF) involving UAS 1 1 0 0 1 1 1 0 2 3 0 1 11* Overseas (no AAIB involvement) 1 1 1 0 2 0 1 0 1 0 2 0 9 Referred to the appropriate Aviation Sporting Association 1 4 0 3 8 7 6 6 0 3 0 2 40 Total no further AAIB action (civil) 15 22 29 22 28 44 37 50 28 33 23 10 341 Total no further AAIB action (civil) inv UAS 0 0 2 0 1 1 3 2 0 1 1 1 12* Military (no AAIB involvement) 0 1 0 0 0 0 0 0 1 0 0 0 2 Total 33 53 44 47 74 93 90 87 53 68 42 22 706 UK Fatal accidents 1 0 0 1 1 3 1 0 0 2 0 0 9 Number of deaths 2 0 0 2 1 3 1 0 0 7 0 0 16 UK Registered Overseas Foreign Reg Overseas UK Field Investigations Military (AAIB  assistance) Total no of  Correspondance  Investigations  (AARF) Overseas (no AAIB  involvement) Referred to the appropriate  Aviation Sporting Association Total no further  AAIB action  Civil) Military (no AAIB  involvement)

• Included in the

total numbers of AARF and non-reportable investigations.

Air Accidents Investigation Branch Annual Safety Review 2020 22 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk

Air Accidents Investigation Branch Annual Safety Review 2020 23 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendations in 2020 In 2020 the AAIB issued 30 Safety Recommendations from 12 investigations. 13 17 26 32 28 32 9 10 26 38 40 19 20 17 39 82 39 76 68 114 76 58 37 82 69 66 58 57 95 55 139 109 150 146 128 98 109 95 103 39 23 42 47 57 29 15 0 20 40 60 80 100 120 140 160 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 12 30 2020 Recommendation numbers made in previous years Each addressee to a Safety Recommendation has to respond within 90 days in accordance with retained Regulation (EU) 996/2010 (as amended) Article 18, and detail what actions have been taken or are under consideration and the time expected to be taken for their completion. If no actions are being considered by the addressee they have to provide their reasoning for the decision. Monitoring of Safety Recommendations The AAIB is responsible for monitoring the action addressee responses to Safety Recommendations. This is in accordance with the amendment that was made to ICAO Annex 13 in November 2018. The specific Paragraph 6.12 requires that; ‘A State that receives a safety recommendation shall implement procedures to monitor the progress of the action taken in response to that safety recommendation’. The AAIB carries out this function for the UK, its Overseas Territories and Crown Dependencies. It is important to note that this is to monitor the progress of actions taken in response to a Safety Recommendation, it is not to undertake the role of the regulator nor to provide opinion on the efficacy of the action. The AAIB monitors the progress of actions being taken by the addressees and reports regularly to the Board of Accident Investigation Branches (BAIB) and the State Safety Board (SSB) on progress toward completion. It is for the SSB to decide whether any further intervention is needed.

Air Accidents Investigation Branch Annual Safety Review 2020 24 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview This monitoring of actions is not only for Safety Recommendations issued by the AAIB but also those that have been issued to addresses in the UK from other Accident Investigation Authorities. When the AAIB receives a response to a recommendation from the addressee it is assessed as to its adequacy under the requirements of Article 18 of retained Regulation (EU) 996/2010 (as amended). The AAIB applies the following assessment criteria to the Safety Recommendation responses;

●Adequate means that the response fully meets the intent of the Safety Recommendation and the action is expected to address the safety issue.

●Partially Adequate means the response goes someway to meeting the intent of the Safety Recommendation and the action will address the safety issue to a certain extent, but further action would be required to fully address the issue identified.

●Not Adequate means that the response does not address the intent of the Safety Recommendation nor does it address the safety issue concerned. The AAIB will apply an open or closed status depending on the expectation of whether the addressee will reassess their response.

○Not Adequate - OPEN The status of ‘open’ implies that AAIB still has concerns regarding the identified safety deficiency and that there is an expectation that the addressee will provide further responses.

○Not Adequate - CLOSED The status ‘closed’ implies that there is a low likelihood that the addressee will act on the recommendation or provide any further responses.

●Superseded means the Safety Recommendation has been ‘Superseded’ either by a ‘newer’ and more comprehensive Safety Recommendation or actions have subsequently been taken by the addressee that have superseded the recommendation.

Air Accidents Investigation Branch Annual Safety Review 2020 25 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview In reporting on the monitoring of the actions taken to a Safety Recommendation these are reported as meeting one of the following: ACTION STATUS Meaning Status

●Planned actions complete All planned actions are completed. CLOSED

●Planned actions partially completed Some of the planned actions have been completed and the addressee is not intending on doing any further action. CLOSED

●Planned actions not completed The planned actions have not been completed and the addressee now has no intention of doing any further action. CLOSED

●Planned actions ongoing update due (XX/XX/ XXXX) Planned actions are still ongoing and further updates will be provided. OPEN

●Not enough information The update is not detailed enough to assess. A request will be made for a further update. OPEN

●No planned actions There are no planned actions. REFER TO NOT ADEQUATE A Safety Recommendation issued after 1 January 2019 therefore remains OPEN until such time as the addressee has completed its activity in relation to that recommendation. It is therefore possible for a Safety Recommendation to be assessed as “adequate” but will remain OPEN until the planned actions are completed. Of the 30 Safety Recommendations issued in 2020, as of the of 31 March 2021, responses have been received for 29 Safety Recommendations. The AAIB response assessment has classified those responses as follows:

●Eight are Adequate, with planned actions completed and are Closed.

●Five are Adequate, with planned actions ongoing and remain Open.

●Ten are Partially Adequate with planned actions ongoing and remain Open.

●Four are Partially Adequate, with planned actions completed and are Closed.

●Two are Not Adequate and are Open.

●One is awaiting a response from the addressee.

Air Accidents Investigation Branch Annual Safety Review 2020 26 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Summary table Number Response Assessment Action Status Status 2020-001 Adequate Planned actions completed Closed 2020-002 Adequate Planned actions completed Closed 2020-003 Adequate Planned action ongoing, update due 28 February 2021 Open 2020-004 Adequate Planned actions completed Closed 2020-005 Adequate Planned action ongoing, update due 30 June 2021 Open 2020-006 Partially adequate Planned action ongoing, update due 31 December 2020 Open 2020-007 Partially adequate Planned action ongoing, update due 31 March 2021 Open 2020-008 Not adequate Not enough information Open 2020-009 Adequate Planned action ongoing, update due 31 December 2020 Open 2020-010 Partially adequate Planned action completed Closed 2020-011 Adequate Planned action ongoing, update due 28 February 2021 Open 2020-012 Adequate Planed action ongoing, update due 02 April 2021 Open 2020-013 Adequate Planned action completed Closed 2020-014 Adequate Planned action completed Closed 2020-015 Adequate Planned action completed Closed 2020-016 Partially adequate Planned action completed Closed 2020-017 Adequate Planned action completed Closed 2020-018 Partially adequate Planned action ongoing, update due 21 June 2021 Open 2020-019 Partially adequate Planned action completed Closed 2020-020 Partially adequate Planned action ongoing, update due 19 July 2021 Open 2020-021 Partially adequate Planned action ongoing, update due 31 January 2022 Open 2020-022 Partially adequate Planned action ongoing, update due 19 July 2021 Open 2020-023 Partially adequate Planned action ongoing, update due 14 September 2021 Open 2020-024 Partially adequate Planned action ongoing, update due 31 August 2021 Open 2020-025 Partially adequate Planned action ongoing, update due 24 May 2021 Open 2020-026 Partially adequate Planned action ongoing, update due 31 December 2021 Open 2020-027 Partially adequate Planned action completed Closed 2020-028 Adequate Planned action completed Closed 2020-029 Not adequate Not enough information Open 2020-030 Awaiting response Open On 31 December 2020 the transition period for the UK exit ended. Thereafter the AAIB was unable to update details of its Safety Recommendations on the European Central Repository Safety Recommendation Information System (SRIS). In addition, SRIS was updated to SRIS 2. The UK Safety Recommendation issued up to the end of 2020 were entered onto SRIS and can be found on the public SRIS.

Air Accidents Investigation Branch Annual Safety Review 2020 27 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview These can be found under Safety Recommendations on the aviationreporting.eu portal: https://sris.aviationreporting.eu/safety-recommendations Each Safety Recommendation is also assessed as to whether it is a Safety Recommendation of European Union Wide Relevance (SRUR) or a Safety Recommendation of Global Concern (SRGC). A SRUR is defined as meeting one or more of the following criteria:

● The deficiency underlying the safety recommendation is systemic, not related to a specific aircraft type, operator, manufacturer component, maintenance organisation, air navigation service and/or approved training organisation, and is not solely a national issue, or

● There is a history of recurrence across Europe of the relevant deficiency. ICAO Annex 13 was amended in November 2020 to the 12th Edition, this included an amendment to the definition of a SRGC to: A safety recommendation regarding a systemic deficiency having a probability of recurrence, with significant consequences at a global level, and requiring timely action to improve safety. SRGC provided to ICAO can be found on their website: https://www.icao.int/safety/airnavigation/AIG/Pages/Safety-Recommendations- of-Global-Concern-(SRGC).aspx Safety Recommendations issued to ICAO are also available on their website: https://www.icao.int/safety/airnavigation/AIG/Lists/Safety%20 recommendations%20to%20ICAO/Search1.aspx Of Safety Recommendations issued by the AAIB in 2020, 5 were both a SRUR and a SRGC. Note: The regulations and a link to ICAO Annex 13 can be found on the AAIB website: https://www.gov.uk/government/collections/aaib-regulations-and-mous

Air Accidents Investigation Branch Annual Safety Review 2020 28 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview   1 2 3 4 5 6 7 8 9 10 11 12 13 Aircraft / Equipment / Facilities Aerodrome equipment / facilities Aircraft / Equipment / Facilities Aircraft equipment Powerplant Aircraft / Equipment / Facilities Aircraft equipment Structures Aircraft / Equipment / Facilities Aircraft equipment Safety equipment Aircraft / Equipment / Facilities Aircraft equipment Aircraft systems Aircraft / Equipment / Facilities Ground equipment Aircraft / Equipment / Facilities Rescue Fire Fighting Services Personnel Other Personnel Training / proficiency / check Procedures / Regulations Aircraft operations Procedures / Regulations Aircraft maintenance/inspection Procedures / Regulations ANS maintenance/inspection Procedures / Regulations Other Procedures / Regulations Rescue Fire Fighting Services Procedures / Regulations Survivability Safety Recommendation Topics

Air Accidents Investigation Branch Annual Safety Review 2020 29 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendations issued in 2020

Notes: Safety Recommendation classification correct at time of publication. Safety Recommendations can also be made through AAIB Special Bulletins and are then also reflected in the final report. Reflects the situation with Safety Recommendations at 31 March 2021. Index of Safety Recommendations 2020 Aircraft Registration Safety Recommendation Page DJI Matrice 210 (UAS registration n/a) 2020-001 2020-002 30 31 Airbus A320-214 G-EZTD 2020-003 33 EMB-145EP G-SAJK 2020-004 35 Piper PA-46-310P N264DB 2020-005 2020-006 2020-007 2020-008 2020-009 37 39 40 41 42 Bell 429 G-WLTS 2020-010 2020-011 44 45 Standard Cirrus 75 G-DDGX 2020-012 2020-013 47 50 Britten-Norman Islander BN-2A-27 VP-MNI 2020-014 2020-015 2020-016 52 53 54 DJI M600 PRO (UAS registration n/a) 2020-017 56 Airbus A320-214 OE-LOA 2020-018 2020-019 58 60 ERJ 190-200 LR G-FBEJ 2020-020 2020-021 2020-022 2020-023 62 64 65 66 DHC-8-402 G-FLBE 2020-024 2020-025 2020-026 68 69 70 Cessna Citation CJ1 N680KH 2020-027 2020-028 2020-029 2020-030 72 74 75 77

Air Accidents Investigation Branch Annual Safety Review 2020 30 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview DJI Matrice 210, (UAS registration n/a) 16 March 2019 at Temple Newsam, Leeds, Yorkshire Synopsis The DJI Matrice 210 small unmanned aircraft was being operated commercially to record video footage of an outdoor athletics event. The pilot started to position the aircraft back towards the landing site due to an increase in the rainfall. The pilot then saw the aircraft “wobble” slightly and as it neared the landing site it flipped over before descending rapidly to the gound from a height of about 3 m (10 ft). No one was injured. During the accident flight the aircraft had been operating at heights of up to about 30 m (100 ft) near to, and above people on the ground. This investigation reviewed other similar accidents and the risk of injury to people on the ground. Two Safety Recommendations were made to the UK CAA. Safety Recommendation 2020-001 Justification Although it was not confirmed if moisture ingress caused this accident, information shows that other Matrice 200 series accidents have been caused by moisture entering the aircraft. The manufacturer’s analysis also showed that 27% of accidents were attributed to a loss of propeller motor propulsion that were for reasons other than a fault with the ESC. The manufacturer did not provide guidance on ascertaining if the rainfall exceeded limitations, or the duration that the IP 43 protection may remain in place. It is therefore possible that pilots of the Matrice 200 series could operate the aircraft in rain without knowing that it could result in the loss of control of the aircraft due to moisture ingress. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-001 It is recommended that the Civil Aviation Authority notify users of the DJI Matrice 200 series of the possibility of moisture entering the aircraft when operating in rain and that this could result in a sudden loss of control of the aircraft. Date Safety Recommendation made: 2 January 2020 Footage captured one minute before the accident

Air Accidents Investigation Branch Annual Safety Review 2020 31 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview LATEST RESPONSE Response received: 25 February 2020 The publication of CAA Safety Notice SN-2020/001 “Small Unmanned Aircraft – Water Ingress” highlights the issue of water ingress to all types of Unmanned Aircraft Systems and not just specifically for the DJI Matrice 200 series AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Safety Recommendation 2020-002 Justification In accordance with the ANO, a person must not ‘permit an aircraft to endanger any person’ and may only fly the aircraft ‘if reasonably satisfied that the flight can safely be made’. It is therefore up to the operator or remote pilot to decide if flying a UA over people will endanger them. However, there is no guidance available from the CAA on how to make that assessment. This could include consideration of standards of safety, reliability, UA mass and type, the operational environment and whether any secondary safety systems are fitted.

IR (EU) 2019/947 is due to come into force in July 2020 and will require that a UA operating in the open category with a mass of more than 250 grams must not be flown over ‘uninvolved persons’. If operating a UA in the specific category, the operator will need to comply with mitigating safety actions to prevent injury to people. However, these actions are not due to be published by the EC until 2021 which leaves an unresolved hazard prior to publication. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-002 It is recommended that the Civil Aviation Authority specify the conditions that must be met for an unmanned aircraft to be flown safely over people. Date Safety Recommendation made: 2 January 2020

Air Accidents Investigation Branch Annual Safety Review 2020 32 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview LATEST RESPONSE Response received: 1 December 2020 The CAA believes that this recommendation is met through the introduction of the European Commission’s new regulations pertaining to UAS that will be implemented in the UK on 31 Dec 20. With the extant regulations, there are no specific requirements that must be met for UAS to be flown over people; the existing rule set specifies that uninvolved third parties must be avoided by a 50m ‘bubble,’ which allows for overflight. Advice on the requirements to achieve this safely were covered through the release of Safety Notices and assessment of individual Operational Authorisations, but it was not within our remit to change the legislation directly to disallow overflight or enforce these requirements. The new regulations specify that the 50m ‘bubble’ will be replaced by a ‘cylinder,’ meaning that UAS cannot fly within a 50m horizontal distance of uninvolved 3rd parties when operating in the A2 and A3 categories. The A2 category also demands extra requirements in terms of pilot competence and product standards. Overflight in the A1 category is permitted and mitigated by the mass limit of 250g and additional product standards. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed

Air Accidents Investigation Branch Annual Safety Review 2020 33 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview

Air Accidents Investigation Branch Annual Safety Review 2020 34 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview LATEST RESPONSE Response received: 6 May 2020 ANA Aeroportos de Portugal is still waiting for approval from the Civil Aviation Authority, ANAC, to promote the AIP Amendment proposed in its letter to ANAC dated 9 March 20. It is thought that there are some delays due to the COVID-19 lockdown, but ANA Aeroportos de Portugal will contact ANAC for an update. AAIB Assessment: Adequate Action Status: Planned Action Ongoing Update Due 28 February 2021 Recommendation Status: Open Feedback rationale The AAIB requests an update by February 2021 on the progress made to discontinue the use of takeoff Positions at Lisbon Airport.

Air Accidents Investigation Branch Annual Safety Review 2020 35 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview EMB-145EP, G-SAJK 7 August 2019 at London Southend Airport Synopsis An Embraer 145 landing at London Southend Airport ran over a general aviation towbar which had been dropped on the runway. No damage was caused to the aircraft. The investigation found that the towbar had fallen from a Cessna  210 which departed Southend Airport 30  minutes before. The Cessna pilot had likely been distracted during his pre-flight checks by an earlier road traffic incident in which he was involved, and had inadvertently left the towbar attached. One Safety Recommendation has been made to the CAA to improve the visibility of general aviation ground equipment. Safety Recommendation 2020-004 Justification Increasing ground equipment visibility. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-004 It is recommended that the Civil Aviation Authority communicate to the general aviation community the importance of increasing the visibility of ground equipment. Date Safety Recommendation made: 16 January 2020 LATEST RESPONSE Response received: 26 March 2020 The General Aviation Unit within the CAA have created a communications campaign on the risk and mitigation actions surrounding the Southend serious incident and made a clear call to action to pilots to consider painting their tow bars in bright colours. Firstly, the AAIB report was highlighted to the community via Skywise with a request for pilots to consider painting their tow bars in bright colours. This was followed by a call on social media for pilots to show and tell the CAA what colour they had painted their own tow London Southend Airport Chart showing approximate location the towbar was found Towbar location

Air Accidents Investigation Branch Annual Safety Review 2020 36 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview bars and to encourage those that haven’t, to follow suit. An article was written about the Southend incident and shared via Skywise, highlighting the factors that led to the event; lack of visibility of the tow bar and inadequate checks due to distraction. Again, a call to action was made to pilots to paint their tow bars in highly visible colours and for them to consider if they are fit to fly. On behalf of the CAA, GASCo have also contributed to the campaign with a slide on external checks as part of covering the incident within their March and April 2021 safety webinars. Once these presentations have commenced the CAA hope to have further reduced the risk of this incident re-occurring and will have fulfilled the above recommendation. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed

Air Accidents Investigation Branch Annual Safety Review 2020 37 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Piper PA-46-310P, N264DB 21 January 2019 at 22nm north-north-west of Guernsey Synopsis The accident occurred on 21 January 2019 at 2016 hrs. The wreckage was located on 3 February 2019 on the seabed approximately 22 nm north-north-west of Guernsey, within 100  m of the last secondary radar point recorded by the radar at Guernsey and at a depth of 68 m. There was one body present in the wreckage, which was recovered. The body was subsequently identified as that of the passenger. The AAIB published Special Bulletin S1/2019 on 25 February 2019 to give preliminary information on the investigation and general information about how aircraft registered in the USA may be operated between the UK and France. This Special Bulletin contains medical information relevant to the accident to highlight the implications of that information to the General Aviation community. Safety Recommendation 2020-005 Justification The CAA maintains a database of the licence details and qualifications of all pilots who hold a UK-issued flying licence as required under EASA Part ARA.GEN.220. It became clear during this investigation, however, that the CAA database for the pilot of N264DB was incomplete and contained numerous errors. The pilot had scanned a copy of his licence onto his laptop, which the investigation was able to access, but without this copy erroneous conclusions might have been reached about the pilot’s qualifications and entitlements. This mismatch between database records and a pilot’s licence is not unique, and previous AAIB investigations have encountered similar discrepancies. Although the authoritative document is the licence, the competent authority, in this case the CAA, should maintain accurate information as required by EASA regulation. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-005 It is recommended that the Civil Aviation Authority ensure that the system in place to meet the requirements of EASA Part ARA.GEN.220 is effective in maintaining accurate and up-to-date records related to personnel licenses, certificates and ratings. Date Safety Recommendation made: 14 March 2020 View looking at remains of inner wing

Air Accidents Investigation Branch Annual Safety Review 2020 38 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview LATEST RESPONSE Response received: 1 December 2020 Our review of the current licensing system delivered several options to allow us to meet the intent of this recommendation by maintaining accurate and up-to-date records related to personnel licences, certificates and ratings. In the current climate with resource heavily involved in both Covid-19 and BREXIT activities a two-stage solution was deemed appropriate. In the short to mid-term, the practice of attaching a scanned copy of the examiner report forms to the Pilots record in the Pilot Information Management System (PIMS) will continue, but where we receive Freedom of Information requests or requests for information from official bodies additional checks will be added to ensure all data contained in the scanned documentation is manually entered on the pilot record as well. The longer-term solution is for the ‘Aviation Licensing Discovery’ activity, which has been paused due to Covid-19 and BREXIT activities, to restart in February 2021. Where engagement with internal and external stakeholders will help clarify the end-to-end licensing requirements, enabling a solution to be created to meet all stakeholder needs and removing the additional burden of managing paper examiner report forms. The discovery phase will take 8 to 12 weeks with the solution passing through Alpha and Beta testing prior to going live approximately 18 months later.

We will provide a further update when the discovery phase reports its findings and the solution has been shaped in June 2021. With additional updates at key stages of development to ensure we remain on track for implementation in December 2022. AAIB Assessment: Adequate Action Status: Planned Action Ongoing Update Due 30 June 2021 Recommendation Status: Open Feedback rationale The AAIB notes the update from 1 December 2020 and requests a further update on progress in June 2021.

Air Accidents Investigation Branch Annual Safety Review 2020 39 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Recommendation 2020-006 Justification CO poisoning is known in the UK as the ‘silent killer’ as the gas cannot be seen, smelt or tasted and its effects can lead to a reduction in performance, permanent injury or death. Even the minor effects of CO poisoning can have a fatal consequence when operating an aircraft. As the existing two barriers to prevent CO poisoning (design and inspections) are not always effective, there is a need for a third barrier to alert pilots to the presence of CO in the cabin in time to take effective action. Low cost warning devices are readily available, and their carriage is actively encouraged by the regulators. Regulators have also produced specifications for CO detectors with active warnings. Although the carriage of a CO detector is at the owner’s and pilot’s discretion, it is unlikely that passengers, pilots under training and individuals who use cost sharing websites understand the risk. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-006 It is recommended that the Federal Aviation Administration require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide. Date Safety Recommendation made: 2 March 2020 LATEST RESPONSE Response received: 19 July 2020 The FAA is evaluating this recommendation and reviewing information related to carbon monoxide detectors that have been addressed in past issues for small airplanes. We anticipate providing an updated response by December 31, 2020. The FAA would like to thank the UK AAIB for submitting FAA Safety Recommendation 20.028 and its continued interest in aviation safety. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 31 December 2020 Recommendation Status: Open

Air Accidents Investigation Branch Annual Safety Review 2020 40 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Recommendation 2020-007 Justification As for Safety Recommendation 2020-006, the following Safety Recommendation was made: Safety Recommendation 2020-007 It is recommended that the European Union Aviation Safety Agency require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide. Date Safety Recommendation made: 13 March 2020 LATEST RESPONSE Response received: 11 December 2020 Prompted by the preliminary results of the Air Accidents Investigation Branch (AAIB) investigation, the European Union Aviation Safety Agency (EASA) has published the Safety Information Bulletin (SIB) No. 2020-01 ‘Carbon Monoxide (CO) Risk in Small Aeroplanes and Helicopters’ on 27 January 2020. The aim of the SIB is to inform Type Certificate and Supplemental Type Certificate holders, maintenance personnel, owners and operators of small aeroplanes (CS-LSA, CS-VLA and CS-23) and light helicopters (CS-27) with internal combustion engines or combustion heaters about the dangers of exposure to CO and to provide recommendations relating to the prevention, the detection and the reactions against CO exposure. The SIB also refers to several related publications from the AAIB, the UK Civil Aviation Authority (CAA) and EASA. In addition, the European Plan for Aviation Safety (EPAS 2020-2024) includes a regular update of the air operational rules (rulemaking task RMT.0392) to ensure efficiency and proportionality of the regulatory framework of Commission Regulation (EU) No 965/2012 laying down technical requirements and administrative procedures related to air operations. The associated Terms of Reference (ToR) were published on the EASA website on 07 October 2020, and, as stated on page 2 of the ToR, this safety recommendation will be considered within the framework of this RMT. See the following link to the ToR: https://www.easa.europa.eu/document-library/terms-of-reference-and-group- compositions/tor-rmt0392 The EPAS 2020-2024 indicates a planning milestone of 2021 Q1 for the associated Notice of Proposed Amendment (NPA). It should be noted that, depending on the complexity of the topics, several NPAs may be published in steps towards that target date.

Air Accidents Investigation Branch Annual Safety Review 2020 41 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 31 March 2021 Recommendation Status: Open Feedback rationale The AAIB requests an update in 2021 Q1 on the progress of this Safety Recommendation within the RMT, corresponding to the EPAS 2020-2024 planning milestone. Safety Recommendation 2020-008 Justification As for Safety Recommendation 2020-006, the following Safety Recommendation was made: Safety Recommendation 2020-008 It is recommended that the Civil Aviation Authority require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide. Date Safety Recommendation made: 14 March 2020 LATEST RESPONSE Response received: 14 May 2020 The Civil Aviation Authority does not currently accept this Recommendation but will revisit this position at the conclusion of an operational trial of carbon monoxide detectors. The Authority is considering what barriers in addition to good design and maintenance practice will be both effective in further minimising the likelihood of critical CO contamination in the UK GA fleet, whilst acknowledging that any such additional measures should be both practical and proportionate. On 3 March 2020, Safety Notice CAA SN 2020/003 was published which highlights the potential benefits of carrying low cost available commercial/domestic active detectors, as well as conventionally installed, approved aviation units. This Safety Notice will be advertised further through communication to all pilots when the current restrictions on recreational flying due to COVID-19 are lifted, to reduce the risk of this announcement being overlooked.

Air Accidents Investigation Branch Annual Safety Review 2020 42 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Importantly, the Safety Notice includes reference to a CAA-sponsored carriage trial of low‑cost, widely available units which is intended to facilitate informed decisions in the future regarding recommending (or possibly mandating) specific categories of devices. This trial will establish if there are any negative safety implications (such as loose article hazard or distraction) associated with the carriage of carbon monoxide detectors. However, given the implications of COVID-19 on the 2020 flying season and stakeholder events, the timing for this trial is currently under review. CAA Status – Open AAIB Assessment: Not Adequate Action Status: Not Enough Infomation

Recommendation Status: Open Feedback rationale The AAIB will await an update from the CAA on the results of its carriage trial of CO detectors including whether it intends to change its position on Recommendation 2020-008. Safety Recommendation 2020-009 Justification While the engine manufacturer produced guidance on how to examine its exhaust system, this guidance was not included or directly referenced in the aircraft manufacturer’s 100‑hour / Annual maintenance schedule. There was a warning in the introduction of the aircraft maintenance manual about consulting vendor publications, but there was no specific requirement in the 100-hour / Annual maintenance schedule for the PA-46-310P to pressurise the exhaust system to check for leaks. CO poisoning is known in the UK as the ‘silent killer’ as the gas cannot be seen, smelt or tasted and its effects can lead to a reduction in performance, permanent injury or death. Even the minor effects of CO poisoning can have a fatal consequence when operating an aircraft. As the existing two barriers to prevent CO poisoning (design and inspections) are not always effective, there is a need for a third barrier to alert pilots to the presence of CO in the cabin in time to take effective action. Low cost warning devices are readily available, and their carriage is actively encouraged by the regulators. Regulators have also produced specifications for CO detectors with active warnings. Although the carriage of a CO detector is at the owner’s and pilot’s discretion, it is unlikely that passengers, pilots under training and individuals who use cost sharing websites understand the risk.

Air Accidents Investigation Branch Annual Safety Review 2020 43 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-009 It is recommended that Piper Aircraft Inc. ensure that the 100-hour / Annual maintenance schedule for the PA-46 variants references the engine manufacturer’s guidance, where available, on inspecting and testing the exhaust system. Date Safety Recommendation made: 2 March 2020 LATEST RESPONSE Response received: 30 June 2020 Piper Aircraft, Inc. acknowledges and agrees with Safety Recommendation 2020-009: “It is recommended that Piper Aircraft Inc. ensure that the 100-hour / Annual maintenance schedule for the PA-46 variants references the engine manufacturer’s guidance, where available, on inspecting and testing the exhaust system.” In furtherance of and to accomplish the above safety recommendation, Piper Aircraft commits to the following:

1. Work with Original Equipment Manufacturers to determine the best way to convey the

importance of thorough exhaust system inspections.

1. Review its maintenance and overhaul manuals to determine whether additional

elaboration would increase the chance of a qualified mechanic finding a potentially un-airworthy condition. Piper will endeavour to complete this review to have any amplifications implemented in the aircraft maintenance manual in as timely a manner practical given the business constraints such as COVID-19, etc. AAIB Assessment: Adequate Action Status: Planned Action Ongoing Update Due 31 December 2020 Recommendation Status: Open Feedback rationale Piper Aircraft’s proposed actions allow their response to the Safety Recommendation to be classified as Adequate, Open. An update is requested when the proposed actions have been completed or by the end of 2020, whichever is earlier.

Air Accidents Investigation Branch Annual Safety Review 2020 44 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Bell 429, G-WLTS 2 January 2019 at Melksham Airbase, Wiltshire Synopsis The report considers two events which occurred while the pilot was conducting a Power Assurance Check. In one, an un‑commanded yaw pedal movement caused a rapid rotation of the helicopter through two and a half complete rotations; in the other, a trim runaway was contained by the pilot. The trim runaway was found to be an unknown feature of the Automatic Flight Control System logic. Following these events, safety action was taken by the helicopter manufacturer and Transport Canada to help crews respond to a yaw trim runaway and to address the underlying causal factor. Also, the flight recorder manufacturer improved the way it reported the results of CVR recording inspections. Two Safety Recommendations are made: one to Transport Canada in relation to conduct of the Power Assurance Check; and one to the European Union Aviation Safety Agency to ensure that the installation of new equipment on aircraft does not have a detrimental effect on existing equipment. Safety Recommendation 2020-010 Justification The Power Assurance Check (PAC is not mentioned in Rotorcraft Flight Manual (RFM) Normal Procedures for normal operations. The description of the PAC is in the Performance section of the manual, where it states that the PAC should be completed daily. However, it does not define the required configuration for the APs and AFCS and does not specify whether the PAC should be carried out pre- or post-flight. The operator conducted the PAC out of sequence with the RFM Category A Supplement, where the intent is to carry it out as part of the pre-flight procedures for every flight. The main body of the RFM, however, does not require the PAC to be conducted on the first start of a day, only that it should be achieved on a daily basis. The PAC is a normal procedure but is not reflected in the Normal Procedures section of the RFM. The inclusion of a defined procedure in Section 2 of the RFM, including starting parameters before the procedure such as AP status, would reduce ambiguity and allow flexibility in the timing of the procedure. Autopilot control panel Autopilot controls

Air Accidents Investigation Branch Annual Safety Review 2020 45 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-010 It is recommended that Transport Canada require Bell Textron Canada Limited to amend Section 2 of the Bell 429 GlobalRanger Rotorcraft Flight Manual to include a Normal Procedure for the conduct of the daily Power Assurance Check. Date Safety Recommendation made: 23 April 2020 LATEST RESPONSE Response received: 6 January 2021 Regarding AAIB Safety Recommendation(s) No 2020-010 The RFM for the Bell 429 has been revised. The revision concerns the AAIB Safety Recommendation. AAIB Assessment: Partially Adequate Action Status: Planned Action Completed Recommendation Status: Closed Feedback rationale Although Transport Canada (TC) declined to accept the Safety Recommendation, the RFM revision goes some way to address its intent. Following publication of the RFM revision, therefore, this Safety Recommendation is closed. Safety Recommendation 2020-011 Justification If newly installed equipment interfaces (and shares information) with other existing equipment on an aircraft, tests must be conducted to ensure the installation has not had a detrimental effect on the existing equipment (these tests are in addition to any electromagnetic compatibility/interference testing). EASA specifically reminds Minor Change applicants of this in guidance contained in their ‘Minor Change Certificate Document’. The document is aimed at applicants making changes to GA aircraft, and especially those who are not Design Organisation Approval holders and who may have limited experience in the change process. There is, however, no equivalent guidance or reminder to organisations qualified and practised in carrying out changes or repairs to Commercial Air Transport aircraft, leaving the potential for these tests to be overlooked and the continued airworthiness of the aircraft to be compromised.

Air Accidents Investigation Branch Annual Safety Review 2020 46 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-011 It is recommended that the European Union Aviation Safety Agency remind Minor Change applicants of the importance of verifying that new equipment does not have a detrimental effect on existing equipment with which it has a direct interface. Date Safety Recommendation made: 21 April 2020 LATEST RESPONSE Response received: 26 July 2020 The European Union Aviation Safety Agency (EASA) will undertake both corrective and preventive actions. First, a dedicated inspection will be performed on the relevant Design Organisation Approval (DOA) holder, with particular attention given to the aspects pertinent to this serious incident. Second, a safety-promotion article will be published in EASA’s Certification & Design Newsletter, to highlight that the installation of certain equipment needs an electromagnetic and audio interference test, as part of the compliance demonstration, before the approval change. An update will be sent to the Air Accidents Investigation Branch once these actions have been performed. AAIB Assessment: Adequate Action Status: Planned Action Ongoing Update Due 28 February 2021 Recommendation Status: Open Feedback rationale EASA is requested to provide an update when the actions are complete or by the end of February 2021, whichever is sooner.

Air Accidents Investigation Branch Annual Safety Review 2020 47 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Standard Cirrus 75, G-DDGX 27 July 2019 at Gwernesney Airfield, Monmouthshire Synopsis The glider was undertaking an aerotow launch to the west at Gwernesney Airfield which was operated by the resident gliding club. During the early stages of the ground roll the horizontal tailplane (tailplane) detached from G-DDGX and fell to the ground. Club members assisting with the launch signalled for the takeoff to be aborted but the message did not reach the aerotow tug pilot; the accident pilot did not appear to hear or see the stop signals either. The glider became airborne and climbed rapidly, before the tow cable released and the aircraft’s nose dropped. The glider descended steeply and struck the ground nose first. It came to rest inverted pointing in an easterly direction. First responders extricated the pilot from the aircraft before he was airlifted to hospital. He died five days later from complications related to injuries sustained in the accident. The investigation determined that the tailplane had not been correctly attached when the glider was rigged and this condition was not detected prior to the flight. Several possible mis-rigging scenarios were identified during the investigation, but the precise manner in which the tailplane had been mis-rigged could not be determined. Two Safety Recommendations are made relating to communication for glider launching and detecting incorrect alignment of tailplane locking features. In addition, the gliding club has undertaken several safety actions regarding launch signalling and detection of incorrect tailplane locking on other Standard Cirrus gliders. Safety Recommendation 2020-012 Justification The BGA’s guidance notes highlight the limitations of hand signals and ‘strongly’ recommend that radios are used during aerotows. While pilot-to-pilot communications would not have prevented this accident, intervention by a radio-equipped launch observer, as occurred in the Ventus glider incident, may have influenced the outcome. Rear tailplane mechanism partially engaged, front fitting disengaged

Air Accidents Investigation Branch Annual Safety Review 2020 48 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-012 It is recommended that the British Gliding Association specifies in its Operational Regulations the minimum requirements for an ‘adequate system of communication’ for glider launching. Date Safety Recommendation made: 20 May 2020 LATEST RESPONSE Response received: 2 October 2020 The BGA accepts that its Operational Regulations regarding signalling should be reviewed and updated. BGA Operational Regulations are high level BGA requirements which are periodically reviewed and can only be significantly modified following a general meeting. Supporting detail is generally published elsewhere to facilitate change. As a result of this accident, several BGA Operational Regulations have been redrafted and will be approved by the membership in their next general meeting. In addition, Managing Flying risk has been updated. The following text describes the proposed changes: PLANNED NEW OPERATIONAL REGULATION REPLACING OP REGS 34, 35 AND 36: Op Reg XX. Launch signalling. A reliable and unambiguous signalling system shall be used for all launches. PLANNED NEW OPERATIONAL REGULATION REPLACING OP REGS 37, 38 AND 39 Op Reg XX. Emergency signals – aerotow. The following emergency signals shall apply:

Aerotow Release. The tug pilot orders the glider pilot to release immediately by rocking the tug laterally.

Unable to Release on Aerotow. The glider pilot either communicates the problem to the tug pilot by radio, or alternatively signals ‘unable to release’ by flying out to the left side of the tug as far as is practicable and rocking the glider laterally.

Excessive Drag on Aerotow. The tug pilot either communicates the problem to the glider pilot by radio, or alternatively signals that the glider is producing excessive drag (for example the glider airbrakes are open or the drogue parachute is deployed) by waggling the rudder.

Air Accidents Investigation Branch Annual Safety Review 2020 49 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview RECENTLY UPDATED MANAGING FLYING RISK TEXT Launch signalling Launch signalling from the ground does not remove the responsibility for the safe conduct of the launch from the pilot in command. Recognised methods of launch signalling

The recognised methods of launch signalling include radio and other wireless transmission, lights, and hand/bat signals. Release of the tow rope or cable by the glider or tug pilot on the ground signals the pilots intent not to launch. Terminology

To minimise the risk of a misunderstanding during launch signalling, which is a safety critical activity, ‘take-up slack’, ‘all out’ and ‘stop’ are the standard terms where verbal commands are used during launches.

Use of signalling lights and signalling by hand - limitations

Light or hand signalling can result in a delayed response, can be difficult to see (even when using bats for hand signalling) or interpret in poor visibility or against bright sunlight, and may not be seen once the launch progresses, for example when a tug pilot is focussed on starting the take-off.

Where signalling lights are utilised, they should not be red or green in colour. Use of signalling lights and signalling by hand/bat - protocol Lights: a. Take up slack: light dashes of one second duration and three seconds interval. b. All out: light dots at one second interval. c. Stop: steady light. By hand: a. Take up slack: arm swung underarm. b. All out: arm swung from side to side above the head. c. Stop: arm held stationary vertically above the head. Signalling – aerotow

Radio communication should be established between the launching operation and the towing aircraft. Where radio communication is not possible, another of the recognised methods of signalling to stop the launch should be available.

Air Accidents Investigation Branch Annual Safety Review 2020 50 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Signalling – wire launches

The method of communication used between the launch point and winch (or tow car) should result in reliable signalling for the duration of each launch and may be visual or audible. It is highly desirable for the signalling system to reliably allow an immediate audible and visual STOP command to be sent to the winch driver. Wireless signalling can provide near-instant communication to audible and visual indicators in the winch cab. Please note that a short period at the start of a personal management radios (PMR) radio transmission can be lost during channel identification. This shortcoming can be addressed by repeating the launch command, eg. “All out. All out” or “Stop. Stop”. AAIB Assessment: Adequate Action Status: Planned Action Ongoing Update Due 02 April 2021 Recommendation Status: Open Feedback rationale Whilst the AAIB accept that the BGA have met the intent of the recommendation, the AAIB request that following the next BGA General Meeting, the BGA confirm that the redrafted regulations have been approved. Safety Recommendation 2020-013 Justification Following this accident, for gliders with similar tailplane locking features to that of the Standard Cirrus 75, the gliding club introduced tell-tale markings to show the approximate required position of the locking lever and make it easier to detect incorrect alignment. The EASA recommended that such markings indicating the correct position for locking levers should be green in colour. Similar tailplane attachment mechanisms are known to be used on other types of glider. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-013 It is recommended that the European Union Aviation Safety Agency require a means to detect incorrect alignment of the tailplane locking lever on gliders with locking features similar to the Standard Cirrus 75. Date Safety Recommendation made: 20 May 2020

Air Accidents Investigation Branch Annual Safety Review 2020 51 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview LATEST RESPONSE Response received: 26 April 2021 AAIB acknowledge that the EASA needs to consult with the manufacturer, and expect an update is March 2021. Following the European Union Aviation Safety Agency (EASA)’s investigation of this issue in cooperation with the sailplane Type Certificate Holder, Schempp-Hirth, an Airworthiness Directive (AD) AD-2020-0260 has been issued in order to address this issue linked to elevator attachment. Furthermore, Safety Information Bulletin (SIB) SIB-2019-07 addressing sailplane rigging is being revised to add more examples. A further update will follow. The AD specifies: 1) Within 90 days after the effective date of the AD, to modify the (powered) sailplane by installing an optical indicator in accordance with the instructions of the TN. 2) Concurrently with the modification of the (powered) sailplane amend the AFM of that (powered) sailplane in accordance with the instructions of the TN, inform all pilots and, thereafter, operate the (powered) sailplane accordingly. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed

Air Accidents Investigation Branch Annual Safety Review 2020 52 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Britten-Norman Islander BN-2A-27, VP-MNI 23 September 2019 at John A Osborne Airport, Montserrat Synopsis The aircraft was flying from Antigua to Montserrat, which was experiencing a heavy rain shower. After the shower had passed the aircraft made a normal approach in a light tailwind to Runway 10, which was still wet from the rain. The pilot made a positive touchdown and applied appropriate braking but was unable to stop the aircraft. The pilot steered the aircraft to the right but it skidded through 180° and departed the level surface of the airfield backwards, down a steep incline at the end of the runway, before coming to a stop when the tail caught in the airport security fence. The pilot and passengers were able to exit the aircraft and the airport rescue and firefighting service responded promptly. No aircraft defects were found that would have contributed to the outcome. The touchdown groundspeed was 79 kt, which was higher than appropriate, either because the approach was flown at an airspeed greater than the normal 65 kt, or because of a significant change in windspeed and direction during the approach. This, combined with a wet runway and skidding, resulted in the aircraft requiring more distance to stop than was available on the runway. Three Safety Recommendations are made regarding aircraft operation, access for rescue and firefighting vehicles, and a means of arresting aircraft that overrun the runway. Safety Recommendation 2020-014 Justification Local wind variations specific to this aerodrome affect landings. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-014 It is recommended that Air Safety Support International Ltd ensure that pilots and operators intending to use John A Osborne Airport take account of local wind variations, and require operators to demonstrate how they will achieve this. Date Safety Recommendation made: 13 May 2020 VP-MNI at the point of touchdown on Runway 10

Air Accidents Investigation Branch Annual Safety Review 2020 53 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview LATEST RESPONSE Response received: 14 May 2020 The runway itself and the associated operating conditions at Montserrat have been the subject of an ongoing monitoring programme by ASSI over a significant period of time. In the past, NOTAMSs have also been issued to advise operators of the adverse runway conditions when wet. A runway refurbishment programme is well underway and this is planned for completion by the end of 2020. Furthermore, and enhanced Governor’s Instruction (MON 004) was issued on 24th  February  2020 which required Commercial Air Transport operators to complete safety risk assessments, paying particular attention to the awareness of potential local wind variations including possible significant turbulence, windshear and downdraft during approach and climb out. The Safety Risk Assessment is aimed at mitigating any residual risk and providing flight crew with sufficient guidance to operate at the Aerodrome. We consider that the combination of runway refurbishment programme and the Governor’s Instruction, a copy of which is attached for reference, satisfies the requirements of Safety Recommendation 2020-014. AAIB Assessmen: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Safety Recommendation 2020-015 Justification Difficult terrain in the aerodrome surroundings prevents ready access to emergency services. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-015 It is recommended that the operator of John A Osborne Airport provide adequate access to the Difficult Environs at the east end of Runway 10 to ensure that emergency services can reach expeditiously the location of an aircraft which has overrun the end of the runway. Date Safety Recommendation made: 13 May 2020

Air Accidents Investigation Branch Annual Safety Review 2020 54 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview LATEST RESPONSE Response received: 5 November 2020 The government received written permission to access the land to ensure that emergency services can reach expeditiously to the location of an aircraft which has overrun the end of the runway. Picture evidence of the four completed trails was sent via email on Tuesday 13th October 2020 for the possible closure of this safety recommendation. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Safety Recommendation 2020-016 Justification Terrain adjacent to the runway ends is hazardous to aircraft that overrun, and prevents ready access by emergency services. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-016 It is recommended that the operator of John A Osborne Airport install a means of arresting the progress of an aircraft that has overrun either end of the runway in order to minimise the risk injury to those onboard and to ensure that emergency services can reach them expeditiously. Date Safety Recommendation made: 13 May 2020 LATEST RESPONSE Response received: 19 February 2021 With the support of ASSI we have conducted further, extensive research into addressing the recommendation. Our intention was to ascertain the availability and practicalities of installing such a system however, the second review supported our original stance that a suitable, approved system is not available and the environment at the John A. Osborne Airport would not allow for effective installation and efficient operations due to the length of the runway and difficulties with the surrounding environs. John A. Osborne Airport is located on what is, effectively, a small plateau and as such, there is insufficient space to install any type of barrier / net or an ‘EMAS-type’ system

Air Accidents Investigation Branch Annual Safety Review 2020 55 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview which could provide any appreciable deceleration or restraint in the event of a runway excursion. For example, approved barriers come with large hydraulic systems and robust stanchions which are simply too large for the available area. The adoption of an ad-hoc, untried ‘fence’ is, in our opinion fraught with uncertainty and could actually introduce more risk than currently exists. Any locally installed catch-fencing would likely be supported by non-frangible posts, set into concrete with all the dangers of airframe and undercarriage damage and the potential risk of ruptured fuel tanks and uncontrolled fires that represents. That said, we fully support the view that the risks of injury to those on board an aircraft which has overrun either end of the runway must be minimised to As Low As Reasonably Practicable (ALARP) and therefore, it may be helpful to make you aware of the additional mitigations which we are putting in place. New markings on the edge of the runway are intended as aiming point markers or (more simply put) ‘throw-away’ indicators. Their purpose is self-explanatory in that pilots who have not positively touched down by those points must execute a missed approach. Thus far, the feedback from the pilots has been very supportive. Secondly, the runway re-surfacing project has been approved and the work to provide a new, grooved surface with a significantly improved friction level, will be completed during the first quarter of 2021 which should significantly reduce the risk of hydroplaning. The additional measures which both the Airport and ASSI have put in place (including a revised Governors instruction ensuring competent and current pilots who take account of wind variations) are robust, pragmatic, and proportionate for an operation of this size and with this level of traffic. They will provide significant safety enhancements in the longer term whilst we continue our search for an arrestor system and ensure that the runway remains complaint with accepted international standards. AAIB Assessment: Partially Adequate Action Status: Planned Action Completed Recommendation Status: Closed Feedback rationale The AAIB acknowledges the Airport operator’s response to the Safety Recommendation and the action it has taken to explore suitable mitigations. It has not installed a means of arresting the progress of an aircraft that has overrun the runway, and the associated hazards remain, but the response includes other action to reduce the likelihood of overruns and to improve access for emergency services. .

Air Accidents Investigation Branch Annual Safety Review 2020 56 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview DJI M600 PRO, (UAS registration n/a) 13 December 2019 at Wallsend, Tyne and Wear Synopsis The UAS, a DJI M600 Pro, was being operated in an automated flight mode to survey a construction site when a GPS-compass error caused the aircraft to revert to a flight mode that required manual control. By the time that the pilot and observer realised that it was not responding to the return-to-home (RTH) function, visual line of sight was lost when the aircraft drifted with the wind beyond a line of trees. It subsequently collided with the roof of a house before falling into the property’s rear garden. No persons were injured. The pilot, and the observer who was also a pilot, had operated UASs since 2018 and had the required permissions from the UK CAA. Both pilots had relied predominantly on the automated flight capability of their aircraft and had not, nor were required to have, practised for emergencies since completing their flying training in 2018. One Safety Recommendation is made to the UK CAA. Safety Recommendation 2020-017 Justification The CAA required that any person or organisation operating a UAS with a mass of no more than 20 kg for commercial work in the UK required permission, which was commonly referred to as Permissions for Commercial Operations (PfCO). A PfCO was renewed annually but the CAA did not require, nor provide guidance on, practising for emergencies or maintaining manual flying skills as part of the PfCO renewal. However, manual flying is a perishable skill that UAS operators may need to rely on in the event of an emergency. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-017 It is recommended that the Civil Aviation Authority require that operators issued with a Permissions for Commercial Operations (PfCO) include in their operations manuals the need to practise routinely the actions to take in the event of emergencies, and specify how pilots will remain competent at maintaining manual control of their aircraft in the event that automated flight modes are lost. Date Safety Recommendation made: 19 June 2020 M600 series aircraft The accident aircraft was fitted with three GPS antenna

Air Accidents Investigation Branch Annual Safety Review 2020 57 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview LATEST RESPONSE Response received: 30 July 2020 The CAA accepts this Recommendation. CAA Safety Notice SN-2020/10 was issued on 22 June 2020, detailing recommendations to all Remote Pilots (RPs), National Qualified Entities and Recognised Assessment Entities. It strongly recommends that all Remote Pilots ensure they are confident in their abilities to recognise and react to likely emergencies and are familiar with the warnings generated by their UAS. It also strongly recommends that RPs regularly practice identifying and responding to emergencies, and maintain competence in reversionary flying modes. The Safety Notice also advises that Operations Manuals will need to assure the CAA that an operation is safe enough by describing complete and effective emergency procedures, and providing schedules for RP practice of emergencies. The same advice was given to NQEs/RAEs, to ensure that they reinforce the content of the Safety Notice to their customers. The UAS Sector Team Surveyors and Inspectors have been briefed to pay particular attention to emergency handling and pilot training currency sections of Operating Safety Cases. Additionally, checks will be made to incoming applications and renewals for Permissions for Commercial Operations for the same. RAE paperwork will be checked for the advice given to their customers when received. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed

Air Accidents Investigation Branch Annual Safety Review 2020 58 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Airbus A320-214, OE-LOA 1 March 2019 at London Stansted Airport Synopsis The aircraft was on a scheduled flight from London Stansted Airport to Vienna International Airport, Austria. Shortly after the takeoff roll was commenced it was rejected, due to a contained failure of the left engine, and the aircraft was brought to a stop on the runway. Just as the flight crew were about to taxi the aircraft off the runway, an evacuation was commanded by the Senior Flight Attendant. The investigation identified several factors that contributed to this decision. Ten passengers were treated for minor injuries that occurred during the evacuation and there was a risk of serious injury due to one of the engines running during the evacuation. The operator has taken several safety actions, principally based around the training of its flight attendants. Two Safety Recommendations regarding passenger evacuation have been made in this report. The left engine experienced a contained failure following the rupture and release of several blades from the first stage of the high-pressure compressor. The investigation found that the blades fractured as a result of high-cycle fatigue loading which initiated in the dovetail (part of the blade root), due to a once-per-revolution aerodynamic excitation. An inlet guide vane lever arm had been improperly assembled which led to aerodynamic excitation of the passing blades and the resulting forces exceeded the design loads of the blades. Safety Recommendation 2020-018 Justification The evidence from this accident, in combination with the collated evidence from previous cases shows that, even despite recent improvements, it remains the case that passenger briefing, safety cards and FA instructions are insufficient to stop passengers retrieving cabin baggage during an evacuation. This hazard will still exist in future emergencies unless additional measures are taken to either reduce the impact of that behaviour on the safety and speed of an evacuation or to prevent passengers evacuating with baggage. RFFS infrared CCTV showing some passengers leaving with baggage

Air Accidents Investigation Branch Annual Safety Review 2020 59 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-018 It is recommended that the European Union Aviation Safety Agency commission research to determine how to prevent passengers from obstructing aircraft evacuations by retrieving carry-on baggage. Date Safety Recommendation made: 20 August 2020 LATEST RESPONSE Response received: 15 November 2020 The safety issue “Emergency Evacuation” is included in the Safety Risk Portfolio (SRP) for large aeroplanes, as part of the European Union Aviation Safety Agency (EASA) Safety Risk Management (SRM) process (see the Annual Safety Review 2020, published on the EASA web site at: https://www.easa.europa.eu/newsroom-and-events/news/easapublishes- annual-safety-review-asr-2020). The SRP is used to trigger the assessment of safety issues, to target analysis activities over key risk areas and to prioritise safety actions. This includes consideration of the exposure to the hazard and its predicted evolution in the coming years, the expected safety benefit of the mitigation recently implemented or committed, or recommended, and reprioritisation of actions where appropriate. Passengers taking hand luggage preventing or slowing down the evacuation is one of the identified sub-set of associated risks. The Emergency Evacuation safety issue is currently under development of recommendations for actions in accordance with the Best Intervention Strategy (BIS) process, with potential inclusion of the mitigating actions in the European Plan for Aviation Safety (EPAS). The recommendation, for EASA to commission research to determine how to prevent passengers from obstructing aircraft evacuations by retrieving carry-on baggage, will be considered within this process. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 21 June 2021 Recommendation Status: Open Feedback rationale The European Union Aviation Safety Agency has confirmed that the recommendation to commission research into preventing passengers from obstructing aircraft evacuations by retrieving carry-on baggage will be considered for inclusion under the European Union Aviation Safety Agency Safety Risk Management process. The AAIB requests an update by 21 June 2021.

Air Accidents Investigation Branch Annual Safety Review 2020 60 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Recommendation 2020-019 Justification During an emergency evacuation, a proportion of passengers will attempt to leave the aircraft with their carry-on baggage slowing the evacuation process. The emergency evacuation demonstrations conducted to show compliance with CS-25 do not include a realistic simulation of this aspect of passenger behaviour which will slow down the evacuation and increase the risk of injury. Therefore, the following Safety Recommendation is made: Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-019 It is recommended that the European Union Aviation Safety Agency consider including a more realistic simulation of passenger behaviour in regard to carry‑on baggage in the test criteria and procedures for the emergency demonstration in CS-25. Date Safety Recommendation made: 20 August 2020 LATEST RESPONSE Response received: 15 November 2020 The aeroplane evacuation demonstration requirement in Certification Specification (CS) CS 25.803(c) and the test criteria and procedures in Appendix J to CS-25 are not intended to investigate all possible emergency evacuation scenarios that may occur in service. In particular, the emergency demonstration does not intend to take into account the impact from unruly passengers. The emergency demonstration provides a standard method for assessing the evacuation capability of the aeroplane and to demonstrate the effectiveness of crew emergency procedures and training. The related test conditions and pass/fail criteria (e.g. the 90 seconds limit to the evacuation time) demonstrate that the aircraft design provides an acceptable level of performance in a standard evacuation scenario. The simulation of passenger behaviour with regards to carry-on baggage would not provide appreciable added value in the evaluation of the aircraft design, and would result in an increased risk of injury for certification test participants. The European Union Aviation Safety Agency (EASA) therefore does not deem it is appropriate to amend CS 25.803(c) and Appendix J to CS-25 as suggested by this safety recommendation.

Air Accidents Investigation Branch Annual Safety Review 2020 61 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview AAIB Assessment: Partially Adequate Action Status: Planned Action Completed Recommendation Status: Closed Feedback rationale The European Union Aviation Safety Agency have considered the Safety Recommendation and stated that the test criteria and procedure in Appendix J of CS-25 are not intended to investigate all possible emergency evacuation scenarios and provide a standard method for assessing the evacuation capability of the aeroplane and to demonstrate the effectiveness of crew emergency procedures and training. The European Union Aviation Safety Agency does not consider that the simulation of passenger evacuation with carry-on baggage would not improve the certification process and would result in an increased risk of injury for certification test participants.

Air Accidents Investigation Branch Annual Safety Review 2020 62 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview ERJ 190-200 LR, G-FBEJ 28 February 2019 at Exeter Airport, Devon Synopsis As the thrust levers were advanced for takeoff, on an early morning scheduled passenger flight, the flight crew detected an unusual odour and observed smoke entering the cockpit. They then moved the thrust levers to the idle position and applied the parking brake. The cabin crew subsequently reported that there were smoke and fumes in the cabin. Following an assessment of the situation, the commander initiated an emergency evacuation. During the evacuation, passengers who evacuated via the overwing exits reported being unsure of how to get down from the wing to the ground and several re-entered the cabin and exited via one of the escape slides. The smoke and fumes were subsequently attributed to an incorrectly performed engine compressor wash procedure, which was carried out by maintenance personnel the night before the occurrence flight.

As a result of the findings of this investigation, the European Union Aviation Safety Agency (EASA) has undertaken two safety actions relating to the certification requirements for overwing emergency exits. The operator has also undertaken several safety actions relating to passenger safety briefings, processes for maintenance planning, engineer training, competency and welfare and monitoring of ground equipment. Four Safety Recommendations are made relating to the certification requirements for overwing exit markings and the height requirement for overwing exits to be equipped with an assisted means of escape. Safety Recommendation 2020-020 Justification Despite the presence of a marked exit route on the wing with a non-slip surface, many passengers who exited via the overwing exits reported being uncertain where to go once out of the aircraft. Overwing exit route markings are not always readily identifiable and may be even less so in darkness. Poor weather conditions or the presence of smoke could also hinder identification of an exit route. It is apparent that the issue of ambiguous overwing escape route markings that resulted in previous AAIB Safety Recommendations 2002-42 and 2010-007 still exists. Overwing exit escape route markings on E195 (view towards wing trailing edge)

Air Accidents Investigation Branch Annual Safety Review 2020 63 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-020 It is recommended that the European Union Aviation Safety Agency amends the certification requirements relating to the design, contrast and conspicuity of overwing exit escape route markings on commercial air transport aircraft, to ensure that the route to be taken from wing to ground is immediately apparent to evacuating passengers, in a range of emergency scenarios. Date Safety Recommendation made: 10 September 2020 LATEST RESPONSE Response received: 11 December 2020 The European Union Aviation Safety Agency (EASA) will assess this recommendation within the frame of the Best Intervention Strategy (BIS) for Emergency Evacuation. BIS are fundamental components of the Safety Risk Management (SRM) programming cycle used to assess the criticality of an issue, and identify the relevant actions for the European Plan for Aviation Safety (EPAS). A BIS report contains the assessment and rationale to determine relevant and proportionate actions. The first draft of this BIS is planned for Q1/2021. The BIS will identify the need for action(s) and, if necessary, will define the adequate relevant one(s) to be included in the EPAS after consultation with the Advisory Bodies. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 19 July 2021 Recommendation Status: Open Feedback rationale The EASA has confirmed that it will assess this recommendation within the frame of the Best Intervention Strategy (BIS) for Emergency Evacuation. The first draft of this BIS is planned for Q1 of 2021. The AAIB request an update by 19 July 2021.

Air Accidents Investigation Branch Annual Safety Review 2020 64 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Recommendation 2020-021 Justification As for Safety Recommendation 2020-020, the following Safety Recommendation was made: Safety Recommendation 2020-021 It is recommended that the Federal Aviation Administration amends the certification requirements relating to the design, contrast and conspicuity of overwing exit escape route markings on commercial air transport aircraft, to ensure that the route to be taken from wing to ground is immediately apparent to evacuating passengers, in a range of emergency scenarios. Date Safety Recommendation made: 10 September 2020 LATEST RESPONSE Response received: 22 February 2021 The FAA chartered the Emergency Evacuation Standards Aviation Rulemaking Committee (ARC) to review various regulatory standards, and in-service events, that apply to emergency evacuations. The ARC also evaluated several issues cited by the National Transportation Safety Board, the United States Congress, and from public inquiries to the FAA, 2 related to recent emergency evacuations. This review included the emergency evacuation of the Embraer ERJ 190-200 LR (E195) aircraft on February 28, 2019, that led the UK AAIB to issue these safety recommendations. Based on a review of the evacuation events through overwing exits, the ARC determined that some evacuees do not understand how or where to egress from a wing when no escape slide is provided. A review of the applicable regulations and guidance reveals potential for improvement, recognizing escape route markings alone do not always appear to provide enough instructions to guide evacuees to the location where they should exit from the wing. The FAA will review the ARC recommendations upon their completion and determine what actions may be warranted by the safety benefit to be gained in relation to the cost of implementing any recommendations. In conjunction with other aviation authorities, the FAA will review the requirements in Title 14, Code of Federal Regulations § 25.810, Emergency Egress Assist Means and Escape Routes for Marking the Escape Routes, from overwing exits. We will determine what actions may be effective to improve passenger recognition and enable safe transition from the wing to the ground. This action will include reassessing the 6 foot (1.8 meter) threshold for assist means cited in §§ 25.810 (a) and (d). We will provide a follow-on response updating you on our actions no later than January 31, 2022.

Air Accidents Investigation Branch Annual Safety Review 2020 65 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 31 January 2022 Recommendation Status: Open Feedback rationale The AAIB acknowledges the FAA’s response and requests an update on the outcome of the review of the Emergency Evacuation Standards Aviation Rulemaking Committee (ARC) recommendations by 31 January 2022. Safety Recommendation 2020-022 Justification Emergency exits that do not meet the 1.8 m maximum height criteria of FAR/CS 25.810 are not required to be equipped with an evacuation slide. This applies equally to overwing and non-overwing exits. Jumping from heights of up to 1.8 m can be challenging for many passengers and has the potential to cause injury. Similar findings were documented in a 2009 EASA study and prior to that, an NTSB safety study, which made a Safety Recommendation to the FAA on this subject. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-022 It is recommended that the European Union Aviation Safety Agency, re- evaluate and reduce the 1.8 m height criteria in CS 25.810(a) and (d), for the provision of an assisted means of escape at emergency exits, to minimise passenger injuries and reduce egress time during emergency evacuations. Date Safety Recommendation made: 10 September 2020 LATEST RESPONSE Response received: 11 December 2020 The European Union Aviation Safety Agency (EASA) will assess this recommendation within the frame of the Best Intervention Strategy (BIS) for Emergency Evacuation. BIS are fundamental components of the Safety Risk Management (SRM) programming cycle used to assess the criticality of an issue, and identify the relevant actions for the European Plan for Aviation Safety (EPAS). A BIS report contains the assessment and rationale to determine relevant and proportionate actions.

Air Accidents Investigation Branch Annual Safety Review 2020 66 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview The first draft of this BIS is planned for Q1/2021. The BIS will identify the need for action(s) and, if necessary, will define the adequate relevant one(s) to be included in the EPAS after consultation with the Advisory Bodies. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 19 July 2021 Recommendation Status: Open Feedback rationale The EASA has confirmed that it will assess this recommendation within the frame of the Best Intervention Strategy (BIS) for Emergency Evacuation. The first draft of this BIS is planned for Q1 of 2021. The AAIB request an update by 19 July 2021 Safety Recommendation 2020-023 Justification As for Safety Recommendation 2020-022, the following Safety Recommendation was made: Safety Recommendation 2020-023 It is recommended that the Federal Aviation Administration, re-evaluate and reduce the 1.8 m height criteria in FAR 25.810(a) and (d), for the provision of an assisted means of escape at emergency exits, to minimise passenger injuries and reduce egress time during emergency evacuations. Date Safety Recommendation made: 10 September 2020 LATEST RESPONSE Response received: 22 February 2021 The FAA chartered the Emergency Evacuation Standards Aviation Rulemaking Committee (ARC) to review various regulatory standards, and in-service events, that apply to emergency evacuations. The ARC also evaluated several issues cited by the National Transportation Safety Board, the United States Congress, and from public inquiries to the FAA, 2 related to recent emergency evacuations. This review included the emergency evacuation of the Embraer ERJ 190-200 LR (E195) aircraft on February 28, 2019, that led the UK AAIB to issue these safety recommendations. Based on a review of the evacuation events through overwing exits, the ARC determined that some evacuees do not understand how or where to egress from a wing when no escape slide is provided. A review of the applicable regulations and guidance reveals

Air Accidents Investigation Branch Annual Safety Review 2020 67 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview potential for improvement, recognizing escape route markings alone do not always appear to provide enough instructions to guide evacuees to the location where they should exit from the wing. The FAA will review the ARC recommendations upon their completion and determine what actions may be warranted by the safety benefit to be gained in relation to the cost of implementing any recommendations. In conjunction with other aviation authorities, the FAA will review the requirements in Title 14, Code of Federal Regulations § 25.810, Emergency Egress Assist Means and Escape Routes for Marking the Escape Routes, from overwing exits. We will determine what actions may be effective to improve passenger recognition and enable safe transition from the wing to the ground. This action will include reassessing the 6 foot (1.8 meter) threshold for assist means cited in §§ 25.810 (a) and (d). We will provide a follow-on response updating you on our actions no later than January 31, 2022. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 14 September 2021 Recommendation Status: Open

Feedback rationale The AAIB acknowledges the FAA’s response and requests an update on the outcome of the review of the Emergency Evacuation Standards Aviation Rulemaking Committee (ARC) recommendations by 31 January 2022.

Air Accidents Investigation Branch Annual Safety Review 2020 68 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview DHC-8-402, G-FLBE 14 November 2019 at In flight from Newquay Airport to London Heathrow Airport Synopsis Shortly after takeoff in a strong crosswind, the pilots noticed that both handwheels were offset to the right in order to maintain wings level flight. The aircraft diverted to Exeter Airport where it made an uneventful landing. The handwheel offset was the result of a break in a left aileron cable that ran along the wing rear spar. In the course of this investigation it was discovered that the right aileron on G-FLBE, and other aircraft in the operator’s fleet, would occasionally not respond to the movement of the handwheels. Non- reversible filters were also fitted to the operator’s aircraft that meant that it was not always possible to reconstruct the actual positions of the control wheel, column or rudder pedals recorded by the Flight Data Recorder. The aircraft manufacturer initiated safety actions to improve the maintenance of control cables and to determine the extent of the unresponsive ailerons across the fleet. Three Safety Recommendations are made in this report for the unresponsive aileron and filtering of the control position data. Safety Recommendation 2020-024 Justification The investigation discovered that aileron control surfaces on some DHC-8-400 aircraft were freezing in flight. This SR requires TC to investigate further. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-024 It is recommended that Transport Canada require De Havilland Canada to determine why the aileron control surfaces on the DHC-8-400 series of aircraft can become unresponsive to handwheel movements and ensure that the findings and any rectification action is promulgated to operators. Date Safety Recommendation made: 8 October 2020 QRH Roll Control Malfunction checklist

Air Accidents Investigation Branch Annual Safety Review 2020 69 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview LATEST RESPONSE Response received: 17 December 2020 The United Kingdom Air Accidents Investigation Branch (AAIB) has determined that the aileron became unresponsive due to aileron cable failure. Transport Canada (TC) National Aircraft Certification (NAC) accepts the recommendation and is working with the manufacturer to collect data necessary to determine what corrective action is appropriate to ensure the integrity of the aileron control system and the usability of Flight Data Recorder (FDR) for the ailerons. Any corrective action that is determined to be mandatory will be promulgated to operators as part of NAC’s Continuing Airworthiness program. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 31 August 2021 Recommendation Status: Open

Feedback rationale The AAIB thanks the Transport Canada for their response and would request an update on the plans to address this Safety Recommendation by 31 August 2021. Safety Recommendation 2020-025 Justification Recording filtered parameters for primary flight controls makes it difficult to reproduce the flight from the stored data. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-025 It is recommended that the European Union Aviation Safety Agency require that the flight data recorder system fitted to DHC-8-400 series of aircraft registered in the United Kingdom record unfiltered data for the parameters representing primary flight control input positions and input forces, so that their original sensor signal values can be reliably established. Date Safety Recommendation made: 8 October 2020

Air Accidents Investigation Branch Annual Safety Review 2020 70 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview LATEST RESPONSE Response received: 11 December 2020 The European Union Aviation Safety Agency is analysing this safety recommendation in cooperation with the Type Certificate Holder - De Havilland Aircraft of Canada. An update will be provided once a decision has been reached on the orientation to be given to this topic. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 24 May 2021 Recommendation Status: Open Feedback rationale The AAIB thanks the EASA for their response and would request an update on the plans to address this Safety Recommendation by 24 May 2021. Safety Recommendation 2020-026 Justification Filtering parameters by the Flight Data Recorder makes it difficult to reconstitute the flight. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-026 It is recommended that the International Civil Aviation Organisation provide guidance on the recording of filtered parameters by the flight data recorder system. The guidance should address as a minimum: 1) Definitions for filtered and unfiltered parameters. 2) Parameters on the FDR for which filtering is not permitted. 3) The need to be able to reconstruct the original sensor signal values from filtered data recorded during extremely dynamic conditions and that the information to achieve this is a permanent part of the aircraft specific FDR system documentation package. Date Safety Recommendation made: 8 October 2020

Air Accidents Investigation Branch Annual Safety Review 2020 71 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview LATEST RESPONSE Response received: 8 January 2021 With respect to the above-mentioned safety recommendation, the proposal for providing guidance material on the recording of filtered and unfiltered parameters by the FDR system will be referred to the Flight Recorder Specific Working Group (FLIRECSWG) of the Flight Operations Panel (FLTOPSP) for further study. The next FLIRECSWG meeting is scheduled for February 2021. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 31 December 2021 Recommendation Status: Open Feedback rationale The AAIB thanks ICAO for their response and looks forward to the update from FLIRECSWG on the response to this Safety Recommendation.

Air Accidents Investigation Branch Annual Safety Review 2020 72 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Cessna Citation CJ1, N680KH 13 April 2019 at Bournemouth Airport

Synopsis The aircraft had been modified with a system intended to enhance its performance, which included supplementary control surfaces designed to deflect symmetrically and automatically to alleviate gust loads. Shortly after takeoff, an electrical failure in this system caused one of these control surfaces to deploy separately, causing an uncommanded roll. The resulting aircraft upset caused the pilot significant surprise and difficulty in controlling the aircraft. The pilot was not aware of supplementary procedures associated with the modification. The procedures did not adequately characterise the significance of the system failure, nor address the failure in all anticipated flight conditions. Certification flight tests of the system did not reveal the severity of possible outcomes. The ‘Aircraft Safety and Certification Reform Act 2020’ underway in the USA will review existing assumptions on pilot recognition and response. Four Safety Recommendations are made, and safety action has been taken or is intended in the areas of training and the information to be provided, both for this system and for other supplementary systems capable of influencing the flight path of an aircraft. Safety Recommendation 2020-027 Justification The ATLAS inoperative in flight procedure currently specified is not relevant to all anticipated flight conditions. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-027 It is recommended that Tamarack Aerospace Group amend the ATLAS inoperative in flight procedure to ensure actions are specified that are relevant in all anticipated flight conditions. Date Safety Recommendation made: 26 November 2020 Cessna 525 wing with ATLAS installed

Air Accidents Investigation Branch Annual Safety Review 2020 73 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview LATEST RESPONSE Response received: 3 March 2021 Tamarack worked closely with EASA to develop the procedure, which was then validated by other aviation authorities in other countries, including FAA, ANAC, TCCA, and others. During certification, EASA flight test personnel flew simulated emergency conditions, and contributed directly to the process of writing the procedures to address them. This process included a variety of critical and less-critical flight conditions, initially to confirm which flight conditions were critical to begin with, and later to confirm that the procedures were appropriate for all. Tamarack is concerned, as was EASA during certification, that the AIIFP must be written explicitly and simply, to give pilots the necessary safety information for responding to the most critical condition identified during the certification process. While it is true that certain steps in the procedure are more critical in some flight conditions than others, the AIIFP was developed to ensure that executing the full procedure in accordance with good pilot judgement and aviation best practices is safe for all anticipated flight conditions. As an example, step three of the AIIFP to disconnect the autopilot and the subsequent procedural step to maintain lateral control would apply to an ATLAS fault event which does not introduce an asymmetric deployment. Likewise, the immediate reduction in power would apply to flight conditions slower than maximum cruise. In both instances, however, the less critical flight conditions allow the AIIFP to be executed quickly, either by the lack of induced roll to address in non-deployment fault conditions or by the relative increase of aileron roll authority relative to the TACS at lower speeds. The overwhelmingly favourable flight characteristics inherent to the 525 series continues to support this conclusion, as do confirmed reports of ATLAS asymmetries and subsequently uneventful executions of the AIIFP in a variety of flight conditions. Flight conditions for abnormal and emergency procedures should be carefully considered. However, the primary contributing factor to the incident described in the AAIB report was pilot lack of familiarity with the AIIFP itself, rather than ambiguity of the procedure in a particular flight condition. Tamarack has received no other feedback from subject matter experts, pilots, or certification authorities to suggest that the procedures are not appropriate to all flight conditions as currently approved. Therefore, no major changes are planned for the ATLAS Inoperative In Flight Procedure. AAIB Assessment: Partially Adequate Action Status: Planned Action Completed Recommendation Status: Closed

Feedback rationale The AAIB notes that the addressee has considered the Safety Recommendation and that it does not intend to amend the ATLAS inoperative in flight procedure.

Air Accidents Investigation Branch Annual Safety Review 2020 74 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Recommendation 2020-028 Justification The information currently provided may be inadequate for pilots to understand the significant and potentially escalating nature of TACS failures. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-028 It is recommended that Tamarack Aerospace Group expand the information within the ATLAS inoperative in flight procedure to provide a level of detail consistent with other AFM procedures and to enable pilots to understand the significant and potentially escalating nature of TACS failures. Date Safety Recommendation made: 26 November 2020 LATEST RESPONSE Response received: 3 March 2021 Tamarack agrees that emergency procedures must balance the need for short, concise steps that are easy to remember and follow with the need to provide pilots with sufficient information to understand the intent of the procedures and the conditions for which they are written. In the case of the AIIFP, Tamarack agrees that there is an opportunity to add potentially useful additional information. The AAIB report indicated that the pilot perceived that the control forces during the recovery were higher than expected, and that these control forces diminished as the airspeed was reduced. This is exactly in line with the original intent of the procedure, which specifies a reduction in airspeed to reduce control forces and minimize pilot exertion during execution of the AIIFP in the event of an asymmetric deployment. To that end, the approved procedures at the time of the incident included a warning preceding the memory items: “Large aileron input may be required if an ATLAS failure at high indicated airspeed includes a TACS runaway. Speed reduction is the first priority in these failure conditions.” Tamarack has amended the wording of the warning to more clearly indicate the intent behind prioritizing speed reduction as follows: “Large aileron input may be required if an ATLAS failure at high indicated airspeed includes a TACS runaway. Speed reduction to reduce control forces is the first priority in these failure conditions at high indicated airspeed.” This change makes the intent of the warning and procedure sequence more explicit without dramatically changing the look of the procedure with which current pilots are already familiar. Further, adding this note is in line with conventional pilot training, which stresses from the earliest stages that speed reduction reduces control forces. Tamarack hopes that better

Air Accidents Investigation Branch Annual Safety Review 2020 75 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview comprehension of the procedure and associated critical flight condition will assist other pilots familiarizing themselves with the AIIFP. Tamarack is also committed to addressing questions and feedback from current and prospective pilots and owners and will continue to review these procedures if feedback or questions indicate that there are further opportunities for improvement. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Safety Recommendation 2020-029 Justification The operation of supplementary systems fitted to an aircraft may require pilot behaviours different to those for which pilots are trained on the unmodified aircraft. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-029 It is recommended that the European Union Aviation Safety Agency determine the additional training it requires pilots to undertake in order to operate aircraft fitted with supplementary systems that influence flight path, where training on the original aircraft would not adequately prepare pilots for operating the modified aircraft in normal, abnormal or emergency situations. Date Safety Recommendation made: 26 November 2020 LATEST RESPONSE Response received: 2 March 2021 The following provisions of Commission Regulation (EU) No 965/2012 on air operations ensure that flight crew are suitably trained for the aircraft type operated (including those with supplementary systems installed), and cover the availability and use of relevant checklists: - NCC.GEN.106(a)(4)(viii) which requires the flight crew to be properly rated and meet competency and recency requirements;

Air Accidents Investigation Branch Annual Safety Review 2020 76 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview - ORO.FC.100(c) on ratings, i.e. type-specific training; - ORO.FC.125 on differences and familiarisation training; - ORO.GEN.110(h) on checklists per aircraft type in normal, abnormal and emergency procedures in accordance with the latest relevant documentation from the design approval holder. Furthermore, in accordance with Article 11 of Regulation (EU) 2018/1139, operational suitability data (OSD) associated with a type design must be approved, when the applicant has demonstrated that the design of the product meets the applicable certification basis, and this approval must be include in the type certificate (TC) (or supplemental type certificate - STC). This provision is further detailed in Commission Regulation (EU) No 748/2012, which in its Article 7a requires aircraft that are newly certified or delivered as new to an EU operator after February 2014 to have OSD, including for flight crew (FC) approved as part of the TC, covering type specific training associated with the aircraft design. Further to that, point 21.A.93 of Annex I (Part-21) to Commission Regulation (EU) No 748/2012, as amended by Commission Regulation (EU) No 69/2014 and applicable from 19 December 2016, requires an applicant for a change to a TC or for an STC to consider the effects of the change to the OSD certification basis, and include the necessary changes to the OSD FC, when applicable, in their application for approval. Guidance to assess the impact of design changes on the OSD are provided in GM No 1 to 21.A.93(b)(1)(iii). Part of the resulting approval covers the pilot training elements associated with a specific design, when such elements are identified in the certification process and captured in the OSD FC associated with the TC or STC. In turn, approved training organisations (ATOs) and operators have an obligation to use the mandatory elements of the OSD FC in developing initial, differences and recurrent training programmes and courses (cf. points FCL.710(a) and FCL.725(a) of Annex I (Part-FCL) to Regulation (EU) 1178/2011; point ORO.FC.145(b) of Annex III (Part-ORO) to Commission Regulation (EU) No 965/2012.). The process embedded in the relevant regulations as described above provides a high level of confidence that, when training elements are necessary to support a specific aircraft design, these are properly identified, approved as part of the TC, change to a TC or STC, and delivered to pilot, reinforcing the principle of them receiving the appropriate training to ensure safe operation of the aircraft and its modifications AAIB Assessment: Not Adequate Action Status: Not enough information Recommendation Status: Open

Air Accidents Investigation Branch Annual Safety Review 2020 77 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Feedback rationale The EASA response describes the regulatory framework that existed at the time of this serious incident. These regulations demonstrably were not adequate to address the circumstances of this occurrence. It is not clear what additional training the EASA has now determined it requires pilots to undertake (to operate aircraft fitted with supplementary systems that influence flight path) to improve on the situation that existed at the time of this serious incident and thus help to avoid those circumstances. Safety Recommendation 2020-030 Justification The operation of supplementary systems fitted to an aircraft may require pilot behaviours different to those for which pilots are trained on the unmodified aircraft. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-030 It is recommended that the Federal Aviation Administration determine the additional training it requires pilots to undertake in order to operate aircraft fitted with supplementary systems that influence flight path, where training on the original aircraft would not adequately prepare pilots for operating the modified aircraft in normal, abnormal or emergency situations. Date Safety Recommendation made: 26 November 2020 LATEST RESPONSE Response received: Awaiting Response Recommendation Status: Open

Air Accidents Investigation Branch Annual Safety Review 2020 78 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk

Air Accidents Investigation Branch Annual Safety Review 2020 79 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety Actions from investigations reported on in 2020 Early in an investigation the AAIB will engage with authorities and organisations which are directly involved and have the ability to act upon any identified safety issues. The intention is to prevent recurrence and to that end to encourage proactive action whilst the investigation is ongoing and not for those involved to wait for the issue of official Safety Recommendations.

When safety action is taken, it means there is no need to raise a Safety Recommendation as the safety issue has been addressed, however if the issue remains then a Safety Recommendation will be raised. The published report details the safety issues and the safety action that has taken place, usually with a green highlight. In 2020, 159 safety actions directly resulted from AAIB investigations. These arose from one Formal Investigation, one Special Bulletin, 26 Field Investigations and 23 Correspondence Investigations. Index of Safety Actions (by aircraft weight)

Commercial Air Transport (Fixed Wing) Page Boeing 747-436, G-BNLN 104 Boeing 747-436, G-CIVU 134 Boeing 787-9, G-CKWB 130 Airbus 321-211, G-POWN 83 Airbus 321, YL-LQC 147 Airbus 321-231, G-EUXJ 133 Airbus 321-231, G-WUKJ 135 and 145 Boeing 737-86N, I-NEOT 100 Boeing 737-8K5, G-TAWG 120 Airbus 320-214, OE-LOA 92 Airbus 320-214, EC-KLT 109 Airbus 320-214, G-EZWE 111 Airbus 320-214, G-EZTD 97 Airbus 320-232, G-EUYB 113 Airbus 319-111, G-EZNM 99 Airbus 319-131, G-DBCD 124 Boeing 737-4Q8, G-JMCR 102 Antonov AN12, UR-CKL 131 ERJ 190-200 (Embraer 195), G-FBEJ 90 DHC-8-402, G-FLBE 116 DHC-8-402, G-PRPK 129 DHC-8-402, G-JECK 143 Embraer 145, G-SAJK 108 Embraer 145EP, G-SAJS 143 Bombardier BD-700-1A10 Global 600, 9H-VJM 118 Embraer E55P Phenom, D-COLT 121

Air Accidents Investigation Branch Annual Safety Review 2020 80 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Index of Safety Actions (by aircraft weight)

Commercial Air Transport (Rotary Wing) Page Sikorsky S-61N Sea King, G-ATBJ 85 Agusta-Westland AW189, G-OENC 122 Bell 429 GlobalRanger, G-WILTS 87 Agusta A109E, G-ETPI 127 Eurocopter EC135T1, VP-CPS 89 Eurocopter AS350B2, G-PDGF 137

General Aviation (Fixed Wing) Hawker Hurricane 1, G-HRLI 141 Piper PA46 Malibu, N264DB 81 Cessna P210N, G-CDMH 108 Cessna 172 Skyhawk, G-BXGV 126 Fuji FA-200-180 Aero Subaru, G-HAMI 126 Jodel D117A, G-AZII 95 Reims Cessna F150M, G-CBSM 146 Jabiru UL450, G-ROYC 115

General Aviation (Gliders) Standard Cirrus 75, G-DDGX 107

General Aviation (Rotary Wing) Guimbal Cabri G2, G-CILR 106 Unmanned Air Systems DJI M600 Pro 119 Aerialtronics Altura Zenith ATX8 132 Believer 140 Yuneec H520 139 DJI Phantom 4 138 Parrot Anafi Thermal 142 Parrot Anafi 128

Air Accidents Investigation Branch Annual Safety Review 2020 81 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview FORMAL INVESTIGATIONS Piper PA-46-310P Malibu, N264DB 21 January 2019 at 22 nm north-north-west of Guernsey The investigation established that the aircraft departed from Nantes Airport, France, at 1906  hrs on 21  January 2019 carrying a passenger on a commercial basis to Cardiff Airport in the UK. At 2016  hrs, probably while manoeuvring to avoid poor weather, the aircraft was lost from radar and struck the sea 22 nm north-north-west of Guernsey. Neither the pilot nor aircraft had the required licences or permissions to operate commercially. The investigation identified the following causal factors: The pilot lost control of the aircraft during a manually-flown turn, which was probably initiated to remain in or regain Visual Meteorological Conditions (VMC). The aircraft subsequently suffered an in-flight break-up while manoeuvring at an airspeed significantly in excess of its design manoeuvring speed. The pilot was probably affected by carbon monoxide (CO) poisoning. The investigation identified the following contributory factors: A loss of control was made more likely because the flight was not conducted in accordance with safety standards applicable to commercial operations. This manifested itself in the flight being operated under Visual Flight Rules (VFR) at night in poor weather conditions despite the pilot having no training in night flying and a lack of recent practice in instrument flying. In-service inspections of exhaust systems do not eliminate the risk of CO poisoning. There was no CO detector with an active warning in the aircraft which might have alerted the pilot to the presence of CO in time for him to take mitigating action.

Air Accidents Investigation Branch Annual Safety Review 2020 82 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Following this accident, the following safety actions were taken: Safety action taken by the CAA

● The CAA developed a campaign to raise awareness of unlicensed charters, including publishing a Leaflet, Legal to Fly, to inform passengers about flying safely in light aircraft and business jets. Safety action taken by the engine manufacturer The engine manufacturer stated that it would:

● Work with Original Equipment Manufacturers to determine the best way to convey the importance of thorough exhaust system inspections.

● Review its maintenance and overhaul manuals to determine whether additional elaboration would increase the chance of a qualified mechanic finding a potentially unairworthy condition. It undertook to complete this review in order to have any amplifications implemented in the next FAA approved version of its Standard Practice Manual (M‑0).

Air Accidents Investigation Branch Annual Safety Review 2020 83 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview SPECIAL BULLETIN Airbus A321-211, G-POWN 26 February 2020 at London Gatwick Airport At 0009 hrs on 26 February 2020, G-POWN took off from London Gatwick Airport for a flight to London Stansted Airport. At approximately 500 ft agl in the climb, there was a loud noise and flames were seen coming from the tailpipe of the No 1 engine as it surged. The crew made a MAYDAY call and turned right to return to the airport. Two minutes later, parameters relating to the No 2 engine began to fluctuate and the crew received an indication that the engine had stalled. The aircraft landed at 0020 hrs. Before the incident flight, there were start-up difficulties with the No 1 engine and momentary ‘Eng  2 Stall’ messages associated with the No 2 engine on descent into Gatwick. An engineer was tasked with troubleshooting the engine stall messages. This intervention was a potential opportunity to detect the abnormal deposits on the high pressure and low pressure turbine blades. It is considered likely that a borescope inspection would have detected these deposits and, had it done so, it is unlikely that the aircraft would have been released to service. The engineer was not tasked with investigating any issues with the No 1 engine. The symptoms presented by each engine were different and no one considered there to be a possible common cause. Safety action by EASA and the FAA:

●The EASA issued Safety Information Bulletin SIB 2020-061 on 20 March 2020, to notify affected stakeholders of recent air safety-related events involving Kathon biocide and to remind aircraft owners and operators to ensure that the correct method and dosage is used for approved biocide treatment of aircraft fuel systems. The FAA issued Special Airworthiness Information Bulletin SAIB NE-20-042 on 25 March 2020 that contained similar regulatory guidance. Safety actions taken by the manufacturers of the biocide and engines:

●The manufacturer of Kathon discontinued the use of its product for aviation fuel applications on 10 March 2020.

●On 16 March 2020, CFM, the manufacturer of the G-POWN’s engines, issued Alert Service Bulletin 73-A0296 recommending that operators of CFM56-5B engines suspend the use of Kathon during aircraft fuel system biocide treatments. Similar instructions were issued for other variants of the CFM56 engine family, as well as all General Electric turbofan engines. Note: the discontinuation of Kathon for aviation applications, combined with the inability to use Biobor within the EU presently, leaves aircraft operators in the EU without an approved biocide treatment. Brown material deposits in No 2 engine combustion chamber swirl cups

Air Accidents Investigation Branch Annual Safety Review 2020 84 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety action by the AMO that performed the biocide treatment:

●The AMO that performed the biocide treatment on G-POWN has introduced a new role of ‘technical engineer’. The technical engineer will be an EASA Part-66 B1 licensed engineer, outside of the management chain within the organisation, who will be available to assist other licensed engineers and mechanics with technical queries, such as calculations.

●The AMO will also introduce usage limits in stores so that staff will not be able to withdraw chemicals in quantities that significantly exceed the maximum permitted. Safety action by the Operator and the AMO at London Gatwick Airport:

●In consultation with the manufacturer, the operator granted the Gatwick AMO access to the airnavX system.

●The Gatwick AMO issued a safety and compliance notice highlighting the importance of filtering maintenance data to the specific aircraft.

Air Accidents Investigation Branch Annual Safety Review 2020 85 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview FIELD INVESTGATIONS Sikorsky S-61N Sea King, G-ATBJ 1 February 2018 in Marchwood, Hampshire The helicopter was being transferred from Marchwood, Hampshire, to a maintenance base having been transported, by sea, from the Falkland Islands. As the helicopter took off for a hover check it pitched nose-down. The commander promptly lowered the collective and the helicopter struck the ground on its nose, before coming to rest on its landing gear. The investigation found that the spherical bearing within the swashplate had seized as a result of corrosion, compounded by inactivity during the voyage from the Falkland Islands. The checks prior to the flight did not identify the control restriction. Safety action has been taken by the helicopter manufacturer to highlight the correct preflight procedures to follow after prolonged aircraft inactivity, and by the operator to remind flight crews to conduct flight control servo system checks to the maximum extents of control movement. The cyclic control restriction was found to be as a result of seizure of the spherical bearing with the swashplate. The seizure was determined to be as a result of corrosion build-up within the bearing sockets. Prolonged inactivity during the transportation of the helicopter from the Falkland Islands allowed corrosion to develop sufficiently to cause the bearing to seize. Following the helicopter’s arrival in the UK, Safety Inspection checks detailed in the S-61N Equalized Inspection and Maintenance Program, SA 4047-13 were not carried out; it is likely that the seized swashplate would have been identified if they had. Despite the seizure, the investigation determined that full fore/aft travel of the cyclic control could still be achieved which indicates that this is not a reliable indication that the swashplate is free to move. During pre-flight checks by maintenance engineers and the flight crew, the flight control servo system checks were not completed to the full extremes of travel. With a seized swashplate, the rotor blades changed pitch due to flexing of the guide tube and the blade movement was incorrectly identified as a positive confirmation of control authority. There was no confirmation by external observation of the main rotor and swashplate operation during the limited range pre-flight checks.

Unloaded Load applied Stills from video of another S-61 showing levels of guide tube deflection when cyclic was applied to a seized swashplate

Air Accidents Investigation Branch Annual Safety Review 2020 86 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview The perceived limitations of the hydraulic system when pressuring the hydraulics from the battery powered DC motor (motorising) compounded by the restrictions of using an external battery for starting were identified as contributory factors because control movements were not made to the full extremes of the cyclic envelop during the pre-flight checks. Safety actions taken by the operator:

●On 20 June 2018, the operator issued Flying Staff Instruction (FSI) 2018-35 to remind all crews to conduct the flight control servo system check, which includes a full and free check, as required in Appendix 2 of the Operations Manual Part B S61 Section 02. This FSI contained the detailed check as an Appendix.

●The operator has continued to monitor that its pilots perform the check, to the extremities, through routine simulator checks and, through its flight data monitoring programme, during operational flying.

●The operator has incorporated the assessment of the ball ring socket for freedom of movement in the Daily inspections. In addition, it has made the decision that, in the future, helicopters that have been transported by sea will be road transported from their port of entry to the maintenance facility.

●The operator has also undertaken to investigate increased environmental protection for its helicopters during sea voyages.

●On 22 July 2019, the helicopter manufacturer issued a Safety Advisory to highlight to operators the necessity of performing the prescribed Safety Inspections after long-term storage of the aircraft, specifically regarding the inspection/check of the swashplate.

Air Accidents Investigation Branch Annual Safety Review 2020 87 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Bell 429 GlobalRanger, G-WLTS 2 January 2019 at Melksham Airbase, Wiltshire The report considers two events which occurred while the pilot was conducting a Power Assurance Check. In one, an un-commanded yaw pedal movement caused a rapid rotation of the helicopter through two and a half complete rotations; in the other, a trim runaway was contained by the pilot. The trim runaway was found to be an unknown feature of the Automatic Flight Control System logic. Following these events, safety action was taken by the helicopter manufacturer and Transport Canada to help crews respond to a yaw trim runaway and to address the underlying causal factor. Also, the flight recorder manufacturer improved the way it reported the results of CVR recording inspections. Two Safety Recommendations are made: one to Transport Canada in relation to conduct of the Power Assurance Check; and one to the European Union Aviation Safety Agency to ensure that the installation of new equipment on aircraft does not have a detrimental effect on existing equipment. The first event on 15 June 2018 occurred during a PAC when the pilot’s feet were clear of the pedals. The yaw trim actuator operated but the pedals could not move because of a restriction, and so the actuator wound up the artificial feel spring instead. When the restriction cleared, the pedals ‘snapped’ to full deflection as the spring unwound, increasing tail rotor thrust and causing the helicopter to rotate rapidly to the left through two and a half revolutions. The investigation did not determine the cause of the trim runaway or the pedal restriction. A similar yaw trim runaway on 2 January 2019 was controlled because the pilot’s feet were resting on the pedals. The manufacturer determined that the AFCS logic meant that it was possible for pilots to inadvertently induce a yaw trim runway and issued a revision to the RFM to reduce the risk of a recurrence. The manufacturer also undertook to address susceptibilities in the flight control system software identified during the investigation into these events. The PAC is a normal procedure which was not reflected in the Normal Procedures section of the RFM. A Safety Recommendation has been issued to update the RFM with an appropriate procedure. It was found that the CVR audio performance was poor after the installation of the TETRA communication system. A Safety Recommendation has been issued to EASA to remind Minor Change applicants of the importance of verifying that new equipment does not have a detrimental effect on existing equipment with which it has a direct interface. Yaw out-of-detent indication

Air Accidents Investigation Branch Annual Safety Review 2020 88 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety Actions taken by the manufacturer:

●Published a revision to the Rotorcraft Flight Manual to reduce the risk of a yaw trim runaway. This included procedures for responding to a runaway so that control of the helicopter would be maintained.

●Amended the Integrated Avionics Manual to include a note that automatic pedal trim remains operational on the ground if force trim is engaged.

●Recorded a Problem Report against their flight control system software related to the susceptibilities identified. The susceptibilities would be addressed by future enhancements to the automatic pedal trim function of the software. Safety action taken by the flight recorder manufacturer:

●The flight recorder manufacturer included a plot of CVR signal waveforms as part of its CVR recording inspection report to enable anomalies such as clipping to be easily identified. Safety action taken by the regulator:

●Transport Canada issued Emergency Airworthiness Directive CF-2019-16, which mandated the incorporation of the Rotorcraft Flight Manual revision and required all flight crews to be advised of the changes.

Air Accidents Investigation Branch Annual Safety Review 2020 89 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Eurocopter EC135T1, VP-CPS 26 February 2019 at Owen Roberts International Airport, Cayman Islands At the start of a ‘training and search’ detail in the Cayman Islands, the pilot lifted the helicopter to a height of approximately four feet and felt the cyclic control stick shake and exert a rearwards force. He immediately lowered the collective lever and the helicopter landed heavily, sustaining damage to the tail boom, landing gear and transmission deck. A subsequent inspection of the helicopter revealed the longitudinal axis of the main rotor actuator had failed. A tie bar within the actuator had suffered pitting corrosion, leading to intercrystalline corrosion and cracking which resulted in overload failure of the remaining material. It is possible that moisture penetrated into the actuator and allowed the tie bar to corrode. The environment conditions of the Cayman Islands may have contributed to the corrosion. Safety actions have been taken to ensure the continued airworthiness of the worldwide fleet and to review the design of the actuator to prevent moisture ingress. Following this accident, where longitudinal control of the helicopter was lost at low level, it was discovered that a tie bar within a main rotor actuator had fractured. This fracture was caused by the reduction in area of the tie bar through the propagation of a crack initiated by pitting corrosion. It is highly probable that the corrosion pits were caused by the accumulation of salt moisture in the end of the actuator, which had penetrated into the actuator through a gap. Safety action taken by the helicopter manufacturer:

●To issue instructions for continued airworthiness in the form of a mandated (by EASA EAD) Alert Service Bulletin to inform all operators to inspect the main rotor actuators. If evidence of tie bar corrosion is found, or the time in service exceeds a defined period, then the tie bar is to be replaced. To initiate a review of the actuator design with the equipment supplier to identify changes that could be made to prevent moisture ingress and a corrosion initiated failure of the tie bar. Material adjacent to tie bar fracture surface

Air Accidents Investigation Branch Annual Safety Review 2020 90 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview ERJ 190-200 LR (Embraer 195), G-FBEJ 28 February 2019 at Exeter Airport, Devon As the thrust levers were advanced for takeoff, on an early morning scheduled passenger flight, the flight crew detected an unusual odour and observed smoke entering the cockpit. They then moved the thrust levers to the idle position and applied the parking brake. The cabin crew subsequently reported that there were smoke and fumes in the cabin. Following an assessment of the situation, the commander initiated an emergency evacuation. During the evacuation, passengers who evacuated via the overwing exits reported being unsure of how to get down from the wing to the ground and several re-entered the cabin and exited via one of the escape slides. The smoke and fumes were subsequently attributed to an incorrectly performed engine compressor wash procedure, which was carried out by maintenance personnel the night before the occurrence flight. As a result of the findings of this investigation, the European Union Aviation Safety Agency (EASA) has undertaken two safety actions relating to the certification requirements for overwing emergency exits. The operator has also undertaken several safety actions relating to passenger safety briefings, processes for maintenance planning, engineer training, competency and welfare and monitoring of ground equipment. Four Safety Recommendations are made relating to the certification requirements for overwing exit markings and the height requirement for overwing exits to be equipped with an assisted means of escape. A lack of maintenance planning, training and control of resources led to an undesirable situation where a maintenance task was allocated to an engineer who was neither qualified nor competent to complete the task. A key step in the engine drying procedure was only described as ‘recommended’ and the engineer did not complete all the elements of the task. This resulted in residual cleaning solution remaining within the ECS system, causing smoke and fumes within the cabin and cockpit and leading to an emergency evacuation. The engine drying procedure has since been amended to require this step to be carried out.

Due to the order in which the emergency evacuation vital actions were performed, the flaps had insufficient time to travel to the selected position. This resulted in an increased drop to the ground for passengers evacuating via the overwing exits, with many reluctant to jump or slide off the wing. Additionally, despite the presence of a marked exit route on the wing with a non-slip surface, many passengers who exited via the overwing exits were uncertain where to go once out of the aircraft. Both of these factors increased the time taken for emergency evacuation to be completed. Drop to the ground from wing trailing edge with flaps in flap 1 setting

Air Accidents Investigation Branch Annual Safety Review 2020 91 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety actions taken by the operator:

●Updated the content of its briefing to passengers seated in the overwing exits of the E195.

●Enhanced the control and tracking of maintenance ground support equipment to enable calibration expiry dates to be managed more effectively.

●Introduced a maintenance planning procedure so that maintenance requirements are identified earlier in the working day to allow appropriate resources to be identified and allocated.

●Undertook a review of tasks performed within the hangar to identify specific training requirements with a view to developing training programmes.

●Launched an engineer’s competency passport scheme to enable maintenance planning departments to allocate specific maintenance tasks to maintenance stations where the correct resources are available.

●Introduced additional simulator training for engineers to undertake engine ground runs and committed to review the its recency period for conducting engine ground runs.

●Introduced a programme to verify that engineers have the correct procedures, records, equipment and tooling, personnel requirements, approvals, replacement parts, environment and information before commencing a maintenance task.

●Committed to undertake fatigue risk assessments for night shift maintenance personnel and initiated an engineer welfare programme.

●Updated its change management process to ensure appropriate management of the risks associated with the changing nature of maintenance being conducted in its base hangar.

●In June 2020, the engine manufacturer updated ESM subtask 72-00-00-410-004 to require, rather than recommend, that a high-power engine dry-out run is conducted after a compressor wash using detergent.

Air Accidents Investigation Branch Annual Safety Review 2020 92 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Airbus A320-214, OE-LOA 1 March 2019 at London Stansted Airport The aircraft was on a scheduled flight from London Stansted Airport to Vienna International Airport, Austria. Shortly after the takeoff roll was commenced it was rejected, due to a contained failure of the left engine, and the aircraft was brought to a stop on the runway. Just as the flight crew were about to taxi the aircraft off the runway, an evacuation was commanded by the Senior Flight Attendant. The investigation identified several factors that contributed to this decision. Ten passengers were treated for minor injuries that occurred during the evacuation and there was a risk of serious injury due to one of the engines running during the evacuation. The operator has taken several safety actions, principally based around the training of its flight attendants. Two Safety Recommendations regarding passenger evacuation have been made in this report.

The left engine experienced a contained failure following the rupture and release of several blades from the first stage of the high-pressure compressor. The investigation found that the blades fractured as a result of high-cycle fatigue loading which initiated in the dovetail (part of the blade root), due to a once-per-revolution aerodynamic excitation. An inlet guide vane lever arm had been improperly assembled which led to aerodynamic excitation of the passing blades and the resulting forces exceeded the design loads of the blades. The left engine experienced a contained engine failure. All the damage found in the engine was consistent with the release of one or more high-pressure compressor stage 1 blades as a result of high-cycle fatigue arising from aerodynamic excitation of the blades. A single inlet guide vane lever arm, which had been improperly assembled in the connecting link on the inlet guide vane actuation ring, was identified as the source of the stimulus that resulted in the blade release. As a result of the engine failure and subsequent rejected takeoff, the Senior Flight Attendant commanded an emergency evacuation that was not necessary in the circumstances. This was probably the result of a combination of factors that heightened her emotional response to the event and affected her decision making. The factors included inexperience as a flight attendant, weaknesses in her training and communication difficulties during the event. As a result of the flight crew not being consulted before the evacuation was commenced, the right engine remained running for the first few minutes of the evacuation. This led to an HPC module showing missing IGVs and damaged stage 1 blades

Air Accidents Investigation Branch Annual Safety Review 2020 93 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview increased risk of serious injury to those passengers that evacuated on the right side of the aircraft. Indeed, several passengers sustained minor injuries having been blown over by the exhaust. During the evacuation several passengers hindered the evacuation by taking their cabin baggage with them. While some were removed by the flight attendants at the supervised exits, this was not possible at the overwing exits. Two Safety Recommendations are made regarding passengers evacuating with carry-on baggage. Safety actions taken by the operator: As a result of this event the operator has stated that several safety actions have been or will be completed, including: Procedures

●The operator sent a Memo, on 19 May 2020, to all its Airbus pilots instructing them to ensure the PA recept is selected on an Audio Control Panel, thus ensuring the CVR records any PA announcements.

●The operator’s Flight Safety Manual will be amended to instruct the Flight Attendants to attempt to establish communications with the flight crew to check that an evacuation is safe and necessary before commanding it independently. Training The operator has taken the following safety actions in relation to its flight attendant training. The operator has:

●Augmented the team responsible for training with the addition of a deputy manager of flight attendant training.

●Introduced a maximum limit of 25 trainees in initial flight attendant training courses. After approval from the operator’s competent authority, it was subsequently increased to 30 in April 2020.

●Added practical training in the CEET to the senior flight attendant course as standard. Practical training has also been incorporated in their annual recurrent training.

●Improved variety of training scenarios in the CEET, including scenarios that result in a return to normal operations rather than an evacuation.

●Improved the syllabus of flight attendant training to include the performance effects of startle, an improved 30-second review15 technique and enhanced communication training.

●Produced a video training aid that will introduce flight attendants to the actions of the flight crew after a rejected takeoff.

Air Accidents Investigation Branch Annual Safety Review 2020 94 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

●Extended the aeroplane familiarisation phase during initial training with additional familiarisation flights. Crew composition

●The operator has introduced a requirement in the Operations Manual regarding flight attendant team composition. A minimum of two experienced flight attendants shall be part of the operating crew’s complement. This is 50% of the operating crew members, as their A320s are operated with four flight attendants. The engine manufacturer has stated the following safety actions have or will be taken Dissemination of information

●Provided a presentation on the subject of improper IGV/VSV lever arm assembly and its consequences at an All Operators Conference in June 2019 and published an article in its monthly publication ‘Fleet Highlites’ in January 2020.

●Highlight the issue of improper IGV/VSV lever arm assembly during calls with its field service representatives for onward dissemination to operators and overhaul facilities. Engine performance analysis

●Evaluate the use of a HPC performance analytic tool to determine if the effects of a mis-assembled lever arm could be identified from a detectable shift in engine performance.

Air Accidents Investigation Branch Annual Safety Review 2020 95 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Jodel D117A, G-AZII 8 April 2019 at Full Sutton Airfield, York The aircraft landed heavily when the pilot’s prosthetic adapter disconnected from the control column late in the approach. The pilot was unhurt. The pilot has since modified the interface between the prosthetic adapter and the aircraft control column. The UK CAA has amended the medical certification pathway for pilots with musculoskeletal disability to include an engineering assessment of interface between any prosthesis and the aircraft flying controls. The aircraft landed heavily when the prosthetic adapter detached from the control column late in the approach and the pilot was unable to regain control before touchdown. The pilot met the requirements for medical fitness to fly, but there was no engineering assessment by a suitably qualified individual of the interface between the prosthesis and the aircraft controls. The lack of a secondary device securing the prosthetic adapter to the control column meant that its security was solely reliant upon the interference fit. Safety action taken by the pilot:

●The pilot has added a velcro strip, which attaches to the prosthetic adapter and the control column, providing added security to the interface in the axial plane while retaining ease of disconnection in the event of an emergency. Safety actions taken by the regulator

●The Civil Aviation Authority of the United Kingdom has reviewed the medical certification pathway of pilots with a musculoskeletal disability and is amending the Medical Flight Test form to implement a 3-stage process involving:

○An assessment by the prosthetist relating to the manufacture and fitting of the prosthetic with regard to use in general in an aircraft, eg flight control system forces and movements;

○Assessment of the prosthetic interface with the aircraft control(s) in an aircraft engineering context by a suitably licenced engineer or inspector;

○The conduct of a general medical flight test by a CFI staff examiner or single pilot aircraft senior examiner, either of whom must be designated by the Authority for this purpose, to: Prosthetic adapter in use

Air Accidents Investigation Branch Annual Safety Review 2020 96 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview a) assess the ability of the pilot to fly and control the aircraft through the use of the prosthetic and operate equipment in normal operations and emergencies including ingress/egress from the aircraft and b) consider how to ensure control of the aircraft is retained in the event of a failure.

Air Accidents Investigation Branch Annual Safety Review 2020 97 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Airbus A320-214, G-EZTD 24 April 2019 at Lisbon Airport, Portugal During pre-flight preparations, both pilots completed a takeoff performance calculation for a takeoff from the runway intersection with Taxiway U5. During subsequent re-planning, the crew thought they had recalculated performance information from Taxiway S1 but had, in fact, used S4 (runway full length). The aircraft took off from Taxiway U5 with performance calculated for the full runway length. The takeoff distance available from U5 was 1,395 m less than that used for the performance calculation, and the aircraft passed the upwind end of the runway at 100 ft aal. The operator had another identical event 14 days later. Following this event, the operator acted to raise awareness of the issue with its crews and engaged with the aircraft manufacturer to review possible technical developments which might prevent a recurrence of these type of events. One Safety Recommendation is made to mitigate the risk of further confusion relating to takeoff positions. Both aircraft took off using incorrect performance data for the intersection used. In each case, a selection error was made in the EFB which led the crew to believe that they had calculated performance information for a departure from S1 when in fact they had selected the full length of the runway. In both cases, the procedural barrier of cross-checking the runway distance against the aerodrome ground chart failed to prevent to error. Human performance limitations mean it is difficult for pilots to recognise and react to reduced performance (acceleration) once the takeoff has begun, so robust adherence to procedures is a key defence against such incidents occurring. Safety action taken by the operator and airport authority: As a result of these serious incidents the following safety action was taken:

●The aircraft operator issued a notice to its flight crew clarifying the takeoff positions available on Runway 21 at Lisbon Airport.

●A NOTAM was issued highlighting ‘confusing runway holding point naming’ and reminding crews that ‘Position S’ referred to the full length of Runway 21.

●The aircraft operator issued a description of the events and their causes to its flight crew to raise awareness of the risks of using the wrong intersection and distance for takeoff.

●The aircraft operator engaged with the aircraft manufacturer to review future developments that could offer extra protections against events such as those covered in this report. EFB dropdown menu showing the all the intersections available

Air Accidents Investigation Branch Annual Safety Review 2020 98 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

●The airport authority undertook to rename taxiways so that Taxiway S intersected the runway at only one point; S4 (full length).

Air Accidents Investigation Branch Annual Safety Review 2020 99 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Airbus A319-111, G-EZNM 11 May 2019 en route to Bristol Airport The lenses of both pilots’ oxygen masks misted when donned during a smoke and fumes event, obscuring their vison. The commander removed his mask so he could see the flight instruments. The aircraft diverted to Birmingham and landed without further event. The investigation found that the masks misted up due to a combination of the environment in which they were stowed and the condition of the lenses. The source of the smoke was probably an accumulation of dust in the transformer rectifier unit (TRU). The aircraft manufacturer has added a cleaning procedure for the TRU in the Aircraft Maintenance Manual. The operator has added a practical demonstration on the use of the mask and its selectors during its recurrent training cycle. The aircraft had a smoke and fumes event that was probably a result of dust accumulation on its TRUs. The pilot’s oxygen masks misted up shortly after donning, due to a combination of the environment in which they were stowed, the crews’ breathing rate and the condition of the lenses. This left them unable to see the flight instruments, resulting in the commander removing his mask. Selecting the emergency pressure setting helps clear a mask and reduced exposure to any remaining smoke and fumes. Safety actions taken by the operator and aircraft manufacturer:

●The operator has added a practical demonstration on the use of the mask and its selectors during its recurrent training cycle.

●The aircraft manufacturer has taken safety actions in the following areas as a result of this incident:

●At the operator’s request, the aircraft manufacturer has moved the relevant warning to the beginning of the procedure and highlighted it as follows: ‘CAUTION: BE CAREFUL NOT TO PUT DETERGENT SOLUTION, DISINFECTANT OR WATER ON THE MASK VISOR. IF YOU DO, DAMAGE TO THE ANTI-MIST LAYER OF THE MASK VISOR CAN OCCUR.’ This was incorporated into the February 2020 revision of the AMM.

●The aircraft manufacturer introduced a cleaning procedure for the TRUs in the AMM. This was incorporated into the May 2019 revision of the AMM. Co-pilot’s mask showing fogging and marks on internal lens

Air Accidents Investigation Branch Annual Safety Review 2020 100 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Boeing 737-86N, I-NEOT 1 June 2019 at Bristol Airport During an unstable approach to Runway 27 at Bristol Airport, I-NEOT descended below the approach path before being instructed to go around by the tower controller. After initially climbing away as expected during the go-around, the aircraft then descended for over 30 seconds reaching a minimum radio altitude of 457 ft. Simultaneously, the crew and the controller realised the aircraft was not climbing away as they expected. The crew corrected the flight path and the aircraft was vectored for a further uneventful approach. The loss of altitude occurred because the target altitude on the Mode Control Panel was set to the minimum altitude for the approach having not been set to the missed approach altitude before the go-around. Neither crew member noticed initially that the aircraft was descending. The operator has taken two safety actions as a result of this incident. They have used this incident as part of their annual recurrent ground school to highlight the risks of rushed and unstable approaches. They are also continuing to work on their flight data monitoring programme so that similar approaches will be identified more rapidly and easily in future. Flying a shortened routing led to a rushed and unstable approach which did not follow the correct vertical flightpath. This was observed by ATC who instructed the aircraft to go around. The crew found themselves performing a go-around unexpectedly but did not know why they had been required to do so. The go‑around was conducted with a mis‑set altitude on the MCP, and neither crew member noticed for a significant period that the aircraft was descending during the manoeuvre. Crews should always be ready to perform a go-around because there can be many reasons why they might have to, either internal or external to the aircraft, such as on instruction from ATC. I-NEOT go-around Altitudes in brackets are radio altitude TOGA pressed Lowest point on approach, 1,040 ft (633) Climb to 1,302 ft (824) Selected alt set to 3,000 ft Audio callouts “500”, “too low gear” Lowest point after descent 1,047 ft (457) ATC : “Climb maintain altitude 3,000 ft Bristol Airport Go around 1,071 ft (674)

Air Accidents Investigation Branch Annual Safety Review 2020 101 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety actions taken by the operator:

●The ground recurrent training syllabus was changed to include stable approach criteria, a review of applicable rules and Flight Data Monitoring (FDM) statistics as well as a presentation of this event.

●The operator improved its FDM system to identify events such as this unstable approach and planned to continue development of the system to make the process easier and more rapid.

Air Accidents Investigation Branch Annual Safety Review 2020 102 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Boeing 737-4Q8, G-JMCR 4 June 2019 at Brussels National Airport, Belgium While descending to land at Brussels National Airport, a partial electrical failure occurred resulting in the loss of a number of systems including the electronic and analogue flight instruments on the left side of the cockpit. The pilot declared a MAYDAY and aware that a thunderstorm was approaching the airfield, assessed that the weather reported by Air Traffic Control (ATC) would allow him to continue and land at Brussels. However, visual references were lost at a late stage of the approach when the aircraft entered a heavy rain shower. A go-around was initiated during which the pilots estimated the amount of thrust required; the aircraft initially appeared to be slow to accelerate and establish a positive rate of climb. The aircraft entered an orbit and subsequently landed successfully from a second approach. The electrical failure was caused by a fault in the transfer relay which resulted in the loss of power to a number of electrical buses. The aircraft documentation was unclear as to which aircraft in the fleet were configured to enable the cockpit instruments to be powered from a standby electrical source; this may have affected the pilots understanding of the failure. Safety action has been taken by the operator to provide clarity in the aircraft documentation. The electrical failure was caused by a fault in the transfer relay which resulted in the loss of power to a number of electrical buses. Following the electrical failure, the commander’s assessment was that the aircraft was in a stable condition so continued the approach to land at Brussels National Airport. This gave the pilots relatively little time to assess the situation and a number of non-normal checklists actions were not carried out; consequently, the aircraft was incorrectly configured for the approach and landing. At a late stage of the approach the pilots lost visual references and executed a go-around. The aircraft then orbited while the thunderstorms cleared the airfield and the pilots used the time to further analyse the failure. The second approach and landing were uneventful. Primary radar track and timing of some radio callls

Air Accidents Investigation Branch Annual Safety Review 2020 103 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety action taken by the operator

●Following this serious incident, the operator identified the aircraft in their fleet configured to enable the left EFIS displays to be powered by the AC Standby Bus. Aircraft documentation has been amended to inform pilots of the status of each aircraft.

Air Accidents Investigation Branch Annual Safety Review 2020 104 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Boeing 747-436, G-BNLN 9 June 2019 in flight from London Heathrow Airport to Phoenix International Airport, USA On reaching top of climb the aircraft experienced unreliable airspeed indications resulting in overspeed warnings and activation of the stall warning system. In recovering, the crew carried out the unreliable airspeed procedure but also carried out the stall warning procedure, which was not required. The problem was believed to have been caused by a fault with the right Air Data Computer (ADC), although this could not be replicated. As a result of this incident, the aircraft manufacturer is providing additional information as part of their published unreliable airspeed procedure. The aircraft operator is also reviewing its maintenance procedures due to the accidental erasure of fault codes on the right ADC as part of the post-incident inspection process. No evidence was found to account for the initiation of the event sequence, but the sequence of events was consistent with a known fault mode of the model of ADC which was fitted to the aircraft, for which a modification was available but had not been incorporated.

The malfunction of the right ADC was not identified despite extensive functional testing. It is likely that the false warnings had been generated erroneously as a result of an incorrect Mach number being supplied by the right ADC. This would then also have caused the stall warning system to operate erroneously at a safe airspeed. The identification of the recorded faults within the right ADC unit during the flight was not possible as the fault codes had been deleted after the unit had been received into the operator’s avionics workshop. The QRH procedure applicable at the time of the incident noted that ‘overspeed warnings and AIRSPEED LOW alerts may occur erroneously or simultaneously’. Stall warnings were not mentioned specifically as the aircraft manufacturer considered that crews would understand this was included. It is apparent this was not however the case with the crew involved who considered they must react to the stall warning when it occurred. The AIRSPEED LOW alert is a specific warning and the crew considered that as the stall warning was not mentioned separately in the procedural note, operation of the stick shaker should not be considered erroneous. This seemed to be confirmed to them when the stick shaker operation ceased when pitch was reduced, as they would expect after a genuine stall warning. This highlights the importance of clear, unambiguous information being readily available to crews at times of high workload when dealing with potentially critical incidents. It also reinforces the need for crews to understand the protection afforded by adopting the pitch and power settings provided as part of the procedure.

Air Accidents Investigation Branch Annual Safety Review 2020 105 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety actions taken by the manufcaturer and operator

●The aircraft manufacturer is planning to update the QRH procedure to specifically include stall warnings as part of the note. This update is due to be included in the block revision to the B747-400 FCOM in April 2020. They are also considering similar action with other relevant types.

●Since the event, the operator has taken steps to identify the process shortcomings that permitted the loss of the fault codes to occur following arrival of the ADC in their avionics workshop. As a result, procedural changes are being introduced aimed at preventing future loss of troubleshooting and fault data that can assist incident investigations.

Air Accidents Investigation Branch Annual Safety Review 2020 106 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Guimbal Cabri G2, G-CILR 22 July 2019 at Wycombe Air Park The helicopter had flown from Dunkeswell, Devon, to Wycombe Air Park, Buckinghamshire. As the pilot was shutting down the helicopter, he noticed smoke emanating from the left side of the rotor mast. He evacuated the helicopter and tried, unsuccessfully, to extinguish the fire with the helicopter’s on-board fire extinguisher. The helicopter was destroyed. Examination of the wreckage identified that the electrical cable connecting the alternator to the starter relay had short circuited against the aluminium baffle that surrounds the engine, probably as a result of the cable clips being incorrectly fitted. As a result of this investigation the helicopter manufacturer issued a service bulletin to instruct operators to inspect for correct installation of the cable clips and has also completed a redesign of the clips to ensure they cannot be fitted incorrectly. The helicopter caught fire shortly after landing because the heat generated from a short circuit in the engine compartment ignited a nearby carbon fibre structure. The short circuit was made between the cable that connected the output of the alternator to the starter relay and the aluminium air baffle through which the cable passed. It is likely that the cable clips that should have held the cable as it passed though the baffle were either not present or, most likely, incorrectly fitted. The upward movement of the engine as a result of the clutch disengagement was sufficient to allow the unsecured cable to contact the unprepared edge of the aluminium baffle, allowing the insulation to be cut and initiate the short circuit. Safety actions taken by the helicopter manufacturer

●A Service Bulletin was issued by the helicopter manufacturer to inspect the clips to ensure correct installation.

●The helicopter manufacturer has completed a redesign of the clipping system to ensure the cable clipping cannot be installed incorrectly. The new design of clip is being fitted to new production helicopters and will be available via service bulletin from the manufacturer. G-CILR prior to being moved

Air Accidents Investigation Branch Annual Safety Review 2020 107 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Standard Cirrus 75, G-DDGX 27 July 2019 at Gwernesney Airfield, Monmouthshire The glider was undertaking an aerotow launch to the west at Gwernesney Airfield which was operated by the resident gliding club. During the early stages of the ground roll the horizontal tailplane (tailplane) detached from G-DDGX and fell to the ground. Club members assisting with the launch signalled for the takeoff to be aborted but the message did not reach the aerotow tug pilot; the accident pilot did not appear to hear or see the stop signals either. The glider became airborne and climbed rapidly, before the tow cable released and the aircraft’s nose dropped. The glider descended steeply and struck the ground nose first. It came to rest inverted pointing in an easterly direction. First responders extricated the pilot from the aircraft before he was airlifted to hospital. He died five days later from complications related to injuries sustained in the accident. The investigation determined that the tailplane had not been correctly attached when the glider was rigged and this condition was not detected prior to the flight. Several possible mis-rigging scenarios were identified during the investigation, but the precise manner in which the tailplane had been mis-rigged could not be determined. Two Safety Recommendations are made relating to communication for glider launching and detecting incorrect alignment of tailplane locking features. In addition, the gliding club has undertaken several safety actions regarding launch signalling and detection of incorrect tailplane locking on other Standard Cirrus gliders. The glider tailplane was mis-rigged in such a way that it passed positive control checks but was not secure for flight. It detached early in the ground roll and the aircraft became airborne with no pitch control available to pilot. Stop signals were relayed by the forward signaller but they were not effective in alerting either pilot to the failure. Effective signalling, radio or visual, might have prevented the glider taking off or reduced the severity of the outcome. Safety actions taken by the gliding club

●The forward signaller position was formalised in the club’s Operations Manual and their use of a white winch-signalling bat was made mandatory.

●Where appropriate, lever alignment marks were to be added to gliders at the club as additional confirmation that rigging had been completed correctly. Locking lever when tailplane attached (left image) and when locked with safety pin inserted (right image)

Air Accidents Investigation Branch Annual Safety Review 2020 108 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview EMB-145EP, G-SAJK & Cessna P210N Pressurized Centurion, G-CDMH 7 August 2019 at London Southend Airport An Embraer 145 landing at London Southend Airport ran over a general aviation towbar which had been dropped on the runway. No damage was caused to the aircraft. The investigation found that the towbar had fallen from a Cessna  210 which departed Southend Airport 30 minutes before. The Cessna pilot had likely been distracted during his pre-flight checks by an earlier road traffic incident in which he was involved, and had inadvertently left the towbar attached. One Safety Recommendation has been made to the CAA to improve the visibility of general aviation ground equipment. A general aviation towbar was inadvertently left attached to an aircraft because the pilot had been distracted by an earlier stressful event during his journey to the airport. The towbar dropped onto the runway during the departure and remained there for approximately 30 minutes, during which two other aircraft used the runway and a runway inspection was completed. A landing aircraft then ran over it. The towbar was inconspicuous because it did not have any reflective or other high visibility markings. Safety action taken by the regulator

●The CAA has stated that if, during the general aviation-specific audits and inspections it conducts, it observes ground equipment that due to its colour is not sufficiently visible, it will bring this to the attention of the relevant operator. Towbar recovered from the runway

Air Accidents Investigation Branch Annual Safety Review 2020 109 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Airbus A320-216, EC-KLT 26 August 2019 on approach to Birmingham Airport The aircraft made two approaches above the correct descent profile, on each occasion leading to a missed approach. On the second missed approach the aircraft initially continued descending and was not configured appropriately, reaching an angle of attack at which the alpha floor1 energy protection mode activated to increase engine thrust. The aircraft made a subsequent approach, landing without further incident. During a subsequent event, involving the same operator and aircraft type (but different flight crew), the aircraft remained above the correct approach descent profile initially but descended below it later in the approach and performed a missed approach. The pilots in this case managed the vertical profile manually using a flight control mode with which they were not familiar. In both cases the pilots appeared not to have understood when to commence the final descent to follow the vertical profile of the approach. The operator’s safety department has recommended improvements in approach training and strategies to assist situational awareness. The operator and air traffic services provider are working to gain a better understanding of each other’s approach requirements. The aircraft did not maintain the correct vertical profile because the pilots were not sure when to commence the final descent. The depiction of the descent profile on charts provided by the operator may have contributed to this uncertainty. In the first event it is likely that the increased workload of an unplanned missed approach contributed to the pilots not configuring the aircraft correctly for the go-around, resulting in the aircraft entering the alpha floor protection mode. In the second event, having also commenced the final descent late, the pilots did not maintain the correct profile thereafter because the type of approach required them to manage the vertical flight path manually, and they were not familiar with the flight mode they were using. Safety actions taken by the operator and air traffic control services provider

●The inclusion of high energy approaches and go-arounds in future company simulator training;

●A review of approach intercept procedures to ensure they make adequate provision for approaches without a glideslope;

●The introduction of procedures to assist pilots in estimating distance to run during an approach; and Extract from operator’s chart for RNAV approach to Runway 33 at Birmingham

Air Accidents Investigation Branch Annual Safety Review 2020 110 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

●Procedures to deal more effectively with a loss of situational awareness.

●The operator and air traffic services provider are working to gain a better understanding of each other’s approach requirements.

Air Accidents Investigation Branch Annual Safety Review 2020 111 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Airbus A320-214, G-EZWE 16 September 2019 at Lisbon Airport, Portugal Under international protocols, this investigation was delegated to the AAIB by the Gabinete de Prevenção e Investigação de Acidentes com Aeronaves e de Acidentes Ferroviários (GPIAAF) in Portugal. During pre-flight preparations, both pilots completed a takeoff performance calculation for a takeoff from Runway 21 at Lisbon Airport. In calculating the performance, the crew believed they had selected the shortest runway length available (from the intersection with Taxiway S1) but had, in fact, used the runway full length (from Taxiway S4). The aircraft was cleared for takeoff from another intersection (Taxiway U5) and used performance calculated for the full runway length. The takeoff distance available from U5, although longer than from S1, was 1,395 m less than that used for the performance calculation, and the aircraft became airborne with only 110 m of the runway remaining. As a result of this and previous, similar incidents, the airport operator renamed part of Taxiway S to have only one intersection on Runway 21 with the letter S. The aircraft operator moved onto a newer software version for performance calculations in December 2019 which gives a pictorial representation of the runway. They also worked with the data supplier to change the menu for intersection selections for Lisbon Airport to eliminate any confusion over which position refers to the full runway length. The aircraft took off using incorrect performance data for the intersection used. A selection error was made in the EFB calculation which led the crew to believe that they had calculated performance information for a departure from S1 when in fact they had selected the full length of the runway. In this case, as in the two previous identical incidents, the final barrier of checking the runway distance in the performance calculation against the aerodrome ground chart failed to prevent the error. Human performance limitations mean it is difficult for pilots to recognise and react to the performance error once the takeoff has begun, so robust adherence to procedures is a key defence against such incidents occurring. CCTV screenshot showing G-EZWE just after reaching V1

Air Accidents Investigation Branch Annual Safety Review 2020 112 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety actions taken by the airport authority, operator and UK regulator

●Following the previous incidents, the AAIB reported that the Lisbon Airport operator intended to rename taxiways to remove the risk of confusion between the two points where Taxiway S crossed Runway 21. The taxiways would be renamed so that Taxiway S intersected the runway at only one point; S4 (full length). This safety action was completed, albeit after the incident to G-EZWE, and is reported here.

●The operator has moved onto Flysmart L6 performance software which now shows the crew a pictorial image of the takeoff point used for the calculation. The takeoff point selection menu was also amended to eliminated Position S making it clear to the crews that this was full length for Runway 21.

●The UK CAA decided to revise the EFB compliance checklist, SRG form 1849, to ensure that the need for a periodic battery replacement programme is emphasised.

Air Accidents Investigation Branch Annual Safety Review 2020 113 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Airbus A320-232, G-EUYB 23 September 2019 on approach London Heathrow Airport During approach to London Heathrow Airport the flight crew detected strong acrid fumes on the flight deck. They both donned oxygen masks and continued to land at Heathrow. After shutting down on a taxiway and removing their masks, the co-pilot became incapacitated and the commander felt unwell; both pilots were taken to hospital but released later that day. Investigations carried out by the AAIB and the operator did not identify the source of the fumes. Numerous other similar fume events have been reported to the AAIB and the CAA. This report reviews five other similar events which occurred with the same operator on the same aircraft type. It was not possible to identify the cause of these events, but, several common features have been identified. The operator and aircraft manufacturer have taken action to try to reduce the number of events, which includes; the development of detailed maintenance procedures to identify the source of fumes, changes to flight crew operating procedures and the evaluation of modifications to enhance cabin air recirculation filtration systems. While it has not been possible to positively identify the compound that was responsible for the fumes and odours experienced in G-EUYB, or any of the other recent events, a number of common factors have been identified. The majority of events occurred after the aircraft had been parked or operated in precipitation. The fumes become apparent during the later stages of the descent, sometimes preceded by a minor event during the climb phase. The generation of fumes appears to be transient; they dissipate rapidly and leave no detectable trace. No link between changes to engine power or changes in other system settings and the generation of fumes was identified. In some cases, the presence of fumes has resulted in physiological reactions which have interfered with a flight crew member’s ability to carry out their normal duties. However, by following the smoke and fume checklist, and donning oxygen masks the flight crew were able to ensure the continued safety of the aircraft. Safety actions Although a specific cause has not been found in these and other recent events, the operator and aircraft manufacturer have taken several actions based on current knowledge to alleviate the odour and fume events. APU schematic

Air Accidents Investigation Branch Annual Safety Review 2020 114 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety actions undertaken by the manufacturer:

●Project FRESH has been initiated by the manufacturer to investigate and regularly inform operators of fume event arisings.

●Published an In-Service Information paper (Ref ISI 21.00.001.139) setting out all the known aspects of fumes and smoke events and includes the details of a filter and sensor product research and development programme. Safety actions undertaken by the operator:

●Developed the post-smoke and fume events maintenance procedure.

●Taken action to ensure that the correct APU start up bleed air selection and shut down procedures are used.

●Will consider the installation of the manufacturer’s ECS air filtration modification when it becomes available

●Carried out a fleet-wide check to confirm that oxygen masks were correctly stowed and issued a Quality Alert Bulletin to all engineering staff to reminded them of the importance of stowing the masks in accordance with the AMM.

Air Accidents Investigation Branch Annual Safety Review 2020 115 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Jabiru UL-450, G-ROYC 27 October 2019 at Gransden Lodge Airfield, Sandy, Cambridgeshire G-ROYC was being flown with two pilots onboard. The pilot in the left seat had 28 hours on type and the pilot in the right seat had not flown the type before. The approach to the runway was flown by the pilot in the right seat. During the approach he decided the aircraft was not stable so elected to go around. During the go-around the aircraft descended and drifted to the left. The aircraft collided with a stationary glider which was waiting to launch. One of the occupants of G-ROYC sustained a minor injury; the glider pilot was uninjured. The investigation found that it is likely that the aircraft did not climb due to a combination of the inadvertent retraction of the flaps, a brief delay in applying full power and the aircraft being slightly above the maximum takeoff weight. The LAA provides a Pilot Coaching Scheme to enable pilots to safely learn new aircraft types and develop their flying skills with experienced instructors. The BGA and the gliding club have taken safety action to ensure the risk of ground collisions continue to be minimised. Whilst attempting to go around from low height G-ROYC descended and drifted left and collided with a stationary glider which was waiting to launch. It is likely that the aircraft did not climb due to the combination of the inadvertent retraction of the flaps, a brief delay in the application of full power and the aircraft being slightly above the maximum takeoff weight. The BGA and the gliding club have taken safety action to ensure the risk of ground collisions is minimised. Safety actions

●The BGA has undertaken to remind all gliding clubs about the risk of landing aircraft colliding with aircraft on the ground and to provide advice on how to minimise the risk.

●Cambridge Gliding Club will review its procedures and consider advice from the BGA to ensure that the risk of ground collision remains as low as is reasonably practical. Damage to the tail and left wing of an SZD-51 glider caused by G-ROYC

Air Accidents Investigation Branch Annual Safety Review 2020 116 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview DHC-8-402, G-FLBE 14 November 2019 in-flight from Newquay Airport to London Heathrow Airport Shortly after takeoff in a strong crosswind, the pilots noticed that both handwheels were offset to the right in order to maintain wings level flight. The aircraft diverted to Exeter Airport where it made an uneventful landing. The handwheel offset was the result of a break in a left aileron cable that ran along the wing rear spar. In the course of this investigation it was discovered that the right aileron on G-FLBE, and other aircraft in the operator’s fleet, would occasionally not respond to the movement of the handwheels. Non-reversible filters were also fitted to the operator’s aircraft that meant that it was not always possible to reconstruct the actual positions of the control wheel, column or rudder pedals recorded by the Flight Data Recorder. The aircraft manufacturer initiated safety actions to improve the maintenance of control cables and to determine the extent of the unresponsive ailerons across the fleet. Three Safety Recommendations are made in this report for the unresponsive aileron and filtering of the control position data. The most probable reason for the aileron cable breaking was that its strength had reduced as a result of wear leading to the failure of individual wires within the cable. The cable failed where it passed over a pulley on the rear wing spar where dirt accumulates which can penetrate into the strands and form an abrasive compound. This can accelerate the normal rate of cable wear. Post-modification cables are available which have a sleeve fitted over the susceptible section to prevent the ingress of dirt. The investigation established that the inspection procedure in the AMM would not have detected the damage to individual wires that run inside the cable. The unresponsive right aileron on G-FLBE was not causal to this serious incident. As the operator ceased trading before they could establish the cause on G-FLBE, and other aircraft in their fleet, further investigation is required to determine if there is a wider safety issue. Filters applied to some of the flight control parameters recorded on the FDR can affect the reconstruction of the rapid movement of the controls. Such filters are not permitted to be installed on the DHC-8-400 aircraft registered in the USA, but there is no similar requirement on aircraft registered in Europe or the UK. While this did not affect this investigation, this could affect other safety investigations. Construction of the control cable Wire Strand

Air Accidents Investigation Branch Annual Safety Review 2020 117 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety actions taken by the manufacturer

●The aircraft manufacturer reviewed the periodic cable inspection procedure and advised that they would amend the procedure to increase the likelihood of identifying cable damage. They also stated that they would issue an All Operators Message to highlight this serious incident and the changes to the inspection procedure.

●The aircraft manufacturer advised that it would provide literature to operators to monitor for unresponsive ailerons using their Flight Data Monitoring Programmes.

Air Accidents Investigation Branch Annual Safety Review 2020 118 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Bombardier BD-700-1A10 Global 6000, 9H-VJM 11 December 2019 at Liverpool Airport The aircraft suffered a nosewheel steering failure shortly after touchdown. During the subsequent landing roll, directional control was lost due to the inadvertent application of right braking and the aircraft departed the runway surface onto the grass. As a result of a fault, the NWS went into free caster shortly after touchdown. During the subsequent landing roll, directional control of the aircraft was lost, and the aircraft departed the right side of the runway and onto the grass. The commander, in applying left rudder to try to keep the aircraft straight, had inadvertently applied some right braking. As the aircraft slowed, full left rudder was unable to counteract the effect of this braking. Safety actions Following the event, the operator took the following safety actions to address the issues of inadvertent brake application and use of differential brake for steering at high speed:

●It issued a Safety Alert to all its pilots which included the following: ‘we would like to recommend all pilots, at the first occasion and when on the ground at parking on board of the airplane, to apply FULL rudder deflection. At full rudder deflection one should check if both brakes can be pushed. In addition, notice that the opposite rudder pedal moves physically closer to your body, if you feel the pressure of the closer pedal increasing and if you apply any unwanted brake pressure due to the position of your shoe on the pedal, the pedals/ seating position should be adjusted. This should be checked in the normal seating position with the respective shoe position adopted for takeoff and landing.’

●In its Training Syllabus for 2020 the operator has included a failure of the NWS system after landing as a preferred malfunction 9H-VJM on the soft groundc

Air Accidents Investigation Branch Annual Safety Review 2020 119 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview DJI M600 Pro (UAS, registration N/A) 13 December 2019 at Wallsend, Tyne and Wear The UAS, a DJI M600 Pro, was being operated in an automated flight mode to survey a construction site when a GPS-compass error caused the aircraft to revert to a flight mode that required manual control. By the time that the pilot and observer realised that it was not responding to the return-to-home (RTH) function, visual line of sight was lost when the aircraft drifted with the wind beyond a line of trees. It subsequently collided with the roof of a house before falling into the property’s rear garden. No persons were injured. The pilot, and the observer who was also a pilot, had operated UASs since 2018 and had the required permissions from the UK CAA. Both pilots had relied predominantly on the automated flight capability of their aircraft and had not, nor were required to have, practised for emergencies since completing their flying training in 2018. One Safety Recommendation is made to the UK CAA. The pilot was required to take manual control of the aircraft following the loss of its automated flight modes due to signal interference. However, no manual control inputs were made, and the aircraft subsequently drifted with the wind until it collided with a house roof and fell to the ground. No persons were injured. Operators holding a PfCO issued by the CAA are not currently required to practise routinely for emergencies or demonstrate the ability to fly their aircraft in a degraded flight mode. These skills are perishable but, as this accident shows, they may be needed at any time; it is important that they are maintained to prevent a risk of injury to people or damage to property. To address this, one Safety Recommendation has been made to the CAA. Safety action taken by the operator

●The operator’s pilots have undergone refresher training on responding to emergency situations and operating their multi-rotor UASs in the ATTI flight mode. The aircraft after falling into the garden

Air Accidents Investigation Branch Annual Safety Review 2020 120 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Boeing 737-8K5, G-TAWG 24 December 2019 at Manchester Airport Shortly after a normal touchdown, the right outer (No 4) mainwheel separated from its axle and was seen, by the pilots, to pass down the right side of the aircraft. The aircraft vacated the runway and was safely brought to a halt on the taxiway. The wheel separated as a result of a failure of the inboard wheel bearing which led to the failure of the outer bearing. The exact cause of the initial failure to the inboard bearing could not be determined. Bearing failure investigations such as this are often inconclusive due the severity of the material damage within the bearing destroying evidence of the initiation. Therefore, it was not possible to determine the cause of the bearing failure, or to discount the possibility that there was a pre- existing fault, or the bearing had become damaged as a result of the ingress of debris or moisture. It is possible that preload torque applied was slightly below the minimum required; however, it was still considered enough to ensure that the bearing assembly was correctly seated and makes it unlikely to have affected the bearing running condition. However, a combination of the possible causes set out in this report cannot be ruled out. The AAIB will review the findings of the operator’s investigation into the bearing failure on G-FDZB and will provide an update to this report if it provides further clarification on the cause of the bearing failure on G-TAWG. Safety action taken by the operator

●As a result of the No 4 inner wheel bearing failure found on Boeing 737-800, G-FDZB, and its similarities with a preceding bearing failure on Boeing 737-800, G-TAWG, a component failure investigation will be carried out to ascertain if there is a common cause for both failures. Hub damage around the inboard bearing cup area

Air Accidents Investigation Branch Annual Safety Review 2020 121 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview CORRESPONDENCE INVESTIGATIONS Embraer E55P Phenom, D-COLT 12 March 2019 at Runway 23R, Manchester Airport While the aircraft was lining up on Runway 23R from intersection J1 at Manchester Airport, the sun’s glare on the wet runway made it difficult for the pilot to see the runway markings. He aligned the aircraft with the runway edge stripe, rather than the centreline and, as instructed by ATC, commenced a rolling takeoff. The ATCO noticed the misalignment and instructed the aircraft to abandon its takeoff, which it did without damage or injuries to those onboard. Several safety actions have been undertaken by the airport authority and the air traffic service unit. The aircraft began taking off on the edge stripe of Runway 23R at Manchester after lining up via intersection J1. The sun’s glare on the wet runway, and the orientation, dimensions and slope of the intersection and runway surfaces, contributed to the pilot misidentifying the centreline. The rolling takeoff reduced his opportunity to check the aircraft’s position. As a result of this and a previous similar event, the airport authority is implementing several safety actions to assist pilots lining up at J1. The ANSP stated that it intends to include the lessons from both events in its annual refresher training for ATCOs, and in other training opportunities. Safety actions taken by the the airport authority and the air navigation services provider The airport authority has undertaken to:

●Instate a ‘runway excursion’ hotspot at J1.

●Reconfigure J1’s lead-on lights so that they will always illuminate when its stopbar is lowered.

●Apply green paint to the areas of the J1 turning circle outside of the runway edge lighting, giving the impression of grass. The ANSP has undertaken to:

●Promulgate the lessons learned from both occurrences across all its airport units, by including them in its upcoming annual refresher training course for ATCOs and otherwise; and by highlighting the use of SMR for monitoring aircraft lining up, particularly small aircraft on large runways with wide shoulders. Image of SMR at the commencement of D-COLT’s takeoff roll

Air Accidents Investigation Branch Annual Safety Review 2020 122 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Agusta Westland AW189, G-OENC 25 March 2019 on Forties Charlie platform, Northern North Sea While operating to the Forties Delta platform the pilots misidentified and landed on the visually similar Forties Charlie platform. The operator has issued a safety notice detailing the lessons learned from the incident and a Flying Staff Instruction amending the guidance in the Operations Manual on the Avoidance of Wrong Deck Landings. The pilots landed the helicopter on the Forties Charlie (40C) platform having misidentified it as the destination platform (40D). Controls in place at the time proved inadequate to break the confirmation bias of the pilots. Discussion between the pilots about the position of the crane on the 40C platform probably resulted in them switching their attention incorrectly to this platform and away from the 40D platform. The crane was not stowed on either platform, so did not serve as a distinguishing feature. The pilots’ familiarity with the Forties field, the physical similarity of the platforms, and the identical approach and landing flight path to each of them served to reinforce their selection of the wrong deck. The pilots did not verify they were approaching the correct platform by cross-checking the position of the platform against the FMS bearing and distance to the destination or reading the platform name on the helideck before committing to land. Safety action taken by the operator The operator has issued a Safety Notice to pilots highlighting four lessons learned from the incident, detailing:

●When to hand over control to the landing pilot

●The importance of pilots monitoring and cross-checking the GPS/FMS bearing and distance

●That pilots must read the platform name before committing to landing

●That pilots should wait for the cranes to be stowed even if this incurs a delay Forties Charlie (40C) platform

Air Accidents Investigation Branch Annual Safety Review 2020 123 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview The operator has issued a Flying Staff Instruction amending the guidance for the ‘Avoidance of a Wrong Deck Landing’ given in the operations manual to emphasise the importance of the following actions:

●The need for pilots to highlight the risk of a wrong-deck landing at both the pre‑flight planning and the approach brief phase

●The need for pilots to ensure the route is fully and correctly entered into the FMS

●The use of GPS/FMS needle bearing and distance guidance to the point that the platform name is read

●The need for pilots to read the platform name and cross-check with the GPS/FMS bearing and distance prior to committing to landing on the heli-deck

Air Accidents Investigation Branch Annual Safety Review 2020 124 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Airbus A319-131, G-DBCD 2 April 2019 en route London Gatwick Airport to Palma De Mallorca During pre-departure maintenance activity to resolve a flight control status message, the No 1 spoiler was unintentionally left in the maintenance position with the maintenance key installed. During the flight, the spoiler was able to ‘float’ up resulting in uncommanded left roll and vibration. The crew landed the aircraft without further incident. The operator’s internal investigation identified a number of factors which contributed to the maintenance error and it made 11 internal recommendations. Following maintenance action intended to deactivate a spoiler, the aircraft departed with the spoiler in the maintenance position. This allowed the spoiler to ‘float’ up in the airflow causing an uncommanded roll input. The aircraft landed without further incident and the spoiler was correctly deactivated for the return flight. The operator’s safety investigation identified that the LAEs had not followed the AMM procedure correctly. The maintenance activity was, by necessity, being conducted in bad weather and it was an unfamiliar task. They were distracted during the task and had difficulty using the APP on the tablet device which was provided to display the required maintenance information. The LAEs had difficulty interpreting the modification status of the actuator and identifying the relevant sections of the procedure to use, relating to the modification status and position of the actuator, on the tablet device they were using. They were not clear on how the maintenance key was to be used to deactivate the spoiler actuator for dispatch. A physical check for correct deactivation was not completed and an independent check for correct deactivation was not required to be carried out. The log book entry for the deactivation was incorrectly certified. The operator’s report also identified a number of contributory factors including how the maintenance information was accessed and presented to the engineers, and differences in how similar information is presented more effectively to flight crews. Spoiler maintenance key and flag as found on arrival

Air Accidents Investigation Branch Annual Safety Review 2020 125 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Safety actions taken by the operator

●Improving the ease of access to, and the presentation and clarity, of maintenance information.

●Discussion with EASA and Airbus about the possibility of having critical lock out tasks clearly defined within the MEL in the style of a QRH for use alongside the crew OPS procedures.

●Reviewing the policy and standards for duplicate inspection to clearly identify that this deactivation task should require a duplicate inspection.

●Reviewing the effectivity of current line manager’s task audits at the Maintenance Safety Group.

●Highlighting to other engineers the importance of fully understanding the AMM and Trouble Shooting Manual tasks.

Air Accidents Investigation Branch Annual Safety Review 2020 126 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Fuji FA-200-180 Aero Subaru, G-HAMI and Cessna 172R Skyhawk, G-BXGV 23 June 2019 near Henley-on-Thames, Oxfordshire Two aircraft had what was initially believed to be a near miss while giving air experience fights to disabled children at a multi-aircraft charity event. It was later discovered that the two aircraft had collided, with one aircraft sustaining minor damage, but both aircraft landed safely. The investigation discovered that one of the accident pilots was asked to present the pilots’ briefing at short notice. The briefing did not include a discussion of how all the participating aircraft would be deconflicted or how they would communicate. Neither aircraft had any form of Electronic Conspicuity. The airfield that hosted the event has committed to take safety actions before hosting the event again. Safety action taken by the airfield

●The host airfield stated that it will conduct a risk assessment before holding the event again. It will also ensure that the Deputy Airfield/Safety Manager or another responsible representative from the airfield is available to make a full and complete briefing, adopting the template of their Members’ Day briefing. An overview of the flying will also be maintained throughout the event.

●The owner of G-BXGV has fitted an EC device and linked it to the navigation software installed on his personal electronic device.

Air Accidents Investigation Branch Annual Safety Review 2020 127 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Agusta A109E, G-ETPI 27 June 2019 in flight North of Seaton, Cornwall During a post-maintenance flight, the left cockpit door window separated from the helicopter. The window had been removed and reinstalled during recent maintenance. The investigation determined that insufficient adhesive had been applied to the rubber retaining seal. In addition, liberal application of high‑concentration soap solution during reinstallation likely contributed to the loss of the window, by reducing the frictional ability of the rubber seal to retain the window. As a result of the findings of this investigation, the maintenance organisation has taken four safety actions. Deviation from the prescribed maintenance manual procedure and lack of effective supervisory oversight were identified as contributory factors. Safety actions taken by the maintenance organisation

●Following its internal safety investigation, the maintenance organisation debriefed all involved staff on the findings of the investigation. On 28 August 2019 it issued a temporary notice to all engineers informing them of the incident and requiring the installation of windows to be considered as a critical maintenance task, requiring an independent inspection to be performed during the installation of any acrylic window. The task was subsequently included on the organisation’s formal list of critical maintenance tasks, when it was next updated. The details of the incident are also to be included in company continuation training, with a focus on the requirements for effective supervision, stage checks and adherence to procedure.

●The maintenance organisation has undertaken to review its Emergency Response Plan (ERP) and to consider implementing a process to ensure that staff involved in maintenance activity prior to a suspected maintenance error, incident, or accident are stood down from duty, and are not allocated to be part of the maintenance response team. It indicated that the review of the ERP would be completed by the end of October 2019.

●In September 2019 the maintenance organisation introduced a new production planning tool across all its maintenance bases to control and monitor to allocation of manpower, including supervisory staff, to aircraft undergoing base maintenance. Window aperture of left cockpit door, showing no evidence of adhesive

Air Accidents Investigation Branch Annual Safety Review 2020 128 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Parrot Anafi (UAS, registration, n/a) 17 July 2020 at : Green Lane, Yeadon, West Yorkshire The operator was conducting a night search of roof tops. About 15 minutes after takeoff, when the UA was at about 50 agl, the pilot noticed the control screen flicker and heard the speed of the UA’s motors increase without any input from him. The UA then started to turn and, despite inputs from the pilot, was unresponsive. He attempted to descend the UA to conduct an emergency landing and then selected the ‘Return to Home’ function, but it did not respond. The UA then entered an uncontrolled descent onto the roof, where it came to rest. The UA was recovered with damage to its two front left propellers and battery. There was also minor damage to the roof covering. The pilot believed that, given the clean fractures on the propellers and the way the motors reacted, the UA had suffered a failure of the two propellers. The AAIB published another reported failure of propellers on a Parrot Anafi in its 9/2020 Bulletin. Safety action taken by the operator

●Previously the operator would only replace damaged propellers but, as a result of the safety action taken in the published event, they will now also change the propellers every 5 hours flight time. They will also make a video recording of all pre- and post- flight safety checks.

Air Accidents Investigation Branch Annual Safety Review 2020 129 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview DHC-8-402 Dash 8, G-PRPK 22 July 2019 en route from Edinburgh Airport to London City Airport During a scheduled flight from Edinburgh Airport to London City Airport the cabin press warning illuminated and the crew initiated an emergency descent. The aircraft diverted to Birmingham and landed without further incident. Following some rectification work the aircraft was returned to service later that day. During the ensuing weeks the aircraft experienced several more pressurisation events until the operator decided to withdraw it from service for in-depth engineering investigation, after which it was returned to service again. To date no more pressurisation events have been reported. The operator has taken safety action intended to enhance the monitoring of recurring aircraft faults. After the ninth event, involving another emergency descent, the operator withdrew the aircraft from service and conducted an in-depth investigation into the recurring fault. Several bleed air and pressurisation components were replaced before the aircraft returned to service. The absence of further reported pressurisation faults since the aircraft returned to service indicates that this intervention was successful. It is therefore possible that several events, including the second emergency descent, would have been avoided if this intervention had occurred sooner. Safety actions taken by the operator

●The operator issued a notice to all its flight crew (NOTAC 101/19) on 9 August 2019 with guidance on the reporting of safety events. It also conducted a ‘roadshow’ for crews and engineers at all its bases, encouraging the submission of ASR reports.

●The operator has initiated a review of its reliability program to, among other things, enable more robust monitoring of recurring defects.

Air Accidents Investigation Branch Annual Safety Review 2020 130 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Boeing 787-9 Dreamliner, G-CKWB 12 August 2019 at London Gatwick Airport G-CKWB was parked on Stand 38 at London Gatwick Airport. The aircraft was loaded, with the doors closed ready to depart for its flight to the USA. Permission was granted by the ground controller for the aircraft to push back and start engines at 0910 hrs. The aircraft was pushed back using the incorrect line and as a result the aircraft tail cone struck the blast screen. Safety actions taken by the operator

●Use of Stand 38 by the operator was suspended temporarily.

●The aircraft operator decided to prepare a risk assessment on the use of additional ground staff to watch the wingtips and tail of aircraft during the pushback. The airport operator agreed to consider this assessment once it was complete.

●Notices were issued by the aircraft operator to all pushback crews to remind them of the procedures and importance for stopping a pushback should the aircraft deviate from the centreline.

●Additional training was given to headset operators to increase their understanding and awareness of pushback hazards.

●A ‘STOP’ mark was painted on the ramp beside the nosewheel stop line on Stand 38 to make it clear that the aircraft should not be pushed back further than this line. This mark matches others at Gatwick where the pushback is limited by the confined space. Pushback route markings and stop position Final pushback position and contact point Final pushback position

Air Accidents Investigation Branch Annual Safety Review 2020 131 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Antonov AN12, UR-CKL 30 September 2019 at Liverpool Airport The aircraft’s left wing struck a lighting stand whilst leaving its parking stand. The aircraft had been parked in a position where the crew could not see the stand’s ground guidance markings and there was no marshaller to guide them. The airport had accommodated the fact an appropriate tow bar was not available for the aircraft by parking it on an existing stand in a manner not intended for that stand. Whilst this enabled the aircraft to leave the stand without needing to be pushed back, it had put the wing in a position where it was in danger of colliding with the lighting stand. This foreseeable outcome might have indicated the need for appropriate guidance to be made available to, and requested by, the crew to ensure adequate clearance from the lighting stand. Safety action taken by airport authority

●The airport has re-designated Stands 11-14 and 33-41 to allow parking by self- manoeuvring. The AIP entry has been updated to inform pilots that under such circumstances a marshaller will be available during departure and to instruct pilots to request assistance at any time they need it when taxiing.

Air Accidents Investigation Branch Annual Safety Review 2020 132 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Aerialtronics Altura Zenith ATX8 (UAS, registration n/a) 1 October 2019 in Stoke Gifford, Gloucestershire Shortly after takeoff for a flight from a road bridge above two railway tracks, the UAS in GPS mode started to drift, accelerate and descend away from the pilot. The pilot was unable to regain control before it crashed into vegetation next to the tracks. A subsequent investigation by the operator found that magnetic deviations of up to 140° were observed over localised regions of the bridge below which the railway track’s overhead high-voltage wires were being ducted. The day after the accident flight, the operator went to inspect the takeoff site to try and identify any factors that might explain the aircraft’s behaviour. A spectrum analysis of the radio frequencies at the site didn’t identify anything of concern. However, when using a hand-held compass to check for any magnetic interference, deviations of up to 140° were observed over localised regions of the bridge below which the railway track’s overhead high-voltage wires were being ducted. Safety action taken by the operator As a result of the findings, the operator has made changes in its flying procedures to reduce the possibility of the event reoccurring. These include:

●A magnetic interference check using a manual compass of an area 10 m around the planned takeoff location;

●A visual check for objects and structures that might have a large magnetic field;

●Takeoff and landings should take place as far away from any sources of magnetic interference; and

●The pilot should always be ready to switch out of GPS mode into atti(tude) or manual flight modes to retake control of the UAS if control is lost whilst in GPS mode.

Air Accidents Investigation Branch Annual Safety Review 2020 133 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Airbus A321-231, G-EUXJ 24 November 2019 on takeoff from Glasgow Airport During the takeoff roll the flight crew realised the aircraft was not accelerating as expected. Just prior to V1 the commander applied full power. The aircraft took off and continued its planned flight without further incident. The flight crew subsequently discovered they had entered an incorrect reduced thrust temperature into the flight management computer. The investigation found the incorrect entry was probably a result of distraction during the data entry. The subsequent standard procedures and checks did not detect the error. The flight crew inadvertently entered a flex temperature of 79° instead of 49°. The error was not detected during the subsequent procedures and checks. The error was likely made due to a combination of brief distraction and entering a nonstandard acceleration height. The subsequent checks do not require the flight crew to refer back to the source data and, whilst the selected flex temperature was unusual for a A321, it was not usual for the A319 which the flight crew had been operating during the tour. The flight crew realised there was insufficient power during the takeoff roll and applied TOGA power. The operator has reminded its pilots about the hazard of distraction during critical data loading and are reviewing their procedures to improve the likelihood that data entry errors are detected. Safety action taken by the operator

●The operator has issued a safety notice to all its flight crew highlighting this and previous events. The notice emphasises the importance of avoiding distractions whilst loading the takeoff performance data.

●The operator is also reviewing its takeoff performance data entry and checking procedures in order to ensure that there are sufficient opportunities in the procedures to trap any error.

Air Accidents Investigation Branch Annual Safety Review 2020 134 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Boeing 747-436, G-CIVU 20 December 2019 at London Heathrow Airport A Boeing 747 collided with a fuel transfer vehicle (FTV) as it was approaching its final parking position on stand at Heathrow. The FTV had remained on stand after refuelling the previous aircraft. Neither the flight crew nor the ground staff responsible for the arrival saw the FTV before the collision. The operator and airport authority have taken safety action to prevent reoccurrence. Safety actions taken by the operator and airport authority The operator is taking the following safety action to resolve these issues:

●The operator will conduct an independent review of the available standard operating procedures and associated documentation to ensure they are;

○clear and workable,

○the accountabilities and responsibilities are detailed and,

○there is a single source of information. The operator will take the following safety action:

●The operator will establish a procedure to ensure all visually restricted stands have a ‘mid-man’, in the line of sight, to act as an additional pair of eyes for the colleague manning the emergency stop button at the head of the stand. The airport authority is taking the following safety action:

●The airport authority has changed the parking arrangement on Stand 331 to prevent vehicles obscuring the view from the head of stand. The airport authority is undertaking a review of the emergency stop button locations on all stands

Air Accidents Investigation Branch Annual Safety Review 2020 135 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Airbus A321-231, G-WUKG 16 January 2020 at London Luton Airport, Bedfordshire The aircraft was departing from Runway 26 at London Luton Airport, but when the PF made a normal aft movement of the side stick control at rotation airspeed, the aircraft did not pitch up. The PF increased the side stick input close to the maximum deflection. When the aircraft still did not pitch up, the PM selected TOGA thrust. The aircraft responded and a climb was commenced with the flight continuing to the planned destination of Prague Airport, Czech Republic. An aircraft change had been made for operational reasons from an Airbus A320 aircraft (A320) to an Airbus A321 aircraft (A321), but no adjustment had been made to the passenger distribution. This led to the passengers being seated towards the front of the aircraft, placing the CG outside the forward limit of the permitted operating envelope. Following this event, the operator took action to: highlight this event to its staff and improve their understanding of the issues raised; and improve the flow of information between operational departments when there is a change of aircraft type to reduce the risk that a similar event would occur in the future. The incident occurred due to the aircraft change from an A320 to an A321 not being notified to both OHD and PSD. As a result, the passengers were seated at the front of the aircraft, placing the CG outside the forward limit of the operating envelope. The effect of this was that, at rotation, the aircraft appeared to the crew not to respond as expected to the normal side stick control inputs due to the forward CG. The PF required almost maximum aft control input and the PM selected TOGA thrust before the aircraft nose lifted. The crew analysed the problem but considered that an incorrect stabiliser setting, taken from the load sheet, had caused the problem. Only at the top of the descent for the destination did it become apparent that the passengers had possibly been incorrectly distributed in the cabin. The crew did not experience any unusual control response during the approach and landing. The A321 Load and Trim Sheet that would have resulted on the incident flight

Air Accidents Investigation Branch Annual Safety Review 2020 136 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Safety actions taken by the operator

●Improve the passage of information between the OCC and the flight crew when a change of aircraft variant takes place.

●Improve Ground Handling Agents’ awareness of the implications of a change in aircraft variant.

●Distribute and make highly visible to all staff briefing material on this incident.

●Include any variant change at the flight and cabin crew briefing.

●Provide additional training for cabin crew on weight and balance distribution and its affects.

●Produce a Safety Bulletin to provide staff with a more detailed description of the incident.

●Issue a Crew Order (change to Operations Manual Part A) with enhanced awareness and guidance if suspicion is raised onboard.

Air Accidents Investigation Branch Annual Safety Review 2020 137 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Eurocopter AS350B2, G-PDGF 3 March 2020 at Glencoe, Argyll, Scotland During the refurbishment of an electricity line, G-PDGF was carrying an underslung load consisting of a 700 kg wooden pole which was then inadvertently released. The pole broke into two pieces when it struck a steep hill approximately 200 m from a minor public road, but clear of any built-up areas and third parties. There was no damage to the helicopter or lifting equipment. The operator considered the most probable cause for the inadvertent release of the load was that the sling, which was carrying the load, was not positioned correctly in the helicopter’s hook which was of the spring-loaded keeper design. As a result of this incident, the operator is continuing to phase out the use of this design of hook for most of its operations and has changed its procedures so that only the operator’s employees are permitted to load the hook when spring‑loaded keeper hooks are used. The most probable cause for the inadvertent release of the load was that the load had not been positioned correctly across the hook’s load bearing beam when the load was hooked on. At this time, the client’s employee, although having been trained in underslung load lifting operations, was working alone and was not being directly supervised. However, an intermittent fault could not be ruled out as an alternative cause for the release. Safety action taken by the operator

●The operator is continuing to phase out the use of hooks with spring-loaded keepers in favour of using keeperless hooks for most of its operations. Additionally, the operator has amended its procedures so that, if spring-loaded keeper hooks are used, only the operator’s employees will carry out loading operations. The operator advised that, as keeperless hooks require the use of two hands, it will retain a few spring-loaded keeper hooks for tasks such as lifting a load from a scree-covered hillside, where using both hands poses a greater risk to the loader. The spring-loaded keeper hook fitted to G-PDGF

Air Accidents Investigation Branch Annual Safety Review 2020 138 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview DJI Phantom 4 (UAS, registration n/a) 5 March 2020 at Bristol sewage treatment works During an aerial survey of a sewage treatment works, the unmanned aircraft flew into a wind turbine, the height of which the pilot had misjudged. The pilot was aware of the wind turbines at the site where the aerial survey was to be conducted but was unable to find any accurate information about the height of these either on the app used to plan the flight or from an internet search. For a UAS pilot flying visual line of sight with the aircraft, tall obstacles may be obvious to see but their actual height is difficult to assess visually. All known ground obstacles greater than 300 ft in height are shown on aeronautical charts. These charts, and apps that use the same obstacle database, are one source of accurate information, and provide a clear indication of areas to avoid flying a UAS if limited to flying not above 400 ft. However, for obstacles less than 300 ft, UAS pilots will need to determine their accurate heights from other sources. UAS pilots are responsible for flying their aircraft within the limitations imposed by their CAA Permission and so must ascertain the accurate height of any hazard or obstacle near the planned flightpath. Safety action taken by the operator

●Having been reminded of the obstacle and airspace information available on aeronautical charts or flight planning apps that have access to this information, the operator has amended its flight planning and risk assessment procedures to include reference to these. Extract from the CAA 250K aeronautical chart with the wind turbines at the sewage works in the centre of the image

Air Accidents Investigation Branch Annual Safety Review 2020 139 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Yuneec H520 (registration N/A) 24 April 2020 at Hove, East Sussex The aircraft dropped to the ground from a height of 15 m when power was lost to the electric motors even though the battery’s energy level (State of Charge) was 97.7%. The wind conditions were turbulent and an investigation by the Unmanned Aircraft System’s (UAS) manufacturer concluded that the probable cause for the power loss was that the battery had become loose in flight. The sudden loss of power to the motors from a battery that was almost fully charged was consistent with the battery disconnecting in flight. The data indicated that the aircraft was pitching through 6° and rolling through 46° as it maintained altitude while moving slowly forward, suggesting that the conditions were turbulent enough to dislodge the battery if it had not been properly secured in place, even though the pilot had checked to make sure it was. Safety action taken by the manufacturer

●The manufacturer stated that future versions of the Yuneec H520 will include logic to prevent takeoff if it detects that the clip holding the battery in its housing is not securely in place.

Air Accidents Investigation Branch Annual Safety Review 2020 140 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Believer (UAS, registration n/a) 2 May 2020 at Solent Airport, Hampshire The flight was part of a test programme prior to the start of commercial operations to the Isle of Wight. The accident UAS was considerably smaller than the production aircraft but it was representative in terms of the avionics and communications. It crashed shortly after taking off because the safety pilot switched the radio control transmitter off before the automatic flight control system was engaged. Several safety actions have been undertaken by the operator because of this accident. The safety pilot erroneously turned the transmitter off before the automatic control system was activated and before the instruction to turn the transmitter off had been issued. The operator believed that the accident was unavoidable after the radio control transmitter was turned off because there was insufficient time to switch it back on and regain control of the UAS. Safety actions taken by the operator

●Operations were reviewed to minimise the period where a UAS is under manual control. The UAS is now launched in a revised automatic mode where the safety pilot can apply control inputs to correct the flight path if appropriate. The safety pilot can also disable the automatic flight control system and take full control of the UAS in the event of an emergency.

●The fail-safe logic has been reviewed and modified so that settings are automatically configured depending on the status of the UAS.

●The operator has reviewed their fatigue risk management strategy and is introducing limitations with respect to permissible crew working times and a requirement for crew members to consider their well-being and declare themselves fit for operation during every flight briefing. The operator is updating their operations manual accordingly. General view of the Believer UAS

Air Accidents Investigation Branch Annual Safety Review 2020 141 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Hawker Hurricane 1, G-HRLI 1 June 2020 at Duxford Airfield, Cambridge While landing with a crosswind the aircraft made an uncommanded right turn that was not corrected, and the landing gear collapsed. The landing technique, the pilot’s lack of recency and the hard, dry runway surface may have been contributory factors. The operator will require that less experienced pilots do not operate the aircraft with a crosswind component above 5 kt from the right. The crosswind on landing induced a turn to the right. The reported application of brake and an absence of tail-down elevator coincided with the aircraft bouncing and pitching forward on the hard, undulating runway surface, aggravating the effects of the swing. In the absence of effective control inputs to oppose the swing, the aircraft began to slide sideways, eventually causing the landing gear to collapse. The pilot considered that his lack of relevant currency may have reduced his ability to anticipate and make appropriate control inputs on landing. Safety action taken by the pilot

●The pilot intends to conduct refresher training in a relevant dual control aircraft such as the Harvard before flying the Hurricane after a significant absence. The operator will amend its Operational Control Manual to require that pilots new to the type with less than 5 hours experience on equivalent types will be limited to a maximum 5 kt crosswind component from the right. G-HRLI after the accident and application of fire-suppressing agent

Air Accidents Investigation Branch Annual Safety Review 2020 142 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Parrot Anafi Thermal 11 June 2020 near The Dicker, East Sussex The operator was conducting training with the UAS for a pilot and observer. About 3 minutes after takeoff the UA was observed to be “twitching”. Despite attempts to regain control, it was observed to pitch, yaw and change height by approximately ± 20 ft, and the UA was flown to the emergency landing area. As the pilot descended the UA for landing it became less responsive. It then pitched down and flew away, without any input from the pilot, and did not respond to any subsequent inputs. The pilot selected the ‘return to home’ function, without effect, and announced “control lost” to the observer. The UA then collided with a tree about 420 ft from the landing area and 100 ft agl, sustaining damage to its gimbal and front right folding propeller. The operator believed that the flight characteristics and damage sustained indicated that the right front propeller failed in flight. Safety action taken by the operator

●The operator had been replacing the propellers on all its UAs every 20 hours of flight time. At the time of the accident the propellers had flown for just under 9 hours. The operator will now change all folding propellers after 5 hours flight time and has made this a scheduled item in its electronic flight and maintenance logging software.

Air Accidents Investigation Branch Annual Safety Review 2020 143 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview DHC-8-402, G-JECK and EMB-145EP, G-SAJS 16 June 2020 at Aberdeen International Airport G-JECK was to be flown from Aberdeen Airport to Weeze Airport, Germany. The aircraft had been in storage at Aberdeen since March 2020 and was parked on a self- manoeuvring stand which had a 1° slope. During the pre- departure checks, the chocks were removed from both the mainwheels and the nosewheels. The hydraulic pressure in the park brake system subsequently reduced to the point where the brakes could no longer prevent G-JECK from moving, and the aircraft rolled across a taxiway before colliding with G-SAJS, which was parked on an adjacent stand. There were no injuries. Safety action has been taken by the CAA, operator of the aircraft, maintenance organisation, ground handling company and airport operator regarding the removal of wheel chocks during pre-flight preparation. G-JECK rolled across Taxiway D from its parking position and struck G-SAJS because the nosewheel chocks had been inadvertently removed, and the hydraulic pressure in the park brake accumulator had depleted over several days to the point where it was unable to prevent the aircraft from moving on the 1° slope. Safety actions Following this event, safety action has been initiated by the following organisations: The organisation that provided the pilots for the flight and sub-contracted the ground handling services has:

●Reminded its sub-contracted ground handling companies that permission must be obtained from the aircraft commander before removing chocks.

●Reiterated that chocks are to remain fitted until either a tug had been attached to the aircraft or, when self-manoeuvring, that nosewheel chocks remain fitted until permission has been given to remove them.

●Recommended that pilots check during their walkaround that chocks had not been inadvertently removed. The CAMO:

●Circulated a tutorial, and included it in recurrent training, to all staff within its organisation to raise awareness of the circumstances of this event. G-JECK and G-SAJS during recovery

Air Accidents Investigation Branch Annual Safety Review 2020 144 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview The organisation contracted to provide ground handling for G-JECK has:

●Updated its training of dispatchers to ensure that third parties undertake only those duties for which they have been explicitly briefed and trained to carry out. Aberdeen Airport has:

●Issued an airside safety alert at Aberdeen, Glasgow and Southampton Airports highlighting the need to obtain permission before removing chocks.

●Undertaken to carry out audits of ground handling companies operating at Aberdeen to better understand chocking procedures and training.

●Requested airside operations to audit chocking procedures on the ramp area, with particular attention to self-manoeuvring stands.

●Undertaken to share safety lessons with ground handling companies via the ramp safety committee at Aberdeen. The UK CAA:

●On 27 July 2020, the UK CAA published Safety Notice, SN-2020-0137 - Returning Aircraft to Service from ‘Extended Parking’, which highlights threats associated with this report.

Air Accidents Investigation Branch Annual Safety Review 2020 145 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Airbus A321-231, G-WUKJ 16 June 2020 at Doncaster Airport During the takeoff roll, as the aircraft was approaching V1, the commander identified that the airspeed on the Primary Flight Display was reading zero and rejected the takeoff. Examination of the aircraft found insect larvae within one of the pitot probes. The aircraft had been parked for nearly 12 weeks prior to the flight. The operator has taken safety action to introduce a procedure that flushes the static and total pressure lines on any aircraft that has been parked for more than three days before it is returned to operation. The post flight report produced a failure message ‘34-12-34 ADR1’ associated with a flight control ECAM warning in the No 1 Air Data Reference (ADR1). Troubleshooting performed by the AMO transposed the No 1 and No 3 Air Data Inertial Reference Units (ADIRUs) and after a successful ground test, released the aircraft for the ferry flight. During the subsequent takeoff, at approximately 1540 hrs, the aircraft performed a low speed rejected takeoff as the commander’s PFD was still not registering an air speed. Further troubleshooting over the following two days finally found three small insect larvae, approximately the size of a grain of rice, within the No 1 pitot probe. These larvae were liberated whilst performing a pitot probe flush, which was advised by the aircraft manufacturer. The larvae were not retained to enable further identification of the insect species. The operator concluded that the insect larvae may have been deposited in the pitot probe whilst it was parked with the pitot probe covers fitted. To prevent differential pressure measurement issues in the air data system1 , pitot probe covers supplied by the aircraft manufacturer do not completely seal the probes, it is therefore possible that an insect could enter the air data system during prolonged parking. It cannot be ruled out, however, that the larvae were deposited once the aircraft had been prepared to return to service on 15 June or an insect had been within the pitot probe covers before they were fitted. Safety actions taken by the operator and aircraft manufacturer

●The operator has introduced a requirement to flush all total and static pressure lines before any aircraft is returned to operation after it has been parked for more than three days.

●The operator is also looking to identify better pitot probe covers that may offer better protection than those currently used.

●The aircraft manufacturer is looking to update the aircraft AMM Return to Operations task to require air data system flushing prior to the next flight after prolonged time on the ground.

Air Accidents Investigation Branch Annual Safety Review 2020 146 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview Reims Cessna F150M, G-CSBM 10 July 2020 at Winchfield, Hampshire As the aircraft approached Blackbushe Airport the engine lost power and the pilot made a precautionary landing in a field. There was no damage to the aircraft and neither occupant was injured. The engine lost power due to fuel exhaustion. The pilot had used a fuel dipstick through a desire to measure the fuel onboard more accurately, but the dipstick used was not calibrated for the aircraft; this led him to overestimate the fuel onboard. The pilot made a safe precautionary landing in a field due to loss of engine power. The engine had lost power due to fuel exhaustion. Through a desire to measure the fuel accurately the pilot had used the incorrect fuel dipstick leading him to overestimate the fuel onboard. Safety action taken by the flying club

●The flying club have reminded pilots of the importance of only using the dipstick calibrated for the aircraft they are flying. G-CSBM after the precautionary landing

Air Accidents Investigation Branch Annual Safety Review 2020 147 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommednation and Safety Action Overview Airbus A321, YL-LCQ Airport, Spain 22 July 2019 on approach to London Stansted Airport London Stansted Airport (STN) was operating with a displaced threshold on Runway 22 (RW22) while repairs were carried out at the normal threshold. RW22 ILS was unavailable during the works period. A revised RNAV approach (RNAV22C), which was steeper and based on the displaced threshold, had been promulgated for RW22. YL-LCQ was observed to be lower than expected during its approach and over the works area. The pilots of YL-LCQ had not realised that a revised approach was required and flew the standard RNAV arrival. Radar data indicated that the aircraft was low over the works area and touched down close to the displaced threshold. Temporary approach plates were available to the pilots in their electronic flight bags (EFB), but the stated workinprogress (WIP) active periods on the temporary airfield chart were incorrect. ATC had made repeated references to the displaced threshold and the RNAV22C arrival during the period when YL-LCQ was on the terminal controller’s frequency. After the incident, the operator highlighted the WIP implications to all their pilots operating from STN. The chart manufacturer reviewed their processes to address the issues which had resulted in incomplete information being presented on the temporary airfield chart. Having read the relevant flight documentation paperwork, the pilots’ mindset was that the runway works at STN were not active during their approach. Confirmation bias appears to have played a part in the pilots’ selection of the wrong approach procedure and may have contributed to ATC not detecting the error. The reminder to follow PAPI indications was misinterpreted as an instruction to ignore them. The incident highlighted the importance of correct and complete radio transmission phraseology Safety actions taken by the aircraft operator, air traffic servies, airport users safety group and chart manufacturer

●The aircraft operator alerted their crews to the error in the temporary airfield chart and the requirement to fly the revised RNAV procedure when the THR 22 works were active.

●The Stansted Airport air traffic services unit terminal control interface manager was tasked to raise the issue of incorrect or incomplete readbacks with the terminal control unit; the aim being to ensure that future poor radio phraseology would be robustly challenged. Comparative radar traces (YL-LCQ trace in red)

Air Accidents Investigation Branch Annual Safety Review 2020 148 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Safety Recommendation and Safety Action Overview

●The airport’s user safety group was tasked to conduct a full review of the phraseology used for the reduced runway operations.

●The chart manufacturer undertook an investigation into how the works scheduling had been incorrectly represented on the temporary airfield chart and took remedial action to prevent similar data transposition errors in the future.

Air Accidents Investigation Branch Annual Safety Review 2020 149 AAIB Air Accidents Investigation Branch © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk @aaibgovuk Appendix 1 - CICITT Occurrence Categories CODE DESCRIPTION ARC ABNORMAL RUNWAY CONTACT AMAN ABRUPT MANEUVER ADRM AERODROME MAC AIRPROX/TCAS ALERT/LOSS OF SEPARATION/NEAR MIDAIR COLLISIONS/MIDAIR COLLISIONS ATM ATM/CNS BIRD BIRD CABIN CABIN SAFETY EVENTS CTOL COLLISION WITH OBSTACLE(S) DURING TAKEOFF AND LANDING CFIT CONTROLLED FLIGHT INTO OR TOWARD TERRAIN EVAC EVACUATION EXTL EXTERNAL LOAD RELATED OCCURRENCES F–NI FIRE/SMOKE (NON-IMPACT) F–POST FIRE/SMOKE (POST-IMPACT) FUEL FUEL RELATED GTOW GLIDER TOWING RELATED EVENTS GCOL GROUND COLLISION RAMP GROUND HANDLING ICE ICING LOC–G LOSS OF CONTROL–GROUND LOC–I LOSS OF CONTROL–INFLIGHT LOLI LOSS OF LIFTING CONDITIONS EN ROUTE LALT LOW ALTITUDE OPERATIONS MED MEDICAL NAV NAVIGATION ERRORS OTHR OTHER RE RUNWAY EXCURSION RI RUNWAY INCURSION SEC SECURITY RELATED SCF–NP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (NON-POWERPLANT) SCF–PP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (POWERPLANT) TURB TURBULENCE ENCOUNTER USOS UNDERSHOOT/OVERSHOOT UIMC UNINTENDED FLIGHT IN IMC UNK UNKNOWN OR UNDETERMINED WILD WILDLIFE WSTRW WIND SHEAR OR THUNDERSTORM

Air Accidents Investigation Branch Annual Safety Review 2020 AAIB Air Accidents Investigation Branch GLOSSARY OF ABBREVIATIONS aal above airfield level ACAS Airborne Collision Avoidance System ACARS Automatic Communications And Reporting System ADF Automatic Direction Finding equipment AFIS(O) Aerodrome Flight Information Service (Officer) agl above ground level AIC Aeronautical Information Circular amsl above mean sea level AOM Aerodrome Operating Minima APU Auxiliary Power Unit ASI airspeed indicator ATC(C)(O) Air Traffic Control (Centre)( Officer) ATIS Automatic Terminal Information Service ATPL Airline Transport Pilot’s Licence BMAA British Microlight Aircraft Association BGA British Gliding Association BBAC British Balloon and Airship Club BHPA British Hang Gliding & Paragliding Association CAA Civil Aviation Authority CAVOK Ceiling And Visibility OK (for VFR flight) CAS calibrated airspeed cc cubic centimetres CG Centre of Gravity cm centimetre(s) CPL Commercial Pilot’s Licence °C,F,M,T Celsius, Fahrenheit, magnetic, true CVR Cockpit Voice Recorder DFDR Digital Flight Data Recorder DME Distance Measuring Equipment EAS equivalent airspeed EASA European Union Aviation Safety Agency ECAM Electronic Centralised Aircraft Monitoring EGPWS Enhanced GPWS EGT Exhaust Gas Temperature EICAS Engine Indication and Crew Alerting System EPR Engine Pressure Ratio ETA Estimated Time of Arrival ETD Estimated Time of Departure FAA Federal Aviation Administration (USA) FIR Flight Information Region FL Flight Level ft feet ft/min feet per minute g acceleration due to Earth’s gravity GPS Global Positioning System GPWS Ground Proximity Warning System hrs hours (clock time as in 1200 hrs) HP high pressure hPa hectopascal (equivalent unit to mb) IAS indicated airspeed IFR Instrument Flight Rules ILS Instrument Landing System IMC Instrument Meteorological Conditions IP Intermediate Pressure IR Instrument Rating ISA International Standard Atmosphere KCAS knots calibrated airspeed kg kilogram(s) KIAS knots indicated airspeed KTAS knots true airspeed km kilometre(s) kt knot(s) lb pound(s) LP low pressure LAA Light Aircraft Association LDA Landing Distance Available LPC Licence Proficiency Check m metre(s) mb millibar(s) MDA Minimum Descent Altitude METAR a timed aerodrome meteorological report min minutes mm millimetre(s) mph miles per hour MTWA Maximum Total Weight Authorised N Newtons NR Main rotor rotation speed (rotorcraft) Ng Gas generator rotation speed (rotorcraft) N1 engine fan or LP compressor speed NDB Non-Directional radio Beacon nm nautical mile(s) NOTAM Notice to Airmen OAT Outside Air Temperature OPC Operator Proficiency Check PAPI Precision Approach Path Indicator PF Pilot Flying PIC Pilot in Command PM Pilot Monitoring POH Pilot’s Operating Handbook PPL Private Pilot’s Licence psi pounds per square inch QFE altimeter pressure setting to indicate

height above aerodrome QNH altimeter pressure setting to indicate

elevation amsl RA Resolution Advisory RFFS Rescue and Fire Fighting Service rpm revolutions per minute RTF radiotelephony RVR Runway Visual Range SAR Search and Rescue SB Service Bulletin SSR Secondary Surveillance Radar TA Traffic Advisory TAF Terminal Aerodrome Forecast TAS true airspeed TAWS Terrain Awareness and Warning System TCAS Traffic Collision Avoidance System TODA Takeoff Distance Available UA Unmanned Aircraft UAS Unmanned Aircraft System USG US gallons UTC Co-ordinated Universal Time (GMT) V Volt(s) V1 Takeoff decision speed V2 Takeoff safety speed VR Rotation speed VREF Reference airspeed (approach) VNE Never Exceed airspeed VASI Visual Approach Slope Indicator VFR Visual Flight Rules VHF Very High Frequency VMC Visual Meteorological Conditions VOR VHF Omnidirectional radio Range

Air Accidents Investigation Branch Annual Safety Review 2020

FD06700 ｜ 2020_英国_annual-safety-review-2020__Annual_Safety_Review_2020_Interactive.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2020 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Annual Safety Review 2020 AAIB Air Accidents Investigation Branch

i © Crown copyright 2021

© Crown Copyright 2021 All rights reserved. Copies of this publication may be reproduced for personal use, or for use within a company or organisation, but may not otherwise be reproduced for publication. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and it is not used in a derogatory manner or in a misleading context. Published: 24 June 2021. Enquiries regarding the content of this publication should be addressed to: Air Accidents Investigation Branch Farnborough House Berkshire Copse Road Aldershot Hampshire GU11 2HH. enquiries@aaib.gov.uk This document is also available in electronic (pdf) format at www.aaib.gov.uk Foreword I am pleased to introduce this Annual Safety Review which includes information on occurrences and the safety action taken or planned in response to AAIB investigations concluded in 2020. Although the coronavirus pandemic had a profound effect on both commercial and general aviation activity in 2020, the AAIB still received 553 occurrence notifications (compared to 826 in 2019) and opened 20 field investigations, 4 of which were into fatal accidents in the UK resulting in 4 deaths. A further 108 investigations were opened by correspondence. In addition, the AAIB appointed an accredited representative to 31 overseas investigations (compared to 96 in 2019), and made a notable contribution to major event investigations in Iran and Indonesia. The number of commercial air transport serious incidents was fewer than normal reflecting the reduction in air travel. However, several occurrences were attributed to factors associated with the return to flying, after a long pause which in some cases affected the aircraft or those that fly them. Despite the coronavirus restrictions, there was a growth in the reporting of unmanned aircraft system (UAS) occurrences in 2020 reflecting a greater awareness among UAS operators of the need to report occurrences. The AAIB undertook several UAS investigations and identified safety issues related to the overflight of 3rd parties that have not been fully addressed by the new regulations and recommendations have been made to the relevant authorities. The AAIB remained operational throughout the lockdowns, responding immediately to occurrences as they arose. Despite the many restrictions in place in the UK and around the world, the AAIB found effective ways to progress its investigations. This Review includes an article which describes how the AAIB adapted its working practices to continue to fulfil its important role. The Review also includes an article on the new cloud-based Case Management System that the AAIB has introduced to manage investigations from notification to closure. Fortuitously, after 2 years of development, the system went live in March 2020, just as the UK went into its first lockdown, greatly enhancing our ability to work collaboratively and remotely as required. Productivity remained high throughout the year and the branch published 30 Field and 199 Correspondence Investigation Reports. These included 30 Safety Recommendations covering diverse safety issues with commercial air transport, general aviation, unmanned air systems and glider flying. Full details of the recommendations and the responses AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Foreword and Contents Foreword and Contents AAIB Air Accidents Investigation Branch Air Accidents Investigation Branch Annual Safety Review 2020

1 © Crown copyright 2021 ii © Crown copyright 2021

received from the responsible authorities, are provided in this Review. There are also details of 159 significant safety actions taken proactively by the industry in response to our investigations, representing a wide array of actions taken to improve aviation safety. I invite you to peruse this 2020 Annual Safety Review which I trust you will find interesting and useful. Crispin Orr Chief Inspector of Air Accidents Contents Foreword ............................................................................................................................ i The Impact of Covid-19 On The Air Accidents Investigation Branch.......................... 3 AAIB’s Case Management System ................................................................................ 9 CICTT factors on investigations by the AAIB in 2020................................................. 13 Field investigations.................................................................................................. 14 Correspondence investigations............................................................................... 15 UAS investigations .................................................................................................. 16 Statistics for 2020........................................................................................................... 17 Category definition .................................................................................................. 18 Notifications 2020.................................................................................................... 19 Notifications 2019.................................................................................................... 20 Notifications 2018.................................................................................................... 21 Safety Recommendations in 2020 ................................................................................ 23 Index of Safety Recommendations 2020 ................................................................ 29 Safety Actions from investigations reported on in 2020 ............................................ 79 Index of Safety Actions (by aircraft weight) ............................................................. 79 Formal Investigations .............................................................................................. 81 Special Bulletin........................................................................................................ 83 Field Investgations .................................................................................................. 85 Correspondence Investigations............................................................................. 121 Appendix 1 - CICITT Occurrence Categories............................................................. 149 AAIB Air Accidents Investigation Branch Air Accidents Investigation Branch Annual Safety Review 2020 AAIB Air Accidents Investigation Branch Air Accidents Investigation Branch Annual Safety Review 2020 Foreword and Contents @aaibgovuk www.aaib.gov.uk Foreword and Contents Follow us on Twitter: @aaibgovuk @aaibgovuk www.aaib.gov.uk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299

3 © Crown copyright 2021 2 © Crown copyright 2021

The Impact of Covid-19 On The Air Accidents Investigation Branch Introduction Whilst flying is the safest form of transport on the planet (per mile travelled), as a high technology industry it has always been an enterprise susceptible to a lack of attention to detail. However, few could have anticipated the devastation that the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) particle, as small as 60µm, would have on aviation globally. One of the significant challenges for aviation has been how, after such a long hiatus, to safely get aircraft, pilots and passengers back flying. The statistics for the past year make interesting reading, and show that despite a disproportionate lack of flying, the amount of safety reporting has remained relatively high, at levels 86% of the year before. Despite huge efforts by regulators, operators and manufacturers to raise awareness of the potential hazards to enable a measured safe return to flying for all types of aviation there have inevitably been mishaps, serious incidents and, unfortunately, accidents. This article covers how the UK Air Accidents Investigation Branch (AAIB) has reacted to these events in the midst of a pandemic. The global challenge The global nature of Aviation is exposed in accidents. An aircraft accident in the UK could, for example, involve design organisations in the US, regulators from Canada and component manufacturers in Europe and could be of interest to operators of the type all over the world. Thus, Accident Investigation Authorities (AIAs) rely on relationships with other AIAs, manufacturers, operators and other government departments to conduct investigations. So, finding effective methods of sustaining these relationships in a pandemic has been key to sustaining operational viability of not just the AAIB, but every AIA. In response to these and many other types of challenge being encountered by investigators, AIAs had to establish codes of practice and recommendations of how to cope in a pandemic. These are comprehensive covering all phases of the accident investigation from notification of the accident, deployment, the post field phase through to the giving of evidence in an Inquest. Maintaining operational readiness Firstly, for the AAIB, it was critical to establish a safe and secure base from which to conduct operations. This required the AAIB Business Support team to overcome the challenge of rapidly implementing procedures and mitigations in accordance with UK Government and World Health Organisation guidelines to ensure that a covid-secure workplace was sustained. Communications and IT are a critical enabler and the AAIB has taken huge strides forward in enabling collaborative remote working whilst retaining its ability to manage sensitive and confidential information. Whilst the AAIB was well positioned in having the right type of Personal Protective Equipment (PPE), the same challenges were faced as with many other organisations of maintaining sufficient stocks in the face of overwhelming AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 The impact of Covid-19 on the AAIB The impact of Covid-19 on the AAIB

5 © Crown copyright 2021 4 © Crown copyright 2021

global demand for these products. Finally, we needed to protect the AAIB’s most valuable assets – its people. Firstly, those within the organisation most at risk were identified and shielded; all unnecessary travel was avoided, particularly by public transport and access to healthcare resources facilitated. For the staff that needed to travel, the AAIB ensured they were designated as critical safety workers, with freedom to move around and operate as required. A small accident in rural Britain will have multi-national interest Notification and deployment In taking the decision to activate an Investigative Team, AAIB Duty Coordinators (DCOs) assess an incident against a range of criteria and decide if it crosses a threshold which supports a deployment. Covid-19 has not changed those criteria, so in one regard the decision whether the AAIB should deploy has not changed. The more critical aspect has been if the team can deploy. Within the UK this was largely surmountable thanks to the skilled efforts of the AAIB Operations Centre team, who managed to resolve the logistics challenges such as availability of accommodation or flights during lockdown. However, overseas deployments presented more significant hurdles with the introduction of quarantine periods both on arrival and return. There was also the risk of contracting the virus whilst on deployment and having investigators stranded in far-off places. This potentially would impact on the wider AAIB capability if a major event occurred in the UK, as such events quickly consume the available resources of what is a capable but compact organisation. The decisions on deployment are more straightforward when there are fatalities involved, but more nuanced with less severe incidents and near miss events. It is the latter scenarios where DCOs are having to carefully weigh the potential safety benefits with the risks involved in deploying. Despite these challenges the AAIB has continued to successfully deploy teams to a wide range of scenarios, attending fatal accidents and serious incidents in the UK and overseas whilst sustaining its capability to respond to a large scale incident. At the accident scene In many ways conducting the physical investigation of the wreckage at the accident site posed the least challenge. With the numerous hazards inherent in aircraft accidents, of which inhalation hazards are often present, investigators were already well prepared from a PPE perspective for the hazards posed by SARS-CoV-2 (or Covid-19 as it more commonly known). The problems resided in the human side of the investigative process. Conducting interviews in-person with witnesses were made more difficult by the wearing of face masks, adding a barrier to the communication in which the ability of the investigator to build a rapport and gain trust is vital. On the accident site the calibration of risk from Covid-19 can be difficult to maintain, the team are focussed on the hazards presented by the site and much care is taken to protect themselves and anyone else from harm. It can be a difficult mental adjustment to consider that each member of the team and other stakeholders present at the accident site could potentially be presenting a hazard to each others health as well. When an investigative team has spent hours in full body suits and masks combing over an accident site, the last thing they wish to do after getting out of the PPE is to put on another mask! But that is the discipline required to protect each other and keep the team operational. One of the challenging aspects of field investigations is managing stakeholders from different organisations who may have different perspectives on risk. On a small accident site this is relatively easy to control but ensuring consistent level of PPE on a larger scale accident can be more challenging. Covid-19 poses a similar problem, whilst the guidance on facemasks and social distancing is clear, it is common to observe lots of variance in adherence to these rules. An important dynamic from the investigative team is to be able to meet together in the evening to discuss the day’s activities. Whilst the Engineering Inspectors will have spent most of the time on site, the Operations Inspectors will have been mobile, interviewing witnesses at varying locations. Similarly, the Recorded Data Group and Human Factors Inspectors may well have all spent time focussed on different areas. The opportunity to brief the investigator in charge and start to knit together the various strands of evidence and information into an initial concept of events is critical in enabling the investigation to focus its efforts in the right area. This time is also important after an investigative team has undertaken the critically important task with the emergency services and Disaster Victim Identification (DVI) teams to carefully extract fatalities from the accident scene. Following exposure to what can be harrowing experiences, it is vital to have the opportunity for the team to talk and support one another. Depending on the location of the accident this type of evening meeting was not always possible. On one deployment to the Channel Islands exemptions were granted from the quarantine with understandable strict conditions (given the Island had a zero incidence of Covid-19). Inspectors were required to go directly from the aircraft to their hotel rooms and only to leave to visit the aircraft. Technology can be used to try and overcome these issues, but there are some conversations that are not suited to the dynamics of video calls. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 The impact of Covid-19 on the AAIB The impact of Covid-19 on the AAIB The impact of Covid-19 on the AAIB

7 © Crown copyright 2021 6 © Crown copyright 2021

Post field phase Whilst the actions taken at an accident site are often challenging, this element (known as the field phase) of the investigation tends also to be relatively short in duration. The post field phase, however, can last months, if not years and managing the investigation during this phase has raised its own challenges. Damaged or undamaged flight recorders have had to be transported to suitable laboratories, sometimes in a foreign state, to recover and analyse data. With international interest in recorder downloads, arrangements had to be considered to enable Accredited Representatives to participate in briefings and observe proceedings remotelyusing live video links. Similarly, novel techniques have had to be adopted to conduct detailed wreckage and component examinations. The AAIB was not able to travel to the United States with critical engine components from a Bell Helicopter, but were able to conduct the forensic examination with assistance from Rolls Royce (UK), with reach-back to the Type Certificate holder in the US who had the in-depth product knowledge. The effect of Covid-19 protocols So, as can be seen, the AAIB and other AIAs have introduced numerous protocols to sustain investigations through the pandemic, but what has been the cost of these? As is often the case in life, new challenges often re-present old problems in a different context. Some readers may be aware of the famous Prussian Military Officer Carl von Clausewitz and his writings on his experiences of war as France defeated Prussia at the twin battles of Jena and Auerstädt on October 14, 1806. It may seem odd to be drawing lessons from such a distant event. What relevance can the experience of a 19th century infantry officer hold for us today performing accident investigation? The central tenet of Clausewitz’s writings are about the attritional effect of reality on ideas and intentions in war, for which he introduced the term ‘friction’. In modern day air accident investigation, the investigative protocols are the embodiment of AIAs ideas and intentions to manage the risks associated with sustaining this important activity in a pandemic. Each mitigation, if applied correctly, is effective, but each brings its own friction in terms of a penalty of adding time, cost and increasing the energy needed to achieve the same level of effectiveness in an investigation. The effect of reality on all these protocols is that they also introduce delay, inertia and complexity at just about every step of an investigation. And it is not just the protocols that have introduced friction. As mentioned earlier, aviation is a global business, and the business of investigating accidents relies on long established relationships with safety staff at operators, manufacturers and regulators. These safety teams have not been immune from the effects of the pandemic on industry. The hollowing out of industrial resources has meant that some company’s ability to respond to incidents has been significantly diminished, and their own investigations have taken longer than normal, or not been possible at all because the company has ceased to operate. As well as the impact on investigations there has been the impact of the pandemic on individual’s health and wellbeing. There are the obvious first order consequences of personnel who have been unfortunate enough to contract Covid-19, both in its short and longer term effects. But more insidious has been the indirect effects of the pandemic on people’s sense of wellbeing. The effects of social distancing and the impediments to the mobility of people has the potential to affect people’s mental and physical health and undermine the morale and cohesion of the workforce. It is interesting to note that Clausewitz recognised the morale and will of a soldier as the most important component in warfare. For AIAs, which tend to be small organisations comprised of highly motivated individuals, maintaining these components is equally important. Unexpected side effects But what AIAs are also recognising is that the pandemic has expedited new ways of working and innovation that may have taken decades to progress otherwise. Home working is not a new concept, in fact it was common prior to the Industrial Revolution (and even sustained through it). However, the huge experiment in home working conducted over the past several months, has despite the understandable initial concerns of some, delivered surprising results. It has generated a resilience by significantly reducing the risk of losing a cohort of investigators to an outbreak of Covid-19. By exploiting the advantages technology can offer it has strengthened the ability of AIAs to conduct remote investigations, particularly overseas. Whilst undoubtedly certain aspects of business, particularly networking, are better conducted face to face, the innovative ways of working adopted through the pandemic have shown that many routine aspects can be conducted remotely. AIAs have had an advantage in that the provisions of Annex 13 to the convention on civil aviation - aircraft accident and incident investigation provide the statutory enabling framework for AIAs to assist one another. The working practices adopted under the pandemic have merely further exploited the co-operation this enables. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 The impact of Covid-19 on the AAIB The impact of Covid-19 on the AAIB The impact of Covid-19 on the AAIB

9 © Crown copyright 2021 8 © Crown copyright 2021

Glimmers of light in the darkness The importance of management and leadership, at all levels, in guiding the AAIB through this pandemic cannot be overstated. This demand is twofold. Firstly, there is the challenging task of trying to understand the cumulative effect of the friction generated by the Covid-19 protocols on the output of an AIA and the health and wellbeing of the workforce. The CIAA and the management team have gone to great lengths to sustain communication with their teams. As importantly, the wider AAIB team have needed to work to support each other across the psychological divides and barriers that can be created by social distancing protocols and remote working. Secondly, there is the responsibility to exploit the opportunities that have been presented by the pandemic to enhance the way the AIA works. If there is one certainty during these very unpredictable times it is that SARS Cov-2 will not be the last virus with which the world will wrestle. The AAIB management team are focussed on learning the lessons from this pandemic. Finding the right blend of traditional and distributed working models and building on the technological capabilities and investigation techniques developed during Covid-19 will be key to the AAIB’s ability to sustain operations in the next pandemic. Conclusion The AAIB has responded effectively to the pandemic; it has remained operational and continued to fulfil its important role of improving aviation safety. It has deployed personnel throughout the pandemic and sustained the currency of its experienced cadre. It has also effectively recruited and trained new inspectors and support staff. It has achieved all this by employing innovative ways of working, exploiting technology and working with its extensive network of fellow AIAs to develop safe protocols for investigations. If there is a truism in the field of accident investigation it is that every accident is different and presents unique challenges. It is in the DNA of the AAIB to overcome challenge and to solve problems and this attitude can be seen at every level and discipline in the AAIB. Ultimately, it has been the harnessing of this corporate attitude that has enabled the AAIB to successfully overcome the challenges and continue to operate during the SARS Cov-2 pandemic. AAIB’s Case Management System As an investigative body there is a need to store appropriate records securely and to manage the investigation process from event notification to assessment of responses to recommendations. The legacy system was proving to be outdated and was not flexible enough to keep pace with changes in accident investigation regulations. In March 2020 AAIB went live with a new cloud-based Case Management System (CMS). This was fortuitous timing as it was the week before the UK went into lockdown due to Covid-19 and our legacy database system did not provide good remote access. The CMS programme was the result of two years of development and testing. It replaced the previous bespoke database, and importantly brought tracked emails and investigation evidence, such as images, into one cloud-based system. The system can be accessed from most mobile devices giving significant improvements for staff working remotely, which is routinely encountered during deployments, as well as during enforced home working during the Covid-19 pandemic. Agile project techniques were used to develop the system, and much of the core functionality was developed in conjunction with the UK Rail and Marine Accident Investigation Branches to reduce costs. Importantly AAIB case records from legacy systems have been migrated into CMS to provide a database of events spanning several decades. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 AAIB’s Case Management System AAIB’s Case Management System The impact of Covid-19 on the AAIB

11 © Crown copyright 2021 10 © Crown copyright 2021

Managing the Investigation The case management process starts with a notification to the AAIB. This might be from a pilot, an airport, an operator, the police or from a member of the public. The AAIB accident line is active at all times. During UK office hours the accident line is staffed by the AAIB’s Operations Centre, whilst out of hours the accident line is transferred to the DfT’s Duty Office who then contacts the AAIB’s Duty Coordinator. Information, gathered from the notification, such as contacts, event description, damage to the aircraft, is entered into CMS. Previously this info would have been recorded on an electronic form, however it is now input directly into CMS by whoever takes the call and is immediately available for the AAIB’s Duty Coordinator to make their assessment as to the AAIB’s response. Event notifications are triaged by the AAIB Duty Coordinator, who is an experienced investigator. This includes an assessment of the severity of the event according to international standards set out in Annex 13 to the Convention on International Civil Aviation and regulations, as well as an assessment of the appropriate response from AAIB. In a typical year AAIB receives just under 1,000 notifications and AAIB are very keen that they achieve an element on over-reporting so that all events from which safety lessons can be learned are captured. AAIB responses include: ● Deploying a team for a Field investigation ● Assigning an inspector for a correspondence investigation ● Conducting a wide-ranging Safety Study ● Completing a short (few lines of text) Record Only investigation ● Assisting a foreign state by appointing an Accredited Representative or “Expert” ● Referring the investigation to a UK sport aviation body ● No Further AAIB Action. Having captured the assessment in CMS the AAIB Operations Centre Team then support the investigation process with various activities such as sending formal notification emails to organisations such as State Investigation Authorities. The team assigned to the investigation are entered in CMS and thereafter automated alerts notify the case team of key milestones in the investigation process. Managing the Investigation A dedicated SharePoint site has been created as part of CMS where case information, such as documents, images and email attachments, are stored. This allows the case team to share case information throughout the investigation, including during the field phase where the deployed team are often not working at the same location. There is also functionality in CMS to record notes on investigation progress to assist management oversight. A key part of the investigation is report creation. AAIB publish several report types such Formal Reports, Field Investigation Reports, Correspondence Investigation Reports, Special Bulletins and Record Only Reports; these are all managed from CMS and the linked SharePoint site. This includes managing the email process for formally requesting comments on draft reports in accordance with the ICAO Annex 13 standards. Managing Safety Recommendations Making Safety Recommendations is a key part of AAIB’s activities in improving aviation safety. The formal transmittal of Safety Recommendations, and the responses from the addressees to Safety Recommendations, is managed and monitored from CMS. This includes managing both the email process with external addressees as well as managing the internal assessment of responses. Evidence Management The tracking of evidence has been incorporated within CMS. Evidence can be logged into CMS during a field deployment using mobile devices and can be tracked as the investigation progresses. CMS has the functionality to manage ‘child’ evidence that is generated from ‘parent’ evidence during a component teardown for example. The system has the option to use barcode readers available on mobile phones. Management data The system has powerful search capabilities and the ability to tailor data presentation to various user needs using bespoke views. This is particularly useful for providing automated management information for example weekly event logs, inspector workload allocation and managing responses to Safety Recommendations. The Deputy Chief Inspector at AAIB, has been very pleased with the results, “not only has this been a real enabler to AAIB during lock down with the extended periods of home working, but it has also provided AAIB with the flexibility to evolve our business processes. The latter is particularly important for our key outputs and Safety Recommendations, as we are now required to monitor the responses and actions taken by organisations”. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 AAIB’s Case Management System AAIB’s Case Management System AAIB’s Case Management System

13 © Crown copyright 2021 12 © Crown copyright 2021

CICTT factors on investigations by the AAIB in 2020 Every occurrence in the UK is recorded and coded using the occurrence taxonomy defined by the CAST/ICAO Common Taxonomy Team (CICTT). This is a worldwide standard taxonomy to permit analysis of data in support of safety initiatives. It should be noted that they are recorded as multiple factors, for example turbulence (TURB) leading to loss of control in flight (LOC-I). Similarly, other (OTHR) is also used and may include aspects that do not have specific classifications. ARC 41 MAC 1 LOCI 61 SCF-PP 4 F-NI 7 AMAN CTOL 24 RE 15 LOCG 24 SF-NP 21 SCF-PP 20 GCOL 12 FUEL 6 CABIN 3 USOS 4 BIRD 2 EVAC 2 LALT 1 GTOW 1 ADRM 10 CFIT 9 WSTRW 5 AMAN 4 NAV 3 TURB 3 F-POST 2 UAS 2 2 OTHR 37 See Appendix 1 for category descriptions UNK 1 ATM 1 EXTL 1 Factors for all investigations reported on by AAIB in 2020 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 CICTT Factors on Investigations by the AAIB in 2020 CICTT Factors on Investigations by the AAIB in 2020

15 © Crown copyright 2021 14 © Crown copyright 2021

Field investigations OTHR 10 SCF-NP* 9 F-NI 5 LOCI* 7 ADRM 4 SCF-PP 4 ARC 2 RE 2 EVAC 2 F-POST 2 GCOL 2 RI 2 AMAN 2 LOCG* 5 CTOL 1 CFIT 1 CABIN 1 FUEL 1 ATM 1 LALT 1 MED 1 GTOW* 1 WSTRW 1 See Appendix 1 for category descriptions

• - Categories connected with fatal accident

Factors for field investigations reported on by AAIB in 2020 In 2020 the AAIB published 30 field investigation reports, one of which was an investigation into a fatal accident and 29 were into non-fatal accidents or serious incidents. The 29 investigation reports published during 2020 into non-fatal events were balanced between commercial air transport (CAT) and general aviation (GA). Correspondence investigations LOCI 22 CTOL 14 F-NI BIRD 1 1 2 MAC 1 EXTL 1 WSTRW 1 See Appendix 1 for category descriptions Factors for correspondence investigations reported on by AAIB in 2020 Correspondence investigations are usually conducted into non-fatal accidents on GA aircraft and to some serious incidents on CAT aircraft. OTHR 23 SCF-PP 4 FUEL 3 AMAN ARC 14 SCF-PP 7 RE 7 GCOL 7 LOCG 6 SCF-NP 6 RAMP 6 ADRM 5 TURB 3 USOS 3 NAV 3 CABIN 2 CFIT 2 MED 1 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 CICTT Factors on Investigations by the AAIB in 2020 CICTT Factors on Investigations by the AAIB in 2020 CICTT Factors on Investigations by the AAIB in 2020

16 © Crown copyright 2021 17

Air Accidents Investigation Branch Annual Safety Review 2020 AAIB Air Accidents Investigation Branch UAS investigations Statistics for 2020 LOCI 41 SCF-PP 6 OTR 5 CFIT 6 CTOL 3 U-LINK 2 SCF-NP 4 GCOL 1 1 ARC 1 FUEL 1 BIRD 1 TURB 1 USOS UNK 1 An overview of what we were involved with during 2020 can be seen below: See Appendix 1 for category descriptions Factors for UAS investigations reported on by AAIB in 2020 The predominant cause of UAS accidents, was LOCI usually resulting from a sudden complete electrical power failure or loss of thrust from one or more lift propellors. In most of these cases failures such as this results in the machine rapidly becoming unflyable and unrecoverable. There is no resort to aerodynamic recovery techniques such as can be carried out in a conventional helicopter. Although the parachute recovery systems are becoming available, the AAIB has no data on the effectiveness or otherwise of these systems. UK Registered Overseas 9 Average months to publication for a Field Investigation 10.92 5.34 Average months to publication for a Correspondence Investigation Number of Correspondence Investigation Reports published (incl UAS and Rec-only) 199 Total number of Correspondence (AARF) Investigations opened 108 Number of Safety Recommendations 30 Referred to Sporting Associations 34 Number of Field Reports published (incl UAS) 30 Overseas (no AAIB involvement) 10 UK Fatal Accidents 4 Number of Deaths 4 Foreign Registered Overseas 22 Number of Formal Reports published 1 No further AAIB action (Civil) 183 Number of Special Bulletins published 1 UK Field Investigations opened (incl UAS) 20 15 Average months to publication for a Formal Investigation Total Number of Notifications received by the AAIB 553 Number of Safety Actions noted 159 Number of UAS Correspondence Investigations opened 17 Military (AAIB assistance) 0 Joint Military & Civil Aircraft 0 Military (no AAIB involvement) 0 Record-only Investigations published 100 Record-only Investigations opened 118 Number of UAS Correspondence Investigations published 20 © Crown copyright 2021 AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Investigation Statistics CICTT Factors on Investigations by the AAIB in 2020 Investigation Statistics

19 © Crown copyright 2021 18 © Crown copyright 2021

Introduction Notifications 2020 The following pages provide the statistics for 2019, 2018 and 2017 for accidents and serious incidents notified to the Air Accidents Investigation Branch. An explanation of the categories is as follows: Category definition UK Aircraft overseas Foreign Aircraft overseas UK Field Investigations Unnmanned Aircraft Systems (UAS) Military with AAIB Assistance / Observer AARF Investigations Overseas (no AAIB involvement) Referrals to Sporting Associations No further AAIB action (Civil) Military (no AAIB involvement) Record-Only Investigations Investigations involving UK registered aircraft, or aircraft registered in one of the UK Overseas Territories or Crown Dependencies, occurring in a Foreign State where the AAIB has participated in the capacity of Accredited Representative in accordance with ICAO Annex 13. Accidents and serious incident investigations to Foreign registered aircraft occurring in a Foreign State where the AAIB has participated in the capacity of Accredited Representative or Expert in accordance with ICAO Annex 13. Investigations involving the deployment of a ‘Field’ team within the UK or to one of the UK Overseas Territories or Crown Dependencies and those investigations where a team has not deployed but Safety Recommendations are made. Also includes investigations which have been delegated to the AAIB by another State. Accidents and serious incident investigations to UAS where they are operated under a CAA permission, or are privately operated with mass greater than 20 kg. Where an MoD aircraft accident, serious incident Service Inquiry may be convened, an AAIB Inspector is appointed to assist or observe. Investigations conducted by correspondence only using an Aircraft Accident Report Form (AARF) completed by the aircraft commander. Notifications to the AAIB of an overseas event which has no AAIB involvement. Investigations referred to the relevant UK Sporting Associations. Occurrences notified to the AAIB involving civil registered aircraft which do not satisfy the criteria of an accident or serious incident in accordance with the Regulations. Notifications to the AAIB concerning Military aircraft with no AAIB involvement. An occurrence that if investigated fully has little likelihood of identifying new safety lessons that will advance aviation safety. Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 1 0 2 1 0 1 0 1 1 1 1 0 9 Foreign Reg Overseas 5 3 1 0 2 0 2 1 2 3 2 1 22 UK Field Investigations 0 1 1 0 3 1 0 4 4 3 2 1 20 Military (AAIB Assistance) 0 0 0 0 0 0 0 0 0 0 0 0 0 Total no of Correspondence Investigations (AARF) 4 5 8 2 9 13 18 15 15 6 4 9 108 Correspondence Investigations (AARF) involving UAS 0 0 3 3 1 2 1 0 0 0 0 0 10 Overseas (no AAIB involvement) 0 0 3 1 0 1 2 0 0 1 1 1 10 Referred to the appropriate Aviation Sporting Association 1 0 1 1 2 7 10 5 4 2 1 0 34 Record Only Investigations 7 7 9 4 10 4 17 18 20 3 9 10 118 Total no further AAIB action (civil) 32 31 8 5 3 8 15 22 28 12 8 11 183 Total no further AAIB action (civil) inv UAS 3 0 1 4 7 4 7 6 7 0 0 0 39 Military (no AAIB involvement) 0 0 0 0 0 0 0 0 0 0 0 0 0 Total 53 47 37 21 37 41 72 72 81 31 28 33 553 UK Fatal accidents 0 0 0 0 0 0 0 2 0 1 1 0 4 Number of deaths 0 0 0 0 0 0 0 2 0 1 1 0 4 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Investigation Statistics Investigation Statistics Investigation Statistics

21 © Crown copyright 2021 20 © Crown copyright 2021

Notifications 2019 Notifications 2018 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 3 1 5 1 8 6 8 6 4 2 0 1 45 Foreign Reg Overseas 3 1 5 4 7 4 5 6 1 6 4 5 51 UK Field Investigations 2 3 2 3 3 4 4 4 4 2 2 4 37 Military (AAIB Assistance) 0 0 0 0 0 0 0 0 0 0 0 0 0 Total no of Correspondence Investigations (AARF) 11 20 11 14 11 10 14 13 6 6 5 3 124 Correspondence Investigations (AARF) involving UAS 3 3 3 2 0 2 1 0 4 2 2 1 23* Overseas (no AAIB involvement) 2 0 2 1 1 1 0 1 2 2 0 1 13 Referred to the appropriate Aviation Sporting Association 3 1 3 5 6 5 8 7 6 1 2 1 48 Record Only Investigations 1 1 1 7 11 15 22 16 14 7 6 14 115 Total no further AAIB action (civil) 22 23 26 26 23 45 49 33 44 40 36 25 392 Total no further AAIB action (civil) inv UAS 0 0 0 0 0 0 0 0 1 2 1 7 11* Military (no AAIB involvement) 0 0 1 0 0 0 0 0 0 0 0 0 1 Total 47 50 56 61 70 90 110 86 81 66 55 54 826 UK Fatal accidents 1 1 0 0 1 0 2 1 0 0 1 1 8 Number of deaths 2 1 0 0 1 0 2 2 0 0 1 1 10 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Total UK Registered Overseas 2 1 1 2 4 4 3 0 2 4 0 0 23 Foreign Reg Overseas 5 6 3 1 2 5 4 5 1 3 4 2 41 UK Field Investigations 2 4 0 3 2 3 4 2 0 5 1 0 26 Military (AAIB Assistance) 0 0 1 0 0 1 1 0 0 0 0 0 3 Total no of Correspondence Investigations (AARF) 7 14 9 16 28 29 34 24 20 20 12 8 221 Correspondence Investigations (AARF) involving UAS 1 1 0 0 1 1 1 0 2 3 0 1 11* Overseas (no AAIB involvement) 1 1 1 0 2 0 1 0 1 0 2 0 9 Referred to the appropriate Aviation Sporting Association 1 4 0 3 8 7 6 6 0 3 0 2 40 Total no further AAIB action (civil) 15 22 29 22 28 44 37 50 28 33 23 10 341 Total no further AAIB action (civil) inv UAS 0 0 2 0 1 1 3 2 0 1 1 1 12* Military (no AAIB involvement) 0 1 0 0 0 0 0 0 1 0 0 0 2 Total 33 53 44 47 74 93 90 87 53 68 42 22 706 UK Fatal accidents 1 0 0 1 1 3 1 0 0 2 0 0 9 Number of deaths 2 0 0 2 1 3 1 0 0 7 0 0 16

• Included in the total

numbers of AARF and non-reportable investigations.

• Included in the

total numbers of AARF and non-reportable investigations. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Investigation Statistics Investigation Statistics Investigation Statistics

23 © Crown copyright 2021 22 © Crown copyright 2021

1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 Safety Recommendations in 2020 In 2020 the AAIB issued 30 Safety Recommendations from 12 investigations. 160 140 120 100 80 60 40 20 0 13 17 26 32 28 32 9 10 26 38 40 19 20 17 39 82 39 76 68 114 76 58 37 82 69 66 58 57 95 55 139 109 150 146 128 98 109 95 103 39 23 42 47 57 29 15 12 30 Recommendation numbers made in previous years Each addressee to a Safety Recommendation has to respond within 90 days in accordance with retained Regulation (EU) 996/2010 (as amended) Article 18, and detail what actions have been taken or are under consideration and the time expected to be taken for their completion. If no actions are being considered by the addressee they have to provide their reasoning for the decision. Monitoring of Safety Recommendations The AAIB is responsible for monitoring the action addressee responses to Safety Recommendations. This is in accordance with the amendment that was made to ICAO Annex 13 in November 2018. The specific Paragraph 6.12 requires that; ‘A State that receives a safety recommendation shall implement procedures to monitor the progress of the action taken in response to that safety recommendation’. The AAIB carries out this function for the UK, its Overseas Territories and Crown Dependencies. It is important to note that this is to monitor the progress of actions taken in response to a Safety Recommendation, it is not to undertake the role of the regulator nor to provide opinion on the efficacy of the action. The AAIB monitors the progress of actions being taken by the addressees and reports regularly to the Board of Accident Investigation Branches (BAIB) and the State Safety Board (SSB) on progress toward completion. It is for the SSB to decide whether any further intervention is needed. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommednation and Safety Action Overview

25 © Crown copyright 2021 24 © Crown copyright 2021

This monitoring of actions is not only for Safety Recommendations issued by the AAIB but also those that have been issued to addresses in the UK from other Accident Investigation Authorities. When the AAIB receives a response to a recommendation from the addressee it is assessed as to its adequacy under the requirements of Article 18 of retained Regulation (EU) 996/2010 (as amended). The AAIB applies the following assessment criteria to the Safety Recommendation responses; ● Adequate means that the response fully meets the intent of the Safety Recommendation and the action is expected to address the safety issue. ● Partially Adequate means the response goes someway to meeting the intent of the Safety Recommendation and the action will address the safety issue to a certain extent, but further action would be required to fully address the issue identified. ● Not Adequate means that the response does not address the intent of the Safety Recommendation nor does it address the safety issue concerned. The AAIB will apply an open or closed status depending on the expectation of whether the addressee will reassess their response. ○ Not Adequate - OPEN The status of ‘open’ implies that AAIB still has concerns regarding the identified safety deficiency and that there is an expectation that the addressee will provide further responses. ○ Not Adequate - CLOSED The status ‘closed’ implies that there is a low likelihood that the addressee will act on the recommendation or provide any further responses. ● Superseded means the Safety Recommendation has been ‘Superseded’ either by a ‘newer’ and more comprehensive Safety Recommendation or actions have subsequently been taken by the addressee that have superseded the recommendation. In reporting on the monitoring of the actions taken to a Safety Recommendation these are reported as meeting one of the following: ACTION STATUS Meaning Status ● Planned actions complete All planned actions are completed. CLOSED ● Planned actions partially completed Some of the planned actions have been completed and the addressee is not intending on doing any further action. CLOSED ● Planned actions not completed The planned actions have not been completed and the addressee now has no intention of doing any further action. CLOSED ● Planned actions ongoing update due (XX/XX/ XXXX) Planned actions are still ongoing and further updates will be provided. OPEN ● Not enough information The update is not detailed enough to assess. A request will be made for a further update. OPEN ● No planned actions There are no planned actions. REFER TO NOT ADEQUATE A Safety Recommendation issued after 1 January 2019 therefore remains OPEN until such time as the addressee has completed its activity in relation to that recommendation. It is therefore possible for a Safety Recommendation to be assessed as “adequate” but will remain OPEN until the planned actions are completed. Of the 30 Safety Recommendations issued in 2020, as of the of 31 March 2021, responses have been received for 29 Safety Recommendations. The AAIB response assessment has classified those responses as follows: ● Eight are Adequate, with planned actions completed and are Closed. ● Five are Adequate, with planned actions ongoing and remain Open. ● Ten are Partially Adequate with planned actions ongoing and remain Open. ● Four are Partially Adequate, with planned actions completed and are Closed. ● Two are Not Adequate and are Open. ● One is awaiting a response from the addressee. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

27 © Crown copyright 2021 26 © Crown copyright 2021

Summary table On 31 December 2020 the transition period for the UK exit ended. Thereafter the AAIB was unable to update details of its Safety Recommendations on the European Central Repository Safety Recommendation Information System (SRIS). In addition, SRIS was updated to SRIS 2. The UK Safety Recommendation issued up to the end of 2020 were entered onto SRIS and can be found on the public SRIS. Number Response Assessment Action Status Status 2020-001 Adequate Planned actions completed Closed 2020-002 Adequate Planned actions completed Closed 2020-003 Adequate Planned action ongoing, update due 28 February 2021 Open 2020-004 Adequate Planned actions completed Closed 2020-005 Adequate Planned action ongoing, update due 30 June 2021 Open 2020-006 Partially adequate Planned action ongoing, update due 31 December 2020 Open 2020-007 Partially adequate Planned action ongoing, update due 31 March 2021 Open 2020-008 Not adequate Not enough information Open 2020-009 Adequate Planned action ongoing, update due 31 December 2020 Open 2020-010 Partially adequate Planned action completed Closed 2020-011 Adequate Planned action ongoing, update due 28 February 2021 Open 2020-012 Adequate Planed action ongoing, update due 02 April 2021 Open 2020-013 Adequate Planned action completed Closed 2020-014 Adequate Planned action completed Closed 2020-015 Adequate Planned action completed Closed 2020-016 Partially adequate Planned action completed Closed 2020-017 Adequate Planned action completed Closed 2020-018 Partially adequate Planned action ongoing, update due 21 June 2021 Open 2020-019 Partially adequate Planned action completed Closed 2020-020 Partially adequate Planned action ongoing, update due 19 July 2021 Open 2020-021 Partially adequate Planned action ongoing, update due 31 January 2022 Open 2020-022 Partially adequate Planned action ongoing, update due 19 July 2021 Open 2020-023 Partially adequate Planned action ongoing, update due 14 September 2021 Open 2020-024 Partially adequate Planned action ongoing, update due 31 August 2021 Open 2020-025 Partially adequate Planned action ongoing, update due 24 May 2021 Open 2020-026 Partially adequate Planned action ongoing, update due 31 December 2021 Open 2020-027 Partially adequate Planned action completed Closed 2020-028 Adequate Planned action completed Closed 2020-029 Not adequate Not enough information Open 2020-030 Awaiting response Open These can be found under Safety Recommendations on the aviationreporting.eu portal: https://sris.aviationreporting.eu/safety-recommendations Each Safety Recommendation is also assessed as to whether it is a Safety Recommendation of European Union Wide Relevance (SRUR) or a Safety Recommendation of Global Concern (SRGC). A SRUR is defined as meeting one or more of the following criteria: ● The deficiency underlying the safety recommendation is systemic, not related to a specific aircraft type, operator, manufacturer component, maintenance organisation, air navigation service and/or approved training organisation, and is not solely a national issue, or ● There is a history of recurrence across Europe of the relevant deficiency. ICAO Annex 13 was amended in November 2020 to the 12th Edition, this included an amendment to the definition of a SRGC to: A safety recommendation regarding a systemic deficiency having a probability of recurrence, with significant consequences at a global level, and requiring timely action to improve safety. SRGC provided to ICAO can be found on their website: https://www.icao.int/safety/airnavigation/AIG/Pages/Safety-Recommendations­ of-Global-Concern-(SRGC).aspx Safety Recommendations issued to ICAO are also available on their website: https://www.icao.int/safety/airnavigation/AIG/Lists/Safety%20 recommendations%20to%20ICAO/Search1.aspx Of Safety Recommendations issued by the AAIB in 2020, 5 were both a SRUR and a SRGC. Note: The regulations and a link to ICAO Annex 13 can be found on the AAIB website: https://www.gov.uk/government/collections/aaib-regulations-and-mous AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

29 © Crown copyright 2021 28 © Crown copyright 2021

                                                                                                                                Safety Recommendation Topics 1 2 3 4 5 6 7 8 9 10 11 12 13 Safety Recommendations issued in 2020 Aircraft / Equipment / Facilities Aerodrome equipment / facilities Aircraft / Equipment / Facilities Aircraft equipment Powerplant Notes: Safety Recommendation classification correct at time of publication. Aircraft / Equipment / Facilities Aircraft equipment Structures Safety Recommendations can also be made through AAIB Special Bulletins and are then also reflected in the final report. Aircraft / Equipment / Facilities Aircraft equipment Safety equipment Reflects the situation with Safety Recommendations at 31 March 2021. Aircraft / Equipment / Facilities Aircraft equipment Aircraft systems Aircraft / Equipment / Facilities Ground equipment Aircraft / Equipment / Facilities Rescue Fire Fighting Services Index of Safety Recommendations 2020 Personnel Other Safety Aircraft Registration Page Personnel Training / proficiency / check Recommendation Procedures / Regulations Aircraft operations DJI Matrice 210 (UAS 2020-001 30 registration n/a) 2020-002 31 Procedures / Regulations Aircraft maintenance/inspection Airbus A320-214 G-EZTD 2020-003 33 Procedures / Regulations ANS maintenance/inspection EMB-145EP G-SAJK 2020-004 35 Procedures / Regulations Other Piper PA-46-310P N264DB 2020-005 Procedures / Regulations Rescue Fire Fighting Services 2020-006 Procedures / Regulations Survivability 2020-007 2020-008 2020-009 Bell 429 G-WLTS 2020-010 44 2020-011 45 Standard Cirrus 75 G-DDGX 2020-012 47 2020-013 50 Britten-Norman VP-MNI 2020-014 52 Islander BN-2A-27 2020-015 53 2020-016 54 DJI M600 PRO Airbus A320-214 (UAS registration n/a) OE-LOA 2020-017 2020-018 2020-019 56 58 60 ERJ 190-200 LR G-FBEJ 2020-020 2020-021 2020-022 2020-023 DHC-8-402 G-FLBE 2020-024 68 2020-025 69 2020-026 70 Cessna Citation CJ1 N680KH 2020-027 2020-028 2020-029 2020-030 37 39 40 41 42 62 64 65 66 72 74 75 77 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

31 © Crown copyright 2021 30 © Crown copyright 2021

DJI Matrice 210, (UAS registration n/a) 16 March 2019 at Temple Newsam, Leeds, Yorkshire Synopsis The DJI Matrice 210 small unmanned aircraft was being operated commercially to record video footage of an outdoor athletics event. The pilot started to position the aircraft back towards the landing site due to an increase in the rainfall. The pilot then saw the aircraft “wobble” slightly and as it neared the landing site it flipped over before descending rapidly to the gound from a height Footage captured one minute of about 3 m (10 ft). No one was before the accident injured. During the accident flight the aircraft had been operating at heights of up to about 30 m (100 ft) near to, and above people on the ground. This investigation reviewed other similar accidents and the risk of injury to people on the ground. Two Safety Recommendations were made to the UK CAA. Safety Recommendation 2020-001 Justification Although it was not confirmed if moisture ingress caused this accident, information shows that other Matrice 200 series accidents have been caused by moisture entering the aircraft. The manufacturer’s analysis also showed that 27% of accidents were attributed to a loss of propeller motor propulsion that were for reasons other than a fault with the ESC. The manufacturer did not provide guidance on ascertaining if the rainfall exceeded limitations, or the duration that the IP 43 protection may remain in place. It is therefore possible that pilots of the Matrice 200 series could operate the aircraft in rain without knowing that it could result in the loss of control of the aircraft due to moisture ingress. Therefore, the following Safety Recommendation was made: Date Safety Recommendation made: 2 January 2020 Safety Recommendation 2020-001 It is recommended that the Civil Aviation Authority notify users of the DJI Matrice 200 series of the possibility of moisture entering the aircraft when operating in rain and that this could result in a sudden loss of control of the aircraft. LATEST RESPONSE Response received: 25 February 2020 The publication of CAA Safety Notice SN-2020/001 “Small Unmanned Aircraft – Water Ingress” highlights the issue of water ingress to all types of Unmanned Aircraft Systems and not just specifically for the DJI Matrice 200 series AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Safety Recommendation 2020-002 Justification In accordance with the ANO, a person must not ‘permit an aircraft to endanger any person’ and may only fly the aircraft ‘if reasonably satisfied that the flight can safely be made’. It is therefore up to the operator or remote pilot to decide if flying a UA over people will endanger them. However, there is no guidance available from the CAA on how to make that assessment. This could include consideration of standards of safety, reliability, UA mass and type, the operational environment and whether any secondary safety systems are fitted. IR (EU) 2019/947 is due to come into force in July 2020 and will require that a UA operating in the open category with a mass of more than 250 grams must not be flown over ‘uninvolved persons’. If operating a UA in the specific category, the operator will need to comply with mitigating safety actions to prevent injury to people. However, these actions are not due to be published by the EC until 2021 which leaves an unresolved hazard prior to publication. Therefore, the following Safety Recommendation was made: Date Safety Recommendation made: 2 January 2020 Safety Recommendation 2020-002 It is recommended that the Civil Aviation Authority specify the conditions that must be met for an unmanned aircraft to be flown safely over people. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

33 © Crown copyright 2021 32 © Crown copyright 2021

LATEST RESPONSE Response received: 1 December 2020 The CAA believes that this recommendation is met through the introduction of the European Commission’s new regulations pertaining to UAS that will be implemented in the UK on 31 Dec 20. With the extant regulations, there are no specific requirements that must be met for UAS to be flown over people; the existing rule set specifies that uninvolved third parties must be avoided by a 50m ‘bubble,’ which allows for overflight. Advice on the requirements to achieve this safely were covered through the release of Safety Notices and assessment of individual Operational Authorisations, but it was not within our remit to change the legislation directly to disallow overflight or enforce these requirements. The new regulations specify that the 50m ‘bubble’ will be replaced by a ‘cylinder,’ meaning that UAS cannot fly within a 50m horizontal distance of uninvolved 3rd parties when operating in the A2 and A3 categories. The A2 category also demands extra requirements in terms of pilot competence and product standards. Overflight in the A1 category is permitted and mitigated by the mass limit of 250g and additional product standards. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Airbus A320-214, G-EZTD 24 April 2019 at Lisbon Airport, Portugal Synopsis Under international protocols, this investigation was delegated to the AAIB by the Gabinete de Prevenção e Investigação de Acidentes com Aeronaves e de Acidentes Ferroviários (GPIAAF) in Portugal. During pre-flight preparations, both pilots completed a takeoff performance calculation for a takeoff from the runway intersection with Taxiway U5. During subsequent re-planning, the crew thought they had recalculated performance EFB calculated takeoff start point Start of takeoff roll Aircraft airborne Image of Lisbon Airport showing information from Taxiway S1 but had, the calculated and actual takeoff points in fact, used S4 (runway full length). The aircraft took off from Taxiway U5 with performance calculated for the full runway length. The takeoff distance available from U5 was 1,395 m less than that used for the performance calculation, and the aircraft passed the upwind end of the runway at 100 ft aal. The operator had another identical event 14 days later. Following this event, the operator acted to raise awareness of the issue with its crews and engaged with the aircraft manufacturer to review possible technical developments which might prevent a recurrence of these type of events. One Safety Recommendation is made to mitigate the risk of further confusion relating to takeoff positions. Safety Recommendation 2020-003 Justification Lisbon Airport uses takeoff ‘Positions’ to reference takeoff points rather than the more usual taxiway/runway intersections. This led to confusion with two crews when entering the takeoff position into their electronic flight bags as part of their takeoff performance calculations. This led to takeoff thrust being calculated for the full length of the runway while the actual takeoff was from an intersection from which there was 1,395 m less runway available. Therefore, the following Safety Recommendation was made: Date Safety Recommendation made: 9 January 2020 Safety Recommendation 2020-003 It is recommended that ANA Aeroportos de Portugal discontinue the use of takeoff ‘Positions’ at Lison Airport to minimise confusion in relation to takeoff points. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

35 © Crown copyright 2021 34 © Crown copyright 2021

LATEST RESPONSE Response received: 6 May 2020 ANA Aeroportos de Portugal is still waiting for approval from the Civil Aviation Authority, ANAC, to promote the AIP Amendment proposed in its letter to ANAC dated 9 March 20. It is thought that there are some delays due to the COVID-19 lockdown, but ANA Aeroportos de Portugal will contact ANAC for an update. AAIB Assessment: Adequate Action Status: Planned Action Ongoing Update Due 28 February 2021 Recommendation Status: Open Feedback rationale The AAIB requests an update by February 2021 on the progress made to discontinue the use of takeoff Positions at Lisbon Airport. EMB-145EP, G-SAJK 7 August 2019 at London Southend Airport Synopsis An Embraer 145 landing at London Southend Airport ran over a general aviation towbar which had been dropped on the runway. No damage was caused to the aircraft. The investigation found that the towbar had fallen from a Cessna 210 which departed Southend Airport 30 minutes before. The Cessna pilot had likely been distracted during his pre-flight checks by an earlier road traffic incident in which he was involved, and had inadvertently left the towbar attached. Towbar location London Southend Airport Chart showing approximate location the towbar was found One Safety Recommendation has been made to the CAA to improve the visibility of general aviation ground equipment. Safety Recommendation 2020-004 Justification Increasing ground equipment visibility. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-004 It is recommended that the Civil Aviation Authority communicate to the general aviation community the importance of increasing the visibility of ground equipment. Date Safety Recommendation made: 16 January 2020 LATEST RESPONSE Response received: 26 March 2020 The General Aviation Unit within the CAA have created a communications campaign on the risk and mitigation actions surrounding the Southend serious incident and made a clear call to action to pilots to consider painting their tow bars in bright colours. Firstly, the AAIB report was highlighted to the community via Skywise with a request for pilots to consider painting their tow bars in bright colours. This was followed by a call on social media for pilots to show and tell the CAA what colour they had painted their own tow AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

37 © Crown copyright 2021 36 © Crown copyright 2021

bars and to encourage those that haven’t, to follow suit. An article was written about the Southend incident and shared via Skywise, highlighting the factors that led to the event; lack of visibility of the tow bar and inadequate checks due to distraction. Again, a call to action was made to pilots to paint their tow bars in highly visible colours and for them to consider if they are fit to fly. On behalf of the CAA, GASCo have also contributed to the campaign with a slide on external checks as part of covering the incident within their March and April 2021 safety webinars. Once these presentations have commenced the CAA hope to have further reduced the risk of this incident re-occurring and will have fulfilled the above recommendation. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Piper PA-46-310P, N264DB 21 January 2019 at 22nm north-north-west of Guernsey Synopsis The accident occurred on 21 January 2019 at 2016 hrs. The wreckage was located on 3February2019 on the seabed approximately 22 nm north-north-west of Guernsey, within 100 m of the last secondary radar point recorded by the radar at Guernsey and at a depth of 68 m. There was one body present in the wreckage, which was recovered. The body was subsequently identified as that of View looking at remains of inner wing the passenger. The AAIB published Special Bulletin S1/2019 on 25 February 2019 to give preliminary information on the investigation and general information about how aircraft registered in the USA may be operated between the UK and France. This Special Bulletin contains medical information relevant to the accident to highlight the implications of that information to the General Aviation community. Safety Recommendation 2020-005 Justification The CAA maintains a database of the licence details and qualifications of all pilots who hold a UK-issued flying licence as required under EASA Part ARA.GEN.220. It became clear during this investigation, however, that the CAA database for the pilot of N264DB was incomplete and contained numerous errors. The pilot had scanned a copy of his licence onto his laptop, which the investigation was able to access, but without this copy erroneous conclusions might have been reached about the pilot’s qualifications and entitlements. This mismatch between database records and a pilot’s licence is not unique, and previous AAIB investigations have encountered similar discrepancies. Although the authoritative document is the licence, the competent authority, in this case the CAA, should maintain accurate information as required by EASA regulation. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-005 It is recommended that the Civil Aviation Authority ensure that the system in place to meet the requirements of EASA Part ARA.GEN.220 is effective in maintaining accurate and up-to-date records related to personnel licenses, certificates and ratings. Date Safety Recommendation made: 14 March 2020 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

39 © Crown copyright 2021 38 © Crown copyright 2021

LATEST RESPONSE Response received: 1 December 2020 Our review of the current licensing system delivered several options to allow us to meet the intent of this recommendation by maintaining accurate and up-to-date records related to personnel licences, certificates and ratings. In the current climate with resource heavily involved in both Covid-19 and BREXIT activities a two-stage solution was deemed appropriate. In the short to mid-term, the practice of attaching a scanned copy of the examiner report forms to the Pilots record in the Pilot Information Management System (PIMS) will continue, but where we receive Freedom of Information requests or requests for information from official bodies additional checks will be added to ensure all data contained in the scanned documentation is manually entered on the pilot record as well. The longer-term solution is for the ‘Aviation Licensing Discovery’ activity, which has been paused due to Covid-19 and BREXIT activities, to restart in February 2021. Where engagement with internal and external stakeholders will help clarify the end-to-end licensing requirements, enabling a solution to be created to meet all stakeholder needs and removing the additional burden of managing paper examiner report forms. The discovery phase will take 8 to 12 weeks with the solution passing through Alpha and Beta testing prior to going live approximately 18 months later. We will provide a further update when the discovery phase reports its findings and the solution has been shaped in June 2021. With additional updates at key stages of development to ensure we remain on track for implementation in December 2022. AAIB Assessment: Adequate Action Status: Planned Action Ongoing Update Due 30 June 2021 Recommendation Status: Open Feedback rationale The AAIB notes the update from 1 December 2020 and requests a further update on progress in June 2021. Safety Recommendation 2020-006 Justification CO poisoning is known in the UK as the ‘silent killer’ as the gas cannot be seen, smelt or tasted and its effects can lead to a reduction in performance, permanent injury or death. Even the minor effects of CO poisoning can have a fatal consequence when operating an aircraft. As the existing two barriers to prevent CO poisoning (design and inspections) are not always effective, there is a need for a third barrier to alert pilots to the presence of CO in the cabin in time to take effective action. Low cost warning devices are readily available, and their carriage is actively encouraged by the regulators. Regulators have also produced specifications for CO detectors with active warnings. Although the carriage of a CO detector is at the owner’s and pilot’s discretion, it is unlikely that passengers, pilots under training and individuals who use cost sharing websites understand the risk. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-006 It is recommended that the Federal Aviation Administration require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide. Date Safety Recommendation made: 2 March 2020 LATEST RESPONSE Response received: 19 July 2020 The FAA is evaluating this recommendation and reviewing information related to carbon monoxide detectors that have been addressed in past issues for small airplanes. We anticipate providing an updated response by December 31, 2020. The FAA would like to thank the UK AAIB for submitting FAA Safety Recommendation 20.028 and its continued interest in aviation safety. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 31 December 2020 Recommendation Status: Open AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

41 © Crown copyright 2021 40 © Crown copyright 2021

Safety Recommendation 2020-007 Justification As for Safety Recommendation 2020-006, the following Safety Recommendation was made: Safety Recommendation 2020-007 It is recommended that the European Union Aviation Safety Agency require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide. Date Safety Recommendation made: 13 March 2020 LATEST RESPONSE Response received: 11 December 2020 Prompted by the preliminary results of the Air Accidents Investigation Branch (AAIB) investigation, the European Union Aviation Safety Agency (EASA) has published the Safety Information Bulletin (SIB) No. 2020-01 ‘Carbon Monoxide (CO) Risk in Small Aeroplanes and Helicopters’ on 27 January 2020. The aim of the SIB is to inform Type Certificate and Supplemental Type Certificate holders, maintenance personnel, owners and operators of small aeroplanes (CS-LSA, CS-VLA and CS-23) and light helicopters (CS-27) with internal combustion engines or combustion heaters about the dangers of exposure to CO and to provide recommendations relating to the prevention, the detection and the reactions against CO exposure. The SIB also refers to several related publications from the AAIB, the UK Civil Aviation Authority (CAA) and EASA. In addition, the European Plan for Aviation Safety (EPAS 2020-2024) includes a regular update of the air operational rules (rulemaking task RMT.0392) to ensure efficiency and proportionality of the regulatory framework of Commission Regulation (EU) No 965/2012 laying down technical requirements and administrative procedures related to air operations. The associated Terms of Reference (ToR) were published on the EASA website on 07 October 2020, and, as stated on page 2 of the ToR, this safety recommendation will be considered within the framework of this RMT. See the following link to the ToR: https://www.easa.europa.eu/document-library/terms-of-reference-and-group­ compositions/tor-rmt0392 The EPAS 2020-2024 indicates a planning milestone of 2021 Q1 for the associated Notice of Proposed Amendment (NPA). It should be noted that, depending on the complexity of the topics, several NPAs may be published in steps towards that target date. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 31 March 2021 Recommendation Status: Open Feedback rationale The AAIB requests an update in 2021 Q1 on the progress of this Safety Recommendation within the RMT, corresponding to the EPAS 2020-2024 planning milestone. Safety Recommendation 2020-008 Justification As for Safety Recommendation 2020-006, the following Safety Recommendation was made: Safety Recommendation 2020-008 It is recommended that the Civil Aviation Authority require piston engine aircraft which may have a risk of carbon monoxide poisoning to have a CO detector with an active warning to alert pilots to the presence of elevated levels of carbon monoxide. Date Safety Recommendation made: 14 March 2020 LATEST RESPONSE Response received: 14 May 2020 The Civil Aviation Authority does not currently accept this Recommendation but will revisit this position at the conclusion of an operational trial of carbon monoxide detectors. The Authority is considering what barriers in addition to good design and maintenance practice will be both effective in further minimising the likelihood of critical CO contamination in the UK GA fleet, whilst acknowledging that any such additional measures should be both practical and proportionate. On 3 March 2020, Safety Notice CAA SN 2020/003 was published which highlights the potential benefits of carrying low cost available commercial/domestic active detectors, as well as conventionally installed, approved aviation units. This Safety Notice will be advertised further through communication to all pilots when the current restrictions on recreational flying due to COVID-19 are lifted, to reduce the risk of this announcement being overlooked. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

43 © Crown copyright 2021 42 © Crown copyright 2021

Importantly, the Safety Notice includes reference to a CAA-sponsored carriage trial of low-cost, widely available units which is intended to facilitate informed decisions in the future regarding recommending (or possibly mandating) specific categories of devices. This trial will establish if there are any negative safety implications (such as loose article hazard or distraction) associated with the carriage of carbon monoxide detectors. However, given the implications of COVID-19 on the 2020 flying season and stakeholder events, the timing for this trial is currently under review. CAA Status – Open AAIB Assessment: Not Adequate Action Status: Not Enough Infomation Recommendation Status: Open Feedback rationale The AAIB will await an update from the CAAon the results of its carriage trial of CO detectors including whether it intends to change its position on Recommendation 2020-008. Safety Recommendation 2020-009 Justification While the engine manufacturer produced guidance on how to examine its exhaust system, this guidance was not included or directly referenced in the aircraft manufacturer’s 100-hour / Annual maintenance schedule. There was a warning in the introduction of the aircraft maintenance manual about consulting vendor publications, but there was no specific requirement in the 100-hour / Annual maintenance schedule for the PA-46-310P to pressurise the exhaust system to check for leaks. CO poisoning is known in the UK as the ‘silent killer’ as the gas cannot be seen, smelt or tasted and its effects can lead to a reduction in performance, permanent injury or death. Even the minor effects of CO poisoning can have a fatal consequence when operating an aircraft. As the existing two barriers to prevent CO poisoning (design and inspections) are not always effective, there is a need for a third barrier to alert pilots to the presence of CO in the cabin in time to take effective action. Low cost warning devices are readily available, and their carriage is actively encouraged by the regulators. Regulators have also produced specifications for CO detectors with active warnings. Although the carriage of a CO detector is at the owner’s and pilot’s discretion, it is unlikely that passengers, pilots under training and individuals who use cost sharing websites understand the risk. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-009 It is recommended that Piper Aircraft Inc. ensure that the 100-hour / Annual maintenance schedule for the PA-46 variants references the engine manufacturer’s guidance, where available, on inspecting and testing the exhaust system. Date Safety Recommendation made: 2 March 2020 LATEST RESPONSE Response received: 30 June 2020 Piper Aircraft, Inc. acknowledges and agrees with Safety Recommendation 2020-009: “It is recommended that Piper Aircraft Inc. ensure that the 100-hour / Annual maintenance schedule for the PA-46 variants references the engine manufacturer’s guidance, where available, on inspecting and testing the exhaust system.” In furtherance of and to accomplish the above safety recommendation, Piper Aircraft commits to the following:

1. Work with Original Equipment Manufacturers to determine the best way to convey the

importance of thorough exhaust system inspections.

1. Review its maintenance and overhaul manuals to determine whether additional

elaboration would increase the chance of a qualified mechanic finding a potentially un-airworthy condition. Piper will endeavour to complete this review to have any amplifications implemented in the aircraft maintenance manual in as timely a manner practical given the business constraints such as COVID-19, etc. AAIB Assessment: Adequate Action Status: Planned Action Ongoing Update Due 31 December 2020 Recommendation Status: Open Feedback rationale Piper Aircraft’s proposed actions allow their response to the Safety Recommendation to be classified as Adequate, Open. An update is requested when the proposed actions have been completed or by the end of 2020, whichever is earlier. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

45 © Crown copyright 2021 44 © Crown copyright 2021

Bell 429, G-WLTS 2 January 2019 at Melksham Airbase, Wiltshire Synopsis The report considers two events which occurred while the pilot was conducting a Power Assurance Check. In one, an un-commanded yaw pedal movement caused a rapid rotation of the helicopter through two and a half complete rotations; in the other, a trim runaway was contained by the pilot. The trim runaway was found to be an unknown feature of the Automatic Flight Control System logic. Autopilot controls Following these events, safety action was Autopilot control panel taken by the helicopter manufacturer and Transport Canada to help crews respond to a yaw trim runaway and to address the underlying causal factor. Also, the flight recorder manufacturer improved the way it reported the results of CVR recording inspections. Two Safety Recommendations are made: one to Transport Canada in relation to conduct of the Power Assurance Check; and one to the European Union Aviation Safety Agency to ensure that the installation of new equipment on aircraft does not have a detrimental effect on existing equipment. Safety Recommendation 2020-010 Justification The Power Assurance Check (PAC is not mentioned in Rotorcraft Flight Manual (RFM) Normal Procedures for normal operations. The description of the PAC is in the Performance section of the manual, where it states that the PAC should be completed daily. However, it does not define the required configuration for the APs and AFCS and does not specify whether the PAC should be carried out pre- or post-flight. The operator conducted the PAC out of sequence with the RFM Category A Supplement, where the intent is to carry it out as part of the pre-flight procedures for every flight. The main body of the RFM, however, does not require the PAC to be conducted on the first start of a day, only that it should be achieved on a daily basis. The PAC is a normal procedure but is not reflected in the Normal Procedures section of the RFM. The inclusion of a defined procedure in Section 2 of the RFM, including starting parameters before the procedure such as AP status, would reduce ambiguity and allow flexibility in the timing of the procedure. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-010 It is recommended that Transport Canada require Bell Textron Canada Limited to amend Section 2 of the Bell 429 GlobalRanger Rotorcraft Flight Manual to include a Normal Procedure for the conduct of the daily Power Assurance Check. Date Safety Recommendation made: 23 April 2020 LATEST RESPONSE Response received: 6 January 2021 Regarding AAIB Safety Recommendation(s) No 2020-010 The RFM for the Bell 429 has been revised. The revision concerns the AAIB Safety Recommendation. AAIB Assessment: Partially Adequate Action Status: Planned Action Completed Recommendation Status: Closed Feedback rationale Although Transport Canada (TC) declined to accept the Safety Recommendation, the RFM revision goes some way to address its intent. Following publication of the RFM revision, therefore, this Safety Recommendation is closed. Safety Recommendation 2020-011 Justification If newly installed equipment interfaces (and shares information) with other existing equipment on an aircraft, tests must be conducted to ensure the installation has not had a detrimental effect on the existing equipment (these tests are in addition to any electromagnetic compatibility/interference testing). EASA specifically reminds Minor Change applicants of this in guidance contained in their ‘Minor Change Certificate Document’. The document is aimed at applicants making changes to GA aircraft, and especially those who are not Design Organisation Approval holders and who may have limited experience in the change process. There is, however, no equivalent guidance or reminder to organisations qualified and practised in carrying out changes or repairs to Commercial Air Transport aircraft, leaving the potential for these tests to be overlooked and the continued airworthiness of the aircraft to be compromised. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

47 © Crown copyright 2021 46 © Crown copyright 2021

Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-011 It is recommended that the European Union Aviation Safety Agency remind Minor Change applicants of the importance of verifying that new equipment does not have a detrimental effect on existing equipment with which it has a direct interface. Date Safety Recommendation made: 21 April 2020 LATEST RESPONSE Response received: 26 July 2020 The European Union Aviation Safety Agency (EASA) will undertake both corrective and preventive actions. First, a dedicated inspection will be performed on the relevant Design Organisation Approval (DOA) holder, with particular attention given to the aspects pertinent to this serious incident. Second, a safety-promotion article will be published in EASA’s Certification & Design Newsletter, to highlight that the installation of certain equipment needs an electromagnetic and audio interference test, as part of the compliance demonstration, before the approval change. An update will be sent to the Air Accidents Investigation Branch once these actions have been performed. AAIB Assessment: Adequate Action Status: Planned Action Ongoing Update Due 28 February 2021 Recommendation Status: Open Feedback rationale EASA is requested to provide an update when the actions are complete or by the end of February 2021, whichever is sooner. Standard Cirrus 75, G-DDGX 27 July 2019 at Gwernesney Airfield, Monmouthshire Synopsis The glider was undertaking an aerotow launch to the west at Gwernesney Airfield which was operated by the resident gliding club. During the early stages of the ground roll the horizontal tailplane (tailplane) detached from G-DDGX and fell to the ground. Club members assisting with the launch signalled for the takeoff to be aborted but the message did not reach the aerotow tug pilot; the accident pilot did not appear to Rear tailplane mechanism partially hear or see the stop signals either. engaged, front fitting disengaged The glider became airborne and climbed rapidly, before the tow cable released and the aircraft’s nose dropped. The glider descended steeply and struck the ground nose first. It came to rest inverted pointing in an easterly direction. First responders extricated the pilot from the aircraft before he was airlifted to hospital. He died five days later from complications related to injuries sustained in the accident. The investigation determined that the tailplane had not been correctly attached when the glider was rigged and this condition was not detected prior to the flight. Several possible mis-rigging scenarios were identified during the investigation, but the precise manner in which the tailplane had been mis-rigged could not be determined. Two Safety Recommendations are made relating to communication for glider launching and detecting incorrect alignment of tailplane locking features. In addition, the gliding club has undertaken several safety actions regarding launch signalling and detection of incorrect tailplane locking on other Standard Cirrus gliders. Safety Recommendation 2020-012 Justification The BGA’s guidance notes highlight the limitations of hand signals and ‘strongly’ recommend that radios are used during aerotows. While pilot-to-pilot communications would not have prevented this accident, intervention by a radio-equipped launch observer, as occurred in the Ventus glider incident, may have influenced the outcome. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

49 © Crown copyright 2021 48 © Crown copyright 2021

Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-012 It is recommended that the British Gliding Association specifies in its Operational Regulations the minimum requirements for an ‘adequate system of communication’ for glider launching. Date Safety Recommendation made: 20 May 2020 LATEST RESPONSE Response received: 2 October 2020 The BGA accepts that its Operational Regulations regarding signalling should be reviewed and updated. BGA Operational Regulations are high level BGA requirements which are periodically reviewed and can only be significantly modified following a general meeting. Supporting detail is generally published elsewhere to facilitate change. As a result of this accident, several BGA Operational Regulations have been redrafted and will be approved by the membership in their next general meeting. In addition, Managing Flying risk has been updated. The following text describes the proposed changes: PLANNED NEW OPERATIONAL REGULATION REPLACING OP REGS 34, 35 AND 36: Op Reg XX. Launch signalling. A reliable and unambiguous signalling system shall be used for all launches. PLANNED NEW OPERATIONAL REGULATION REPLACING OP REGS 37, 38 AND 39 Op Reg XX. Emergency signals – aerotow. The following emergency signals shall apply: Aerotow Release. The tug pilot orders the glider pilot to release immediately by rocking the tug laterally. Unable to Release on Aerotow. The glider pilot either communicates the problem to the tug pilot by radio, or alternatively signals ‘unable to release’ by flying out to the left side of the tug as far as is practicable and rocking the glider laterally. Excessive Drag on Aerotow. The tug pilot either communicates the problem to the glider pilot by radio, or alternatively signals that the glider is producing excessive drag (for example the glider airbrakes are open or the drogue parachute is deployed) by waggling the rudder. RECENTLY UPDATED MANAGING FLYING RISK TEXT Launch signalling Launch signalling from the ground does not remove the responsibility for the safe conduct of the launch from the pilot in command. Recognised methods of launch signalling The recognised methods of launch signalling include radio and other wireless transmission, lights, and hand/bat signals. Release of the tow rope or cable by the glider or tug pilot on the ground signals the pilots intent not to launch. Terminology To minimise the risk of a misunderstanding during launch signalling, which is a safety critical activity, ‘take-up slack’, ‘all out’ and ‘stop’ are the standard terms where verbal commands are used during launches. Use of signalling lights and signalling by hand - limitations Light or hand signalling can result in a delayed response, can be difficult to see (even when using bats for hand signalling) or interpret in poor visibility or against bright sunlight, and may not be seen once the launch progresses, for example when a tug pilot is focussed on starting the take-off. Where signalling lights are utilised, they should not be red or green in colour. Use of signalling lights and signalling by hand/bat - protocol Lights: a. Take up slack: light dashes of one second duration and three seconds interval. b. All out: light dots at one second interval. c. Stop: steady light. By hand: a. Take up slack: arm swung underarm. b. All out: arm swung from side to side above the head. c. Stop: arm held stationary vertically above the head. Signalling – aerotow Radio communication should be established between the launching operation and the towing aircraft. Where radio communication is not possible, another of the recognised methods of signalling to stop the launch should be available. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

51 © Crown copyright 2021 50 © Crown copyright 2021

Signalling – wire launches The method of communication used between the launch point and winch (or tow car) should result in reliable signalling for the duration of each launch and may be visual or audible. It is highly desirable for the signalling system to reliably allow an immediate audible and visual STOP command to be sent to the winch driver. Wireless signalling can provide near-instant communication to audible and visual indicators in the winch cab. Please note that a short period at the start of a personal management radios (PMR) radio transmission can be lost during channel identification. This shortcoming can be addressed by repeating the launch command, eg. “All out. All out” or “Stop. Stop”. AAIB Assessment: Adequate Action Status: Planned Action Ongoing Update Due 02 April 2021 Recommendation Status: Open Feedback rationale Whilst the AAIB accept that the BGA have met the intent of the recommendation, the AAIB request that following the next BGA General Meeting, the BGA confirm that the redrafted regulations have been approved. Safety Recommendation 2020-013 Justification Following this accident, for gliders with similar tailplane locking features to that of the Standard Cirrus 75, the gliding club introduced tell-tale markings to show the approximate required position of the locking lever and make it easier to detect incorrect alignment. The EASA recommended that such markings indicating the correct position for locking levers should be green in colour. Similar tailplane attachment mechanisms are known to be used on other types of glider. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-013 It is recommended that the European Union Aviation Safety Agency require a means to detect incorrect alignment of the tailplane locking lever on gliders with locking features similar to the Standard Cirrus 75. LATEST RESPONSE Response received: 26 April 2021 AAIB acknowledge that the EASA needs to consult with the manufacturer, and expect an update is March 2021. Following the European Union Aviation Safety Agency (EASA)’s investigation of this issue in cooperation with the sailplane Type Certificate Holder, Schempp-Hirth, an Airworthiness Directive (AD) AD-2020-0260 has been issued in order to address this issue linked to elevator attachment. Furthermore, Safety Information Bulletin (SIB) SIB-2019-07 addressing sailplane rigging is being revised to add more examples. A further update will follow. The AD specifies: 1) Within 90 days after the effective date of the AD, to modify the (powered) sailplane by installing an optical indicator in accordance with the instructions of the TN. 2) Concurrently with the modification of the (powered) sailplane amend the AFM of that (powered) sailplane in accordance with the instructions of the TN, inform all pilots and, thereafter, operate the (powered) sailplane accordingly. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Date Safety Recommendation made: 20 May 2020 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

53 © Crown copyright 2021 52 © Crown copyright 2021

Britten-Norman Islander BN-2A-27, VP-MNI 23 September 2019 at John A Osborne Airport, Montserrat Synopsis The aircraft was flying from Antigua to Montserrat, which was experiencing a heavy rain shower. After the shower had passed the aircraft made a normal approach in a light tailwind to Runway 10, which was still wet from the rain. The pilot made a positive touchdown and applied appropriate braking but was unable to stop the aircraft. The pilot steered the aircraft to the right but it skidded through 180° and departed the level surface of the airfield backwards, down a steep incline VP-MNI at the point of at the end of the runway, before coming to a touchdown on Runway 10 stop when the tail caught in the airport security fence. The pilot and passengers were able to exit the aircraft and the airport rescue and firefighting service responded promptly. No aircraft defects were found that would have contributed to the outcome. The touchdown groundspeed was 79 kt, which was higher than appropriate, either because the approach was flown at an airspeed greater than the normal 65 kt, or because of a significant change in windspeed and direction during the approach. This, combined with a wet runway and skidding, resulted in the aircraft requiring more distance to stop than was available on the runway. Three Safety Recommendations are made regarding aircraft operation, access for rescue and firefighting vehicles, and a means of arresting aircraft that overrun the runway. Safety Recommendation 2020-014 Justification Local wind variations specific to this aerodrome affect landings. Therefore, the following Safety Recommendation was made: Date Safety Recommendation made: 13 May 2020 Safety Recommendation 2020-014 It is recommended that Air Safety Support International Ltd ensure that pilots and operators intending to use John A Osborne Airport take account of local wind variations, and require operators to demonstrate how they will achieve this. LATEST RESPONSE Response received: 14 May 2020 The runway itself and the associated operating conditions at Montserrat have been the subject of an ongoing monitoring programme by ASSI over a significant period of time. In the past, NOTAMSs have also been issued to advise operators of the adverse runway conditions when wet. A runway refurbishment programme is well underway and this is planned for completion by the end of 2020. Furthermore, and enhanced Governor’s Instruction (MON 004) was issued on 24th February 2020 which required Commercial Air Transport operators to complete safety risk assessments, paying particular attention to the awareness of potential local wind variations including possible significant turbulence, windshear and downdraft during approach and climb out. The Safety Risk Assessment is aimed at mitigating any residual risk and providing flight crew with sufficient guidance to operate at the Aerodrome. We consider that the combination of runway refurbishment programme and the Governor’s Instruction, a copy of which is attached for reference, satisfies the requirements of Safety Recommendation 2020-014. AAIB Assessmen: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Safety Recommendation 2020-015 Justification Difficult terrain in the aerodrome surroundings prevents ready access to emergency services. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-015 It is recommended that the operator of John A Osborne Airport provide adequate access to the Difficult Environs at the east end of Runway 10 to ensure that emergency services can reach expeditiously the location of an aircraft which has overrun the end of the runway. Date Safety Recommendation made: 13 May 2020 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

55 © Crown copyright 2021 54 © Crown copyright 2021

LATEST RESPONSE Response received: 5 November 2020 The government received written permission to access the land to ensure that emergency services can reach expeditiously to the location of an aircraft which has overrun the end of the runway. Picture evidence of the four completed trails was sent via email on Tuesday 13th October 2020 for the possible closure of this safety recommendation. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Safety Recommendation 2020-016 Justification Terrain adjacent to the runway ends is hazardous to aircraft that overrun, and prevents ready access by emergency services. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-016 It is recommended that the operator of John A Osborne Airport install a means of arresting the progress of an aircraft that has overrun either end of the runway in order to minimise the risk injury to those onboard and to ensure that emergency services can reach them expeditiously. Date Safety Recommendation made: 13 May 2020 LATEST RESPONSE Response received: 19 February 2021 With the support of ASSI we have conducted further, extensive research into addressing the recommendation. Our intention was to ascertain the availability and practicalities of installing such a system however, the second review supported our original stance that a suitable, approved system is not available and the environment at the John A. Osborne Airport would not allow for effective installation and efficient operations due to the length of the runway and difficulties with the surrounding environs. John A. Osborne Airport is located on what is, effectively, a small plateau and as such, there is insufficient space to install any type of barrier / net or an ‘EMAS-type’ system which could provide any appreciable deceleration or restraint in the event of a runway excursion. For example, approved barriers come with large hydraulic systems and robust stanchions which are simply too large for the available area. The adoption of an ad-hoc, untried ‘fence’ is, in our opinion fraught with uncertainty and could actually introduce more risk than currently exists. Any locally installed catch-fencing would likely be supported by non-frangible posts, set into concrete with all the dangers of airframe and undercarriage damage and the potential risk of ruptured fuel tanks and uncontrolled fires that represents. That said, we fully support the view that the risks of injury to those on board an aircraft which has overrun either end of the runway must be minimised to As Low As Reasonably Practicable (ALARP) and therefore, it may be helpful to make you aware of the additional mitigations which we are putting in place. New markings on the edge of the runway are intended as aiming point markers or (more simply put) ‘throw-away’ indicators. Their purpose is self-explanatory in that pilots who have not positively touched down by those points must execute a missed approach. Thus far, the feedback from the pilots has been very supportive. Secondly, the runway re-surfacing project has been approved and the work to provide a new, grooved surface with a significantly improved friction level, will be completed during the first quarter of 2021 which should significantly reduce the risk of hydroplaning. The additional measures which both the Airport and ASSI have put in place (including a revised Governors instruction ensuring competent and current pilots who take account of wind variations) are robust, pragmatic, and proportionate for an operation of this size and with this level of traffic. They will provide significant safety enhancements in the longer term whilst we continue our search for an arrestor system and ensure that the runway remains complaint with accepted international standards. AAIB Assessment: Partially Adequate Action Status: Planned Action Completed Recommendation Status: Closed Feedback rationale The AAIB acknowledges the Airport operator’s response to the Safety Recommendation and the action it has taken to explore suitable mitigations. It has not installed a means of arresting the progress of an aircraft that has overrun the runway, and the associated hazards remain, but the response includes other action to reduce the likelihood of overruns and to improve access for emergency services. . AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

57 © Crown copyright 2021 56 © Crown copyright 2021

DJI M600 PRO, (UAS registration n/a) 13 December 2019 at Wallsend, Tyne and Wear Synopsis The UAS, a DJI M600 Pro, was being operated in an automated flight mode to survey a construction site when a GPS-compass error caused the aircraft to revert to a flight mode that required manual control. By the time that the pilot and observer realised that it was not responding to the return-to-home (RTH) function, visual line of sight was lost when the aircraft drifted with the wind beyond a line of trees. It subsequently collided with the roof of a house before falling M600 series aircraft into the property’s rear garden. No persons The accident aircraft was fitted with three GPS antenna were injured. The pilot, and the observer who was also a pilot, had operated UASs since 2018 and had the required permissions from the UK CAA. Both pilots had relied predominantly on the automated flight capability of their aircraft and had not, nor were required to have, practised for emergencies since completing their flying training in 2018. One Safety Recommendation is made to the UK CAA. Safety Recommendation 2020-017 Justification The CAA required that any person or organisation operating a UAS with a mass of no more than 20 kg for commercial work in the UK required permission, which was commonly referred to as Permissions for Commercial Operations (PfCO). A PfCO was renewed annually but the CAA did not require, nor provide guidance on, practising for emergencies or maintaining manual flying skills as part of the PfCO renewal. However, manual flying is a perishable skill that UAS operators may need to rely on in the event of an emergency. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-017 It is recommended that the Civil Aviation Authority require that operators issued with a Permissions for Commercial Operations (PfCO) include in their operations manuals the need to practise routinely the actions to take in the event of emergencies, and specify how pilots will remain competent at maintaining manual control of their aircraft in the event that automated flight modes are lost. LATEST RESPONSE Response received: 30 July 2020 The CAA accepts this Recommendation. CAA Safety Notice SN-2020/10 was issued on 22 June 2020, detailing recommendations to all Remote Pilots (RPs), National Qualified Entities and Recognised Assessment Entities. It strongly recommends that all Remote Pilots ensure they are confident in their abilities to recognise and react to likely emergencies and are familiar with the warnings generated by their UAS. It also strongly recommends that RPs regularly practice identifying and responding to emergencies, and maintain competence in reversionary flying modes. The Safety Notice also advises that Operations Manuals will need to assure the CAA that an operation is safe enough by describing complete and effective emergency procedures, and providing schedules for RP practice of emergencies. The same advice was given to NQEs/RAEs, to ensure that they reinforce the content of the Safety Notice to their customers. The UAS Sector Team Surveyors and Inspectors have been briefed to pay particular attention to emergency handling and pilot training currency sections of Operating Safety Cases. Additionally, checks will be made to incoming applications and renewals for Permissions for Commercial Operations for the same. RAE paperwork will be checked for the advice given to their customers when received. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Date Safety Recommendation made: 19 June 2020 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

59 © Crown copyright 2021 58 © Crown copyright 2021

Airbus A320-214, OE-LOA 1 March 2019 at London Stansted Airport Synopsis The aircraft was on a scheduled flight from London Stansted Airport to Vienna International Airport, Austria. Shortly after the takeoff roll was commenced it was rejected, due to a contained failure of the left engine, and the aircraft was brought to a stop on the runway. Just as the flight crew were about to taxi the aircraft off the runway, an evacuation was commanded by the Senior Flight Attendant. The investigation identified several factors that contributed to this decision. Ten passengers were treated RFFS infrared CCTV showing some for minor injuries that occurred during passengers leaving with baggage the evacuation and there was a risk of serious injury due to one of the engines running during the evacuation. The operator has taken several safety actions, principally based around the training of its flight attendants. Two Safety Recommendations regarding passenger evacuation have been made in this report. The left engine experienced a contained failure following the rupture and release of several blades from the first stage of the high-pressure compressor. The investigation found that the blades fractured as a result of high-cycle fatigue loading which initiated in the dovetail (part of the blade root), due to a once-per-revolution aerodynamic excitation. An inlet guide vane lever arm had been improperly assembled which led to aerodynamic excitation of the passing blades and the resulting forces exceeded the design loads of the blades. Safety Recommendation 2020-018 Justification The evidence from this accident, in combination with the collated evidence from previous cases shows that, even despite recent improvements, it remains the case that passenger briefing, safety cards and FA instructions are insufficient to stop passengers retrieving cabin baggage during an evacuation. This hazard will still exist in future emergencies unless additional measures are taken to either reduce the impact of that behaviour on the safety and speed of an evacuation or to prevent passengers evacuating with baggage. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-018 It is recommended that the European Union Aviation Safety Agency commission research to determine how to prevent passengers from obstructing aircraft evacuations by retrieving carry-on baggage. Date Safety Recommendation made: 20 August 2020 LATEST RESPONSE Response received: 15 November 2020 The safety issue “Emergency Evacuation” is included in the Safety Risk Portfolio (SRP) for large aeroplanes, as part of the European Union Aviation Safety Agency (EASA) Safety Risk Management (SRM) process (see the Annual Safety Review 2020, published on the EASAweb site at: https://www.easa.europa.eu/newsroom-and-events/news/easapublishes­ annual-safety-review-asr-2020). The SRP is used to trigger the assessment of safety issues, to target analysis activities over key risk areas and to prioritise safety actions. This includes consideration of the exposure to the hazard and its predicted evolution in the coming years, the expected safety benefit of the mitigation recently implemented or committed, or recommended, and reprioritisation of actions where appropriate. Passengers taking hand luggage preventing or slowing down the evacuation is one of the identified sub-set of associated risks. The Emergency Evacuation safety issue is currently under development of recommendations for actions in accordance with the Best Intervention Strategy (BIS) process, with potential inclusion of the mitigating actions in the European Plan for Aviation Safety (EPAS). The recommendation, for EASA to commission research to determine how to prevent passengers from obstructing aircraft evacuations by retrieving carry-on baggage, will be considered within this process. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 21 June 2021 Recommendation Status: Open Feedback rationale The European Union Aviation Safety Agency has confirmed that the recommendation to commission research into preventing passengers from obstructing aircraft evacuations by retrieving carry-on baggage will be considered for inclusion under the European Union Aviation Safety Agency Safety Risk Management process. The AAIB requests an update by 21 June 2021. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

61 © Crown copyright 2021 60 © Crown copyright 2021

Safety Recommendation 2020-019 Justification During an emergency evacuation, a proportion of passengers will attempt to leave the aircraft with their carry-on baggage slowing the evacuation process. The emergency evacuation demonstrations conducted to show compliance with CS-25 do not include a realistic simulation of this aspect of passenger behaviour which will slow down the evacuation and increase the risk of injury. Therefore, the following Safety Recommendation is made: Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-019 It is recommended that the European Union Aviation Safety Agency consider including a more realistic simulation of passenger behaviour in regard to carry-on baggage in the test criteria and procedures for the emergency demonstration in CS-25. Date Safety Recommendation made: 20 August 2020 LATEST RESPONSE Response received: 15 November 2020 The aeroplane evacuation demonstration requirement in Certification Specification (CS) CS 25.803(c) and the test criteria and procedures in Appendix J to CS-25 are not intended to investigate all possible emergency evacuation scenarios that may occur in service. In particular, the emergency demonstration does not intend to take into account the impact from unruly passengers. The emergency demonstration provides a standard method for assessing the evacuation capability of the aeroplane and to demonstrate the effectiveness of crew emergency procedures and training. The related test conditions and pass/fail criteria (e.g. the 90 seconds limit to the evacuation time) demonstrate that the aircraft design provides an acceptable level of performance in a standard evacuation scenario. The simulation of passenger behaviour with regards to carry-on baggage would not provide appreciable added value in the evaluation of the aircraft design, and would result in an increased risk of injury for certification test participants. The European Union Aviation Safety Agency (EASA) therefore does not deem it is appropriate to amend CS 25.803(c) and Appendix J to CS-25 as suggested by this safety recommendation. AAIB Assessment: Partially Adequate Action Status: Planned Action Completed Recommendation Status: Closed Feedback rationale The European Union Aviation Safety Agency have considered the Safety Recommendation and stated that the test criteria and procedure in Appendix J of CS-25 are not intended to investigate all possible emergency evacuation scenarios and provide a standard method for assessing the evacuation capability of the aeroplane and to demonstrate the effectiveness of crew emergency procedures and training. The European Union Aviation Safety Agency does not consider that the simulation of passenger evacuation with carry-on baggage would not improve the certification process and would result in an increased risk of injury for certification test participants. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

63 © Crown copyright 2021 62 © Crown copyright 2021

ERJ 190-200 LR, G-FBEJ 28 February 2019 at Exeter Airport, Devon Synopsis As the thrust levers were advanced for takeoff, on an early morning scheduled passenger flight, the flight crew detected an unusual odour and observed smoke entering the cockpit. They then moved the thrust levers to the idle position and applied the parking brake. The cabin crew subsequently reported that there were smoke and fumes in the cabin. Following an assessment of the situation, the commander initiated an emergency evacuation. During the evacuation, passengers who evacuated via the overwing exits reported being unsure of how to get down from the wing to the ground and several re-entered the cabin and exited via one of the escape slides. The smoke and fumes were subsequently attributed to an incorrectly performed engine compressor wash procedure, which was carried out by maintenance personnel the night before the occurrence flight. As a result of the findings of this investigation, the European Union Aviation Safety Agency (EASA) has undertaken two safety actions relating to the certification requirements for overwing emergency exits. The operator has also undertaken several safety actions relating to passenger safety briefings, processes for maintenance planning, engineer training, competency and welfare and monitoring of ground equipment. Four Safety Recommendations are made relating to the certification requirements for overwing exit Overwing exit escape route markings and the height requirement for overwing exits to be equipped with an assisted means of markings on E195 (view towards wing trailing edge) escape. Safety Recommendation 2020-020 Justification Despite the presence of a marked exit route on the wing with a non-slip surface, many passengers who exited via the overwing exits reported being uncertain where to go once out of the aircraft. Overwing exit route markings are not always readily identifiable and may be even less so in darkness. Poor weather conditions or the presence of smoke could also hinder identification of an exit route. It is apparent that the issue of ambiguous overwing escape route markings that resulted in previous AAIB Safety Recommendations 2002-42 and 2010-007 still exists. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-020 It is recommended that the European Union Aviation Safety Agency amends the certification requirements relating to the design, contrast and conspicuity of overwing exit escape route markings on commercial air transport aircraft, to ensure that the route to be taken from wing to ground is immediately apparent to evacuating passengers, in a range of emergency scenarios. Date Safety Recommendation made: 10 September 2020 LATEST RESPONSE Response received: 11 December 2020 The European Union Aviation Safety Agency (EASA) will assess this recommendation within the frame of the Best Intervention Strategy (BIS) for Emergency Evacuation. BIS are fundamental components of the Safety Risk Management (SRM) programming cycle used to assess the criticality of an issue, and identify the relevant actions for the European Plan for Aviation Safety (EPAS). A BIS report contains the assessment and rationale to determine relevant and proportionate actions. The first draft of this BIS is planned for Q1/2021. The BIS will identify the need for action(s) and, if necessary, will define the adequate relevant one(s) to be included in the EPAS after consultation with the Advisory Bodies. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 19 July 2021 Recommendation Status: Open Feedback rationale The EASA has confirmed that it will assess this recommendation within the frame of the Best Intervention Strategy (BIS) for Emergency Evacuation. The first draft of this BIS is planned for Q1 of 2021. The AAIB request an update by 19 July 2021. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

65 © Crown copyright 2021 64 © Crown copyright 2021

Safety Recommendation 2020-021 Justification As for Safety Recommendation 2020-020, the following Safety Recommendation was made: Safety Recommendation 2020-021 It is recommended that the Federal Aviation Administration amends the certification requirements relating to the design, contrast and conspicuity of overwing exit escape route markings on commercial air transport aircraft, to ensure that the route to be taken from wing to ground is immediately apparent to evacuating passengers, in a range of emergency scenarios. Date Safety Recommendation made: 10 September 2020 LATEST RESPONSE Response received: 22 February 2021 The FAA chartered the Emergency Evacuation Standards Aviation Rulemaking Committee (ARC) to review various regulatory standards, and in-service events, that apply to emergency evacuations. The ARC also evaluated several issues cited by the National Transportation Safety Board, the United States Congress, and from public inquiries to the FAA, 2 related to recent emergency evacuations. This review included the emergency evacuation of the Embraer ERJ 190-200 LR (E195) aircraft on February 28, 2019, that led the UK AAIB to issue these safety recommendations. Based on a review of the evacuation events through overwing exits, the ARC determined that some evacuees do not understand how or where to egress from a wing when no escape slide is provided. A review of the applicable regulations and guidance reveals potential for improvement, recognizing escape route markings alone do not always appear to provide enough instructions to guide evacuees to the location where they should exit from the wing. The FAA will review the ARC recommendations upon their completion and determine what actions may be warranted by the safety benefit to be gained in relation to the cost of implementing any recommendations. In conjunction with other aviation authorities, the FAA will review the requirements in Title 14, Code of Federal Regulations § 25.810, Emergency Egress Assist Means and Escape Routes for Marking the Escape Routes, from overwing exits. We will determine what actions may be effective to improve passenger recognition and enable safe transition from the wing to the ground. This action will include reassessing the 6 foot (1.8 meter) threshold for assist means cited in §§ 25.810 (a) and (d). We will provide a follow-on response updating you on our actions no later than January 31, 2022. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 31 January 2022 Recommendation Status: Open Feedback rationale The AAIB acknowledges the FAA’s response and requests an update on the outcome of the review of the Emergency Evacuation Standards Aviation Rulemaking Committee (ARC) recommendations by 31 January 2022. Safety Recommendation 2020-022 Justification Emergency exits that do not meet the 1.8 m maximum height criteria of FAR/CS 25.810 are not required to be equipped with an evacuation slide. This applies equally to overwing and non-overwing exits. Jumping from heights of up to 1.8 m can be challenging for many passengers and has the potential to cause injury. Similar findings were documented in a 2009 EASA study and prior to that, an NTSB safety study, which made a Safety Recommendation to the FAA on this subject. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-022 It is recommended that the European Union Aviation Safety Agency, re­ evaluate and reduce the 1.8 m height criteria in CS 25.810(a) and (d), for the provision of an assisted means of escape at emergency exits, to minimise passenger injuries and reduce egress time during emergency evacuations. Date Safety Recommendation made: 10 September 2020 LATEST RESPONSE Response received: 11 December 2020 The European Union Aviation Safety Agency (EASA) will assess this recommendation within the frame of the Best Intervention Strategy (BIS) for Emergency Evacuation. BIS are fundamental components of the Safety Risk Management (SRM) programming cycle used to assess the criticality of an issue, and identify the relevant actions for the European Plan for Aviation Safety (EPAS). A BIS report contains the assessment and rationale to determine relevant and proportionate actions. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

67 © Crown copyright 2021 66 © Crown copyright 2021

The first draft of this BIS is planned for Q1/2021. The BIS will identify the need for action(s) and, if necessary, will define the adequate relevant one(s) to be included in the EPAS after consultation with the Advisory Bodies. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 19 July 2021 Recommendation Status: Open Feedback rationale The EASA has confirmed that it will assess this recommendation within the frame of the Best Intervention Strategy (BIS) for Emergency Evacuation. The first draft of this BIS is planned for Q1 of 2021. The AAIB request an update by 19 July 2021 Safety Recommendation 2020-023 Justification As for Safety Recommendation 2020-022, the following Safety Recommendation was made: Safety Recommendation 2020-023 It is recommended that the Federal Aviation Administration, re-evaluate and reduce the 1.8 m height criteria in FAR 25.810(a) and (d), for the provision of an assisted means of escape at emergency exits, to minimise passenger injuries and reduce egress time during emergency evacuations. Date Safety Recommendation made: 10 September 2020 LATEST RESPONSE Response received: 22 February 2021 The FAA chartered the Emergency Evacuation Standards Aviation Rulemaking Committee (ARC) to review various regulatory standards, and in-service events, that apply to emergency evacuations. The ARC also evaluated several issues cited by the National Transportation Safety Board, the United States Congress, and from public inquiries to the FAA, 2 related to recent emergency evacuations. This review included the emergency evacuation of the Embraer ERJ 190-200 LR (E195) aircraft on February 28, 2019, that led the UK AAIB to issue these safety recommendations. Based on a review of the evacuation events through overwing exits, the ARC determined that some evacuees do not understand how or where to egress from a wing when no escape slide is provided. A review of the applicable regulations and guidance reveals potential for improvement, recognizing escape route markings alone do not always appear to provide enough instructions to guide evacuees to the location where they should exit from the wing. The FAA will review the ARC recommendations upon their completion and determine what actions may be warranted by the safety benefit to be gained in relation to the cost of implementing any recommendations. In conjunction with other aviation authorities, the FAA will review the requirements in Title 14, Code of Federal Regulations § 25.810, Emergency Egress Assist Means and Escape Routes for Marking the Escape Routes, from overwing exits. We will determine what actions may be effective to improve passenger recognition and enable safe transition from the wing to the ground. This action will include reassessing the 6 foot (1.8 meter) threshold for assist means cited in §§ 25.810 (a) and (d). We will provide a follow-on response updating you on our actions no later than January 31, 2022. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 14 September 2021 Recommendation Status: Open Feedback rationale The AAIB acknowledges the FAA’s response and requests an update on the outcome of the review of the Emergency Evacuation Standards Aviation Rulemaking Committee (ARC) recommendations by 31 January 2022. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

69 © Crown copyright 2021 68 © Crown copyright 2021

DHC-8-402, G-FLBE 14 November 2019 at In flight from Newquay Airport to London Heathrow Airport Synopsis Shortly after takeoff in a strong crosswind, the pilots noticed that both handwheels were offset to the right in order to maintain wings level flight. The aircraft diverted to Exeter Airport where it made an uneventful landing. The handwheel offset was the result of a break in a left aileron cable that ran along the wing rear spar. In the course of this investigation it was discovered that the right aileron on G-FLBE, and other aircraft in the operator’s fleet, would occasionally not respond to the movement of the handwheels. Non- reversible filters were also fitted to the operator’s aircraft that meant that it was not always possible to reconstruct the actual positions of the control wheel, column or rudder pedals recorded by the QRH Roll Control Malfunction checklist Flight Data Recorder. The aircraft manufacturer initiated safety actions to improve the maintenance of control cables and to determine the extent of the unresponsive ailerons across the fleet. Three Safety Recommendations are made in this report for the unresponsive aileron and filtering of the control position data. Safety Recommendation 2020-024 Justification The investigation discovered that aileron control surfaces on some DHC-8-400 aircraft were freezing in flight. This SR requires TC to investigate further. Therefore, the following Safety Recommendation was made: Date Safety Recommendation made: 8 October 2020 Safety Recommendation 2020-024 It is recommended that Transport Canada require De Havilland Canada to determine why the aileron control surfaces on the DHC-8-400 series of aircraft can become unresponsive to handwheel movements and ensure that the findings and any rectification action is promulgated to operators. LATEST RESPONSE Response received: 17 December 2020 The United Kingdom Air Accidents Investigation Branch (AAIB) has determined that the aileron became unresponsive due to aileron cable failure. Transport Canada (TC) National Aircraft Certification (NAC) accepts the recommendation and is working with the manufacturer to collect data necessary to determine what corrective action is appropriate to ensure the integrity of the aileron control system and the usability of Flight Data Recorder (FDR) for the ailerons. Any corrective action that is determined to be mandatory will be promulgated to operators as part of NAC’s Continuing Airworthiness program. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 31 August 2021 Recommendation Status: Open Feedback rationale The AAIB thanks the Transport Canada for their response and would request an update on the plans to address this Safety Recommendation by 31 August 2021. Safety Recommendation 2020-025 Justification Recording filtered parameters for primary flight controls makes it difficult to reproduce the flight from the stored data. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-025 It is recommended that the European Union Aviation Safety Agency require that the flight data recorder system fitted to DHC-8-400 series of aircraft registered in the United Kingdom record unfiltered data for the parameters representing primary flight control input positions and input forces, so that their original sensor signal values can be reliably established. Date Safety Recommendation made: 8 October 2020 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

71 © Crown copyright 2021 70 © Crown copyright 2021

LATEST RESPONSE Response received: 11 December 2020 The European Union Aviation Safety Agency is analysing this safety recommendation in cooperation with the Type Certificate Holder - De Havilland Aircraft of Canada. An update will be provided once a decision has been reached on the orientation to be given to this topic. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 24 May 2021 Recommendation Status: Open Feedback rationale The AAIB thanks the EASA for their response and would request an update on the plans to address this Safety Recommendation by 24 May 2021. Safety Recommendation 2020-026 Justification Filtering parameters by the Flight Data Recorder makes it difficult to reconstitute the flight. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-026 It is recommended that the International Civil Aviation Organisation provide guidance on the recording of filtered parameters by the flight data recorder system. The guidance should address as a minimum: 1) Definitions for filtered and unfiltered parameters. 2) Parameters on the FDR for which filtering is not permitted. 3) The need to be able to reconstruct the original sensor signal values from filtered data recorded during extremely dynamic conditions and that the information to achieve this is a permanent part of the aircraft specific FDR system documentation package. LATEST RESPONSE Response received: 8 January 2021 With respect to the above-mentioned safety recommendation, the proposal for providing guidance material on the recording of filtered and unfiltered parameters by the FDR system will be referred to the Flight Recorder Specific Working Group (FLIRECSWG) of the Flight Operations Panel (FLTOPSP) for further study. The next FLIRECSWG meeting is scheduled for February 2021. AAIB Assessment: Partially Adequate Action Status: Planned Action Ongoing Update Due 31 December 2021 Recommendation Status: Open Feedback rationale The AAIB thanks ICAO for their response and looks forward to the update from FLIRECSWG on the response to this Safety Recommendation. Date Safety Recommendation made: 8 October 2020 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

73 © Crown copyright 2021 72 © Crown copyright 2021

Cessna Citation CJ1, N680KH 13 April 2019 at Bournemouth Airport Synopsis The aircraft had been modified with a system intended to enhance its performance, which included supplementary control surfaces designed to deflect symmetrically and automatically to alleviate gust loads. Shortly after takeoff, an electrical failure in this system caused one of these control surfaces to deploy separately, causing an uncommanded roll. The resulting aircraft upset caused the pilot Date Safety Recommendation made: 26 November 2020 significant surprise and difficulty in Cessna 525 wing with ATLAS installed controlling the aircraft. The pilot was not aware of supplementary procedures associated with the modification. The procedures did not adequately characterise the significance of the system failure, nor address the failure in all anticipated flight conditions. Certification flight tests of the system did not reveal the severity of possible outcomes. The ‘Aircraft Safety and Certification Reform Act 2020’ underway in the USA will review existing assumptions on pilot recognition and response. Four Safety Recommendations are made, and safety action has been taken or is intended in the areas of training and the information to be provided, both for this system and for other supplementary systems capable of influencing the flight path of an aircraft. Safety Recommendation 2020-027 Justification The ATLAS inoperative in flight procedure currently specified is not relevant to all anticipated flight conditions. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-027 It is recommended that Tamarack Aerospace Group amend the ATLAS inoperative in flight procedure to ensure actions are specified that are relevant in all anticipated flight conditions. LATEST RESPONSE Response received: 3 March 2021 Tamarack worked closely with EASA to develop the procedure, which was then validated by other aviation authorities in other countries, including FAA, ANAC, TCCA, and others. During certification, EASA flight test personnel flew simulated emergency conditions, and contributed directly to the process of writing the procedures to address them. This process included a variety of critical and less-critical flight conditions, initially to confirm which flight conditions were critical to begin with, and later to confirm that the procedures were appropriate for all. Tamarack is concerned, as was EASA during certification, that the AIIFP must be written explicitly and simply, to give pilots the necessary safety information for responding to the most critical condition identified during the certification process. While it is true that certain steps in the procedure are more critical in some flight conditions than others, the AIIFP was developed to ensure that executing the full procedure in accordance with good pilot judgement and aviation best practices is safe for all anticipated flight conditions. As an example, step three of the AIIFP to disconnect the autopilot and the subsequent procedural step to maintain lateral control would apply to an ATLAS fault event which does not introduce an asymmetric deployment. Likewise, the immediate reduction in power would apply to flight conditions slower than maximum cruise. In both instances, however, the less critical flight conditions allow the AIIFP to be executed quickly, either by the lack of induced roll to address in non-deployment fault conditions or by the relative increase of aileron roll authority relative to the TACS at lower speeds. The overwhelmingly favourable flight characteristics inherent to the 525 series continues to support this conclusion, as do confirmed reports of ATLAS asymmetries and subsequently uneventful executions of the AIIFP in a variety of flight conditions. Flight conditions for abnormal and emergency procedures should be carefully considered. However, the primary contributing factor to the incident described in the AAIB report was pilot lack of familiarity with the AIIFP itself, rather than ambiguity of the procedure in a particular flight condition. Tamarack has received no other feedback from subject matter experts, pilots, or certification authorities to suggest that the procedures are not appropriate to all flight conditions as currently approved. Therefore, no major changes are planned for the ATLAS Inoperative In Flight Procedure. AAIB Assessment: Partially Adequate Action Status: Planned Action Completed Recommendation Status: Closed Feedback rationale The AAIB notes that the addressee has considered the Safety Recommendation and that it does not intend to amend the ATLAS inoperative in flight procedure. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

75 © Crown copyright 2021 74 © Crown copyright 2021

Safety Recommendation 2020-028 Justification The information currently provided may be inadequate for pilots to understand the significant and potentially escalating nature of TACS failures. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-028 It is recommended that Tamarack Aerospace Group expand the information within the ATLAS inoperative in flight procedure to provide a level of detail consistent with other AFM procedures and to enable pilots to understand the significant and potentially escalating nature of TACS failures. Date Safety Recommendation made: 26 November 2020 LATEST RESPONSE Response received: 3 March 2021 Tamarack agrees that emergency procedures must balance the need for short, concise steps that are easy to remember and follow with the need to provide pilots with sufficient information to understand the intent of the procedures and the conditions for which they are written. In the case of the AIIFP, Tamarack agrees that there is an opportunity to add potentially useful additional information. The AAIB report indicated that the pilot perceived that the control forces during the recovery were higher than expected, and that these control forces diminished as the airspeed was reduced. This is exactly in line with the original intent of the procedure, which specifies a reduction in airspeed to reduce control forces and minimize pilot exertion during execution of the AIIFP in the event of an asymmetric deployment. To that end, the approved procedures at the time of the incident included a warning preceding the memory items: “Large aileron input may be required if an ATLAS failure at high indicated airspeed includes a TACS runaway. Speed reduction is the first priority in these failure conditions.” Tamarack has amended the wording of the warning to more clearly indicate the intent behind prioritizing speed reduction as follows: “Large aileron input may be required if an ATLAS failure at high indicated airspeed includes a TACS runaway. Speed reduction to reduce control forces is the first priority in these failure conditions at high indicated airspeed.” This change makes the intent of the warning and procedure sequence more explicit without dramatically changing the look of the procedure with which current pilots are already familiar. Further, adding this note is in line with conventional pilot training, which stresses from the earliest stages that speed reduction reduces control forces. Tamarack hopes that better comprehension of the procedure and associated critical flight condition will assist other pilots familiarizing themselves with the AIIFP. Tamarack is also committed to addressing questions and feedback from current and prospective pilots and owners and will continue to review these procedures if feedback or questions indicate that there are further opportunities for improvement. AAIB Assessment: Adequate Action Status: Planned Action Completed Recommendation Status: Closed Safety Recommendation 2020-029 Justification The operation of supplementary systems fitted to an aircraft may require pilot behaviours different to those for which pilots are trained on the unmodified aircraft. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-029 It is recommended that the European Union Aviation Safety Agency determine the additional training it requires pilots to undertake in order to operate aircraft fitted with supplementary systems that influence flight path, where training on the original aircraft would not adequately prepare pilots for operating the modified aircraft in normal, abnormal or emergency situations. Date Safety Recommendation made: 26 November 2020 LATEST RESPONSE Response received: 2 March 2021 The following provisions of Commission Regulation (EU) No 965/2012 on air operations ensure that flight crew are suitably trained for the aircraft type operated (including those with supplementary systems installed), and cover the availability and use of relevant

checklists:

NCC.GEN.106(a)(4)(viii) which requires the flight crew to be properly rated and meet competency and recency requirements; AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

77 © Crown copyright 2021 76 © Crown copyright 2021

-

ORO.FC.100(c) on ratings, i.e. type-specific training;

ORO.FC.125 on differences and familiarisation training;

ORO.GEN.110(h) on checklists per aircraft type in normal, abnormal and emergency procedures in accordance with the latest relevant documentation from the design approval holder. Furthermore, in accordance with Article 11 of Regulation (EU) 2018/1139, operational suitability data (OSD) associated with a type design must be approved, when the applicant has demonstrated that the design of the product meets the applicable certification basis, and this approval must be include in the type certificate (TC) (or supplemental type certificate - STC). This provision is further detailed in Commission Regulation (EU) No 748/2012, which in its Article 7a requires aircraft that are newly certified or delivered as new to an EU operator after February 2014 to have OSD, including for flight crew (FC) approved as part of the TC, covering type specific training associated with the aircraft design. Further to that, point 21.A.93 of Annex I (Part-21) to Commission Regulation (EU) No 748/2012, as amended by Commission Regulation (EU) No 69/2014 and applicable from 19 December 2016, requires an applicant for a change to a TC or for an STC to consider the effects of the change to the OSD certification basis, and include the necessary changes to the OSD FC, when applicable, in their application for approval. Guidance to assess the impact of design changes on the OSD are provided in GM No 1 to 21.A.93(b)(1)(iii). Part of the resulting approval covers the pilot training elements associated with a specific design, when such elements are identified in the certification process and captured in the OSD FC associated with the TC or STC. In turn, approved training organisations (ATOs) and operators have an obligation to use the mandatory elements of the OSD FC in developing initial, differences and recurrent training programmes and courses (cf. points FCL.710(a) and FCL.725(a) of Annex I (Part-FCL) to Regulation (EU) 1178/2011; point ORO.FC.145(b) of Annex III (Part-ORO) to Commission Regulation (EU) No 965/2012.). The process embedded in the relevant regulations as described above provides a high level of confidence that, when training elements are necessary to support a specific aircraft design, these are properly identified, approved as part of the TC, change to a TC or STC, and delivered to pilot, reinforcing the principle of them receiving the appropriate training to ensure safe operation of the aircraft and its modifications AAIB Assessment: Not Adequate Action Status: Not enough information Recommendation Status: Open Feedback rationale The EASA response describes the regulatory framework that existed at the time of this serious incident. These regulations demonstrably were not adequate to address the circumstances of this occurrence. It is not clear what additional training the EASA has now determined it requires pilots to undertake (to operate aircraft fitted with supplementary systems that influence flight path) to improve on the situation that existed at the time of this serious incident and thus help to avoid those circumstances. Safety Recommendation 2020-030 Justification The operation of supplementary systems fitted to an aircraft may require pilot behaviours different to those for which pilots are trained on the unmodified aircraft. Therefore, the following Safety Recommendation was made: Safety Recommendation 2020-030 It is recommended that the Federal Aviation Administration determine the additional training it requires pilots to undertake in order to operate aircraft fitted with supplementary systems that influence flight path, where training on the original aircraft would not adequately prepare pilots for operating the modified aircraft in normal, abnormal or emergency situations. Date Safety Recommendation made: 26 November 2020 LATEST RESPONSE Response received: Awaiting Response Recommendation Status: Open AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

79 © Crown copyright 2021 78 © Crown copyright 2021

Safety Actions from investigations reported on in 2020 Early in an investigation the AAIB will engage with authorities and organisations which are directly involved and have the ability to act upon any identified safety issues. The intention is to prevent recurrence and to that end to encourage proactive action whilst the investigation is ongoing and not for those involved to wait for the issue of official Safety Recommendations. When safety action is taken, it means there is no need to raise a Safety Recommendation as the safety issue has been addressed, however if the issue remains then a Safety Recommendation will be raised. The published report details the safety issues and the safety action that has taken place, usually with a green highlight. In 2020, 159 safety actions directly resulted from AAIB investigations. These arose from one Formal Investigation, one Special Bulletin, 26 Field Investigations and 23 Correspondence Investigations. Index of Safety Actions (by aircraft weight) Commercial Air Transport (Fixed Wing) Boeing 747-436, G-BNLN Boeing 747-436, G-CIVU Boeing 787-9, G-CKWB Airbus 321-211, G-POWN Airbus 321, YL-LQC Airbus 321-231, G-EUXJ Airbus 321-231, G-WUKJ Boeing 737-86N, I-NEOT Boeing 737-8K5, G-TAWG Airbus 320-214, OE-LOA Airbus 320-214, EC-KLT Airbus 320-214, G-EZWE Airbus 320-214, G-EZTD Airbus 320-232, G-EUYB Airbus 319-111, G-EZNM Airbus 319-131, G-DBCD Boeing 737-4Q8, G-JMCR Antonov AN12, UR-CKL ERJ 190-200 (Embraer 195), G-FBEJ DHC-8-402, G-FLBE DHC-8-402, G-PRPK DHC-8-402, G-JECK Embraer 145, G-SAJK Embraer 145EP, G-SAJS Bombardier BD-700-1A10 Global 600, 9H-VJM Embraer E55P Phenom, D-COLT Page 104 134 130 83 147 133 135 and 145 100 120 92 109 111 97 113 99 124 102 131 90 116 129 143 108 143 118 121 AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview

81 © Crown copyright 2021 80 © Crown copyright 2021

Index of Safety Actions (by aircraft weight) Commercial Air Transport (Rotary Wing) Sikorsky S-61N Sea King, G-ATBJ Agusta-Westland AW189, G-OENC Bell 429 GlobalRanger, G-WLTS Agusta A109E, G-ETPI Eurocopter EC135T1, VP-CPS Eurocopter AS350B2, G-PDGF General Aviation (Fixed Wing) Hawker Hurricane 1, G-HRLI Piper PA46 Malibu, N264DB Cessna P210N, G-CDMH Cessna 172 Skyhawk, G-BXGV Fuji FA-200-180 Aero Subaru, G-HAMI Jodel D117A, G-AZII Reims Cessna F150M, G-CBSM Jabiru UL450, G-ROYC General Aviation (Gliders) Standard Cirrus 75, G-DDGX General Aviation (Rotary Wing) Guimbal Cabri G2, G-CILR Unmanned Air Systems DJI M600 Pro Aerialtronics Altura Zenith ATX8 Believer Yuneec H520 DJI Phantom 4 Parrot Anafi Thermal Parrot Anafi FORMAL INVESTIGATIONS Page Piper PA-46-310P Malibu, N264DB 85 21 January 2019 at 22 nm north-north-west of Guernsey 122 The investigation established that 87 the aircraft departed from Nantes 127 Airport, France, at 1906 hrs 137 89 on 21 January 2019 carrying a passenger on a commercial basis to Cardiff Airport in the 141 UK. At 2016 hrs, probably while 81 manoeuvring to avoid poor weather, 108 the aircraft was lost from radar and 126 struck the sea 22 nm north-north-west of Guernsey. Neither the pilot nor aircraft had the 126 required licences or permissions to operate commercially. 95 146 The investigation identified the following causal factors: 115 The pilot lost control of the aircraft during a manually-flown turn, which was probably initiated to remain in or regain Visual Meteorological Conditions 107 (VMC). The aircraft subsequently suffered an in-flight break-up while manoeuvring at 106 an airspeed significantly in excess of its design manoeuvring speed. The pilot was probably affected by carbon monoxide (CO) poisoning. 119 132 The investigation identified the following contributory factors: 140 139 A loss of control was made more likely because the flight was not conducted 138 in accordance with safety standards applicable to commercial operations. This 142 manifested itself in the flight being operated under Visual Flight Rules (VFR) 128 at night in poor weather conditions despite the pilot having no training in night flying and a lack of recent practice in instrument flying. In-service inspections of exhaust systems do not eliminate the risk of CO poisoning. There was no CO detector with an active warning in the aircraft which might have alerted the pilot to the presence of CO in time for him to take mitigating action. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

83 © Crown copyright 2021 82 © Crown copyright 2021

Following this accident, the following safety actions were taken: Safety action taken by the CAA ● The CAA developed a campaign to raise awareness of unlicensed charters, including publishing a Leaflet, Legal to Fly, to inform passengers about flying safely in light aircraft and business jets. Safety action taken by the engine manufacturer The engine manufacturer stated that it would: ● Work with Original Equipment Manufacturers to determine the best way to convey the importance of thorough exhaust system inspections. ● Review its maintenance and overhaul manuals to determine whether additional elaboration would increase the chance of a qualified mechanic finding a potentially unairworthy condition. It undertook to complete this review in order to have any amplifications implemented in the next FAA approved version of its Standard Practice Manual (M-0). SPECIAL BULLETIN Airbus A321-211, G-POWN 26 February 2020 at London Gatwick Airport At 0009 hrs on 26 February 2020, G-POWN took off from London Gatwick Airport for a flight to London Stansted Airport. At approximately 500 ft agl in the climb, there was a loud noise and flames were seen coming from the tailpipe of the No 1 engine as it surged. The crew made a MAYDAY call and turned right to return to the airport. Two minutes later, parameters relating to the No 2 engine began to fluctuate and the crew received an indication that the engine had stalled. The aircraft landed at 0020 hrs. Before the incident flight, there were start-up difficulties with the No 1 engine and momentary ‘Eng 2 Stall’ messages associated with the No 2 engine Brown material deposits in No 2 engine combustion on descent into Gatwick. An chamber swirl cups engineer was tasked with troubleshooting the engine stall messages. This intervention was a potential opportunity to detect the abnormal deposits on the high pressure and low pressure turbine blades. It is considered likely that a borescope inspection would have detected these deposits and, had it done so, it is unlikely that the aircraft would have been released to service. The engineer was not tasked with investigating any issues with the No 1 engine. The symptoms presented by each engine were different and no one considered there to be a possible common cause. Safety action by EASA and the FAA: ● The EASA issued Safety Information Bulletin SIB 2020-061 on 20 March 2020, to notify affected stakeholders of recent air safety-related events involving Kathon biocide and to remind aircraft owners and operators to ensure that the correct method and dosage is used for approved biocide treatment of aircraft fuel systems. The FAA issued Special Airworthiness Information Bulletin SAIB NE-20-042 on 25 March 2020 that contained similar regulatory guidance. Safety actions taken by the manufacturers of the biocide and engines: ● The manufacturer of Kathon discontinued the use of its product for aviation fuel applications on 10 March 2020. ● On 16 March 2020, CFM, the manufacturer of the G-POWN’s engines, issued Alert Service Bulletin 73-A0296 recommending that operators of CFM56-5B engines suspend the use of Kathon during aircraft fuel system biocide treatments. Similar instructions were issued for other variants of the CFM56 engine family, as well as all General Electric turbofan engines. Note: the discontinuation of Kathon for aviation applications, combined with the inability to use Biobor within the EU presently, leaves aircraft operators in the EU without an approved biocide treatment. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

85 © Crown copyright 2021 84 © Crown copyright 2021

Safety action by the AMO that performed the biocide treatment: ● The AMO that performed the biocide treatment on G-POWN has introduced a new role of ‘technical engineer’. The technical engineer will be an EASA Part-66 B1 licensed engineer, outside of the management chain within the organisation, who will be available to assist other licensed engineers and mechanics with technical queries, such as calculations. ● The AMO will also introduce usage limits in stores so that staff will not be able to withdraw chemicals in quantities that significantly exceed the maximum permitted. Safety action by the Operator and the AMO at London Gatwick Airport: ● In consultation with the manufacturer, the operator granted the Gatwick AMO access to the airnavX system. ● The Gatwick AMO issued a safety and compliance notice highlighting the importance of filtering maintenance data to the specific aircraft. FIELD INVESTGATIONS Sikorsky S-61N Sea King, G-ATBJ 1 February 2018 in Marchwood, Hampshire The helicopter was being transferred from Marchwood, Hampshire, to a maintenance base having been transported, by sea, from the Falkland Islands. As the helicopter took off for a hover check it pitched nose-down. The commander promptly lowered the collective and the helicopter struck the ground on its nose, before coming to rest on its landing gear. The investigation found that the spherical bearing within the swashplate had seized as a result of corrosion, compounded by inactivity during the voyage from the Falkland Islands. The checks prior to the flight did not identify the control restriction. Safety action has been taken by the helicopter manufacturer to highlight the correct preflight procedures to follow after prolonged aircraft inactivity, and by the operator to remind flight crews to conduct flight control servo system checks to the maximum extents of control movement. The cyclic control restriction was found to be as a result of seizure of the spherical bearing with the swashplate. The seizure was determined to be as a result of corrosion build-up within the bearing sockets. Prolonged inactivity during the transportation of the helicopter from the Falkland Islands allowed corrosion to develop sufficiently to cause the bearing to seize. Following the helicopter’s arrival in the UK, Safety Inspection checks detailed in the S-61N Equalized Inspection and Maintenance Program, SA 4047-13 were not carried out; it is likely that the seized swashplate would have been identified if they had. Unloaded Load applied Stills from video of another S-61 showing levels of guide tube deflection when cyclic was Despite the seizure, the investigation applied to a seized swashplate determined that full fore/aft travel of the cyclic control could still be achieved which indicates that this is not a reliable indication that the swashplate is free to move. During pre-flight checks by maintenance engineers and the flight crew, the flight control servo system checks were not completed to the full extremes of travel. With a seized swashplate, the rotor blades changed pitch due to flexing of the guide tube and the blade movement was incorrectly identified as a positive confirmation of control authority. There was no confirmation by external observation of the main rotor and swashplate operation during the limited range pre-flight checks. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

87 © Crown copyright 2021 86 © Crown copyright 2021

The perceived limitations of the hydraulic system when pressuring the hydraulics from the battery powered DC motor (motorising) compounded by the restrictions of using an external battery for starting were identified as contributory factors because control movements were not made to the full extremes of the cyclic envelop during the pre-flight checks. Safety actions taken by the operator: ● On 20 June 2018, the operator issued Flying Staff Instruction (FSI) 2018-35 to remind all crews to conduct the flight control servo system check, which includes a full and free check, as required in Appendix 2 of the Operations Manual Part B S61 Section 02. This FSI contained the detailed check as an Appendix. ● The operator has continued to monitor that its pilots perform the check, to the extremities, through routine simulator checks and, through its flight data monitoring programme, during operational flying. ● The operator has incorporated the assessment of the ball ring socket for freedom of movement in the Daily inspections. In addition, it has made the decision that, in the future, helicopters that have been transported by sea will be road transported from their port of entry to the maintenance facility. ● The operator has also undertaken to investigate increased environmental protection for its helicopters during sea voyages. ● On 22 July 2019, the helicopter manufacturer issued a Safety Advisory to highlight to operators the necessity of performing the prescribed Safety Inspections after long-term storage of the aircraft, specifically regarding the inspection/check of the swashplate. Bell 429 GlobalRanger, G-WLTS 2 January 2019 at Melksham Airbase, Wiltshire The report considers two events which occurred while the pilot was conducting a Power Assurance Check. In one, an un-commanded yaw pedal movement caused a rapid rotation of the helicopter through two and a half complete rotations; in the other, a trim runaway was contained by the pilot. The trim runaway was found to be an unknown feature of the Automatic Flight Control System logic. Following these events, safety action was taken by the helicopter manufacturer and Transport Canada to help crews respond to a yaw trim runaway and to address the underlying causal factor. Also, the flight recorder manufacturer improved the way it reported the results of CVR recording inspections. Two Safety Recommendations are made: one to Transport Canada in relation to conduct of the Power Assurance Check; and one to the European Union Aviation Safety Agency to ensure that the installation of new equipment on aircraft does not have a detrimental effect on existing equipment. The first event on 15 June 2018 occurred during a PAC when the pilot’s feet were clear of the pedals. The yaw trim actuator operated but the pedals could not move because of a restriction, and so the actuator wound up the artificial feel spring instead. When the restriction cleared, the pedals ‘snapped’ to full deflection as the spring unwound, increasing tail rotor thrust and causing the helicopter to rotate rapidly to the left through two and a half revolutions. The investigation did not determine the cause of the trim runaway or the pedal restriction. Asimilar yaw trim runaway on 2 January 2019 was controlled because the pilot’s feet were resting on the pedals. The Yaw out-of-detent indication manufacturer determined that the AFCS logic meant that it was possible for pilots to inadvertently induce a yaw trim runway and issued a revision to the RFM to reduce the risk of a recurrence. The manufacturer also undertook to address susceptibilities in the flight control system software identified during the investigation into these events. The PAC is a normal procedure which was not reflected in the Normal Procedures section of the RFM. A Safety Recommendation has been issued to update the RFM with an appropriate procedure. It was found that the CVR audio performance was poor after the installation of the TETRA communication system. A Safety Recommendation has been issued to EASA to remind Minor Change applicants of the importance of verifying that new equipment does not have a detrimental effect on existing equipment with which it has a direct interface. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

89 © Crown copyright 2021 88 © Crown copyright 2021

Safety Actions taken by the manufacturer: ● Published a revision to the Rotorcraft Flight Manual to reduce the risk of a yaw trim runaway. This included procedures for responding to a runaway so that control of the helicopter would be maintained. ● Amended the Integrated Avionics Manual to include a note that automatic pedal trim remains operational on the ground if force trim is engaged. ● Recorded a Problem Report against their flight control system software related to the susceptibilities identified. The susceptibilities would be addressed by future enhancements to the automatic pedal trim function of the software. Safety action taken by the flight recorder manufacturer: ● The flight recorder manufacturer included a plot of CVR signal waveforms as part of its CVR recording inspection report to enable anomalies such as clipping to be easily identified. Safety action taken by the regulator: ● Transport Canada issued Emergency Airworthiness Directive CF-2019-16, which mandated the incorporation of the Rotorcraft Flight Manual revision and required all flight crews to be advised of the changes. Eurocopter EC135T1, VP-CPS 26 February 2019 at Owen Roberts International Airport, Cayman Islands At the start of a ‘training and search’ detail in the Cayman Islands, the pilot lifted the helicopter to a height of approximately four feet and felt the cyclic control stick shake and exert a rearwards force. He immediately lowered the collective lever and the helicopter landed heavily, sustaining damage to the tail boom, landing gear and transmission deck. A subsequent inspection of the helicopter revealed the longitudinal axis of the main rotor actuator had failed. A tie bar within the actuator had suffered pitting corrosion, leading to intercrystalline corrosion and cracking which resulted in overload failure of the remaining material. It is possible that moisture penetrated into the actuator and allowed the tie bar to corrode. The environment conditions of the Cayman Islands may have contributed to the corrosion. Safety actions have been taken to ensure the continued airworthiness of the worldwide fleet and to review the design of the actuator to prevent moisture ingress. Following this accident, where longitudinal control of the helicopter was lost at low level, it was discovered that a tie bar within a main rotor actuator had fractured. This fracture was caused by the reduction in area of the tie bar through the propagation of a crack initiated by pitting corrosion. It is highly probable that the corrosion pits were caused by the accumulation of salt moisture in the end of the actuator, which had penetrated into the actuator through a gap. Material adjacent to tie bar fracture surface Safety action taken by the helicopter manufacturer: ● To issue instructions for continued airworthiness in the form of a mandated (by EASA EAD) Alert Service Bulletin to inform all operators to inspect the main rotor actuators. If evidence of tie bar corrosion is found, or the time in service exceeds a defined period, then the tie bar is to be replaced. To initiate a review of the actuator design with the equipment supplier to identify changes that could be made to prevent moisture ingress and a corrosion initiated failure of the tie bar. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

91 © Crown copyright 2021 90 © Crown copyright 2021

ERJ 190-200 LR (Embraer 195), G-FBEJ 28 February 2019 at Exeter Airport, Devon As the thrust levers were advanced for takeoff, on an early morning scheduled passenger flight, the flight crew detected an unusual odour and observed smoke entering the cockpit. They then moved the thrust levers to the idle position and applied the parking brake. The cabin crew subsequently reported that there were smoke and fumes in the cabin. Following an assessment of the situation, the commander initiated an emergency evacuation. During the evacuation, passengers who evacuated via the overwing exits reported being unsure of how to get down from the wing to the ground and several re-entered the cabin and exited via one of the escape slides. The smoke and fumes were subsequently attributed to an incorrectly performed engine compressor wash procedure, which was carried out by maintenance personnel the night before the occurrence flight. As a result of the findings of this investigation, the European Union Aviation Safety Agency (EASA) has undertaken two safety actions relating to the certification requirements for overwing emergency exits. The operator has also undertaken several safety actions relating to passenger safety briefings, processes for maintenance planning, engineer training, competency and welfare and monitoring of ground equipment. Four Safety Recommendations are made relating to the certification requirements for overwing exit markings and the height requirement for overwing exits to be equipped with an assisted means of escape. A lack of maintenance planning, training and control of resources led to an undesirable situation where a maintenance task was allocated to an engineer who was neither qualified nor competent to complete the task. Drop to the ground from wing trailing A key step in the engine drying procedure was edge with flaps in flap 1 setting only described as ‘recommended’ and the engineer did not complete all the elements of the task. This resulted in residual cleaning solution remaining within the ECS system, causing smoke and fumes within the cabin and cockpit and leading to an emergency evacuation. The engine drying procedure has since been amended to require this step to be carried out. Due to the order in which the emergency evacuation vital actions were performed, the flaps had insufficient time to travel to the selected position. This resulted in an increased drop to the ground for passengers evacuating via the overwing exits, with many reluctant to jump or slide off the wing. Additionally, despite the presence of a marked exit route on the wing with a non-slip surface, many passengers who exited via the overwing exits were uncertain where to go once out of the aircraft. Both of these factors increased the time taken for emergency evacuation to be completed. Safety actions taken by the operator: ● Updated the content of its briefing to passengers seated in the overwing exits of the E195. ● Enhanced the control and tracking of maintenance ground support equipment to enable calibration expiry dates to be managed more effectively. ● Introduced a maintenance planning procedure so that maintenance requirements are identified earlier in the working day to allow appropriate resources to be identified and allocated. ● Undertook a review of tasks performed within the hangar to identify specific training requirements with a view to developing training programmes. ● Launched an engineer’s competency passport scheme to enable maintenance planning departments to allocate specific maintenance tasks to maintenance stations where the correct resources are available. ● Introduced additional simulator training for engineers to undertake engine ground runs and committed to review the its recency period for conducting engine ground runs. ● Introduced a programme to verify that engineers have the correct procedures, records, equipment and tooling, personnel requirements, approvals, replacement parts, environment and information before commencing a maintenance task. ● Committed to undertake fatigue risk assessments for night shift maintenance personnel and initiated an engineer welfare programme. ● Updated its change management process to ensure appropriate management of the risks associated with the changing nature of maintenance being conducted in its base hangar. ● In June 2020, the engine manufacturer updated ESM subtask 72-00-00-410-004 to require, rather than recommend, that a high-power engine dry-out run is conducted after a compressor wash using detergent. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

93 © Crown copyright 2021 92 © Crown copyright 2021

Airbus A320-214, OE-LOA 1 March 2019 at London Stansted Airport The aircraft was on a scheduled flight from London Stansted Airport to Vienna International Airport, Austria. Shortly after the takeoff roll was commenced it was rejected, due to a contained failure of the left engine, and the aircraft was brought to a stop on the runway. Just as the flight crew were about to taxi the aircraft off the runway, an evacuation was commanded by the Senior Flight Attendant. The investigation identified several factors that contributed to this decision. Ten passengers were treated for minor injuries that occurred during the evacuation and there was a risk of serious injury due to one of the engines running during the evacuation. The operator has taken several safety actions, principally based around the training of its flight attendants. Two Safety Recommendations regarding passenger evacuation have been made in this report. The left engine experienced a contained failure following the rupture and release of several blades from the first stage of the high-pressure compressor. The investigation found that the blades fractured as a result of high-cycle fatigue loading which initiated in the dovetail (part of the blade root), due to a once-per-revolution aerodynamic excitation. An inlet guide vane lever arm had been improperly assembled which led to aerodynamic excitation of the passing blades and the resulting forces exceeded the design loads of the blades. The left engine experienced a contained engine failure. All the damage found in the engine was consistent with the release of one or more high-pressure compressor stage 1 blades as a result of high-cycle fatigue arising from aerodynamic excitation of the blades. A single inlet guide vane lever arm, which had been improperly assembled in the connecting link on the inlet guide vane actuation ring, was identified as the source of the stimulus that resulted in HPC module showing missing IGVs and damaged stage 1 blades the blade release. As a result of the engine failure and subsequent rejected takeoff, the Senior Flight Attendant commanded an emergency evacuation that was not necessary in the circumstances. This was probably the result of a combination of factors that heightened her emotional response to the event and affected her decision making. The factors included inexperience as a flight attendant, weaknesses in her training and communication difficulties during the event. As a result of the flight crew not being consulted before the evacuation was commenced, the right engine remained running for the first few minutes of the evacuation. This led to an increased risk of serious injury to those passengers that evacuated on the right side of the aircraft. Indeed, several passengers sustained minor injuries having been blown over by the exhaust. During the evacuation several passengers hindered the evacuation by taking their cabin baggage with them. While some were removed by the flight attendants at the supervised exits, this was not possible at the overwing exits. Two Safety Recommendations are made regarding passengers evacuating with carry-on baggage. Safety actions taken by the operator: As a result of this event the operator has stated that several safety actions have been or will be completed, including: Procedures ● The operator sent a Memo, on 19 May 2020, to all its Airbus pilots instructing them to ensure the PA recept is selected on an Audio Control Panel, thus ensuring the CVR records any PA announcements. ● The operator’s Flight Safety Manual will be amended to instruct the Flight Attendants to attempt to establish communications with the flight crew to check that an evacuation is safe and necessary before commanding it independently. Training The operator has taken the following safety actions in relation to its flight attendant training. The operator has: ● Augmented the team responsible for training with the addition of a deputy manager of flight attendant training. ● Introduced a maximum limit of 25 trainees in initial flight attendant training courses. After approval from the operator’s competent authority, it was subsequently increased to 30 in April 2020. ● Added practical training in the CEET to the senior flight attendant course as standard. Practical training has also been incorporated in their annual recurrent training. ● Improved variety of training scenarios in the CEET, including scenarios that result in a return to normal operations rather than an evacuation. ● Improved the syllabus of flight attendant training to include the performance effects of startle, an improved 30-second review15 technique and enhanced communication training. ● Produced a video training aid that will introduce flight attendants to the actions of the flight crew after a rejected takeoff. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

95 © Crown copyright 2021 94 © Crown copyright 2021

● Extended the aeroplane familiarisation phase during initial training with additional familiarisation flights. Crew composition ● The operator has introduced a requirement in the Operations Manual regarding flight attendant team composition. A minimum of two experienced flight attendants shall be part of the operating crew’s complement. This is 50% of the operating crew members, as their A320s are operated with four flight attendants. The engine manufacturer has stated the following safety actions have or will be taken Dissemination of information ● Provided a presentation on the subject of improper IGV/VSV lever arm assembly and its consequences at an All Operators Conference in June 2019 and published an article in its monthly publication ‘Fleet Highlites’ in January 2020. ● Highlight the issue of improper IGV/VSV lever arm assembly during calls with its field service representatives for onward dissemination to operators and overhaul facilities. Engine performance analysis ● Evaluate the use of a HPC performance analytic tool to determine if the effects of a mis-assembled lever arm could be identified from a detectable shift in engine performance. Jodel D117A, G-AZII 8 April 2019 at Full Sutton Airfield, York The aircraft landed heavily when the pilot’s prosthetic adapter disconnected from the control column late in the approach. The pilot was unhurt. The pilot has since modified the interface between the prosthetic adapter and the aircraft control column. The UK CAA has amended the medical certification pathway for pilots with musculoskeletal disability to include an engineering assessment of interface between Prosthetic adapter in use any prosthesis and the aircraft flying controls. The aircraft landed heavily when the prosthetic adapter detached from the control column late in the approach and the pilot was unable to regain control before touchdown. The pilot met the requirements for medical fitness to fly, but there was no engineering assessment by a suitably qualified individual of the interface between the prosthesis and the aircraft controls. The lack of a secondary device securing the prosthetic adapter to the control column meant that its security was solely reliant upon the interference fit. Safety action taken by the pilot: ● The pilot has added a velcro strip, which attaches to the prosthetic adapter and the control column, providing added security to the interface in the axial plane while retaining ease of disconnection in the event of an emergency. Safety actions taken by the regulator ● The Civil Aviation Authority of the United Kingdom has reviewed the medical certification pathway of pilots with a musculoskeletal disability and is amending the Medical Flight Test form to implement a 3-stage process involving: ○ An assessment by the prosthetist relating to the manufacture and fitting of the prosthetic with regard to use in general in an aircraft, eg flight control system forces and movements; ○ Assessment of the prosthetic interface with the aircraft control(s) in an aircraft engineering context by a suitably licenced engineer or inspector; ○ The conduct of a general medical flight test by a CFI staff examiner or single pilot aircraft senior examiner, either of whom must be designated by the Authority for this purpose, to: AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

97 © Crown copyright 2021 96 © Crown copyright 2021

a) assess the ability of the pilot to fly and control the aircraft through the use of the prosthetic and operate equipment in normal operations and emergencies including ingress/egress from the aircraft and b) consider how to ensure control of the aircraft is retained in the event of a failure. Airbus A320-214, G-EZTD 24 April 2019 at Lisbon Airport, Portugal During pre-flight preparations, both pilots completed a takeoff performance calculation for a takeoff from the runway intersection with Taxiway U5. During subsequent re-planning, the crew thought they had recalculated performance information from Taxiway S1 but had, in fact, used S4 (runway full length). The aircraft took off from Taxiway U5 with performance calculated for the full runway length. The takeoff distance available from U5 was 1,395 m less than that used for the performance calculation, and the aircraft passed the upwind end of the runway at 100 ft aal. The operator had another identical event 14 days later. Following this event, the operator acted to raise awareness of the issue with its crews and engaged with the aircraft manufacturer to review possible technical developments which might prevent a recurrence of these type of events. One Safety Recommendation is made to mitigate the risk of further confusion relating to takeoff positions. EFB dropdown menu showing the Both aircraft took off using incorrect performance all the intersections available data for the intersection used. In each case, a selection error was made in the EFB which led the crew to believe that they had calculated performance information for a departure from S1 when in fact they had selected the full length of the runway. In both cases, the procedural barrier of cross-checking the runway distance against the aerodrome ground chart failed to prevent to error. Human performance limitations mean it is difficult for pilots to recognise and react to reduced performance (acceleration) once the takeoff has begun, so robust adherence to procedures is a key defence against such incidents occurring. Safety action taken by the operator and airport authority: As a result of these serious incidents the following safety action was taken: ● The aircraft operator issued a notice to its flight crew clarifying the takeoff positions available on Runway 21 at Lisbon Airport. ● A NOTAM was issued highlighting ‘confusing runway holding point naming’ and reminding crews that ‘Position S’ referred to the full length of Runway 21. ● The aircraft operator issued a description of the events and their causes to its flight crew to raise awareness of the risks of using the wrong intersection and distance for takeoff. ● The aircraft operator engaged with the aircraft manufacturer to review future developments that could offer extra protections against events such as those covered in this report. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

99 © Crown copyright 2021 98 © Crown copyright 2021

● The airport authority undertook to rename taxiways so that Taxiway S intersected the runway at only one point; S4 (full length). Airbus A319-111, G-EZNM 11 May 2019 en route to Bristol Airport The lenses of both pilots’ oxygen masks misted when donned during a smoke and fumes event, obscuring their vison. The commander removed his mask so he could see the flight instruments. The aircraft diverted to Birmingham and landed without further event. The investigation found that the masks misted up due to a combination of the environment in which they were stowed and the condition of the lenses. The source of the smoke was probably an accumulation of dust in the transformer rectifier unit (TRU). The aircraft manufacturer has added a cleaning procedure for the TRU in the Aircraft Maintenance Manual. The operator has added a practical demonstration on the use of the mask and its Co-pilot’s mask showing fogging selectors during its recurrent training cycle. and marks on internal lens The aircraft had a smoke and fumes event that was probably a result of dust accumulation on its TRUs. The pilot’s oxygen masks misted up shortly after donning, due to a combination of the environment in which they were stowed, the crews’ breathing rate and the condition of the lenses. This left them unable to see the flight instruments, resulting in the commander removing his mask. Selecting the emergency pressure setting helps clear a mask and reduced exposure to any remaining smoke and fumes. Safety actions taken by the operator and aircraft manufacturer: ● The operator has added a practical demonstration on the use of the mask and its selectors during its recurrent training cycle. ● The aircraft manufacturer has taken safety actions in the following areas as a result of this incident: ● At the operator’s request, the aircraft manufacturer has moved the relevant warning to the beginning of the procedure and highlighted it as follows: ‘CAUTION: BE CAREFUL NOT TO PUT DETERGENT SOLUTION, DISINFECTANT OR WATER ON THE MASK VISOR. IF YOU DO, DAMAGE TO THE ANTI-MIST LAYER OF THE MASK VISOR CAN OCCUR.’ This was incorporated into the February 2020 revision of the AMM. ● The aircraft manufacturer introduced a cleaning procedure for the TRUs in the AMM. This was incorporated into the May 2019 revision of the AMM. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

101 © Crown copyright 2021 100 © Crown copyright 2021

Boeing 737-86N, I-NEOT 1 June 2019 at Bristol Airport During an unstable approach to Runway 27 at Bristol Airport, I-NEOT descended below the approach path before being instructed to go around by the tower controller. After initially climbing away as expected during the go-around, the aircraft then descended for over 30 seconds reaching a minimum radio altitude of 457 ft. Simultaneously, the crew and the controller realised the aircraft was not climbing away as they expected. The crew corrected the flight path and the aircraft was vectored for a further uneventful approach. The loss of altitude occurred because the target altitude on the Mode Control Panel was set to the minimum altitude for the approach having not been set to the missed approach altitude before the go-around. Neither crew member noticed initially that the aircraft was descending. The operator has taken two safety actions as a result of this incident. They have used this incident as part of their annual recurrent ground school to highlight the risks of rushed and unstable approaches. They are also continuing to work on their flight data monitoring programme so that similar approaches will be identified more rapidly and easily in future. Flying a shortened routing led to a rushed and unstable approach which did not follow the correct vertical flightpath. This was observed by ATC who instructed the aircraft to go around. The crew found themselves performing a go-around unexpectedly but did not know why they Altitudes in brackets are radio altitude TOGA pressed Lowest point on approach, 1,040 ft (633) Climb to 1,302 ft (824) Selected alt set to 3,000 ft Audio callouts “500”, “too low gear” Lowest point after descent 1,047 ft (457) ATC : “Climb maintain altitude 3,000 ft Bristol Airport Go around 1,071 ft (674) had been required to do so. The go-around was I-NEOT go-around conducted with a mis-set altitude on the MCP, and neither crew member noticed for a significant period that the aircraft was descending during the manoeuvre. Crews should always be ready to perform a go-around because there can be many reasons why they might have to, either internal or external to the aircraft, such as on instruction from ATC. Safety actions taken by the operator: ● The ground recurrent training syllabus was changed to include stable approach criteria, a review of applicable rules and Flight Data Monitoring (FDM) statistics as well as a presentation of this event. ● The operator improved its FDM system to identify events such as this unstable approach and planned to continue development of the system to make the process easier and more rapid. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

103 © Crown copyright 2021 102 © Crown copyright 2021

Boeing 737-4Q8, G-JMCR 4 June 2019 at Brussels National Airport, Belgium While descending to land at Brussels National Airport, a partial electrical failure occurred resulting in the loss of a number of systems including the electronic and analogue flight instruments on the left side of the cockpit. The pilot declared a MAYDAY and aware that a thunderstorm was approaching the airfield, assessed that the weather reported by Air Traffic Control (ATC) would allow him to continue and land at Brussels. However, visual references were lost at a late stage of the approach when the aircraft entered a heavy rain shower. A go-around was initiated during which the pilots estimated the amount of thrust required; the aircraft initially appeared to be slow to accelerate and establish a positive rate of climb. The aircraft entered an orbit and subsequently landed successfully from a second approach. The electrical failure was caused by a fault in the transfer relay which resulted in the loss of power to a number of electrical buses. The aircraft documentation was unclear as to which aircraft in the fleet were configured to enable the cockpit instruments to be powered from a standby electrical source; this may have affected the pilots understanding of the failure. Safety action has been taken by the operator to provide clarity in the aircraft documentation. The electrical failure was caused by a fault in the transfer relay which resulted in the loss of power to a number of electrical buses. Primary radar track and timing of some The second approach and landing radio callls were uneventful. Following the electrical failure, the commander’s assessment was that the aircraft was in a stable condition so continued the approach to land at Brussels National Airport. This gave the pilots relatively little time to assess the situation and a number of non-normal checklists actions were not carried out; consequently, the aircraft was incorrectly configured for the approach and landing. At a late stage of the approach the pilots lost visual references and executed a go-around. The aircraft then orbited while the thunderstorms cleared the airfield and the pilots used the time to further analyse the failure. Safety action taken by the operator ● Following this serious incident, the operator identified the aircraft in their fleet configured to enable the left EFIS displays to be powered by the AC Standby Bus. Aircraft documentation has been amended to inform pilots of the status of each aircraft. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

105 © Crown copyright 2021 104 © Crown copyright 2021

Boeing 747-436, G-BNLN 9 June 2019 in flight from London Heathrow Airport to Phoenix International Airport, USA On reaching top of climb the aircraft experienced unreliable airspeed indications resulting in overspeed warnings and activation of the stall warning system. In recovering, the crew carried out the unreliable airspeed procedure but also carried out the stall warning procedure, which was not required. The problem was believed to have been caused by a fault with the right Air Data Computer (ADC), although this could not be replicated. As a result of this incident, the aircraft manufacturer is providing additional information as part of their published unreliable airspeed procedure. The aircraft operator is also reviewing its maintenance procedures due to the accidental erasure of fault codes on the right ADC as part of the post-incident inspection process. No evidence was found to account for the initiation of the event sequence, but the sequence of events was consistent with a known fault mode of the model of ADC which was fitted to the aircraft, for which a modification was available but had not been incorporated. The malfunction of the right ADC was not identified despite extensive functional testing. It is likely that the false warnings had been generated erroneously as a result of an incorrect Mach number being supplied by the right ADC. This would then also have caused the stall warning system to operate erroneously at a safe airspeed. The identification of the recorded faults within the right ADC unit during the flight was not possible as the fault codes had been deleted after the unit had been received into the operator’s avionics workshop. The QRH procedure applicable at the time of the incident noted that ‘overspeed warnings and AIRSPEED LOW alerts may occur erroneously or simultaneously’. Stall warnings were not mentioned specifically as the aircraft manufacturer considered that crews would understand this was included. It is apparent this was not however the case with the crew involved who considered they must react to the stall warning when it occurred. The AIRSPEED LOW alert is a specific warning and the crew considered that as the stall warning was not mentioned separately in the procedural note, operation of the stick shaker should not be considered erroneous. This seemed to be confirmed to them when the stick shaker operation ceased when pitch was reduced, as they would expect after a genuine stall warning. This highlights the importance of clear, unambiguous information being readily available to crews at times of high workload when dealing with potentially critical incidents. It also reinforces the need for crews to understand the protection afforded by adopting the pitch and power settings provided as part of the procedure. Safety actions taken by the manufcaturer and operator ● The aircraft manufacturer is planning to update the QRH procedure to specifically include stall warnings as part of the note. This update is due to be included in the block revision to the B747-400 FCOM in April 2020. They are also considering similar action with other relevant types. ● Since the event, the operator has taken steps to identify the process shortcomings that permitted the loss of the fault codes to occur following arrival of the ADC in their avionics workshop. As a result, procedural changes are being introduced aimed at preventing future loss of troubleshooting and fault data that can assist incident investigations. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

107 © Crown copyright 2021 106 © Crown copyright 2021

Guimbal Cabri G2, G-CILR 22 July 2019 at Wycombe Air Park The helicopter had flown from Dunkeswell, Devon, to Wycombe Air Park, Buckinghamshire. As the pilot was shutting down the helicopter, he noticed smoke emanating from the left side of the rotor mast. He evacuated the helicopter and tried, unsuccessfully, to extinguish the fire with the helicopter’s on-board fire extinguisher. The helicopter was destroyed. Examination of the wreckage identified that the electrical cable connecting the alternator to the starter relay had short circuited against the aluminium baffle that surrounds the engine, probably as a result of the cable clips being incorrectly fitted. As a result of this investigation the helicopter manufacturer issued a service bulletin to instruct operators to inspect for correct installation of the cable clips and has also completed a redesign of the clips to ensure they cannot be fitted incorrectly. The helicopter caught fire shortly after landing because the heat generated from a short circuit in the engine compartment ignited a nearby carbon fibre structure. The short circuit was made between the cable that connected the output of the alternator to the starter relay and the aluminium air baffle through which the cable passed. It is likely that the cable clips that should have held the cable as it passed though the baffle were either not present or, most likely, incorrectly fitted. G-CILR prior to being moved The upward movement of the engine as a result of the clutch disengagement was sufficient to allow the unsecured cable to contact the unprepared edge of the aluminium baffle, allowing the insulation to be cut and initiate the short circuit. Safety actions taken by the helicopter manufacturer ● A Service Bulletin was issued by the helicopter manufacturer to inspect the clips to ensure correct installation. ● The helicopter manufacturer has completed a redesign of the clipping system to ensure the cable clipping cannot be installed incorrectly. The new design of clip is being fitted to new production helicopters and will be available via service bulletin from the manufacturer. Standard Cirrus 75, G-DDGX 27 July 2019 at Gwernesney Airfield, Monmouthshire The glider was undertaking an aerotow launch to the west at Gwernesney Airfield which was operated by the resident gliding club. During the early stages of the ground roll the horizontal tailplane (tailplane) detached from G-DDGX and fell to the ground. Club members assisting with the launch signalled for the takeoff to be aborted but the message did not reach the aerotow tug pilot; the accident pilot did not appear to hear or see the stop signals either. The glider became airborne and climbed rapidly, before the tow cable released and the aircraft’s nose dropped. The glider descended steeply and struck the ground nose first. It came to rest inverted pointing in an easterly direction. First responders extricated the pilot from the aircraft before he was airlifted to hospital. He died five days later from complications related to injuries sustained in the accident. The investigation determined that the tailplane had not been correctly attached when the glider was rigged and this condition was not detected prior to the flight. Several possible mis-rigging scenarios were identified during the investigation, but the Locking lever when tailplane attached precise manner in which the tailplane (left image) and when locked with safety pin inserted had been mis-rigged could not be (right image) determined. Two Safety Recommendations are made relating to communication for glider launching and detecting incorrect alignment of tailplane locking features. In addition, the gliding club has undertaken several safety actions regarding launch signalling and detection of incorrect tailplane locking on other Standard Cirrus gliders. The glider tailplane was mis-rigged in such a way that it passed positive control checks but was not secure for flight. It detached early in the ground roll and the aircraft became airborne with no pitch control available to pilot. Stop signals were relayed by the forward signaller but they were not effective in alerting either pilot to the failure. Effective signalling, radio or visual, might have prevented the glider taking off or reduced the severity of the outcome. Safety actions taken by the gliding club ● The forward signaller position was formalised in the club’s Operations Manual and their use of a white winch-signalling bat was made mandatory. ● Where appropriate, lever alignment marks were to be added to gliders at the club as additional confirmation that rigging had been completed correctly. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

109 © Crown copyright 2021 108 © Crown copyright 2021

EMB-145EP, G-SAJK & Cessna P210N Pressurized Centurion, G-CDMH 7 August 2019 at London Southend Airport An Embraer 145 landing at London Southend Airport ran over a general aviation towbar which had been dropped on the runway. No damage was caused to the aircraft. The investigation found that the towbar had fallen from a Cessna 210 which departed Southend Airport 30 minutes before. The Cessna pilot had likely been distracted during his pre-flight checks by an earlier road traffic incident in which he was involved, and had inadvertently left the towbar attached. One Safety Recommendation has been made to the CAA to improve the visibility of general aviation ground equipment. A general aviation towbar was inadvertently left attached to an aircraft because the pilot had been distracted by an earlier stressful event during his journey to the airport. The towbar dropped onto the runway during the departure and remained there for approximately 30 minutes, during which two other aircraft used the runway and a runway inspection was completed. A landing aircraft then ran over it. The towbar was inconspicuous because it did not have any reflective or other high visibility markings. Towbar recovered from the runway Safety action taken by the regulator ● The CAA has stated that if, during the general aviation-specific audits and inspections it conducts, it observes ground equipment that due to its colour is not sufficiently visible, it will bring this to the attention of the relevant operator. Airbus A320-216, EC-KLT 26 August 2019 on approach to Birmingham Airport The aircraft made two approaches above the correct descent profile, on each occasion leading to a missed approach. On the second missed approach the aircraft initially continued descending and was not configured appropriately, reaching an angle of attack at which the alpha floor1 energy protection mode activated to increase engine thrust. The aircraft made a subsequent approach, landing without further incident. During a subsequent event, involving the same operator and aircraft type (but different flight crew), the aircraft remained above the correct approach descent profile initially but descended below it later in the approach and performed a missed approach. The pilots in this case managed the vertical profile manually using a flight control mode with which they were not familiar. In both cases the pilots appeared not to have understood when to commence the final descent to follow the vertical profile of the approach. The operator’s safety department has recommended improvements in approach training and strategies to assist situational awareness. The operator and air traffic services provider are working to gain a better understanding of each other’s approach requirements. The aircraft did not maintain the correct vertical profile because the pilots were not sure when to commence the final descent. The depiction of the descent profile on charts provided by the operator may have contributed to this uncertainty. In the first event it is likely that the increased workload of an unplanned missed approach contributed to the pilots not configuring the aircraft correctly for the go-around, resulting in the aircraft entering the alpha floor protection mode. In the second event, Extract from operator’s chart for RNAV having also commenced the final approach to Runway 33 at Birmingham descent late, the pilots did not maintain the correct profile thereafter because the type of approach required them to manage the vertical flight path manually, and they were not familiar with the flight mode they were using. Safety actions taken by the operator and air traffic control services provider ● The inclusion of high energy approaches and go-arounds in future company simulator training; ● A review of approach intercept procedures to ensure they make adequate provision for approaches without a glideslope; ● The introduction of procedures to assist pilots in estimating distance to run during an approach; and AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

111 © Crown copyright 2021 110 © Crown copyright 2021

● Procedures to deal more effectively with a loss of situational awareness. ● The operator and air traffic services provider are working to gain a better understanding of each other’s approach requirements. Airbus A320-214, G-EZWE 16 September 2019 at Lisbon Airport, Portugal Under international protocols, this investigation was delegated to the AAIB by the Gabinete de Prevenção e Investigação de Acidentes com Aeronaves e de Acidentes Ferroviários (GPIAAF) in Portugal. During pre-flight preparations, both pilots completed a takeoff performance calculation for a takeoff from Runway 21 at Lisbon Airport. In calculating the performance, the crew believed they had selected the shortest runway length available (from the intersection with Taxiway S1) but had, in fact, used the runway full length (from Taxiway S4). The aircraft was cleared for takeoff from another intersection (Taxiway U5) and used performance calculated for the full runway length. The takeoff distance available from U5, although longer than from S1, was 1,395 m less than that used for the performance calculation, and the aircraft became airborne with only 110 m of the runway remaining. As a result of this and previous, similar incidents, the airport operator renamed part of Taxiway S to have only one intersection on Runway 21 with the letter S. The aircraft operator moved onto a newer software version for performance calculations in December 2019 which gives a pictorial representation of the runway. They also worked with the data supplier to change the menu for intersection selections for Lisbon Airport to eliminate any confusion over which position refers to the full runway length. The aircraft took off using incorrect performance data for the intersection used. A selection error was made in the EFB calculation which led the crew to believe that they had calculated performance information for a departure from S1 when in fact they had selected the full length of the runway. In this case, as in the two previous identical incidents, the final barrier CCTV screenshot showing G-EZWE of checking the runway distance in just after reaching V1 the performance calculation against the aerodrome ground chart failed to prevent the error. Human performance limitations mean it is difficult for pilots to recognise and react to the performance error once the takeoff has begun, so robust adherence to procedures is a key defence against such incidents occurring. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

113 © Crown copyright 2021 112 © Crown copyright 2021

Safety actions taken by the airport authority, operator and UK regulator ● Following the previous incidents, the AAIB reported that the Lisbon Airport operator intended to rename taxiways to remove the risk of confusion between the two points where Taxiway S crossed Runway 21. The taxiways would be renamed so that Taxiway S intersected the runway at only one point; S4 (full length). This safety action was completed, albeit after the incident to G-EZWE, and is reported here. ● The operator has moved onto Flysmart L6 performance software which now shows the crew a pictorial image of the takeoff point used for the calculation. The takeoff point selection menu was also amended to eliminated Position S making it clear to the crews that this was full length for Runway 21. ● The UK CAA decided to revise the EFB compliance checklist, SRG form 1849, to ensure that the need for a periodic battery replacement programme is emphasised. Airbus A320-232, G-EUYB 23 September 2019 on approach London Heathrow Airport During approach to London Heathrow Airport the flight crew detected strong acrid fumes on the flight deck. They both donned oxygen masks and continued to land at Heathrow. After shutting down on a taxiway and removing their masks, the co-pilot became incapacitated and the commander felt unwell; both pilots were taken to hospital but released later that day. Investigations carried out by the AAIB and the operator did not identify the source of the fumes. Numerous other similar fume events have been reported to the AAIB and the CAA. This report reviews five other similar events which occurred with the same operator on the same aircraft type. It was not possible to identify the cause of these events, but, several common features have been identified. The operator and aircraft manufacturer have taken action to try to reduce the number of events, which includes; the development of detailed maintenance procedures to identify the source of fumes, changes to flight crew operating procedures and the evaluation of modifications to enhance cabin air recirculation filtration systems. APU schematic While it has not been possible to positively identify the compound that was responsible for the fumes and odours experienced in G-EUYB, or any of the other recent events, a number of common factors have been identified. The majority of events occurred after the aircraft had been parked or operated in precipitation. The fumes become apparent during the later stages of the descent, sometimes preceded by a minor event during the climb phase. The generation of fumes appears to be transient; they dissipate rapidly and leave no detectable trace. No link between changes to engine power or changes in other system settings and the generation of fumes was identified. In some cases, the presence of fumes has resulted in physiological reactions which have interfered with a flight crew member’s ability to carry out their normal duties. However, by following the smoke and fume checklist, and donning oxygen masks the flight crew were able to ensure the continued safety of the aircraft. Safety actions Although a specific cause has not been found in these and other recent events, the operator and aircraft manufacturer have taken several actions based on current knowledge to alleviate the odour and fume events. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

115 © Crown copyright 2021 114 © Crown copyright 2021

Safety actions undertaken by the manufacturer: ● Project FRESH has been initiated by the manufacturer to investigate and regularly inform operators of fume event arisings. ● Published an In-Service Information paper (Ref ISI 21.00.001.139) setting out all the known aspects of fumes and smoke events and includes the details of a filter and sensor product research and development programme. Safety actions undertaken by the operator: ● Developed the post-smoke and fume events maintenance procedure. ● Taken action to ensure that the correct APU start up bleed air selection and shut down procedures are used. ● Will consider the installation of the manufacturer’s ECS air filtration modification when it becomes available ● Carried out a fleet-wide check to confirm that oxygen masks were correctly stowed and issued a Quality Alert Bulletin to all engineering staff to reminded them of the importance of stowing the masks in accordance with the AMM. Jabiru UL-450, G-ROYC 27 October 2019 at Gransden Lodge Airfield, Sandy, Cambridgeshire G-ROYC was being flown with two pilots onboard. The pilot in the left seat had 28 hours on type and the pilot in the right seat had not flown the type before. The approach to the runway was flown by the pilot in the right seat. During the approach he decided the aircraft was not stable so elected to go around. During the go-around the aircraft descended and drifted to the left. The aircraft collided with a stationary glider which was waiting to launch. One of the occupants of G-ROYC sustained a minor injury; Damage to the tail and left wing of an the glider pilot was uninjured. SZD-51 glider caused by G-ROYC The investigation found that it is likely that the aircraft did not climb due to a combination of the inadvertent retraction of the flaps, a brief delay in applying full power and the aircraft being slightly above the maximum takeoff weight. The LAA provides a Pilot Coaching Scheme to enable pilots to safely learn new aircraft types and develop their flying skills with experienced instructors. The BGA and the gliding club have taken safety action to ensure the risk of ground collisions continue to be minimised. Whilst attempting to go around from low height G-ROYC descended and drifted left and collided with a stationary glider which was waiting to launch. It is likely that the aircraft did not climb due to the combination of the inadvertent retraction of the flaps, a brief delay in the application of full power and the aircraft being slightly above the maximum takeoff weight. The BGA and the gliding club have taken safety action to ensure the risk of ground collisions is minimised. Safety actions ● The BGA has undertaken to remind all gliding clubs about the risk of landing aircraft colliding with aircraft on the ground and to provide advice on how to minimise the risk. ● Cambridge Gliding Club will review its procedures and consider advice from the BGA to ensure that the risk of ground collision remains as low as is reasonably practical. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

117 © Crown copyright 2021 116 © Crown copyright 2021

DHC-8-402, G-FLBE 14 November 2019 in-flight from Newquay Airport to London Heathrow Airport Shortly after takeoff in a strong crosswind, the pilots noticed that both handwheels were offset to the right in order to maintain wings level flight. The aircraft diverted to Exeter Airport where it made an uneventful landing. The handwheel offset was the result of a break in a left aileron cable that ran along the wing rear spar. In the course of this investigation it was discovered that the right aileron on G-FLBE, and other aircraft in the operator’s fleet, would occasionally not respond to the movement of the handwheels. Non-reversible filters were also fitted to the operator’s aircraft that meant that it was not always possible to reconstruct the actual positions of the control wheel, column or rudder pedals recorded by the Flight Data Recorder. The aircraft manufacturer initiated safety actions to improve the maintenance of control cables and to determine the extent of the unresponsive ailerons across the fleet. Three Safety Recommendations are made in this report for the unresponsive aileron and filtering of the control position data. The most probable reason for the aileron cable breaking was that its strength had reduced as a result of wear leading to the failure of individual wires within the cable. The cable failed where it Wire Strand passed over a pulley on Construction of the control cable the rear wing spar where dirt accumulates which can penetrate into the strands and form an abrasive compound. This can accelerate the normal rate of cable wear. Post-modification cables are available which have a sleeve fitted over the susceptible section to prevent the ingress of dirt. The investigation established that the inspection procedure in the AMM would not have detected the damage to individual wires that run inside the cable. The unresponsive right aileron on G-FLBE was not causal to this serious incident. As the operator ceased trading before they could establish the cause on G-FLBE, and other aircraft in their fleet, further investigation is required to determine if there is a wider safety issue. Filters applied to some of the flight control parameters recorded on the FDR can affect the reconstruction of the rapid movement of the controls. Such filters are not permitted to be installed on the DHC-8-400 aircraft registered in the USA, but there is no similar requirement on aircraft registered in Europe or the UK. While this did not affect this investigation, this could affect other safety investigations. Safety actions taken by the manufacturer ● The aircraft manufacturer reviewed the periodic cable inspection procedure and advised that they would amend the procedure to increase the likelihood of identifying cable damage. They also stated that they would issue an All Operators Message to highlight this serious incident and the changes to the inspection procedure. ● The aircraft manufacturer advised that it would provide literature to operators to monitor for unresponsive ailerons using their Flight Data Monitoring Programmes. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

119 © Crown copyright 2021 118 © Crown copyright 2021

Bombardier BD-700-1A10 Global 6000, 9H-VJM 11 December 2019 at Liverpool Airport The aircraft suffered a nosewheel steering failure shortly after touchdown. During the subsequent landing roll, directional control was lost due to the inadvertent application of right braking and the aircraft departed the runway surface onto the grass. As a result of a fault, the NWS went into free caster shortly after touchdown. During the subsequent 9H-VJM on the soft groundc landing roll, directional control of the aircraft was lost, and the aircraft departed the right side of the runway and onto the grass. The commander, in applying left rudder to try to keep the aircraft straight, had inadvertently applied some right braking. As the aircraft slowed, full left rudder was unable to counteract the effect of this braking. Safety actions Following the event, the operator took the following safety actions to address the issues of inadvertent brake application and use of differential brake for steering at high speed: ● It issued a Safety Alert to all its pilots which included the following: ‘we would like to recommend all pilots, at the first occasion and when on the ground at parking on board of the airplane, to apply FULL rudder deflection. At full rudder deflection one should check if both brakes can be pushed. In addition, notice that the opposite rudder pedal moves physically closer to your body, if you feel the pressure of the closer pedal increasing and if you apply any unwanted brake pressure due to the position of your shoe on the pedal, the pedals/ seating position should be adjusted. This should be checked in the normal seating position with the respective shoe position adopted for takeoff and landing.’ ● In its Training Syllabus for 2020 the operator has included a failure of the NWS system after landing as a preferred malfunction DJI M600 Pro (UAS, registration N/A) 13 December 2019 at Wallsend, Tyne and Wear The UAS, a DJI M600 Pro, was being operated in an automated flight mode to survey a construction site when a GPS-compass error caused the aircraft to revert to a flight mode that required manual control. By the time that the pilot and observer realised that it was not responding to the return-to-home (RTH) function, visual line of sight was lost when the aircraft drifted with the wind beyond a line of trees. It subsequently collided with the roof of a house before falling into the property’s rear garden. No persons were injured. The pilot, and the observer who was also a pilot, had operated UASs since 2018 and had the required permissions from the UK CAA. Both pilots had relied predominantly on the automated flight capability of their aircraft and had not, nor were required to have, practised for emergencies since completing their flying training in 2018. One Safety Recommendation is made to the UK CAA. The pilot was required to take manual control of the aircraft following the loss of its automated flight modes due to signal interference. However, no manual control inputs were made, and the aircraft subsequently drifted with the wind until it The aircraft after falling collided with a house roof and fell to the ground. into the garden No persons were injured. Operators holding a PfCO issued by the CAA are not currently required to practise routinely for emergencies or demonstrate the ability to fly their aircraft in a degraded flight mode. These skills are perishable but, as this accident shows, they may be needed at any time; it is important that they are maintained to prevent a risk of injury to people or damage to property. To address this, one Safety Recommendation has been made to the CAA. Safety action taken by the operator ● The operator’s pilots have undergone refresher training on responding to emergency situations and operating their multi-rotor UASs in the ATTI flight mode. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

121 © Crown copyright 2021 120 © Crown copyright 2021

Boeing 737-8K5, G-TAWG 24 December 2019 at Manchester Airport Shortly after a normal touchdown, the right outer (No 4) mainwheel separated from its axle and was seen, by the pilots, to pass down the right side of the aircraft. The aircraft vacated the runway and was safely brought to a halt on the taxiway. The wheel separated as a result of a failure of the inboard wheel bearing which led to the failure of the outer bearing. The exact cause of the initial failure to the inboard bearing could not be determined. Bearing failure investigations such as this are often inconclusive due the severity of the material damage within the bearing destroying evidence of the initiation. Therefore, it was not possible to determine the cause of the bearing failure, or to discount the possibility that there was a pre­ existing fault, or the bearing had become damaged as a result of the ingress of debris or moisture. It is possible that preload torque applied was slightly below the minimum required; however, it was still considered enough Hub damage around the inboard bearing cup area to ensure that the bearing assembly was correctly seated and makes it unlikely to have affected the bearing running condition. However, a combination of the possible causes set out in this report cannot be ruled out. The AAIB will review the findings of the operator’s investigation into the bearing failure on G-FDZB and will provide an update to this report if it provides further clarification on the cause of the bearing failure on G-TAWG. Safety action taken by the operator ● As a result of the No 4 inner wheel bearing failure found on Boeing 737-800, G-FDZB, and its similarities with a preceding bearing failure on Boeing 737-800, G-TAWG, a component failure investigation will be carried out to ascertain if there is a common cause for both failures. CORRESPONDENCE INVESTIGATIONS Embraer E55P Phenom, D-COLT 12 March 2019 at Runway 23R, Manchester Airport While the aircraft was lining up on Runway 23R from intersection J1 at Manchester Airport, the sun’s glare on the wet runway made it difficult for the pilot to see the runway markings. He aligned the aircraft with the runway edge stripe, rather than the centreline and, as instructed by ATC, commenced a rolling takeoff. The ATCO noticed the misalignment and instructed the aircraft to abandon its takeoff, which it did without damage or injuries to those onboard. Several safety actions have been undertaken by the airport authority and the air traffic service unit. The aircraft began taking off on the edge stripe of Runway 23R at Manchester after lining up via intersection J1. The Image of SMR at the commencement sun’s glare on the wet runway, and the of D-COLT’s takeoff roll orientation, dimensions and slope of the intersection and runway surfaces, contributed to the pilot misidentifying the centreline. The rolling takeoff reduced his opportunity to check the aircraft’s position. As a result of this and a previous similar event, the airport authority is implementing several safety actions to assist pilots lining up at J1. The ANSP stated that it intends to include the lessons from both events in its annual refresher training for ATCOs, and in other training opportunities. Safety actions taken by the the airport authority and the air navigation services provider The airport authority has undertaken to: ● Instate a ‘runway excursion’ hotspot at J1. ● Reconfigure J1’s lead-on lights so that they will always illuminate when its stopbar is lowered. ● Apply green paint to the areas of the J1 turning circle outside of the runway edge lighting, giving the impression of grass. The ANSP has undertaken to: ● Promulgate the lessons learned from both occurrences across all its airport units, by including them in its upcoming annual refresher training course for ATCOs and otherwise; and by highlighting the use of SMR for monitoring aircraft lining up, particularly small aircraft on large runways with wide shoulders. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

123 © Crown copyright 2021 122 © Crown copyright 2021

Agusta Westland AW189, G-OENC 25 March 2019 on Forties Charlie platform, Northern North Sea While operating to the Forties Delta platform the pilots misidentified and landed on the visually similar Forties Charlie platform. The operator has issued a safety notice detailing the lessons learned from the incident and a Flying Staff Instruction amending the guidance in the Operations Manual on the Avoidance of Wrong Deck Landings. The pilots landed the helicopter on the Forties Charlie (40C) platform having misidentified it as the destination platform (40D). Controls in place at the time proved inadequate to break the confirmation bias of the pilots. Discussion between the pilots about the position of the crane on the 40C platform probably resulted in them switching their attention incorrectly to this platform and away from the 40D platform. The crane was not stowed on either platform, so did not serve as a distinguishing feature. Forties Charlie (40C) platform The pilots’ familiarity with the Forties field, the physical similarity of the platforms, and the identical approach and landing flight path to each of them served to reinforce their selection of the wrong deck. The pilots did not verify they were approaching the correct platform by cross-checking the position of the platform against the FMS bearing and distance to the destination or reading the platform name on the helideck before committing to land. Safety action taken by the operator The operator has issued a Safety Notice to pilots highlighting four lessons learned from the incident, detailing: ● When to hand over control to the landing pilot ● The importance of pilots monitoring and cross-checking the GPS/FMS bearing and distance ● That pilots must read the platform name before committing to landing ● That pilots should wait for the cranes to be stowed even if this incurs a delay The operator has issued a Flying Staff Instruction amending the guidance for the ‘Avoidance of a Wrong Deck Landing’ given in the operations manual to emphasise the importance of the following actions: ● The need for pilots to highlight the risk of a wrong-deck landing at both the pre-flight planning and the approach brief phase ● The need for pilots to ensure the route is fully and correctly entered into the FMS ● The use of GPS/FMS needle bearing and distance guidance to the point that the platform name is read ● The need for pilots to read the platform name and cross-check with the GPS/FMS bearing and distance prior to committing to landing on the heli-deck AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

125 © Crown copyright 2021 124 © Crown copyright 2021

Airbus A319-131, G-DBCD 2 April 2019 en route London Gatwick Airport to Palma De Mallorca During pre-departure maintenance activity to resolve a flight control status message, the No 1 spoiler was unintentionally left in the maintenance position with the maintenance key installed. During the flight, the spoiler was able to ‘float’ up resulting in uncommanded left roll and vibration. The crew landed the aircraft without further incident. The operator’s internal investigation identified a number of factors which contributed to the maintenance error and it made 11 internal recommendations. Following maintenance action intended to deactivate a spoiler, the aircraft departed with the spoiler in the maintenance position. This allowed the spoiler to ‘float’ up in the airflow causing an uncommanded roll input. The aircraft landed without further incident and the spoiler was correctly deactivated for the return flight. The operator’s safety investigation identified that the LAEs had not followed the AMM procedure correctly. The maintenance activity was, by necessity, being conducted in bad weather and it was an unfamiliar task. They were distracted during the task and had difficulty using the APP on the tablet device Spoiler maintenance key and flag as found on arrival which was provided to display the required maintenance information. The LAEs had difficulty interpreting the modification status of the actuator and identifying the relevant sections of the procedure to use, relating to the modification status and position of the actuator, on the tablet device they were using. They were not clear on how the maintenance key was to be used to deactivate the spoiler actuator for dispatch. A physical check for correct deactivation was not completed and an independent check for correct deactivation was not required to be carried out. The log book entry for the deactivation was incorrectly certified. The operator’s report also identified a number of contributory factors including how the maintenance information was accessed and presented to the engineers, and differences in how similar information is presented more effectively to flight crews. Safety actions taken by the operator ● Improving the ease of access to, and the presentation and clarity, of maintenance information. ● Discussion with EASA and Airbus about the possibility of having critical lock out tasks clearly defined within the MEL in the style of a QRH for use alongside the crew OPS procedures. ● Reviewing the policy and standards for duplicate inspection to clearly identify that this deactivation task should require a duplicate inspection. ● Reviewing the effectivity of current line manager’s task audits at the Maintenance Safety Group. ● Highlighting to other engineers the importance of fully understanding the AMM and Trouble Shooting Manual tasks. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

127 © Crown copyright 2021 126 © Crown copyright 2021

Fuji FA-200-180 Aero Subaru, G-HAMI and Cessna 172R Skyhawk, G-BXGV 23 June 2019 near Henley-on-Thames, Oxfordshire Two aircraft had what was initially believed to be a near miss while giving air experience fights to disabled children at a multi-aircraft charity event. It was later discovered that the two aircraft had collided, with one aircraft sustaining minor damage, but both aircraft landed safely. The investigation discovered that one of the accident pilots was asked to present the pilots’ briefing at short notice. The briefing did not include a discussion of how all the participating aircraft would be deconflicted or how they would communicate. Neither aircraft had any form of Electronic Conspicuity. The airfield that hosted the event has committed to take safety actions before hosting the event again. Safety action taken by the airfield ● The host airfield stated that it will conduct a risk assessment before holding the event again. It will also ensure that the Deputy Airfield/Safety Manager or another responsible representative from the airfield is available to make a full and complete briefing, adopting the template of their Members’ Day briefing. An overview of the flying will also be maintained throughout the event. ● The owner of G-BXGV has fitted an EC device and linked it to the navigation software installed on his personal electronic device. Agusta A109E, G-ETPI 27 June 2019 in flight North of Seaton, Cornwall During a post-maintenance flight, the left cockpit door window separated from the helicopter. The window had been removed and reinstalled during recent maintenance. The investigation determined that insufficient adhesive had been applied to the rubber retaining seal. In addition, liberal application of high-concentration soap solution Window aperture of left cockpit door, during reinstallation likely contributed showing no evidence of adhesive to the loss of the window, by reducing the frictional ability of the rubber seal to retain the window. As a result of the findings of this investigation, the maintenance organisation has taken four safety actions. Deviation from the prescribed maintenance manual procedure and lack of effective supervisory oversight were identified as contributory factors. Safety actions taken by the maintenance organisation ● Following its internal safety investigation, the maintenance organisation debriefed all involved staff on the findings of the investigation. On 28 August 2019 it issued a temporary notice to all engineers informing them of the incident and requiring the installation of windows to be considered as a critical maintenance task, requiring an independent inspection to be performed during the installation of any acrylic window. The task was subsequently included on the organisation’s formal list of critical maintenance tasks, when it was next updated. The details of the incident are also to be included in company continuation training, with a focus on the requirements for effective supervision, stage checks and adherence to procedure. ● The maintenance organisation has undertaken to review its Emergency Response Plan (ERP) and to consider implementing a process to ensure that staff involved in maintenance activity prior to a suspected maintenance error, incident, or accident are stood down from duty, and are not allocated to be part of the maintenance response team. It indicated that the review of the ERP would be completed by the end of October 2019. ● In September 2019 the maintenance organisation introduced a new production planning tool across all its maintenance bases to control and monitor to allocation of manpower, including supervisory staff, to aircraft undergoing base maintenance. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

129 © Crown copyright 2021 128 © Crown copyright 2021

Parrot Anafi (UAS, registration, n/a) 17 July 2020 at : Green Lane, Yeadon, West Yorkshire The operator was conducting a night search of roof tops. About 15 minutes after takeoff, when the UA was at about 50 agl, the pilot noticed the control screen flicker and heard the speed of the UA’s motors increase without any input from him. The UA then started to turn and, despite inputs from the pilot, was unresponsive. He attempted to descend the UA to conduct an emergency landing and then selected the ‘Return to Home’ function, but it did not respond. The UA then entered an uncontrolled descent onto the roof, where it came to rest. The UA was recovered with damage to its two front left propellers and battery. There was also minor damage to the roof covering. The pilot believed that, given the clean fractures on the propellers and the way the motors reacted, the UA had suffered a failure of the two propellers. The AAIB published another reported failure of propellers on a Parrot Anafi in its 9/2020 Bulletin. Safety action taken by the operator ● Previously the operator would only replace damaged propellers but, as a result of the safety action taken in the published event, they will now also change the propellers every 5 hours flight time. They will also make a video recording of all pre- and post- flight safety checks. DHC-8-402 Dash 8, G-PRPK 22 July 2019 en route from Edinburgh Airport to London City Airport During a scheduled flight from Edinburgh Airport to London City Airport the cabin press warning illuminated and the crew initiated an emergency descent. The aircraft diverted to Birmingham and landed without further incident. Following some rectification work the aircraft was returned to service later that day. During the ensuing weeks the aircraft experienced several more pressurisation events until the operator decided to withdraw it from service for in-depth engineering investigation, after which it was returned to service again. To date no more pressurisation events have been reported. The operator has taken safety action intended to enhance the monitoring of recurring aircraft faults. After the ninth event, involving another emergency descent, the operator withdrew the aircraft from service and conducted an in-depth investigation into the recurring fault. Several bleed air and pressurisation components were replaced before the aircraft returned to service. The absence of further reported pressurisation faults since the aircraft returned to service indicates that this intervention was successful. It is therefore possible that several events, including the second emergency descent, would have been avoided if this intervention had occurred sooner. Safety actions taken by the operator ● The operator issued a notice to all its flight crew (NOTAC 101/19) on 9 August 2019 with guidance on the reporting of safety events. It also conducted a ‘roadshow’ for crews and engineers at all its bases, encouraging the submission of ASR reports. ● The operator has initiated a review of its reliability program to, among other things, enable more robust monitoring of recurring defects. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

131 © Crown copyright 2021 130 © Crown copyright 2021

Boeing 787-9 Dreamliner, G-CKWB 12 August 2019 at London Gatwick Airport G-CKWB was parked on Stand 38 at London Gatwick Airport. The aircraft was loaded, with the doors closed ready to depart for its flight to the USA. Permission was granted by the ground controller for the aircraft to push back and start engines at 0910 hrs. The aircraft was pushed back using the incorrect line and as a result the aircraft tail cone struck the blast screen. Pushback route markings and stop position Final pushback position and contact point Final pushback position Safety actions taken by the operator ● Use of Stand 38 by the operator was suspended temporarily. ● The aircraft operator decided to prepare a risk assessment on the use of additional ground staff to watch the wingtips and tail of aircraft during the pushback. The airport operator agreed to consider this assessment once it was complete. ● Notices were issued by the aircraft operator to all pushback crews to remind them of the procedures and importance for stopping a pushback should the aircraft deviate from the centreline. ● Additional training was given to headset operators to increase their understanding and awareness of pushback hazards. ● A ‘STOP’ mark was painted on the ramp beside the nosewheel stop line on Stand 38 to make it clear that the aircraft should not be pushed back further than this line. This mark matches others at Gatwick where the pushback is limited by the confined space. Antonov AN12, UR-CKL 30 September 2019 at Liverpool Airport The aircraft’s left wing struck a lighting stand whilst leaving its parking stand. The aircraft had been parked in a position where the crew could not see the stand’s ground guidance markings and there was no marshaller to guide them. The airport had accommodated the fact an appropriate tow bar was not available for the aircraft by parking it on an existing stand in a manner not intended for that stand. Whilst this enabled the aircraft to leave the stand without needing to be pushed back, it had put the wing in a position where it was in danger of colliding with the lighting stand. This foreseeable outcome might have indicated the need for appropriate guidance to be made available to, and requested by, the crew to ensure adequate clearance from the lighting stand. Safety action taken by airport authority ● The airport has re-designated Stands 11-14 and 33-41 to allow parking by self­ manoeuvring. The AIP entry has been updated to inform pilots that under such circumstances a marshaller will be available during departure and to instruct pilots to request assistance at any time they need it when taxiing. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

133 © Crown copyright 2021 132 © Crown copyright 2021

Aerialtronics Altura Zenith ATX8 (UAS, registration n/a) 1 October 2019 in Stoke Gifford, Gloucestershire Shortly after takeoff for a flight from a road bridge above two railway tracks, the UAS in GPS mode started to drift, accelerate and descend away from the pilot. The pilot was unable to regain control before it crashed into vegetation next to the tracks. A subsequent investigation by the operator found that magnetic deviations of up to 140° were observed over localised regions of the bridge below which the railway track’s overhead high-voltage wires were being ducted. The day after the accident flight, the operator went to inspect the takeoff site to try and identify any factors that might explain the aircraft’s behaviour. A spectrum analysis of the radio frequencies at the site didn’t identify anything of concern. However, when using a hand-held compass to check for any magnetic interference, deviations of up to 140° were observed over localised regions of the bridge below which the railway track’s overhead high-voltage wires were being ducted. Safety action taken by the operator As a result of the findings, the operator has made changes in its flying procedures to reduce the possibility of the event reoccurring. These include: ● A magnetic interference check using a manual compass of an area 10 m around the planned takeoff location; ● A visual check for objects and structures that might have a large magnetic field; ● Takeoff and landings should take place as far away from any sources of magnetic interference; and ● The pilot should always be ready to switch out of GPS mode into atti(tude) or manual flight modes to retake control of the UAS if control is lost whilst in GPS mode. Airbus A321-231, G-EUXJ 24 November 2019 on takeoff from Glasgow Airport During the takeoff roll the flight crew realised the aircraft was not accelerating as expected. Just prior to V1 the commander applied full power. The aircraft took off and continued its planned flight without further incident. The flight crew subsequently discovered they had entered an incorrect reduced thrust temperature into the flight management computer. The investigation found the incorrect entry was probably a result of distraction during the data entry. The subsequent standard procedures and checks did not detect the error. The flight crew inadvertently entered a flex temperature of 79° instead of 49°. The error was not detected during the subsequent procedures and checks. The error was likely made due to a combination of brief distraction and entering a nonstandard acceleration height. The subsequent checks do not require the flight crew to refer back to the source data and, whilst the selected flex temperature was unusual for a A321, it was not usual for the A319 which the flight crew had been operating during the tour. The flight crew realised there was insufficient power during the takeoff roll and applied TOGA power. The operator has reminded its pilots about the hazard of distraction during critical data loading and are reviewing their procedures to improve the likelihood that data entry errors are detected. Safety action taken by the operator ● The operator has issued a safety notice to all its flight crew highlighting this and previous events. The notice emphasises the importance of avoiding distractions whilst loading the takeoff performance data. ● The operator is also reviewing its takeoff performance data entry and checking procedures in order to ensure that there are sufficient opportunities in the procedures to trap any error. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

135 © Crown copyright 2021 134 © Crown copyright 2021

Boeing 747-436, G-CIVU 20 December 2019 at London Heathrow Airport A Boeing 747 collided with a fuel transfer vehicle (FTV) as it was approaching its final parking position on stand at Heathrow. The FTV had remained on stand after refuelling the previous aircraft. Neither the flight crew nor the ground staff responsible for the arrival saw the FTV before the collision. The operator and airport authority have taken safety action to prevent reoccurrence. Safety actions taken by the operator and airport authority The operator is taking the following safety action to resolve these issues: ● The operator will conduct an independent review of the available standard operating procedures and associated documentation to ensure they are; ○ clear and workable, ○ the accountabilities and responsibilities are detailed and, ○ there is a single source of information. The operator will take the following safety action: ● The operator will establish a procedure to ensure all visually restricted stands have a ‘mid-man’, in the line of sight, to act as an additional pair of eyes for the colleague manning the emergency stop button at the head of the stand. The airport authority is taking the following safety action: ● The airport authority has changed the parking arrangement on Stand 331 to prevent vehicles obscuring the view from the head of stand. The airport authority is undertaking a review of the emergency stop button locations on all stands Airbus A321-231, G-WUKG 16 January 2020 at London Luton Airport, Bedfordshire The aircraft was departing from Runway 26 at London Luton Airport, but when the PF made a normal aft movement of the side stick control at rotation airspeed, the aircraft did not pitch up. The PF increased the side stick input close to the maximum deflection. When the aircraft still did not pitch up, the PM selected TOGA thrust. The aircraft responded and a climb was commenced with the flight continuing to the planned destination of Prague Airport, Czech Republic. An aircraft change had been made for operational reasons from an Airbus A320 aircraft (A320) to an Airbus A321 aircraft (A321), but no adjustment had been made to the passenger distribution. This led to the passengers being seated towards the front of the aircraft, placing the CG outside the forward limit of the permitted operating envelope. Following this event, the operator took action to: highlight this event to its staff and The A321 Load and Trim Sheet that would have resulted on the incident flight improve their understanding of the issues raised; and improve the flow of information between operational departments when there is a change of aircraft type to reduce the risk that a similar event would occur in the future. The incident occurred due to the aircraft change from an A320 to an A321 not being notified to both OHD and PSD. As a result, the passengers were seated at the front of the aircraft, placing the CG outside the forward limit of the operating envelope. The effect of this was that, at rotation, the aircraft appeared to the crew not to respond as expected to the normal side stick control inputs due to the forward CG. The PF required almost maximum aft control input and the PM selected TOGA thrust before the aircraft nose lifted. The crew analysed the problem but considered that an incorrect stabiliser setting, taken from the load sheet, had caused the problem. Only at the top of the descent for the destination did it become apparent that the passengers had possibly been incorrectly distributed in the cabin. The crew did not experience any unusual control response during the approach and landing. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

137 © Crown copyright 2021 136 © Crown copyright 2021

Safety actions taken by the operator ● Improve the passage of information between the OCC and the flight crew when a change of aircraft variant takes place. ● Improve Ground Handling Agents’ awareness of the implications of a change in aircraft variant. ● Distribute and make highly visible to all staff briefing material on this incident. ● Include any variant change at the flight and cabin crew briefing. ● Provide additional training for cabin crew on weight and balance distribution and its affects. ● Produce a Safety Bulletin to provide staff with a more detailed description of the incident. ● Issue a Crew Order (change to Operations Manual Part A) with enhanced awareness and guidance if suspicion is raised onboard. Eurocopter AS350B2, G-PDGF 3 March 2020 at Glencoe, Argyll, Scotland During the refurbishment of an electricity line, G-PDGF was carrying an underslung load consisting of a 700 kg wooden pole which was then inadvertently released. The pole broke into two pieces when it struck a steep hill approximately 200 m from a minor public road, but clear of any built-up areas and third parties. There was no damage to the helicopter or lifting equipment. The operator considered the most probable cause for the inadvertent release of the load was that the sling, which was carrying the load, was not positioned correctly in the helicopter’s hook which was of the spring-loaded keeper design. As a result of this incident, the operator is continuing to phase out the use of this design of hook for most of its operations and has changed its procedures so that only the operator’s employees are permitted to load the hook when spring-loaded keeper hooks are used. The most probable cause for the inadvertent release of the load was that the load had not been positioned correctly across the hook’s load bearing beam when the load was hooked on. At this time, the client’s employee, although having been trained in underslung load lifting operations, was working alone and was not being directly supervised. However, an intermittent fault could not The spring-loaded keeper hook be ruled out as an alternative cause for fitted to G-PDGF the release. Safety action taken by the operator ● The operator is continuing to phase out the use of hooks with spring-loaded keepers in favour of using keeperless hooks for most of its operations. Additionally, the operator has amended its procedures so that, if spring-loaded keeper hooks are used, only the operator’s employees will carry out loading operations. The operator advised that, as keeperless hooks require the use of two hands, it will retain a few spring-loaded keeper hooks for tasks such as lifting a load from a scree-covered hillside, where using both hands poses a greater risk to the loader. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

139 © Crown copyright 2021 138 © Crown copyright 2021

DJI Phantom 4 (UAS, registration n/a) 5 March 2020 at Bristol sewage treatment works During an aerial survey of a sewage treatment works, the unmanned aircraft flew into a wind turbine, the height of which the pilot had misjudged. The pilot was aware of the wind turbines at the site where the aerial survey was to be conducted but was unable to find any accurate information about the height of these either on the app used to plan the flight or from an internet search. For a UAS pilot flying visual line of sight with the aircraft, tall obstacles may be obvious to see but their actual height is difficult to assess visually. All known ground obstacles greater than 300 ft in Extract from the CAA 250K aeronautical height are shown on aeronautical charts. chart with the wind turbines at the sewage works in the centre of the image These charts, and apps that use the same obstacle database, are one source of accurate information, and provide a clear indication of areas to avoid flying a UAS if limited to flying not above 400 ft. However, for obstacles less than 300 ft, UAS pilots will need to determine their accurate heights from other sources. UAS pilots are responsible for flying their aircraft within the limitations imposed by their CAA Permission and so must ascertain the accurate height of any hazard or obstacle near the planned flightpath. Safety action taken by the operator ● Having been reminded of the obstacle and airspace information available on aeronautical charts or flight planning apps that have access to this information, the operator has amended its flight planning and risk assessment procedures to include reference to these. Yuneec H520 (registration N/A) 24 April 2020 at Hove, East Sussex The aircraft dropped to the ground from a height of 15 m when power was lost to the electric motors even though the battery’s energy level (State of Charge) was 97.7%. The wind conditions were turbulent and an investigation by the Unmanned Aircraft System’s (UAS) manufacturer concluded that the probable cause for the power loss was that the battery had become loose in flight. The sudden loss of power to the motors from a battery that was almost fully charged was consistent with the battery disconnecting in flight. The data indicated that the aircraft was pitching through 6° and rolling through 46° as it maintained altitude while moving slowly forward, suggesting that the conditions were turbulent enough to dislodge the battery if it had not been properly secured in place, even though the pilot had checked to make sure it was. Safety action taken by the manufacturer ● The manufacturer stated that future versions of the Yuneec H520 will include logic to prevent takeoff if it detects that the clip holding the battery in its housing is not securely in place. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

141 © Crown copyright 2021 140 © Crown copyright 2021

Believer (UAS, registration n/a) 2 May 2020 at Solent Airport, Hampshire The flight was part of a test programme prior to the start of commercial operations to the Isle of Wight. The accident UAS was considerably smaller than the production aircraft but it was representative in terms of the avionics and communications. It crashed shortly after taking off because the safety pilot switched the radio control transmitter off before the automatic flight control system was engaged. Several safety actions have been undertaken General view of the Believer UAS by the operator because of this accident. The safety pilot erroneously turned the transmitter off before the automatic control system was activated and before the instruction to turn the transmitter off had been issued. The operator believed that the accident was unavoidable after the radio control transmitter was turned off because there was insufficient time to switch it back on and regain control of the UAS. Safety actions taken by the operator ● Operations were reviewed to minimise the period where a UAS is under manual control. The UAS is now launched in a revised automatic mode where the safety pilot can apply control inputs to correct the flight path if appropriate. The safety pilot can also disable the automatic flight control system and take full control of the UAS in the event of an emergency. ● The fail-safe logic has been reviewed and modified so that settings are automatically configured depending on the status of the UAS. ● The operator has reviewed their fatigue risk management strategy and is introducing limitations with respect to permissible crew working times and a requirement for crew members to consider their well-being and declare themselves fit for operation during every flight briefing. The operator is updating their operations manual accordingly. Hawker Hurricane 1, G-HRLI 1 June 2020 at Duxford Airfield, Cambridge While landing with a crosswind the aircraft made an uncommanded right turn that was not corrected, and the landing gear collapsed. The landing technique, the pilot’s lack of recency and the hard, dry runway surface may have been contributory factors. The operator will require that less experienced pilots do not operate the aircraft with a crosswind component above 5 kt from G-HRLI after the accident and the right. application of fire-suppressing agent The crosswind on landing induced a turn to the right. The reported application of brake and an absence of tail-down elevator coincided with the aircraft bouncing and pitching forward on the hard, undulating runway surface, aggravating the effects of the swing. In the absence of effective control inputs to oppose the swing, the aircraft began to slide sideways, eventually causing the landing gear to collapse. The pilot considered that his lack of relevant currency may have reduced his ability to anticipate and make appropriate control inputs on landing. Safety action taken by the pilot ● The pilot intends to conduct refresher training in a relevant dual control aircraft such as the Harvard before flying the Hurricane after a significant absence. The operator will amend its Operational Control Manual to require that pilots new to the type with less than 5 hours experience on equivalent types will be limited to a maximum 5 kt crosswind component from the right. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

143 © Crown copyright 2021 142 © Crown copyright 2021

Parrot Anafi Thermal 11 June 2020 near The Dicker, East Sussex The operator was conducting training with the UAS for a pilot and observer. About 3 minutes after takeoff the UA was observed to be “twitching”. Despite attempts to regain control, it was observed to pitch, yaw and change height by approximately ± 20 ft, and the UA was flown to the emergency landing area. As the pilot descended the UA for landing it became less responsive. It then pitched down and flew away, without any input from the pilot, and did not respond to any subsequent inputs. The pilot selected the ‘return to home’ function, without effect, and announced “control lost” to the observer. The UA then collided with a tree about 420 ft from the landing area and 100 ft agl, sustaining damage to its gimbal and front right folding propeller. The operator believed that the flight characteristics and damage sustained indicated that the right front propeller failed in flight. Safety action taken by the operator ● The operator had been replacing the propellers on all its UAs every 20 hours of flight time. At the time of the accident the propellers had flown for just under 9 hours. The operator will now change all folding propellers after 5 hours flight time and has made this a scheduled item in its electronic flight and maintenance logging software. DHC-8-402, G-JECK and EMB-145EP, G-SAJS 16 June 2020 at Aberdeen International Airport G-JECK was to be flown from Aberdeen Airport to Weeze Airport, Germany. The aircraft had been in storage at Aberdeen since March 2020 and was parked on a self­ manoeuvring stand which had a 1° slope. During the pre­ departure checks, the chocks were removed from both the mainwheels and the nosewheels. The hydraulic pressure in the park brake system subsequently reduced to the point where the brakes could no longer prevent G-JECK from moving, and the aircraft rolled across a taxiway before colliding with G-SAJS, which was parked on an adjacent stand. There were no injuries. Safety action has been taken by the CAA, operator of the aircraft, maintenance organisation, ground handling company and airport operator regarding the removal of wheel chocks during pre-flight preparation. G-JECK rolled across Taxiway D from its parking position G-JECK and G-SAJS and struck G-SAJS because the nosewheel chocks had during recovery been inadvertently removed, and the hydraulic pressure in the park brake accumulator had depleted over several days to the point where it was unable to prevent the aircraft from moving on the 1° slope. Safety actions Following this event, safety action has been initiated by the following organisations: The organisation that provided the pilots for the flight and sub-contracted the ground handling services has: ● Reminded its sub-contracted ground handling companies that permission must be obtained from the aircraft commander before removing chocks. ● Reiterated that chocks are to remain fitted until either a tug had been attached to the aircraft or, when self-manoeuvring, that nosewheel chocks remain fitted until permission has been given to remove them. ● Recommended that pilots check during their walkaround that chocks had not been inadvertently removed. The CAMO: ● Circulated a tutorial, and included it in recurrent training, to all staff within its organisation to raise awareness of the circumstances of this event. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

145 © Crown copyright 2021 144 © Crown copyright 2021

The organisation contracted to provide ground handling for G-JECK has: ● Updated its training of dispatchers to ensure that third parties undertake only those duties for which they have been explicitly briefed and trained to carry out. Aberdeen Airport has: ● Issued an airside safety alert at Aberdeen, Glasgow and Southampton Airports highlighting the need to obtain permission before removing chocks. ● Undertaken to carry out audits of ground handling companies operating at Aberdeen to better understand chocking procedures and training. ● Requested airside operations to audit chocking procedures on the ramp area, with particular attention to self-manoeuvring stands. ● Undertaken to share safety lessons with ground handling companies via the ramp safety committee at Aberdeen. The UK CAA: ● On 27 July 2020, the UK CAA published Safety Notice, SN-2020-0137 - Returning Aircraft to Service from ‘Extended Parking’, which highlights threats associated with this report. Airbus A321-231, G-WUKJ 16 June 2020 at Doncaster Airport During the takeoff roll, as the aircraft was approaching V1, the commander identified that the airspeed on the Primary Flight Display was reading zero and rejected the takeoff. Examination of the aircraft found insect larvae within one of the pitot probes. The aircraft had been parked for nearly 12 weeks prior to the flight. The operator has taken safety action to introduce a procedure that flushes the static and total pressure lines on any aircraft that has been parked for more than three days before it is returned to operation. The post flight report produced a failure message ‘34-12-34 ADR1’ associated with a flight control ECAM warning in the No 1 Air Data Reference (ADR1). Troubleshooting performed by the AMO transposed the No 1 and No 3 Air Data Inertial Reference Units (ADIRUs) and after a successful ground test, released the aircraft for the ferry flight. During the subsequent takeoff, at approximately 1540 hrs, the aircraft performed a low speed rejected takeoff as the commander’s PFD was still not registering an air speed. Further troubleshooting over the following two days finally found three small insect larvae, approximately the size of a grain of rice, within the No 1 pitot probe. These larvae were liberated whilst performing a pitot probe flush, which was advised by the aircraft manufacturer. The larvae were not retained to enable further identification of the insect species. The operator concluded that the insect larvae may have been deposited in the pitot probe whilst it was parked with the pitot probe covers fitted. To prevent differential pressure measurement issues in the air data system1 , pitot probe covers supplied by the aircraft manufacturer do not completely seal the probes, it is therefore possible that an insect could enter the air data system during prolonged parking. It cannot be ruled out, however, that the larvae were deposited once the aircraft had been prepared to return to service on 15 June or an insect had been within the pitot probe covers before they were fitted. Safety actions taken by the operator and aircraft manufacturer ● The operator has introduced a requirement to flush all total and static pressure lines before any aircraft is returned to operation after it has been parked for more than three days. ● The operator is also looking to identify better pitot probe covers that may offer better protection than those currently used. ● The aircraft manufacturer is looking to update the aircraft AMM Return to Operations task to require air data system flushing prior to the next flight after prolonged time on the ground. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

147 © Crown copyright 2021 146 © Crown copyright 2021

Reims Cessna F150M, G-CSBM 10 July 2020 at Winchfield, Hampshire As the aircraft approached Blackbushe Airport the engine lost power and the pilot made a precautionary landing in a field. There was no damage to the aircraft and neither occupant was injured. The engine lost power due to fuel exhaustion. The pilot had used a fuel dipstick through a desire to measure the fuel onboard more accurately, but the dipstick used was not calibrated for the aircraft; this led him to overestimate the fuel onboard. The pilot made a safe precautionary landing in a field due to loss of engine power. The engine had G-CSBM after the lost power due to fuel exhaustion. precautionary landing Through a desire to measure the fuel accurately the pilot had used the incorrect fuel dipstick leading him to overestimate the fuel onboard. Safety action taken by the flying club ● The flying club have reminded pilots of the importance of only using the dipstick calibrated for the aircraft they are flying. Airbus A321, YL-LCQ Airport, Spain 22 July 2019 on approach to London Stansted Airport London Stansted Airport (STN) was operating with a displaced threshold on Runway 22 (RW22) while repairs were carried out at the normal threshold. RW22 ILS was unavailable during the works period. A revised RNAV approach (RNAV22C), which was steeper and based on the displaced threshold, had been promulgated for RW22. YL-LCQ was observed to be lower than expected during its approach and over the works area. The pilots of YL-LCQ had not realised that a revised approach was required and flew the standard RNAV arrival. Radar data indicated that the aircraft was low over the works area and touched down close to the displaced threshold. Temporary approach plates were available to the pilots in their electronic flight bags (EFB), but the stated workinprogress (WIP) Comparative radar traces active periods on the temporary (YL-LCQ trace in red) airfield chart were incorrect. ATC had made repeated references to the displaced threshold and the RNAV22C arrival during the period when YL-LCQ was on the terminal controller’s frequency. After the incident, the operator highlighted the WIP implications to all their pilots operating from STN. The chart manufacturer reviewed their processes to address the issues which had resulted in incomplete information being presented on the temporary airfield chart. Having read the relevant flight documentation paperwork, the pilots’ mindset was that the runway works at STN were not active during their approach. Confirmation bias appears to have played a part in the pilots’ selection of the wrong approach procedure and may have contributed to ATC not detecting the error. The reminder to follow PAPI indications was misinterpreted as an instruction to ignore them. The incident highlighted the importance of correct and complete radio transmission phraseology Safety actions taken by the aircraft operator, air traffic servies, airport users safety group and chart manufacturer ● The aircraft operator alerted their crews to the error in the temporary airfield chart and the requirement to fly the revised RNAV procedure when the THR 22 works were active. ● The Stansted Airport air traffic services unit terminal control interface manager was tasked to raise the issue of incorrect or incomplete readbacks with the terminal control unit; the aim being to ensure that future poor radio phraseology would be robustly challenged. AAIB Air Accidents Investigation Branch www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Safety Recommednation and Safety Action Overview Safety Recommendation and Safety Action Overview

149 © Crown copyright 2021 148 © Crown copyright 2021

● The airport’s user safety group was tasked to conduct a full review of the phraseology used for the reduced runway operations. ● The chart manufacturer undertook an investigation into how the works scheduling had been incorrectly represented on the temporary airfield chart and took remedial action to prevent similar data transposition errors in the future. Appendix 1 - CICITT Occurrence Categories CODE DESCRIPTION ARC ABNORMAL RUNWAY CONTACT AMAN ABRUPT MANEUVER ADRM AERODROME MAC AIRPROX/TCAS ALERT/LOSS OF SEPARATION/NEAR MIDAIR COLLISIONS/MIDAIR COLLISIONS ATM ATM/CNS BIRD BIRD CABIN CABIN SAFETY EVENTS CTOL COLLISION WITH OBSTACLE(S) DURING TAKEOFF AND LANDING CFIT CONTROLLED FLIGHT INTO OR TOWARD TERRAIN EVAC EVACUATION EXTL EXTERNAL LOAD RELATED OCCURRENCES F–NI FIRE/SMOKE (NON-IMPACT) F–POST FIRE/SMOKE (POST-IMPACT) FUEL FUEL RELATED GTOW GLIDER TOWING RELATED EVENTS GCOL GROUND COLLISION RAMP GROUND HANDLING ICE ICING LOC–G LOSS OF CONTROL–GROUND LOC–I LOSS OF CONTROL–INFLIGHT LOLI LOSS OF LIFTING CONDITIONS EN ROUTE LALT LOW ALTITUDE OPERATIONS MED MEDICAL NAV NAVIGATION ERRORS OTHR OTHER RE RUNWAY EXCURSION RI RUNWAY INCURSION SEC SECURITY RELATED SCF–NP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (NON-POWERPLANT) SCF–PP SYSTEM/COMPONENT FAILURE OR MALFUNCTION (POWERPLANT) TURB TURBULENCE ENCOUNTER USOS UNDERSHOOT/OVERSHOOT UIMC UNINTENDED FLIGHT IN IMC UNK UNKNOWN OR UNDETERMINED WILD WILDLIFE WSTRW WIND SHEAR OR THUNDERSTORM www.aaib.gov.uk @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 www.aaib.gov.uk AAIB Air Accidents Investigation Branch @aaibgovuk AAIB 24-hour Reporting - Telephone number +44 (0)1252 512299 Air Accidents Investigation Branch Annual Safety Review 2020 Air Accidents Investigation Branch Annual Safety Review 2020 AAIB Air Accidents Investigation Branch Safety Recommendation and Safety Action Overview

GLOSSARY OF ABBREVIATIONS aal above airfield level ACAS Airborne Collision Avoidance System ACARS Automatic Communications And Reporting System ADF Automatic Direction Finding equipment AFIS(O) Aerodrome Flight Information Service (Officer) agl above ground level AIC Aeronautical Information Circular amsl above mean sea level AOM Aerodrome Operating Minima APU Auxiliary Power Unit ASI airspeed indicator ATC(C)(O) Air Traffic Control (Centre)( Officer) ATIS Automatic Terminal Information Service ATPL Airline Transport Pilot’s Licence BMAA British Microlight Aircraft Association BGA British Gliding Association BBAC British Balloon and Airship Club BHPA British Hang Gliding & Paragliding Association CAA Civil Aviation Authority CAVOK Ceiling And Visibility OK (for VFR flight) CAS calibrated airspeed cc cubic centimetres CG Centre of Gravity cm centimetre(s) CPL Commercial Pilot’s Licence °C,F,M,T Celsius, Fahrenheit, magnetic, true CVR Cockpit Voice Recorder DFDR Digital Flight Data Recorder DME Distance Measuring Equipment EAS equivalent airspeed EASA European Union Aviation Safety Agency ECAM Electronic Centralised Aircraft Monitoring EGPWS Enhanced GPWS EGT Exhaust Gas Temperature EICAS Engine Indication and Crew Alerting System EPR Engine Pressure Ratio ETA Estimated Time of Arrival ETD Estimated Time of Departure FAA Federal Aviation Administration (USA) FIR Flight Information Region FL Flight Level ft feet ft/min feet per minute g acceleration due to Earth’s gravity GPS Global Positioning System GPWS Ground Proximity Warning System hrs hours (clock time as in 1200 hrs) HP high pressure hPa hectopascal (equivalent unit to mb) IAS indicated airspeed IFR Instrument Flight Rules ILS Instrument Landing System IMC Instrument Meteorological Conditions IP Intermediate Pressure IR Instrument Rating ISA International Standard Atmosphere KCAS knots calibrated airspeed kg kilogram(s) KIAS knots indicated airspeed KTAS knots true airspeed km kilometre(s) kt knot(s) lb pound(s) LP low pressure LAA Light Aircraft Association LDA Landing Distance Available LPC Licence Proficiency Check m metre(s) mb millibar(s) MDA Minimum Descent Altitude METAR a timed aerodrome meteorological report min minutes mm millimetre(s) mph miles per hour MTWA Maximum Total Weight Authorised N Newtons NR Main rotor rotation speed (rotorcraft) Ng Gas generator rotation speed (rotorcraft) N1 engine fan or LP compressor speed NDB Non-Directional radio Beacon nm nautical mile(s) NOTAM Notice to Airmen OAT Outside Air Temperature OPC Operator Proficiency Check PAPI Precision Approach Path Indicator PF Pilot Flying PIC Pilot in Command PM Pilot Monitoring POH Pilot’s Operating Handbook PPL Private Pilot’s Licence psi pounds per square inch QFE altimeter pressure setting to indicate height above aerodrome QNH altimeter pressure setting to indicate elevation amsl RA Resolution Advisory RFFS Rescue and Fire Fighting Service rpm revolutions per minute RTF radiotelephony RVR Runway Visual Range SAR Search and Rescue SB Service Bulletin SSR Secondary Surveillance Radar TA Traffic Advisory TAF Terminal Aerodrome Forecast TAS true airspeed TAWS Terrain Awareness and Warning System TCAS Traffic Collision Avoidance System TODA Takeoff Distance Available UA Unmanned Aircraft UAS Unmanned Aircraft System USG US gallons UTC Co-ordinated Universal Time (GMT) V Volt(s) V1 Takeoff decision speed V2 Takeoff safety speed VR Rotation speed Reference airspeed (approach) VREF Never Exceed airspeed VNE VASI Visual Approach Slope Indicator VFR Visual Flight Rules VHF Very High Frequency VMC Visual Meteorological Conditions VOR VHF Omnidirectional radio Range AAIB Air Accidents Investigation Branch Air Accidents Investigation Branch Annual Safety Review 2020

Air Accidents Investigation Branch Annual Safety Review 2020

FD06701 ｜ 2021_英国_aaib-investigation-to-agusta-a109e-g-etpj__Agusta_A109E_G-ETPJ_01-21.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

49 © Crown copyright 2021 All times are UTC AAIB Bulletin: 1/2021 G-ETPJ AAIB-26772 SERIOUS INCIDENT

Aircraft Type and Registration: Agusta A109E, G-ETPJ No & Type of Engines: 2 Pratt & Whitney Canada PW206C turboshaft engines Year of Manufacture: 2004 (Serial no: 11173) Date & Time (UTC): 2 July 2020 at 1510 hrs Location: Boscombe Down Airfield, Wiltshire Type of Flight: N/A Persons on Board: Crew - None Passengers - None

Injuries: Crew - N/A Passengers - N/A Nature of Damage: Localised overheating and burning Commander’s Licence: N/A Commander’s Age: N/A Commander’s Flying Experience: N/A Information Source: Aircraft Accident Report Form and further enquiries by the AAIB Synopsis The helicopter landed after a routine flight during which a circuit breaker (CB) tripped. While an engineer was investigating the cause, the next flight crew noted a burning smell in the rear baggage bay during their walk-around checks. The operator’s investigation found evidence of a fire in the aft equipment bay1, and a chaffed electrical cable. The cable was part of a design change that was made whilst the helicopter was on the UK military register operated as Military Registered Civil Owned Aircraft (MRCOA) subject to oversight by the UK CAA. A protective strip should have been installed as part of the design change, but this was missing when the helicopter was examined after the incident. The strip would have prevented the cable from chaffing against the adjacent structure. History of the flight The helicopter was on a routine flight when the main Flight Test Instrumentation (FTI) circuit breaker (CB) tripped. The crew did not reset the CB and the flight continued as normal with the helicopter landing after approximately 20 minutes. A ground engineer attended the helicopter and with the batteries on, reset the CB, which tripped again almost immediately. Whilst the engineer investigated the fault, the next flight crew commenced a walk-around check of the helicopter in preparation for the next flight. Footnote 1 The aft equipment bay is behind the baggage bay. It is accessed by removing a lightweight panel between the two bays.

50 © Crown copyright 2021 All times are UTC AAIB Bulletin: 1/2021 G-ETPJ AAIB-26772 Upon opening the baggage bay the crew noticed a burning smell and, with the assistance of the engineer, they removed the panel to access the rear equipment bay. They found a ‘smouldering fire’, which self-extinguished before the arrival of the airfield fire service (Figures 1 and 2).

(Images courtesy of the operator) Figures 1 and 2 Overheat damage before and after FTI crate removal (Note: the panel between the baggage bay and rear equipment bay has been removed) Investigation Cabling The damage was most severe where electrical cables entered the equipment bay through an aperture in the adjacent structure. A single cable was found to be chaffed and it was apparent that the exposed conductor had been arcing with the equipment bay liner, which was manufactured from a composite material. The cable connected the battery and FTI busbars and the circuit was protected by a 10 Amp CB. This was the CB that tripped in‑flight. Flight Test Instrumentation The FTI was designed and installed several years before the incident when the helicopter was on the UK military register. When the helicopter moved onto the civil register the design was reviewed by an approved organisation and a STC was issued by the EASA. The installation drawings depicted a protective strip around the periphery of the aperture to ensure that the cables did not chafe against the adjacent structure. When the helicopter was examined after the incident it was apparent that the protective strip was missing. Operator’s fleet check The operator owned another Agusta 109 (G-ETPI), which was equipped with a similar FTI installation. This helicopter was checked, and the protective strip was found correctly embodied (Figures 3 and 4).

51 © Crown copyright 2021 All times are UTC AAIB Bulletin: 1/2021 G-ETPJ AAIB-26772

(Images courtesy of the operator) Figures 3 and 4 Note: lack of protective strip on G-ETPJ (left image) and protective strip as fitted to G-ETPI (right image) Conclusion The investigation established that the electrical power supply cable between the battery busbar and the FTI busbar chaffed against the equipment bay liner causing a short-circuit, arcing, and the CB to trip. The equipment bay liner was melted and burned, and the operator concluded that it was probable that fire damage occurred in-flight, assisted by airflow entering the bay through the cable aperture. If a protective strip had been installed, as required by the design change, this should have prevented the cable damage. BULLETIN CORRECTION Following publication the following corrections were made to the report. The fourth sentence in the synopsis on should read: The cable was part of a design change that was made whilst the helicopter was on the UK military register operated as Military Registered Civil Owned Aircraft (MRCOA) subject to oversight by the UK CAA. The last sentence of the first paragraph of the Flight Test Instrumentation section on page 50 should read: When the helicopter moved onto the civil register the design was reviewed by an approved organisation and a STC was issued by the EASA. Full details of the corrections can be found online and will be in the March 2021 Bulletin. The online version of the report was corrected 11 February 2021.

FD06702 ｜ 2021_英国_aaib-investigation-to-beech-200-super-king-air-g-fseu__Beech_200_Super_King_Air_G-FSEU_01.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

52 © Crown copyright 2021 All times are UTC AAIB Bulletin: 1/2021 G-FSEU AAIB-26442 SERIOUS INCIDENT

Aircraft Type and Registration: Beech 200 Super King Air, G-FSEU No & Type of Engines: 2 Pratt & Whitney Canada PT6A-41 turboprop engines Year of Manufacture: 1978 (Serial no: BB-331) Date & Time (UTC): 28 February 2020 at 1415 hrs Location: Doncaster – Sheffield Airport Type of Flight: Commercial Air Transport Persons on Board: Crew - 2 Passengers - None

Injuries: Crew - None Passengers - N/A

Nature of Damage: Flap motor burnt out Commander’s Licence: Commercial Pilot’s Licence Commander’s Age: 35 years Commander’s Flying Experience: 856 hours (of which 393 were on type)

Last 90 days - 18 hours

Last 28 days - 2 hours Information Source: Aircraft Accident Report Form submitted by the pilot and further enquiries by the AAIB Synopsis While climbing through 8,800 ft after departing Doncaster-Sheffield Airport, the pilots noticed an electrical smell on the flight deck followed by a build-up of grey smoke in the cabin. A MAYDAY was declared and on the approach the flaps were selected down but remained in the retracted position. The aircraft landed without further incident. The smoke was caused by overheating of the flap motor. The flaps up limit switch had not operated due to wear in the system and so electrical power continued to be supplied to the motor after the flaps reached the retracted position prior to takeoff. The flap motor Circuit Breaker was found to be intermittent and had not initially tripped to protect the motor from overload. History of the flight Prior to a flight from Doncaster-Sheffield Airport to Wick Airport, the commander checked the flap system by operating the flaps through their full range and visually comparing each position against the flap indicator. The flaps were returned to the retracted (up) position and the aircraft made a flapless take off from Runway 20. As the aircraft climbed through 8,800 ft, the pilots noticed an electrical burning smell in the cockpit and decided to return to Doncaster. There was no obvious source for the smell

53 © Crown copyright 2021 All times are UTC AAIB Bulletin: 1/2021 G-FSEU AAIB-26442 and none of the circuit breakers (CB) had operated. Grey smoke was then seen in the cabin. The commander declared a MAYDAY to Scottish ATC(C) and requested an ILS approach for Runway 20, while the co-pilot searched for the origin of the smoke in the cabin. However, the source could not be identified. On the approach to Doncaster, the commander selected the flaps to the approach position but there was no movement. An inspection of the CB panel found that the CB for the flap motor had tripped. The aircraft made an uneventful landing at Doncaster and was met by the airport Rescue and Fire Fighting Service who used thermal imaging equipment to search for hot spots. A hotspot was detected on the left of the fuselage, below the floor near the centre of the cabin where the flap motor was located. There was no evidence of fire. Flap control system Two flaps are mounted on each wing and are driven by an electric motor and gearbox located below the floor to the left of centre of the cabin. The gearbox drives four flexible drive shafts each connected to a jackscrew via a flap actuator, which moves the flaps to the position selected by the pilot. The flap selector has three positions: up, approach and down. When the pilot selects one of these positions, electrical power is supplied to the motor to move the flaps. Once the flaps reach the selected position, a cam connected to the right inboard flap by a link-arm assembly operates a limit switch to disconnect electrical power to the motor. At the same time a second winding in the motor is activated which causes the motor to act as a brake to prevent the flaps from travelling past their selected position. Maintenance The manufacturer changed the maintenance schedule of the flap system from phased based maintenance to flap cycles in January 2019, which reflects the actual usage of the flaps. The flap motor, gearbox and flap actuators were replaced during the Phase 3 maintenance carried out on 17 January 2020 and had operated for 56 flap cycles prior to this event. Maintenance actions Examination of aircraft Examination of the aircraft, by the operator’s engineers, discovered evidence of heat damage and a burnt smell from the flap motor (Figure 1). A check of the flap motor CB was carried out and was found to be intermittent in operation.

54 © Crown copyright 2021 All times are UTC AAIB Bulletin: 1/2021 G-FSEU AAIB-26442

Figure 1 Flap motor showing evidence of damage due to overheating Cause of the smoke in the cabin The maintenance organisation believed that wear in the flap cam and link-arm assembly prevented the flap up limit switch from operating when the flaps retracted. As a result, electrical power was continuously supplied to the motor, which overheated, emitting fumes and smoke into the cabin. Normally, the CB would operate to protect the motor; however, it is likely that an intermittent fault meant it did not initially trip.

FD06703 ｜ 2021_英国_aaib-investigation-to-beech-b200-g-yvip__Beech_B200_G-YVIP_05-21.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

54 © Crown copyright 2021 All times are UTC AAIB Bulletin: 5/2021 G-YVIP AAIB-27011 SERIOUS INCIDENT

Aircraft Type and Registration: Beech B200, G-YVIP No & Type of Engines: 2 Pratt & Whitney Canada PT6A-42 turboprop engines Year of Manufacture: 1988 (Serial no: BB-1306) Date & Time (UTC): 23 October 2020 at 0920 hrs Location: Bournemouth Airport, Dorset Type of Flight: Private Persons on Board: Crew - 2 Passengers - None

Injuries: Crew - None Passengers - N/A Nature of Damage: Circuit breaker panel damaged Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 40 years Commander’s Flying Experience: 7,200 hours (of which 900 were on type)

Last 90 days - 45 hours

Last 28 days - 20 hours Information Source: Aircraft Accident Report Form submitted by the pilot and operator’s safety investigation report Synopsis The aircraft landed safely after an electrical fire and smoke in the cockpit during the final approach. The operator’s investigation found that the commander’s circuit breaker (CB) panel showed evidence of moisture ingress and the back-lighting circuit board was burned. They concluded that the most likely scenario is that rainwater entered the cockpit through the storm window, which is above the CB panel. Following this event, the operator took action to ensure that all their King Air aircraft have an improved storm window seal and that their aircraft are parked inside a hangar when they are not in use. History of the flight The aircraft was on final approach to Bournemouth Airport in clear weather, at a height of approximately 1,200 ft. Very shortly after selecting approach flap, they noticed a yellow glow and smoke coming from behind the commander’s CB panel. They attempted to isolate the problem by operating the master switch gang bar, which switches off the battery and electrical generators, but this had no effect, so they declared a mayday. The first officer tried to reach the fire extinguisher under his seat but found this to be difficult because of his shoulder straps. After landing the crew evacuated the aircraft on the runway and the airport fire service attended but the smoke stopped without intervention when the aircraft was shut down.

55 © Crown copyright 2021 All times are UTC AAIB Bulletin: 5/2021 G-YVIP AAIB-27011 Operator’s investigation The operator found evidence of moisture ingress in the commander’s CB panel and there was overheat and burning damage on the back-lighting circuit board (Figure 1). Figure 1 CB panel showing evidence of moisture ingress and overheating The commander’s CB panel is under the left storm window, which can be opened. The window has a seal to minimise the risk of moisture leaking into the cockpit, and the operator assessed this to be serviceable after the incident. They reported that there is a ‘reasonable body of evidence that they are prone to water ingress, particularly when the aircraft is parked outside in the rain’, and that water, which tends to collect on the outside of the window, can enter the cockpit when it is opened. They said that an improved seal is available as an optional modification, but this had not been fitted to G-YVIP. The operator reported that they normally keep their aircraft in a hangar when they are not in use, but G-YVIP was a recent addition to their fleet and anecdotal evidence indicated that it previously spent most of its time outside. Another possible contributory factor was that the operator’s crews had been routinely opening the storm window recently to clear the cockpit of a ‘fogging’ agent that was used for sterilisation in response to the global coronavirus pandemic. They considered that this might have increased the likelihood of water ingress.

Conclusion The operator’s investigation found evidence of moisture ingress, overheat and burning damage in the commander’s CB panel, which is under the left storm window. They concluded that the most likely scenario is that moisture entered the cockpit through the window, eventually resulting in electrical breakdown of the CB panel back-lighting circuit board.

56 © Crown copyright 2021 All times are UTC AAIB Bulletin: 5/2021 G-YVIP AAIB-27011 Safety actions The operator has installed the improved window seal across their fleet of King Air aircraft, and whenever possible, their aircraft will be parked inside the hangar and only towed outside when required.

FD06704 ｜ 2021_英国_aaib-investigation-to-bn2t-4s-islander-g-cgtc__BN2T-4S_Islander_G-CGTC_10-21.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

3 © Crown copyright 2021 All times are UTC SERIOUS INCIDENT

Aircraft Type and Registration: BN2T-4S Islander, G-CGTC No & Type of Engines: 2 Rolls Royce M250-B17F/1 turboprop engines Year of Manufacture: 2013 (Serial no: 4019) Date & Time (UTC): 12 November 2020 at 2055 hrs Location: City of Derry Airport, Eglinton, Londonderry Type of Flight: Emergency services operations Persons on Board: Crew - 1 Passengers - 2 Injuries: Crew - None Passengers - None Nature of Damage: Undamaged Commander’s Licence: Commercial Pilots Licence/Instrument Rating Commander’s Age: 59 years Commander’s Flying Experience: 8,325 hours (of which 3,153 were on type)

Last 90 days - 31 hours

Last 28 days - 10 hours Information Source: AAIB Field Investigation Synopsis The aircraft suffered a double engine failure, likely due to intake icing, while operating in IMC at approximately 7,000 ft amsl. After an initial glide descent both engines were successfully restarted and the aircraft made a powered landing at Eglinton. The operator has taken safety action related to winter operations, use of anti-icing systems and pilot wellbeing. History of the flight The plan was to depart Belfast Aldergrove Airport and route to an operating area, climbing to an altitude of approximately 10,000 ft amsl. The crew consisted of the pilot and two observer passengers. Before flight the crew conducted a briefing in which the meteorological information was an area of particular concern as a cold front was approaching the operating area bringing extensive cloud and reducing temperatures. The pilot was conscious of the risks of airframe icing and during the brief decided to operate the aircraft below the 0°C isotherm. The aircraft taxied at approximately 1950 hrs for departure from Runway 17 at Aldergrove. While taxiing, the aircraft was given a different ad hoc task. The pilot informed ATC of the change and arranged a new departure clearance. Shortly afterwards the pilot was told by one of the observers that the new task had been resolved and therefore the aircraft was to revert to its original plan. The pilot requested an appropriate departure clearance, but the aircraft was then required for the ad hoc tasking once again. The pilot again requested a AAIB Bulletin: 10/2021 G-CGTC AAIB-27032

4 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 change of departure clearance and stated he felt somewhat exasperated by the frequently changing situation. Figure 1 Britten-Norman 2T-4S Islander The aircraft took off from Runway 17 at 2005 hrs and routed to the new operating area. This tasking was at lower levels, so the pilot climbed to approximately 1,600 to 1,800 ft amsl. The lower altitude allowed the aircraft to operate clear of cloud, and icing conditions were not an issue. The task was concluded at 2025 hrs and the aircraft was released to continue with the originally planned operation. The pilot set course for the operating area and requested clearance to operate up to FL 090. During the transit the pilot decided to stop the climb at approximately 7,000 ft amsl to remain below the 0°C isotherm. At 7,000 ft he recalled that the air temperature was +1°C. During the transit the aircraft entered cloud and as it did so the pilot recalled selecting the engine anti-icing on. The aircraft reached its operating area at approximately 2045 hrs. After around five minutes on task the pilot noticed that the torque indications for both propellers were reducing, with a related decrease in airspeed. He therefore increased power to restore both torque and airspeed. A short time later the pilot again noticed a drop in both torque and airspeed. The aircraft needed “more and more power” to maintain the required performance and the pilot became concerned that something was amiss. He then noticed that the turbine gas temperature (TGT) on both engines had reached the limit of 927°C. At this point the pilot reduced power to keep the TGT within limits. He informed the rest of the crew that there was a technical issue with the aircraft and that his intention was to return

5 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 to Aldergrove. The pilot recalled that during the subsequent left turn the right engine failed, stating, “I was so startled I did not do any immediate drills but concentrated on maintaining control of the aircraft.” Given the already evident engine issues he was now concerned that the second engine would also fail. He recalled that as he thought this, the left engine failed. The pilot was aware of the aircraft’s position and decided that his only option was to try to glide to the nearer City of Derry Airport, Eglinton. He established the aircraft in a glide and then completed the engine shutdown and propeller feathering drills. He declared mayday to Aldergrove ATC and asked for vectors toward Eglinton. He was aware that Eglinton was closed so asked Aldergrove ATC if they could do anything to get the airfield lighting switched on. The aircraft’s topographical moving map display is role equipment and requires electrical supply from the generators and so was lost when the engines stopped. The pilot had an iPad with a mapping application but this also was not working. The observers also had iPads with mapping applications and one of them went to the cockpit to assist. During the descent the pilot attempted to restart the engines and 1 minute 30 secs after the second engine failure he was able to restart the right engine at approximately 2,100 ft amsl. The aircraft had cleared cloud and the pilot could now see nearby cultural lighting. From the observer’s iPad he could see the aircraft was over Loch Foyle. At approximately 1,500 ft amsl he then attempted a restart of the left engine. The first attempt was unsuccessful, which he attributed to not having selected the left engine igniters on. On what he recalled was the second attempt the left engine also restarted. The pilot decided to continue to land at Eglinton. Using the iPad map, and with the observer assisting with navigation, he flew the aircraft towards the airport. The pilot recalled that the wet runway surface at Eglinton became visible in reflected cultural lighting as the aircraft flew overhead at approximately 900 ft agl. Considering that this was too high for a safe approach he flew a left hand circuit to reposition on the centreline for Runway 26. The aircraft descended during the circuit and the pilot recalled seeing the runway from a height of approximately 350 ft agl. He then made a powered landing on the unlit runway. After landing the pilot taxied the aircraft to the main parking area and completed the shutdown checks. All on board were uninjured. Recorded information G-CGTC was not fitted, nor required to be fitted, with a flight data or cockpit voice recorder but recorded information was obtained from the following sources. Flight Management Computer G-CGTC was fitted with a Universal Flight Management Computer (FMC) that, when powered, continually recorded data to internal non-volatile memory1. The FMC was Footnote 1 This functionality is only available on some Universal FMCs, running certain software part numbers, and records data for the last 20 hours that the FMC is powered.

6 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 downloaded by the AAIB and the recovered data, which contained the incident flight, was decoded by the manufacturer. Data from the FMC, which is primarily used for navigation and flight guidance, included the aircraft’s position, altitude, details about the aircraft’s operating environment such as the Static Air Temperature (SAT) and the engaged flight guidance modes. The FMC data also included fuel consumption for each engine, derived from a fuel flowmeter mounted on each engine, and a calculated value for the total fuel on board2. In addition, the FMC memory recorded the pilot’s interaction with the FMC. The data showed that, after the first tasking was completed at approximately 2025 hrs, the aircraft climbed to a pressure altitude of 7,400 ft (equivalent to 7,000 ft amsl), reaching this altitude at 2035 hrs, and tracked from the general vicinity of Aldergrove towards the west. As G-CGTC climbed, the SAT decreased from 8°C to 1°C. Eight minutes after levelling off, at 2043 hrs, while maintaining a westward track the SAT reduced further to 0°C and a marked decrease in the right engine’s fuel flow was seen on the data, without a notable change in G-CGTC’s flightpath or performance. Ten minutes later, at 2053 hrs, after a descent to a pressure altitude of 7,000ft (equivalent to 6,600 ft amsl) and while G-CGTC performed the flight’s second tasking, the left engine’s fuel flow reduced to zero as the engine flamed out. G-CGTC entered a descent, at up to 1,500 ft/min, and its true airspeed increased to 150 kt. A minute later, at 2054 hrs, the right engine’s fuel flow reduced to zero as this engine also flamed out. (The data showed that the engines did not fail in the order recalled by the pilot). G-CGTC then entered a steeper descent, during which the true airspeed (which after the first engine flameout had reduced to 120 kt) again reached 150 kt, the SAT rose rapidly and a peak rate of descent of approximately 3,300 ft/min was recorded. The right engine was successfully restarted 74 seconds after it flamed out and at a pressure altitude of 2,500 ft (2,100 ft amsl), at which point G-CGTC’s flight path began to stabilise with a reduction in both the rate of descent and true airspeed recorded. The data then showed two unsuccessful attempts were made to restart the left engine, while the aircraft was in a shallow descent towards Eglinton, before it was successfully restarted at a pressure altitude of 1,200 ft (800 ft amsl) 8 minutes 27 seconds after it had failed. G-CGTC landed at 2109 hrs, with both engines operational, after one circuit flown at approximately 500 ft agl. An annotated copy of this data is shown in Figure 2 below. Terrain Awareness and Warning System G-CGTC was fitted with a Universal Terrain Awareness and Warning System (TAWS). The data recovered from the unit showed that several 500 ft agl call-outs were issued by the TAWS, as the aircraft positioned and then flew a single circuit to land at Eglinton, followed by a sink rate alert which occurred on short final. The sink rate alert was triggered by a descent rate of 990 ft/min, when G-CGTC was 91 ft above ground and had a true airspeed of 82 kt. The terrain and obstacle data used by the system was found to be significantly out of date. 2 The FMC calculates the total fuel on board by totalising the fuel used during the flight and subtracting this value from a pilot-entered value at the start of the flight.

7 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032   Figure 2 FMC data for the incident flight Radar recordings Radar and RTF recordings of the incident flight were available, radar coverage being lost because of terrain masking as the aircraft descended. Miscellaneous recorded data Flightpath data recovered from the observer’s iPad agreed with data recovered from the FMC and is not presented here.

8 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 Aircraft information Originally derived from the BN Islander aircraft, the BN-2T-4S Islander has a stretched fuselage, an enlarged wing, a new nose structure capable of accommodating a sensor turret and radar, and an increased payload. The aircraft is powered by two Rolls Royce M250‑B17F/1 turboprop engines rated at 450 shaft horsepower (shp) but derated to 400 shp for integration into the Islander platform. Each engine is fitted with a Hartzell three-bladed, constant speed, oil/gas operated, fully feathering propeller. Rolls Royce M250-B17F/1 engines The Rolls Royce M250-B17F/1 is a hydro-mechanically controlled engine consisting of four modules: a four-stage axial and single stage centrifugal compressor, a reverse flow combustor, a gas generator and power turbine, and reduction gearbox modules. Air flows through the axial and centrifugal compressors and is ported rearwards via two transfer pipes from the centrifugal compressor discharge (Diffuser scroll). The transfer pipes turn the air through 180° and connect to the rear of the combustion chamber. The expanding combustion products power the high pressure (HP) turbine to drive the compressor module and the power turbine which drives the propeller via the reduction gearbox. Anti-ice system The aircraft is cleared for flight into known icing conditions. The wing and tail leading edges are fitted with a pneumatic de-icing system. Powerplant icing is considered a risk with visible moisture in the air at temperatures of +5°C or less3. The powerplant anti-ice system activates two distinct sub-systems. One powers electrically heated spraymats4 on the engine intake ducts and electrical heater elements bonded to the propeller blades. The second diverts hot bleed air from the compressor discharge to the compressor front support structure to heat the surfaces of the static structure reducing the likelihood of ice accretion. The engine igniters are automatically switched to continuous operation when the anti-ice system is on, to help prevent water from melted ice or snow interrupting the combustion process. A green l.engine anti-ice or r.engine anti-ice caption illuminates on the cockpit central annunciator panel when the respective anti-ice system is selected. Once activated, intake duct heating is cycled on and off by a controller circuit depending on the surface temperature of the duct. At 60°C or below, the heating elements will activate and warm the intake surface to 110°C. On reaching this temperature, the control circuit will deactivate the heater until the surface cools again to 60°C, when the circuit is reenergised. The operation of the electrical anti-ice circuits can be monitored on an ammeter located in the pilot’s instrument panel just above the anti-ice switch panel. A four-position rotary switch selects left or right intake or propeller electrical current indication. If the ammeter Footnote 3 Pilatus BN Pilot’s Operating Handbook and CAA Approved Aircraft Flight Manual (AFM/2T-4S) section 2 ‘Limitations’, paragraph 2.9d. 4 A spraymat contains heating elements and a thermistor sensor for detecting the spraymat’s surface temperature.

9 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 needle is within the green band marked ‘Intake’ or ‘Prop’ it shows that the current drawn is within the circuit’s electrical operating limits. When anti-ice is selected on, an engine mounted solenoid valve is de-activated5 allowing hot bleed air to be diverted from the diffuser scroll to the compressor front support structure (Figure 3). Feeding hot air to the front of the engine causes a slight increase in the TGT which can be observed on the respective engine’s TGT indicator located on the cockpit centre instrument panel. The increase in TGT results in a small reduction of available torque. Diverting air from the compressor also reduces the engine’s efficiency and power. In addition, the current drawn by the anti-ice heating system increases the load on the engines from the electrical generators, compounding the reduction in engine torque. The Pilatus BN Pilot’s Operating Handbook and CAA Approved Aircraft Flight Manual (AFM/2T-4S), (AFM), contains the following caution: ‘The formation of intake ice may cause rapid power loss. Selecting Power ENGINE ANTI-ICE to FAST or SLOW, after intake ice has formed, may cause engine flame-out. If icing conditions are inadvertently encountered, or intake icing is suspected, immediately select ENGINE ANTI-ICE to FAST or SLOW for the selected engine. Confirm correct operation of the selected engine for approximately ten seconds before repeating the ENGINE ANTI-ICE selection for the other engine.’ Figure 3 Schematic of the engine anti-ice bleed air system Footnote 5 With the anti-ice off, power is supplied to the solenoid valve, the valve closes and activates a piston mechanism to prevent bleed air from reaching the front support assembly.

10 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 Aircraft examination Fuel The aircraft’s maintenance organisation took fuel samples from its main bulk fuel supply bowser and from the bowser used to refuel G-CGTC. Visual examination of the samples showed the fuel to be clear, bright, the correct colour and with no visible debris, contamination, or water. Testing using water sample capsules showed the dispersed water content was less than the maximum limit of 30 parts per million as recommended by the International Air Transport Association. The samples were sent for forensic examination. The aircraft fuel gauges showed approximately 240 US gallons of fuel, 120 US gallons in each side, remained in the aircraft fuel tanks. The left and right engine driven fuel pump filters were replaced with new items and the removed filters quarantined. As the aircraft was parked in a location that was exposed to poor weather conditions, it was taxied at low power to a local maintenance hangar for storage and further examination. There were no anomalies reported with the aircraft systems or engines during this process. Ten fuel samples were taken from the aircraft (5 from each wing) and sent for forensic examination to assess the fuel type, content, additives, potential contamination, and quality. The quarantined filters were also sent for debris analysis. There were no significant anomalies. Very small amounts of debris were found in the filters but no microbiological growth.

Engines An initial borescope inspection was made of the engine compressors’ first stage rotors and guide vanes to look for obvious signs of soft body damage6 caused by any contact with ice. The first stages of each engines’ HP and power turbines were borescoped via the combustion chamber igniter plug ports and the exhaust ducts. The combustion chambers, inner liners and the first stage turbine nozzle shields were also visually examined. No obvious signs of damage were evident on the first stages of the compressors, the turbines, nozzle shields or combustion chambers and liners. Powerplant anti-ice system To determine the operational status of the powerplant anti-ice systems, the engines were started, the engine anti-ice systems selected on and the left and right engine anti-ice ammeter switches set to ‘Prop’ and ‘Intake’ in turn. In most cases, the ammeter indications were within their respective green bands. The ammeter showed that the heating element on one of the three blades on the left propeller was inoperative. With the engines at idle, the respective TGTs increased by 30 to 50°C when anti-ice was switched on and returned to their original temperatures when switched off, indicating the system was functioning as expected. The appropriate green anti-ice warning caption illuminated when the system was selected. The engines were removed for further examination and component testing. Footnote 6 Soft body damage is caused when material that is softer than the blades causes damage such as bending of the aerofoil surfaces during impact.

11 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 Examination of the engines Both engines were examined and dismantled together so comparisons could be made if potential issues were found. No external damage was visible other than fraying of an igniter cable braided metal outer sheath. No anomalies were found when the magnetic chip detectors were removed and examined. When the axial-flow compressor casings were unbolted and split in half to view the rotor wheels and stator stages, there were signs of slight rubbing of the tips of the rotor blades. Figure 4 Some of the corrosion found on the left engine axial compressor wheel hubs Further detailed examination of the left engine’s rotor wheels showed there was heavy corrosion present on their hubs (Figure 4). Despite these issues, there was no damage that could be attributed to ice ingress, a potential overspeed or overheat event during the roll-back and shutdown of the engines. When the centrifugal compressors were removed from the engines, and the outer diffuser casings removed, both the impeller blades and inner casing abradable surfaces showed signs of rubbing. The maintenance organisation and the subsequent report by the engine manufacturer7 stated that the wear was typical of normal engine deterioration. Following engine disassembly, the main ancillary components were bench tested to determine their operational status. Some of the pass-off settings8 of both fuel control units were found to be slightly out of limits. The maintenance organisation considered the out of tolerance settings to be normal for in-service items. The fuel nozzles were placed in a test chamber and a metered, substitute fluid used to show their spray pattern. Minor voids were present in the left nozzle’s spray pattern caused Footnote 7 Thomas, A (2021), ASI0213 Dual Engine IFSD of BN Islander G-CGTC, edition 01, Rolls Royce. 8 Pass-off settings are the fine tolerances required to certify a repaired or overhauled fuel control unit as serviceable.

12 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 by small amounts of carbon build-up partially blocking the nozzle holes, but they were not considered to have been a factor in the engine failures. No faults or anomalies were found with the remaining engine parts or ancillary items during bench testing. Core lock Thermal lock or core lock is a result of the differing cooling effects of air on various rotating metal engine components. Tolerances between moving and stationary turbine parts can be compromised by differing rates of thermal contraction as the engine cools following an in‑flight shutdown, causing them to temporarily lock together to prevent engine rotation. Meteorology Across Northern Ireland, the meteorological conditions on the evening of 12 November 2020 were characterised by an active cold front crossing from the west. This brought a band of rain, heavy in places, across the region as shown in Figure 5. Figure 5 Met Office radar images for 1900, 2000 and 2100 hrs

13 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 Thick layers of cloud existed within this frontal zone from around 1,500 ft amsl, occasionally lowering to 700 ft amsl, with cloud tops up to 16,000 ft amsl. Analysis of a radiosonde ascent showed the 0°C Isotherm was around 8,500 ft and the +5°C Isotherm around 4,500 ft. Due to the very high liquid water content in the atmosphere, sustained flight in or around the 0°C Isotherm could lead to a risk of severe airframe icing developing. The relevant from F215 (Figure 6) forecast the presence of moderate icing with a risk of severe icing on the cold front. Figure 6 Met Office F215 forecast Weather Below 10,000 ft Airfield information Eglinton, (Figure 7) is a regional airport on the south bank of Lough Foyle. Runway 08/26 is 6,460 ft long and has an asphalt surface. The runway is equipped with an ILS for both landing directions and there is an NDB on the airfield. The NDB radiates 24 hours a day and the ILS is left radiating on whichever runway is in use at the close of the ATC watch. When the ATC watch closed on 12 November 2020 the ILS was radiating on Runway 26.

14 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 Figure 7 Eglinton Airport diagram While not intended for use out of aerodrome operating hours the ILS would have provided guidance in azimuth and elevation and could have been of assistance in locating the runway. Personnel Pilot The aircraft was operated by a single pilot. Under current regulations a pilot must cease commercial single-pilot operations at age 60. The incident pilot was 59 at the time of the event and was aware that once he reached age 60 he could no longer be employed as a pilot. His contract indicated he would be offered alternative employment until a retirement age of 67 and he intended to continue in employment until then. He had raised the matter through the unit’s chief pilot. The operator had approached its parent organisation’s human resources (HR) department in October 2019 to seek guidance on what employment would be available to the pilot after his 60th birthday. Although repeated requests had been made before the event, which occurred two months before the pilot’s 60th birthday, there had been no offer of alternative employment. The pilot stated during interview that the uncertainty over his future, and other personal stressors, had contributed to him feeling worried and had caused his sleep pattern to be badly disrupted. He stated that the stress he was experiencing had the effect of making him feel angry more easily, but he had not thought it would affect his flying performance and had not considered seeking any kind of emotional or psychological support.

15 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 Sleep history The commander’s description of his sleeping patterns indicated that he usually gave himself sufficient sleep opportunity but suffered disturbed sleep, with early waking or periods of wakefulness on the four nights prior to the incident. The pilot slept for about six hours on the night immediately before the incident, compared to his reported sleep need of approximately nine hours. Observers The observers, though necessary for the operational role, were carried aboard the aircraft as passengers and not as technical crew. They were not therefore subject to flight time limitations or other crew regulations. However, the operator had embarked on a Crew Resource Management programme to enhance the integration of the observer activities with the overall operation of the aircraft, which included some simulator training on the operator’s helicopter types. Checklists The aircraft was routinely operated by a single pilot. Consequently, all the normal and abnormal checks were conducted by the pilot without assistance from or monitoring by anyone else. The operator’s Operations Manual stated the following about use of the aircraft checklists. ‘For normal operations, the Flight Crew adopt a flow system. For each phase of flight, the Flight crew member actions the relevant switches and required configurations using a well-practiced route and order around the flight deck. They will then follow up with “Set-Up Redundancy,” using the Normal Abbreviated Checklist, to check the relevant actions and configurations have been completed. All Emergency and Abnormal checks should be carried out using the appropriate checklist. Items printed in bold on the aircraft Emergency and Abnormal checklist MUST be committed to memory.’ Reference is made to checks for icing in the pre-takeoff, climb and cruise checklists but these checks relate to particular flight events. There was no procedure specified in the operator’s manuals for entry into IMC or icing conditions, so selection of ice protection required pilots to recognise if such conditions existed. The aircraft’s Primary Flight Display and Multi-Function Display show total air temperature, indicating when the temperature is in the band for icing to occur, but there is no colour change or other warning to draw the pilot’s attention. There was no system fitted to the aircraft specifically to detect or alert the pilot to the existence of icing conditions.

16 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 The AFM Supplement covering flight into known icing contained a checklist for entry in IMC:

Figure 8 Checklist for entering cloud The pilot stated that he was aware of this checklist but had not used it during the incident flight. It was not a part of the normal checklist card carried in the aircraft cockpit. The aircraft checklist contains actions for the failure of both engines: Figure 9 Failure of both engines checklist

17 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 This is an emergency checklist intended to be completed from memory by the single pilot. Should the first two items not result in an immediate restart then the remaining items prepare the engines for an air start. The air start checklist is shown in Figure 10. Figure 10 Air start checklist The pilot stated that after both engines failed he was “shocked and confused.” His immediate feeling was to fear for the lives of all onboard. His initial focus was on the possibilities for a forced landing. As a result, he did not attempt an immediate relight but began the air start procedure once established in the glide. Organisational information Most of the operator’s flights were conducted in VMC. While all the operator’s pilots had instrument ratings, they exercised them less frequently than would be usual in some other commercial aviation environments. The operator had two similar aircraft, but differences between them had led to different clearances for operating in known icing conditions. While the incident aircraft was cleared for unrestricted flight in icing conditions the other aircraft was not cleared for flight in airframe icing. There had been frequent discussion about the icing clearance and the issue had led

18 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 to a drop in confidence among the crew about operating in such conditions. For example, during the incident flight the pilot chose to operate below the 0°C isotherm even though there was no technical requirement for the incident aircraft to remain clear of airframe icing conditions. The operator did not include specific training in winter operations in its recurrent programme. Stress, fatigue and performance CAP 737 – Flight-crew human factors handbook9 defines stress on a human being as: ‘The body’s non-specific response to demands placed upon it, whether these demands are pleasant or unpleasant.’ and ‘An unresolved pressure, strain or force acting upon an individual’s mental or physical systems which, if continued, will cause damage to those systems.’ It states that continued stress can create physical symptoms such as insomnia and irritability. The document also lists some performance and behaviour issues associated with stress, including omitting to carry out actions. CAP 737 lists the effects of fatigue, including ‘easy distraction’, ‘increased slips and mistakes’ and ‘abnormal mood swings.’ Fatigue is defined by the International Civil Aviation Organisation (ICAO) as: ‘A physiological state of reduced mental or physical performance capability resulting from sleep loss or extended wakefulness, circadian phase or workload (mental and physical activity) that can impair a crew member’s alertness and ability to safely operate an aircraft or perform safety related duties.’ The ICAO Fatigue Management Guide10 summarises the scientific principles of fatigue management and states: ‘losing as little as two hours sleep on one night will reduce alertness the next day and degrade performance on many types of task.’ Support for pilots Negative life events and stressors can have a detrimental effect on anyone’s wellbeing. Pilots are not immune and may need support in times of stress. Common options including seeking support from a line manager, HR department or doctor may not appeal if the individual is concerned about confidentiality or fears the loss of their licence or medical certificate and therefore livelihood. Footnote 9 Civil Aviation Authority (2014) CAP737 Flight-crew human factors handbook. https://publicapps.caa.co.uk/ docs/33/CAP%20737%20DEC16.pdf [accessed on 30 April 2021] 10 International Civil Aviation Organisation (2015) Fatigue Management Guide for Airline Operators. https:// www.unitingaviation.com/publications/FM-Guide-Airline-Operators/#page=1 [accessed on 30 April 2021]

19 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 Confidential peer-to-peer support programmes are considered particularly suitable support mechanism for pilots. Pilots are considered more likely to be open with a fellow professional who does the same job and understands the unique stresses and demands of it. A pilot peer support programme can be described as follows: ‘A structure whereby a pilot can get confidential help with mental wellbeing or life stress issues, either for themselves or for a colleague. The confidentiality of the process is absolute, except for certain clearly defined circumstances which are standard medical practice. At the heart of the programme are Pilot Peers: ordinary line pilots who are trained in basic listening and counselling skills, and who have extensive knowledge of company policies which can assist the pilot in addressing their problems. These Peers are trained, mentored and supported by a suitably qualified Mental Health Professional (MHP)’11 Pilot peer support programmes also provide anonymised data to operators to feed into the safety management system. This can help an organisation to identify and manage risks associated with poor mental wellbeing. The investigation did not find any published evaluations of pilot peer support programmes. Pilot support guidance and practice in the UK There are no regulations in the UK requiring commercial air transport operators to provide access to a support service specifically for pilots. The CAA has been encouraging operators to implement pilot support for several years and published CAP 1695 Pilot Support Programme – Guidance for Commercial Air Transport Operators12 in September 2018. Several larger operators within the UK have implemented in-house pilot support programmes and many smaller UK operators have contracted third parties to provide them. In July 2020, the CAA issued Safety Notice SN-2020/01413 that stated: ‘Support Programmes are key. It remains essential that senior management of all aviation stakeholders, mental health professionals, trained peers, and in many cases representative organisations of crew members and safety sensitive personnel work together to enable self-declaration, referral, advice, counselling and/or treatment, where necessary when mental or wellbeing issues arise. CAT operators are strongly encouraged to continue with their maintenance of or preparations for introducing Support Programmes.’ Footnote 11 European Pilot Peer Support Initiative (2019). Pilot peer support programmes: The EPPSI guide. https:// www.ifalpa.org/media/3519/eppsi-guide-v81.pdf [accessed on 26 April 2021] 12 https://publicapps.caa.co.uk/docs/33/CAP1695%20-%20Pilot%20Support%20Programme_SEP18.pdf [Accessed on 15 March 2021] 13 https://publicapps.caa.co.uk/docs/33/SN%20-%20The%20Effect%20on%20Mental%20Health%20 From%20Return%20To%20Work%20Due%20to%20Covid%2019.pdf [accessed on 17 March 2021]

20 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 In January 2021, the CAA issued Safety Notice SN-2021/00414 which stated: ‘CAT operators are strongly recommended to continue to introduce Flight Crew Support Programmes as required by the Regulation [Regulation EU 2018/1042] and to maintain existing programmes despite a deferred implementation date.’ Pilot support regulation and guidance in the EU Regulation EU 2018/1042 introduced requirements in commercial aviation for pilot support: ‘The operator shall enable, facilitate and ensure access to a proactive and non-punitive support programme that will assist and support flight crew in recognising, coping with, and overcoming any problem which might negatively affect their ability to safely exercise the privileges of their licence.’ Implementation was postponed from 14 August 2020 until 14 February 2021 by Commission implementing Regulation (EU) 2020/745 of 4 June 2020 to account for delays caused by public health restrictions. Consequently, the new regulations were not in force and applicable before the UK left the EU on 31 December 2020 and were not therefore automatically applicable in the UK at the time of the occurrence. The CAA stated that the Statutory Instrument necessary to implement Regulation EU 2018/1042, in whole or in part, is intended to be laid before parliament on 31 October 2021. The Statutory Instrument will come into force (as UK law) 21 days later, and the CAA would expect applicable operators in the UK to be fully compliant with the requirements within 90 days of the law coming into force. Educational aspects of pilot support Santilhano (2019)15 found in her research that, ‘the historical emphasis in aviation on identifying physical symptoms of incapacitation may contribute to pilots’ lack of understanding or awareness of their emotional and psychological well-being, subsequently failing to see it as impacting their fitness to fly.’ The Acceptable Means of Compliance16 that accompanied Regulation EU 2018/1042 specified that the support programme should contain as a minimum: ‘procedures including education of flight crew regarding self-awareness and facilitation of self-referral’ and ‘involvement of trained peers, where trained peers are available.’ Footnote 14 Safety Notice SN-2021/004 Update to the introduction of UK Regulation No. 2018/1042 of 23 July 2018 and 2020/745 of 4 June 2020 amending Regulation No. 965/2012 http://publicapps.caa.co.uk/docs/33/ SafetyNotice2021004.pdf [accessed on 17 March 2021] 15 Santilhano, W., Bor, R. and Hewitt, L.M.M. (2019). The role of peer support and its contribution as an effective response to addressing the emotional well-being of pilots. Aviation Psychology and Applied Human Factors, 9(2), 67-76 16 AMC3 CAT.GEN.MPA.215 Support Programme.

21 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 The guidance material17 suggested that the education of flight crew should include: ‘Positive impacts of a support programme Awareness of job stressors and life stressors – mental fitness and mental health Coping strategies Early recognition of mental unfitness Principles and availability of a support programme’ The AAIB observed an example of an introductory education module for UK aviation personnel that covered these aspects. At the end of the module, participants were asked if they would now feel confident contacting the peer support service. Of 23 responding, two said ‘I still have concerns about using the service’, 11 that ‘I already knew about the service and am happy to use it’ and 10 said ‘I wasn’t aware of the service but am happy to use it.’ Support at the operator The parent organisation of the operator offered a self-referral confidential counselling service for all employees, intended to provide support with worry and stress. The service was publicised in emails from the occupational health and wellbeing department of the parent organisation, but the pilot was not aware of it before the occurrence. The operator did not offer a support service specifically for pilots. The operator reported that it had been encouraged by the CAA to implement one but, at the time, felt that the informal support offered within its small pilot community was sufficient. However, public health restrictions meant there was little contact between pilots at the unit in the lead-up to this incident. Consequently, there was little opportunity to seek or offer informal support. A representative of the operator’s HR department explained that staff shortages and pressures created by public health restrictions, as well as the legal complexity of the situation, had hampered the resolution of the pilot’s employment status. Analysis Introduction The investigation found no evidence of defects in the aircraft engines, anti-ice systems, fuel system or the fuel itself that could have caused the double engine failure. Operation of the aircraft The pilot was particularly concerned by the threat of airframe icing conditions, which he covered in his pre-flight briefing. At that briefing he had decided to operate the flight below the 0°C isotherm to avoid the risk of airframe icing. After the initial low level tasking the aircraft climbed to higher altitude to undertake its originally planned tasking. During that Footnote 17 GM3 CAT.GEN.MPA.215 Support programme, training and awareness

22 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 climb the pilot recognised that the aircraft would enter IMC conditions and recalled selecting the engine anti-icing on before entering cloud. However, he did not recall the existence of the eng anti-ice captions and could not confirm if they illuminated. It is likely therefore that he did not select the engine anti-icing system on before entering engine icing conditions despite his recollection that he did so. A build-up of ice in the engine intakes would then have precipitated the failure of both engines. The operator’s pilots were more familiar with operating in VMC and it is likely they had a lower awareness of the risks posed by operating in engine icing conditions than if they had done so more frequently. In this single-pilot operation there was no challenge-an‑response process for entry into IMC, and no means of trapping an omission to select engine anti‑icing. It therefore represented a single failure path to double engine flameout. After the engines failed the pilot promptly established the aircraft in a glide descent toward Eglinton. He asked for assistance from Aldergrove ATC, who were able to provide vectors but unable to assist with reopening Eglinton in time for a landing there. The loss of engine driven generator power following the engine flameouts resulted in failure of many electrical services, including the topographical map display. The pilot’s iPad also failed and initially he found himself with limited navigation information. Aldergrove ATC lost radar contact as the aircraft descended. One of the observers recognised that the pilot was in difficulty and immediately went to the cockpit to assist, taking with him an iPad with a mapping application that he and the pilot used to navigate to Eglinton. His presence and support to the pilot assisted in the conduct of the restart drills and the approach to Eglinton. During the descent the right engine restarted on the first attempt. The left engine required three attempts to restart. The pilot attributed this to the igniters not being selected, though it is possible that the left engine was also affected by the core lock phenomena. Once both engines had restarted the pilot and observer used the iPad to position for a landing at Eglinton. The observer was not aware that the ILS would be radiating, and this was not considered by the pilot. Because it was unlit the crew identified the aerodrome quite late in the approach and flew a circuit to land. The pilot began a descent from the circuit based on the position shown on the iPad and only positively identified the aerodrome visually on the approach at approximately 300 ft agl. The rate of descent was variable and much higher than usual during the latter stages of the approach, but a safe landing was achieved. Although both engines had restarted the pilot was sufficiently concerned about the prospect of further engine issues that he rejected the option of a transit to Aldergrove. This would have offered a fully lit airfield, ATC assistance and approach aids, but would have extended the flight by approximately 20 minutes. Pilot wellbeing and support The unit’s chief pilot had attempted to resolve the pilot’s contractual situation. The operator’s HR department stated that staff shortages and public health restrictions in place at the time had hampered their efforts. The delay meant that the pilot had been uncertain about his future for about a year at the time of the incident, and he stated that the stress he was experiencing disrupted his sleep.

23 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 In the days leading up to the event the pilot stated that he had suffered a period of disturbed and restricted sleep which he considered arose from various stressors, primarily his contractual situation and the lack of a resolution to it. On the night before the incident, he had lost approximately three hours sleep and his sleep quality on the preceding three nights was poor. One effect of both stress and fatigue is irritability or difficulty regulating mood. The commander described his exasperation at the repeated change of tasking instructions during the departure, and the stress and fatigue he reported may have been a factor in this. The pilot reported that he considered his flying performance would not be affected by the worry he was feeling about his future or the effects of disrupted sleep, and he did not consider seeking assistance. It was not possible to determine whether stress and fatigue were a factor in the pilot omitting to turn on the engine anti-ice system, but the relationships between stress, disrupted sleep and impaired human performance are well established and are acknowledged hazards in aviation. The limited social contact at the unit in the period leading up to the incident provided little opportunity for others to notice any observable symptoms, and the ad hoc social support that the unit relied on was also not readily available. The pilot was not aware of the confidential self-referral counselling service that was available to all the company’s employees. There was no applicable regulatory requirement for a pilot support programme at the time of the incident, though the CAA had encouraged all CAT operators to introduce one. Following the model of Regulation EU 2018/1042, such a programme would include education to raise pilot awareness of and access to confidential peer support. The incident pilot did not identify in himself the effects of the various stressors or recognise that they might represent a flight safety hazard. The example training observed as part of this investigation appeared effective in raising awareness that a confidential support facility was available, helping pilots to recognise the hazards and refer themselves for assistance if necessary. The CAA stated that the Statutory Instrument necessary to implement Regulation EU 2018/1042, in whole or in part, is intended to be laid before parliament on 31 October 2021. The Statutory Instrument will come into force (as UK law) 21 days later, and the CAA would expect applicable operators in the UK to be fully compliant with the requirements within 90 days of the law coming into force. Engines During examination of the engine components and operational testing, voids were found in the left fuel nozzle’s spray pattern due to carbon build-up. The engines’ fuel control unit idle speeds were slightly out of tolerance, there was some wear of the axial and centrifugal compressor blades, and there was corrosion present in the left engine’s axial compressor wheel hubs. However, these issues were attributed to normal wear and tear typical in use. There was no evidence of damage to the engines that may have been caused by ice, overtemperature or overspeed events.

24 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 The results of fuel testing and forensic analysis of the fuel samples and filters indicate that the fuel system and contents were not a factor in this incident. The failure of the heating element on one of the propeller blades would not have caused the engines to fail, and there was no other evidence of mechanical or electrical defects that would have caused or contributed to the incident.

The AFM caution in paragraph 2 of section 4.17.e ‘Use of Engine Anti-ice System’ is informative: ‘Caution… The formation of intake ice may cause rapid power loss. Selecting Power ENGINE ANTI-ICE to FAST or SLOW, after intake ice has formed, may cause engine flame-out.’ It is likely that the initial loss of propeller torque observed by the pilot was a result of ice forming on the engine intake ducts. The absence of soft body damage on the axial compressor blades does not necessarily mean that ice was not present: the ice may have melted or softened sufficiently to avoid damage to the compressor when it was released from the intake ducts. If anti-ice was selected after ice had formed, it would have melted and loosened the ice causing a combination of water and ice to enter the engines’ compressors and progress into the combustion chambers. This could have interrupted the combustion process, however, when anti-ice is selected the igniters operate continuously to maintain combustion and resist engine roll-back. If the pilot did not select powerplant anti-ice, it is likely that a rapid build-up of ice formed around the engine intake ducts when the aircraft entered cloud, choking the engines of air resulting in roll-back and shut down. The fact that both engines shut down within a short time of each other adds weight to this possibility. As the aircraft descended and the outside air temperature increased, the ice may have melted sufficiently to unblock the ducts enabling the pilot to restart the right engine. It took some time to restart the left engine, and thermal (core) lock may have been a factor. Conclusion It is likely the engine anti-icing system was not selected on before entry into cloud with an outside air temperature less than 5°C. A build-up of ice in the engine ducts probably caused the engine symptoms noted by the pilot and the subsequent rollbacks and flameouts. The investigation found that the pilot’s limited recent experience in icing conditions was likely to have been a contributory factor, and that circumstances causing stress and fatigue could have affected his performance. Both engines were relit during the descent and a safe landing was made at Eglinton, although the airport was closed.

25 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-CGTC AAIB-27032 Safety action The operator has taken the following action: Introduced a standard system of icing conditions briefing and checks for all the operator’s flights. This includes pre-flight briefing of icing conditions along with actions required and the impact of any aircraft system unserviceabilities. Inflight use of a standard response to any change of altitude such as “Levelling FL70, temperature 2°C, engine anti-icing is on.” Emphasis on ‘Standard’ climb and descent checks. Secured funding to provide an update to the TAWS database on the incident aircraft. Introduced icing checklists that can be called for by either the pilot or the observers. Introduced biannual ground training days for all pilots. Re-issued a winter operations briefing to all pilots. Enhanced training for individuals based on examiner, management pilot and individual input.

Produced cockpit aide memoires to cover icing related issues. Increased communications with pilots relating to mental wellbeing and access to a specific aviation-focused peer support programme within the flying operation in addition to the confidential counselling service already available within the parent organisation. Published: 16 September 2021.

FD06705 ｜ 2021_英国_aaib-investigation-to-boeing-777-336er-g-stba__Boeing_777-336ER_G-STBA_12-21.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

33 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-STBA AAIB-27450 SERIOUS INCIDENT

Aircraft Type and Registration: Boeing 777-336ER, G-STBA No & Type of Engines: 2 General Electric Co GE90-115B turbofan engines Year of Manufacture: 2010 (Serial no: 40542) Date & Time (UTC): 2 July 2021 at 0945 hrs Location: London Heathrow Airport Type of Flight: Commercial Air Transport (Cargo) Persons on Board: Crew - 16 Passengers - None

Injuries: Crew - 1 (Minor) Passengers - N/A Nature of Damage: None Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 53 years Commander’s Flying Experience: 17,000 hours (of which 10,300 were on type)

Last 90 days - 91 hours

Last 28 days - 24 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis A fire cargo aft warning illuminated during the pre-start procedures. The crew were advised by RFFS to conduct a rapid disembarkation via an airbridge. One cabin crew member suffered minor injuries during the disembarkation. The fire warning was triggered when a short circuit in the battery pack of a refrigerated container in the aft cargo hold caused heating of cables and smoke. Safety action was taken by the operator and container manufacturer to reduce the probability that damage to a container would lead to such an event again. History of the flight During the pre-start procedures a fire cargo aft warning illuminated, and the fire bell audio warning sounded. The crew actioned the fire cargo aft checklist from the Quick Reference Handbook (QRH). If the aircraft is on the ground with cargo doors open the fire cargo aft checklist states that the checklist should only be accomplished if there is an actual fire. Therefore, the additional co-pilot on the crew was asked to go to the cabin and investigate. He initially went to the rear of the aircraft cabin and looked out from the windows to the area of the rear cargo door. He could see that the door was open but at this point there were no signs of fire or any fumes in the cabin. He returned to the flight deck and reported these findings to the commander.

34 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-STBA AAIB-27450 The additional co-pilot then went outside the aircraft to liaise with the loading crew and to ascertain if there was an actual fire. Due to the long airbridge jetty there was a significant elapsed time before the co-pilot reached the ground. On board, the cabin crew reported to the commander that there were acrid fumes in the passenger cabin. The commander decided to pause the fire cargo aft checklist to instead commence the smoke, fire and fumes checklist. Shortly after the fire cargo aft occurred, the indications cleared indicating that the relevant condition was no longer being sensed. A public address (PA) broadcast was made to alert the cabin crew and a PAN call was made by RTF to alert ATC and to request fire service assistance. The PA to the crew was an ‘Attention Crew! At Stations’ call which is intended to prepare the cabin crew to respond to an emergency situation. It requires all cabin crew members to go to their allocated seating positions adjacent to exit doors. So, in response to the call some of the crew were positioned toward the rear of the aircraft in the area of the fumes. As the additional co-pilot approached the rear cargo hold, he saw two of the loading team running clear of the aircraft. They reported to him that there were acrid fumes in the rear cargo hold. Immediately after this conversation, the RFFS arrived and the co-pilot had a brief discussion about the situation with the RFFS commander. The RFFS commander then told the co-pilot that he wished the aircraft to be cleared of personnel. The additional co-pilot returned to the aircraft to pass on the direction for a precautionary disembarkation of the aircraft via the air bridge which was connected to the left No 2 passenger door. After informing the commander, the additional co-pilot was directed to inform the cabin crew. The APU was shut down and the aircraft secure checklist was completed, and the crew left the aircraft via the airbridge. During the disembarkation one of the cabin crew tripped on a cargo net which was being used to secure cargo in the passenger cabin. The total time from the fire warning sounding to all crew being off the aircraft was approximately 8 minutes. Organisational information The use of the ‘Attention Crew! At Stations’ Call is described in Part B of the Operator’s Operations Manual (OMB). The relevant section is shown in Figure 1. The OMB gives the information at Figure 2 for the use of a rapid disembarkation PA. The commander was aware of this PA but considered its wording to be inappropriate for the situation.

35 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-STBA AAIB-27450 Figure 1 Use of ‘Attention Crew At Stations’ Figure 2 Rapid Disembarkation Procedure

36 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-STBA AAIB-27450 Cargo investigation The rear hold cargo was removed from the aircraft and examined by the RFFS. A refrigerated container was identified as the source of the fumes. The back wall of the container was opened by the RFFS and the container battery pack confirmed as the source. After the RFFS had disconnected the batteries, the container was taken to a warehouse at Heathrow and then subsequently returned to the manufacturer for further examination. The manufacturer’s investigation report stated that: ‘the smoke was a consequence of improper handling of the container, which led to a short circuit of two of the batteries. The short circuit was caused by a significant impact/collision on the back of the container, where the affected batteries are located.’ Photographs of the damage are at Figure 3. Figure 3 Impact damage to container In the opinion of the manufacturer the damage was the result of a significant impact to the container, beyond what should be expected in routine handling. The deformation caused a bracket in the battery compartment to be torn from its mounting. The manufacturer made the following finding: ‘As one of the brackets to secure the batteries had been compromised, the batteries were able to shift sideways which led to the battery cables/poles rubbing against a secondary securing bracket. As a result, the battery cables sheared and heated which led to a short circuit as expected. This prevented any further incident to the container electrics that would lead to a fire outbreak. The heating of the cables caused the smoke which highlighted the incident to the ground handler.’

37 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-STBA AAIB-27450 The manufacturer described the cables as “short circuit proof” and gave the following information: ’The safety systems designed to prevent a fire have worked correctly. The observed smoke is due to the heated battery cables which were a result of the short circuit. These short-circuit-proof cables are designed to perform in such a way that in the event of a short circuit, smoke is produced, but no fire. This prevents any further damage to other parts of other container, the area surrounding the container and the aircraft too. The short-circuit-proof cables functioned as expected in instance.’ Data recorded by the container indicated it had last been charged between 0755 and 0839 hrs on 2 July 2021. At that time no abnormalities were recorded and there were no reports of smoke being observed. The manufacturer believed, therefore, there was no short circuit at that point. Analysis The fire cargo aft warning QRH checklist directs that, with the cargo door open, the aircraft’s cargo fire extinguishers should only be discharged if the presence of a fire can be confirmed. The commander sent the extra pilot on the crew to investigate the situation while he and the co-pilot actioned the QRH and communicated the issue to ATC. On hearing reports of fumes in the cabin, the commander decided to action the QRH checklist for smoke, fire and fumes. In common with the fire cargo aft checklist the actions are principally intended for situations where the aircraft is in flight. The QRH did not therefore present any step-by-step path of action to the crew. The fact that the warning cleared shortly after its appearance indicated to the commander that the situation may not be serious, and he was conscious of gathering evidence to clarify decision making and avoid precipitate action. The ‘Attention Crew! At Stations’ PA is intended for use after doors close and directs all of the cabin crew to take their allocated positions next to aircraft exit doors. Some crew members were therefore redeployed from the forward to the aft cabin, into the vicinity of the aft cargo hold. In retrospect, the commander considered that a PA telling the cabin crew to prepare for a rapid disembarkation would have been more appropriate. The operator does have a standard PA for rapid disembarkation via boarding doors rather than evacuation slides. However, the wording of that is very much directed at a situation with passengers on board. In this case, with only cabin crew aboard, the commander felt that the standard wording may have only added confusion rather than giving clear direction to the crew. When the additional co-pilot informed the commander of the advice from the RFFS, the commander then directed him to return to the cabin and tell the cabin crew to leave the aircraft. The examination of the container indicated that it been subject to a collision which caused damage to a battery bracket. The damage allowed the batteries to move position and

38 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-STBA AAIB-27450 cause a short circuit. The electrical system had been designed to tolerate this damage, though the subsequent heating of the battery cables produced the smoke that triggered the fire cargo aft warning. Conclusion A short circuit in the battery pack of a refrigerated container loaded in the aircraft aft cargo hold caused heating of cables in the pack and, therefore, smoke to be produced. The smoke was detected by the aircraft fire detection systems and a fire cargo aft warning was triggered. The crew disembarked through the boarding door. Safety Action Following this event, the following Safety Action was taken: The container manufacturer decided to consider reinforcing the battery attachment and, if necessary, make modifications to improve the functionality and safety of the container. The operator decided to consider introducing a comprehensive damage check on all similar containers before they are loaded onto aircraft.

FD06706 ｜ 2021_英国_aaib-investigation-to-boeing-787-9-g-zbkf__Boeing_787-9_G-ZBKF_05-21.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1 © Crown copyright 2021 All times are UTC AAIB Bulletin: 5/2021 G-ZBKF AAIB-26975 SERIOUS INCIDENT

Aircraft Type and Registration: Boeing 787-9, G-ZBKF No & Type of Engines: 2 Rolls-Royce Trent 1000-J2 turbofan engines Year of Manufacture: 2016 (Serial no: 38622) Date & Time (UTC): 1 October 2020 at 0800 hrs Location: En route to London Heathrow Airport Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 10 Passengers - 53

Injuries: Crew - None Passengers - None Nature of Damage: No aircraft damage Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 49 years Commander’s Flying Experience: 21,200 hours (of which 2,092 were on type)

Last 90 days - 111 hours

Last 28 days - 35 hours Information Source: AAIB Field Investigation Synopsis The aircraft was approaching the top of descent when the cabin crew saw smoke emanating from a passenger seat. It was discovered that a mobile phone had fallen down the side of the seat and had been crushed in the seat mechanism. The cabin crew extinguished the fire and the aircraft continued to its destination. There was no damage to the aircraft. There have been several reports of similar events occurring leading to smoke in the cabin. There are currently no seat design requirements to prevent electronic devices from becoming trapped in seats. Manufacturers and regulators are aware of this issue but it has proven challenging to find a workable solution. The EASA and the SAE International Seat Committee have taken safety action to develop new design standards and recommended practices. A Safety Recommendation is made to the CAA to improve seat design regulations. History of the flight The aircraft was flying from Miami International Airport, USA to London Heathrow Airport. Approximately 40 minutes before landing the flight crew made an announcement that woke a passenger. The passenger moved her seat from the flat-bed position to a more upright position then left her seat to use the washroom. One of the cabin crew asked the passenger if she could stow the bedding whilst the passenger was away from her seat. As she removed the bedding, she smelt a strong odour and noticed a charging cable which was plugged in to the seat socket with the other end down the side of the seat. The smell,

2 © Crown copyright 2021 All times are UTC AAIB Bulletin: 5/2021 G-ZBKF AAIB-26975 which she described as “sulphur”, was getting stronger so she attracted the attention of the Senior Cabin Crew Member (SCCM). At this point they heard a “hissing” sound and a large plume of grey smoke emitted from the seat in a “tornado” motion. They remembered seeing an orange glow in the seat area amongst the smoke. The crew member retrieved a BCF1 fire extinguisher and fire gloves for the SCCM and asked a third crew member to switch the seat power off. The SCCM pulled back the seat padding exposing a device trapped in the seat mechanism. She discharged several bursts of BCF into the device. The crew member then collected a water extinguisher and filled an ice bucket with water. The third crew member contacted the flight crew. Shortly before receiving the call from the cabin crew the flight crew smelt an acrid odour on the flight deck. The cabin crew informed the commander that thick smoke was emanating from a seat in the forward cabin and that they had initiated their firefighting drill. The flight crew started the smoke, fire or fumes checklist and evaluated their diversion options. The third pilot went back to the cabin to assist. After the SCCM had discharged the BCF, the smoke quickly dissipated and the crew were able to clearly see a red mobile phone trapped in the seat mechanism. The crew attempted to remove the device but it was jammed. There was very little heat coming from the device. They checked for secondary heat sources but did not find any. The cabin crew updated the commander. As the source of the smoke had been identified and extinguished and the aircraft was now only 20 minutes from landing at Heathrow the commander decided to continue to Heathrow. He made a PAN call to alert ATC and ensure the fire service met the aircraft on landing. He also made an alert call2 to the cabin crew and gave a NITS briefing3. He then made a further announcement to the passengers. One cabin crew member remained in the vicinity of the seat with an extinguisher to hand for the remainder of the flight. The aircraft landed normally at Heathrow. After landing the fire service boarded the aircraft and removed the device from the seat (Figure 1). There was no damage to the aircraft. Footnote 1 Bromochlorodifluoromethane 2 An ‘Alert call’ is a call made to the cabin crew to alert them all to an abnormal situation. 3 NITS is an acronym used for briefing the cabin crew about an abnormal situation, it stands for Nature, Intentions, Time and Special instructions.

3 © Crown copyright 2021 All times are UTC AAIB Bulletin: 5/2021 G-ZBKF AAIB-26975 Figure 1 Mobile phone retrieved by the fire service after landing Operator’s procedures The operator’s operations manual contained the following information regarding Portable Electronic Devices (PEDs) and lithium battery hazard: ‘The potential hazard from these batteries occurs as a result of over-charging or rapid energy release (short circuit). Fumes and gases will be emitted prior to the battery igniting. The resultant over heating of the cells can result in a cell ‘thermal runaway’. This is where the cells within the battery ignite in a chain reaction. Incidents have occurred as a result of:

● Structural deformation caused by crushed, physically or electrically abused lithium batteries; in extreme cases PEDs have been known to ignite. Damage could be caused by seat mechanisms crushing misplaced PEDs.

● Overheating lithium batteries due to overcharging. CAUTION: A lithium battery has a higher likelihood of catching fire during or following charging.’ The manual specifies that passengers may use PEDs throughout the flight but that: ‘When not being used PEDs must be switched off and disconnected from the seat power.

4 © Crown copyright 2021 All times are UTC AAIB Bulletin: 5/2021 G-ZBKF AAIB-26975 PEDs must not be charged while sleeping. Cabin crew are not required to check that all devices are switched-off or in ‘flight safe’ mode, however they are expected to inform passengers of the appropriate requirements.’ The following PAs are made to inform passengers about the use of PEDs: Prior to departure – ‘during the flight, all electronic devices must be disconnected from the seat power when not in use.’ During the safety demonstration – ‘take care your device does not get lost within your seat. if it does please don’t move it but let one of your cabin crew know. devices must be switched off and disconnected from the seat power socket when not being used in flight.’ During the initial climb and again 40 minutes before landing - ‘if you are seated in our first or club world cabin, please take care that your personal electronic device does not obstruct the adjustment of your seat. if it does get lost within your seat, please do not move the seat and let one of us know.’ The manual contains the following instructions for lost PEDs: ‘Report all PEDs lost in seat mechanisms in the AML. This ensures engineering will remove the item prior to the next flight. Clarify with the passenger: Identity of the item, Exact location where item may have dropped or slipped, Has the seat been moved since misplacing the item CAUTION: Electrically operated seats with trapped PEDs should NEVER be moved electrically or manually.’ In addition to the operator’s standard firefighting procedure the manual contains the following advice relating to PEDs fires: ‘Use a BCF extinguisher to extinguish and prevent flames spreading to additional flammable materials. Take a suitable container or empty metal toilet bin to the location. Don fire gloves. When considered safe to do so place the device inside the container and immerse the PED in water or other non-flammable liquid.’ CAUTION: Water should not be used on, or in the immediate vicinity of, any other piece of electrical equipment.’

5 © Crown copyright 2021 All times are UTC AAIB Bulletin: 5/2021 G-ZBKF AAIB-26975 Operator’s investigation The operator considered that the incident had been managed appropriately by the crew. However, it identified the following aspects which it will review to determine if any change is required to its procedures or training:

● The SCCM becoming directly involved in fighting the fire instead of allowing the crewmember that found the fire to fight the fire.

● The crewmember did not dowse the device with water because they believed this would damage the seat electrics or impact on the spill hazard zone.   Operator’s seat design The seat type involved was designed approximately ten years ago. They were designed to limit the chance of a PED becoming trapped, but it was found to be challenging to remove the risk completely. Additionally, since they were designed, PEDs have become smaller, batteries have become more powerful and the number of devices passengers carry has increased. Since they were first designed the operator has made further improvements to the seat to further reduce the likelihood of devices becoming trapped in the mechanism.

EASA safety information bulletin In December 2015 the EASA published a safety information bulletin4 regarding passenger awareness of the risks of lithium batteries. It recommends that: ‘Aircraft and aerodrome operators make passengers aware of the risks caused by PED as a result of the battery being potentially short-circuited or damaged if caught in the movable part of seats, and that they should call a staff member when such situation occurs and/or whenever any abnormal situation is suspected, either on board the aircraft, or at the aerodrome.’ Other events The CAA reviewed its Mandatory Occurrence Report database and found 166 previous reports of PED’s becoming trapped in passenger seats in the last five years. Of these events 42 resulted in a fire or smoke in the cabin. Boeing reviewed its safety reporting database and, among the reports of PED failures, was able to confirm three specific events where PEDs were trapped in a seat.  Much of what had been reported did not detail trapping within a seat or was vague in the event description but, in these three instances, the events were managed with existing crew procedures. 

Footnote 4 Available at https://ad.easa.europa.eu/ad/2015-28 (accessed 15 December 2020)

6 © Crown copyright 2021 All times are UTC AAIB Bulletin: 5/2021 G-ZBKF AAIB-26975 Seat design requirements Neither the CAA, the EASA nor the FAA currently require seats to be designed to prevent PEDs from becoming trapped or crushed. The EASA reported that this is a known issue and seat manufacturers have tried to design seats to minimise the risk. However, it has been challenging to design moving seats that eliminates the chance that a device can fall into its mechanism. Following this investigation, the EASA requested the SAE International5 Seat Committee to develop design standards and/or recommended practices to address the issue. It reported that the committee intends to update the Aircraft Seat Design Guidance and Clarifications document (SAE ARP 5526) and incorporate this in the initial release of the Performance Standard for Seat Furnishings in Transport Aircraft document (SAE AS6960). The publication of these documents is planned for late 2021. Analysis A passenger’s mobile phone became trapped in the seat mechanism and was crushed when the seat was adjusted. This damaged the battery, generating flames, smoke and fumes. The cabin crew were able to extinguish the fire using their existing procedures. The operator makes announcements to passengers on all flights with electrically powered seats to try to prevent PEDs becoming lost in seats, as recommended by the EASA. They have also tried to design the seats to limit the chance of PEDs being crushed in the mechanism. However, these events continue to occur. The CAA has received 166 reports of PEDs lost in passenger seats in the last five years. A quarter of these events resulted in fire or smoke in the cabin, demonstrating that this is a significant hazard to the safety of the aircraft. There are currently no CAA or EASA requirements to design seats to prevent damage to PEDs which become accidentally trapped, despite this being a known issue. The SAE international seat committee is taking safety action to develop design standards and/ or recommended practices to address the issue. The AAIB makes the following Safety Recommendation to ensure these design standards and/or recommended practices are developed and adopted: Safety Recommendation 2021-017: It is recommended that the Civil Aviation Authority require that passenger seats in commercial air transport aircraft are designed to minimise the chance of portable electronic devices becoming crushed in mechanisms. Footnote 5 SAE International is a global association of engineers and related technical experts in the aerospace, automotive and commercial-vehicle industries. One of their purposes is the development of voluntary consensus standards.

7 © Crown copyright 2021 All times are UTC AAIB Bulletin: 5/2021 G-ZBKF AAIB-26975 Safety Action The EASA has requested that the SAE International Seat Committee develop design standards and/or recommended practices for the design of seats on commercial air transport aircraft to minimise the chance of portable electronic devices becoming crushed in mechanisms Published: 19 April 2021.

FD06707 ｜ 2021_英国_aaib-investigation-to-boeing-a75n1-pt17-stearman-n707tjBoeing_A75N1_PT17Stearman_N707T.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 ACCIDENT

Aircraft Type and Registration: Boeing A75N1(PT17) Stearman, N707TJ No & Type of Engines: 1 Pratt &Whitney R-985 engine Year of Manufacture: 1940 (Serial no: 75-950) Date & Time (UTC): 4 September 2021 at 1448 hrs Location: In the sea off Sandbanks, Poole, Dorset Type of Flight: Private Persons on Board: Crew - 2 Passengers - None

Injuries: Crew - None Passengers - N/A Nature of Damage: Aircraft destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 57 years Commander’s Flying Experience: 4,494 hours (of which 3,581 were on type)

Last 90 days - 175 hours

Last 28 days - 62 hours Information Source: AAIB Field Investigation Synopsis While performing an aerobatic wing walking display over the sea at Bournemouth Air Festival, the aircraft experienced a reduction in engine power. The pilot stopped the display routine and flew the aircraft west, along the coast, with the intention of returning to Bournemouth Airport. The wing walker returned to her seat in the front cockpit. Although the aircraft was initially able to maintain height, the engine subsequently experienced a complete loss of power and the pilot ditched in the entrance to Poole Harbour. The aircraft flipped over on contact with the water, but both occupants were able to exit the aircraft unaided. The investigation determined that during the display the engine suffered a loss of engine power due to failure of the oil inlet pipe, most likely due to fatigue, which prevented oil being supplied to the engine. This was precipitated by a fatigue failure of the metal strap which supported the weight of the oil inlet pipe. The fatigue failure initiated at an area of mechanical damage on the surface of the support strap, which had been caused by over- tightening of the retaining nut. History of the flight The aircraft was part of a two aircraft display team performing at the Bournemouth Air Festival from 2 to 5 September 2021. The team consisted of four people, with one pilot and one wing walker in each aircraft. Following the flight on 3 September 2021, the pilot of N707TJ refuelled the aircraft and confirmed that the oil level was between 7 and 8 USG.

2 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 On the day of the accident the team met to discuss the planned display routine. This included a walk-through of the display sequence and discussion of actions to take in the event of various types of emergencies. The discussion included the technique required for ditching the aircraft and the actions for egress in the event of a ditching. Prior to starting the engine, the pilot turned the propeller by hand to ensure there was no oil pooled in the lower cylinders. He reported that he did not see any sign of oil on the ground. He started and warmed-up the engine in accordance with the operator’s checklist and completed the power checks, which were satisfactory. The two aircraft took off from Bournemouth Airport at 1437 hrs with the wing walkers already on the wing and with N707TJ as the lead aircraft. They changed to the display radio frequency and when at ‘Town Hold’1 were cleared by the Flight Display Director (FDD) to proceed directly to the display area to begin their display. The pilot subsequently reported to the AAIB that the oil temperature and pressure were normal, and the engine was responding as expected. The key locations during the flight are shown in Figure 1. Poole  Studland  Bournemouth  Airport  Ditching  Golf  Course  Sandbanks  Figure 1 Display area and key locations (©Google Earth, map data SIO, NOAA, US Navy, NGA, GEBCO) Footnote 1 Town Hold was a holding point used to manage the aircraft flow to and from the display area situated to the east of the airport.

3 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 The team commenced the display at 1443 hrs and completed the first two manoeuvres during which the pilot reported that the engine rpm was approximately 2,000 rpm and the manifold pressure 32 inches. Positioning for the next manoeuvre, both aircraft flew away from the crowd line and, after increasing power, the pilot noticed that the aircraft was not climbing, and the rpm was lower than expected at around 1,800 rpm. The pilot checked and confirmed that the throttle lever was fully forward. He also checked the fuel, magnetos, and carburettor icing controls, which were all in the correct positions, and the engine temperature and pressure indicators which were normal. As the engine was not delivering full power, the pilot turned to depart the display area to the west. He rocked the wings, which was the agreed signal to attract the attention of the wing walker and indicated by hand signal for her to dismount the wing. The wing walker dismounted, strapped into the front cockpit, and disconnected the wing walking safety restraint. The pilot reported on the display frequency that he had an engine problem and advised that he planned to return to Bournemouth Airport. The pilot of the other aircraft followed N707TJ at a distance and instructed his wing walker to dismount. As N707TJ began to route west along the coast, at about 600 ft above mean seal level (amsl), the engine misfired. The pilot changed frequency to Bournemouth Tower, declared a PAN and was cleared to route direct for any runway. While there was insufficient power available to climb, the aircraft was still able to maintain height. However, not wishing to cross a built-up area at 600 ft amsl and mindful that the engine might stop, the pilot continued to fly west parallel with the coast. His intent was to fly around the west of Bournemouth and Poole and return to the airport over the more open ground to the north. He then noticed oil streaming out of the engine cowling and coming past the cockpit. Recognising that there was no opportunity to land on the beach, owing to the crowds and the available distance between the wooden groynes2, the pilot asked Bournemouth Tower for a steer to an open field and was given a heading to Parkstone golf course. However, the pilot considered that the golf course would be occupied, and a safe emergency landing could not be assured. As he was now approaching the Sandbanks area, and losing height, he set the aircraft attitude to achieve the best glide speed of 70 mph and aimed for some open fields on the Studland side of Poole Harbour. Around this time, the engine produced a loud mechanical noise, vibrated violently, and suffered a significant loss of power. The entrance to Poole Harbour was ahead and the pilot identified an area clear of boats in which to ditch, located between the breakwater and the shoreline, and separated from the channel by a line of poles. He reported that the water was ‘choppy’ and the wind was light from the west. The last speed he observed was 70 mph (stall speed was 55 mph) and that he pulled back on the control column to put the tail into the water first. Video recordings showed the aircraft in a stable descent, with the propeller turning, and it adopted a slightly Footnote 2 A groyne is a barrier built out into the sea from a beach to stop erosion.

4 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 nose-high attitude as it neared the water (Figure 2). On contact with the water the aircraft rapidly flipped over onto its back and came to rest close to the chain ferry slipway on the Sandbanks side of the harbour entrance; the ferry was on the other side of the harbour. The pilot and wing walker exited their cockpits, which were submerged, and were picked up by a small leisure craft. Figure 2 Stills taken from video just prior to ditching (Used with permission) The time from the initial indications of an engine problem to the ditching was about four minutes. The ditching occurred 3 nm to the west of the display area. The pilot of the other aircraft in the formation shadowed N707TJ to the point that it ditched and then orbited for a short time. He declared a MAYDAY to Bournemouth Tower who informed the Distress and Diversion Cell at the National Air Traffic Service Swanwick at 1450 hrs. Emergency response The police control room was informed of the accident at 1452 hrs. Although the accident occurred outside of the air display area, a multi-agency control centre (MACC) established for the Air Festival took control of the incident, with the police as the lead agency. The police coordinated the response with other agencies using local and air show resources. The MACC informed a RNLI vessel supporting the festival that the aircraft had a problem, which then followed the aircraft and arrived on scene shortly after the pilot and wing walker had been rescued by a leisure boat and transferred to a working boat operating in the area.

5 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 The wing walker, who had knocked her head during the accident, was examined by a paramedic on the RNLI vessel. Both the wing walker and pilot were taken by ambulance to hospital for medical checks and released later that day. The FDD made the decision to cancel the remainder of the flying display for that day. Recorded information Photographs and videos taken during the accident flight on 4 September 2021 show heavy oil staining on the underside of N707TJ’s fuselage aft of the engine cowling (Figure 3) and lighter oil staining on the upper fuselage, aft of the rear cockpit. Photographs taken the previous day during and at the end of the display showed no oil staining present. Figure 3 Oil staining on underside of N707TJ (white aircraft) fuselage during accident flight The oil staining was evenly distributed across the bottom of the fuselage and emanated rearwards from the bottom of the engine cowling, which eliminated the possibility that the oil came from the oil cooler or the engine exhaust. The final part of the ditching was captured by CCTV from a nearby hotel which shows the aircraft flipping over very rapidly.

6 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 Aircraft information The Boeing Stearman 75 (Stearman) is a two-seat tandem biplane, with a fixed landing gear and tailwheel configuration. The fuselage is of tubular welded steel construction with a secondary aluminium structure. The wings and centre section have wooden spars covered with aluminium compression struts and steel bracing wires. The fuselage and wings are fabric covered. The accident aircraft, originally powered by a 220 hp Continental engine, was manufactured in 1940 for the United States Navy and remained in service until 1944. The aircraft subsequently transferred to civilian use and was re-registered several times. Over the intervening years the aircraft underwent various modifications, embodied under FAA Supplemental Type Certificates, to increase aircraft performance and allow inverted aerobatic flight. The modifications included in 1974 the replacement of the original engine and propeller with a 450 hp radial Pratt & Whitney R-985-AN14B ‘Junior Wasp’ engine and a constant speed Hamilton Standard 2D30/6101A-12 propeller. In 1988 the aircraft was rebuilt and re-registered as N707TJ. The rebuild included the installation of an overhauled R-985 engine, modification of the fuel and oil systems to allow inverted flight and various aerobatic modifications. The original oil tank was replaced with a larger tank of 8 USG capacity, and this was relocated from the engine bay to beneath the baggage compartment, with associated modifications to the oil system to re-route the supply and return lines. A wing walking rig on top of the upper wing centre section and an aerobatic display smoke system were also added. N707TJ was imported to the UK in 1990 when it entered service with the current operator. The R-985 engine installed at the time of the accident was fitted in 2013 following the failure of the previous engine. Aircraft maintenance N707TJ was primarily maintained by the operator’s engineer. The maintenance was inspected and certified by an external FAA licensed engineer. The most recent annual inspection was completed on 21 January 2021. During this inspection a cylinder was replaced on the engine, a compression check was carried out and an engine ground run performed. Except for a 20-minute check flight flown in April  2021, the aircraft did not fly again until August 2021. In June 2021, the engine mounts and both carburettors were replaced and an engine ground run was carried out. The aircraft was subsequently flown for a total of 6 hours and 50 minutes, over 10 flights between 3 August 2021 and the accident flight. At the time of the accident, the aircraft had accumulated a total of 14,809 hours and the engine had accrued 475 hours since overhaul.

7 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 Accident site The aircraft ditched in the sea in the entrance to Poole Harbour on the Sandbanks side, and subsequently sank. The AAIB did not attend the accident site and the aircraft was recovered from the water by marine contractors under the direction of the Poole Harbour Master. Examination of wreckage Aircraft Photographs taken during and after the recovery of the aircraft from the water showed that the lower right wing had separated at the spar stub and both upper and lower right wings had collapsed on top of the forward cockpit. The aircraft had suffered substantial damage to the upper surface of the fuselage, consistent with it striking the water in an inverted orientation. The tailplane exhibited damage associated with water impact and the recovery. The aircraft was examined by the AAIB several days after the accident, after it had been transported by road to the operator’s facility. The wings had been removed to facilitate transportation. Both cockpits showed evidence of prolonged immersion in water but were otherwise free from damage and the integrity of the cockpit structure was maintained. The engine cowlings were missing, but the engine and propeller were largely intact and free from impact damage. Oil residue was present on the fuselage sidewalls, upper and lower surfaces, and on the engine firewall. There was no evidence of oil in the oil tank. Engine oil inlet pipe Forward of the engine firewall, the oil inlet pipe comprises a flexible section and a rigid section, which is attached to a mounting boss on the bottom of the engine oil pump via a 90º threaded joint. Incorporated in the rigid section of the pipe is a port for the engine oil temperature probe. A metal strap supports the weight of the rigid section of the oil pipe. The strap is retained at its upper end on a mounting stud for one of the oil drain lines and is secured by a nut. Visual examination of the engine revealed that the oil inlet pipe was broken at the point where it attached to the engine casing (Figures 4 and 5). The rigid section of pipe had fractured at the mounting boss and the support strap had fractured at a fastener hole. An area of damage was evident on the flexible section of pipe, but this was limited to a tear in the fire-retardant sleeve on the pipe and the inner pipe was intact at this location. This damage may have occurred during recovery of the aircraft from the water, as the engine cowlings which would normally protect this part of the engine bay were no longer present.

8 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 Figure 4 N707TJ’s engine viewed from right side showing oil inlet pipe Figure 5 Fractured oil inlet pipe and support strap

9 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 Metallurgical examination of the oil inlet pipe and mounting boss General The oil inlet pipe, mounting boss and part of the support strap were subjected to a metallurgical examination. Failure had occurred at a fastener hole in the support strap and on the threaded section of pipe that connected to the mounting boss. Part of the threaded joint remained inside the mounting boss (Figure 6). The support strap and main oil pipe were made from steel. The right-angled threaded end piece of the oil pipe which had fractured was made from a leaded gunmetal casting. It appeared that the gunmetal end fitting had been brazed to the steel pipe. Figure 6 Rigid section of the oil inlet pipe Support strap Visual examination of the support strap at the fracture location showed evidence of mechanical damage (witness marks) around the fastener hole on both sides of the strap (Figure 7). The witness marks were circular in shape and consistent with a nut (possibly in combination with a washer) having been over-tightened. No washer was present when the aircraft was examined.

10 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 Figure 7 Witness marks around fastener hole on support strap outer face (left image) and inner face (right image) Scanning electron microscope (SEM) examination of the fracture surface showed extensive corrosion. After cleaning to remove the corrosion, fatigue striations were observed across most of the fracture surface on both sides of the fastener hole. The fatigue initiated within the mechanical damage around the fastener hole on the outer face of the support strap and propagated towards the inner face. A small amount of overload was observed at the right edge of the fastener hole on the inner face. The end of the fatigue crack on the left side of the fastener hole had been destroyed by mechanical damage (Figure 8). Figure 8 Key failure features identified on the fracture surface of the support strap (Fatigue striations not shown in this image) Oil pipe threaded joint The fracture surface of the part of the threaded joint of the oil pipe which remained inside the mounting boss was examined. Visual examination showed that the topography of the fracture surface was typical of overload failure, with no areas that appeared to be consistent with progressive crack growth. The fracture in the oil pipe occurred in the root of a thread.

11 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 A step was evident in the fracture surface at the 12 o’clock position (Figure 9). In threaded components, this usually occurs at the last part to fracture. This suggests that crack initiation is likely to have occurred opposite to this (around the 6 o’clock position), with the crack propagating clockwise and anticlockwise around the helical thread. At the 12 o’clock position the crack jumped between adjacent threads to form a continuous crack. An area of mechanical damage/smearing was also evident on the fracture surface. A corresponding area of damage on the opposing fracture face indicated that this likely occurred as a result of relative movement between the two fracture faces during or after the final failure. Figure 9 Fracture surface of the oil pipe at root of thread SEM examination of the fracture surface showed extensive corrosion. Cleaning to remove the corrosion product only revealed a surface that had been attacked by corrosion and no real surface detail was visible. Shrinkage porosity was observed on the fracture surface. Shrinkage is a common defect found in cast materials, but without a specification for the casting, it was not possible to determine if the amount of shrinkage exceeded any specified limit. The presence of shrinkage porosity would reduce the load carrying capacity of the casting, and it is therefore possible that it contributed to the failure. Between the 4 o’clock and 7 o’clock positions on the fracture surface, a band approximately 0.3 mm deep that contained ratchet marks was observed at the edge of the thread root. This band is identified by yellow dashed lines in Figure 10, and the ratchet marks as yellow arrows.

12 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 Figure 10 Fracture surface of the oil pipe at edge of thread root, showing ratchet marks in two example locations between the 4 o’clock and 7 o’clock positions Ratchet marks are a characteristic of fatigue cracks and occur when cracks initiate at multiple points on different planes and then join to form a single crack front. Striation-like features were also observed within the 0.3 mm deep band. These features were consistent with fatigue striations and their orientation was consistent with fatigue initiating at the thread root. However, due to the extent of the corrosion it was difficult to positively attribute them to fatigue. Aircraft maintenance The operator’s engineer considered that there was no reason for the oil inlet pipe connection to be disturbed, other than during an engine removal or installation, and he could not recall any maintenance in this area in recent years. Nor was anything relevant recorded in the engine or aircraft logbooks. He therefore considered that the oil pipe mounting boss and support strap would have last been disturbed in 2013, when the most recent engine replacement took place. The aircraft was routinely disassembled, shipped by container and reassembled to fly at overseas air displays between 2014 and 2019. The oil and fuel were drained for shipping, but the oil system was not otherwise disturbed. Although the area where the oil inlet pipe mounting boss and support strap connected to the engine casing had many pipes, accessories and engine bay structure present which may have obscured visibility, the engineer believed that he would have noticed the broken

13 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 support strap had it been present on recent annual inspections. He advised that no torque limit was specified for the nut which held the support strap in place. During the aircraft examination, the torque to loosen the nut was noted as approximately 21 Nm. The flexible and rigid sections of the oil inlet pipe were weighed, and the combined weight was found to be 1.54 kg. Examination of other Stearman aircraft There are five Stearman aircraft on the UK register equipped with the R-985 engine and at least one US-registered aircraft based in the UK. Of these six aircraft, three are known to have the modification for the larger oil tank in the baggage compartment, similar to N707TJ. Two are owned by N707TJ’s operator, which, also owns a third R-985-engined Stearman that had retained the original 4 USG oil tank mounted on the firewall. The oil system forward of the engine firewall was examined on the operator’s three other R985-engined Stearman, to identify if there was potential for similar failures. The operator advised that when Stearman were historically retrofitted with the R-985 engine there was no standard manufacturer-approved modification, and the installation of the oil system could differ from aircraft to aircraft. Examination showed that the installation and support of the main oil inlet pipe was different on each of the operator’s aircraft, and none had the exact same installation as N707TJ. The oil inlet pipe on the first aircraft examined also comprised a flexible and rigid section of pipe. The rigid section, which also accommodated a port for the oil temperature probe and a 90º threaded joint, was similar in shape but much smaller and lighter than that on N707TJ. Two support straps supported the weight of the pipe (Figure 11).   Figure 11 Alternative installation: smaller rigid pipe. Side view (left image), top view (right image) The operator subsequently modified the installation on this aircraft to consist of a single flexible pipe and relocated the oil temperature probe.

14 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 The oil inlet pipe on the second aircraft was comprised only of a flexible pipe, which was shorter than that on N707TJ and a 90º threaded union (Figure 12). There were no supporting straps and the oil temperature probe was mounted separately. Figure 12 Alternative installation: flexible oil pipe and 90º threaded union, no support strap The third aircraft, which had the original smaller oil tank mounted on the firewall had a flexible oil pipe which ran down from the oil tank, along the forward face of the firewall, into a Y-shaped union. From there a flexible pipe ran forward to the engine casing where it was attached to the mounting boss via a rigid 90º union. There were no support straps. Safety and survivability aspects Harnesses Each seat in N707TJ was equipped with a 5-point seat harness connected to the seat and a secondary airline-style lap belt connected to the airframe. In addition, the wing walker wore a harness under her coverall, which attached to a safety restraint system and was used when the walker was outside the cockpit. After the aircraft ditched, the pilot reported that he was able to unclip both his harnesses and escape without difficulty. The wing walker detached from the safety restraint system when she returned to the cockpit. She reported that although she struggled to exit the aircraft due to the shock of ditching, locating the seat harnesses was instinctive because of her training. Head protection There was no regulatory requirement for either of the occupants to wear a helmet. The operator informed the investigation that their standard practice was for both occupants to wear a helmet during transit flights. For display flights, the wing walkers would not wear a helmet as the operator considered that the weight and drag would place an extra strain on their body.

15 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 While there was padding around the sides of the cockpit, there was no padding on the coaming to provide head protection for the occupant (Figure 13). The operator explained that with the seat harnesses correctly tightened, it is not possible for the head to hit the coming or instrument panel. Figure 13 Padding around the side of the front cockpit Life jackets Regarding this air display, the operator believed that wearing a life jacket could pose a potential hazard of becoming trapped in an inverted aircraft following a ditching and that there was less risk in not wearing a life jacket. This assessment was based on the time the aircraft would spend over the water during the display, and that it would be close to shore with safety vessels present to rescue the crew. It was also felt that wearing a life jacket would restrict the freedom of movement of the wing walker in climbing onto and off the wing. Training At the beginning of each season, training was undertaken by the wing walkers. This included familiarisation with the cockpit harnesses, the wing walker safety restraint system, and the brace position to be adopted during a crash or ditching. Communication between pilot and wing walker The aircraft was not fitted with any means for voice communication between the pilot and wing walker. Rocking the wings was the signal for the wing walker to look back to the pilot who would then communicate using pre-defined hand signals. The team reported that the moment either of the pilots deviated from the set display routine, the wing walker and the other pilot would recognise that there was something amiss.

16 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 The operator’s ‘Professional Wing Walker’s Induction Guide’ defined the hand signals to be used between the wing walker and the pilot but did not include any signals to be used in the case of an emergency. The wing walker reported that although she noticed when she returned to the cockpit that it was covered in oil, she had no means of informing the pilot. As a result of this accident, the operator has introduced three new signals: expect a diversion; prepare for a forced landing / ditching and adopt the brace position; and for the walker to advise the pilot that there is fuel or oil in the cockpit. Personnel The pilot joined the operator in 2006. He was the lead pilot for the display team and had flown more than 900 displays. He held a UK Part-FCL PPL (A) with a valid SEP (land) class rating and a Display Authorisation (DA), which allowed him to act as formation leader and to carry out displays with an individual standing on the wing. The wing walker had been with the team since 2018 and was the lead wing walker. This was her fourth display season with the team. Ditching technique The Pilot’s Flight Operating Instructions for the Stearman provide no guidance on the technique for ditching. The pilot reported that prior to the flight he briefed the wing walker that in the event of a ditching he would fly as slowly as possible into wind just above the stall speed and ‘pancake’ the aircraft with the tailwheel touching first. CAA Safety Sense Leaflet 213, extant at the time of the event, provided the following general advice to GA pilots on ditching and survival techniques: ‘The force of impact can be high so ditch as slowly as possible whilst maintaining control…Hold the aircraft off the water so as to land tail down at the lowest possible forward speed, but do not stall into the water from a height of several feet…This main impact will usually result in considerable deceleration…’ Following this accident, the CAA provided a routine update to Safety Sense Leaflet 214, which provides additional guidance on the technique to be used for ditching. Analysis Introduction The loss of engine power, and subsequent ditching, was the result of a loss of oil supply to the engine. This occurred following a failure of the engine oil inlet pipe. Footnote 3 CAA Safety Sense Leaflet 21D ‘Ditching’, dated January 2013, extant at the time of the accident. 4 CAA Safety Sense SS21 ‘Ditching Light Aircraft on Water’, dated July 2022. Available at https://publicapps. caa.co.uk/docs/33/SafetySense_21-Ditching.pdf [accessed August 2022].

17 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 Failure of the support strap The steel support strap on the oil inlet pipe failed as a result of fatigue, which initiated at mechanical damage on the outer surface of the strap and propagated towards the inner surface. Normal engine vibration could have provided the cyclic loading mechanism to propagate the crack once formed. The function of the strap was to support the weight of the oil pipe. Once the strap had failed, the load would have transferred to the threaded joint on the pipe. The size and shape of the witness marks associated with the mechanical damage on the support strap were consistent with its retaining nut having been over-tightened. It was not determined when this occurred, but there was no indication in the aircraft logbook that the oil pipe had been disturbed since the engine was replaced in 2013. It was not determined how long the aircraft may have flown with the support strap fractured, but nothing was noted during the recent annual inspection carried out several months before the accident. Failure of the oil pipe Examination of the fracture surface of the oil pipe threaded joint was less conclusive due to the extent of the corrosion, which likely occurred due to the aircraft’s immersion in salt water. However, several features observed on the fracture surface, and the location of these features, were consistent with fatigue. After the support strap failed, the weight of the oil pipe would have been taken solely by the threaded joint, leading to a stress concentration at the point of maximum tensile load. The final failure point, (at the 12 o’clock position), indicated by the crack jumping between adjacent threads, suggests that the crack initiated at or close to the 6 o’clock position (Figure 9). Examination around the 6 o’clock position, identified ratchet marks between the 4 o’clock and 7 o’clock positions. The presence of ratchet marks, and their location at the edge of the thread root, combined with the striation-like features in the area where a fatigue crack would most likely initiate (around the 6 o’clock position), suggest that fatigue was the most likely cause of failure of the oil pipe. The presence of shrinkage porosity in the cast material of the threaded portion, would have reduced its load carrying capacity and may also have contributed to the failure. No unusual oil leaks were noted on the engine prior to the accident. Photographs taken as the aircraft was landing after the previous day’s flying display show no evidence of an oil leak, and no oil was noted on the ground during the pilot’s pre-flight inspection on the day of the accident. It is therefore concluded that the final failure of the oil pipe occurred during the accident flight, although the crack may have been propagating for some time. Other aircraft The particular arrangement of the oil inlet pipe on N707TJ most likely arose from the need to re-route the oil supply when the larger oil tank was installed in the baggage compartment. Examination of the operator’s other three R-985-engined Stearman aircraft (including two with a relocated oil tank) showed that there were a variety of possible installations for

18 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 the oil inlet pipe. The installations on the other aircraft were different to each other and smaller/lighter than that on N707TJ, which made them less likely to suffer a similar failure. Nonetheless, the operator inspected the oil pipe installation on the other aircraft to satisfy itself that they were adequately supported. Management of the emergency The initial symptoms were that the aircraft was not climbing and the engine power was lower than expected. Consequently, the pilot abandoned the display with the intention of returning to the airfield without overflying populated areas and endangering third parties. As the emergency developed, the pilot declared a PAN and communicated his changing intentions. The involvement of the second aircraft in observing the event and declaring a MAYDAY, after N707TJ ditched, enhanced the overall understanding of the situation and ensured a rapid response from the emergency services. With the FDD and representatives from the emergency services collocated in the MACC there was a joint understanding of the developing situation, which allowed a coordinated response. This included the tasking of the RNLI rescue boat, and paramedic, to shadow N707TJ and the subsequent transfer by ambulance to hospital. The decision by the FDD to cancel the remainder of the flying display prevented subsequent aircraft from displaying before the fuel supply at Bournemouth Airport could be checked for contamination. It is also not unusual following an accident for other pilots and staff involved in the event to become unsettled and for safety resources to be out of position. Therefore, the cancellation of the flying allowed individuals to reconcile what had happened and provided the necessary time to reset the programme and ensure that the safety boats were in position. Ditching The crew had prepared for a ditching by briefing the technique to be used prior to the flight and by the wing walker rehearsing the brace position and the release of both seat harnesses during the preseason training. The video of the final stages of the flight showed the aircraft in a stable descent with the aircraft adopting a slightly nose raised attitude towards the end of the flight, followed by a controlled impact with the water. A ditching will result in a rapid deceleration and given the fixed landing gear it was almost inevitable that the aircraft would flip over. While the wing walker banged her head during the ditching there were no medical reports of either crew sustaining an injury. A helmet would offer the wing walker additional protection, but the operator believed that this would be at the risk of possible injury due to the additional strain a helmet would place on the body while standing on the wing. The risk of a head injury was somewhat mitigated by padding down the edges of the cockpit, correctly fitted harness and the use of the brace position. The operator considered that life jackets might impede the release of the seat harnesses and the escape from a submerged cockpit. It would also make it more difficult for the wing

19 © Crown copyright 2022 All times are UTC AAIB Bulletin: N707TJ AAIB-27642 walker to get on and off the wing. Consequently, they were not worn. While not wearing a life jacket would have advantages during the evacuation, it would leave the occupants unprotected once in the water. The mitigation during the display was that organisers had several safety vessels situated around the display area who could quickly offer assistance; however, in this case the ditching occurred 3 nm from the display area. Conclusion The reduction in engine power occurred due to the failure of the oil inlet pipe, which resulted in the loss of the oil supply to the engine. The pilot was quick to respond to the situation and initially intended to return to the airfield avoiding high ground and populated areas. As the situation deteriorated, he continually revaluated his options and positioned the aircraft for a ditching that would reduce the risk to third parties. The pilot and wing walker were well rehearsed in handling emergencies and a successful ditching was carried out. Following this accident, the operator introduced additional hand signals to enable the wing walker to inform the pilot of any oil or fuel leaks, and for the pilot to inform the walker that he intended to ditch. Published: 20 October 2022.

FD06708 ｜ 2021_英国_aaib-investigation-to-cessna-fra150l-aerobat-g-ciir__Cessna_FRA150L_Aerobat_G-CIIR_12-21.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

3 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 ACCIDENT

Aircraft Type and Registration: Cessna FRA150L, Aerobat, G-CIIR No & Type of Engines: 1 Rolls-Royce Continental O-240-A piston engine Year of Manufacture: 1973 (Serial no: 187) Date & Time (UTC): 11 October 2020 at 1342 hrs Location: Troutbeck Airfield, Cumbria Type of Flight: Private Persons on Board: Crew - 1 Passengers - None

Injuries: Crew - 1 (Fatal) Passengers - N/A Nature of Damage: Destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 44 years Commander’s Flying Experience: 69 hours (of which 52 were on type)

Last 90 days - 3 hours

Last 28 days - 2 hours Information Source: Field Investigation Synopsis G-CIIR landed at Troutbeck Airfield with its pilot and a passenger without the required permission. As the conditions on the day meant the aircraft’s takeoff performance from Troutbeck would be marginal, the airfield owner instructed the pilot to depart solo in order to improve the aircraft’s performance by reducing its takeoff weight. On the subsequent takeoff the aircraft was seen to depart controlled flight seconds after getting airborne and strike the ground. The pilot was fatally injured. The investigation identified a number of shortcomings with the preparation for the flight that contributed to the accident. History of the flight Background information The pilot and his passenger planned to fly in his Cessna FRA150L Aerobat (C150), registration G-CIIR, from Retford (Gamston) Airport, Nottinghamshire, where it was based, to Troutbeck Airfield, near Penrith, Cumbria. En route, they planned to meet a friend at Netherthorpe Airfield, South Yorkshire, who had a Maule M7 aircraft (M7) and who would fly to Troutbeck about five minutes ahead of them. Another M7 was due to join them at Troutbeck, flying direct from Auchinleck, near Prestwick Airport, South Ayrshire.

4 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Prior to departing Gamston, the pilot of G-CIIR requested the aircraft’s fuel tanks “were brimmed” by the refuelers, meaning he wanted them full. G-CIIR then flew to Netherthorpe and landed on grass Runway 36. The M7 landed about 10 minutes later. The pilot of G-CIIR had not obtained the Prior Permission Required (PPR) to land at Netherthorpe before departure from Gamston. The M7 pilot did not require PPR as he was a member of the resident flying club and had an aircraft based there. After about 50 minutes, the M7 took off from Netherthorpe followed about five minutes later by G-CIIR, at about 1125 hrs. The two aircraft then flew up to Cumbria. Given the M7’s faster cruising speed, and the pilot of G-CIIR’s wish to fly a less direct route over the Lake District, the M7 landed at Troutbeck first at about 1235 hrs. At the time grass Runway 36 was in use and the wind was from 360° at about 10 kt. As the runway was “sludgy”, the M7 pilot tried to call the pilot of G-CIIR on his mobile phone, to advise him of the runway state. However, he could not “positively remember” if he spoke to the pilot. After the M7 had shut down, its pilot met the airfield’s owner outside the airfield’s hangar. About 10 to 15 minutes later, while they were in conversation, G-CIIR came into view. Given the distance, the airfield owner initially thought it was an Aviat Husky1 or another M7. However, when it was overhead, he realised it was a C150, an aircraft that he was not content to operate into Troutbeck. He ran into the hangar to get his hand-held transceiver and made repeated calls on ‘SafetyCom’ frequency2, 135.480  MHz, to try and ascertain what the pilot’s intentions were, but there was no response. G-CIIR then made an uneventful descent, approach and landing, and taxied in and parked about 80 m from the hangar. Neither pilot had obtained PPR directly from the airfield owner to land at Troutbeck. However, the M7 pilot believed he had PPR by proxy from the Auchinleck M7 pilot, who had phoned the airfield owner that morning asking for PPR and saying that the M7 pilot was planning on visiting too. The airfield owner was “very cross” with the M7 pilot, as he had made no mention that a C150 was visiting with him, adding that it was “not appropriate for one to land here in the conditions”. After G-CIIR had vacated the runway, the M7 pilot gesticulated to indicate where to taxi and park as the ground was rough and boggy, but the accident pilot misunderstood and parked in an area of boggy ground. After G-CIIR had shutdown, the M7 pilot went to speak to the pilot before he and his passenger went to the hangar. During this conversation, which was recorded by a video camera that the pilot had mounted on the underside of the aircraft’s right wing, the pilot referred to the flight from Netherthorpe as being “very stressful”. However, he did not elaborate as to what aspects of the fight may have caused concern. The passenger later commented that this was due to the radio being intermittent because of the terrain, having to climb and descend to avoid clouds and trying to keep up with the M7. The M7 pilot then advised G-CIIR’s pilot that the airfield owner was dissatisfied that PPR had not been requested, and that the runway’s condition was not Footnote 1 An Aviat Husky is a tandem two-seat, high-wing short takeoff and landing (STOL) capable aircraft. 2 SafetyCom is a common traffic advisory frequency for use at aerodromes that do not have an assigned frequency. Aircraft should announce their position and intentions at the normal points in the circuit.

5 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 suitable for operating a C150. The M7 pilot then said that he (the M7 pilot) should probably take the passenger back to Gamston in his M7, if not all of them. The pilot replied “no, no we’ll get out easily”, and the recording ended shortly afterwards. At the hangar the pilot and his passenger met the airfield owner who was annoyed with them and repeated that a C150 should not have landed there in the conditions. The pilot was apologetic, saying he thought someone had phoned on his behalf to ask for PPR. Given the airfield owner’s concerns about a C150 operating from Troutbeck, he instructed G-CIIR’s pilot to depart solo, with his passenger departing in the M7. He added that the pilot was to use the full length of Runway 36 to ensure all the Takeoff Distance Available (TODA) was used. This would entail a backtrack of Runway 36 from the intersection of Runway 04 before starting the takeoff roll (Figure 1); the pilot agreed. The airfield owner then had to leave, but before doing so he told the M7 pilot to ensure that he took the passenger back to Gamston and that G-CIIR used the full length of the runway.

Figure 1 Plate of Troutbeck Airfield - © Pooleys

6 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Both pilots walked the runway to discuss the airfield owner’s instructions, but they did not go to the threshold of Runway 36. Due to the surface condition and the positive gradient from the threshold to the intersection with Runway 04, G-CIIR’s pilot said he would go down about halfway from the intersection to the threshold before starting the takeoff roll; the M7 pilot accepted this. The accident flight G-CIIR’s pilot started his aircraft first for the return to Gamston but, due to the condition of the ground where he had parked, he had difficulty taxiing out. He was assisted by the M7 pilot who leant on the tailplane to take the weight off the nosewheel and pushed the aircraft to help it move. G-CIIR was seen to taxi along Runway 22 and, as it got to the intersection with Runway 36, turn right onto Runway 36. Its engine was heard to accelerate to full power and the aircraft commenced the takeoff roll. The M7 pilot said that the engine sounded normal and G-CIIR quickly became airborne. This coincided with the M7 pilot starting to record a video of the aircraft using his mobile phone. He estimated the wind was from about 020‑030° at 6 kt. Given the short time it took G-CIIR to taxi out and commence the takeoff roll, he believed the pilot did not have time to perform his engine power checks and pre‑takeoff checks. Once airborne, the aircraft was seen to drift left off the side of the runway, yawing left with its pitch angle increasing. It appeared the pilot then started a left turn during which the left wing dropped and the aircraft entered a near vertical dive from about 50 ft agl, before striking the ground in an adjacent field. The aircraft came to rest on its nose in a vertical attitude, having been airborne for just over 10 seconds. As G-CIIR entered the near vertical dive, the M7 pilot and passenger realised that it was going to strike the ground and started to run towards it. Prior to reaching the aircraft they rang the emergency services before proceeding to it to help the pilot. As they approached the aircraft there was smoke coming from the engine, which soon dissipated. The M7 pilot found the pilot hanging by his lap straps unconscious and not breathing. He believed the pilot did not have his shoulder harness secured. Smelling fuel and seeing some emanating from a hole in the aircraft’s right wing tank, he was keen to extricate the pilot in case the aircraft caught fire. The pilot was subsequently removed from the aircraft with the assistance of the passenger and another witness. As they did this, the aircraft toppled over onto its back, coming to rest inverted. They put the pilot on the aircraft’s inverted wing and, with the assistance of the emergency service on the phone, gave the pilot first aid. Paramedics, local RFFS and police were in attendance about 10 to 15 minutes after the accident and attended to the pilot. An air ambulance arrived soon thereafter. However, the pilot had sustained fatal injuries.

7 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Accident site The aircraft hit waterlogged soft ground about 60 m from a conifer plantation. Marks on the ground showed that the aircraft hit the ground near vertical with the left wingtip striking the ground first. This was confirmed by the damage to the nose of the aircraft and the leading edges of the wings (Figure 2). The propeller had lifted out a divot and the spinner and engine cowl had made a hole in the soil about 0.45 m deep which had filled with water and a small amount of oil leaking from the engine. Figure 2 G-CIIR accident site The engine had been pushed rearwards distorting its firewall and severely disrupting the rudder pedals, instrument panel and surrounding components. The nose section of the aircraft had been shortened by approximately 0.75 m. The fuel selector was in the on position and the battery master switch, although distorted, appeared to be in the off position. The cabin doors remained attached but had opened in the impact. The windscreen frame and instrument panel glare shield were severely distorted, and the windscreen and roof transparencies had fragmented. Some of the personal items within the aircraft had fallen out onto the ground. The left and right seat safety harnesses were loose; the pilot’s harness was reported as being found undone by the first responders when they arrived. The nose landing gear was severely displaced and had bent rearwards, and its wheel fairing had detached. The main wheels and fairings were intact but were heavily contaminated with mud (Figure 3).

8 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Figure 3 Left and right mainwheel mud contamination (aircraft inverted) Of note, the right main wheel brake appeared to be binding whilst the left mainwheel was free to rotate. The underside of the fuselage was heavily mud-spattered, and the underside of the tailplane was also contaminated but to a lesser extent. Fuel had leaked from the right fuel tank leaving approximately 5 litres. The left tank appeared undamaged and contained approximately 26 litres. A total of 31 litres was extracted during the aircraft recovery. There was no fire within or around the aircraft pre- or post-impact. The pilot’s checklist was found open at the ‘AFTER START, TAXYING and POWER’ page with mud and scrape marks on it. The ‘PRE-TAKE OFF CHECKS – VITAL ACTIONS’ were on the following page. Other pages were in a clean condition. Accident pilot’s experience The accident pilot completed his PPL(A) Licence Skills Test (LST) on 30 July 2020, and his licence was issued by the CAA on 27 August 2020. Bar the flights to Troutbeck on the day of the accident, he had flown two hours since his LST. On 8 August 2020 the accident pilot flew G-CIIR from Gamston into the M7 pilot’s private grass airstrip, which is 18 nm south-west, prior to his licence being issued by the CAA3. The airstrip is orientated approximately east/west and has about 330 m of Take Off Run Available (TORA), with trees and residential houses in the undershoot and overshoot. When the accident pilot asked his supervising instructor, via a text message, if he could fly there, the instructor assumed he was going there as a passenger with the M7 pilot and Footnote 3 After a pilot has passed his LST, but before his licence is issued by the CAA, any solo flying is to be supervised by the pilot’s flying school, as if he was still a student. See the following link for more details: https://www.caa.co.uk/Flights-after-completing-a-skill-test.aspx

9 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 responded “Go for it”. However, the pilot planned to fly himself there in G-CIIR. Prior to departing Gamston, another instructor4 heard on the radio that this flight was preparing to takeoff and, knowing the airstrip was not suitable for a C150, was surprised to hear this. He tried to phone the pilot to stop him from going but got no reply. He therefore took it upon himself to drive to the airstrip, a distance of about 28 nm (approximately 45 minutes). The instructor arrived just before G-CIIR landed. After the pilot had landed, the instructor chastised him and made it quite clear that he had driven over because he was completely dismayed that the pilot had opted to operate a C150 into this airstrip. The instructor told him that the airstrip was not suitable for a C150, whatever the pilot’s experience, and suggested that a more experienced pilot fly the aircraft out of the airstrip. He also made his feelings known to the M7 pilot. However, the accident pilot subsequently flew G-CIIR out contrary to the instructor’s advice. A few days later the instructor spoke to the pilot and reiterated his concerns to him. He discussed the performance issues and hazards of operating his aircraft into such an airstrip. He also spoke at length about the type of flying he should be doing to gain experience with his new licence; it did not include any grass or performance limiting airfields. Comments from others involved Maule M7 pilot The M7 pilot stated that he was aware the accident pilot had flown into Netherthorpe on a number of occasions and did not remind him to ensure he obtained PPR. With regards to PPR for Troutbeck, the accident pilot messaged the M7 pilot before he departed Gamston asking whether the airfield owner would “require a call in advance?” to which the M7 pilot replied “call probably good but not essential.” The M7 pilot added that during the approach and landing at Troutbeck he transmitted on the UK’s microlight airfield frequency (129.830 MHz) and believes the accident pilot did the same. Airfield owner The airfield owner stated that he prefers requests for PPR the day before an arrival. This allows him to check that a pilot has the airfield’s plates and appropriate short airstrip experience. He also checks the aircraft type they are flying to ensure it is a “low energy aircraft”, like a microlight or a STOL capable aircraft, such as an M7 or Piper Super Cub. However, he instructs pilots to call before they takeoff so he can inform them of the current weather conditions, what the wind is and to advise the most suitable runway to use. He also advises them where to park and, in soft ground conditions, where not to park. If he has any doubt about an aircraft type or a pilot’s experience, he will not permit them to visit; this is something he has done before. Footnote 4 This instructor had flown with the accident pilot early in his training but not since.

10 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 The accident pilot had previously visited Troutbeck in G-CIIR, on 25 May 2020, with the M7 pilot who flew in a Super Cub. On this occasion the accident pilot was conducting a solo crosscountry flight prior to completing his PPL(A) LST. The M7 pilot requested PPR from the airfield owner, adding that he was bringing a friend, but the airfield owner was not aware of what type of aircraft he would be arriving in. Having known the M7 pilot for some time, he assumed the other pilot and the aircraft would be capable of operating into Troutbeck. However, the airfield owner was “astounded” to find out, while talking to G-CIIR’s pilot, that he was a student pilot. Had the M7 pilot mentioned this when he phoned up, the owner would “most certainly not have allowed him to land”. He stated that he would not have given him PPR on the day of the accident due to his lack of experience and the poor ground conditions at the time. On the morning of 11 October 2020, he received two calls for PPR of which one was from the pilot based at Auchinleck, near Prestwick Airport, who was known to the M7 pilot and was flying in another M7. The Auchinleck pilot asked for PPR and mentioned that the M7 pilot was planning on coming too. However, he made no mention of another aircraft accompanying him. The airfield owner did not try to contact the M7 pilot as he assumed he would be airborne. This was a concern to him because, while the airfield was pretty firm but soggy, there were some wet areas that pilots needed to be made aware of before they arrived, as he didn’t want them taxiing too far off the runway into them. The accident pilot’s instructor The accident pilot purchased G-CIIR in June 2019 when he was part way through training for his PPL(A). Thereafter he flew the rest of the syllabus in it. One of the accident pilot’s instructors, who flew and supervised most of his training flights after he had purchased G-CIIR, stated that during some of the first flights he flew with him he had a habit of not wearing his shoulder straps. From the outset the instructor asked him to put them on, which he reluctantly did. When debriefed on this, the instructor told him firmly that he would not fly with him unless he wore them. The same instructor described the accident pilot as a “good solid average pilot”, though he could be “a bit hit and miss at times”. He was also “not the most consistent student”. He described him as one of the “more aggressive, pushy students” at times. He added that during some of the first few lessons they flew together these attributes gave him cause to “reel him in” at times and he had to explain to him what was acceptable and what was not. He added that he had to be quite firm with him at times. He authorised the cross-country flight to Troutbeck on 25 May 2020 as he felt his ability was up to it, his attitude had “turned a new leaf” and he was progressing well through the course5. Additionally, he felt the conditions were suitable on the day to go into a “500 m strip”. However, he didn’t ask to see his performance calculations, though it was expected Footnote 5 Article 209 of The Air Navigation Order 2016 states that the training organisation needs to check that an aerodrome used by a student pilot is suitable and, if an unlicensed aerodrome is being used, they are required to conduct an assessment of the suitability and any hazards with operating from/to that aerodrome.

11 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 that students would do them when visiting a new airfield. At the end of the briefing the pilot was reminded to obtain PPR, though the instructor did not check this had been done. Aircraft information General The C150 is a two-seat, all-metal, high-wing monoplane with fixed tricycle landing gear. It is fitted with a flat-four cylinder horizontally opposed normally aspirated piston engine driving a two-bladed fixed-pitch propeller. Fuel is contained in rigid tanks within the left and right wings. An on-off fuel selector is fitted on the cockpit floor and when in the on position fuel is drawn equally from each tank. It has conventional mechanical flying controls and electrically driven flaps. The flaps are operated by a spring-loaded paddle switch which self-centres on release after the chosen flap position is achieved. A pitch trim tab is fitted on the trailing edge of the right elevator and is controlled by a hand wheel in the centre console of the instrument panel. A pneumatic stall warning device is fitted within the leading edge of the left wing. It consists of a small rectangular orifice positioned in the region where a negative pressure develops with the onset of a wing stall. The negative pressure creates a vacuum, via a tube within the wing leading edge, which causes a small reed to vibrate producing an audible note in a horn situated in the cockpit near to the pilot. The main wheels are fitted with hydraulic disc brakes operated by articulated toe pads on the rudder pedals. Four-point adjustable safety harnesses are fitted for the left and right seat occupants. G-CIIR The Airworthiness Review Certificate (ARC) was valid until 27 November 20 and its annual inspection was also due at that date. The aircraft’s flight manual stated that normal takeoffs are performed with flaps retracted. Flaps 10 is reserved for minimum ground runs or for takeoffs from soft or rough fields with no obstacles ahead. The aircraft’s flight manual stated that: ‘The stall warning horn produces a steady signal…4 to 8.5 kts…before the actual stall is reached and remains on until the airplane flight attitude is changed.’ It added that stall characteristics are conventional with flaps up and down. Slight buffeting may occur just before the stall with flaps down. Table 1 shows the calculated takeoff and landing weights for the series of flights up to the accident flight.

12 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Gamston to Netherthorpe Netherthorpe to Troutbeck Troutbeck to Gamston Aircraft Basic Weight 1,212.62 1,212.62 1,212.62 Fuel at start up 156 (26 US Gall) 148 (24.67 US Gall) 82 (13.73 US Gall) Pilot 1766 176 176 Passenger 132 132 N/A Baggage 9 9 9 Takeoff Weight 1,685.62 1,677.62 1,479.62 Fuel at shutdown 148 82 N/A Landing Weight 1,677.62 1,611.62 N/A Table 1 G-CIIR takeoff and landing weight calculations (Weights in Pounds) The calculated takeoff weights for the takeoffs from Gamston and Netherthorpe were 1,685.62 lb and 1,677.62 lb respectively. The calculated landing weight at Netherthorpe was 1,677.62 lb. The aircraft’s maximum authorised weight is 1,650 lb (750 kg). The calculated takeoff weight for the aircraft on the accident flight was 1,479.62 lb. The CG on the accident flight was calculated to be 847 mm aft of datum, within the permitted range of 840 to 930 mm aft of datum. Meteorology An aftercast provided by the Met Office for the day of the accident stated that there was a ridge of high pressure over the UK, leading to generally settled conditions. The METARs for Doncaster Sheffield Airport, 11 nm north-east of Netherthorpe, indicated that there was good visibility with scattered clouds at 2,600 ft aal, and a wind from 340° at 14 kt at 1050 hrs, and from 330° at 14 kt at 1120 hrs. The conditions at Troutbeck were likely to have been good visibility with scattered cloud around 3,500 ft amsl with a light wind from the north-west. The atmospheric pressure was 1027 hPa. The M7 pilot stated that at the time GCIIR landed the wind was from 360° at about 10 kt. Video evidence of the airfield’s windsock suggested that at the time of the accident the wind varied between 330° and 350° at about 10 kt. There was no evidence of any wind gusts. Footnote 6 Pilot’s naked weight as recorded at the post-mortem examination.

13 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Airfield information Retford (Gamston) Airport G-CIIR was based at Retford (Gamston) Airport. It has an asphalt runway orientated 03/21 which has a Take off Run Available (TORA) of 1,199 m. Netherthorpe Airfield Netherthorpe Airfield has two grass runways oriented 06/24 and 18/36. Runway 36 has a Landing Distance Available (LDA) of 308 m and a TORA of 361 m. The airfield is ‘Strictly PPR by phone. Inexperienced pilots are to phone for advice prior to arrival and contact a member of flying staff before departure’. Troutbeck Airfield Troutbeck Airfield has three grass runways oriented 18/36, 04/22 and 09/27 (Figure 1). Runway 36 is a 450 m grass runway. The runway has a positive gradient of about 3.3% from the threshold of Runway 36 to just after the intersection with Runway 04. Thereafter, it has a negative gradient. The elevation is approximately the same at the threshold of Runway 36 and Runway 18. Runway 36 is approximately 320 m long from the intersection of Runway 04. Runway 36 has a gradient of about +0.5% over its full length. This is based on the threshold being at 290 ft amsl and the end being around 298 ft amsl. From the threshold of Runway 04, the slope along the remainder of Runway 36 is negligible (albeit slightly negative; 2 ft over 320 m). To the left of the extended centreline of Runway 36, on slightly higher ground, is a conifer plantation (Figure 4). Figure 4 View down Runway 36 showing conifer plantation

14 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 About halfway down Runway  36, there is a limestone soakaway, to a drain that runs lengthwise under the runway. The windsock situated in the middle of the three runways is a 15 kt windsock. This means that it flies horizontally in a wind of 15 kt or greater. As stated in Figure 1, Troutbeck airfield is ‘Strictly PPR’ and the SafetyCom frequency (134.480 MHz) is to be used for RTF communications. Recorded information Sources of recorded information The video and audio soundtrack of G-CIIR, captured by the M7 pilot on his mobile phone, started just before the aircraft became airborne, and the aircraft remained in camera view until shortly before it struck the ground. The footage included the airfield’s windsock, which was positioned about 60 m from where the aircraft had taken off. At 1342:25 hrs, a secondary radar return was recorded for G-CIIR. The radar-derived position was near to where the aircraft struck the ground. Radar data was also available for the aircraft’s two previous flights on the day of the accident. Video and audio footage of these flights was captured by a camera that the pilot had attached to the underside of the aircraft’s right wing, which captured a near 360° view. After landing at Troutbeck, a conversation between the pilots of G-CIIR and the M7 was recorded. The camera was not operating during the accident flight. Accident flight As the video footage of the takeoff started, a light-coloured dust-like cloud could be seen near to the runway behind G-CIIR (Figure 5), which then rapidly dissipated. Very shortly afterwards, G-CIIR lifted off at which point the aircraft yawed to the left whilst also briefly banking to the left (Figure 6), before the wings then levelled. The aircraft’s track over the ground was estimated to be approximately 20° to the left of the extended centreline of the runway, which placed the aircraft on a course towards the conifer plantation. During the next few seconds, the aircraft was observed to climb gradually whilst maintaining a predominantly wings level attitude heading towards the conifer plantation, but as it reached a height of about 50 ft agl, the aircraft proceeded to roll quickly to the left whilst also starting to pitch nose-down whilst descending (Figure 7). The final image of the aircraft (Figure 8), captured less than two seconds later, showed the aircraft’s nose was 20° below the horizon and the bank angle had reached nearly 90°. A sound consistent with the aircraft striking the ground was recorded 1.6 seconds later, which coincided with the sound of the engine stopping. The estimated elapsed time from the aircraft becoming airborne to it striking the ground was just over 10 seconds. During the recording, G-CIIR’s engine could be heard operating. There was no evidence of a problem, such as a misfire, and analysis of the audio spectrum showed that the engine speed was consistent with that expected during takeoff.

15 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 It was not possible to determine the position of the aircraft’s flaps or its control surfaces from the video recording as the resolution was not sufficient. Figure 5 Image of G-CIIR shortly before takeoff Figure 6 Aircraft yawing and turning left after takeoff

16 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Figure 7 Aircraft banks rapidly to the left whilst starting to descend Figure 8 Image of aircraft before striking the ground

17 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Previous takeoff distances At Gamston asphalt Runway 03, the flaps were selected up and a rolling takeoff was made. The takeoff run distance was about 250 m and at takeoff the airspeed was estimated to have been 70 KIAS. At Netherthorpe grass Runway 36, the pilot used a short field takeoff technique (full engine power prior to releasing brakes) with flaps 10 selected. The takeoff run was about 200 m and the airspeed at takeoff was estimated to have been 63 KIAS. The video footage showed that at Troutbeck the aircraft had lifted off about 130 m from the upwind end of Runway 36. Based on the witness evidence of where the pilot started the takeoff roll, this equated to a takeoff roll of about 230 m. Aircraft examination The aircraft was recovered to the AAIB hangar for further examination. Airframe The nose section of the aircraft and engine bay was compressed and had displaced the firewall into the cockpit area. As a result, the flying control linkages to both hand yokes and rudder pedals were displaced and jammed. Both flight control yokes were broken and had detached from their shafts. Most of the instruments had remained in place although many were damaged. No meaningful information was shown on the remains of any of the instruments apart from the barometric altimeter setting. The lower panel switches and circuit breakers had been damaged during the impact. The pitch trim wheel chain drive had derailed, and its position indicator bar was bent out of shape. The throttle and mixture control linkages had also been displaced. Both wings were displaced and had a slight rearward bend and the right fuel line at the wing route had ruptured. The leading edges of both wings had been compressed and had buckled along the entire length. The fuselage skin behind and beneath the cockpit area was also buckled. The tailplane and fin were undamaged except for a minor compression of the fin tip caused by the aircraft settling onto its back after the impact. Flying controls The ailerons were correctly attached to the wings and were free to move on their hinges. The aileron control cables had come off their guide pulleys at the wing routes caused by the wing displacement. However, there was cable continuity to the flight control yokes, although these and the mechanisms behind them were jammed by the firewall and instrument panel distortion. The elevators were free to move on their hinges and the control cables were undamaged and correctly routed. There was continuity between the elevator and hand yokes, but they were in a similar jammed condition as the ailerons. The pitch trim tab was set at 8 mm down which give a nose-up trim setting. Its control cables were also correctly routed

18 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 and were undamaged. The hand wheel chain drive was derailed. The position indicator was bent out of shape and could not be relied upon to be a true indication of the trim tab position. The rudder was free to move on its mountings and its cables were correctly routed and connected to the rudder pedals. Despite the damage to the firewall and distortion to the rudder pedals, they were able to provide a small amount of rudder movement. The right wing flap was locked in position by its electrically driven screw jack and was 80 mm down. The left flap was loose in its tracks because the synchronising cables had come out of their pulleys as a result of the wing displacement during the impact. The inner ribs of both flaps and associated skin were distorted. Stall warner The stall warner orifice in the left leading edge contained soil residue. Distortion of the wing leading edge during the impact had caused a crack in the plastic cup at its tube attachment point. However, when a vacuum was applied directly to the tube the warning horn sounded correctly. Engine The engine had been pushed backwards into the firewall by the impact trapping and distorting the ancillary components in the process. The engine tubular mounting frame was misshapen and some of its welded joints had cracked. A large amount of soil and debris was found within the engine cowl and around the front cylinder cooling fins. The propeller was bent and misshapen and showed the engine to have been at a high power setting at the point of impact. An examination of the spark plugs indicated the engine was in a good overall state of tune. Wheels and brakes The main wheels and brakes were examined at the accident site and a further detailed examination was carried out at the AAIB. The wheel hubs, tyres and brake friction pads were covered in a layer of liquified mud. Prior to recovering the aircraft, the layer of mud was sticky and wet, but it had dried out by the time it arrived at the AAIB. The inside of the wheel fairings was also covered in mud in the same way. At the accident site the left wheel, although stiff, could be rotated by hand whereas the right wheel was seized and could not be rotated. It was eventually freed with the application of a small amount of lubricant on the disc surfaces. Both tyres were found to be correctly inflated and the treads were well defined. The brake callipers and pads were also covered in a layer of liquified mud but underneath were generally in a good, unworn condition. Despite the mud contamination the pistons had not seized in their callipers. However, mud had been smeared onto the disc friction surfaces during wheel rotation and had accumulated on the leading face of the pad friction material.

19 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Crashworthiness The cabin and cockpit area had retained their basic shape and the left and right seat were correctly attached to the cockpit floor. The left and right four-point harness straps were undone and hanging loosely. The first responders had extracted the pilot, to render first aid, by undoing the harness rotary release wheel. An examination of the straps found them to be in good condition. There was no evidence of overloading on the floor mounting plates of the lap straps or the cables, shackles and brackets of the shoulder straps. The control yoke, windscreen fragments, windscreen frame and cockpit instrument panel coaming showed evidence of impact damage and distortion caused by the pilot as the aircraft hit the ground. This is known as a ‘secondary collision’, whereby an unrestrained or partially restrained occupant of an aircraft, hits interior fittings and equipment during an accident sequence. It is caused by the inertial mass of limbs, torso and head moving uncontrollably, known as flailing, in this case forward, during a sudden and rapid deceleration, and it results in contact injuries. Using measurements of the distortion, 0.45 m to 0.75 m to the front of the aircraft, and an impact speed derived from the video, the rate of deceleration of the aircraft was calculated7 to be between 3 and 4.25 g. This rate of deceleration was acting on a partially restrained body. The forces of an unrestrained upper torso and head striking the aircraft structure will be much higher as the deceleration of a head hitting a non-deforming object will result in a substantially higher g-loads. Testing and research8 has been carried out into crash survivability in aircraft and vehicle accidents and has found that: ‘Prevention of the secondary collision is essential to crash survival since relatively minor crashes can result in fatal impacts with interior vehicle structures. There are many different types of belt restraint systems available today, but they mainly involve either pelvic restraint (lap belt) or upper torso restraint (shoulder belt) or a combination of both (3-point, 4-point, and 5-point systems). Lap belt only configurations (2-point restraints) permit tremendous flail of the upper torso in crashes.’ Medical information A post-mortem examination was conducted by a consultant pathologist, which revealed that the accident pilot died as a result of head and chest injuries with the pathologist commenting that he expected them to have proved to be “rapidly fatal”. Footnote 7 The figures used to derive the force assume a constant and uniform deceleration and therefore give a conservative figure. It is probable that the initial g force may have been higher but over a very short period of time. 8 Shanahan, Dennis F. M.D., M.P.H. Human Tolerance and Crash Survivability, NATO, 2004.

20 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 There was no evidence found from the post-mortem examination findings, or a review of the accident pilot’s medical records, of a medical condition likely to cause sudden medical impairment or incapacity. Injuries The accident pilot sustained extensive head injuries consistent with the head striking part of the aircraft. He also had witness marks to his right groin and right hip towards his navel and on his left hip towards his navel, which were generally symmetrical. These were likely to be harness marks from the lap straps. There were no fractures to his clavicular (collar bones) which may have been expected as a result of the shoulder harness being worn. There were marks on his right anterior chest (including sharp edge marks) which may correlate to harness or aircraft parts. There were multiple anterior rib fractures, but these were probably due to chest compressions during cardiopulmonary resuscitation. There were also some posterior rib fractures which are likely to be as a result of contact with part of the aircraft. Toxicological Findings Toxicology results were positive for the presence of cocaine metabolites (benzoylecgonine) in the pilot’s blood. They were positive for the presence of cocaine and cocaine metabolites (benzoylecgonine) in the pilot’s urine. They were negative for alcohol. The consultant clinical scientist and forensic toxicologist stated that the presence of a low level of benzoylecgonine in the blood, and both cocaine and benzoylecgonine in the urine, indicated it was likely that cocaine had been used within one or two days before the accident. The fact that it was only the inactive metabolite benzoylecgonine that had been found in the pilot’s blood suggested that the behaviour of the pilot would not have been directly affected by cocaine on the day of the accident. The level of carboxyhaemoglobin9 (COHb) in the pilot’s blood was 8.5%, with levels below 10% being regarded as normal. The medical evidence was reviewed by a consultant interventional cardiologist. His report stated that, in summary, there was no medical evidence that the pilot suffered any acute medical emergency at the time of the accident. Equally there was no significant evidence that he did not. Also, there was no evidence that he was incapacitated due to the ingestion of any drug or other substance. There was also no evidence that he was feeling unwell or complaining of any particular symptoms prior to the accident flight. Footnote 9 COHb is a stable complex of carbon monoxide (CO) and haemoglobin that forms in red blood cells when carbon monoxide is inhaled. COHb should be measured if CO poisoning is suspected.

21 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 CAA Safety Sense Leaflets Leaflet No 7: Aeroplane Performance10 Leaflet No 7 includes the following information: ‘6 TAKE-OFF - POINTS TO NOTE d) Use of available length: make use of the full length of the runway; there is no point in turning a good length runway into a short one by doing an ‘intersection’ take-off... 8 SAFETY FACTORS a) Take-off

It is strongly recommended that the appropriate Public Transport factor,…, should be applied for all flights. For take-off this factor is x1.33 and applies to all single-engined aeroplanes…

Where several factors are relevant, they must be multiplied. The resulting Take-Off Distance Required to a height of 50 feet (TODR) can become surprisingly high.

You should always ensure that, after applying all the relevant factors, including the safety factor, the TODR does not exceed the Take-Off Run Available (TORA). If it does, you must offload passengers, fuel or baggage.’ Figures 9 and 10 illustrate these points. Leaflet No 12: Strip Flying11 Leaflet No 12 includes the following information: ‘3 OPERATING CONSIDERATIONS a) Aeroplane performance must be appropriate for the proposed strip. You must be fully familiar with the contents of SafetySense Leaflet No. 7 (Aeroplane Performance)… 5 FLYING CONSIDERATIONS i) Always start your take-off run as close as possible to the beginning of the strip, unless there are very good reasons not to do so…’ Footnote 10 Available: http://publicapps.caa.co.uk/modalapplication. aspx?catid=1&pagetype=65&appid=11&mode=detail&id=1913 (accessed 30 June 2021). 11 Available: http://publicapps.caa.co.uk/modalapplication. aspx?catid=1&pagetype=65&appid=11&mode=detail&id=1166 (accessed 30 June 2021).

22 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991   Figure 9 Table of factors to be multiplied to the flight manual TODR from SafetySense Leaflet 7 Figure 10 Depiction of TODR and runway length available

23 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Aircraft performance The AAIB made the following performance calculations for: Gamston The TORA of 1,199 m was in excess of the Takeoff Distance Required (TODR) for a C150 in still air. Netherthorpe Runway 36 The Landing Distance Required (LDR) on Runway 36 at Netherthorpe, using the relevant factors in Figure 9, with an 8 kt headwind, without the additional safety factor (ASF), was 301 m. With the ASF (+43%), it was 430 m. This compares to an LDA of 308 m. The TODR at Netherthorpe, using the factors in Figure 9, with an 8 kt headwind, without the ASF, was 302 m. With the ASF (+33%) it was 402 m. This compares to a TORA of 361 m. Troutbeck Runway 36 The LDR on Runway 36 at Troutbeck, using the factors in Figure 9, with a 10 kt headwind, without the ASF, was 420 m. With ASF (+43%) it was 600 m. This compares to an LDA of 450 m. The TODR at Troutbeck, from the beginning of Runway 36, using the factors in Figure 9, with a 10 kt headwind, without the ASF, was 439 m. With the ASF (+33%) it was 584 m. This compares to a TORA of 450 m. The TODR from the intersection of Runway 04, using the factors in Figure 9, with a 10 kt headwind, without the ASF, was 428 m. With the ASF (+33%) it was 570 m. This compares to a TORA of 320 m. The TODR at Troutbeck from the beginning of Runway  36, on a standard atmosphere day, using the dry grass and 0.5% gradient factors in Figure 9, with a 9 kt headwind, with the ASF, was 449 m. These figures are summarised in Table 2 (with colour-coding to separate takeoff from landing data for each runway).

24 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Distances in m Gamston Runway 03 Netherthorpe Runway 36 Troutbeck Runway 36 full length Troutbeck Runway 36 from intersection TORA 1,199 361 450 320 TODR (No ASF)

302 439 428 TODR (With ASF)

402 584 570 LDA N/A 308 450 N/A LDR (No ASF) N/A 301 420 N/A LDR (With ASF) N/A 430 600 N/A Table 2 Summary of takeoff and landing performance figures Test and research C150 handling characteristics – test profiles As part of the investigation, a flight trial was carried out in another C150 to assess the likely handling qualities and performance of G-CIIR, with various trim settings and flap 10 selected. The flight was conducted at a similar takeoff weight and CG to G-CIIR12 by a qualified test pilot, using standard EASA CS-2313 test techniques. The assessment specifically looked at the following:

Normal takeoff with elevator trim set for takeoff – to establish the control column and rudder forces during a normal takeoff.

Short field landing - to establish the deflection of the elevator trim tab after a short field landing with flap 40.

Takeoff with elevator trim tab at 8 mm of nose-up deflection – to establish the control column forces with the elevator trim tab set as found on the accident aircraft.

Full power stalls – to establish the stall characteristics with flap 10 and full power applied. Footnote 12 The takeoff weight of the test aircraft was 1,490 lb (estimate for G-CIIR was 1,479.62 lb) and the CG was 867 mm aft (estimate for G-CIIR was 847 mm inches aft). The CG position of the test aircraft would have resulted in a negligible reduction in longitudinal stability over that of G-CIIR. 13 CS-23 is the EASA certification specification for normal, utility, aerobatic, and commuter category aeroplanes.

25 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 C150 handling characteristics – test results The results of the flight tests were as follows:

1. Normal takeoff with elevator trim set for takeoff

A normal takeoff with flap 10 was flown. Initially the aircraft ran straight but as the speed increased a very “modest” right pedal input (about 1 to 2 cm) was required to keep the aircraft straight. A gentle aft pressure on the control column allowed the nosewheel to be lifted off by 40 KIAS with the aircraft flying off at 50 KIAS. The takeoff trim setting equated to an attitude of about 12° nose‑up, which gave 55 to 60  KIAS “hands-off” with full power applied. Maintaining 55 KIAS required moderate attention and resulted in a high nose-up attitude with degraded field of view.

1. Short field landing

The aircraft was flown for a short field approach and landing with flap  40 selected, with a small amount of power applied, to give a normal approach angle. The elevator trim required equated to that found on the accident aircraft.

1. Takeoff with elevator trim tab at 8 mm of nose-up deflection

A normal takeoff was conducted. The aircraft flew off at 50 KIAS and the speed was maintained at 55 KIAS. With the elevator trim set to that found on the accident aircraft a “very modest push force” of 4 daN (4 kgf) was required to hold the speed.

1. Full power stalls

The aircraft’s stalling characteristics were assessed at full power, with flap 10 and the elevator trim selected to that found on the accident aircraft. As the aircraft slowed it adopted a high nose-up attitude with degraded field of view. With the aircraft kept in balance, by applying a modest right rudder input, the aircraft slowed below 40  KIAS and the stall warner sounding with the stall occurring at about 30 KIAS. The stall was generally defined by a “g break” or nose-down pitch change. With no rudder applied, the aircraft yawed left and then rolled left. With no rudder this eventually led to the aircraft’s nose dropping in the turn before a full stall was achieved. However, with a modest right rudder input the stall would be achieved with a left wing drop. Overall, the full power stall characteristics were relatively benign, but the high noseup attitude would make it difficult for an inexperienced pilot to ascertain the aircraft’s attitude, and the yaw/roll might go un-noticed.

26 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Analysis The aircraft Examination of the aircraft found no evidence of a structural failure that could have led to this accident. There was also no evidence to suggest any malfunction of the flying controls, and physical and audio evidence showed the engine was producing power until the impact. The light grey coloured dust-like cloud observed a few metres behind the aircraft before it got airborne was not considered to have come from the aircraft but had most likely been displaced limestone dust from the runway soakaway as the aircraft travelled over it. The stall warner was damaged during the impact. However, despite this, correct operation could be demonstrated under test and therefore there was no reason to doubt that it was able to warn the pilot of the onset of stall during the accident flight. The first flight to Troutbeck The accident pilot first visited Troutbeck on 25 May 2020 while still a student pilot. This was authorised by his supervising instructor who assumed he had obtained PPR, which he had not. Had he attempted to obtain PPR, the airfield owner would not have granted it, given his lack of experience and a licence. Flight planning The accident pilot was recently qualified with only two hours of flying since passing his LST. As discussed with his instructor, the plan to go to Troutbeck was beyond his experience, but having had an uneventful previous visit it may have given him the confidence to return, albeit in different conditions. The accident pilot did not request PPR for Netherthorpe or Troutbeck despite both airfields requiring it. When the accident pilot messaged the M7 pilot about calling Troutbeck before departing, he was told: “call probably good but not essential”. However, the airfield’s plates clearly state ‘Strictly PPR’. Had they prepared more thoroughly they would have known to request permission in advance. Had the accident pilot tried to obtain PPR it would have been refused and the accident could have been avoided. Similarly, the M7 pilot stated he used the microlight frequency 129.825 MHz for the approach and believed the accident pilot did the same. Assuming that the accident pilot was not on the SafetyCom frequency, as stated on the airfield’s plate, he would not have been able to receive the airfield owner’s transmissions. Had he heard them, he would have been refused permission to land and the accident would not have happened. It was calculated that the LDR for the flights into Netherthorpe and Troutbeck, with the ASF applied, were in excess of the LDA. It was calculated that the TODR for the flight out of Netherthorpe, with the ASF added, was greater than the TORA. It was also calculated that the TODRs for the accident flight, from the start of Runway 36 and from the intersection with Runway 04, with the ASF added, were in excess of the TORA.

27 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 It was also calculated that the aircraft took off from Gamston and Netherthorpe and landed at Netherthorpe and Troutbeck above the aircraft’s maximum authorised weight. A limitation is imposed on the maximum authorised weight at which any aircraft is permitted to operate. This limitation depends on the strength of the structural components of the aircraft and the operational requirements it is designed to meet. If these limitations are exceeded, the safety of the aircraft may be jeopardized and its operational efficiency impaired. All these findings suggest that the accident pilot had either forgotten to calculate the performance and weight and balance figures, or considered he could operate into Troutbeck again without doing the necessary planning, perhaps because he had visited before without event, albeit in better conditions and without a passenger. The accident flight The M7 pilot stated that he believed the accident pilot did not have time to perform his engine power checks and pre-take off checks in the time it took him to taxi out to the runway and takeoff. While it is not known if he used the checklist, given it was found at the ‘AFTER START TAXYING and POWER’ page with mud and scrape marks, and the ‘PRE-TAKE OFF CHECKS – VITAL ACTIONS’ were on the following page, it is probable that they were not completed. This may have been because the pilot did not want to get his aircraft stuck in the mud, as had happened after he initially tried to start taxiing. This may also be the reason why he started the takeoff run from the intersection rather than backtracking to the beginning of the runway, as instructed to do by the airfield owner, or to a point halfway between the intersection and runway threshold, as he had told the M7 pilot he would do. In either case, not using the full length of the runway for a performance-limited takeoff was contrary to the guidance in Safety Sense Leaflets 7 and 12. The M7 pilot did not believe the accident pilot’s shoulder harness was secure when he released his harness prior to removing him from the aircraft. Given that the pilot had a previous tendency to not wear his shoulder harness, he taxied out and took off hastily, and his head and chest injuries indicated probable contact with parts of the aircraft, it was concluded that the shoulder harnesses were probably not secured prior to take off. The video evidence indicated that after taking off the aircraft had some left yaw with a brief left roll component. The condition of the runway was described as sludgy and the aircraft was found with lots of mud on its underside. Additionally, the left mainwheel was free to rotate whilst the right mainwheel brake appeared to be binding. This was probably a result of the mud that was discovered on its brakes friction surfaces. With this binding brake, the right wheel would have had higher rolling resistance compared to the left, leading to a tendency for the aircraft to drift right during the takeoff. This would have required the pilot to apply left rudder on the takeoff roll to maintain the aircraft’s track along the runway centre line. If the pilot maintained left rudder after the aircraft became airborne, it would have caused the left yaw and initial left roll as observed in the video. With the aircraft heading towards the conifer plantation, the pilot would have found himself in an uncomfortable situation, and one he was unlikely to have experienced before. The increase in the aircraft’s pitch attitude was consistent with him attempting to climb above

28 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 the plantation, although it might also have been related to the elevator trim being set for landing, not takeoff (see Flight characteristics). It is likely that the high nose attitude caused the airspeed to decrease triggering the stall warner and leading to the left wing dropping as it stalled, with the aircraft then entering the near vertical dive. With any yaw applied the tendency for the aircraft to depart controlled flight was increased. Any inability to recognise the yaw to the left and to react appropriately to the stall warner (which probably sounded) is likely to be linked to the pilot’s lack of experience. Having departed controlled flight and entered the dive at about 50 ft agl, there was insufficient height available in which to execute a recovery. Flight characteristics The flight trial found that the pilot probably took off with the elevator trimmer at the same position it was after he had landed. With it not reset to the takeoff position, the aircraft would have required a push of 4 DaN on the control column to hold the takeoff attitude. While this is a moderate force and controllable, had the pilot become distracted and relaxed his hold on the control column, or suffered some form of incapacitation, the aircraft would have pitched up. This would have caused the aircraft’s speed to decrease, which, if not corrected in a timely manner, would lead to the aircraft stalling and departing controlled flight. Any yaw applied at or close to the stalling speed of the aircraft – as appeared likely in this accident – would hasten any tendency for the aircraft to depart controlled flight. The fact that the trimmer was probably not set for takeoff also suggests that the pre-takeoff checks were not completed. No single handling or performance characteristic of the aircraft was identified that would be difficult to control. However, it was still possible for the aircraft to adopt an uncomfortable and unusual attitude that, if uncorrected, would lead to the stall and associated wing drop. Conduct of the flights The flights after the pilot passed his LST and which led up to the accident flight were characterised by incomplete preparation and an apparent disregard of advice from those notably more experienced than him. It is possible that his previous visit to Troutbeck, authorised by one of his instructors, may have given him the confidence to return there. However, it appears that the chastisement and subsequent discussion with one of his instructors at the M7 pilot’s airstrip, about what type of flying was appropriate for a newly qualified pilot, was not heeded. During the takeoff from Troutbeck – an airfield on the limits of the aircraft’s performance capabilities – the pilot rushed; he did not use the full length of the runway; it is likely he used a nose-up elevator trim setting appropriate to landing having not completed his pre-takeoff checks; and it is likely he did not fasten his shoulder harness. The toxicologist stated that the pilot’s behaviour would not have been directly affected on the day of the accident by the aftereffects of his previous cocaine use.

29 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 The consultant interventional cardiologist stated that there was no medical evidence that the pilot suffered any acute medical emergency that may have caused some form of incapacitation. Equally there was no significant evidence that he did not. Immediately after takeoff, the aircraft yawed and rolled to the left but the wings were then levelled. This would have required control input from the pilot, suggesting that he was not incapacitated at that point. Nevertheless, the possibility that the pilot became incapacitated in the final seconds of the flight could not be excluded. It was considered likely that his conduct during the flights leading up to and including the accident are explained by an apparent willingness to trust his own judgement over the advice of others. Survivability The aircraft descended vertically into waterlogged but dense soil. The engine was at a high power setting and the rotating propeller cut itself into the soil lifting out a large divot in the process. At the same time, the engine frame and nose section became compressed until both wing edges contacted the ground, as shown by the marks in the soil. The aircraft appears have been brought to a stop in a distance estimated to be between 0.45 m to 0.75 m, based on the impact hole and shortening of the nose section. Using an impact speed derived from the video evidence, the aircraft and pilot sustained an impact deceleration between 3 g and 4.25 g. These forces are not particularly high and should have been survivable. The pilot received fatal injuries to his head and chest and there was no evidence of a medical condition likely to cause sudden medical impairment or incapacity. Given that some of his injuries were probably sustained by contacting the aircraft and it is likely he was not wearing his shoulder harness, these injuries may have been less severe and possibly survivable had the shoulder harness been worn. Conclusion The aircraft had a valid ARC and was in a good overall condition. There was no evidence of any system malfunction or structural failure that could have been causal or contributed to this accident. All the damage to the aircraft was consistent with a frontal impact with waterlogged but dense soil. The accident was caused when a high nose attitude immediately after takeoff caused the airspeed to reduce to such an extent that the aircraft stalled with a wing-drop to the left. The high nose attitude was made more likely by the fact that the elevator trim remained set for landing, probably because the pilot did not carry out his pre-takeoff checks as he rushed to depart while not becoming stuck in the muddy surface. The wing-drop was consistent with residual left yaw at the stall, a condition considered likely because of the left roll and yaw observed immediately after takeoff. The left yaw was probably a result of the pilot not reducing the left rudder input that would have been required during the ground roll to overcome the effect of the right brake binding while rolling over the muddy runway surface.

30 © Crown copyright 2021 All times are UTC AAIB Bulletin: 12/2021 G-CIIR AAIB-26991 Pilot incapacitation in the final seconds of the flight could not be ruled out but was considered unlikely. Opportunities were missed to prevent the accident because the pilot did not heed the advice not to operate into grass, performance-limiting airfields, did not obtain PPR and was probably not on the correct radio frequency on arrival. It is likely that the pilot did not fasten his shoulder harness, against the strong advice of his instructor, and this action may have meant the accident became unsurvivable. Flying for any pilot is a continual learning process whether they are newly qualified or very experienced. However, newly qualified pilots should be very careful to make sure they fly within the limits of their experience. This accident highlights the fact that thorough preparation is essential for every flight, and accidents can happen if short cuts are taken or good advice is not heeded. Published: 18 November 2021.

FD06709 ｜ 2021_英国_aaib-investigation-to-cirrus-sr22-g-ctam__Cirrus_SR22_G-CTAM_11-21.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 ACCIDENT

Aircraft Type and Registration: Cirrus SR22, G-CTAM No & Type of Engines: 1 Teledyne Continental IO-550-N piston engine Year of Manufacture: 2007 (Serial no: 2740) Date & Time (UTC): 31 May 2020 at 1345 hrs Location: Calshot Spit, Hampshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1

Injuries: Crew - None Passengers - None Nature of Damage: Damaged beyond economical repair Commander’s Licence: Private Pilot’s Licence Commander’s Age: 56 years Commander’s Flying Experience: 587 hours (of which 89 were on type)

Last 90 days - 11 hours

Last 28 days - 6 hours Information Source: AAIB Field Investigation Synopsis Passing 1,400 ft in a descent towards an airfield the engine started to run roughly and subsequently lost power. The pilot turned the aircraft parallel to the shore and deployed the aircraft’s Ballistic Parachute Recovery System. The parachute descent was successful and both occupants escaped from the aircraft uninjured. The loss of power was probably caused by fuel starvation to the engine, but the cause of the starvation could not be determined. History of the flight The aircraft was refuelled on the morning of 28 May 2020 at Lee-on-Solent (EGHF), and it was fuelled to tabs that are visible in the tank filler necks. The tab level gives a fuel load of 227 litres and 126 litres were added to the aircraft tanks to achieve this. The pilot selected ‘tabs’ on the Multi-Function Display (MFD) and reduced the displayed total to 220 litres to provide a contingency margin. The aircraft flew a return trip from Lee-on-Solent to Turweston Aerodrome (EGBT), and the pilot recorded 1 hour 45 minutes in his logbook for these two sectors and stated that the airborne time was 1 hour 13 minutes. On 31 May the pilot took the aircraft out of its hangar at Lee-on-Solent and conducted pre-flight checks. During these he noted that the aircraft’s MFD showed a usable fuel load of 127 litres. The aircraft departed Lee-on-Solent at 1054 hrs and flew to Dunkeswell (EGTU), landing at 1130 hrs. The pilot stated that he used a timer in the aircraft cockpit to remind him to change the fuel tank selection every 20 minutes. Both the occupants

2 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 had lunch and returned to the aircraft at 1245 hrs to prepare for the return flight. During the checks the pilot noted that the MFD showed a usable fuel of 84 litres. As 43 litres had been used for the flight to Dunkeswell, the pilot assessed that sufficient fuel remained for the return leg. The aircraft took off at 1305 hrs and climbed to 3,400 ft amsl for the return leg. Throughout these sectors, the pilot stated that he used the fuel leaning functions of the aircraft’s engine management controls to achieve a cruise power of approximately 75%. During the flight the pilot altered the planned route to fly close to the Bournemouth Airport overhead. After Bournemouth the pilot descended to 1,700 ft at reporting point OLGUD1. The pilot stated that during the descent the fuel remaining display on the MFD2 showed that there would be 12 USG at OLGUD and 11 USG at Lee-on-Solent. He preferred to use the fuel remaining figure on the MFD as his primary fuel reference during flight, cross-referring to the aircraft fuel gauges as required, although he did not trust the accuracy of the fuel gauges. After OLGUD, the pilot commenced a slow descent toward Lee-on-Solent and called the airfield on RTF to obtain traffic information. At around 1,400 ft he recalled the engine “coughed a little.” His first thought was that he had retarded the fuel mixture rather than the power lever, but on checking he found the lever in the correct position. He did not consider a low fuel situation because of his recent fuel checks. Then, the pilot recalled, the fuel caution light on the instrument panel illuminated, and the engine began to run very roughly. The pilot did not recall seeing any fuel cautions or warnings on the MFD. The pilot called Lee-on-Solent and informed them he was running out of fuel. He changed the fuel tank selection and the engine recovered briefly but then faltered again. He did not select the fuel pump switch to boost. The aircraft had now descended to 800 ft, and the pilot changed the fuel tank selection again but with no improvement, and he called Lee-on‑Solent to inform them he was preparing to ditch. The last altitude the pilot recalled seeing was 600 ft before he turned the aircraft parallel to the shore, briefed the passenger and deployed the ballistic parachute recovery system (BPRS). The routes of the flights detailed in this section are shown in Figures 1 and 8. On touchdown the aircraft nose went briefly underwater before bobbing back to the surface. The aircraft floated upright with the wings just slightly below the surface and only a small amount of water entering the cockpit. Both occupants left the aircraft through the right door onto the wing. The parachute remained airborne and caused the aircraft to invert as the occupants swam clear. They were assisted by a nearby windsurfer before being rescued by the Hamble Lifeboat. Both were uninjured. The parachute remained inflated and dragged the ditched aircraft to the shore. Footntoe 1 OLGUD is a reporting point at the west end of The Solent, approximately 2 nm south-east of Lymington. 2 While on the ground the MFD Initial Fuel Page shows fuel quantity in litres. In flight the displays show fuel quantity in USG.

3 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Accident site The aircraft ditched in the sea 3.4 nm west of Runway 05 at Lee-on-Solent Airport and 0.5 nm south-east of the beach at Calshot Spit (Figure 1). The inverted aircraft washed up on the beach at Calshot. Figure 1 Final flight path and ditching location Mapping © 2021 Google, Image © 2021 TerraMetrics A rescuer of the Royal National Lifeboat Institution (RNLI), who was also a pilot, boarded the aircraft and turned off the fuel selector, battery master switch and magnetos. He did not move the fuel pump switch or the mixture lever. The police were also on scene and did not report any fuel leaks or fuel spills. The aircraft was guarded overnight and was then examined the next day by an insurance loss adjuster. Photos taken by the loss adjuster showed the throttle lever fully forward, the mixture lever near fully forward, the fuel pump switch in the off position and the fuel selector in the right-off position. An aircraft recovery team opened the inverted fuel tanks via the lower access panels and the loss adjuster reported that both the left and right main tanks contained no more in total than two or three pints of fuel and a small amount of sea water. The inboard collector tanks contained a trace of fuel and some sea water. There was no visible fuel leakage around the aircraft. The aircraft’s wings were cut off and the aircraft was transported to a secure facility. The aircraft had suffered significant damage to its upper fuselage structure and windscreen from being dragged up the beach inverted (Figure 2).

4 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Figure 2 Aircraft after it was righted, the engine cowling removed, and the wings cut off Aircraft information The Cirrus SR22 is a four-seat single-engine composite aircraft that was first certified in 2000 and more than 6,000 have since been produced. There are different variants and G-CTAM was a Cirrus SR22 G3 with a 310-horsepower Continental IO-550-N engine and an after-market Tornado Alley turbocharger conversion. The G3 variant has a modified wing with a higher fuel capacity than the G2 and with fuel caps further outboard on the wing. The cockpit features a large Primary Flight Display (PFD) and a MFD. The aircraft is equipped with a whole-plane BPRS. Maintenance history G-CTAM, had accumulated 708 airframe and engine hours. The aircraft’s last maintenance was a 50-hour check completed on 10 January 2000. During the aircraft’s last annual inspection in June 2019, at 668 hours, work on the engine including cylinder removals was carried out to address low compression on four of the cylinders. Fuel system description Two main wing tanks and two collector tanks provide for a total capacity of 94.5 USG (358 litres), of which 92.0 USG (348 litres) are usable. When filled to the tabs, below each filler neck, the total usable fuel is 60 USG (227 litres). Fuel is gravity-fed from each tank to the associated 2.8 USG collector tank where the engine-driven fuel pump draws fuel through a filter and selector valve to pressure feed the engine fuel injection system (Figure 3). An electric fuel pump is provided for engine priming when the fuel pump switch is set to prime and vapour suppression when set to boost. Each wing tank and collector tank has a drain valve to collect water and contaminants. Each wing tank has an air vent at the top of the tank which is connected to an air inlet on each lower outboard wing surface. Each collector tank has a vent line connected to its main tank.

5 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Figure 3 Fuel system diagram for Cirrus SR22 with G3 wing The fuel tank selector valve is mounted in the centre console (Figure 4). It has four positions: left, right, right-off and left-off. To move the selector to one of the off positions requires lifting the circular plunger in the centre of the selector; this design is intended to prevent an inadvertent off selection. Fuel is balanced throughout the flight by the pilot alternating the selection between left and right tank. The maximum allowable fuel imbalance is 10 USG.

6 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Figure 4 Fuel selector valve, fuel gauge and fuel pump switch Fuel quantity indication and alert system Each wing tank contains two analogue float-type sensors, one outboard and one inboard. These sensors provide fuel level information to the analogue fuel quantity indicator mounted forward of the fuel selector. An amber fuel caution light located to the left of the PFD (Figure 5) comes on to indicate a low fuel condition. It is triggered by switches in the fuel quantity indicator when both tanks are indicating below approximately 14 USG. If both tanks are equally balanced at about 14 USG, then the light will illuminate at an indicated usable fuel quantity of about 28 USG. However, if one tank is run dry when the other tank is above about 14 USG, then the light will illuminate at a usable quantity of about 14 USG. The fuel filler cap is located far outboard on the wing, further outboard than on earlier versions of the Cirrus SR22 which had smaller fuel tanks. Because of the wing dihedral, there can be fuel in the main wing tank without it being visible through the filler neck. The aircraft manufacturer estimated that the minimum usable fuel level that would still be visible below the filler neck in a wing is 15 USG with an aircraft that is perfectly level. So, it is possible for the aircraft to have just below 30 USG of usable fuel remaining without it being visible to the pilot.

7 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Figure 5 PFD, MFD and location of fuel caution light The aircraft manufacturer stated that the fuel indication system on this aircraft is accurate to within a few gallons when new, but over time the resistive elements in the analogue float sensors can suffer from wear which can result in inaccurate readings. Cirrus SR models manufactured after 2012 have a digital fuel quantity indication system, which uses a more reliable digital magnetoresistive float sensor; it is also available for retrofit on older models. Multi-Function Display The aircraft is fitted with an Avidyne Entegra EX5000C MFD. This provides engine management, navigation and fuel management capabilities. The system calculates fuel remaining at upcoming waypoints in the flight plan and displays a time remaining to fuel exhaustion. This information is portrayed in data blocks which are shown to the top left and right of the MFD map. The MFD has an input of fuel flow rate from a Data Acquisition Unit (DAU) which supplies all other engine parameters as well. The pilot enters the fuel quantity via a fuel initialisation page on the MFD and then the system calculations are based on that figure and measured fuel flow. Neither the DAU nor the MFD have any interface to the float-based fuel quantity indication system. The MFD calculates total fuel remaining but cannot calculate or display the distribution of that fuel across the aircraft’s tanks as only the total fuel flow to the engine is measured. Due to the reliance of the MFD on accurate input of fuel quantity, the Pilots Guide for the MFD contains the cautionary note shown at Figure 6.

8 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Figure 6 Caution note from MFD Pilots Guide The MFD has a message bar which appears at the bottom of the screen whenever a message is posted by any of the system functions. The messages do not trigger any aural warning tone. Messages are displayed in yellow for cautions and red for warnings. For total fuel remaining, a yellow caution is displayed with 28 USG remaining and a red warning with 10 USG remaining. The note in Figure 6 states that pilots should prepare to land immediately should the red fuel warning appear. Aircraft examination This investigation began as an AAIB Correspondence Investigation which is why the AAIB did not attend the scene or initially recover the wreckage. However, as there was recorded data on board it was decided to recover the PFD and MFD. Following data analysis, it was decided to recover the aircraft wreckage to the AAIB’s facility for further examination. This occurred after the loss adjuster had already arranged for the engine to be removed and stripped for storage. No faults, apart from corrosion, were found during the engine strip, and the engineer who removed the engine reported that he did not find any fuel in the engine fuel hoses. The level of corrosion was as expected from the aircraft’s exposure to saltwater following the ditching. No loose connections were reported during the engine removal and engine strip.

9 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 The lack of usable fuel found in the fuel tanks did not necessarily indicate that the aircraft had run out of fuel. Sea water was found in the fuel tanks and sand was found inside the fuel selector which indicated that the fuel system had been compromised after immersion in the sea. It was possible that while the aircraft was inverted in the sea, fuel had drained away via the fuel tank vents. As the external part of the vents are located on the lower surface of the outboard part of the wing, the wing’s dihedra l could have resulted in an inverted wing’s wingtip being lower than its vent pick-up point inside the tank, resulting in a siphoning effect. The aircraft manufacturer stated that there was nothing to prevent the collector tank from draining via its vent tubing into the main tank and then through the main tank vent line to the exterior if the aircraft was inverted. The recorded data also provided evidence suggesting there was usable fuel remaining, so further airframe and engine examinations were carried out. The fuel selector was removed at the AAIB’s facility, and although its rotating mechanism had seized due to corrosion as a result of sea water ingress, once the corrosion was removed the fuel selector operated normally and the central knob functioned correctly to reduce the chance of a pilot inadvertently turning it off while changing tanks. A test fluid was passed through the left and right inlets and there was no restriction to flow in either the left or right position. The fuel tank drain valves were tested for leaks and no leaks were found. The inboard floats inside the main fuel tanks operated freely. One of the outboard floats provided some resistance to movement, most likely due to corrosion, but this outboard part of the tank would have been dry at the time of the loss of power. Because the engine had already been removed, the AAIB could not determine if there had been any loose connections forward of the engine firewall, but none were reported by the engineer who removed it. The recorded data indicated an issue with fuel flow so the engine-driven fuel pump, fuel control unit and fuel flow divider were tested and strip-examined by an approved engine overhaul organisation. Some corrosion was found but no faults were found that would explain a loss of fuel flow. Recorded information There are no requirements for this aircraft to be fitted with a flight recorder. Unlike many other aircraft of this type, an optional Recoverable Data Module (RDM) was not installed. Data was recovered from the Avidyne PFD and MFD. The end of the flight was also captured by a CCTV camera. The avionics had been submersed in sea water and were not operational when recovered. The MFD stored data was on an internal Compact Flash (CF) memory card. This had suffered from corrosion damage but was repaired and the data was recovered using a working MFD. The PFD stored its data on non-volatile memory chips mounted on the unit’s circuit boards. These were removed and downloaded. The manufacturer converted the data to a usable format.

The PFD recorded general flight parameters but was not to the latest software standard so

10 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 did not record engine parameters. The MFD recorded engine and fuel flow parameters as well as the cumulative fuel used during the flight derived from the fuel flow data. The MFD also retained the last calculated figure for total fuel remaining, as displayed to the pilot, based on the last pilot input of total fuel quantity after refuelling and the subsequent sensed fuel flow values. This figure was 11.4 USG (43 litres). The recordings do not include fuel quantities sensed from the fuel tanks. Low fuel warnings generated by either the MFD or onboard systems are not recorded. The combined PFD and MFD data for the final part of the accident flight is shown in Figure 7. There was a sensor issue with one of the engine cylinder EGTs which is not believed to be relevant to the investigation. The fuel flow data shows an initial dip in fuel flow followed by a transition to a rich fuel mixture (fuel flow of 25 USG/hr) prior to the descent towards Lee-on-Solent. In the descent, there was a decrease to 4 USG/hr, which would have been insufficient to sustain combustion, followed by a recovery of the fuel flow. The decrease occurred again 20 seconds later and this time the EGTs reduced to zero indicating that no combustion was taking place. The fuel flow recovered again for about another 20 seconds before it dropped again and the EGTs reduced to zero again. There was a final recovery and drop-off before the BPRS was activated below 400 ft amsl. The data was analysed and discussed with the aircraft manufacturer, the engine manufacturer and the turbocharger manufacturer. The consensus view was that the engine’s performance was following the fuel flow. When the fuel flow was sufficiently high combustion was occurring and power was being produced, and when the fuel flow dropped sufficiently combustion ceased. The engine-driven fuel pump had been tested and functioned normally and therefore the consensus was that the loss of fuel flow was indicative of fuel starvation, ie the demanded fuel was not always reaching the fuel pump.

The data does not show when the pilot switched fuel tanks and therefore a conclusive analysis of each fuel flow reduction and increase could not be performed. The manufacturers stated that when a fuel tank is almost ‘dry’ the fuel outlet port can become uncovered and a mixture of air and fuel can be sucked up to the fuel pump, which can cause engine surging. When only air is sucked, combustion ceases. Due to fuel slosh, the port might alternately cover and uncover with fuel. At a fuel flow rate of 20 USG/hr (0.021 litres/second), a supply of 0.42 litres of fuel would be sufficient to run the engine for 20 seconds. It is possible that one or more of the fuel flow reductions and increases observed in the data was caused by fuel slosh. It is likely that at least one of the fuel flow reductions and increases was a consequence of the pilot switching tanks. When a pilot switches tanks after the system has sucked in air from a dry tank, the engine can fail to pick up or can run roughly. The turbocharger manufacturer stated that the fuel flow measurement is averaged over two or four seconds, so momentary drops in fuel flow due to air entrainment would not show up in the data. Fluctuations in longitudinal acceleration indicate that the engine was probably not running smoothly for very long in between fuel flow drops. The engine-driven fuel pump cannot suck fuel through a large amount of air, whereas the electric fuel pump, which is located below the collector tank and is gravity fed by it, can push fresh fuel up the fuel lines to clear any air. This is why activating the fuel pump is important if a tank has run dry.

11 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Figure 7 Extracts of PFD and MFD data at the end of the accident flight. Analysis of the CCTV imagery correlated with the recorded data indicated a time lag in the recorded altitude and altitude rate parameters compared to the accelerometers. The combined data indicated that the BPRS was deployed descending through 340 ±20 ft above sea level. Taking the parameter timings into account, the average descent rate over the last 1.5 seconds before impact with the water was approximately 1,500 ft/min. At the time of contact with the water the pitch of the aircraft was recorded as 74° nose down. The recorded longitudinal acceleration increased by 2 g, the normal acceleration increased by 3 g and the lateral acceleration peaked at 1.5 g, although it was unclear how accurate these values were as the system was unlikely to have been designed or tested for accuracy during dynamic impact situations such as this.

12 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 The recorded fuel usage for the four flights flown since refuelling are shown in Figure 8.

Figure 8 Fuel usage since refuelling Spot checks of engine rpm, manifold pressure, altitude, airspeed and fuel flow from the recorded data compared favourably to the data in the performance tables in the POH, which indicated that the recorded fuel flow data and derived fuel usage data was reliable, assuming no leaks. If fuelling to tabs was accurate (60 USG / 227 litres) and the recorded fuel flow and fuel used values were accurate, there should have been 13.3 USG (50 litres) of usable fuel available at the time the aircraft ditched.

13 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 The pilot stated that he started a timer on takeoff and that he switched tanks every 20 minutes. The four flights since refuelling were all more than 20 minutes long and less than 40 minutes so should have triggered one tank switch each. The tanks were not switched on the ground between flights. Applying the fuel flow figures to the tank switching method described meant that at the time of the engine problems there should have been approximately 6.6 USG (25 litres) of usable fuel in each tank. The pilot did not believe that he had missed an in-flight switch. However, if one of the in-flight switches had been missed during one of the flights on 28 May, then calculations showed that the tank in use at the time of the engine problems would have run dry and the other tank would have been close to the nominal 14 USG alert level in the location of the engine problems (plus or minus less than 2 USG). 20 minutes into the first flight on 28 May coincided with the transition from a longer stable flight leg to a turn onto a new heading, with multiple corrections afterwards. 20 minutes into the second flight on 28 May was approximately halfway along a stable flight leg. There are potential sources of error with these calculations, such as assuming the nominal ‘tabs’ fuel quantity was accurately achieved and imprecision in the timing for the remaining fuel tank switch-overs. POH Checklist The POH3 procedure for changing the selected tank states: ‘Fuel BOOST must be used for switching from one tank to another. Failures to activate the Fuel Pump before transfer could result in delayed restart if the engine should quit due to fuel starvation’. On the centre console, in front of the fuel pump switch, there is a label which states: ‘TURN BOOST PUMP ON DURING TAKE OFF, CLIMB, LANDING, AND SWITCHING FUEL TANKS.’ The aircraft POH contains checklists for actions in the event of an engine failure in flight. The checklist drill is shown at Figure 9. The POH states that items which are underlined ‘should be memorized for accomplishment without reference to the procedure’. Footnote 3 Pilot’s Operating Handbook and EASA Approved Airplane Flight Manual for the Cirrus Design SR22 covering aircraft serials 0002 thru 2978 and some others. P/N 13772-001E Revision A10.

14 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Figure 9 Engine Failure checklist The CAA Skyway Code The CAA Skyway Code4 is intended to provide General Aviation pilots with practical guidance on issues relevant to their flying. The section dealing with fuel states the following about fuel gauges: ‘Fuel gauges in most GA aircraft are not sufficiently reliable for the purposes of flight planning or pre-flight checking. Physically examining the fuel levels with a method appropriate to the aircraft type (such as a dipstick) is the best way of assessing the aircraft’s fuel state. However, in flight, low fuel gauge readings should never be ignored.’ It goes on to say the following about fuel totalisers: ‘A fuel totaliser, if fitted, is a good indicator of fuel burn. However, for the purpose of counting fuel remaining it is completely dependent on the initial fuel level being correct. It only measures fuel consumed by the engine rather than the content of the fuel tanks and would not detect a leak.’ Footnote 4 https://publicapps.caa.co.uk/docs/33/CAP1535S%20Skyway%20Code%20Version%203.pdf [Accessed September 2021]

15 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Manufacturer’s flight test involving switching fuel tanks According to Federal Aviation Regulation FAR 23.955(e), for aircraft with multiple fuel tanks and reciprocating engines, if engine power loss results from fuel depletion of the selected tank, it must be possible after switching to any full tank to obtain 75% maximum continuous power in not more than 10 seconds for naturally aspirated single-engine aeroplanes. The figure is 20 seconds for turbocharged single-engine aeroplanes provided that 75% of normally aspirated power is regained in 10 seconds. A fuel boost pump can be used to meet this requirement. The aircraft manufacturer conducted a flight test against this requirement in a Cirrus SR22 G1 with a naturally aspirated engine. The engine was run on one tank until the fuel was exhausted and then the tank was switched to the full tank. This was done three separate times with the boost pump on and three times with the boost pump off. This was then repeated on a subsequent flight with the other tank empty. The results are shown in Table 1. Flight No. Tank run dry Tank turned on Using boost pump Without boost pump 1 Right Left 8.5 14 1 Right Left 6.8 8.4 1 Right Left 6.1 17.5 2 Left Right 6.6 11.9 2 Left Right 5.5 45 2 Left Right 6.1 No start in 1 minute Time to regain 75% power (seconds) Table 1 Results from Cirrus SR22 G1 fuel tank switching flight test As it was not possible to consistently restart the engine to 75% power within 10 seconds with the boost pump off, the POH contains a limitation to engage the boost pump prior to switching tanks, and to engage it as part of the emergency procedures following loss of power. These tests were not repeated in later models of the Cirrus SR22. A later flight test involving an SR22 G3 only involved switching tanks without running one dry. Another flight test involved an SR20 G3 (which has a lower power engine), which also revealed that the fuel pump was needed to consistently regain power within 10 seconds. The turbo manufacturer stated that the addition of a turbocharger would not affect these performance figures at low altitude. The aircraft manufacturer had not retained the time-trace data from these test flights, so it was not possible to see the effect on fuel flow when running a tank dry. However, the manufacturer’s engineer involved with the flight tests stated that “the engine did not lose power suddenly but coughed and spluttered for maybe up to a 1 minute or maybe 30 seconds”.

16 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Ballistic parachute recovery system The Cirrus SR22 is equipped with a whole-aircraft BPRS, proprietarily called the Cirrus Airframe Parachute System (CAPS). The following are extracts from the POH description of the system: ‘The CAPS consists of a parachute, a solid-propellant rocket to deploy the parachute, a rocket activation handle, and a harness imbedded within the fuselage structure. When the rocket launches, the parachute assembly is extracted outward due to rocket thrust and rearward due to relative wind. In approximately two seconds the parachute will begin to inflate. Following any nose-up pitching, the nose will gradually drop until the aircraft is hanging nose-low beneath the canopy. Eight seconds after deployment, the rear riser snub line will be cut and the aircraft tail will drop down into its final approximately level attitude. Once stabilized in this attitude, the aircraft may yaw slowly back and forth or oscillate slightly as it hangs from the parachute. Descent rate is expected to be less than 1700 feet per minute with a lateral speed equal to the velocity of the surface wind. The Cirrus Airframe Parachute System (CAPS) is designed to lower the aircraft and its passengers to the ground in the event of a life threatening emergency. However, because CAPS deployment is expected to result in damage to the airframe and, depending upon adverse external factors such as high deployment speed, low altitude, rough terrain or high wind conditions, may result in severe injury or death to the aircraft occupants, its use should not be taken lightly. Instead, possible CAPS activation scenarios should be well thought out and mentally practiced by every SR22 pilot. The following discussion is meant to guide your thinking about CAPS activation. It is intended to be informative, not directive. It is the responsibility of you, the pilot, to determine when and how the CAPS will be used.’ The POH offers a range of scenarios in which the use of the BPRS is suggested. One of those is as follows: ‘Landing Required in Terrain not Permitting a Safe Landing If a forced landing is required because of engine failure, fuel exhaustion, excessive structural icing, or any other condition CAPS activation is only warranted if a landing cannot be made that ensures little or no risk to the aircraft occupants. However, if the condition occurs over terrain thought not to permit such a landing, such as: over extremely rough or mountainous terrain, over water out of gliding distance to land, over widespread ground fog or at night, CAPS activation should be considered.’

17 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 While there is no absolute limit on altitude for deployment of the BPRS the POH gives the following advice on its use: ‘Deployment Altitude No minimum altitude for deployment has been set. This is because the actual altitude loss during a particular deployment depends upon the airplane’s airspeed, altitude and attitude at deployment as well as other environmental factors. In all cases, however, the chances of a successful deployment increase with altitude. As a guideline, the demonstrated altitude loss from entry into a one-turn spin until under a stabilized parachute is 920 feet. Altitude loss from level flight deployments has been demonstrated at less than 400 feet. With these numbers in mind it might be useful to keep 2,000 feet AGL in mind as a cut-off decision altitude. Above 2,000 feet, there would normally be time to systematically assess and address the aircraft emergency. Below 2,000 feet, the decision to activate the CAPS has to come almost immediately in order to maximize the possibility of successful deployment. At any altitude, once the CAPS is determined to be the only alternative available for saving the aircraft occupants, deploy the system without delay.’ The pilot stated that he had been taught during training on the aircraft to deploy the BPRS by 400 ft above the surface and to deploy it in preference to attempting a forced landing. According to the aircraft manufacturer there have been 10 CAPS activations over water in Cirrus SR aircraft (including G-CTAM). In all but one of these accidents all occupants survived. One accident resulted in one fatality and three serious injuries following deployment in a spin at a height of 528 ft where the aircraft hit the water 4 seconds after activation. One of the accidents resulted in a serious injury and the remaining eight did not result in any serious injuries. Manufacturer’s online training programme The aircraft manufacturer has produced a CAPS training programme which discusses many issues related to the system. This is free of charge to all pilots and can be accessed here: https://learning.cirrusapproach.com/learning-catalog. In the training the manufacturer suggests a CAPS briefing format to be used for every flight and suggests pilots adopt a “CAPS available” calI when the aircraft climbs through 500 ft agl. It also addresses pilot decision making and examines a variety of scenarios for use of the CAPS. For the engine failure case the training package recommends immediate deployment of the CAPS should the failure occur between 500 ft agl and 2,000 ft agl (600 ft agl and 2,000 ft agl for SR22T Generation 5 or later), regardless of the terrain. The aircraft manufacturer stated that the guidance in the online training programme is based on their research of many successful CAPS activations over the years since the POH guidance was first published, and research of unsuccessful forced landings which resulted in injuries or fatalities.

18 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Survivability The BPRS, although deployed at low altitude, performed as expected and the aircraft hit the sea with a rate of descent of approximately 1,500 ft/min, and a nose-down pitch attitude of 74° (enough time did not pass from activation of CAPS until impact with the sea for the rear riser snub line to be cut and for the aircraft to adopt a more level attitude). While still a significant descent rate, this was preferable to a ditching at the normal approach speed of approximately 80 kt. After touchdown, the aircraft remained upright long enough for both occupants to escape onto the wing, but the parachute remained inflated and caused the aircraft to invert as they swam clear. The inversion of the aircraft would have significantly impeded their escape had it occurred immediately after touchdown. Aircraft performance Using the engine management function of the MFD to achieve best fuel performance in the cruise gives a power setting of approximately 75%. In ISA conditions at 4,000 ft, this equates to a calculated burn rate of 17.5 USG (66 litres) per hour. The recorded data indicated the aircraft had burned 15 USG (57 litres) per hour in the cruise. Time to climb to 4,000 ft would be approximately three minutes and burn 1.3 USG (5 litres). The aircraft had completed four takeoff and climb events and a total of 143 minutes of airborne time since the refuel to 226 litres described by the pilot. Based on these figures, the total in-flight fuel burn would have been approximately 43.4 USG (164 litres). Recorded data showed a total fuel burn of 177 litres. Analysis Cause of the loss of power The final loss of power was preceded by large fluctuations in fuel flow from 20 USG/ hour down to near zero. Both times that the fuel flow dropped to 1 USG/hour, the EGT’s dropped to zero, indicating that combustion briefly ceased, before recovering as the fuel flow recovered. During the earlier fuel flow reduction to 3 USG/hour the EGT’s did not drop to zero but at this low fuel flow rate combustion would have also ceased. The consensus view after discussion with the representatives of the aircraft, engine and turbocharger manufacturers was that the engine was producing power when the fuel flow was normal. The engine-driven fuel pump was tested after the accident and functioned normally and therefore it was most likely that the demanded fuel was not always reaching the fuel pump. This was consistent with the evidence from the engineer who removed the engine stating that there was no fuel in the fuel hoses in the engine. It is therefore probable that the loss of power was caused by fuel starvation, due to either a fuel leak or another mechanism.

Possible cause of fuel starvation if there was no fuel leak If a selected fuel tank is used until there is no more usable fuel remaining, a loss of power will ensue due to fuel starvation. This may be preceded by engine power fluctuations as the engine-driven fuel pump alternately picks up fuel or sucks in air as the fuel pick-up point in the tank becomes exposed. The aircraft manufacturer’s engineer stated that the engine coughed and spluttered for a while when they ran a tank ‘dry’ during flight tests. The flight

19 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 tests also revealed that if a pilot changes fuel tanks after this has happened, the engine can take a long time to recover if the electric fuel pump is not set to boost; and in one test the engine failed to recover. If the fuel tanks were filled to tabs as described, and if there had been no fuel leaks, then according to the recorded data there should have been about 13 USG (49 litres) remaining. Only about 0.5 USG of fuel was recovered from all the fuel tanks, but because the aircraft had been inverted the remaining fuel could have escaped via the air vents. According to the POH 2.5 USG of fuel is unusable, so if both tanks had been run ‘dry’ and no fuel had escaped post-impact, there should have been closer to 2.5 USG of fuel remaining. This was another indication that fuel probably escaped post impact. The pilot did not recall any fuel cautions or warnings on the MFD, and it was not possible to confirm from retrieved data whether or not they appeared. The MFD low fuel caution comes on at 28 USG remaining so should have been illuminated prior to departure from Dunkeswell. Regardless of whether it illuminated, the pilot is likely to have been aware that he had less than 28 USG prior to departure because the 84 litres he noted before departure is 22 USG. The MFD red fuel warning would not yet have appeared as it illuminates when the system has calculated there are 10 USG remaining. The pilot recalled the separate fuel caution light illuminating just as the engine began to run roughly. Since the light illuminates when the fuel quantity in each tank is below about 14 USG, it would be possible for one tank to be empty and the caution light to illuminate when the second tank reached about 14 USG. The pilot stated that he changed tanks every 20 minutes to minimise fuel imbalance and avoid such a situation. In theory, a larger tank imbalance could have been achieved by missing one of the timed tank switches during one of the four flights since the aircraft was last fuelled. If one of the in-flight switches had been missed, then calculations showed that the tank in use at the time of the engine problems would have run dry and the other tank would have been close to the nominal 14 USG alert level in the location of the engine problems, plus or minus less than 2 USG. In this scenario it would be more likely that the low fuel caution illuminated after the pilot switched tanks to address the rough running, whereas the pilot recalled it illuminated before he switched tanks. The only fuel indicators that could have differentiated between the contents of the left and right wing tanks were of an older, less reliable design, and not trusted by the pilot. As they linked into the low fuel caution system, this could explain the light not illuminating when it should have. If one tank was empty with all the remaining fuel in the other tank, then it would be expected that the engine would recover when the tank was changed. However, this did not always occur in flight tests with the electric fuel pump off because air gets sucked into the fuel system when a tank is run dry. The pilot chose to switch tanks before deciding to deploy the BPRS, and the POH states that the fuel pump must be set to boost whenever the tank is changed. The pilot did not select the pump on, however, and this would likely have had an impact on the engine’s capacity to recover had there been fuel in the tank to which the change was made.

20 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Although it is not clear which of the reductions in fuel flow corresponded with the first fuel tank switch, the engine recovered for a short period despite the electric pump not being selected to boost. However, the pilot reported that he switched tanks again because the engine faltered again. If fuel remained in the tank he first switched to, it is possible that he did not leave enough time for the engine recovery to stabilise, or that it would have stabilised more quickly with the electric pump set to boost. Had he waited longer with the pump on, it is possible he might not have felt the need to switch back to the original tank. Possible cause of fuel starvation if there was a fuel leak Another possibility for the cause of fuel starvation is that both tanks ran dry due to a fuel leak upstream of the fuel flow sensor (between the sensor and the fuel tanks). The MFD only shows fuel used as measured by the fuel flow sensor so any fuel lost upstream of the sensor would not be detected by the MFD. For this to have happened the last fuel tank switch before the engine started faltering (about 11 minutes earlier), would have needed to have occurred just as that tank was about to run dry. Also, in the fuel leak scenario the fuel caution light should have come on much earlier in the flight, in which case it was either not noticed or one of the gauges was indicating at least 14 USG while the tank was actually empty. The fuel leak scenario demonstrates the importance of not relying on the MFD figures. The only way to detect a fuel leak in flight is by direct reference to the fuel gauges and comparing their indications to expected fuel figures along the route or MFD figures. The risk of running both tanks dry as a result of a fuel leak can be mitigated in the following ways:

1. Cross check the MFD figures with the fuel gauges to look for discrepancies

between fuel remaining and fuel quantity.

1. Replace faulty fuel flow sensors if the fuel gauges are not reading accurately.
2. Calibrate the fuel gauges so you know the indications which correspond

with actual quantities.

1. Carry more fuel so that there is always visible fuel in both tanks before

departure, thereby increasing confidence in the reliability of the starting quantity. Decision to deploy the BPRS The event began at a relatively low altitude of 1,400 ft amsl, so little time was available to the pilot to action drills and attempt to resolve the engine issue. By the time the pilot had informed Lee-on-Solent of his situation and attempted a fuel tank change, the aircraft had descended to 800 ft amsl. The pilot attempted another fuel tank change, but this still had no effect. Believing that he would be unable to glide to land, the pilot deployed the BPRS in accordance with the training he received for engine failures in Cirrus aircraft, and the last altitude he recalled seeing was approximately 600 ft amsl. Data retrieved from the aircraft indicated that the BPRS was deployed descending through 340 ±20 ft above sea level.

21 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 The aircraft hit the sea in a nose-down attitude of 74° because there had not been time for the rear riser snub line to be cut, which would have pitched the aircraft back up to an approximately level attitude. This indicated that the system was deployed below a height that would have enabled the deployment sequence to complete. The aircraft hit the sea at about 1,500 ft/min (15 kt) vertical speed, and despite the nose-low attitude the occupants were not injured and were able to egress successfully. Guidance in the POH on use of BPRS The guidance on the use of BPRS/CAPS in the POH says that, following an engine failure, CAPS activation should be considered if the forced landing would be on extremely rough or mountainous terrain, over water, over widespread ground fog or at night. There is a different emphasis in the manufacturer’s online training programme which advises pilots to activate CAPS immediately following an engine failure between 500ft/600ft and 2,000 ft regardless of the terrain. The POH states that below 2,000 ft CAPS should be activated almost immediately, but it does not provide a minimum safe altitude to deploy CAPS following an engine failure. It states that the height loss from level flight deployments has been demonstrated as less than 400 ft, but it does not provide a figure of the height loss when the aircraft is already descending in a glide descent following an engine failure. However, the online training programme provides a clear minimum safe height for activating CAPS after an engine failure. The aircraft manufacturer stated that it would convene a panel to discuss updating the CAPS guidance in the POH to reflect the guidance in the CAPS online training programme, gained through in-service experience of CAPS deployments. Conclusion The aircraft suffered a loss of power, probably due to fuel starvation, but the cause of the fuel starvation could not be determined. It is possible that one fuel tank ran dry, and that the engine did not fully recover when the fuel tank was switched because the fuel pump had not been set to boost and the pilot had not kept this tank selected for long enough. However, the possibility of a fuel leak causing both tanks to run dry could not be ruled out. The pilot, believing that it would not be possible to glide to land, deployed the BPRS and the aircraft descended by parachute into the sea. Both those on board escaped uninjured. The investigation highlighted the importance of setting the fuel pump switch to boost when changing fuel tanks, the importance of checking the fuel gauges for fuel quantity and any imbalance, and ensuring the serviceability of the fuel indication system. This is because neither the fuel totaliser system of the MFD nor the low fuel indication system can warn the pilot that a tank is about to run dry. Furthermore, if the fuel level in each tank is below about 15 USG, then due to the wing dihedral the pilot cannot visually check the fuel tank contents.

22 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-CTAM AAIB-26727 Safety action The aircraft manufacturer stated that it would convene a panel to discuss updating the CAPS guidance in the POH to reflect the guidance in the CAPS online training programme. Published: 30 September 2021.

FD06710 ｜ 2021_英国_aaib-investigation-to-hawker-sea-fury-t-mk-20-g-rnhf-28-april-2021__Hawker_Sea_Fury_T_Mk_2.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

52 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 ACCIDENT

Aircraft Type and Registration: Hawker Sea Fury T Mk 20, G-RNHF No & Type of Engines: 1 Bristol Centaurus XVIII piston engine Year of Manufacture: 1949 (Serial no: ES3615) Date & Time (UTC): 28 April 2021 at 1315 hrs Location: Approximately 0.5 nm from Runway 04, RNAS Yeovilton, Somerset Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1

Injuries: Crew - 1 Passengers - 1 (Minor)

Nature of Damage: Aircraft destroyed Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 60 years Commander’s Flying Experience: 11,550 hours (of which 36 were on type)

Last 90 days - 146 hours

Last 28 days - 55 hours Information Source: AAIB Field Investigation Synopsis The aircraft was being positioned for a landing on Runway 04 at RNAS Yeovilton following a low engine oil pressure indication. As the aircraft began the base turn, the engine seized suddenly and the pilot was unable to feather the propeller. Due to the extremely high rate of descent required to maintain speed it was not possible to reach the runway. The aircraft struck the ground approximately 0.5 nm from the runway threshold. The aircraft was destroyed but both occupants were able to extract themselves from the cockpit. The engine’s rear crankpin bearing had overheated, leading to extensive damage within the rear crankcase and causing the engine to seize. Due to the severe damage to the engine, the cause of the rear crankpin bearing becoming overheated was not established. History of the flight G-RNHF was prepared for a training flight for the front seat pilot with a pilot not rated on the Sea Fury in the rear seat for familiarisation. After completing a comprehensive brief for the sortie and reviewing the technical documents for the aircraft, the crew proceeded out to G-RNHF. After strapping in, the pilot completed the pre-start process and the engine was started using external electrical power. The pilot reported that the engine started well and ran smoothly. The oil pressure initially indicated 110 psi with the oil cold, which the pilot considered to be

53 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 normal whilst the engine warmed up. The passenger noted that his oil temperature gauge was indicating that the oil was very cold. The pilot noted that his was indicating normally, and the two occupants agreed that the rear gauge was inoperative. The Sea Fury does not have a parking brake system so relies on the pilot using the foot brakes to hold the aircraft in position. As a result of this, it is preferential to complete the engine run up checks on the ramp with the wheel chocks in place. The use of chocks and the pilot pressing on the foot brakes ensures that the aircraft is secure with the much higher power setting required for the checks. The pilot spread the wings and completed other checks of the aircraft systems before running the engine up to 2,000 rpm. He then checked the magnetos and noted that the rpm drop seemed excessive on one. He noticed that the rpm had crept back so was lower than the 2,000 he had initially set. Having tightened the throttle friction, he again set 2,000 rpm and checked the magnetos. This time the rpm drops were within limits. The pilot noted that the oil pressure was steady at 100 psi at 2,000 rpm. The pilot then reduced power for the slow running rpm check but was reminded by the back seat occupant who was following the checklist that he had omitted to check the supercharger gear change over which should be conducted at 2,000 rpm. The pilot re-selected 2,000 rpm and the supercharger check was carried out and found to be normal. At 1300 hrs the pilot began taxiing G-RNHF to Runway 04 at RNAS Yeovilton. After completing the pre-takeoff checks and a final briefing, the aircraft approached the final holding position. At this point with the rpm around 600, the pilot noticed that the oil pressure was about 60 psi which was outside the normal operating limits. He confirmed with the passenger that the rear gauge was reading the same. He increased power to 1,200 rpm and the oil pressure immediately recovered. The pilot noted that repeating the engine run at 2,000 rpm for the supercharger check had probably left the oil at a higher temperature than normal and that was the cause of the momentary low oil pressure. The engine was running smoothly and there were no other signs of anything abnormal. The aircraft took off at 1309 hrs and turned to the northwest during the departure. Seeing some weather on their track the pilot turned the aircraft to the east towards clearer skies. As the aircraft was heading out to the area of operation, the pilot noted that the oil pressure was low. He immediately informed ATC, making a PAN PAN call and turned back towards the airfield. The engine continued to run, but the pilot described it is as rather “lumpy and unsteady”. He attempted to position G-RNHF for a landing on Runway 04 but having lowered the gear and flap to increase the rate of descent, the engine failed completely, generating several “violent thumps” through the airframe before it seized, leaving the propeller stationary. The pilot was unable to feather the propeller, and the increase in drag meant that it was not possible to make the airfield. The pilot made a MAYDAY call to ATC. The aircraft struck the ground around 0.6 nm from the threshold of Runway 04. The aircraft broke into several sections but both occupants were able to extract themselves from the cockpit without assistance.

54 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 Recorded information The aircraft did not carry any devices that recorded data for the accident flight. The approximate flightpath taken by the aircraft, based on position information broadcast from it, is shown in Figure 1.   Figure 1 Accident flightpath (Image Landsat/Copernicus © 2022 Google) The flight time between the start of the takeoff roll and the last recorded position was 5 minutes 30 seconds. It is estimated that the rate of descent, during the glide once the engine had seized, was between 7,000 and 10,000 fpm. Accident site The aircraft initially struck a telegraph pole, having cleared the roof of a nearby house by approximately 6 m, before it then struck the ground in a level attitude in an area of paddocks. Ground marks showed that the right main landing gear and tailwheel were extended when the aircraft touched down, however the right mainwheel then separated from the leg, which folded rearwards underneath the wing. The left main landing gear was found retracted in the wing. The aircraft slid across the surface of the paddock before striking a hedge which covered a shallow earth berm, causing the wing and engine to separate from the fuselage (Figure 2). The length of the wreckage trail from the first ground scar to the engine, which had travelled beyond the fuselage, was 95 m. The fuselage came to rest inverted, supported by the fin and the right tailplane. It was covered in a light sheen of engine oil, which was described as normal for the type by a maintenance engineer familiar with the aircraft. No fire had occurred. The propeller was in fine pitch and all five blades were folded rearwards due to ground contact.

55 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 Figure 2 Accident site (courtesy of Defence Accident Investigation Branch) Aircraft information The Sea Fury T Mk 20 is two-seat, two-cockpit conversion trainer for the single-seat Sea Fury, incorporating dual controls. It is a cantilever, low wing monoplane with folding wings and retractable main undercarriage. A Bristol Centaurus XVIII radial air-cooled engine drives a five-bladed Rotol variable pitch propeller. The aircraft type entered service with the Royal Navy in 1947. Production ceased in 1955. The type had largely been retired from the Royal Navy by the late 1950s. Several Sea Furies (both single and two seat) remain airworthy around the world. The Sea Fury T Mk 20 is a large aircraft with a maximum weight of 14,200 lb (6,441 kg), a length of 34 ft 7 in (10.5 m) and a wingspan of 38 ft 4.5 in (11.7 m). The weight of the aircraft is roughly equivalent to two Spitfires. G-RNHF was approved for passenger carrying under the CAA Safety Standards Acknowledgement and Consent regulations1. Centaurus XVIII engine The Centaurus XVIII engine has 18 cylinders arranged into two radial rows of nine cylinders (Figure 3). Each cylinder has a swept volume of 2.98 litres, giving a total displacement of 53.6 litres. The engine is rated at 2,500 hp at 2,700 rpm and 9.5 psi boost pressure. The cylinders are numbered clockwise when viewed from the front, starting from the uppermost, with the front bank having even numbers and the rear bank odd numbers. The flow of induction air-fuel mixture and exhaust gases into and from each cylinder is controlled by a sliding steel sleeve between the cylinder and piston. Each sleeve is driven by a crank, connected to gear train driven from the crankshaft, with one set of sleeve-drive gears for the forward row of sleeves and a second set of gears at the rear of the crankcase to drive the rear row of sleeves. The sleeves move in an elliptical motion and holes cut into the sleeve permit the passage of inlet and exhaust gases. Footnote 1 CAP 1395 Safety Standards Acknowledgement and Consent (SSAC), Edition 3, January 2021.

56 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 Figure 3 Bristol Centaurus engine (courtesy of Aeroplane/Key Publishing) The crankcase is comprised of three separate aluminium alloy forgings, with circular lightening holes in the crankcase webs allowing oil to pass between the front and rear rows. The front cover, attached to the forward crankcase, encloses the front row sleeve‑drive gear and supports the cover for the reduction bevel gear set that drives the propeller. A two‑speed supercharger is attached to the rear of the crankcase, and a rear cover is mounted to the rear of the supercharger casing. The rear cover carries drives for two magnetos, the starter, accessory gearbox and Hobson injection carburettor. The crankshaft is an assembly of three major components held together by four maneton2 bolts, two each at the front and rear crankpins3 (Figure 4). The crankpin bearings are steel sleeves coated with a tin-based soft white metal4 bearing layer 0.015” thick. Oil is supplied to the crankpin bearings through drillings in the hollow crankshaft, and is distributed around the bearing surface through V-shaped grooves. Oil pressure is retained in the crankpin bearing by a silver-plated fixed oil retainer (Figure 5) on one side of the master rod and a floating oil retainer on the other, which also distributes oil to the articulated rod wrist pins. Footnote 2 A maneton bolt is a fastener used to clamp the counterweight onto the crankshaft, through controlled tightening to a defined bolt stretch. 3 A crankpin is the part of the crankshaft to which the connecting rods are attached. In a radial engine, the master rod big end transfers all the loads from each cylinder to the crankpin. 4 The bearing alloy was Bristol specification B.A.C.E. 25, known commercially as Hoyt No.11 Z.3, composed approximately by weight of 86% tin, 6.0-7.5% antimony, 2.5-3.5% copper, 2.25-3.25% silver and less than 0.6% nickel.

57 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 The crankpin bearing sleeves are shrunk onto the crankpin journals to provide an interference fit, to prevent the sleeve from rotating on the journal, thereby maintaining alignment between the oil supply holes in the crankshaft and the oil entry holes in the bearing sleeve. Four dogs5 at one end of each sleeve engage with the fixed oil retainer to further restrain the sleeve from rotating on the journal. Figure 4 Crankshaft assembly Each row of nine cylinders is connected to the crankshaft by a high-tensile steel master connecting rod, to which eight articulated connecting rods are connected via wrist pins arranged around the master rod big end. The master rod big end bore is hardened and ground to the required size at manufacture, and rides on the crankpin bearing. The crankpin bearings are reliant on the presence of a lubricating oil-film to prevent excessive bearing wear and overheating. Footnote 5 In engineering usage the term ‘dog’ refers to a lug or other feature that prevents movement through physical engagement.

58 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 Figure 5 Master rod and articulated rod assembly Oil grade The General and Technical Information publication for the Centaurus Mk 18 Aero Engine6, in its Leading Particulars section, states that the oil grade to be used in the engine is a 100-weight7 mineral oil to Joint Service Designation (JSD) OM 270. This is a straight mineral oil with no additives. During the majority of the Sea Fury’s military service life however, AeroShell Oil 100U was used, which is a dispersant8 oil with metallic additives specifically formulated for Bristol sleeve valves engines. In 1965 the Ministry of Defence  (MOD) conducted a trial of OMD 370, a 120-weight dispersant oil with non-metallic additives in Centaurus engines, however increased rates of piston ring failures, piston ring gumming and head ring failures occurred which led to the trial being halted. Footnote 6 AP 102B-7501-1A, January 2006 (superseding AP 4146B Vol.1). 7 The weight of an oil is a measure of its viscosity; the higher the value, the thicker the oil is. 8 A dispersant additive assists in keeping combustion products suspended in the oil.

59 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 Stocks of 100U oil continued to be made available to the operator through the 1980s and 1990s until supplies were exhausted in approximately 2003. Following correspondence between the MOD and a lubricant specialist, a recommendation to use AeroShell Oil W100 was made. W100 is a 100-weight dispersant oil with non-metallic additives, widely used in poppet-valve piston engines. Correspondence between the MOD and the engine manufacturer in 2015 re-confirmed the recommendation to use W100 in Centaurus engines and stated that “it is essential to keep the oil system as clean as possible”. Following the installation of G-RNHF’s overhauled engine, approximately six hours of engine ground-running was carried out using straight 100-weight mineral oil, before the oil was drained and replaced with AeroShell Oil W100. Oil system The engine is of the dry-sump type with an external oil tank mounted to the firewall and an oil cooler mounted in the left wing leading edge. The capacity of the oil system is 14 imperial gallons (112 pints) and typical engine oil consumption varies between 12 and 20 pints per hour, depending on the power setting. Oil is gravity-fed from the tank, through a wire-mesh strainer to the engine-driven oil pump located at the base of the engine sump. The oil pump incorporates both a pressure pump and scavenge pump, which protrudes into the sump and is immersed in scavenge oil. Oil is drawn into the scavenge pump through a wire-mesh strainer. Additional scavenge return pumps, driven by the sleeve valve drive gear, are located at the front and rear row crankcases to return scavenge oil to the sump. Each scavenge return pump has a perforated inlet screen. Oil pressure is measured at the outlet of the pressure pump and is displayed on gauges in both cockpits which also display the oil temperature and fuel pressure (Figure 6).   Figure 6 Combined oil temperature, oil pressure and fuel pressure gauge in the front cockpit

60 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 A pressure relief valve within the oil pump is set to limit the outlet pressure to 100 psi. A separate high initial oil pressure (HIOP) valve in the oil pump limits excessive oil pressure during cold starts by bleeding excessively-pressurised oil to the inlet side of the scavenge pump. High pressure oil from the pump is fed into the rear of the hollow crankshaft to lubricate the crankpin bearings, crankshaft main bearings and oil jets that splash-lubricate the bottom of the pistons and sleeves. An additional feed from the oil pump supplies two oil centrifuges which remove sludge and aeration from the oil that is fed to two clutch units used to drive a two-speed supercharger. High pressure oil is also supplied to the propeller constant-speed unit through a separate wire-mesh oil strainer. A pressure-reducing valve is used to reduce high pressure oil from the pump to 30 psi to lubricate the sleeve-drive gears and accessory gearbox. Oil scavenged from the sump is returned to the oil tank via an anti-surge valve that returns oil directly to the tank during cold starting, when the oil is cold and viscous. Once the oil temperature has risen the anti-surge valve closes, forcing oil to flow to a thermostatic valve. When the oil temperature is below 50°C, the thermostatic valve causes the oil to bypass the oil cooler allowing the oil temperature to reach its minimum working temperature as soon as possible after the engine is started. As the oil temperature rises, the thermostatic valve progressively opens allowing more oil to flow through the cooler until the oil temperature rises to 90°C, when the valve is fully opened and all oil is passed to the cooler. Engine history The engine fitted to G-RNHF was an overhauled unit built around a core9 purchased in the USA and a set of cylinders, sleeves, pistons and gudgeon pins sourced from a supplier in Australia. The previous running hours of these components was not established due to a lack of service records. Other components required for the engine were either sourced commercially or issued from the operator’s parts store. A survey of the engine’s modification state was performed by the maintenance organisation which concluded that the engine conformed to a 1952 build standard, with the caveat that other modifications of a later date may have been embodied but could not be proven due to a lack of technical information or part number marking. The aircraft’s maintenance organisation performed an overhaul of the engine based on the requirements contained in the Bristol Centaurus XVIII Overhaul Manual. The overhaul included disassembly of the engine into its constituent parts, stripping of protective finishes and geometric and NDT inspections of critical components as required by the overhaul manual. The engine was first run after overhaul in August 2017, fitted to G-RNHF which itself had undergone repairs following an accident in 201410. The engine had accumulated 69.8 flying hours when the accident occurred. Apart from a minor oil leak from a magneto drive oil seal, there were no other engine-related deferred defects recorded. Footnote 9 The core engine consisted of the crankcase and crankshaft assembly, propeller reduction gearbox, sleeve‑drive gears, supercharger and rear cover casings. 10 AAIB Accident Report EW/G2014/07/32, published in the July 2015 AAIB Bulletin with an Addendum EW/C2014/07/02 published in the September 2017 AAIB Bulletin.

61 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 The Centaurus engine is not supported by the manufacturer under its Historic Engine Policy, and the maintenance facility and operator had to rely on copies of relevant technical publications they held on file. Original drawings and specifications for engine components were generally not available to them apart from a drawing of the crankshaft oil gland seal, which was issued to the maintenance facility by the manufacturer to allow a new seal to be produced, as no stocks were available. Maintenance programme and engine lifing policy The life between overhauls for Centaurus XVIII engines when in service use with the Royal Navy was set at 500 flying hours11. The maintenance organisation and operator noted that this figure was “difficult to achieve” based on their previous experience and they set the initial service life at 150 hours, with the intention of extending this figure based on satisfactory performance of the engine. They also agreed to perform an internal inspection of the engine at 50 hour intervals, with access inside the crankcase provided by removing one front and one rear cylinder at each inspection. The contents of the oil strainers and centrifuges were to be cleaned and examined at 25 hour intervals, and oil samples for a SOAP12 programme were to be taken at 10 hour intervals. The aircraft’s maintenance programme required annual Primary inspections, Minor inspections every two years and Major inspections every six years. Routine maintenance was also specified at 25-hour intervals. A review of the maintenance records showed that the required maintenance had been carried out in accordance with the maintenance programme. The aircraft entered an extended period of storage between November 2019 and April  2021 for which the engine was inhibited by coating the internal components with a 3:1 mix of engine oil and corrosion inhibitor13. Desiccant plugs were also fitted in place of the spark plugs. The engine was de-inhibited in February 2021 and run, following the required pre‑oiling14 process. A Primary inspection was completed on 12 April 2021 and following the replacement of spark plugs to cure engine rough running, the aircraft flew from the maintenance facility to Yeovilton on 23 April 2021. The accident occurred on the next flight on 28 April 2021. As the period during which the aircraft’s engine had not run was less than seven days, no pre-oiling process was carried out. The operator carried out a before-flight check on the morning of the accident flight, during which 1.5 gallons of oil was added to the oil tank, bringing the engine oil system level to 13 gallons. Footnote 11 The AAIB understands that application of certain modifications and Bristol Technical Leaflets extended the service life of Centaurus XVIII engines beyond 500 flying hours, but has not been able to confirm this. 12 Spectrometric Oil Analysis Programme (SOAP) is a method used to monitor the health of aircraft engines and gearboxes by periodic laboratory analysis of oil samples. The laboratory tests reveal the composition and level of metallic particles suspended in the oil sample. 13 AeroShell Fluid 2XN. 14 The pre-oiling process ensures that the engine is sufficiently lubricated following inhibiting or when the engine has not been run for periods greater than seven days. It involves removing the spark plugs and pumping two gallons of heated oil through the engine oil system at a pressure of 60 psi, before rotating the propeller by hand through 12 complete revolutions. Following this a further gallon of heated oil is pumped through the engine oil system. The oil pipe between the tank and the engine is also purged of air in this procedure.

62 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 Meteorology The weather forecast for RNAS Yeovilton was for a north-easterly wind, good visibility with broken cloud at 2,000 ft aal. Reports from the airfield at 1250 hrs indicated the wind was 040/17, visibility in excess of 10 km and cloud broken at 2,000 ft aal. There was little change between the 1250 hrs observation and the next at 1350 hrs. Airfield information RNAS Yeovilton is operated by the Royal Navy. It has a 2,292 m runway running 080-260° and a shorter 1,464 m runway 040-220° as well as a 600 m grass strip for light aircraft to the north of the main runway. Personnel The pilot of the aircraft has extensive ‘warbird’ experience including on the Sea Fury. Although this was only his second flight on the aircraft in the previous few years due to the aircraft storage and overhaul, he had flown a number of other similar types recently to prepare himself. The passenger, although not rated on the Sea Fury, also has extensive experience on similar aircraft types. He was flying in the Sea Fury to familiarise himself with the aircraft and was able to offer some assistance to the pilot during the flight. Survivability Both the pilot and passenger were wearing full military style flying kit and helmets. Despite the extensive disruption to the aircraft during the accident, neither pilot suffered serious injuries. The cockpit area proved to be strong, maintaining its shape although it came to rest almost completely inverted. None of the harness straps failed and the helmets protected the occupants’ heads during the accident sequence as well as during their escape from the aircraft. The pilot was able to leave the cockpit through the smashed front canopy and the rear canopy had slid back during the accident sequence allowing the passenger to vacate the rear cockpit. There was no post-accident fire. Examination of the pilot’s helmet after the accident showed that it had suffered a significant blow at some point during the accident sequence. Although the pilot suffered a small fracture to the skull, the helmet had protected him from a much more serious head injury. Aircraft operation Pilot notes, maintenance manuals, engine manuals and checklists were based on the original naval military documents. The operators of G-RNHF had an extensive manual suite for the servicing and maintenance of the aircraft. Emergency checklists The operator of G-RNHF had developed a set of Flight Reference Cards (FRCs) which contained the normal checklist, as well as actions to be taken in the event of an emergency.

63 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 These emergency checklists included ‘Oil Pressure Fluctuating or out of limits’, ‘Engine Failure in Flight’ and a ‘Forced Landing Drill’. The operators FRCs checklist for oil pressure fluctuating or out of limit is: Figure 7 FRCs Actions for Oil Pressure The FRCs required the aircraft to be landed as soon as possible from a glide approach. In this accident, on noticing the oil pressure issues, the pilot immediately initiated a return to Yeovilton. He did not consider that there were any mechanical signs of a failure and opted to leave the throttle where it was already located, minimising the change. Given his limited flying on the type, he decided to return to Runway 04 although this was a longer routing. Landing on Runway 08, whilst a shorter track distance, would have meant a reasonable crosswind which the pilot considered to be of a greater risk than the extra time to reach the into wind runway. As the pilot flew the aircraft around the base turn for landing, he closed the throttle as he considered that he was too high and it was very shortly after this that the engine failed. He was unable to feather the propeller and a very high rate of descent was required to maintain the aircraft speed. Although the FRCs contained a forced landing drill, there was only around 10 seconds between the engine failing and the aircraft striking the ground. The pilot did not have the time to consider or complete the drill. This meant that both canopies were locked closed, rather than jettisoned or locked open as required by the forced landing checklist. Whilst the FRCs required a glide approach to be flown, the seizure of the engine and propeller with no ability to feather would have rendered any glide approach path inadequate for the rate of descent that was required to maintain a suitable speed.

64 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 Engine examination The propeller and engine cowlings were removed along with three cylinders from the rear row which revealed that the master rod and crankpin bearing had broken up, leaving the rear crankpin journal exposed (Figure 8). The remains of fractured articulated rods and pistons were visible in the bottom of the rear crankcase.   Figure 8 View inside the rear crankcase, looking down the No 17 cylinder The engine was disassembled which showed that the front row components were largely intact, with only minor impact damage evident from debris liberated by the rear row that had entered the front row through the crankcase lightening holes. The rear master rod and articulated rods were fractured in multiple locations (Figure 9). The fractured sections of the master rod big end showed evidence of overheating and a large number of cracks were present on the face of the master rod big end bore (Figure 10). The front master rod bore exhibited similar cracking. Examination of the cracks in the rear master rod bore showed that they were intergranular, following grain boundaries, and were coated with tin. Metallurgical assessment of the cracks noted that they were likely caused by liquid metal embrittlement (LME) of the master rod steel material with molten tin from the crankpin sleeve bearing. Three conditions are required for rapid crack propagation in steel due to LME with tin; the steel must be in a state of tension, with the steel surface free of oxidation and the liquid tin must intimately wet the steel surface. All three conditions were present in the master rod big end bores during the engine failure.

65 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 Figure 9 Front view of reassembled components of the rear row master and articulated rod assembly Figure 10 Cracks (circled) in the front and rear master rod big end bores The fractures to the rear articulated rods were inspected and determined to be consistent with mechanical overload. There was no visible evidence of any progressive crack propagation, although smearing of some of the fracture surfaces during the engine failure prevented a complete examination.

66 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 The rear half of the crankshaft was bent and the rear maneton joint had slipped, opposite to the direction of crankshaft rotation, due to contact between the rear counterweight and debris within the rear crankcase liberated during the engine failure. Fretting marks were present on the mating surfaces of the rear maneton joint (Figure 11). The crankshaft rear main roller bearing had failed in overload. Figure 11 Fretting damage to the rear maneton joint Both rear maneton bolts were mechanically damaged due to impacts. The degree of stretch present in the rear maneton bolts was measured during disassembly and found to be 0.009” for the rearmost bolt and 0.004” for the adjacent bolt. This was lower than the specified range of 0.013” - 0.015”, which was recorded as being applied to both rear maneton bolts in the engine overhaul records. The elemental composition and hardness of the maneton bolts were analysed, which showed that they were manufactured from BS S97 steel rather than BS S65 steel as specified on the bolt’s part drawing. BS S97 has similar mechanical properties to BS S65. The bolts were found to geometrically conform to drawing requirements. The rear crankpin sleeve bearing was broken into three pieces (Figure 12). The sleeve’s locating dogs were sheared off and it had spun on the crankpin. The sleeve had overheated, causing the white metal bearing layer to melt and little bearing material was left on the sleeve. Metallurgical analysis of the rear crankpin bearing confirmed the elemental composition of the white metal bearing material, along with lead bromide deposits, which are formed during the combustion of avgas fuel containing tetraethyl lead. The examination also revealed a small deposit of cadmium that had melted and resolidified on the bearing’s surface, indicating that the bearing temperature exceeded 321°C during the engine failure. The source of the cadmium was considered to be a fragment of cadmium plating from elsewhere within the engine, liberated during the failure sequence.

67 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 Figure 12 Front and rear crankpin sleeve bearings The front crankpin bearing had missing regions of white metal bearing material adjacent to the oil entry holes (Figure 13). Examination of the missing bearing material under a scanning electron microscope showed that an antimony-tin phase of the white metal had melted due to contact with oil in excess of 232°C, leaving behind a copper-tin phase of the material which remained due to it having a higher melting point of 344°C. Some of the bearing material had been smeared, due to contact with the master rod bore once the lubricating oil-film was lost. The sleeve’s locating dogs were intact and it had not rotated on the front crankpin. Figure 13 Front crankpin sleeve bearing, with missing bearing material circled

68 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 The rear row sleeves were all damaged at their bottom ends due to impacts received during the engine failure (Figure 14). The sleeve drives for cylinders 3, 5 and 9 had failed in shear overload and 11 had failed in bending due to an impact. The front row sleeves were largely undamaged apart from cylinders 6, 12 and 14 which had received light impact damage at their bases. The sleeve drives for cylinders 10 and 14 had failed in shear overload. All of the sleeves in both rows of cylinders exhibited elliptical scoring marks on their outer surfaces, indicating that they were all being driven normally whilst metallic debris was circulating in the engine oil system. No significant corrosion was observed on any of the engine components. Figure 14 Typical impact damage to bottom end of a rear row sleeve (No 7 shown) The magnetos were removed and run on a test rig. Whilst the left magneto operated normally, the right magneto sparked erratically. This magneto was disassembled, revealing that impact distortion to the casing had caused the points gap to close up, causing the erratic sparking. The ignition cable harnesses did not have any evidence of pre-accident defects, and all 36 spark plugs were in good condition with no damage observed to their electrode tips or ceramic insulation. The pre-impact positions of the engine controls in the front and rear cockpits could not be established due to disturbance of the control rods and cables when the engine separated from the fuselage in the accident. The supercharger control valve was examined, however it was not possible to establish the supercharger gear selection at impact as the spool within the control valve is moved to the low gear position, under spring loading, once oil pressure is lost. Oil system examination Oil samples recovered from the oil tank, sump and crankcase all contained fine metallic debris and larger debris was trapped in the sump strainer and scavenge pump screens. A greater amount of debris was present in the forward crankcase scavenge pump screen than the rear. This could be attributed to drive to the rear scavenge pump having been lost

69 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 during the engine failure sequence due to an impact of its sleeve-drive driving gear, whilst the front scavenge pump continued to be driven until the engine eventually seized. The oil supply and return pipes between the engine and oil tank had parted in overload when the engine broke away from the fuselage. All engine oil pipes and hoses were examined and no blockages or other pre-existing deterioration was observed. The oil cooler was flushed and pressure-tested, and apart from the presence of metallic debris generated by the engine failure, no abnormalities were noted. The anti-surge, thermostatic and pressure control valves were disassembled and no defects were evident. Mechanical drive between the crankshaft and oil pump was confirmed. The oil pump was disassembled revealing that its internal components were in good condition, including the HIOP and pressure relief valves. The crankshaft oil gland seal was installed in the correct orientation and was slightly stiff, but otherwise in good condition. The oil centrifuges were opened and a small amount of oil sludge was present. The oilways within the engine, including the crankshaft oil passages were clear of blockages and the required sealing between casings was present. The oil jets on the front crankshaft counterweight and centre bearing retaining bolt were free of obstructions, however the rear counterweight oil jet was too damaged to determine its condition prior to the engine failure. Oil analysis results The aircraft operator and maintenance organisation each sent engine oil samples to different laboratories for analysis (Figure 15). Oil samples were taken either from the oil sump drain point or the oil tank, and occasionally from both points. The operator’s laboratory reported the results without reference to limiting values, whereas the maintenance organisation’s laboratory provided warnings when the levels of certain elements exceeded thresholds set by that laboratory. The oil analysis results were monitored by the maintenance organisation and did not give cause for any unscheduled maintenance or other investigation. Levels of tin above the warning level were ascribed to ‘bedding in’ of the sleeve-drive gears, which had been tin‑plated during the engine overhaul. Relatively high levels of lead in the oil, thought to originate from tetraethyl lead in the avgas fuel, were seen to reduce to normal levels following an engine oil change. No warning level had been set for lead concentration level. The maintenance organisation sent an oil sample from an oil centrifuge for analysis in July 2019, for comparison against oil drained from elsewhere within the engine oil system. This sample contained levels of metallic elements that were significantly higher than for previous oil samples. This result was interpreted by the maintenance organisation as confirmation that the centrifuges were successfully removing debris from the oil system, as was intended by their design. Following the accident a sample of engine oil was analysed which showed that, aside from metallic particles present in the oil due to the engine failure, the oil conformed to a reference sample of unused AeroShell Oil W100 apart from the Total Acid Number (TAN). The sample TAN was 0.140 mgKOH/g, which was higher than the reference sample value

70 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 of 0.016  mgKOH/g. The laboratory noted that TAN rises in engine oil during normal engine running, and that a value 1.0 mgKOH/g is regarded as an acceptable upper limit for W100 oil. Figure 15 Summary of SOAP programme data Other information Sources of airworthiness information The design standard and sources of information relating to the continued airworthiness of an aircraft operating on a National Permit to Fly (NPF) are defined in its Airworthiness Approval Note (AAN). The AAN for G-RNHF15 was issued by the CAA in September 2010, following a review of the aircraft, its documentation and a design report submitted by the applicant. G-RNHF’s NPF was issued by the CAA in 2011 and required an annual airworthiness review to remain valid, through a process resulting in the issue of a Certificate of Validity (CofV). Footnote 15 CAA Airworthiness Approval Note No. 29215, 15 September 2010.

71 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 The aircraft’s maintenance organisation holds CAA approval under CAP 553 BCAR A8-25, permitting the organisation to conduct the airworthiness review and issue CofVs. G-RNHF’s last CofV was issued on 9 April 2021 and was therefore valid when the accident occurred. G-RNHF’s AAN stated that the basis of approval for the aircraft included service experience with the type on the basis of precedence, along with an assessment of modifications as listed in AP4018C Volume 2, Part 1, which listed manufacturer’s modifications applicable to the Sea Fury. The AAN further stated that this modification list had been assessed by the applicant and those considered relevant to the airworthiness, classified B/2 or above, had been applied. AP4018C relates to airframe modifications and does not contain modification data relevant to the engine. Section 5.5 of the AAN provided a list of required manuals for the maintenance of the aircraft and its engine (Figure 16). The AAN stated a required amendment status for two of the manuals, but not for the others. Figure 16 List of required manuals from G-RNHF’s AAN In addition to the required manuals, the maintenance organisation had a copy of Centaurus Aero-Engines Modification Lists16, which contains a tabulated list of Centaurus engine modifications. The title of each modification is listed, along with its Class and Repair Modification Category, but no additional description or embodiment instructions for the modifications are provided. The maintenance organisation also had a 1958 copy of the Centaurus XVIII Illustrated Parts Catalogue17, which contains amendments to part numbers affected by issued modifications at that date. Centaurus engine modifications are generally classified by a Ministry of Supply scheme of a combination of a letter and a number. The letter denotes the Repair Modification Category and the number denotes the Class of the modification. Repair Modification Categories vary between A and D (Table 1) and Class categories vary between 1 and 4 (Table 2). Footnote 16 AP2039, Amendment List 8, January 1963. 17 Bristol Centaurus 18 and 57 Engines, Illustrated Parts Catalogue, Amendment List 12, January 1958.

72 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 Repair Modification Category Meaning A Essential. Engines not to be dispatched without. B Essential when material available, on complete overhaul. B* As B, but must also be fitted on partial overhaul. C As material available. D Only when existing parts are worn out. Table 1 Ministry of Supply Repair Modification Categories Modification Class Meaning 1 Safety modifications requiring immediate and compulsory embodiment in all engines of the type and/or mark, pending which flying is suspended. 2 Modifications of an operational character or of sufficient importance from a safety point of view to justify compulsory embodiment in all engines of the type and/or mark, but flying will not be restricted in the meantime. These modifications should be embodied before the issue of engines or aeroplanes to squadrons and similar units. 3 A desirable modification, the embodiment of which is discretionary. Commands are not entitled to refuse to accept engines which may be issued to them without these modifications embodied. 4 Modifications carried out only at maker’s works and at repair depots. Table 2 Ministry of Supply Modification Classes In addition to modifications classified as above, a significant number of the available modifications were instead classified as Salvage, relating to the re-working of obsolete parts to a later modification standard. The engine’s modification status listed by the maintenance organisation when the engine was overhauled was compared against the list of available modifications for the Centaurus XVIII. Two Category A modifications were stated as embodied, against a total of four available Category A modifications however examination of the engine by the AAIB confirmed that all four Category A modifications were present. Sixty-nine modifications classified as B/218 and listed as available for the engine were not stated as embodied at overhaul, although the maintenance organisation had noted that other modifications of a later date may have been embodied, but could not be proven due to a lack of technical information or part number marking. Footnote 18 Repair Category B modification that was Modification Class 2.

73 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 Examination of the part numbers stamped on the sleeves revealed that two of the rear row sleeves, on cylinders 5 and 7, had been subject to salvage modification E.3338. This involved reapplying nitriding to the surface of the sleeves and stamping the modified sleeves with an additional part number19. The modification title for E.3338 stated that such modified sleeves were not to be used for master rod cylinders (number 7 and 8 on the Centaurus XVIII). The operator held a copy of Historic Centaurus Mk 18 and 58 Modification Leaflets20 on file, which had originally been held by the MOD before being transferred to the operator by the MOD on 1 January 202121. This document had not been shared with the maintenance organisation by either the MOD or the operator, and the maintenance organisation was unaware that the operator had a copy of it. The operator stated that as the aircraft had been declared airworthy by the maintenance organisation, there was no perceived need to share the document with them. The document contained detailed information relating to 86 modifications for the Centaurus XVIII, issued between June 1946 and April 1955. The information provided in each leaflet included the reason for the introduction of a modification, lists of required parts, embodiment instructions and illustrations. The maintenance organisation noted that whilst certain parts listed in a Modification Leaflet might no longer be available, the information contained in the leaflets was very useful in determining whether a particular modification was embodied, or was relevant to the airworthiness of the engine. Analysis Once the pilot and passenger had strapped into G-RNHF for a staff continuation training sortie, the engine was started normally and was described as running well by the pilot. The after start and before takeoff checks were completed on the ramp with the chocks in place as was normal practise. Although the supercharger check was missed by the pilot in his normal sequence, he was prompted by the rear seat occupant to complete it before the aircraft was taxied to the runway. There were no abnormal indications during or after the engine start. As the aircraft approached the runway, the pilot noticed that the oil pressure was indicating 60 psi which was below the minimum limitation. This reading was confirmed by the rear seat occupant, but as the pilot increased the engine rpm to 1,200 the reading immediately recovered to a normal level. The pilot considered at the time that this might have been due to the oil being hotter than normal after the checklist items were completed. It is possible that this may have been the first indication of a problem with the engine. Having departed from RNAS Yeovilton, the pilot began to head east towards clearer weather when he noticed that the oil pressure was low. He informed the tower at Yeovilton and Footnote 19 SAL FB193081 for the rear row sleeves. 20 AP 102B-7501-2, July 2013 (superseding AP 4146B Vol.2, Part 1). 21 This transfer of documents coincided with the transfer of a number of historic aircraft from the MOD to the operator.

74 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 turned for the airfield. He considered that although the main runway (08) was closer, the crosswind presented a greater hazard to the aircraft and crew than the longer route to position for Runway 04. The pilot was faced with a dramatic and complete engine seizure on the base leg turn to Runway 04. The aircraft position and height at the time of the failure, combined with the very significant increase in drag with the unfeathered propeller meant that it was not possible to reach the runway and the pilot was left with no choice but to attempt a forced landing from a very high rate of descent. It is possible that, had the pilot decided to land on Runway 08, the engine might have still been running at touchdown but it is far from certain. There is no way to predict what caused the final failure and whether the cause may have occurred sooner had the aircraft throttle position been altered earlier in manoeuvring to Runway 08. Whilst the shorter pattern might have been considered a better option given the known outcome, the pilot was concerned about the crosswind when he had so little recent experience of the aircraft. The decision to proceed to Runway 04 was a reasonable one given that although the oil pressure was low there were no other indications of engine difficulties together with the pilot’s lack of recent flying on type. Although the checklist required a glide approach to be flown, clearly given the rate of descent required once the engine had seized, any such glide approach pattern would have been rendered irrelevant as the aircraft height would still have been insufficient to reach the runway. The time between the engine failure and the aircraft striking the ground was around 10 seconds. Although there was an emergency landing checklist that required the pilot and rear seat occupant to jettison or lock open their canopies, there was no time to complete these actions. Fortunately, both the pilot and the rear seat passenger were able to extract themselves from the wreckage as the front canopy had smashed and the rear canopy had slid open in the accident. The fact that both occupants were wearing helmets almost certainly saved them from any serious head injuries despite the cockpit coming to rest almost inverted. Engine failure The failure of the rear master rod resulted from overheating of the rear crankpin bearing, which caused its white metal bearing layer to melt. Increased friction between the crankpin bearing and the master rod bore was sufficient to shear the bearing sleeve’s dogs, allowing the sleeve to spin on the crankpin journal. The molten tin liberated from the overheated bearing caused LME of the rear master rod big end. This promoted rapid crack propagation in the big end, leading to its eventual fracture into three main sections under the high loads imposed on it whilst the engine was running. The damage sustained by the front crankpin bearing was caused by excessively hot oil flowing to it through the rear crankshaft, which had been heated by the failed rear crankpin bearing. This shows that some oil was still circulating within the high-pressure oil system whilst the rear crankpin bearing failure was underway. The overheated oil caused the partial melting of the front crankpin bearing, leading to similar LME-cracking of the front

75 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 master rod big end although these cracks did not grow to a critical length and the front master rod remained structurally intact. The breakup of the rear row connecting rods, pistons and sleeves occurred whilst the undisturbed front row continued to produce power, resulting in the very significant disruption observed within the rear row crankcase. The engine eventually seized when the rear maneton joint slipped, due to impacts between the rear counterweight and debris within the rear crankcase. Loss of alignment of the rear maneton joint caused sufficiently large radial loads on the rear main bearing that it failed in overload. Despite the re-nitriding of the rear row’s number 7 sleeve, which was not permitted under modification E.3338, there was no evidence to suggest that this contributed to the rear crankpin bearing failure. The sleeve had not seized in the cylinder bore and the lug at the base of the sleeve remained attached to its sleeve crank drive. All sleeves within the engine exhibited similar elliptical surface scoring due to contact with metallic debris in the engine oil whilst the sleeves were moving through their normal range of movement. Therefore the initiating event in the engine failure sequence preceded any subsequent failure of the rear row sleeves. It is uncertain whether the loss of oil pressure observed by the pilot preceded the overheating of the rear crankpin bearing, or whether it occurred as a result of the bearing failure due to another unidentified cause, which then allowed oil to leak from it resulting in a loss of oil pressure. The remains of the bearing were too badly damaged to allow a determination of the cause of the bearing failure. It is possible that mechanical failure or rapid wear of a component within the engine, unidentified by this investigation, generated debris that circulated within the engine oil system. In this scenario any debris would reach the rear crankpin bearing first, due to the direction of oil flow within the crankshaft, and could cause rapid wear of the bearing, leading to its failure. No pre-accident defects were identified in the engine oil system or its associated components. An unusually large number of oil samples were analysed for the SOAP programme, however after an initial ‘wear-in’ period, the oil analysis did not show any adverse trend that would have prompted the maintenance organisation to carry out unplanned maintenance or investigative activity. Modifications The maintenance organisation’s assessment of the modification standard of the engine was hampered by a lack of relevant information, in particular in not having access to a complete set of Modification Leaflets covering all the issued modifications for the engine. The AAN for the aircraft only contained a requirement to consider the airworthiness implications of airframe modifications classified as B/2 or above, which the maintenance organisation complied with. The list of engine modifications embodied in the overhauled engine was therefore incomplete, however this information was accepted by a CAA surveyor when an audit visit occurred prior to operation of the aircraft with the overhauled engine.

76 © Crown copyright 2022 All times are UTC AAIB Bulletin: 7/2022 G-RNHF AAIB-27257 The maintenance organisation’s lack of access to Centaurus XVIII Modification Leaflets could have been partially alleviated if the operator or, prior to 1 January 2021, the MOD had shared those it held on file, however this did not occur as the maintenance organisation was unaware that they were potentially available and therefore had not asked for them. As the investigation was unable to identify the cause of the rear crankpin bearing failure, no link can be drawn between the engine failure and the engine’s modification standard. However since B/2 modifications relate to the improvement of an engine’s safety or reliability, it is important that maintenance organisations have access to this information when assessing if an engine has a particular modification embodied, and if not, what the impact on its airworthiness may be. Enquiries made by the AAIB during the investigation indicate that difficulties in access to relevant information for historic piston and turbine engines, particularly in relation to identifying engine modification status and modification data, is a systemic problem. As a result of this investigation the CAA have agreed to meet with the engine manufacturer to discuss whether Modification Leaflets for the Centaurus XVIII can be made available to maintenance organisations servicing these engines, despite the restrictions imposed by the manufacturer’s Historic Engine Policy. Conclusion The aircraft’s engine failed shortly after takeoff on the second flight following a long period of aircraft storage. Examination of the engine identified that the rear crankpin bearing had overheated, leading to fracture of the rear master rod and destruction of the rear cylinder row components. Due to the severe engine damage, the investigation was unable to identify why the rear crankpin bearing overheated. The point at which the engine seized on the base leg for landing left the pilot with no choice but to complete a forced landing short of the runway. Despite not having time to jettison or open the canopies, both pilots were able to vacate the cockpit once the aircraft had come to rest. The investigation identified the difficulty maintenance organisations have in accessing technical information for historic engines, in particular that relating to engine modifications. The CAA have agreed to meet with the engine manufacturer to discuss whether Modification Leaflets for the Centaurus XVIII can be made available to maintenance organisations servicing these engines. Published: 26 May 2022.

FD06711 ｜ 2021_英国_aaib-investigation-to-hawker-sea-fury-t-mk-dot-20-g-invn__Hawker_Sea_Fury_T_Mk.20_G-INVN_1.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

26 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 ACCIDENT

Aircraft Type and Registration: Hawker Sea Fury T Mk.20, G-INVN No & Type of Engines: 1 Pratt & Whitney R2800-CB3 radial piston engine Year of Manufacture: 1951 (Serial no: 41H-636070) Date & Time (UTC): 4 August 2020 at 1518 hrs Location: Harston, Cambridgeshire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1

Injuries: Crew - 1 (Serious) Passengers - 1 (Serious) Nature of Damage: Forward fuselage and wings detached from engine and tail section. Extensive internal engine damage Commander’s Licence: Air Transport Pilot’s Licence Commander’s Age: 47 years Commander’s Flying Experience: 3,508 hours (of which 31 were on type)

Last 90 days - 15 hours

Last 28 days - 8 hours Information Source: Field Investigation Synopsis During the aircraft’s second flight following maintenance, its engine oil temperature rose and the oil pressure started to fluctuate. The engine then seized, forcing the pilot to make a landing in a field. The aircraft was extensively damaged and both occupants suffered serious injuries. Examination of the engine revealed extensive internal damage which resulted from the failure of a main engine bearing. The cause of the bearing failure could not be identified but the investigation determined that contamination of the oil system was the most likely cause. History of the flight G-INVN had been undergoing an annual maintenance check for the previous nine months. Completion of the maintenance check had been delayed while a new engine oil cooler and tailwheel fork were manufactured. Engine ground runs were conducted during the week prior to the accident. On the morning of the accident flight, the pilot flew the aircraft for a post-maintenance test flight. During his pre-flight checks he noticed the rudder trim had been rigged incorrectly and arranged for this to be rectified before the flight. He flew the aircraft for 15 minutes,

27 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 completing several stalls, checking the trim and completing some general handling. He reported that the aircraft was “wonderful”, the engine was “smooth” and there were no problems. Weather conditions were good, with a light south-easterly breeze, CAVOK and temperature 22°C. A second flight was planned with a journalist, who had been invited to fly as a passenger in the Sea Fury. The journalist, who was also a qualified pilot, was writing an article about it. The flight was intended to last approximately 20 minutes. N  Figure 1 Accident flight track recorded by Flightradar24 The aircraft took off from Duxford for the second flight at 1508 hrs and climbed to approximately 4,500 ft. As it climbed through 1,000 ft the pilot passed control to the passenger so he could experience flying it. As they had briefed, the pilot retained control of the throttle and rpm lever. They flew to the north conducting several turns, rolls, stalls and a loop. The track recorded by Flightradar24 is shown in Figure 1. Both the pilot and passenger reported that the aircraft was flying very well and they both recalled monitoring the engine instruments and seeing all parameters “in the green”.

28 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 The first indication of a problem occurred as they were flying back towards Duxford, passing abeam Cambridge at 2,000 – 2,500 ft. The pilot noticed that the engine oil temperature was rising. He asked the passenger to check the gauge in the rear cockpit, and the passenger confirmed it was also showing the temperature rising. At this stage the temperature was still “in the white” (being above the green band but below the second red line). The pilot manually selected the oil cooler flap to open (by holding the switch to the open position for 12 - 15 seconds) and increased airspeed to increase the cooling airflow. Approximately 20 seconds later the oil temperature passed the upper red line and the oil pressure started to fluctuate. Figure 2 Oil temperature gauge (top) and oil pressure gauge (lower left) (indications shown do not represent the accident flight) At 1618:25 hrs the pilot transmitted a MAYDAY call to Duxford: G-INVN - “mayday mayday mayday seafury india november victor november, got engine issues” Duxford - “golf india november victor november, roger, circuit is, er, traffic is just climbing out, there is nothing lined-up, we will clear the circuit, report final for either runway, the surface wind two three zero degrees ten knots” G-INVN - “copied, we seem to be losing oil pressure, temperature running high, we might not make it there” He considered diverting to Cambridge Airport, but discounted this because of a large built‑up area in that direction. The passenger recalled that the engine was now starting to run rough, and he could smell oil and see oil on the windscreen. He looked over the side and could see smoke. The engine speed then increased beyond the 2,800 rpm takeoff limit, to 3,600 rpm. The pilot brought the throttle and rpm levers fully back to contain the overspeed, reducing the rpm to 2,900 rpm. The pilot recalled the airspeed reducing but the engine was running fast, which felt counter-intuitive, and he remembered seeing brown smoke to his right. The engine and propeller then stopped rotating.

29 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 The pilot lowered the aircraft’s nose and found that it required an attitude of approximately 45° nose-down to maintain airspeed. He maintained 135 kt and remembered thinking “just keep it flying”. The aircraft was descending rapidly, which he considered gave him limited options, and his view forward was restricted by oil on the windscreen. He selected a brown field slightly to the right and at 1619:26 hrs transmitted a final call to Duxford: “just lost the engine, making a forced landing” He kept the landing gear up as he believed this was the safest option for an off-airfield landing. He selected the flaps down, though unsure if there was enough hydraulic pressure for them to travel. He did not have time to select the fuel or magnetos off nor to open or jettison the canopy. The passenger did briefly consider jettisoning his canopy but thought he did not want to create extra drag. Nearing the ground, the pilot flared the aircraft to reduce the rate of descent but did not hold it off. The aircraft hit the ground and bounced, then hit again and skidded across the field. The aircraft slid into a tree on the far side of the field, which spun it around, and it came to rest in a hedgerow (Figure 3). Figure 3 G-INVN after the accident The pilot and passenger were able to climb out and move away from the aircraft. Local residents arrived quickly, and the pilot and passenger told them to stay away from the aircraft as there remained a risk of fire from the fuel on board. Another pilot who was flying nearby and heard the pilot’s transmissions was able to locate the wreckage and pass the location to Duxford. Emergency services from Duxford arrived shortly afterwards. The pilot and passenger were taken to hospital, both having suffered broken vertebrae. Witnesses Several people saw or heard the aircraft in flight. One witness, located north-west of Cambridge, heard it pass over heading north. He tracked the aircraft on Flightradar24 and, when he saw it was coming back overhead, went to look for it. When he heard it

30 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 for the second time, he described it as “sounding totally different, clattery, not missing, sounding rough”. Several people in villages near the accident site reported hearing and seeing the aircraft before the accident. They reported hearing a rough running engine and seeing smoke coming from the aircraft. Several of them heard the engine stop. Video footage and several still photographs supplied to the AAIB showed a smoke trail coming from the aircraft (Figure 4). A witness who was close to the accident site saw the aircraft flying towards him. He described seeing “thick black smoke coming from both sides” and that “the propeller was rotating but then stopped and the nose dropped”. Figure 4 G-INVN in flight just prior to the accident with smoke trail visible (Photograph used with permission) Accident site The aircraft touched down mid-way across a smooth ploughed field travelling in a south‑westerly direction and continued until it reached a dense hedgerow with trees (Figure 5). It did not slow significantly, travelling approximately 160 m, with the landing gear raised, over the dry hard earth. After the initial impact there was a second impact impression and thereafter a debris trail of small metallic items, remains of antennas and part of an engine mount. The left wingtip struck the hedge first and caused the aircraft to rotate anti-clockwise (as viewed from above) whilst travelling along the hedge line. The aircraft came to rest in three pieces: the engine, the forward fuselage with wings, and the rear fuselage. The engine had detached from its mountings during the ground slide but was still attached to the airframe by several large-diameter electrical cables. The fuselage had broken just aft of the front windscreen, which coincided with the rear of the wing structure.

31 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 N  Figure 5 Accident location Recorded information Video footage of the morning flight included the start-up, taxi, takeoff and landing, and showed a smoke trail from the aircraft on takeoff. Several people watched this takeoff and opinion was divided as to whether the smoke trail was normal. The image in Figure 6 was taken after the flight and showed an oil streak along the left side of the aircraft. The oil streak appeared to emerge from the crankcase breather duct positioned beside the cowling flaps. Figure 6 G-INVN after the first flight showing an oil streak on the left side (Still photograph taken from video used with permission - Sky High Films) Further video footage showed the start-up, taxi and takeoff of the accident flight. During the pre-flight checks, smoke could be seen coming from the exhaust for the No 9 cylinder (rear bank, master cylinder) (Figure 7). No smoke was observed coming from any other exhaust. The footage also showed a smoke trail during the takeoff, and there appeared to be more smoke than was visible on the first flight.

32 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Figure 7 G-INVN before the accident flight showing smoke from No 9 exhaust (Still photograph taken from video. Image used with permission) Aircraft information G-INVN was a Hawker Sea Fury T.20 two-seat training aircraft originally built in 1951. The aircraft was used in a variety of roles until, in 1990, it suffered an engine failure and forced landing in which it was significantly damaged. It was rebuilt and returned to the UK in 2009. During the winter of 2017/2018 the Bristol Centaurus engine was removed and replaced by a Pratt & Whitney (P&W) R2800-CB3 18-cylinder radial engine. The five-bladed propeller was replaced by a 4 m diameter four-bladed propeller from a Grumman Guardian. The engine had been overhauled in 2016 and had completed 86 flying hours before the accident flight. The aircraft was used for private flights, display flying and recreational flights within the Safety Standards Acknowledgement and Consent framework1. Engine The P&W R2800 engine has two banks of nine cylinders driving a single crankshaft. The crankshaft drives a supercharger to compress the fuel/air mixture from a carburettor mounted on the upper rear crankcase. Aft of the supercharger is an accessory gearbox to which the oil pumps, filters, an electrical generator and a starter motor are attached. The front of the crankshaft drives another accessory gearbox for magnetos, an oil pump and the reduction gearbox for the propeller. The engine has an oil-fed propeller governor to control the pitch of the propeller blades. Cylinder numbering is shown in Figure 8 with the engine viewed from the front. Footnote 1

Safety Standards Acknowledgement and Consent (SSAC) | UK Civil Aviation Authority (caa.co.uk) [accessed January 2021]. SSAC is a risk analysis framework that allows operators to offer fare-paying recreational flights in certain aircraft that are unable to meet commercial safety standards. An operator intending to offer SSAC flights must ensure that the risks to both participants, third parties and other airspace users have been considered.

33 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Figure 8 Cylinder numbering (Pratt & Whitney) The design of the crankshaft evolved throughout the life of the R2800 programme, with the CB3 crankshaft one of the last iterations. The crankshaft is made up of three sections, split at the forward and rear crankpins to facilitate assembly, and is structurally stiff along the axis of the shaft. This inherent stiffness results in a lower load on the centre of three plain crankshaft journal bearings (Figure 9), which are steel shells with silver plating on the internal and external faces. There are locking tabs on the bearings which engage in the crankcase to prevent rotation. Each bank of nine pistons is connected to the crankshaft by a master connecting rod and eight link connecting rods (Figure 10). The master rod bearing and the eight link pins are held by two retaining plates. The master cylinder (in which the master rod is located) is No 8 in the front bank and No 9 in the rear bank. The master rod bearings are silver-plated steel plain bearings with a lead-indium coating on the internal bore. The crankpin bearing faces are nitrided to harden the surface, with case hardening approximately 0.76mm (0.030 inch) thick. During the engine overhaul in 2016, all the crankshaft bearings were inspected and the lead-indium coating on the two master rod bearings was re-plated. Each cylinder has two poppet valves, one for inlet and one for exhaust. These are opened and closed by rockers and pushrods driven from a cam ring inside the front and rear crankcases. There are external pipes for the fuel/air mixture from the supercharger and each cylinder has its own exhaust pipe. With reference to Figure 8, cylinder Nos 2 to 10 (in blue) exit on the right side of the airframe, and cylinder Nos 11 to 18 and No 1 (in green) exit on the left side.

34 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Crankshaft split Figure 9 Crankshaft (Pratt & Whitney) Figure 10 Master connecting rod assembly (Pratt & Whitney) Master rod bearing (Photograph used with permission) The pistons are manufactured from aluminium and have five piston rings: three compression rings, a dual oil control ring and a fifth scraper ring at the bottom of the fullskirt. Oil system The engine oil lubrication system installed in G-INVN was a hybrid system using some parts from the original Bristol Centaurus installation and other parts specific to the R2800 (Figure 11). The oil tank was fitted to the cockpit firewall and comprised original equipment modified to allow additional clearance from the starter motor on the rear of the engine. The outlet pipe from the tank fed the pressure oil pump on the engine rear accessory case, providing the primary oil pressure for the system.

35 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Within the engine, oil from the pressure oil pump passes through the pressure oil strainer and then into seven individual oil pathways to ensure complete lubrication. Oil to the rear crankshaft journal is supplied by a short pipe from a pocket in the centre of the rear crankshaft. Oil passes through the centre of the crankshaft to the front of the engine, lubricating the crankshaft, pistons and master rod bearings. Another pump in the front accessory case boosts the oil pressure to the propeller governor. Oil is returned to the rear of the engine by the front scavenge oil pump and then pumped out of the engine by the main scavenge oil pump. Oil from the rear of the engine passes through the rear case drain screen before joining the scavenge system. The oil pressure gauge in each cockpit was connected to a common pressure tapping on the rear engine case. The oil temperature gauge in the front cockpit was connected to a sensor in the oil outlet pipe, whereas the rear cockpit gauge was connected to a sensor in the rear accessory case. They were both protected by the same circuit breaker (CB) labelled ‘oil tmp’. Scavenged oil passed through a metal mesh Cuno2 pressure filter mounted on the engine firewall and then to a bypass valve. The Cuno filter replaced the original suction filter which was installed between the oil tank and the engine. The pressure oil strainer was fitted with a bypass valve which operated if the filter became blocked. The outlet pressure of the scavenge pump was unregulated, so a bypass valve provided over-pressure protection for the oil cooler and was set to open at 100 psi. Oil cooler system An oil cooler was installed in the left wing root and used the airflow of forward flight to cool the oil (Figure 12). Air entered the cooler through a slot in the wing leading edge and passed through the cooler core, which was made up of 5.2 mm diameter copper alloy pipes. Heated airflow exited through the lower wing surface and was regulated by a movable flap. A cockpit switch allowed the flap to be manually opened, closed, switched off, or to operate automatically. The switch was sprung to off, in which the flap would remain in its current position, and it was necessary to hold it in either the open or close position to manually adjust the flap. The switch was normally placed in auto. The flap was opened and closed by an electrical actuator and used a temperature sensor in the cooler outlet in the auto mode. The circuit was protected by a CB labelled ‘oil clr’. Footnote 2 A Cuno filter is a cartridge oil filter made up of alternating metal woven mesh disks and spacers. Contamination is caught on the mesh.

36 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Figure 11 Oil system schematic

37 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Figure 12 Oil cooler If the oil temperature was lower than 50°C the thermostatic valve diverted the oil to the bypass inlet of the cooler, where it flowed around the cooler frame and back to the oil tank. The valve would gradually open as the oil temperature rose from 50°C to 95°C, allowing hot oil to flow into the cooler core and over the matrix of copper alloy pipes. The core was made up of ten sections with internal baffles, forcing the oil to travel back and forth across the core sections to maximise contact with the air-cooled pipes. At the end of the core the oil joined the bypass flow in the frame of the cooler and returned to the tank. Several entries made in the aircraft maintenance log in 2019 referred to the oil cooler leaking. Each entry was closed stating that the cooler had been repaired. During annual maintenance in October 2019 it was noted that the cooler was leaking again. The cooler was removed and sent to a specialist to manufacture new core sections and replace them in the original frame. The cooler was then flushed and pressure tested to ensure integrity prior to completion. The rebuilt cooler was fitted in July 2020. Crankcase breather In all piston engines there is some leakage of combustion gases past the piston rings into the crankcase. To allow these gases to escape without damaging the engine there is a ventilation system in the crankcase. The internal volume of the engine, from the propeller reduction gearbox to the supercharger, is interconnected and allows free passage of oil and gases. On the front face of the supercharger diaphragm there are four orifices located on the periphery of the casing which lead through internal passages in the crankcase to two ports on the rear of the crankcase. These ports are connected by pipes to ducts mounted on the side of the engine cowls (Figure 13).

38 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839      Supercharger diaphragm Figure 13 Crankcase breathers (Photograph (left) used with permission - Aerotech (Suffolk) Ltd) Oil priming process G-INVN had last flown on 28 October 2019, before the maintenance check. The engine was not run again until 3 August 2020 due to the oil cooler replacement. The engine oil was replaced and the filters were cleaned in January 2020. The engine was not inhibited whilst waiting for the new cooler. Before the engine was started after the maintenance check, the oil which had collected in the engine was drained and an oil priming rig was attached to the oil pressure tapping on the rear case. The oil priming rig was used to heat approximately two gallons of engine oil to 60°C and then pump it into the engine at about 80 psi using an electric pump. This process was intended to ensure that all the bearings were lubricated before the first engine start after being dormant. The priming oil was pumped through the engine and the other system components and added to the oil already in the tank. The propeller was rotated by hand during priming, with one spark plug removed from each cylinder to ensure that no hydraulic lock3 occurred. No written procedure was available for the operation of the priming rig but the person operating it had been trained by those familiar with it. After completion of the priming process, the engine was run on the ground to verify system functionality. High power ground runs, the first flight and the accident flight were all made the following day. Footnote 3 Oil can enter the lower (inverted) cylinders of an engine by seepage past seals and piston rings. A hydraulic lock occurs when the volume of any incompressible fluids in a cylinder approaches the volume remaining as the piston moves towards top dead centre. If the engine is rotated past this point, mechanical failure can occur, usually manifesting as damage to the connecting rods.

39 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Propeller pitch control Pressurised oil from the front accessory case pump is fed to the propeller governor to control the pitch of the propeller blades and maintain the selected engine rpm. Aerodynamic loads on the blades tend to move them to ‘fine’ pitch to align with the blade rotation. In fine pitch the load on the engine decreases and the speed of the propeller increases. When the blades are rotated to ‘coarse’ pitch their angle of attack increases, increasing the load on the engine and reducing the speed of rotation. Aircraft examination Initial inspection An inspection of the aircraft at the accident site revealed the damage sustained either whilst travelling cross the field or during the impact with the hedge. Two propeller blades were bent backwards and had scratches consistent with scraping across the ploughed field. One blade had detached at the blade root and had failed in bending, and there was evidence of it having struck a substantial tree trunk in the hedge. The engine had become detached from the mounting structure and had pitched nose-down as it travelled across the field. This motion had caused the starter motor to rupture the engine oil tank, so it was not possible to determine the amount of oil remaining in the system before impact. The rear of the engine bay was covered in oil and there was evidence of oil contamination on the ground. The carburettor, generator, one magneto and other engine ancillaries had suffered impact damage during the accident. The fuselage had split to the rear of the windscreen and the gap between the two sections was approximately one metre. The sheet metal on the left side of the break showed signs of compression buckling and tearing in tension whereas the right side showed only tearing in tension. The cockpit instrument panels were largely intact, but the transponder had become dislodged and was found several metres to the right of the fuselage. All the CBs were closed (in) except the ‘oil clr’ and ‘oil tmp’. There was evidence of oil streaking along the side of the fuselage from each of the crankcase breather ducts (Figure 14).    Figure 14 Oil streak from crankcase breather ducts

40 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 The left wing was significantly damaged by the impact with the hedge, with multiple tears, and the tip structure had detached (Figure 15 left). The right aileron was significantly damaged and was deformed by a large tree. The flap lever was in the fully DOWN position and the flaps had partially deployed. The landing gear lever was in the UP position with the landing gear retracted, but the landing gear was not locked and the legs extended freely during the recovery. The tail structure was intact and the right tailplane had dug into the ground. The partially deployed tail wheel had scribed an arc in the grass (Figure 15 right). Figure 15 Engine section, aircraft forward and aft sections The oil cooler inlet cowling was deformed and the front of the cooler was clogged with earth. The outlet flap was closed but the actuator arm had penetrated through the surface, indicating that the flap had been at least been partially open and was forced closed during the ground slide (Figure 16). Actuator arm Figure 16 Oil cooler outlet flap

41 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Preliminary engine strip down The engine was disassembled under AAIB supervision. Initial inspection showed that no external components were missing from the engine, there were no signs of component failure, it was still seized and all visible external damage had been sustained during the ground slide. The engine had seized with the No 1 piston (rear bank) at or near top dead centre (TDC). Correspondingly the No 10 piston (front bank) was also at or near TDC. All the rear bank pistons were damaged below the scraper ring groove and the scraper rings were partially lost (Figure 17 left). Around the periphery of the piston crown it was evident that some pistons had struck the top of their cylinders (Figure 17 centre) and there were indentations from the inlet valves in all the piston crowns. The side of all pistons showed evidence of abrasion and the compression rings were entrained in the grooves of the master piston (Figure 17 right). Figure 17 Rear bank piston damage (Piston No 9 shown) There was considerably less damage to the front bank pistons, with only abrasion damage to the skirts and some pistons retaining metal fragments inside the rear of the piston. There was evidence on some piston crowns, in each bank, of a grey powder deposit (Figure 18). A sample was removed, analysed, and found to contain aluminium, carbon, oxygen, lead and bromine.

42 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Figure 18 Piston crown deposit (piston No 13 shown) Some cylinder barrels had impact damage to the flange which engages inside the crankcase. The shape and size of the damage was inconsistent: whilst most flared outwards (Figure 19), one cylinder was flared inwards. Figure 19 Cylinder flange impact damage (cylinder No 15 shown) The pressure oil pump was removed and could be turned by hand. There was evidence of fine metallic debris in the oil passageways. The front scavenge pump would not turn by hand but there was no evidence of damage to the drive gears. The pump was disassembled, and metallic debris was found within the gears, preventing them from turning (Figure 20). No other damage was observed.

43 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Figure 20 Front oil scavenge pump The two engine oil filters and the Cuno filter were removed and their contents examined. The metal mesh filters contained a large amount of fine metallic debris whereas the rear case screen contained a quantity of large metallic fragments (Figure 21). These fragments were identified as broken pieces of piston skirt and piston ring. The fine metallic debris was analysed and was found to be silver, iron, aluminium and copper.    Figure 21 Left – pressure oil strainer. Right – debris from rear case drain screen Crankcase strip down The propeller reduction drive gearbox, front & rear accessory cases and the supercharger were removed from the crankcase. More metallic debris was found inside all sections, similar to that found in the oil filters. None of the components were significantly damaged and all were present and correctly located. On all internal faces the coating of oil was heavily laden with fine metallic particles and there were indications that the oil had reached an abnormally high temperature.

44 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 An inspection of the front and rear crankcases revealed evidence that the front and rear crankshaft journal bearings had rotated in the crankcase. The locking tabs of both bearings had dragged in the casing (Figure 22) with the front bearing having rotated approximately three to four degrees. The rotation of the rear bearing was at least 120° as there was continuous mechanical damage between the locking tab slots. It was not possible to determine if the bearing had rotated more than 120°. The bearing surfaces were heavily scored (Figure 23) and there was evidence that the silver had melted and solidified. The centre crankshaft bearing showed no evidence of rotation but some evidence of scoring. The silver bearing material was largely intact. Figure 22 Left – Detail of front bearing rotation (arrowed) and molten metal (circled). Right – Detail of rear bearing rotation    Figure 23 Left – Front crankshaft journal bearing Right – Rear crankshaft journal bearing Crankshaft The crankshaft journals were heavily scored and there was evidence in the journal oil holes of a build-up of fine metallic particles (Figure 24). When the supercharger output shaft was removed from the rear of the crankshaft, the metallic particles retained in the crankshaft pocket were found on the end of the shaft (Figure 25). The oil pipe to the rear bearing was

45 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 blocked and the rear secondary counterweight bearing showed evidence of running without lubrication. The front journal bearing hole was partially blocked restricting the supply of oil to the bearing.    Figure 24 Left - Front crankshaft journal (oil holes circled) Right - Rear crankshaft journal (oil hole circled) Figure 25 Metallic particles filling the rear of the crankshaft Supercharger output shaft – Left. Crankshaft pocket – Right The crankshaft was split into its three sections and the master rod assemblies were removed. Both crankpins were deeply scored and one side of the rear crankpin was heavily worn. The nominal diameter of a crankpin is 89.027 mm (3.505 inches) and Table 1 shows the diameter with reference to Figures 26 and 27 for the rear crankpin. Front crankpin wear

46 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 was similar to the rear but to a lesser extent, with the smallest diameter of 88.519 mm across the same line as the rear crankpin (A-E). Measurement (mm) 1 2 3 4 A-E 84.328 84.074 84.023 84.455 B-F 86.665 86.360 86.436 87.757 C-G 89.408 88.773 88.265 88.900 D-H 87.173 86.157 85.344 85.852 Table 1 Rear crankpin diameters Figure 26 View looking aft on rear crankpin (centre crankshaft removed)   1 2 3 4 Figure 27 Side view of rear crankpin (centre crankshaft removed) Left - view on G. Centre – view on E. Right – view on C

47 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Master rods The front master rod assembly was removed and there was evidence of extensive bearing material erosion and scoring of the bearing face. The bearing faces were wet with heavily contaminated oil indicating that the bearing was being lubricated until the engine stopped. The rear master rod assembly also showed evidence of heavy scoring with very little of the bearing material remaining (Figure 28). There were also substantial amounts of loose, metallic particles on the bearing face. The castellations on both ends of the bearing had been significantly damaged along with the corresponding castellations of the retaining plate. The castellations had become swaged together and had to be cut away to enable the bearing to be pressed from the master rod. No defects or bending were found on the link rods of either master rod assembly.   Figure 28 Rear master rod showing bearing damage Thermostatic valve The thermostatic valve was found in the hot oil position despite being at ambient temperature when examined. When the valve was disassembled it was found that metallic particles had jammed the valve, preventing it from returning to the bypass position. The valve was cleaned and was found to operate correctly. The particles that had jammed the valve were identified as iron, silver, aluminium and lead. Temperature sensors The two temperature sensors were examined and subjected to an electrical continuity test. No defects were found with the sensor removed from the rear accessory case (rear cockpit) but the sensor providing indications in the front cockpit was damaged. The electrical connector was disconnected from the sensor and it was found that the pins had become twisted together (Figure 29).

48 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Figure 29 Oil temperature sensor electrical connection pins Oil cooler The oil cooler was scanned using computerised tomography (CT), which showed many metallic particles within the cooler. Several large bright particles were visible in the hot oil inlet which were determined to be silver (Figure 30). Multiple bright particles were identified throughout the core of the cooler, with a higher concentration towards the inlet end (examples circled in Figure 31). Other particles, probably of aluminium, were also identified throughout the inlet and the core. It was not possible to perform a detailed analysis of the inlet pathway, from the inlet pipe to the first core pack, because the X-rays did not penetrate the multiple layers of brass and steel. Figure 30 Section view through the oil cooler - hot oil inlet

49 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Figure 31 Oil cooler core. Some particles highlighted Survivability Whilst the fuselage had split across the front cockpit, the space the pilot occupied had remained largely intact. The rear cockpit was not disrupted. This left a survivable space for both occupants. The aircraft did not catch fire, despite having approximately 700 litres of fuel onboard, which allowed time for them to escape. Both occupants were wearing kevlar flying helmets. It is likely these protected them from more serious head injuries. Meteorology At 1520 hrs, Cambridge Airport (5 nm north-east of the accident site) reported surface wind from 240° at 11 kt, visibility greater than 10 km, few clouds at 4,800 ft, temperature 22°C, dewpoint 6°C and QNH 1013 hPa. At 1520 hrs, Stansted Airport (16 nm south south-east of the accident site) reported surface wind from 230° at 12 kt and visibility greater than 10 km. There was no discernible cloud, the temperature was 22°C, dewpoint 7°C and the QNH 1014 hPa. The weather did not change significantly during the three flights the pilot conducted on the day of the accident. Pilot background The pilot held an EASA Air Transport Pilot’s Licence and was a qualified Test Pilot. He was flying the Sea Fury on a valid Single Engine Piston rating. He also held a Flight Instructor rating and an Aerobatic rating. He held a valid Class 1 medical certificate. He had a total flight experience of 3,508 hours including 31 hours flying G-INVN. After the accident the pilot reflected on the aspects of his previous experience which he felt had helped him manage the engine failure. He had previously practiced 10 – 15 forced

50 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 landings in a Spitfire simulator. Although the simulator was not representative of a Sea Fury, he felt it helped to reduce the startle and stress of the real thing. He reported that it enabled him to focus on flying the aircraft and maintaining airspeed. Just prior to the accident flight he had flown a display in a North American P51D Mustang to renew his Display Authorisation. Prior to the renewal flight he had discussed with the examiner how to manage engine failures during a display. They considered the priority was maintaining airspeed and that an off-airfield landing may be the safest option even when close to the airfield. They agreed that the key was to arrive at the ground with the wings level and a low rate of descent. The pilot had also previously experienced engine failures in a Boeing Stearman biplane and in a Saab Safir single engine training aircraft, although these had both occurred over airfields and he had been able to land successfully. He described how he always took time to think about the aircraft type he was due to fly, to review the operating handbook and to visualise his actions. He also felt that his currency helped: although he had not flown the Sea Fury recently, he had flown a Chance Vought Corsair which has the same engine type. He commented that he had attended the annual Warbird Symposium at Shuttleworth House in February 2020 which included lectures on engineering, operations, human factors and lessons learnt from display flying. He felt this refreshed his knowledge and helped him think clearly as the emergency unfolded. Organisational information The accident flight was a private flight. The operator provided a copy of the Organisational Control Manual (OCM) under which the aircraft was being operated (in accordance with CAP 6324) and a copy of the Pilot’s Notes for G-INVN. The only guidance relating to engine failure in the pilots notes stated: ‘A power off landing should NOT normally be made with full flap as the flight path with gear down and full flaps is very steep and the rate of descent is very high. The recommended technique is to lower the flaps to the takeoff position whilst maintaining 130 kt. When landing is assured the flaps should be lowered to the max lift position and a gradual round-out should be performed to change the attitude and flight path angle, and to arrive at the threshold at 115 kt. There is little increase in the landing roll between max lift and down flaps. A flapless glide-speed of 150 kt is recommended until landing is assured.’ Footnote 4 CAP632 – ‘Operation of “Permit-to-Fly” ex-military aircraft on the UK register’. This document specifies the operational requirements that an applicant for the issue of a Permit-to-Fly for an ex-military aircraft is required to meet.

51 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Other information Propeller driving the engine – manifold pressure insufficient for selected engine speed In a radial engine, as the crankshaft rotates in normal operation, the resultant force from the power stroke of each piston and the centrifugal load, is directed at the same spot on the crankpin via the master rod assembly. The location of the oil supply hole in the crankpin is optimised to ensure an effective oil film lubricates the master rod bearing in normal operation. The oil flow is turbulent as it enters the clearance between the crankpin and the bearing, and therefore is not an effective lubricating film. Consequently, the oil hole is positioned such that the oil has become a uniform laminar film as it reaches the highly loaded bearing faces (the precise location having been established empirically by the manufacturer as it developed the engine). If, because of insufficient gas load (manifold pressure), the propeller is allowed to drive the engine, the resultant force on the crankshaft is applied to the opposite side of the crankpin, where the oil supply is not optimised, and may quickly damage the bearing. This damage worsens over time and eventually the bearing will fail. Failure may occur several hours after the initiating event, and therefore a pilot may inadvertently damage the bearing without seeing any immediate symptoms requiring maintenance intervention. The engine is designed to cope with some reverse loading for brief periods, for example when the propeller is driven at lower airspeed when landing, but critical damage may occur quickly at higher speeds. An Engine Operating Information Letter published by Pratt & Whitney in January 19525, describes how low manifold pressure with high rpm can lead to the propeller driving the engine and cause bearing damage. The letter recommends ensuring at least one inch of manifold pressure be used for each 100 rpm (so that for example at 2,200 rpm, 22 inches is the minimum manifold pressure). This feature of radial engines was discussed with the accident pilot. He was familiar with the issue and reported that he always operated the engine to avoid low manifold pressure with high rpm. Whilst it was necessary to close the throttle to land, at this stage the airspeed was relatively low, and at high speed he would ensure the manifold pressure was greater than the rpm/100. When flying the stall manoeuvres, he reported that he flew a gentle climb to avoid needing to select idle power. After speaking to the accident pilot, the AAIB interviewed all the pilots who had flown G-INVN for the previous 20 flights (back to 26 August 2019). All reported they were familiar with the hazards of operating at insufficient manifold pressure and reported that they operated the engine to keep manifold pressure above rpm. Footnote 5 Pratt & Whitney Manual of Engine Operation – Engine Operation Information Letter Number 25, 22 January 1952.

52 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Other pilot’s reports The only problem reported by these other pilots was the oil leaks from the oil cooler. They reported that the oil temperature was never a problem in flight. Once the engine had warmed up, the oil temperature remained constant. They all reported that they left the oil cooler switch in auto in flight. A few pilots selected the switch to open after landing if they had a long taxi and the weather was warm.

Off-airfield landing The pilot reported that when the engine failed, he did not consider abandoning the aircraft. He had briefed the passenger that if the engine failed whilst away from the aerodrome he would attempt to land in a suitable field. When the engine did fail, he still considered this to be the safest option. Reflecting after the accident he was confident that this was the correct decision. He felt that, given the low altitude and the high rate of descent required to maintain airspeed, there was not enough time for them both to abandon the aircraft safely. There was no procedure for an off-airfield landing in the pilot notes provided by the operator. However, based on his experience the pilot considered a gear-up landing was the safest option. He believed this would minimise drag in the descent, reduce the risk of the aircraft tipping over on landing and remove the risk of only one gear extending with limited hydraulic pressure. Figure 32 is an extract from the pilot notes published by the Royal Navy for the Sea Fury Mk 10 & 116. Figure 32 Extract from the Sea Fury Mk 10 & 11 pilot notes 6 A.P. 4018A & B -P.N. Sea Fury Mk 10 & 11 Pilot Notes, 2nd Edition, May 1950.

53 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Passenger briefing The OCM required passengers to be briefed on seatbelt operation, canopy hood operation, communication equipment, forced landing procedure, in-flight emergencies, bail out procedure and aircraft hazard areas. The passenger reported that he received a thorough briefing in all these areas before the flight. He recalled that he and the pilot discussed the procedures for making an off-airfield landing and for abandoning the aircraft. They briefed that they would make an off-airfield landing if the engine failed and it was not possible to reach an airfield, and that they might need to abandon the aircraft in the event of a fire or after a mid-air collision if the aircraft was uncontrollable. Chip detectors To assist in the early detection of failures some engine and gearbox systems are equipped with magnetic chip detectors, in which magnetic plugs are installed at strategic locations within the oil system to attract ferrous material. In systems that provide an indication in the cockpit, when enough metal has built up on the plug it forms a bridge across an electrical connector and illuminates a warning light to alert the pilot. In other systems it is necessary to remove the plug to inspect for any build-up of particles on the magnet. A major operator of R2800 engines has used such a system successfully to provide early warning of significant damage, enabling remedial action before catastrophic failure. Corrosion in inactive engines Corrosion is a possibility in engines during any extended period of inactivity, and inhibiting procedures are intended to address this. UK operator experience indicates that large radial engines that are inactive for several months without inhibiting do not necessarily suffer catastrophic failure.7 Analysis Accident flight indications The first abnormal indication reported by the pilot was the increase in oil temperature. The oil temperature continued to rise and, soon after, the oil pressure was seen to fluctuate. The increase in oil temperature was caused by the oil encountering increased heat energy from multiple sources and a reduction in the effectivity of the oil cooler. Video footage of the engine run-up before the accident flight showed smoke emerging from the rear bank master cylinder (No 9) but not from any other exhaust. As the engine had been run for several minutes it is likely that any residual oil in the cylinders would have been burnt off or blown from the exhausts by that time. The No 9 piston exhibited substantial wear on the leading face of the piston (relative to engine rotation) and some of the piston rings were entrained into the piston ring grooves. This would have allowed oil to pass into the combustion chamber, generating the observed smoke, and would have allowed Footnote 7 UK operator of up to eight R2800-CB3 engines in low utilisation between 2004 and 2008, involving inactive winters of approximately seven months, following which there were no reported operating issues.

54 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 combustion gases into the crankcase. These gases would have elevated the temperature inside the crankcase and some of this additional heat energy would have been absorbed by the engine oil. The abnormal wear of the master piston was a result of the change in geometry between the master rod, crankshaft and master piston. The relationship between the crankshaft and the master rod is determined by the master rod bearing, so this change in geometry would indicate bearing wear. The metal particles liberated from the rear bank master rod bearing passed around the engine oil system and contaminated the entire engine, increasing friction and generating more heat in all moving components. All the oil filters were heavily contaminated with metal particles and from the CT scan it was evident that some material had also been captured within the oil cooler core. The multiple path arrangement of the cooler enabled oil to continue following through it but as the pathways became blocked, reducing the surface area available to transfer heat from the oil to the cooling air, its ability to remove heat from the oil system would have diminished. As the heat energy in the system continued to increase, the breakdown of the highly loaded main engine bearings accelerated, further contaminating the oil system. Eventually the contamination was sufficient to block the oil filters, the filter bypass valves opened, and heavily contaminated oil entered the branches of the oil system. Some of the smaller oil passages (for example to the rear crankshaft journal bearing) were found completely blocked and it is likely that the fluctuations in indicated oil pressure were due to the gauge pressure line being intermittently blocked with metal particles. The pilot reported that, shortly after he saw the abnormal oil indications, the engine began to run roughly with a significant amount of smoke, and oil covered the cockpit canopy. No damage, such as holes in the crankcase, was found that would have resulted in oil being lost from the engine. There was evidence on the side of the fuselage (Figure 6) that oil was passing out through crankcase breathers. This indicates an increase in crankcase internal pressure, probably caused by pressurised cylinder gases escaping via piston erosion. It is also likely that oil was escaping past the piston rings, in sufficient quantity not to be fully burnt, and then through the exhausts. Both mechanisms would have resulted in smoke and oil being seen by the occupants. The pilot reported that the engine over sped just before it seized. It is likely that the contamination of the oil system reduced oil pressure to the propeller governor, making it unable to maintain the appropriate blade pitch. The aerodynamic loads on the blades drove them to fine pitch, resulting in an increase in engine speed. Engine observations To reduce the engine speed the pilot retarded the throttle and rpm levers, resulting in reduced load on the engine bearings. By this time, it is likely that the silver bearing metal in the front and rear crankshaft bearings was molten, and when the load was reduced this was sufficient for the bearings to solidify and seize the engine. This was evident in rotation of

55 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 the journal bearings in the crankcase. The lack of damage exhibited by the centre bearing is probably due to its lower loading. The silver bearing metal of the rear bank master rod bearing was eroded and the steel bearing shell was running against the crankpin. Load, and therefore wear, is distributed over the full surface of the bearing shell due to the rotation of the master rod relative to the crankpin. However, the same segment of the crankpin always reacts the power stroke and therefore the wear was concentrated on this part of the crankpin. The nitriding slowed this wear but once the case-hardened layer had been worn away, the damage increased rapidly. This was evident in the shape of the rear crankpin when it was inspected after the accident, with approximately 5 mm being lost from the diameter of the crankpin. This material was liberated into the oil system and caused further damage. As the diameter of the crankpin reduced, the gap into which the oil exited increased from 0.13 mm (0.005 inch) to approximately 5.1 mm (0.200 inch) and would have allowed more oil into the bearing area. This would have disrupted the oil flow to the rest of the engine because the release of oil into the bearing cavities is carefully balanced throughout the engine. This might also have contributed to the oil pressure fluctuations reported by the pilot. The deterioration of the master rod bearing resulted in a reduction in the clearance between the piston bottom dead centre position and the crankshaft counterweight. As the crankshaft rotated the counterweight struck the lower edge of the piston skirt, removing pieces of it, and broke the oil scraper rings. These pieces of aluminium piston and steel scraper ring were then unrestrained within the crankcase and caused impact damage to the casing. The irregular shape and inconsistent position of the damage to the cylinder flanges inside the crankcase was probably caused by these pieces being caught between the rotating counterweight and the flange. There was no evidence of the counterweight striking the cylinder flange directly. The broken pieces of piston and ring were transported throughout the engine by the oil system and contributed further to the blocking of the oil system passageways. There was evidence, on the crowns of the rear bank pistons, of impact with the top of the cylinder and the inlet valve. The valve stems were not bent and the depth of the indentation indicated low impact forces, suggesting the impact occurred as the inlet valve opened and the piston was descending into the cylinder, thereby applying insufficient force to the stem to bend it. Wear to the master rod bearing probably allowed the pistons to overtravel at TDC and strike the top of the cylinder, as indicated by the ring around the periphery of the piston crown. There was a fine powder residue on some of the piston crowns, which was made up of carbon, lead, aluminium and bromine. The aluminium was probably carried into the combustion chamber in the oil and left behind as the oil was burnt off. The other components were typical residues from the combustion of aviation fuel. Other observations When the thermostatic valve was inspected it was found seized in the fully hot position. This indicates that, at the time the engine seized, oil would have been passing through the oil cooler core, but the valve was jammed with metal particles and so had not closed to the bypass position as the thermostruts returned to ambient temperature. The distribution of

56 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 metallic particles throughout the oil cooler indicated that contaminated oil had been flowing through the core. The concentration of particles was greatest towards the inlet, indicating that particle-laden oil was flowing into the cooler, with some being entrained within the core, but that some particles were still suspended in the oil all the way to the outlet. This indicates that the oil cooler was contaminated by large amounts of material released from damage elsewhere in the engine. There was no evidence the oil cooler was itself a source of foreign material that could have caused damage to the master rod bearing. It was not possible to determine the amount of metal particles in the oil outlet flow from the cooler because the oil tank, to which the oil passed next, was destroyed during the accident. The oil tmp and oil clr CBs were found open. The pilot reported he had opened the oil cooler flap to reduce the oil temperature. Inspection at the accident site showed that the oil cooler flap had been open but was forced closed by the ground slide. The investigation could not determine why the oil clr CB had opened. It is likely both oil temperature gauges were working because the pilot and passenger both reported seeing the same rise in temperature as the engine started to fail. Each cockpit gauge is connected to a separate sensor; one in the oil outlet and one in the rear accessory case. The electrical connector to the oil outlet sensor had rotated, twisting the pins together and causing an electrical short circuit. This would have opened the oil tmp CB. In the video footage of G-INVN departing for the first flight, no smoke was visible from the exhausts once the initial start-up had cleared the cylinders. When the aircraft returned from the flight there was an oil streak along the left side of the aircraft and smoke could be seen from the right bank of exhausts (due to the camera angle it was not possible to determine which exhaust). The investigation did not determine the cause of the oil streak, which may have come from either the left side crankcase breather or a left side exhaust. Video of the accident flight departure showed the rear bank master cylinder (No 9) exhaust smoking after all the cylinders had cleared following engine start. When the master rod bearing is worn the geometry of the master rod / link rod assembly results in a side load on the master rod, which causes the master piston to become eroded, and it is possible that this smoke indicated the master rod bearing had started to wear and oil was entering the combustion chamber. Master rod bearing failure It is likely that the initial mechanical failure was breakdown of the rear bank master rod bearing. Due to the extent of the damage and the amount of debris in the engine it was not possible to determine precisely what initiated the bearing failure. In the following section various possible mechanisms are discussed along with their probability and counter evidence. Manifold pressure Radial engines are particularly susceptible to master rod bearing damage during prolonged flight with manifold pressure insufficient to compensate for the reciprocating loads. The pilots who had flown G-INVN since the installation of the R2800 engine reported they

57 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 were aware of this issue and stated that they operated the aircraft in a manner intended to avoid it. Air lock in the oil system G-INVN was in maintenance for approximately nine months during which there were no engine runs. Engine oil would have settled in the lowest parts of the engine and in some cases oil passageways would have emptied. It is possible for an air lock to have formed during the hot oil priming procedure prior to restart, resulting in a loss of lubrication when the engine was started. However, the oil path from the pressure pump to the rear bank master rod bearing is straight through the crank shaft and it is unlikely it would have been starved of oil long enough to cause significant damage. The hot oil priming process that the maintenance organisation reported it had completed was consistent with the manufacturer’s process and with industry practice. Air locks in the oil system are not considered typical of the R2800. Hydraulic damage Oil will drain into the lowest, inverted cylinders of a radial engine when it is stationary and must be purged before engine start to avoid damage. Oil can leak past the valve guides and piston rings into the combustion chambers. If there is enough to create a hydraulic lock, it will result in bending of the link or master rods. This damage will change the way the loads are applied to the master rod bearing and in time may cause bearing failure. The maintenance organisation reported that during the oil priming process one spark plug was removed from each cylinder and the engine was rotated by hand-turning the propeller. Oil that had collected was either drained from the spark plug hole, or it was pushed into the exhaust system. One operator of Sea Furys with Pratt and Whitney radial engines described to the AAIB the use of ‘burp plugs’ during oil priming to mitigate the risk of hydraulic lock. The burp plug is a one-way valve which replaces one spark plug per cylinder during the oil priming process. The burp plug allows oil to be ejected from the cylinder but ensures that air is drawn in through the inlet manifold rather than through the open spark plug hole. This results in any residual oil in the inlet manifold being drawn into the cylinder and removed, reducing the opportunity for residual oil to be drawn into the cylinder during engine starting. During normal operation the engine is rotated until all cylinders have passed through TDC, before switching on the magnetos, to ensure that none of the cylinders is hydraulically locked when the engine starts. This can be achieved by hand rotating the propeller or by using the starter motor. It is usually preferable to turn the engine using the starter motor if it is fitted with a clutch because, should there be a hydraulic lock, the drive will slip before link or master rod damage can occur. In some engine installations, the leverage of a propeller blade, and the multiplying effect of any reduction gearbox, may provide sufficient mechanical advantage to cause damage if the engine is turned by hand. There was no evidence of damage caused by hydraulic lock, excluding this as a likely cause of master rod bearing failure.

58 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Contamination of the oil system During the engine’s overhaul before installation into G-INVN, all critical components were inspected and either repaired or replaced with serviceable items. Organisations familiar with the R2800 indicated that significant defects usually become apparent within 5 -10 hours of operation after overhaul. Should an engine pass this threshold without issue it will usually, with appropriate maintenance and correct operation, continue for many hundreds of hours. The engine in G-INVN failed after 86 flying hours and some unrecorded ground running, past the point where overhaul-related issues might usually be identified. During maintenance prior to the accident flight, the engine was serviced and repairs made to the oil system. The engine oil was replaced and the filters cleaned as part of routine maintenance, and it was recorded that the oil cooler was leaking again. Several entries in the maintenance logbook indicated previous oil cooler repairs had been attempted, but ultimately it was decided to rebuild the cooler. The manufacture of a new cooler took approximately nine months and during this time the aircraft was dormant in the hangar. The new oil cooler, utilising the original frame and new cores, was flushed and pressure tested upon completion. It is possible that debris remained in the multiple pathways within the cooler and became dislodged in flight on 4 August; or that foreign material entered the oil system during the oil replacement, filter cleaning, oil priming, or oil top-up after the first flight. It is also possible that some corrosion may have formed inside the engine because it was not inhibited during the oil cooler maintenance, and that this corrosion could have detached from the parent material and reached the bearing, causing damage. However, relevant operator experience indicates that this is not necessarily a factor in engines that are inactive for a few months. Likewise, the engine from G-INVN has not exhibited any corrosion during the investigation. The available evidence was not sufficient to determine which, if any of these, was a factor. The first highly loaded bearing in the oil system is the rear bank master rod bearing, which therefore makes it the most likely to be affected by contamination entering the engine from the cooler or tank. Analysis of the oil and the material found in the filter elements revealed aluminium, silver, lead, indium and iron, all of which are materials used in the engine. The engine damage found would have resulted in all those materials being in the oil. Given the amount of debris present it was not possible to isolate any foreign material that could be confirmed as initiating the damage to the rear bank master rod bearing. The oil tank was damaged by the starter motor during the accident, which resulted in most of the oil being lost, and some oil was lost through the crankcase breathers or burnt during the flight. The organisation most familiar with the overhaul of R2800 engines considered that the damage found was consistent with contamination of the oil system.

59 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Possible cause summary Table 2 summarises the six possible causes of bearing damage identified by the investigation, and the counter evidence if any. Based on this information the investigation found that oil contamination of some sort was the most likely cause of the initial damage to the rear master rod bearing. It was not possible to determine when this might have occurred. Chip detectors and oil analysis A magnetic chip detector might have detected the ferrous material produced by wear to the bearing and crankshaft and found in oil recovered from G-INVN. It is possible that a suitable system would have alerted the pilot during the first flight that maintenance intervention was required, thereby avoiding the accident flight. Periodic analysis of oil samples can also provide an early indication of damage or excessive wear. This is most effective when conducted over many hundreds of hours and on several engines to establish trends, because it is not unusual for engine oil to contain some metallic particles in normal operation. The engine in G-INVN had run for only 86 hours since overhaul, which may have been insufficient to establish a significant trend. Possible cause Counter evidence Insufficient manifold pressure for engine rpm. All pilots reported that they operated the engine to avoid insufficient manifold pressure for engine rpm. Air lock in the oil system. Not typical for an R2800. Can affect other large radial engine types. Hydraulic damage. No damage to the connecting rods. All the cylinders were drained of oil during oil priming procedure and before engine starting. Inadequate oil priming. Procedure applied in accordance with normal practice. Bearing quality issue related to engine overhaul. Damage normally occurs sooner after overhaul. Engine had operated for 86 hours since overhaul. Contamination of the oil system. None. Table 2 Summary of possible causes of rear master rod bearing damage

60 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 Pilot’s actions The first cockpit indication of an engine problem was an increase in oil temperature, which the pilot reported was normally very stable. The pilot’s notes did not contain a procedure for high oil temperature. Based on his experience, the pilot opened the oil cooler manually and increased airspeed to increase cooling airflow, but the temperature continued to rise and the pressure started to fluctuate. When the engine seized the pilot had the option to abandon the aircraft or to make an off-airfield landing. He reported that he had planned and briefed that, if the engine failed, he intended to make an off-airfield landing. When the engine did fail, he did not consider abandoning the aircraft and focused on landing as planned. With time to reflect after the accident he remained of the opinion that, given the low altitude and high rate of descent, attempting a landing was the safest option. The pilot reported that, after the engine stopped, he focused on maintaining airspeed and keeping the aircraft flying. Although the pilot’s notes used by the operator did not contain specific guidance on off-airfield landings, based on his experience he kept the landing gear retracted. This was consistent with the guidance in the Royal Navy Sea Fury Mk 10 & 11 pilot’s notes. The high rate of descent limited the choice of fields. He tried to extend the flaps but with little hydraulic pressure they only moved slightly from the up position. The pilot was able to transmit a mayday call which enabled the emergency services, with the assistance of other aircraft in the area, to locate the aircraft quickly. He did not have time to jettison the canopy or switch off the fuel or ignition before landing. The AAIB has investigated several single engine aircraft accidents in which the engine failed and the pilot lost control of the aircraft before reaching the ground, often resulting in serious or fatal injury. In this accident the pilot was able to maintain control until reaching the ground, preventing more serious injuries to the occupants. The pilot reported that, before flying, he always took time to mentally rehearse his actions in the event of an emergency. He believed this was of considerable assistance when the engine failed, and that his recent simulator training, general flying recency and past experience all helped him manage the situation successfully. Conclusion The engine failure was caused by breakdown of the rear master rod bearing. The release of material and increased friction overwhelmed the oil cooling system and exceeded its capacity to maintain normal operating temperatures, resulting in catastrophic damage to the reciprocating components and eventually engine seizure. Symptoms of the bearing failure were visible before the accident flight, in the form of abnormal oil smoke, and might have been shown by a chip detector had one been fitted. However, from the moment excessive oil temperature was indicated, total engine failure could not be prevented.

61 © Crown copyright 2021 All times are UTC AAIB Bulletin: 10/2021 G-INVN AAIB-26839 The investigation did not discover precisely what initiated the bearing damage but determined that oil contamination was the most likely cause. The pilot’s experience, including practice engine failures in a relevant simulator, assisted him in conducting a safe forced landing. Maintaining sufficient airspeed, whilst avoiding built-up areas and the temptation to reach an aerodrome, contributed to this outcome. The accident demonstrates the importance of an effective emergency briefing before flight, and the value of wearing appropriate head protection. AAIB comment The investigation has not identified the need for new safety recommendations, but highlights three areas for additional consideration by operators of similar aircraft:

1. An engine oil chip detector may provide sufficient early warning of engine

damage to indicate the need for remedial maintenance before further flight.

1. Forced landing or abandonment involves significant risk of injury in high

performance aircraft. Operators and pilots can promote safe outcomes by providing clear safety briefings and ensuring all occupants wear effective head protection, as in this case.

1. Training in a relevant simulator can help familiarise pilots with prioritising the

tasks necessary to conduct a safe forced landing, including the importance of maintaining sufficient airspeed, field selection, and the passenger and other emergency procedures that must be completed. The AAIB recognises that there are few such simulators for high performance piston driven aircraft, and alternative means of achieving the same training aims may also be beneficial. Published: 16 September 2021.

FD06712 ｜ 2021_英国_aaib-investigation-to-piper-pa-24-180-comanche-n5839p__Piper_PA-24-180_Comanche_N5839P_01.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

61 © Crown copyright 2021 All times are UTC AAIB Bulletin: 1/2021 N5839P AAIB-26931 ACCIDENT

Aircraft Type and Registration: Piper PA-24-180 Comanche, N5839P No & Type of Engines: 1 Lycoming O-360-A1A engine Year of Manufacture: 1959 (Serial no: 24-920) Date & Time (UTC): 13 September 2020 at 1630 hrs Location: Compton Abbas Airfield, Dorset Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1 Injuries: Crew - None Passengers - None Nature of Damage: Damage to propeller, engine, exhaust and underside of fuselage Commander’s Licence: Private Pilot’s Licence Commander’s Age: 59 years Commander’s Flying Experience: 214 hours (of which 117 were on type)

Last 90 days - 12 hours

Last 28 days - 5 hours Information Source: Aircraft Accident Report Form submitted by the pilot N5839P was being positioned via an overhead join for an approach to land on Runway 26. When the landing gear was selected down there was a sudden smell of burning. The pilot, believing there was a fire or an imminent risk of fire, immediately made an emergency call to ATC and positioned the aircraft for a shortened approach. The aircraft touched down normally and rolled on its landing gear for around 80 m before it collapsed and the aircraft slid along on its belly. Once the aircraft came to a halt, the occupants vacated the aircraft with the fire service in attendance. Initial enquires suggested the landing gear failed to lock down due to a burnt-out electrical gear motor. When the burning smell became apparent to the pilot, he made sure that he was positioned to land as soon as possible, informed ATC of his emergency and asked for the fire truck to attend. Having completed the landing, both he and his passenger evacuated the aircraft as quickly as they could. The aircraft landed safely and neither occupant was injured. The aircraft suffered damage to the propeller, engine, exhaust and underside.

FD06713 ｜ 2021_英国_aaib-investigation-to-piper-pa-28-181-g-jant__Piper_PA-28-181_G-JANT_07-21.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

51 © Crown copyright 2021 All times are UTC AAIB Bulletin: 7/2021 G-JANT AAIB-27263 ACCIDENT

Aircraft Type and Registration: Piper PA-28-181, G-JANT No & Type of Engines: 1 Lycoming O-360-A4M piston engine Year of Manufacture: 1983 (Serial no: 28-8390075) Date & Time (UTC): 30 April 2021 at 1814 hrs Location: Bolt Head Airfield, Kingsbridge, Devon Type of Flight: Private Persons on Board: Crew - 1 Passengers - 3

Injuries: Crew - None Passengers - None

Nature of Damage: Damage to fuselage, both wings, undercarriage and propeller Commander’s Licence: Private Pilot’s Licence Commander’s Age: 37 years Commander’s Flying Experience: 143 hours (of which 73 were on type)

Last 90 days - 11 hours

Last 28 days - 6 hours Information Source: Aircraft Accident Report Form submitted by the pilot The pilot overflew the 600 m grass strip, which was familiar to him, and after seeing that there was no wind decided to land on Runway 11 to avoid the glare of the sun on the approach to Runway 29.  The aircraft was high on the first approach, so the pilot decided to go around. On the next approach, with full flap selected, the pilot slowed the aircraft from a 70 kt approach speed, flared and touched down about 50 m beyond the threshold.  After bouncing once, the brakes were progressively applied to slow the aircraft on the damp grass. The pilot sensed that the aircraft was not slowing as anticipated so released and pumped the brakes, but without much apparent effect.  Seeing the 4 ft high wire boundary fence about 150 m ahead, the pilot decided to go around.  Two stages of flap were selected, and full power applied.  The pilot allowed the aircraft to accelerate for “as long as possible” before pulling back on the stick.  As the aircraft became airborne the pilot “possibly heard the stall warner and so pushed forward slightly to gather speed”. However, the aircraft’s landing gear contacted the fence and a second 4 ft high wire fence 2 m beyond, after which the nosewheel and right landing gear became detached.  The aircraft came to a stop after sliding for about 300 m into a further field boundary fence (Figure 1). The pilot and passengers were unharmed and exited the aircraft once the pilot had removed the ignition key and turned off the fuel. The pilot later confirmed that the brakes were working correctly when tested during taxiing prior to take off from the departure airfield.

52 © Crown copyright 2021 All times are UTC AAIB Bulletin: 7/2021 G-JANT AAIB-27263 Figure 1 Final resting position of G-JANT (used with permission)

FD06714 ｜ 2021_英国_aaib-investigation-to-rans-s6-116-coyote-ii-g-buwk__Rans_S6-116_Coyote_II_G-BUWK_04-21.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

21 © Crown copyright 2021 All times are UTC AAIB Bulletin: 4/2021 G-BUWK AAIB-26836 ACCIDENT

Aircraft Type and Registration: Rans S6-116 Coyote II, G-BUWK No & Type of Engines: 1 Rotax 912-UL Piston engine Year of Manufacture: 1993 (Serial no: PFA 204A-12448) Date & Time (UTC): 4 August 2020 at 1000 hrs Location: Bradley’s Lawn airstrip, Cross in Hand, Heathfield, East Sussex Type of Flight: Private Persons on Board: Crew - 1 Passengers - None

Injuries: Crew - 1 (Fatal) Passengers - N/A

Nature of Damage: Destroyed Commander’s Licence: Private Pilot’s Licence Commander’s Age: 65 years Commander’s Flying Experience: 6,070 hours (of which 5,800 were on type)

Last 90 days - 79 hours

Last 28 days - 37 hours Information Source: AAIB Field Investigation Synopsis G-BUWK, a Rans S6-116, took off from Bradley’s Lawn airstrip, East Sussex. Witnesses then saw the aircraft make a spiral descent to the ground. There was a post-impact fire; the aircraft was destroyed and the pilot was found deceased. A post-mortem examination indicated that the pilot probably suffered a cardiac event resulting in incapacitation shortly after takeoff. History of the flight The pilot left his home at 0820 hrs on the morning of the flight, arriving at Bradley’s Lawn airstrip, East Sussex at 0850 hrs. The landowner initially saw the pilot on his mobile telephone and again, at some point later, with the engine cowl of G-BUWK open (The landowner presumed this was for pre-flight checks). He chatted with the pilot for about 20 minutes during which the pilot commented that he intended to fly to Popham Airfield, Hampshire, where his partner had probably already landed. The pilot’s partner had planned to fly her own aircraft to Popham from another departure airfield, meeting up airborne with the pilot prior to arrival. On the day of the accident, the pilot advised his partner by SMS that his departure was delayed, and he would fly direct to Popham and meet her there. The landowner commented that the pilot did not seem to be in a hurry. The pilot indicated on the airstrip’s ‘Departures Log’ that he would depart at 0950 hrs, listing Popham as his destination. About 10 minutes after the conversation, as the landowner

22 © Crown copyright 2021 All times are UTC AAIB Bulletin: 4/2021 G-BUWK AAIB-26836 was walking down a track behind the hangars, he heard the aircraft start up and, shortly afterwards, from a gateway abeam the windsock1, saw the aircraft already airborne. He stated that the takeoff looked and sounded normal. Having turned away, he heard a loud bang a few moments later and looked up to see a column of black smoke and flames rising upwind of the airstrip. Witnesses A witness on the opposite side of the valley to the airstrip, south-east and under ½ nm away, had a clear view of the airstrip and the hangars. He saw the aircraft takeoff and stated that it was airborne by the time it passed the hangars. He considered that the takeoff looked normal and that the aircraft climbed steadily before disappearing behind trees. He then heard the engine stop and, about 15 seconds later, a large bang followed by a plume of smoke and two further bangs. Another witness, about ¾ nm to the west, saw the aircraft come into view from the direction of the airfield and fly normally before suddenly “spinning” twice and disappearing behind some trees. A plume of smoke rose above the treeline. On seeing the smoke, the witness called the emergency services at 1001 hrs. A third witness, at a car workshop about ¾ nm to the west of the airstrip recalled seeing an aircraft with markings and lettering similar to the accident aircraft whose engine sounded as if it was “running extremely rough”. At the time he was at the entrance to the workshop looking to the west and was on a telephone call. Call logs showed the call began at 0959 hrs. He lost sight of the aircraft as he walked inside to the office, but about 30 seconds later, from the office window as he looked east, he stated that he saw the same aircraft above the treeline but that he could not hear any engine sound. The witness then described seeing the aircraft fly normally before “the tail pitch[ed] up and the right wing kick[ed] down and it seemed it was flipping over” as it disappeared below the treeline. At this point the witness hung up on the phone and shortly afterwards he saw black and heavy smoke rising. Post-accident response On seeing the plume of smoke, the landowner called the emergency services at 1003 hrs. He helped to direct emergency services to the scene and was joined by another pilot; both determined that they could not assist the pilot. The emergency services arrived within 10 minutes of the call. Accident site The accident site was in a grass field approximately 480 m south-west of the airstrip’s Runway 22 threshold (Figure 1), and approximately in line with the extended runway centreline. Footnote 1 The windsock was between the threshold of Runway 22 and the hangars.

23 © Crown copyright 2021 All times are UTC AAIB Bulletin: 4/2021 G-BUWK AAIB-26836 Figure 1 Partial ground track derived from ADS-B data The aircraft had struck the ground in a near-vertical attitude with its wings level. The rear fuselage structure had separated from the front fuselage frame and had come to rest inverted adjacent to the right wing; the elevator and rudder control cables remained connected to the front fuselage. Deformation of the left and right wings indicated that the aircraft was rolling to the right about its longitudinal axis at the time of impact. An intense post-impact fire destroyed most of the polyester fabric wing and fuselage coverings. All electronic equipment and instruments within the cockpit were also consumed in the fire. The fire had melted the inboard ends of the aluminium rear spars and strut braces. The steel frame of the forward fuselage was complete but severely disrupted.

Both fuel tanks, located between the inboard ends of the wing spars, had been destroyed during the accident. Deformation and flattening of the tubular leading edge spars forward of the tanks suggested that both tanks were close to being full at the time of impact. No fuel could be recovered from the aircraft after the accident.

24 © Crown copyright 2021 All times are UTC AAIB Bulletin: 4/2021 G-BUWK AAIB-26836 The inboard sections of both aluminium aileron control rods had melted in the post-impact fire and the forward end of the elevator control rod had fractured as a result of the impact. Other than this damage, there was no evidence the flying controls had become disconnected before impact. It was not possible to determine the elevator trim or flap positions that were set at the time of the accident. The carbon fibre propeller had been severely heat-damaged in the fire causing extensive delamination. One propeller blade had broken off the hub; the other had broken at the hub. There were no indications of leading edge damage on either of the blades and the location they were recovered from suggested they had little or no rotational energy2 at impact. The pilot was known to fly with a small gas camping stove aboard the aircraft. An exploded gas cylinder for such a stove was found in an adjacent field. The exploded casing of the aircraft’s fire extinguisher was also found within the wreckage. Both probably exploded as a result of intense heating in the post-impact fire, and account for the two further bangs heard by witnesses after the accident. Recorded information Several avionic units were recovered from the accident site, including three tablet devices used for navigation, a Garmin GPS III Pilot, a Pilot Aware electronic conspicuity device and a Dynon Avionics D1 electronic flight instrument system. All were damaged in the post‑impact fire and no data could be recovered from their internal memory. The aircraft was fitted with a Mode S and ADS-B3 Out transponder but was flying too low to be detected by radar. Some of the ADS-B Out broadcasts were nevertheless detected and recorded by ground stations of the Flightradar244 network that were in line of sight of the aircraft. The recordings covered a period of 17 seconds starting shortly after takeoff as the aircraft flew toward the south-west corner of the airstrip and ending about 200 m further on, 130 m north of the accident site. The last 12 seconds of recorded ADS-B Out broadcasts contained the aircraft’s latitude and longitude, as shown in Figure 1. Figure 2 plots the aircraft’s GPS altitude (25-ft resolution), track and groundspeed from the ABS-B Out broadcasts. It shows that, shortly after takeoff, the aircraft turned right through about 25°, before turning left 9° on to a track of 237°, which was maintained at a groundspeed of 52 kt for the last seven seconds of recordings. Footnote 2 The energy in this type of light propeller is low compared to similarly sized wooden or metal propellers, even when operating at high power. 3 Automatic dependent surveillance—broadcast (ADS–B) is a surveillance technology in which an aircraft determines its position via satellite navigation and periodically broadcasts it and other information, enabling it to be tracked. This capability is referred to as ABS-B Out. In contrast, ADS-B In refers to a suitably equipped aircraft being capable of receiving and interpreting the broadcasts from other aircraft. 4 Flightradar24 is a global flight tracking service comprising a network of over 20,000 ADS-B receivers.

25 © Crown copyright 2021 All times are UTC AAIB Bulletin: 4/2021 G-BUWK AAIB-26836   Figure 2 ADS-B Out flight data As the aircraft passed over the south-west corner of the airstrip it was about 220 ft above the airstrip elevation and climbed a further 100 ft over the next six seconds. The climb rate of the aircraft was, on average, approximately 1,000 ft/min (consistent with normal climb performance information provided by the manufacturer for this aircraft type at a mass of 544 kg). It then descended at about 1,000 ft/min to 270 ft above the airstrip elevation before the recordings stopped. The last recorded point positioned the aircraft about 200 ft above and 130 m north of the accident site. Aircraft information The Rans S6-116 Coyote II is a high-wing, strut-braced aircraft with two side-by-side seats. The airframe is mainly of bolted and riveted aluminium tube construction, with the forward fuselage structure consisting of a welded tubular steel cage. The entire airframe is covered with pre-sewn polyester fabric envelopes. G-BUWK was an ex-demonstrator aircraft, having been constructed from a kit in 1993 and bought by the pilot in October that year. The aircraft had completed 5,795 flight hours since it was built. Its Permit to Fly was valid until 3 June 2021. It was fitted with a Rotax 912 UL four-stroke engine driving a two-bladed composite propeller via an overload clutch. The engine was installed in the aircraft in March 2012, having previously been fitted to another aircraft. Records indicated it had run for a total of 54 hours when it was installed and had achieved 2,531 operating hours at the time of the accident.

26 © Crown copyright 2021 All times are UTC AAIB Bulletin: 4/2021 G-BUWK AAIB-26836 The engine logbook showed that the engine had been regularly serviced by the pilot, and was last overhauled in August 2011, before it was installed in the aircraft. The only other recorded engine removal was to complete a shock load assessment after the aircraft had been involved in an accident in October 2012. The engine manufacturer’s recommended overhaul life is 1,500 hours. This can be extended to 2,000 hours if Service Bulletin SB-912-570UL is applied. There was no record of this service bulletin in the engine logbook. As G-BUWK was operated on a Permit to Fly, the LAA did not mandate the manufacturer’s service bulletin and, as detailed in LAA Technical Leaflet TL 2.23, there was no defined service life for this type of engine. Therefore, there was no requirement for the engine to have been overhauled during the 2,477 flying hours since it was installed. The landowner and the other pilot reported that the pilot always re-fuelled the aircraft after each flight. He then re-filled the fuel containers with Mogas as he drove from or to the airfield and left them in the hangar ready to refuel the aircraft upon return. Full fuel containers were found in the aircraft hangar after the accident, indicating that the aircraft tanks were likely to have been full when the aircraft took off. However, the fuel within the containers was not representative of the fuel in the aircraft at the time of the accident, and samples were not taken. Aircraft examination The aircraft wreckage was recovered to the AAIB facility in Farnborough for further assessment. The airframe structure was re-examined. No evidence of any pre-existing damage was found. All fuel lines, ducts and hoses had been consumed by the fire. The fuel selector valve was found in the ‘LEFT’ position, which would have been the normal fuel tank for engine start5.

Engine examination Both carburettors were dislodged from the engine, but the throttle and choke cables were still attached. Both carburettor butterfly valves were in the open position. The casing around the left carburettor butterfly valve exhibited impact damage which prevented the valve from closing, suggesting the valve was in the open position at the time of impact. All external engine accessories, including the alternator, electrical ignition system and fuel pump were damaged to the extent that their functionality could not be assessed. All spark plugs were in a good condition with no evidence of erosion or sooting. Strip examination of the engine found no evidence of an engine malfunction. Footnote 5 The fuel system on this engine returned fuel to the left tank whilst in operation, therefore the engine must be started on left tank to prevent over filling the tank.

27 © Crown copyright 2021 All times are UTC AAIB Bulletin: 4/2021 G-BUWK AAIB-26836 Weight and balance An assessment of the likely loading of the aircraft determined that the weight and balance would have been within the required limits. Aircraft handling characteristics The handling notes6 highlight that the aircraft experiences greater speed decay rate owing to its ‘lightweight nature where little kinetic energy is to be had.’ Stalls are preceded by easily distinguishable buffet. In a fully developed stall, ‘the nose falls through very slightly and a high sink rate develops (approximately 1,000 to 1,500 fpm). The craft can be held wings level with the rudder.’ Flight tests7 indicated that wing drop was no more than 15° and recovery was instantaneous on the release of back pressure. The notes further state: ‘If, during a deep stall (falling leaf) the pilot’s feet are removed from the rudder pedals, the Coyote II will begin to dip each wing alternately until finally making a gentle spiral to the right or left. (NOTE: This is not a spin!). At this point it could be argued that it is spinning. However, rotation is not through the plane’s center mass. Instead, it is as if it were riding down the sides of a vertical cylinder…. To further support this, the spin properties are very conventional. Entry requires full deflection of elevator and rudder and must be held in full deflection.’ ‘The spin’s rotation is approximately 80 degrees nose down with rotation through the center mass, almost through the aircraft centreline…. Rotation speed is 3 seconds per turn…. Sink rates average 1,500 to 2000 fpm, with 200 to 400 feet lost per turn depending on density altitude.’ ‘This spiral and spin difference is easily recognized as well as controlled. Stall and spin testing in all configurations has been done with no unusual characteristics revealed.’ Meteorology The actual weather reports at Gatwick Airport recorded minimal cloud coverage at medium level, otherwise the sky was clear with good visibility and light south-westerly winds. Other airfields in the southeast of England reported very similar conditions. Witness statements suggest the wind may have been variable around the time of the accident. Footnote 6 There is no generic Pilot’s Operating Handbook for this aircraft type. The handling notes for each aircraft are included in the Technical Build manual. 7 These were flight tests conducted on two other Rans S6-116 by the Light Aircraft Association (LAA). The aircraft in their configuration including the same engine, and weight and balance, were representative.

28 © Crown copyright 2021 All times are UTC AAIB Bulletin: 4/2021 G-BUWK AAIB-26836 Airfield information Bradley’s Lawn is a grass airstrip situated on fields surrounded by high trees (Figure 3). Its runway is aligned north-east / south-west; the flight path on departure from Runway 22 is over fields with gently rising ground. A TV aerial 489 ft in height (1,007 ft amsl) is situated just under 1 nm to the southwest from the airstrip.   Figure 3 Bradley’s Lawn airstrip Personnel The pilot held an EASA PPL (A) with a current Single Engine Piston (Land) rating and a Class Instructor rating with Part-FCL.945 privileges. He had owned G-BUWK since 1993, soon after he had gained his licence, and gained the most of his flying experience on it. Medical information The pilot held an EASA Class 2 medical valid until March 2021. He suffered from hypertension and had been diagnosed with a cardiac condition. The post-mortem examination found no soot in the airways or upper digestive tract and, despite extensive injuries, there was no adjacent haemorrhage. The post-mortem examination also found moderate three-vessel coronary artery atheroma.8 The toxicology report was negative. The pathologist concluded that the lack of soot indicated the pilot was not alive during the fire. This was corroborated by the lack of evidence of adjacent haemorrhage indicating that the pilot had no pulse or measurable blood pressure at the time that he sustained the injuries. The pathologist stated that atheroma in association with hypertension can be associated with sudden death. No acute myocardial infarctions were identified in the myocardium, a finding which is ‘normal in cases of sudden death due to coronary heart disease.’ Footnote 8 Atheroma is the build-up of materials that can narrow an artery enough that it severely restricts blood flow.

29 © Crown copyright 2021 All times are UTC AAIB Bulletin: 4/2021 G-BUWK AAIB-26836 The pathologist stated that the findings were: ‘entirely consistent with a medical event, of likely cardiac origin occurring shortly after takeoff with unconsciousness and cardiorespiratory failure occurring prior to the crash. There is no evidence to suggest that the pilot was alive at the time of the impact or when the fire started.’ Analysis Witness evidence and recorded data indicate that the aircraft performance was normal during takeoff and climb. Witnesses described the loss of control in flight as sudden with a large drop of the nose followed by a rapid spiralling descent. The aircraft wreckage indicated that it struck the ground in a near-vertical nose-down attitude with right rotation. Technical issues The absence of leading edge strike marks on the propeller blades would normally be consistent with the engine at low power; however, as the engine was fitted with an overload clutch which protects the engine crankshaft in the event of a prop strike, the inertia of the engine would not have been transmitted through to the propeller when it struck the ground. Therefore, the lack of leading propeller damage may not indicate low engine speed on impact. Examination of the two carburettors revealed that the butterfly valves were both open during the impact sequence, suggesting that the throttle lever was set for maximum engine power at the time. It was not possible to determine when the throttle was moved to this position.

Although the aircraft sustained extensive damage during the impact sequence and subsequent fire, there was no evidence of a pre-existing technical issue with the aircraft or engine. Loss of control Witnesses reported that the aircraft seemed to perform normally on departure with no indication of engine problems; this is corroborated by the recorded climb performance and aircraft speed, suggesting that the engine was producing sufficient power at least up until the point where a loss of control appears to have occurred. Although one witness reported hearing the engine stop shortly after he lost sight of the nose-down attitude aircraft behind trees, this may have been as a result of the trees and wind masking the sound. While a separate witness reported seeing an aircraft with similar markings whose engine was running rough, it has not been possible to reconcile this sighting with the recorded data. It was not possible to determine the exact cause for the loss of control in flight. The extent of the pilot’s experience on the aircraft suggests that he should have been capable of recovering from a stall and any associated wing drop that might have resulted from a loss of performance. Therefore, an engine failure alone was not sufficient to result in such an outcome.

30 © Crown copyright 2021 All times are UTC AAIB Bulletin: 4/2021 G-BUWK AAIB-26836 Witness evidence indicated that the loss of control in flight was sudden and unexpected. The phase of flight, the likely aircraft configuration and performance, and the finding of the flight test report that full control deflection was required to enter a spin, together suggest that inadvertent mishandling was unlikely to cause loss of control resulting in a spin. The post-mortem report suggests incapacitation was likely of cardiac origin occurring shortly after takeoff, and the absence of other factors likely to have caused the loss of control indicate, it is the most probable cause of the accident. Conclusion G-BUWK experienced a loss of control in flight shortly after takeoff, which resulted in a steep spiral descent. The aircraft struck the ground and a post-impact fire started shortly afterwards. Although engine failure could not be discounted, the loss of control was probably the result of the pilot suffering a cardiac event resulting in incapacitation shortly after takeoff. Published: 4 March 2021. Bulletin Correction Following publication the Recorded information section of this report was amended. The words ‘capable of ADS-B In/Out,’ were removed from line three of the first paragraph of this section. The paragraph now reads: Several avionic units were recovered from the accident site, including three tablet devices used for navigation, a Garmin GPS III Pilot, a Pilot Aware electronic conspicuity device and a Dynon Avionics D1 electronic flight instrument system. All were damaged in the post-impact fire and no data could be recovered from their internal memory. The online version of the report was corrected on 10 March 2021.

FD06715 ｜ 2021_英国_aaib-investigation-to-schleicher-ash-25-e-g-cfst__Schleicher_ASH_25_E_G-CFST_06-21.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 ACCIDENT

Aircraft Type and Registration: Schleicher ASH 25 E, G-CFST No & Type of Engines: 1 Rotax 275 two-stroke engine Year of Manufacture: 1989 (Serial no: 25073) Date & Time (UTC): 26 August 2020 at 1216 hrs Location: Cheltenham, Gloucestershire Type of Flight: Private Persons on Board: Crew - 1 Passengers - 1

Injuries: Crew - 1 (Fatal) Passengers - 1 (Minor)

Nature of Damage: Aircraft destroyed Commander’s Licence: BGA Glider Pilot’s Licence Commander’s Age: 91 years Commander’s Flying Experience: 6,007 hours

Last 90 days - 14 hours

Last 28 days - 3 hours Information Source: AAIB Field Investigation Synopsis G-CFST launched behind an aerotow tug from Aston Down Airfield with the intention of soaring along the Cotswold Ridge between Dursley and Broadway. The soaring conditions proved challenging and the glider became too low as it followed the ridge to the east of Cheltenham, an area with few options for a successful field landing. The glider collided with the top of a line of trees while the pilot was attempting to start the glider’s sustainer engine and trying to find a suitable place to land. After colliding with the trees, the glider struck the ground nose-first imparting fatal injuries to the pilot. The rear seat passenger received only minor injuries. The investigation found that the accident occurred because the glider was flown over an area where the combination of the terrain and the glider’s altitude meant a successful field landing could not be assured. While the pilot had been flying under an informal age-related ‘dual-only’ limitation imposed by his gliding club, the investigation was not able to determine to what degree age was a factor in the pilot’s decision making on the accident flight. Following this accident, the BGA began a consultation process with their member clubs to develop policy and guidance for the management of pilots who, for any reason, might benefit from flying with a safety pilot or relinquishing PIC status.

2 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 History of the flight The accident pilot, hereinafter referred to as the pilot, was a member of the gliding club at Aston Down Airfield. On the day of the accident he was taking part in a time and distance challenge of soaring between Dursley and Broadway along the Cotswold Ridge. The ridge is approximately depicted by the dashed blue line on the map at Figure 1.

Figure 1 Challenge route between Dursley and Broadway (©2020 Google) The pilot was accompanied by a long-standing friend who he had asked to join him for the day’s flying. The friend, hereinafter referred to as the passenger, was also an experienced glider pilot and the two had flown together many times previously. The passenger reported that the pilot had attempted to test-start G-CFST’s sustainer engine, using the in-cockpit impulse starter handle, when standing beside the glider at the launch queue. While the engine did not fully fire up, it “coughed” on the third or fourth attempt, which the pilot reportedly took as an indication of its serviceability. The passenger also confirmed that they both carried out a “harnesses and canopies secure check” during the pre-flight checks.

3 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 The glider launched behind an aerotow tug just before 1200 hrs and climbed out to the west, reaching approximately 1,500 ft aal (2,100 ft amsl) before releasing the tow in the vicinity of Woodchester (Figure 2). The passenger reported that the pilot maintained the correct position behind the tug throughout the aerotow.

Figure 2 Flight elevation profile (Image Landsat/Copernicus ©2020 Google) He also reported that there was very little lift to be found as the glider tracked north- eastwards along the ridge. Crossing the ‘Birdlip bowl1’ to the east of Gloucester (Figure 3) they experienced significant “sink,” losing over 350 ft in 1.8 nm. The passenger judged that the ridge “was not working” and became increasingly concerned they were too low to continue following the route as intended. At that point he suggested to the pilot that they should “err on the side of caution” and divert to Gloucester Airport, approximately 3 nm to the north-west. Possibly because they had picked up lift while tracking northbound towards Shurdington, the pilot instead chose to continue following the ridge east of Cheltenham. While concerned that they were lower than he was comfortable with, the passenger judged that, given the shallow glide angle of the ASH 25 E, they still had just enough height to allow them to escape to the north and, potentially, land at the airstrip adjoining Cheltenham racecourse (Figure 3). Footnote 1 Colloquial name for the area where the ridge tracks east and then north in the vicinity of Birdlip.

4 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884

Figure 3 Overhead view of G-CFST’s track and approximate navigation logger-derived altitudes (©2020 Google) Once past Shurdington, the glider descended steadily as it tracked eastwards. An eyewitness reported being on Hartley Hill at 270 m (885 ft) amsl (Figure 3) and seeing the glider heading from west to east close to the ridge “just below” their level. The witness’s estimate of the glider’s altitude broadly correlated with data recovered from navigation logging devices in the aircraft. The glider was below ridge level at approximately 4-500 ft agl as it passed east of Hartley Hill (Figure 4). As the ground rose to meet it beyond Charlton Kings, the glider’s height reduced to below 250 ft agl at the point where the pilot turned to the north-west. Figure 4 View of glider track looking north-east from the witness’s location on Hartley Hill (Image Landsat/Copernicus ©2020 Google)

5 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Shortly after turning away from the ridge near Charlton Kings and without informing the passenger, the pilot began an attempt to start the glider’s engine and turned to the south‑west. The additional drag with the engine deployed required the pilot to lower the glider’s nose to maintain speed for a windmill start2. Despite the dive angle achieved, the passenger estimated that they were 5 kt slower than ideal for a start attempt. He could hear the engine turning over but it did not fire up and the glider was heading toward a row of trees short of a residential area. Just before the glider entered the trees, the passenger put one hand across his face to protect it and pulled back on the control column to try and stall the aircraft and drag the tail through the trees in an attempt to reduce the energy of the collision. CCTV evidence showed the glider hitting the tops of the trees in a right-wing low attitude. It then pitched steeply upwards and yawed rapidly to the right before falling to the ground, nose-first, beyond the tree line. The first person on scene was a witness who had been tending animals approximately 100 m from the accident site and heard the impact. He arrived at the glider within “two to three minutes” and found the pilot unconscious. The passenger was dazed but already talking to the emergency services by mobile phone. The witness then left the site to get help from his wife, a nurse, who was in their house 150 m from the glider. On arrival at the aircraft, the nurse saw that the pilot was still unconscious. She checked his pulse and found it to be present but weakening. While remaining with the pilot to comfort him, the nurse could hear a “motor” running in the fuselage. The passenger identified this as the electric fuel pump which was controlled by a switch in the front cockpit. Concerned about a potential fire risk, he asked the nurse to try and turn the pump off. Under his direction she operated a “silver-coloured flick switch” in the front cockpit but the fuel pump kept running. The passenger then reached over his shoulder and pulled at the connecting wires to both batteries to disconnect them, thereby removing the power supply from the fuel pump. The ambulance paramedic who arrived on scene at 1236 hrs determined that the pilot had passed away. The passenger, having been initially trapped, was released from the cockpit by the emergency services and was able to walk, with assistance, to the waiting ambulance. Recorded information Loggers Four flight logging devices had recorded GPS positions and other parameters during the flight. The horizontal paths differed by as much as 40 m but were usually more closely matched. The altitude profiles recorded similar vertical motion but were offset from each other by large amounts. These offsets could not be accounted for by using different commonly used datums3. The altitude profile of one of the loggers, a Naviter Oudie (referred to as logger A), was consistent with the departure airfield elevation and used for further flight path analysis. The flight path is shown in Figure 5. Footnote 2 Procedure and speeds for a windmill start are covered in the section on ‘glider description’ in this report. 3 The datum defines zero elevation which may or may not coincide with local sea level.

6 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Figure 5 Accident flight One of the loggers, a Cambridge GPS NAV Model 25 (referred to as logger B) also recorded pressure altitude. Correcting this for terrain elevation at the start of the flight results in an altitude profile that broadly agrees with the GPS altitude profile of logger A. The correction does not account for any changes in the ambient conditions during the flight or the fact that the sensor measures the cockpit static pressure and not the external pressure via a static port. Logger B also recorded an Environment Noise Level (ENL) parameter, also described as the Engine Noise Level. This is used to establish whether an engine is used during a competition flight. It has an internal microphone which captures the ambient noise and the logger processes the signal into a single value that is recorded whenever a geographic position is logged. This is not in specific units but can be compared to previous flights and documentation relating to acceptability as a competition logger. Three loggers recorded ground speed and the equivalent data was derived from the flight path recorded by the fourth. The ground speed values were closely aligned. Pertinent data from the loggers is shown in Figure 6.

7 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Figure 6 Accident flight recorded parameters The glider takeoff run started at 1156 hrs, it climbed at approximately 388 ft/min and reached a peak recorded GPS altitude of 2,110 ft amsl. This was followed by a generally descending flight path with small further climbs. Noise level The ENL values recorded during the accident flight were compared to the previous flights downloaded from the logger and were found to be broadly similar for the majority of the accident flight. The ENL values of 90 recorded at the end of the accident flight are more than the normal noise generated by the glider in the final approach but less than that generated during the landing run. For the logger, the typical range of ENL values expected while running a two-stroke engine is over 150 and typically 180 or more, but this is not specific to G-CFST. Figure 7 shows the ENL value increasing relative to the final flight path. It is likely that the increased values recorded at the end of the accident flight are associated with the deployment of the engine, but it is not known if it reflects an attempt to start the engine, or is just an increase in aerodynamic noise.

8 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Figure 7 ENL values at the end of the flight CCTV The final part of the flight was recorded by two CCTV cameras. The final moments are partially obscured by trees but provide sufficient information to establish the fundamental final manoeuvre. The details are provided in the History of the Flight section of this report. Glider description General The ASH 25 E is a two-seat, mid-wing, self-sustaining, powered glider, designed and manufactured by Alexander Schleicher GmbH & Co. It is of predominantly glass fibre construction and has a 25 m wing, T-tail and retractable landing gear. Each wing has an inner and outer section, with the structural and flight control joint at 3.8 m span. Flying controls With the exception of the rudder, the flight controls are actuated using a combination of pushrods and bell cranks. The rudder is operated by steel control cables. Three trailing

9 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 edge flaps, which also function as ailerons, extend over the full span of each wing. Each wing has a double-panelled airbrake that extends from the upper surface. Seat restraints Both seats are equipped with a four-point harness. A rotary buckle, also known as a quick release fitting (QRF), is incorporated as part of the right lap strap. Turning the QRF in either direction simultaneously releases both shoulder straps and the left lap strap. A rectangular tab at the 12 o’clock position on the QRF allows the wearer to release only the shoulder straps, by hooking a thumb or finger behind the tab and pushing forward (Figure 8). Release tab Figure 8 Seat harness QRF The shoulder straps are mounted on a metal bar above each seat. Structural attachment for each lap strap is achieved by a metal shackle and bracket, which is integrally mounted in a composite plate bonded to the cockpit wall. Sustainer engine The glider is equipped with a Rotax 275 two-stroke, single-cylinder sustainer engine driving a two-blade, fixed-pitch, wooden propeller. The engine is normally stowed inside the fuselage behind the cockpit and the extension/retraction mechanism is electrically powered. The engine can be operated from the front cockpit only. An engine control unit on the right armrest comprises the main switch for the engine electric system, a red pilot light which illuminates when the main switch is on, an ignition toggle switch and an extend/retract rocker switch (Figure 9).

10 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Figure 9 Engine control unit The cable-operated throttle, choke and propeller brake are actuated by levers mounted on the right side of the cockpit wall. A pull-start handle mounted in the right footwell, operates an impulse starter. G-CFST’s engine had been retrofitted with a cable-operated decompressor valve to assist engine starting, removing the need to use the engine pull-start handle in flight (Figure 10). G-CFST was fitted with an 8.5 litre composite fuel tank in the wheel well and a 15 litre flexible fuel bag in the left wing. The fuel shutoff valve is operated by a lever on the left side of the cockpit and the electric fuel pump is operated by a toggle switch on the front instrument panel. Figure 10 Engine controls on another ASH 25 E (main image) showing position of decompressor lever on G-CFST (inset)

11 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Engine starting The ASH 25 E flight manual4 describes the following initial actions for extending and starting the engine, whether inflight or on the ground:

• Fuel shut-off valve: open
• Main switch: on (red pilot light)
• Continue to press switch on “extend” setting until signal sounds for about

one second

• Ignition: on
• Propeller brake: off (released)?

For an inflight start, the following actions are then required:

• Air speed 110 to 120 km/h (60 to 65 kt)
• Throttle 1/3rd forward
• Choke: open (fully forward!)
• Firmly pull starter until engine turns over
• Reduce airspeed and apply full throttle (watch the rate of revolutions!)

The flight manual procedure does not cover the use of a decompressor. In the case of G-CFST’s engine, the decompressor would be held open by the pilot as the glider was being dived to achieve an airspeed of 60 – 65 kt. This removes cylinder compression, allowing the propeller to windmill in the airflow. The lever would then be moved to the start position, closing the decompressor and allowing the engine to start. Starting the engine on the ground requires slightly different throttle and choke settings and three to four strong pulls of the pull-start handle. Flight manual cautions The flight manual contains two cautions relating to the operation of the ASH 25 E’s engine: ‘The power-plant of a powered sailplane must not be regarded as a life insurance, for instance for crossing unlandable areas.’ ‘If the situation is so critical as to make a crash landing likely as no landable terrain can be reached, the power-plant should be retracted - even with the propeller out of vertical or not quite stopped - about half-way. This not only improves the gliding performance…but also reduces the risk in case of a crash landing.’ Footnote 4 Flight manual for Powered Sailplane ASH 25 E, Alexander Schleicher GMBH & Co., Segelflugzeugbau, D-36161 Poppenhausen/Wasserkuppe, dated October 1989.

12 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Accident site The accident site was in a narrow sloping field on the edge of Cheltenham, within the grounds of a school. It was bordered to the north and west by residential areas and to the south and east by school grounds (Figure 11). Approximate direction of travel from CCTV G-CFST wreckage Figure 11 Accident site The wreckage of the glider was situated below the canopy of a large oak tree. Several large branches had broken and fallen on top of the wreckage, indicating that the glider had struck this tree. It was also apparent that the tops of some of the trees which formed the boundary with the adjacent field had been trimmed (Figure 12). Damage to the leading edge and lower surface of the outer right wing was consistent with it having struck the tops of these trees. This was subsequently confirmed by CCTV recordings. Figure 12 Trees struck by the right wing from above (left) and from the adjacent field (right)

13 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 An impact crater approximately 45 cm deep corresponding to the profile of the glider’s nose, indicated that the glider had struck the ground in a steep, almost vertical nose-down attitude. A clear indentation in the grass had been made by the leading edge of the left wing. Disruption to the front cockpit included crushing of the sidewalls and disturbance of the flight control runs, seat structure and floor but the cockpit retained a substantial degree of structural integrity. The shoulder straps on the pilot’s harness were found undone, but the lap straps were engaged in the QRF. Neither the first people on scene nor the first responders had released the pilot’s shoulder straps. The engine was deployed but the engine pylon had bent forward approximately 90° from its normal deployed orientation, such that the engine was lying parallel to the top of the glider above the rear cockpit (Figure 13). The landing gear was retracted. The tail boom had fractured just behind the engine bay and the left outer wing had separated at the wing joint, leaving a section of broken spar protruding from the inner wing. The control rods for the airbrake, aileron and flap were bent rearwards and had exited through the trailing edge wing structure at the location of the wing break. The left airbrake was extended. The presence of all major components of the glider and the compact distribution of wreckage indicated that the glider had been structurally intact prior to striking the trees. Figure 13 G-CFST wreckage showing position of engine Detailed aircraft examination Engine, engine controls and fuel The engine was free from external damage but the damage sustained by the extension actuator and pylon was consistent with it being in the extended position when the ground

14 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 impact occurred. The propeller was intact and largely undamaged with the exception of two small cracks in the hub and a small nick on the trailing edge of one blade. There was no evidence of rotational scoring which might be expected if the propeller was rotating at impact. Apart from the ignition switch, which was in the off position, the position of the engine controls was broadly consistent with the expected positions for engine starting. There were 6.5 litres of fuel in the fuselage tank and 8.5 litres in the left wing tank. Both the fuel shutoff valve and its selector lever were found partially open. The operating linkage runs inside the front seat left armrest which had been disturbed during the impact, so it was not possible to determine its pre-impact position. The fuel pump switch was found in the off position. Damage to the engine support structure precluded running the engine in the installed condition. The engine, engine controls and fuel pump were removed from the wreckage to facilitate a ground run. The engine started on the fourth pull of the pull-start handle and appeared to operate normally. Due to the propeller damage the engine was only run for a matter of seconds, so its continued operation was not assessed. Flying controls It was not possible to determine the pre-accident position of the flying controls due to the extent of the disruption to the control runs, but the left airbrake most likely extended when the left outer wing separated. Seat harnesses The structural attachments for the shoulder straps at each seat and those for the lap straps on the rear seat, were intact. The composite mounting panels for the left and right lap straps of the front seat, had each separated from the cockpit wall at the bond line. The fabric straps appeared to be in good condition. Identification labels on several of the straps were missing, faded or torn, but were legible and indicated that they were manufactured in 1989. Both QRFs functioned normally when operated and the release tabs required positive operation to release the shoulder straps. Aircraft performance Gliding performance Interpolation of the performance charts (Flight Polars) in the ASH 25 E flight manual indicated achievable glide ratios of approximately 1:45 at 70 kt and 1:50 at 60 kt for G-CFST at a representative all-up-weight in the clean configuration or with soaring flap selected. While the flight manual does not contain performance tables for flight with the engine deployed and not running, other ASH 25 E pilots estimated that it reduced the achievable gliding range by approximately 60-70%.

15 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Field landing performance Two pilots with experience of flying the ASH 25 E expressed the view that, depending on available headwind, slope and surface characteristics, the minimum strip length for a field landing in G-CFST would be between 1,000 and 1,500 ft. Using the sustainer engine BGA guidance In their Managing the Flying Risk document, the BGA offers guidance for pilots flying sustainer gliders which includes the following: ‘Accident report data indicates that most problems occur due to a late decision to start the engine…Having a pre-considered and personally agreed minimum height for engine start – effectively a pilot’s own ‘red line’ - is very important. …. Recognize [sic] that descending beneath this height effectively discards the engine option…As should always be the case when flying cross-country, constantly monitor the available landing options. Have a landing option selected before deploying the engine.’ Club guidance The gliding club’s Chief Flying Instructor (CFI) would informally brief club pilots new to sustainer aircraft that, when contemplating deploying the engine in flight, they should assume that it will not start and to configure for a field landing before deploying the engine. He also suggested that they use 1,500 ft as a minimum height to commence a start and if they are below that height, they should commit to a field landing with the engine stowed. Experience of engine operation on G-CFST A review of the pilot’s flying logbooks showed that he had the habit of annotating ‘E’ against flights on G-CFST where he had used the engine, but the last such annotation was against a flight in December 2018. It was not determined whether he did not use the engine in flight after this date, or whether he stopped annotating this in his logbook. G-CFST’s co-owner had flown many hundreds of hours in the glider with the pilot and normally occupied the rear seat. If it became necessary to use the engine in flight, he would typically fly the glider to achieve the necessary airspeed, while the pilot operated the engine controls. He stated that the engine could sometimes be problematic; it did not always fully extend, required a lot of height to start and sometimes did not start. It was also difficult to start on the ground. The passenger, who was familiar with flying in G-CFST with the pilot, also reported that the engine very often didn’t start. He estimated that height loss when starting the engine in flight was typically 400 - 500 ft but recalled one occasion, when the engine had not been used for some time, where the pilot attempted to start the engine at 4,000 ft and it was 1,500 ft before it fired.

16 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Meteorology The weather at the time of the accident was reported as “good, with moderate westerly winds.” A weather observation from Gloucester Airport taken four minutes after the accident recorded a wind velocity of 260°/11 kt and no significant cloud below 3,200 ft. Glider pilots can record their flights on the BGA Ladder5, an ‘informal, year-long soaring competition intended for UK-based glider pilots.’ In addition to logging time and distance achievements, they can also add comments on, for example, the weather conditions they experienced. The following notes were uploaded by three glider pilots who were flying in the vicinity of Cheltenham on the day of the accident: ‘The best lift was south of Cheltenham but it looked mostly unlandable there’ ‘Not quite enough wind from the right direction for ridge to work properly, a lot of wave interference, lots of spreadout6 and weak thermals all made it rather challenging’ ‘…ridge not quite working then a combination of spreadout and wave interference’ Personnel Pilot The pilot was the holder of a BGA Glider Pilot’s Licence with three Diamond Badges7. He started gliding in 1973 and had amassed over 6,000 flying hours. Of those hours, more than 4,400 were logged in multi-seat gliders. He was a well-respected member of the gliding club whose members spoke highly of his flying ability and dedication to gliding. On a series of winter check flights, in November 2019, the instructor noted an occasional lapse in decision making which he attributed to the pilot “showing the signs of ageing.” His handling skills were still of a good standard and, with the pilot about to embark on a period of dual flying in Australia over winter, a decision on how best to manage the situation was deferred. The pilot then did not fly in the UK again until after the national COVID-19 lockdown restrictions were eased in May 2020. He initially regained currency by flying in the club’s gliders before returning to the air in G-CFST on 7 June. In early July the pilot was involved in a potential upset on an aerotow where the towing pilot released the tow cable because the pilot got too high behind the tug. Following the incident, the club imposed a ‘no-aerotow’ restriction on the pilot, but later revised it to ‘dual‑only8’ limitation. The club’s rationale for the limitation was twofold; to address any pilot incapacitation risk due Footnote 5 https://www.bgaladder.net [accessed 2 November 2020]. 6 Where convective clouds spread out under an inversion creating a layer of stratocumulus cloud which wholly or partially blocks the sun’s rays from the surface, thereby reducing thermal convection. 7 Goal Diamond for a flight of over 300 km, Distance Diamond for a flight of over 500 km and Height Diamond for climbing to 5,000 m. 8 Requiring him to only fly G-CFST when accompanied by an experienced pilot capable of landing the glider in an emergency.

17 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 to the pilot’s age and to help or prompt his airborne decision making should it be necessary. This was a proactive informal risk mitigation measure by the club and there was no policy, procedure or precedent for the arrangement. The club described themselves as “feeling their way” in managing the situation and were planning to review the appropriateness of the limitation as the gliding season progressed. It was anticipated that, if deemed necessary, the next step would have been to prevent the pilot from acting as PIC. The club expressed the view that higher level guidance for the management of ageing pilots would be welcome. Before the accident flight, the pilot had flown on four occasions with four different pilots after the ‘dual-only’ restriction had been established. The fourth occasion was with the club CFI on 2 August 2020. While he had appeared to take the ‘dual-only’ limitation well, the pilot disagreed with the need for it and wanted to prove to the CFI that it was not necessary. None of the pilots who had flown with him on the three previous occasions had raised any concerns with the club over the pilot’s flying but had informally mentioned occasionally prompting him for a decision. Having subsequently flown with the pilot, the CFI remained of the opinion that, while still up to solo standard, he would nonetheless benefit from someone accompanying him to help manage his flights. Passenger The passenger reported that, on their many previous mutual flights, he and the pilot would regularly share the flying and navigation tasks. He was aware that the club had required the pilot to be accompanied when flying G-CFST but had not been specifically briefed as to why. His assumption was that it was a pilot incapacitation precaution and to assist with heavy manual tasks like ground handling and raising the landing gear in flight. Prior to the accident fight, they last flew together in May 2018 in the passenger’s Duo Discus glider. Ageing pilots Human performance limitations in relation to flying are widely documented in aviation textbooks and guidance literature such as the CAA’s Flight Crew Human Factors Handbook9 and The Skyway Code10. Decision making is discussed in both publications and was an important area of focus for the investigation. Older pilots are not necessarily less-safe pilots and poor decision making can affect pilots of all age and experience levels. Nonetheless, age-related deterioration in eyesight, hearing, mobility, memory, cognition and decision making are recognised as having an impact on piloting ability. Data from the CAA’s website11 for the years 2000, 2011 and 2018, indicates that the average age of non-commercial pilots in the UK is increasing (Figure 14). Footnote 9 CAP 737 Flight Crew Human Factors Book, published by the UK CAA. Available at https://publicapps.caa. co.uk/docs/33/CAP%20737%20DEC16.pdf [accessed 4 February 2021] 10 CAP 1535 The Skyway Code Version 2, published by the UK CAA. Available at https://www.caa.co.uk/ General-aviation/Safety-information/The-Skyway-Code [Accessed 8 February 2021] 11 CAA-published data on the age and sex of the UK holders of National and EASA non-commercial pilots’ licences with a valid medical certificate. Available at https://www.caa.co.uk/Data-and-analysis/Approved- persons-and-organisations/Datasets/Licence-holders-by-age-and-sex [accessed 22 February 2021]

18 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884

Figure 14 Age distribution of non-commercial UK pilots for the years 2000, 2011 and 2018 Although the broad effects of ageing are well known, there is great variability on how any specific decline will affect an individual pilot and chronological age is not a reliable metric to predict age-related impairment. As quoted in an AOPA12 Air Safety Institute research review on the subject of ‘Ageing and the General Aviation Pilot’13 , ‘Not only does age affect the different cognitive functions to different degrees, the time of onset of significant age effects also differs across cognitive functions.’14 While experience, knowledge, aptitude and wellbeing can offset or delay the effects of ageing, there will inevitably come a point where the most sensible option for an individual is to retire from flying as PIC. One challenge for organisations supervising ageing pilots is that if a pilot has a valid medical and can pass periodical flying checks it is difficult to argue for grounding them when subjective concerns are raised. Unless precipitated by an accident or incident, without an objective metric for making the decision, it relies on individual pilots to be honest with themselves and for supervisors to be candid enough to reach a shared acknowledgement that their days as PIC are over. Family, friends and peers can play a part in encouraging and supporting pilots when that decision has to be made. This is especially important for pilots not affiliated to clubs or sporting associations. Footnote 12 Aircraft Owners and Pilots Association, an American political organisation advocating for general aviation. 13 Ageing and the General Aviation Pilot published by AOPA. Available at https://www.aopa.org/-/media/files/ aopa/home/pilot-resources/safety-and-proficiency/accident-analysis/special-reports/1302agingpilotreport. pdf?la=en [Accessed 5 February 2021] 14 Tsang, Pamela S. Age and pilot performance. In ‘Aviation Training: Learners, Instruction and Organization’, edited by Ross A. Telfer and Phillip J. Moore. Aldershot: Avebury Aviation, 1997. Pages 21-39.

19 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Following this accident, the British Gliding Association began a consultation process with its member clubs with the aim of developing formal guidance to support the management of pilots of any age who might benefit from flying with a safety pilot or relinquishing PIC status. Medical Injuries to persons In his post-mortem report, the pathologist found that the pilot died from ‘the combined effects of multiple traumatic injuries.’ There was no indication of medical impairment or incapacitation of the pilot before the final collision. The post-mortem examination did not reveal any definitive evidence to suggest that the pilot had been wearing his harness shoulder straps at the time of the accident but could not exclude the possibility. The pathologist’s report further indicated that, discounting injuries potentially sustained as a result of his upper torso being unrestrained, the pilot’s other injuries would not have been survivable. The passenger sustained only minor injuries and there were no third-party casualties. Medical requirements for glider pilots For pilots holding a BGA Glider Pilot’s Licence the medical requirements are detailed in the BGA’s Laws and Rules (BGA Operational Regulations)15 which state: ’[Regulation 14] …To fly a glider solo or with another pilot, a pilot needs to hold a driving licence…Additional and higher requirements apply to instructors and those pilots carrying passengers. Details of all acceptable and alternative means of compliance are contained in ‘BGA Pilot Medical Requirements.’ The pilot was not an instructor neither was he carrying an inexperienced passenger; therefore, the medical requirements that applied to him were those in Paragraph 3 of the BGA Laws and Rules (BGA Pilot Medical Requirements)16: ‘Acceptable evidence of fitness for pilots of gliders; solo flight or with another pilot: A driving licence issued by an EU nation (or the UK or the Crown dependencies).’ The pilot held a current UK driving licence which was due to expire on 11 May 2023. Footnote 15 BGA Laws and Rules: BGA Operational Regulations Version 1.1, Effective date 29 Feb 2020. Available at https://members.gliding.co.uk/library/bga-requirements-guidance/operational-regulations-of-the-bga [accessed 29 September 2020]. 16 BGA Laws and Rules: BGA Pilot Medical Requirements, Version 1.3, Effective date 25 Aug 2016. Available at https://members.gliding.co.uk/wp-content/uploads/sites/3/2015/04/Medical-Requirements.pdf [accessed 29 September 2020].

20 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Assessment of ongoing medical fitness BGA member clubs can place more stringent medical restrictions on individual pilots should it be deemed necessary. The BGA recommendation is that medical advice should be sought before additional limitations are imposed. The club had not imposed a recognised medical restriction on the pilot and he had not declared any medical condition that would affect his fitness to fly. The post-mortem report did not reveal any pre-existing medical conditions pertinent to flying and the pathologist did not find any ‘obvious features of disease that would be likely to significantly impair or diminish his judgment or cognitive faculties.’ Medical requirement for a safety pilot Where the holder of a Class 2 or LAPL17 medical certificate is considered at increased risk of incapacitation compared to his peer group the awarding medical examiner can impose an Operational Safety Pilot Limitation (OSL). Under the EU regulatory framework18, ‘the holder of a medical certificate with an OSL limitation shall only operate an aircraft if another pilot fully qualified to act as pilot-in-command on the relevant class or type of aircraft is carried on board, the aircraft is fitted with dual controls and the other pilot occupies a seat at the controls.’ In their Safety Pilot Information Sheet19, the CAA define a safety pilot as ‘a pilot who is current and qualified to act as Pilot-In-Command (PIC) on the class/type of aeroplane and carried on board the aeroplane for the purpose of taking over control should the person acting as the PIC become incapacitated.’ They are not a designated flight crew member and hold the legal status of passenger. There is no equivalent OSL process or procedure for pilots who are flying under the BGA rules and exercising the privileges of a self-declaration medical. Organisational information Regulatory body At the time of the accident, the BGA was the sporting body overseeing gliding in the UK. Pilots exercising the privileges of a BGA Glider Pilot’s Licence were required to comply with the BGA Laws and Rules. In addition to their Laws and Rules, the BGA publish several protocol documents as guidance for pilots. One of these documents, Managing the Flying Risk20, aims to ‘provide pilots and clubs with guidance on how to better understand, minimise and manage the hazards associated with gliding operations, including with powered gliders and tug aircraft. It does not replace any existing law, which should always take precedent.’ Footnote 17 Light Aircraft Pilot’s Licence. 18 Commission Regulation (EU) No 1178/2011 Annex IV, Subpart B, Section 1, MED.B.005.d.2.ii dated 25 November

1. Available at https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32011R1178&from=EN

[accessed 5 November 2020]. 19 20130121SafetyPilotInformationAndBriefingSheet.pdf v7.1 dated January 2013. Available at: https://www. caa.co.uk/WorkArea/DownloadAsset.aspx?id=4294974324 [accessed 1 October 2020]. 20 Managing the Flying Risk v14,1 effective date 12 July 2020. Available at https://members.gliding.co.uk/ library/bga-requirements-guidance/managing-flying-risk-guidance [accessed 29 September 2020].

21 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Crew status for single-pilot operations For a single-pilot operation such as gliding, apart from pilots on an instructional flight with a flying instructor, the only defined crew role is that of PIC. While the PIC can ask anyone on board to assist with the operation of the aircraft, that does not confer crew status on the individual, even if they are a qualified pilot on type or acting as a safety pilot under the OSL provisions. Crew resource management Crew Resource Management (CRM) is the effective use of all resources available to a pilot to assure a safe and efficient flight, thereby contributing to better decision making by helping to reduce error and stress. While CRM training was initially developed to improve multi-crew cooperation many elements can be read across to single-pilot operations. Effective CRM combines various skill areas including, situational awareness, workload management, planning and briefing, decision making and communication. The Skyway Code and CAP737 are two of the readily available reference documents which discuss CRM and its applicability to GA and glider flying. For pilots flying solo, advice from instructors and fellow club members, the assistance of air traffic control and aviation reference documents are examples of supplemental resources that can be accessed before, during and after flight. Section 12 of Managing the Flying Risk is dedicated to the topic of qualified pilots flying together in two-seat gliders (mutual flying) and addresses some of the associated CRM considerations. It highlights the importance of agreeing who will act as PIC and discussing how either pilot can raise their concerns effectively when airborne. Passengers who are also pilots can offer invaluable assistance provided the ground rules for collaboration and communication are clearly understood.

Other than for pilots on flying instructor training programmes, glider pilots do not routinely undertake CRM training. Other information Ridge soaring - general The term ridge soaring relates to gliders taking advantage of lift generated on the windward side of an escarpment or line of hills when the wind is blowing approximately perpendicular to the high ground. The optimal lift zone is generally found above the windward slope just below the ridge line and extends upwards, angled into wind (Figure 15). Beyond the ridge line the air descends again to follow the terrain, leading to lee side sink. To gain maximum benefit from ridge soaring pilots aim to fly parallel to the ridge and within the optimum lift zone. The amount of lift generated and position of the optimal zone depend on the wind profile and the terrain characteristics of the ridge. With a wind direction more than 45° off perpendicular to the ridge the lift generation process is less effective. Variable physical characteristics of the ridge can affect the lift generating capability for a given wind direction.

22 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Figure 15 Cross section of imaginary ridge showing lift and sink zones Lee side sink can be a particular issue when crossing spurs or bowls, such as the one at Birdlip. Crossing a bowl, a glider would experience uplift approaching the boundary spur and then downdraught as it entered the bowl (Figure 16). Taking a direct route across the mouth of such a bowl is the recommended approach21 to avoid the lee side sink.

Figure 16 Simplistic view of bowl effect vs ridge lift Soaring on the Cotswold Ridge The irregular profile of the Cotswold Ridge and its location in the lee of the Brecon Beacons can give rise to unpredictable and unreliable soaring conditions. As the ridge line changes direction the upslope lift can vary significantly. With a westerly wind, lee wave effects downstream from the Welsh hills can produce interference that reduces available lift. Having Footnote 21 FAA Glider Flying Handbook, Chapter 10: Soaring Techniques. https://www.faa.gov/regulations_policies/ handbooks_manuals/aircraft/glider_handbook/media/gfh_ch10.pdf [accessed 29 September 2020].

23 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 flown from Aston Down for most of his gliding career, the pilot was familiar with the challenges posed by the Cotswold Ridge. Fellow club members referred to him as “an aficionado on the ridge.” Given the pilot’s extensive experience of soaring on the ridge, it is possible that he had developed his own ‘gate-height22’ for committing around the Cheltenham Bowl and that he was above it on the accident flight. The investigation was not able to determine if this had been the case. The club’s instructors did not conduct soaring training on the ridge and did not issue gate-height guidance to pilots using it. While there are areas where towns and villages abut the lower slopes, for most of its length there are ample options for gliders to land out on fields to the west of the ridge. One area where options are limited is where it passes to the east of Cheltenham. Between Hartley Hill to the south and Prestbury to the north, the built up area of Cheltenham occupies most of the land below and to the west of the escarpment. If flying above ridge level, pilots would have an option to head east to the flatter land beyond the summit, otherwise, turning back towards Shurdington or heading north towards the racecourse beyond Prestbury are the shortest available escape routes. Seat harness and QRF QRFs similar to that used on G-CFST are common in many aircraft and glider types. The BGA provided anecdotal information that some UK glider owners using similar QRFs had experienced inadvertent operation of the release tab and had since had this function inhibited. The harness manufacturer, which purchases the QRFs from another supplier, advised that it had previously developed a modification to inhibit operation of the release tab. This was done at the request of several glider manufacturers, to prevent the shoulder straps coming undone in aerobatic flight. The modification is incorporated as standard from new on certain aerobatic-rated gliders and is available on request for individual glider owners. The investigation considered whether the pilot’s shoulder straps could have become disengaged during the accident sequence, due to inadvertent operation of the release tab either as a result of impact loads or other factors. The pilot had been wearing a USB logger device on a lanyard around his neck. Because it was obscured by clothing, the logger’s position with respect to the QRF was not observed at the accident site. Prominent areas on the back face of the QRF are intended to guard against forward release of the tab (Figure 17). The shape of the logger was such that it could fit in the recess behind the release tab. Post-accident simulations showed that the reclined seating position in the ASH 25 E and length of the lanyard meant that the logger could rest in proximity to the QRF. There were many variables such as exact seating position and height of the wearer and the logger was easily dislodged with movement if positioned behind the QRF. It was therefore considered unlikely that the logger could have interfered with the release tab on the QRF, but the possibility could not be ruled out. Footnote 22 Threshold altitude, below which he would not attempt to circumnavigate the Bowl.

24 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Release tab Prominent areas Figure 17 Seat harness QRF showing rear face (left) and USB logger (right) The harness manufacturer stipulates a recommended maximum life of 12 years for the harness, including the QRF. Historically the BGA has permitted seat harnesses to be operated ‘on condition’ subject to annual inspection and agreement by the certifying engineer. G-CFST’s Self Declared Maintenance Programme (SDMP) included a documented deviation from the recommended harness life. The QRF manufacturer advised that it was designed to be an ‘on condition’ product, with no recommended service life. It indicated that service-related wear of internal locking pins can occur in QRFs with long term usage and these would typically be replaced on QRFs returned for overhaul. It did not find any reports in its records relating to unintended release of the shoulder straps, either due to wear or other reasons. G-CFST maintenance General G-CFST was manufactured in 1989 and was jointly owned by the pilot and another club member. The pilot assumed the role of ‘lead’ owner, holding the aircraft documents and maintenance paperwork. The glider underwent its most recent annual inspection and Airworthiness Review Certificate (ARC) renewal on 24 March 2020, at which time the BGA inspector also created a SDMP, on behalf of the owners. At the time of the accident G-CFST had accumulated 3,974 flight hours and 1,692 launches. Engine maintenance requirements The ASH 25 E maintenance manual23 originally required that the engine was overhauled every 300 hours or six years, whichever occurred first. The Rotax 275 operator’s manual Footnote 23 Maintenance manual for the powered sailplane ASH 25 E, Alexander Schleicher GMBH & Co., Segelflugzeugbau, D-36161 Poppenhausen/Wasserkuppe, dated January 1995.

25 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 specified that this should be done after 300 hours of operation. The engine manufacturer subsequently ceased to support the Rotax 275 and this requirement was replaced by Service Bulletin (SB) 505-010R1 dated 5 September 200624, which provided an updated ‘on condition’ maintenance schedule requiring maintenance inspections at one, two, three, five and six year intervals. SB 505-010R1 was categorised as ‘mandatory’ by the engine manufacturer but it was not mandated by an airworthiness directive (AD). Generic Requirement (GR) 24 ‘Light aircraft piston engine overhaul periods’ of Civil Aviation Publication (CAP) 747 ‘Mandatory Requirements for Airworthiness’ contains provisions for the maintenance and operation of light aircraft piston engines beyond their maximum overhaul life. Rotax engines were initially excluded from GR 24, but in 2013, Rotax 275 engines installed in powered gliders became eligible to be operated ‘on condition’ under the provisions of GR 24. This required continued compliance with SB 505-010R1. On its website, the BGA publishes a Compendium, which is a collection of documents intended to help members identify relevant airworthiness information for a particular aircraft or engine. With respect to the Rotax 275 the Compendium refers to two BGA Technical News Sheets (TNS) 5-2006 and 1-2013 which each refer to SB 505-010R1 and indicate that the maintenance schedule described therein applies to all BGA aircraft with applicable engines. On 24 March 2020, following the introduction of Part M Light (Part-ML)25 under Regulation (EU) 2019/1383, GR 24 ceased to be applicable to EASA aircraft types, including gliders. Under Part-ML, continued ‘on condition’ operation of an engine beyond its recommended overhaul life requires the owner to declare and sign a deviation from the manufacturer’s recommended maintenance in the aircraft’s SDMP. Engine maintenance The BGA inspector had carried out the annual inspections and ARC renewal on G-CFST since 2016. G-CFST’s engine had been operated ‘on condition’ for many years and the inspector commented that it was in reasonable condition when he became involved. During G-CFST’s recent annual inspection, the BGA inspector serviced the engine which involved replenishing the gearbox oil, cleaning the spark plug and checking the operation of the decompressor, fuel pump and engine extension/retraction system. He also carried out a cylinder compression test, noting the compression as 50 psi. This was typical of the engine maintenance he carried out at each annual inspection. Footnote 24 SB 505-010 is applicable to the Rotax 275, 501, 505 and 535 models and was subsequently updated to Revision 1 (SB 505-010R1) on 4 May 2007. It is available on the Rotax website by searching for Service Bulletins relevant to the 505 model: https://www.flyrotax.com/services/technical-documentation.html 25 Part-ML is a continuing airworthiness standard for all EASA-regulated general aviation light aircraft (including gliders) which formally transfers responsibility for all aspects of owning and maintaining an airraft to the aircraft owner. It requires aircraft to be subject to a minimum inspection programme, which may be incorporated within an SDMP. Part-ML allows owners flexibility to develop a maintenance programme specific to their particular aircraft and to declare deviations from recommended maintenance. Deviations must be agreed by the certifying engineer, documented within the maintenance programme and signed by the owner.

26 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 The BGA inspector commented that he had not noticed any substantial degradation in its condition during this time26, nor had the owners reported any significant engine problems to him. He was aware that the engine was a source of worry for the owners as it was increasingly difficult to find spare parts. As such they were trying to limit the amount the engine was run to prolong its life. There was an engine hours logger fitted to the glider but the owners considered it unreliable and there was no information relating to engine operating hours recorded in G-CFST’s logbook. Only the second of G-CFST’s two logbooks was located covering the period from 2015 onwards. The BGA inspector stated that he inspected the engine each year based on the generic engine inspection requirements of BGA Glider Maintenance Programme and those listed in the Rotax 275 Operator’s Manual. These inspection items were carried across when he created the SDMP. He was not aware of SB 505-010R1 or the information in the BGA Compendium which referred to it. Neither G-CSFT’s logbook nor the associated work packs for previous annual inspections made reference to SB 505-010R127 and G-CFST’s owners had not identified its existence to him. As it was not mandated by an AD, he did not come across SB 505-010R1 when he searched for ADs applicable to G-CFST. As a consequence, there were some inspections that were not performed. When creating G-CFST’s SDMP he did not include a deviation for operation of the engine beyond the manufacturer’s recommended life, as the engine had already been operating ‘on condition’ for many years and he considered there would be no change to this under the SDMP. Analysis General Ground marks and the distribution of the wreckage showed that the glider struck the ground in a steep nose-down attitude and was structurally intact before it struck the trees. Examination did not reveal any pre-accident defects which would have affected the controllability of the glider. Engine Although the engine was deployed, it was not operating at the time of the accident. With the exception of the ignition switch, which was off, the configuration of the engine controls was broadly consistent with an attempt to start the engine. The ignition switch is visually similar to the fuel pump switch and it is possible it was moved post-accident during attempts to turn off the fuel pump. The engine was reported by several sources to have been difficult to start, both in the air and on the ground and did not start when the pilot attempted to start it prior to the accident flight. During post-accident testing, the engine started on the fourth pull of the pull-start Footnote 26 The paperwork for the 2019 annual inspection noted the cylinder compression as 4 Bar (58 psi) and as 5 Bar (72.5 psi) in 2016, 2017 and 2018. 27 A work pack from 2008 made reference to a ‘6-year check’ being performed on the engine.

27 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 handle, in line with the ground start procedure from the flight manual. In the installed condition, the pull-start cable undergoes several changes of direction. With the engine and its controls removed from the glider for testing, a direct, in-line, pull force could be applied to the starter, which may have contributed to the ease of starting. Continued operation of the engine was not assessed. Ground testing could not replicate the elapsed time or height required to start the engine in flight, nor take account of using the decompressor. But it indicated that the engine was most likely capable of starting, given available height and time to perform the required sequence of actions and the appropriate airspeed. Observation on engine maintenance The engine was no longer supported by the engine manufacturer and it had been operated ‘on condition’ for many years. It was inspected and serviced annually, including at the recent annual inspection. The engine had not been inspected in accordance with a required SB and G-CFST’s recently-created SDMP did not include a documented deviation from the manufacturer’s recommended engine maintenance schedule. These aspects were not causal or contributory to the accident but are reported as they may have relevance to other gliders equipped with engines which were operating ‘on condition’ prior to the introduction of Part-ML. Following this accident, the BGA undertook to write to all BGA Inspectors and owners of gliders with engines that are no longer supported by the engine manufacturer, to remind them of the maintenance requirements and the need to document any deviations from recommended maintenance in the aircraft’s SDMP. Survivability The pilot’s shoulder straps were found undone and had not been released by personnel attending the pilot after the accident. It was not established whether the pilot did not secure them prior to the flight, intentionally released them during the flight or if they became disengaged during the accident sequence. Anecdotal information from the BGA indicated the potential for inadvertent operation of the release tab on this type of QRF and a modification to prevent this was available from the harness manufacturer. It was considered unlikely that the USB logger worn around the pilot’s neck could have interfered with operation of the release tab, but the possibility could not be discounted. The post-mortem examination indicated that the extent of the injuries sustained by the pilot were such that they could have resulted in a fatal outcome, even if effective upper body restraint had been present. With the engine deployed, the impact forces caused substantial damage to the pylon, such that the engine came to rest just above the rear cockpit. In this case the passenger did not suffer injuries as a result. However, it underlines the importance of the guidance in the flight manual to stow the engine if a crash landing becomes inevitable, as a means of reducing the risk of injury to occupants.

28 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Licensing The pilot held a valid BGA Glider Pilot’s Licence. Medical Under the BGA Laws and Rules, the pilot was required to self-declare his medical fitness to fly and had done so in February 2019. The pilot held a current driving licence at the time of the accident, thus satisfying the medical requirements stipulated in the BGA’s Rules and Laws. While the club had imposed a ‘dual-only’ limitation on the pilot because he was “showing signs of ageing,” the pilot did not have an identifiable medical condition that would have stopped him from driving or flying. With a valid driving licence and no known declarable medical condition, the pilot’s self-declaration medical was valid on the day of the flight. Club imposed limitation The ‘dual-only’ limitation imposed on the pilot was a pragmatic first step towards mitigating potential risk associated with the perceived impact of age on the pilot’s decision making. The intention had been to review the measure as the gliding season progressed. The club did not have a formal process to follow and described themselves as “feeling their way” regarding how best to proceed. At the time of the accident flight, the club management did not consider there was enough evidence on which to base a decision to prevent the pilot flying as PIC. Crew status The pilot was PIC for the accident flight and the rear seat occupant held passenger status, with no legal authority to override decisions made by the PIC. The passenger was aware of the ‘dual-only’ limitation on the pilot but had not been formally briefed in his capacity as accompanying pilot. He was not acting in a recognised safety pilot role. Intervention Successful and timely in-cockpit intervention by a non-handling pilot, even in a multi- pilot environment, can be difficult to achieve. When the non-handling pilot is flying as a passenger in a single-pilot operation they have no legal authority to interfere with the conduct of the flight, intervention can only be effective if the PIC empowers the passenger to raise concerns. Even when empowered, deference to a more experienced and capable colleague, friendship and a PIC-to-passenger authority gradient are some factors that caninhibit effective intervention. The BGA’s guidance on mutual flying recommends airing such topics on the ground before flight as a way of bolstering CRM and avoiding the potential for later awkwardness. It also reminds pilots that the final decision for any course of action is the responsibility of the PIC. Having flown together on many previous occasions the two friends did not feel the need to discuss the specifics of cockpit management, authority gradient or empowerment before the accident flight.

29 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Gliding performance The wide variability between the altitude measurements from the various navigational recorders on the glider meant that an accurate calculation of G-CFST’s achieved gliding performance was not possible. Loggers A and B broadly correlated with the eyewitness account of the glider passing ‘just below’ his level on the 270 m contour line at Hartley Hill and were used as the basis for an indicative analysis of the flight’s vertical profile but definite conclusions could not be drawn. Comments from pilots posting on the BGA Ladder confirm the passenger’s observation that the Cotswold Ridge was not generating good soaring conditions on the day of the accident. Nonetheless, having released the aerotow at 2,100 ft amsl, the glider covered 16.5 nm before the engine was deployed at an altitude of approximately 590 ft, equating to an average achieved glide ratio of 1:65. It could not be determined to what extent ridge lift, rather than simply tailwind, contributed to this figure. G-CFST was below ridge height as it flew parallel to it south of Cheltenham. During this leg, the wind direction meant that the ridge would not be expected to produce significant lift, but the pilot might reasonably have anticipated that they would gain height tracking northbound from the Charlton Kings area. The passenger considered it probable that the pilot expected, even if the ridge wasn’t working well, that he would have enough height to reach the racecourse for a field landing. A simplistic comparison of the notional glide performance of G-CFST is included at Figure 18. This shows that from an assumed altitude of 885 ft (270 m) abeam the witness on Hartley Hill, a 1:50 glide path would have been sufficient to maintain terrain clearance when following the hypothetical yellow track line to the racecourse. This calculation does not take account of obstacles, such as buildings or trees, on the flightpath or of any head or tailwind component. Data from the loggers placed the aircraft just below 800 ft passing the witness. The five logger-derived altitude reference points depicted in orange indicate that, likely due to a tailwind, G-CFST was achieving a greater than 1:50 glide ratio around the bowl before the engine was deployed. From Point 5 on the graphic, while the racecourse airstrip was theoretically in range, the pilot had no contingency height in reserve. Heading north from Point 5 would have looked daunting, requiring descent from approximately 230 ft agl towards hostile28 rising ground. Terrain clearance at the highest ground elevation on track would likely have been less than 100 ft. From that point, with the terrain gradient approximating close to 1:50, and without factoring in trees and buildings en route, unless it found additional lift, the glider would have been at ultra-low-level for the remainder of the flight (Figure 19). Footnote 28 An area with no viable options for a successful field landing.

30 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Figure 18 Glide angle and terrain elevation profile comparison (Image ©2020 Google) Figure 19 View to the south-east from Cheltenham racecourse (Image Landsat/Copernicus ©2020 Google)

31 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 A comparative analysis for escaping to the south-west is at Figure 20. Assuming a 1:50 glide ratio with engine stowed, at 50 kt airspeed and compensating for a 15 kt headwind29, the glider would theoretically have achieved a 1:35 glide angle over the ground. Starting from an altitude of 590 ft and following the yellow track line on Figure 20, a 1:35 descent profile appears insufficient to clear the built-up area of Cheltenham. While the glider may have been unable to reach open ground beyond the town, it could have reached the playing fields in the middle of the built-up area. Although reachable, none of the playing fields were long enough in which to safely land an ASH 25 E.

Figure 20 Comparison of notional 1:35 glide angle vs terrain profile across Cheltenham (Image ©2020 Google) Engine deployment The ASH 25 E is an early example of a glider with a sustainer engine and the procedure to start the engine in flight is more time consuming and complex than that on many more modern types. The time taken to deploy the engine and the several steps needed result in unavoidable height loss during a start attempt. When the engine did not start immediately, there would have been insufficient time remaining to follow the steps required to stow the engine. After engine deployment the average glide angle achieved approximated to 1:11. Footnote 29 Based on the reported wind of 260°/11 kt at Gloucester Airport.

32 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 Pilot decision making The investigation was not able to determine why, having found the soaring conditions unfavourable, the pilot continued following the ridge behind Cheltenham from an altitude which left limited options for a successful outcome. The passenger reported recognising that continuing would be hazardous and prompting the pilot to divert to Gloucester Airport but was not able to convince the pilot to accept his advice. Once committed behind Cheltenham at low altitude, the pilot found himself faced with three unappealing options as he passed Charlton Kings:

● To descend towards rising hostile ground to the north, trusting that he would have enough height to clear the high ground short of Prestbury and be able to reach a safe landing area beyond.

● To turn into wind over Cheltenham and hope to have enough height to clear the built-up area for a potentially compromised field landing, either in the playing fields or on open ground beyond the town.

● To attempt an engine start at a height from which success would be highly unlikely. Anecdotal evidence was that the pilot knew starting the engine would require in excess of 400 ft. At the point of engine deployment, the glider was approximately 200-250 ft agl and heading towards rising ground, making a successful start highly improbable. How the pilot arrived at the decision to deploy the engine could not be determined, but the investigation considered it an indication that he thought the other options were untenable and that starting the engine was the only avenue left to try. Being unaware of the intention to deploy the engine, the passenger was unable to influence the pilot’s decision to trade the glider’s remaining height for an engine start outside viable deployment parameters. While acknowledging the known effects of ageing on a pilot’s general cognitive function, the investigation did not find direct evidence linking the pilot’s age to his decision making on the accident flight. Conclusion The accident occurred because the glider was flown over an area and at an altitude where a successful field landing could not be assured. While the pilot had been flying under an informal ‘dual-only’ limitation related to the perceived effects of ageing, the investigation was not able to determine to what degree age was a factor in his decision making on the accident flight. With an ageing pilot population, the effective and fair management of those with declining physical and cognitive capabilities is likely to remain an ongoing challenge for supervisors and regulators. Formal guidance, such as that proposed by the BGA, could help those empowered with overseeing GA and gliding operations make more informed and transparent supervisory decisions in this regard. Failing to recognise when they are approaching the point of no return for continued safe flight is not the sole purview of ageing pilots; it is a constant hazard in all forms of aviation

33 © Crown copyright 2021 All times are UTC AAIB Bulletin: 6/2021 G-CFST AAIB-26884 and for pilots of every experience level. Effective CRM is an important risk mitigation tool for single-pilot operations, not just something to be employed by multi-pilot crews. While passengers do not have legal authority to intervene, if properly empowered as part of an effective CRM strategy, they can make a valuable contribution to the safe conduct of flights. Safety action Following this accident, the British Gliding Association:

● Began a consultation process with its member clubs with the aim of developing formal guidance to support the management of pilots of any age who might benefit from flying with a safety pilot or relinquishing PIC status.

● Undertook to write to all BGA Inspectors and owners of gliders with engines that are no longer supported by the engine manufacturer, to remind them of the maintenance requirements and the need to document any deviations from recommended maintenance in the aircraft’s SDMP. Published: 29 April 2021.

FD06716 ｜ 2021_英国_aaib-investigation-to-tekever-ar5-evolution-mk-2-g-tekv__Tekever_AR5_Evolution_Mk_2_G-TEKV.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 SERIOUS INCIDENT

Aircraft Type and Registration: Tekever AR5 Evolution Mk 2, G-TEKV No & Type of Engines: 2 3W 2-stroke piston engines Year of Manufacture: 2019 (Serial no: E505) Date & Time (UTC): 29 December 2020 at 1446 hrs Location: Lydd Airport, Kent Type of Flight: Commercial operations (UAS) Persons on Board: Crew - None Passengers - None

Injuries: Crew - None Passengers - N/A Nature of Damage: None Commander’s Licence: Other Commander’s Age: 33 years Commander’s Flying Experience: 1,514 hours (of which 665 were on type)

Last 90 days - 105 hours

Last 28 days - 34 hours Information Source: Field Investigation Synopsis While orbiting south of the runway in preparation for landing, both the unmanned aircraft’s engines shut down unexpectedly. The External Pilot on the ground, who was visual with the aircraft, took control and landed it without further incident. The dual engine shutdown was likely to have been caused by an on-aircraft data error. Various safety actions, including improvements to the aircraft’s hardware and software, and the Ground Control Station software, have been taken to reduce the risk of a reoccurrence. History of the flight The unmanned aircraft, G-TEKV, was returning to Lydd Airport from a flight over the English Channel. Flight operations were conducted from a Ground Control Station (GCS) where the crew control the aircraft from takeoff to landing and operate the payload to fulfil the mission objectives. The GCS contained two stations, the flight GCS (fGCS) and the mission GCS (mGCS). The fGCS focused on all aspects of the control of the aircraft platform, whereas the mGCS focused on the mission goals and operation of the payload. The GCS was manned by the Mission Commander (MC), the oncoming Internal Pilot (IP), the off-going IP, and the Payload Operator (PO). An External Pilot (EP)1 and a Maintenance Technician (MT) were positioned at the side of the runway abeam the intended touchdown position for the aircraft and both could communicate with the IP through air band radios. Footnote 1 The EP may also be referred to as a Safety Pilot (SP).

2 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 While the aircraft was orbiting off the coast prior to transiting back to the airfield, the two IPs conducted a handover; the off-going IP remained to act as a second pilot to assist with the conduct of the remainder of the flight. Meanwhile the EP advised that the wind favoured a landing on Runway 03 with a light crosswind. Figure 1 Lydd Airport and Echo Point The aircraft transited towards the airfield at 700 ft amsl to remain clear of the cloud and icing. On reaching Echo Point, overhead the airfield (Figure 1), the aircraft entered an orbit while the IP, assisted by the off-going IP, proceeded to load the mission waypoints for a landing on Runway 03. Meanwhile, the EP reported to the GCS that he could hear the aircraft but was not visual with it. The MC instructed the IP to descend the aircraft to 600 ft at which point the EP confirmed that the aircraft was visual and clear of cloud. With the aircraft established at 600 ft in the orbit at Echo Point and the mission points uploaded, the IP informed the EP that the aircraft was set up for the landing. The EP acknowledged and the IP switched the aircraft to route mode2 to proceed with the approach and landing on Runway 03. After the aircraft completed two more orbits, the crew in the GCS noticed that it did not appear to leave the orbit at the expected point to establish itself downwind. As the aircraft flew the final orbit, the EP outside was expecting the call ‘downwind’ from the GCS team. He noticed the aircraft level its wings, as expected when departing the orbit, Footnote 2 This is an automatic mode where the aircraft follows a specified route defined of sequential waypoints defined by location and altitude.

3 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 but observed the nose drop more than normal. At this point the EP became aware that he was not able to hear the aircraft’s engines. He operated the throttles and confirmed that there was no engine response. The EP switched to fly-by-wire (FBW)3 mode, took control of the aircraft, confirmed control response, and instructed the MT to inform the GCS about the complete loss of engine power. While this was happening, the flight team in the GCS was first alerted that something was amiss when they observed the aircraft fly on a westerly heading towards the runway and not along the expected track to establish itself downwind parallel to the runway. None of the team reported seeing or hearing any alarms or warnings. The MC noticed that the height of the aircraft appeared low, and the off-going IP then noticed that the displayed parameters for both engines indicated zero rpm. The MC, unaware that the EP had already taken control of the aircraft, gave instruction to the IP to advise the EP to do so and went outside the GCS to observe the aircraft. The MT advised the IP that the EP had already taken control and so, from that point on, the IP provided speed information to the EP until the aircraft had landed. The EP assessed the conditions and positioned the aircraft on final approach; it landed without further incident. June 2020 event This event followed a related one that occurred in June 2020 where, during an integration ground test of equipment onto a new AR5 aircraft at the manufacturing and development site in Portugal, both engines shut down, uncommanded by either the GCS or the EP. Lydd Airport Lydd Airport has an elevation of 13 ft amsl and is situated about 1 nm inland from the south coast. At the time of this event the airfield was closed, and ATC was not manned. The operator had authorisation to operate the aircraft from the airfield when it was closed. Personnel Crewing The MC leads the team in the execution of the flight and its mission. The IP is the fGCS operator and is responsible for the control and navigation of the aircraft. The IP communicates with ATC, when available, and other aircraft to ensure deconfliction. The PO is the mission GCS (mGCS) operator and is responsible for the management of the payload. Footnote 3 The EP controls the aircraft’s roll and pitch angles and throttle (using his radio controller) and the aircraft is stabilized within control limits. The rudder is either controlled manually or automatically with aileron movement. In this mode of operation, the IP is required to constantly update the EP with speed information.

4 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 The MC, IP and PO are located in the GCS for the mission. The EP is responsible for ground manoeuvring, takeoffs and landings, and provides redundancy while the aircraft remains within Radio Line of Sight (RLOS) of him in the event of signal loss between the aircraft and the GCS. For departure and arrival, the EP stands at the side of the runway abeam the intended departure or landing point. The EP has an air band radio to listen to the information passed by the IP in the GCS but relies on the MT to transmit any information back to the GCS. The MT is responsible for ensuring the aircraft is serviceable and operational. During takeoffs and landings, the MT accompanies the EP to act as a communications relay between the EP and the IP in the GCS. Training and experience All the pilots satisfied the qualification and competency requirements specified in CAP 7224. Each of the crew members had successfully completed the operator’s own competency training programme for the aircraft in their specific roles. The MC, IP and PO all had previous experience operating UAS and were trained for both the IP and PO roles. The EP had satisfied the required competency training for his role and it was noted that he had extensive experience in flying radio-controlled models, including 40% scale aircraft. Recorded information Recorded data was available from both the aircraft and GCS. Flight data was stored in a log file on the aircraft which included: flight control data (such as received control commands and control surface deflections); GPS-sourced data; engine data, aircraft attitudes and aircraft modes (such as ‘Fly by wire’); and messages (such as ‘Ignition OFF’). The aircraft was also fitted with cameras, but these were not active during the event. The GCS recorded data into three log files. One of these included telemetry data from the aircraft that was GPS timestamped. The GCS had no facility to record alarms and warning triggers, either in a log file, visually or audibly. Figure 2 shows the flight track of the aircraft from the last of six orbits around Echo Point through to the landing. The aircraft came into radio range of the EP’s controller at 1437:30 hrs near Echo Point and commenced the orbits at about 750 ft. From the flight log it was determined that during the last orbit an engine ‘Ignition OFF’ command was detected by the autopilot after which the engines shut down. The EP started making roll control inputs to level the wings 17 seconds after the ‘Ignition OFF’ command (overriding the autopilot) before switching to FBW mode 11 seconds later. Footnote 4 CAA, CAP 722, ‘Unmanned Aircraft System Operations in UK Airspace – Guidance’ 7th Edition, amendment 2019/03, 4 September 2019.

5 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 Figure 2 Aircraft flight path during the event Aircraft information System description The Tekever AR5 Evolution UAS (AR5) consists of a manned GCS and an unmanned aircraft (Figure 3). G-TEKV was manufactured and operated by the same organisation and, for this report, is referred to as the operator. Command and control of the aircraft is achieved through the use of RLOS and Beyond Radio Line of Sight (BRLOS) communication data links. The system has six data links in total, five of which carry primary and secondary RLOS and BRLOS capability. The sixth link is a radio link used for control of the aircraft by the EP. The RLOS control system operates in one frequency band and has a maximum range of 3 km, the backup RLOS system operates at a different frequency and has a range of 4 km. For BRLOS the system uses 4G and Satcom channels to maintain communication with the aircraft. In the event of a loss of the link, the aircraft can remain in a holding pattern to try and re-establish communications. If, after a defined period, the aircraft has not established communications, it can return home and perform an automatic landing.

6 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 Figure 3 Tekever AR5 Evolution Aircraft description The aircraft has a maximum takeoff mass of 180 kg, a wingspan of 7.29 m, a length of 4.03 m and a fuel tank capacity of 60 litres. It is powered by two 170 cc two-stroke boxer engines manufactured by 3W which generate 9.43 kW at 5,600 rpm. An external electrical engine starter is manually connected to each engine before start-up. Once the engines are running the starters are disconnected. The AR5 does not possess a built-in engine start capability. The aircraft fuel system consists of one central tank in the fuselage and two electric fuel pumps. The avionics systems can be considered as falling into two main categories. Firstly, all the critical systems that affect safe control and navigation of the aircraft. These comprise the Flight Management System (FMS), Autopilot, Actuator Control Electronics (ACE), Electronic Fuel Injection (EFI) and the sensors and actuators to control the flying control surfaces. Secondly, the avionics and systems that enable exploitation of the aircraft’s mission systems. These include video processing and thermal imaging cameras. In normal flight conditions the aircraft is controlled via the RLOS and BRLOS communication channel from the GCS. However, in an emergency the EP can take direct control of the aircraft via a separate controller with its own radio link. Although there is only one transmitter (used by the EP), at the time of the event the AR5 had a dual receiver system which provided redundancy should one of the receivers fail. The dual receiver system also marginally extended the range at which the EP could control the aircraft. The outputs from the dual receivers were routed through a multiplexer which merged the signals and passed them via the ACE to the Autopilot (Figure 4). When out of range of the EP’s controller, receivers are programmed to send a signal down one of the control channels to the autopilot. The autopilot then ignores all the other control channel signals until a receiver detects that the aircraft is back in range.

7 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 Figure 4 EP control path Generator power unit (GPU) The GPU is responsible for the management of the aircraft’s electrical power systems, swapping from generator energy to batteries, charging batteries and managing external power sources. Within the GPU, switching regulators were used and the circuitry design followed the recommendations of the regulators’ manufacturer. The regulators were certified to meet IPC 9592A, Category 2, Class II.5 EP radio link The EP radio link is used to control the aircraft’s ailerons, elevator, throttles, rudder, flight modes and the ignition switch. The autopilot receives command signals via the serial data bus from the multiplexer at a rate of 50 Hz but are only recorded in the flight log at 10 Hz (every fifth value received by the autopilot). Each of the channel data on the serial data bus was in the form of an 11-bit value (0 to 2,047) for use by the autopilot. For the ignition switch channel, the ‘Ignition ON’ command was made by sending a pre-defined non-zero value, and the ‘Ignition OFF’ command by sending a value which is larger than a set threshold. Only one instance of a value exceeding the set threshold was required (of the 50 per second sent) to command ‘Ignition OFF’ and cut both engines. As such, a single bit error would be sufficient to modify the ‘Ignition ON’ signal value so that it exceeded the ‘Ignition OFF’ threshold.6 Bit errors on the control surface channels, if infrequent, would have little noticeable effect as the control surfaces would not be able to react quickly enough before being commanded back to a ‘good’ value 0.02 seconds later. Footnote 5 IPC-9592A specifies the requirements for design, qualification testing, conformance testing and manufacturing quality/reliability processes of power conversion devices for the computer and telecommunications industries. Category 2 devices are board-mounted dc to dc convertors. 6 For bit errors in the SBUS data stream to modify the 11-bit default value so that it exceeded the threshold, two combinations existed for a single-bit change, 15 combinations for a two-bit change, 56 for a three-bit change etc. of the 2,048 combinations of an 11-bit word. The highest number (but least likely) of bit-error combinations was 290 for changes to six bits.

8 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 GCS stations and displays General The fGCS consisted of a dual screen display, of which the primary screen displayed the Mission Station (MiSt) screen (Figure 5). The mGCS consisted of a three-screen display, one of which mirrored the MiSt display. Figure 5 fGCS Primary display – MiSt screen Flight Information Bar The flight information bar is situated on the left of the MiSt screen. A pictorial display of an artificial horizon with speed, heading and altitude information is displayed at the bottom. In the middle of the bar, the signal integrity for each of the communication links is displayed through icons which are coloured according to a traffic light system. Above this, aircraft parameters are displayed and include information on the signals, battery levels, and engine parameters (which include engine rpm and throttle status for each engine). An enlarged view of that part of the flight information bar is shown in Figure 6. None of the aircraft parameters were colour coded according to status.

Figure 6 Flight Information Bar – Engine Parameters

9 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 Notifications and warnings The conditions to trigger alerts and warnings could be set and enabled or disabled individually and were specific to the fGCS and mGCS stations. The conditions for engine alerts, including the low engine rpm warnings were set on the fGCS station. An audible alert could be either enabled or disabled but applied to all warnings and alerts and could not be configured individually. There was also a configurable snooze function, which allowed an alert to be made temporarily inactive for a specified period of time. The notification toolbar was situated in the bottom right corner of the screen and displayed any new event notifications, alerts or warnings to the IP. A new alert or warning was brought to the attention of the IP through an alerts/warning button at the bottom right of the screen which flashed red if a new warning had been activated. By clicking the alerts/warning button on the notification toolbar, the IP could bring up a dialogue box with more detailed information on the warning or alert which allowed the IP to choose to either snooze the alarm, ignore it, or locate it. Once an action had been selected the alerts/warning button would turn black with white writing. Organisational information Regulation At the time of the event, the aircraft was operating under the ANO (2016); the CAA had granted an Exemption for BVLOS operations. The original authorisations were granted under CAP 722 edition 6, but at the time of the event edition 7 was extant and stated: ‘Operators of unmanned aircraft over 20 kg are required to apply for an exemption from the CAA. Any commercial operations aspects will also be covered within this exemption. The application must include a safety case including a risk assessment which demonstrates that the operation can be conducted in a safe manner.’ The operator had provided an Operational Safety Case (OSC) to support its application to the CAA for an Exemption and, since that time, had updated it where appropriate. Double Engine Failure Volume 2 of the OSC outlined the emergency procedures in the event of a double engine failure on takeoff or en route; the routing to and from the airfield was designed to reduce the subsequent risk to third parties or property. The procedures included the designation, prior to departure, of emergency landing locations in case of loss of communications or propulsion, as well as the use of an External Pilot as a safety pilot. Volume 3 of the OSC outlined the risk assessment. It identified three scenarios of relevance to this event together with measures to control the risk (Table 1).

10 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 Scenario Extant Control Measures A9 – SP [EP] takes control of UAV [Unmanned Aerial Vehicle] with degraded performance

1. Only qualified crew and in good health conditions operate

Tekever AR5 Evolution

1. Ensure constant communications among crew members

during the take-off/landing manoeuvres

1. IP is aware of degraded performance using the fGCS

instruments

1. IP will inform EP about degraded performance

O2 – Non-EMI [Electromagnetic Interference] related Double engine failure

1. UAV maintenance is done by qualified crew and in good

health conditions. Maintenance schedules reduce the risk of engine failure

1. IP monitors engine readings during the flight to detect

potential problems

1. The UAV will attempt to land in a pre-planned landing area
2. The crew can use Flight termination system (FTS) to

prevent further flight O15 – Erroneous control actions by the autopilot

1. UAV maintenance is done by qualified crew and in good

health conditions to operate Tekever AR5 Evolution

1. IP will detect erroneous actions by autopilot and perform

the corrections needed

1. FTS available
2. Operating in restricted airspace within safety areas’

Table 1 OSC risk assessment scenarios of relevance to the event CAP 722 and airworthiness standards Section 4 of CAP 722 (Edition 6) titled ‘Certification & Airworthiness’ contained guidance on certification and the suggested approach for aircraft which do not require certification to formal standards. For this operation, the CAA used the OSC process, where applications would be scrutinised in a proportionate way to the risk its design and usage posed to the general public and property and, where there was a lack of demonstrable airworthiness, risks could be mitigated by operational limitations. Appendix C of CAP 722 provided a template and guidance on how to complete an OSC. Volume  2, Section 1.1 ‘Details of design and manufacturing organisation(s) and any recognised standards to which the equipment has been designed, built and tested’ stated that: ‘Details of any standards that may or may not be aviation related and may add to the safety argument. Where known this must include test and evaluation evidence.’

11 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 In Edition 7 of CAP 722, the following text was added to this section: ‘Provide details of any recognised standards to which equipment relevant to the application has been designed, built and tested, for example, aeronautical standards such as EUROCAE and RTCA, or product standards such as ISO, ASTM, STANAG and BSI.’ The OSC for this operation, developed under Edition 6 of Cap 722, did not contain details of any standards used. However, the operator advised that aircraft had been designed and built using STANAG 47037 as guidance, along with ‘industry best practice’ but was ‘not fully compliant to the standards.’ It also advised that software is designed using DO-178B8 as guidance during the development process to ‘ensure that there were no catastrophic errors.’ No formal testing against any of these standards was made, nor was any required for the Operational Authorisation. In January 2021, the operator published internal document ‘EMC [Electromagnetic Compatibility] Integration Considerations’ which detailed ‘the procedures and best practices’ to be used by the operator ‘to ensure that the integration of new equipment maintains the baseline EMC values.’ The OSC contained information on how modifications were embodied and how configuration control was maintained. It did not, however, describe the process for developing the modification, but this was later clarified in the operator’s document TAS-CMN-QAP-008_00 Development Procedures in Electronics, Version 1 which was issued on 11 February 2021. Operator’s investigation of June 2020 event Following the double engine shutdown event on the ground in Portugal in June 2020, the operator analysed the recorded data available and determined that, although the autopilot had received an ‘Ignition OFF’ command, the command had not been sent from either the GCS or EP. After further testing, the operator identified erroneous values, in the form of bit errors, within the data passed from the multiplexer via the ACE to the autopilot (Figure 7) and began an investigation to understand how and where these signal errors were being introduced. Footnote 7 STANAG 4703 – Allied Engineering Publication AEP-83 ‘Light Unmanned Aircraft Systems Airworthiness Requirements’ is a set of technical airworthiness requirements intended for the airworthiness certification of fixed-wing light military UAS with a maximum takeoff weight not greater than 150 kg that intend to regularly operate in non-segregated airspace over all population densities. 8 DO-178B – Software Considerations in Airborne Systems and Equipment Certification – is a guideline dealing with the safety of safety-critical software used in airborne systems. The Software Level, ranging from Catastrophic (failure may cause a crash) to No Effect (failure has no impact of safety) is determined by examining the effects of a failure condition in the system.

12 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083

Figure 7 Data from the aircraft log file showing spikes on the control channels in and out of the autopilot for Aileron (C1) and Rudder (C4) for the June 2020 event The operator’s investigation followed several lines of inquiry:

1. EP radio link system robustness – since it appeared that there were

wrong values being sent to the autopilot system.

1. Source of noise – since it appeared that higher system current loads

increased the probability of the event happening.

1. Autopilot system – study the possibility of the autopilot incorrectly

interpreting the control inputs and why the data logged for the ignition switch control contained no erroneous values. The operator concluded that:

● The event could be replicated only if the multiplexer was in the system and that noise was detected on the output signal from the multiplexer.

● The noise level increased when the current loading from the aircraft’s electrical systems increased implying that the GPU was the source of the electrical noise.

● The autopilot recorded the 50 Hz signal data at a rate of 10 Hz (to limit the quantity of data recorded) so some erroneous values might not be logged.

● Checking for a continuous ‘Ignition OFF’ command over a defined period of time (rather than a single value) would reduce the likelihood of the engines being shut down due to transient erroneous commands.

13 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 As a result of the operator’s investigation into the June 2020 event the following safety actions were taken:

A new SBUS multiplexer hardware revision was released in June 2020 that fine-tuned the internal PCB design and some components to minimise the impact of external interference. It was noted that it was ‘not fully protected against noise’; however, the inadvertent engine shutdown event could not be reproduced during tests. This revision was embodied on the entire AR5 fleet, including G-TEKV which was modified in June 2020.

The GPU was redesigned to reduce Electromagnetic Interference (EMI) emissions. The GPU redesign was based on the standards of STANAG  4703, and tests were performed to comply with CISPR25 – Class 1.9 This work was completed in the second quarter of 2021 and the new GPUs are being installed on new build aircraft and on those returned to the factory for maintenance. The operator also recommended that the autopilot firmware be updated as soon as possible with a change to the detection of an ‘Ignition OFF’ command from a single instance to a requirement to have 10 consecutive valid commands. This change would prevent single erroneous ‘Ignition OFF’ commands from shutting down both engines. However, the operator decided that this was ‘not a critical update’ given the apparent effectiveness of the multiplexer redesign. As a consequence, the firmware update was only applied to aircraft returned to the factory, or to new build aircraft. G-TEKV was built prior to June 2020, had not been returned to the factory since that date, and so did not have this firmware update embodied. Following the serious incident in December 2020, the operator has now embodied this autopilot firmware update on the entire AR5 fleet of aircraft. It has also disconnected one of the EP channel radio receivers and bypassed the multiplexer completely. The operator noted that this decreased the radio range but ‘continues to be in the distance needed for safe operation as described in the OSC’. The operator also introduced an additional procedural control measure to disable the ‘Ignition OFF’ command unless the aircraft was within 500 m of the EP. The operator reviewed the implementation of warnings and alerts to users of the GCS. The review noted that alert thresholds could be changed by users but that ‘the warnings offer a high level of verbosity’ and that ‘multiple warnings can be triggered when in a ‘normal’ state’. It identified that this saturation of warnings could result in an alert or warning being made inactive by users to remove the distraction or that warnings risked being ignored. Footnote 9 Comité International Spécial des Perturbations Radioélectriques (CISPR) sets standards for controlling electromagnetic interference in electrical and electronic devices. CISPR25 details limits and procedures for the measurement of on-board radio disturbances in the range of 150 kHz to 2500 MHz. The standard applies to any electronic/electrical component intended for use in vehicles as well as boats powered by internal combustion engines, and devices also powered by internal combustion engines. Class 1 is the least stringent of the five classes within the standard.

14 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 The review recommended the implementation of a revised warning system with a notification/ warning message bar which would identify the alert without user action or intervention, and which would ensure that the information remained visible. In addition, the corresponding parameter on the flight information bar would be highlighted in red. From April 2021, the operator started to implement the revised system status reporting within the GCS software. This includes two alert levels (caution and warning) and a revised flight information bar with parameters colour coded according to status (an extract is shown in Figure 8). Figure 8 Revised flight information bar extract Analysis The event Whilst the aircraft was returning to the airfield to land, both engines shut down at the same time and there was no means to restart them in the air. The event occurred over the airfield at a time when the EP was prepared and expecting to take over flight control from the GCS team for the landing. Although the cause of this event was such that it could only have occurred whilst the aircraft was in radio range of the EP, it was fortuitous that it happened at a time when he had good visibility of the aircraft. He saw that there was a problem, took control in accordance with the actions stipulated in the operator’s OSC, and his training and experience enabled him to glide the aircraft to an otherwise uneventful ‘dead stick’ landing on the runway. There was a short period during which the crew in the GCS were unaware of the aircraft’s degraded performance. None of them saw or heard any warnings or alerts associated with the loss of engine power and only became aware of an issue when they observed the aircraft deviating from the planned trajectory because the EP had taken control. The GCS crew noticed the aircraft descend and this then drew their attention to the engine indications on the fGCS primary display. Following an internal review, the operator has implemented a revision to the system status reporting within the GCS software. The reason for the simultaneous shut down of both engines was likely to be a spurious ‘Ignition OFF’ command generated on the aircraft’s EP controlling link through corruption of data provided to the autopilot from two radio receivers via a multiplexer. The presence of

15 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 a single erroneous command was sufficient to cause the simultaneous engine shutdowns. This data corruption most likely originated from electrical noise as a result of electromagnetic interference originating from the GPU, which affected the operation of the multiplexer. Data corruptions so caused were difficult to identify as only one out of five samples of data were recorded and the level of noise generated varied with the load on the aircraft’s electrical system. Such data corruptions could only have an effect when the aircraft was within range of the EP’s transmitter as the autopilot was programmed to ignore any commands received via this radio link at all other times. Design, build and test standards Following an earlier similar event in June 2020, the operator did identify and implement improvements to the multiplexer to make it more resistant to electromagnetic interference. Subsequent testing could not reproduce the issue and so the operator considered that the problem had been resolved and this improvement was embodied on all AR5 aircraft. However, believing that the multiplexer redesign had solved the problem, an associated update to the autopilot firmware to improve resilience to spurious commands (which included the agreed change to the ’Ignition OFF’ logic in the autopilot software) was considered not to be critical. It was decided that existing aircraft would only be updated on their next return to the factory for maintenance. G-TEKV was equipped with the improved multiplexer but not the updated autopilot firmware at the time of the event in December 2020. It is unclear exactly what EMC tests were carried out after the June 2020 event and if these were the same as those carried out during the development and testing phase of the aircraft. However, with the modified multiplexer installed, these tests did show that noise could still be detected on the control signals. The fact that the noise did not trigger an ‘Ignition OFF’ command during these tests and would have had negligible impact on the other control inputs to the autopilot, resulted in a false assumption that the issue had been resolved. The standards to which the aircraft was built and tested to were not described in the OSC and, although the OSC template in CAP 722 had provision for this information, there was no requirement for it to be included. Various aeronautical and transport standards were used as guides for the design and testing of the aircraft, representing best practice at the time. No formal testing against any of these standards was conducted so it is unknown if the aircraft design would have passed these. The OSC template referred to in later additions to CAP 722 now include examples of aeronautical standards that could be applied but there are still no requirements for these standards to be met. In March 2021, in a report of an accident to a Alauda Airspeeder Mk II UA10, the AAIB made recommendations to the CAA and EASA to: ‘adopt appropriate design, production, maintenance and reliability standards for all Unmanned Aircraft Systems with aircraft capable of imparting over 80 joules of energy11.’ In response Footnote 10 AAIB Bulletin 03-2021.indd (publishing.service.gov.uk) [accessed 9 August 2021] 11 80 joules of kinetic energy (equivalent to a 1 kg mass falling to the ground from about 8 m) is the limit specified in EU Commission Implementing Regulation 2019/947 for UAs in the Open category that can be operated intentionally over ‘uninvolved people’.

16 © Crown copyright 2021 All times are UTC AAIB Bulletin: 11/2021 G-TEKV AAIB-27083 to these recommendations, both organisations have indicated the intent to develop, and adopt into regulation, such standards as are deemed appropriate and proportionate for the various types of UAS design and operation. Conclusion While the unmanned aircraft was orbiting south of the runway in preparation for landing, both engines were commanded to shut down due to a spurious ‘Ignition OFF’ signal being detected by the autopilot. It was likely to have been caused by electromagnetic interference from the aircraft’s generator power unit corrupting some data on the radio channel used by the EP to control the aircraft. The EP on the ground, who was visual with the aircraft, took control and landed it without further incident. This event followed a similar erroneous ‘Ignition OFF’ signal six months earlier during a ground test. As a result of the operator’s investigation into the first event, design changes were made to the aircraft to limit the effect of interference, not all of which had been implemented by the time of the second event. Following this second event, a number of additional safety actions have been taken by the operator. Safety actions Since the June 2020 and December 2020 events, the operator has: Redesigned the GPU to reduce emissions and is installing these on the AR5 aircraft fleet. Changed the design of the radio command channel used by the EP and bypassed the multiplexer. Embodied an autopilot firmware update on the AR5 fleet of aircraft so that ‘Ignition OFF’ must be asserted for 10 consecutive commands to trigger engine shutdown. Introduced an additional procedural control measure to disable the ‘Ignition OFF’ command unless the aircraft is within 500 m of the EP. Implemented a revision to the alerting system within the GCS software to improve its effectiveness. Revised its internal documentation to include modification design and embodiment processes and to ensure that consideration is given to EMC for the integration of new equipment. Published: 21 October 2021.

FD06717 ｜ 2021_英国_aaib-investigation-to-wingcopter-178-heavylift-uas-registration-n-slash-a__Wingcopter_178.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

79 © Crown copyright 2021 All times are UTC AAIB Bulletin: 1/2021 Wingcopter 178 Heavylift AAIB-26982 ACCIDENT

Aircraft Type and Registration: Wingcopter 178 Heavylift (UAS, registration n/a) No & Type of Engines: 4 Scorpion SII-4035 560 KV brushless DC motors Year of Manufacture: 2020 (Serial no: SN-0084) Date & Time (UTC): 4 September 2020 at 1415 hrs Location: Mayfield Farm, Ilsley Road, Compton, Newbury Type of Flight: Training Persons on Board: Crew - N/A Passengers - N/A

Injuries: Crew - N/A Passengers - N/A Nature of Damage: Damaged beyond economical repair Commander’s Licence: Other Commander’s Age: 24 years Commander’s Flying Experience: 108 hours (of which 13 were on type)

Last 90 days - 14 hours

Last 28 days - 4 hours Information Source: Aircraft Accident Report Form submitted by the pilot Synopsis Whilst the unmanned aircraft (UA) was climbing, in hover mode, one of the rear electronic speed controllers (ECSs) overheated causing a loss of control of its associated motor and propeller. Control of the aircraft was lost and it fell into a crop field, damaging it beyond economical repair. The manufacturer is looking to re-design the rear propellers to reduce the likelihood of the ESCs overheating. History of the flight The Wingcopter 178 Heavylift, (Figure 1) is an unmanned electric Vertical Takeoff and Landing (eVTOL) aircraft with a maximum takeoff weight of 18 kg. It can take off and land vertically like many multirotor unmanned aircraft but can transition to wing-borne flight by rotating its two forward propellers to a horizontal position and folding its rear propellers to reduce drag. In ‘fixed wing mode’ the aircraft is capable of ranges of up to 75 miles and speeds up to 150 mph, dependent on payload. The aircraft has a 1.78 m wingspan and is 1.32 m long. The UA was conducting a test flight to verify its performance at its maximum takeoff mass (MTOM), using an automated mission profile that it had successfully completed five times before.

80 © Crown copyright 2021 All times are UTC AAIB Bulletin: 1/2021 Wingcopter 178 Heavylift AAIB-26982 Figure 1 Wingcopter 178 Heavylift with propellers positioned in ‘hover mode’ After conducting the pre-flight and mission checks the remote pilot (RP) armed the aircraft, confirmed that the motors had spooled up correctly and initiated the automatic flight by switching the radio control transmitter to ‘mission’ mode. The aircraft lifted off successfully and began to climb in ‘hover mode’ towards its target height of 110 m agl at which point the aircraft would transition to ‘fixed wing mode’. Recorded data from the aircraft shows that it initially climbed vertically to approximately 35 m agl before continuing a programmed translational climb in ‘hover mode’ to the south west (Figure 2). After 72 seconds, whilst approaching 100 m agl, and having travelled 188 m, the aircraft rolled and pitched to the right and became temporarily inverted. It righted itself, but was unable to maintain control, descending rapidly whilst spinning in a clockwise direction. The RP reported that it was evident that one of the motors had lost propulsion. He attempted to gain control of the aircraft by switching to manual control, but this was unsuccessful. As the aircraft descended some thrust was still produced by the operating motors prolonging the descent. The UA travelled approximately 80 m downwind before striking the ground in a harvested crop field. There were no injuries, although the aircraft was destroyed.

81 © Crown copyright 2021 All times are UTC AAIB Bulletin: 1/2021 Wingcopter 178 Heavylift AAIB-26982 Hover climb Translational Climb Uncontrolled descent Figure 2 Oblique view of the aircraft’s flight profile © Google 2020, Image © Landsat / Copernicus Aircraft examination Assessment of the aircraft by the operator, in conjunction with the manufacturer, identified that a rear ESC had overheated resulting in the loss of control of its associated motor. This issue had been previously identified by the manufacturer and a hover time limitation of 120 seconds, to prevent the overheating, had been imposed. It is considered that the ESC overheated due to the increased load produced as a result of the combination of the duration of the translational climb and operation close to MTOM. The manufacturer is currently working on resolving this issue by introducing re-designed rear propellers to the aircraft type.

FD06718 ｜ 2021_英国_aircraft-accident-report-aar-1-slash-2021-airbus-a321-211-g-pown-26-february-2020__AAR_1-2.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2021 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

AIRCRAFT ACCIDENT REPORT 1/2021 Report on the serious incident to Airbus A321-211, G-POWN at London Gatwick Airport on 26 February 2020 AAIB Air Accidents Investigation Branch

AIRCRAFT ACCIDENT REPORT 1/2021 Air Accidents Investigation Branch Report on the serious incident to Airbus A321-211, registration G-POWN at London Gatwick Airport on 26 February 2020 This investigation has been conducted in accordance with Annex 13 to the ICAO Convention on International Civil Aviation, EU Regulation No 996/2010 (as amended) and The Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 2018. The sole objective of the investigation of an accident or incident under these Regulations is the prevention of future accidents and incidents. It is not the purpose of such an investigation to apportion blame or liability. Accordingly, it is inappropriate that AAIB reports should be used to assign fault or blame or determine liability, since neither the investigation nor the reporting process has been undertaken for that purpose.

ii © Crown Copyright 2021 Printed in the United Kingdom for the Air Accidents Investigation Branch This report contains facts which have been determined up to the time of publication. This information is published to inform the aviation industry and the public of the general circumstances of accidents and serious incidents. Extracts may be published without specific permission providing that the source is duly acknowledged, the material is reproduced accurately and it is not used in a derogatory manner or in a misleading context. Published 4 May 2021

iii Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 Contents © Crown Copyright 2021 Contents Contents Introduction...................................................................................................................... 1 Summary........................................................................................................................... 2 1 Factual information................................................................................................ 5 1.1 History of the flight........................................................................................... 5 1.1.1 Base maintenance............................................................................. 5 1.1.2 The flights before the incident flight................................................... 5 1.1.3 Line maintenance.............................................................................. 7 1.1.4 The incident flight.............................................................................. 8 1.2 Injuries to persons......................................................................................... 10 1.3 Damage to the aircraft................................................................................... 10 1.4 Other damage................................................................................................ 10 1.5 Personnel information.................................................................................... 10 1.5.1 Commander A.................................................................................. 10 1.5.2 Co-pilot A..........................................................................................11 1.5.3 Base Engineer 1...............................................................................11 1.5.4 Line Engineer.................................................................................. 12 1.6 Aircraft information........................................................................................ 12 1.6.1 General............................................................................................ 12 1.6.2 Aircraft description........................................................................... 13 1.6.3 Fuel system..................................................................................... 13 1.6.4 CFM56-5B3/3 engine...................................................................... 15 1.6.5 Engine Control Unit......................................................................... 16 1.6.6 Engine Hydromechanical Units....................................................... 16 1.6.7 Base maintenance........................................................................... 20 1.6.7.1 Preparation for base maintenance................................ 20 1.6.7.2 Preparation for the biocide treatment............................ 20 1.6.7.3 The biocide treatment................................................... 21 1.6.7.4 Completion of the work and departure of G-POWN...... 22 1.6.7.5 Other biocide treatments at the Base AMO................... 22 1.6.7.6 AMM procedures for biocide treatments....................... 23 1.6.7.7 Biocides - Kathon FP1.5............................................... 23 1.6.7.8 Biocides - Biobor® JF................................................... 23 1.6.7.9 Kathon concentration calculation.................................. 24 1.6.7.10 Administering methods - Pre-mix ................................. 24 1.6.7.11 Administering methods – metered injection rig............. 25

iv Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 Contents © Crown Copyright 2021 Contents 1.6.8 Line maintenance............................................................................ 26 1.6.9 Aircraft maintenance data applications............................................ 27 1.6.9.1 Maintenance data applications interface design........... 27 1.6.9.2 Transition between AirN@v and airnavX and

the delegation of access............................................... 30 1.6.9.3 Appearance of the troubleshooting procedure.............. 30 1.6.10 Troubleshooting procedures for the engine stall message.............. 32 1.6.10.1 77-11-00-810-815-A - Stall Above Idle on Engine 1(2).. 32 1.6.10.2 73-00-00-810-866-A - Stall of Engine 1 or 2 in Flight ... 33 1.6.11 Operational procedures................................................................... 34 1.6.11.1 Engine starting.............................................................. 34 1.6.11.2 Engine vibration............................................................ 35 1.6.11.3 Engine stall.................................................................... 36 1.6.11.4 Engine fail..................................................................... 37 1.6.11.5 Fuel contamination – procedures and training.............. 38 1.6.11.6 ECAM............................................................................ 38 1.7 Meteorological information............................................................................ 38 1.8 Aids to navigation.......................................................................................... 38 1.9 Communications............................................................................................ 39 1.10 Airport information......................................................................................... 39 1.11 Recorded information.................................................................................... 39 1.11.1 Radar data....................................................................................... 39 1.11.2 Flight data........................................................................................ 39 1.11.2.1 Typical fuel flow characteristics for engine starts.......... 40 1.11.2.2 Larnaca-Stansted (24 February) - first flight

post biocidal treatment.................................................. 41 1.11.2.3 Stansted-Gatwick (25 February) - second flight

post biocidal treatment.................................................. 41 1.11.2.4 Gatwick-Krakow (25 February) - third flight

post biocidal treatment.................................................. 42 1.11.2.5 Krakow-Gatwick (25 February) - fourth flight

post biocidal treatment.................................................. 43 1.11.2.6 Gatwick-Gatwick (25/26 February) – event flight.......... 45 1.11.3 ECAM – message alerts.................................................................. 53 1.11.3.1 Types of ECAM message alerts.................................... 53 1.11.3.2 Recording of ECAM message alerts............................. 53 1.11.3.3 Stansted-Gatwick (25 February) – ECAM fault alerts... 55 1.11.3.4 Krakow-Gatwick (25 February) – ECAM fault alerts..... 55 1.11.3.5 Gatwick-Gatwick (25/26 February) – event flight –

ECAM fault alerts.......................................................... 56

v Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 Contents © Crown Copyright 2021 Contents 1.12 Aircraft and engine examination.................................................................... 57 1.12.1 Fuel tanks and engine fuel filters..................................................... 57 1.12.2 Engines............................................................................................ 58 1.12.3 Hydro Mechanical Unit examinations.............................................. 60 1.12.3.1 HMU from No 1 engine................................................. 60 1.12.3.2 HMU from No 2 engine................................................. 62 1.12.4 Analysis of deposits found within the HMUs.................................... 63 1.13 Medical and pathological information............................................................ 64 1.14 Fire................................................................................................................ 64 1.15 Crashworthiness............................................................................................ 64 1.16 Tests and research........................................................................................ 64 1.16.1 Fuel samples................................................................................... 64 1.16.2 Part-145 AMO survey...................................................................... 65 1.16.2.1 Method.......................................................................... 65 1.16.2.2 Findings - Fuel biocide dosing task............................... 65 1.16.2.3 Findings - Airbus troubleshooting manual..................... 66 1.16.2.4 Findings - response to the G-POWN Serious Incident... 67 1.16.3 Part-145 AMO visits......................................................................... 67 1.16.3.1 Biocide treatment.......................................................... 67 1.16.3.2 Airbus troubleshooting.................................................. 68 1.17 Organisational and management information................................................ 68 1.17.1 Base AMO....................................................................................... 68 1.17.2 Substitution test performed by the Line AMO.................................. 69 1.17.3 Engineer type training and competency assessment

at the Line AMO............................................................................... 69 1.17.4 Engineer type training at the aircraft manufacturer......................... 70 1.17.5 Help functions within the maintenance data applications................ 71 1.17.6 Regulatory requirements and oversight of engineer type training... 71 1.17.7 Operational Suitability Data............................................................. 73 1.17.8 Critical Maintenance Tasks.............................................................. 73 1.17.9 Regulatory oversight........................................................................ 74 1.18 Additional information.................................................................................... 74 1.18.1 Fuel quantity records and maximum possible Kathon

concentration................................................................................... 74 1.18.2 Other incidents caused by suspected Kathon overdoses................ 75 1.18.3 Previous incident relating to incorrect use of maintenance data..... 76 1.18.4 Additional information from Crews A and B..................................... 77 1.18.5 Additional information from cabin crew............................................ 77 1.18.6 Additional information about operational procedures...................... 78 1.18.7 Additional information from the operator......................................... 78

vi Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 Contents © Crown Copyright 2021 Contents 2 Analysis................................................................................................................. 81 2.1 Effect of the biocide overdose on the aircraft................................................ 81 2.2 Operational review of the flights ................................................................... 83 2.2.1 Engine starting in Stansted (Crew A)............................................... 83 2.2.2 Engine starting in Krakow (Crew B)................................................. 83 2.2.3 En route Krakow to Gatwick (Crew B). .......................................... 84 2.2.4 Ground phase at Gatwick (crews A and B)...................................... 85 2.2.5 Engine starting in Gatwick (Crew A)................................................ 86 2.2.6 Incident flight (Crew A).................................................................... 86 2.2.7 Decision-making.............................................................................. 86 2.2.8 CRM and training............................................................................. 87 2.2.9 Operations summary....................................................................... 87 2.3 The biocide treatment.................................................................................... 88 2.3.1 Individual factors.............................................................................. 88 2.3.2 Task factors..................................................................................... 88 2.3.3 Organisational factors...................................................................... 89 2.3.4 Example good practice in relation to biocide use............................ 90 2.3.5 Action by regulators......................................................................... 91 2.4 Line maintenance troubleshooting................................................................. 92 2.4.1 Interaction between the line engineer and the AirN@v interface..... 93 2.4.2 Method for using the TSM, and associated training........................ 93 2.4.3 Opportunity to realise the incorrect procedure had been

selected........................................................................................... 95 2.4.4 Comparison of AirN@v and airnavX and the transition

between the two systems................................................................ 95 3 Conclusion............................................................................................................ 97 3.1 Findings......................................................................................................... 97 3.1.1 Operation of the aircraft................................................................... 97 3.1.2 The biocide overdose...................................................................... 98 3.1.3. Troubleshooting at Gatwick Airport.................................................. 99 3.1.4 Training in the use of maintenance documentation....................... 100 3.1.5 Online applications to access maintenance documentation.......... 101 3.2 Causal factors.............................................................................................. 101 3.3 Contributory factors..................................................................................... 102

vii Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 Contents © Crown Copyright 2021 Contents 4 Safety Recommendations and Action.............................................................. 103 4.1 Safety Recommendations........................................................................... 103 4.2 Safety Actions.............................................................................................. 104 4.2.1 Action by regulators....................................................................... 104 4.2.2 Action by IATA................................................................................ 104 4.2.3 Action by the manufacturers of the biocide and the engines......... 105 4.2.4 Action by the aircraft manufacturer................................................ 105 4.2.5 Action by the Base AMO that performed the biocide treatment..... 106 4.2.6 Action by the Line AMO................................................................. 107 4.2.7 Action by the operator................................................................... 107 Appendices Appendix A Comparison of biocide tasks....................................................................109 Appendix B Copy of AMO questionnaire..................................................................... 111 Appendix C Post-Flight Reports.................................................................................. 118 Stansted-Gatwick (25 February).............................................................. 118 Gatwick-Krakow (25 February)................................................................ 118 Krakow-Gatwick (25 February)................................................................ 119 Gatwick-Gatwick (25/26 February) – event flight..................................... 119

viii Glossary of Abbreviations Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 GLOSSARY OF ABBREVIATIONS USED IN THIS REPORT Glossary of abbreviations AAIB Air Accidents Investigation Branch ACARS Aircraft Communications Addressing and Reporting System agl Above ground level AMC Acceptable Means of Compliance AMM Aircraft Maintenance Manual AMO Approved Maintenance Organisation APU Auxiliary power unit ARFFS Airport rescue and fire-fighting service ATA Air Transport Association BEA Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile CAA Civil Aviation Authority CAMO Continued Airworthiness Management Organisation CRM Crew Resource Management CVR Cockpit Voice Recorder EASA European Union Aviation Safety Agency ECAM Electronic Centralised Aircraft Monitoring ECU Engine Control Unit EGT Exhaust Gas Temperature FAA Federal Aviation Administration FADEC Full Authority Digital Engine Control FCOM Flight Crew Operating Manual FCTM Flight Crew Training Manual FDR Flight Data Recorder FMV Flow Metering Valve HMU Hydro Mechanical Units HP High Pressure HPC High Pressure Compressor HPSOV High Pressure Shut-off Valve HPT High Pressure Turbine HPTCC High Pressure Turbine Case Control LP Low Pressure LPTCC Low Pressure Turbine Case Control MSDS Material Safety Data Sheet MOR Mandatory Occurrence Report N1 Fan, or Low Pressure Compressor speed N2 Intermediate or High Pressure Compressor speed OSD Operational Suitability Data PC Control Pressure PCR Control Pressure Return PFR Post-flight report PM Pilot Monitoring ppm Parts per million PSOV Pressurising and Shut-off Valve QRH Quick Reference Handbook Rwy Runway SB Service Bulletin SCCM Senior cabin crew member STC Supplemental Type Certificate TBV Transient bleed valve TC Type Certificate TLB Technical Logbook TNA Training Needs Analysis TSM Troubleshooting Manual VBV Variable Bleed Valve VSV Variable Stator Vane

1 Introduction and Summary Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Introduction and Summary Air Accidents Investigation Branch Aircraft Accident Report No: 1/2021 (AAIB-26436) Registered Owner and Operator: Hagondale Ltd, Titan Airways Aircraft Type: Airbus A321-211 Nationality: UK Registration: G-POWN Place of Serious incident: London Gatwick Airport, UK Date and Time: 26 February 2020 at 0009 hrs All times in this report are UTC Introduction The Air Accidents Investigation Branch (AAIB) became aware of this serious incident on 26 February 2020. In exercise of his powers, the Chief Inspector of Air Accidents ordered an investigation to be carried out in accordance with the provisions of Regulation (EU) 996/2010 (as amended) and the UK Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 2018. The sole objective of the investigation of an accident or serious incident under these regulations is the prevention of accidents and serious incidents. It shall not be the purpose of such an investigation to apportion blame or liability. In accordance with established international arrangements, the following safety investigation authorities appointed Accredited Representatives to the investigation: the Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (BEA) in France, representing the State of Design and Manufacture of the aircraft; the National Transportation Safety Board (NTSB) in the USA alongside the BEA, representing the State of Design and Manufacture of the engines; and the Aircraft Accident and Incident Investigation Board of Cyprus. The aircraft operator, various maintenance organisations, the European Union Aviation Safety Agency (EASA), and the UK Civil Aviation Authority (CAA) also assisted with the investigation.

2 Introduction and Summary Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Introduction and Summary Summary As part of scheduled maintenance overseas, G-POWN underwent a biocide shock treatment on its fuel system, using Kathon biocide, to treat microbial contamination. The aircraft returned to the UK on 24 February 2020, once the maintenance was complete. In the 24 hours preceding this serious incident, there were abnormalities with the operation of both engines across four flights. On the flight before the fourth (event) flight, the crew reported momentary indications of a No 2 (right) engine stall. After the aircraft landed, this was investigated using an inappropriate procedure obtained from an aircraft troubleshooting manual not applicable to G-POWN, but no fault was found. The aircraft took off from London Gatwick Airport Runway 26L at 0009 hrs on 26 February 2020 but, at around 500 ft agl, the No 1 (left) engine began to surge. The commander declared a MAYDAY and turned right downwind for an immediate return to the airport but, shortly afterwards, the crew received indications that the No 2 engine had stalled. The crew established that the engines were more stable at low thrust settings and the thrust available at those settings was sufficient to maintain a safe flightpath. They continued the approach and the aircraft landed at 0020 hrs. The investigation identified the following causal factors:

G-POWN’s fuel tanks were treated with approximately 38 times the recommended concentration of Kathon.

The excessive Kathon level in the aircraft’s fuel system caused contamination of the engine Hydro Mechanical Units (HMU) resulting in a loss of correct HMU regulation of the aircraft’s engines.

A troubleshooting procedure was used for the engine No 2 stall that applied to LEAP-1A32 engines, but G-POWN was fitted with CFM56‑5B3/3 engines. The procedure for CFM56-5B3/3 engines required additional steps that would have precluded G-POWN’s departure on the incident flight. The investigation identified the following contributory factors:

The Aircraft Maintenance Manual (AMM) procedure did not provide enough information to enable maintenance engineers to reliably calculate the quantity of Kathon required, and the specific gravity value of Kathon was not readily available.

3 Introduction and Summary Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Introduction and Summary

There were no independent checking procedures in place at the base maintenance Approved Maintenance Organisation (Base AMO) to prevent, or reduce the likelihood of, calculating and administering an incorrect quantity of biocide.

There were organisational factors at the Base AMO that contributed to the incorrect Kathon quantity calculations. In particular, the workload was high for the available facilities and personnel, and there was no internal technical support function for engineers to consult when they were uncertain.

The manufacturer’s recommended method of searching the troubleshooting manual was not used to find the applicable procedure relating to the engine No 2 stall. Following this serious incident, Safety Action was taken by regulators, the International Air Transport Association, the manufacturers of the aircraft, engines and biocide, the AMOs involved, and the operator. The specific action taken is detailed in Section 4.2 of this report. Redundancy in safety critical systems is one of the principles supporting the safety of commercial air transport but fuel contamination undermines that redundancy because it can affect all engines simultaneously. It is essential that maintenance systems are resilient to errors that can lead to fuel system contamination. Therefore, five Safety Recommendations have been made in this report to promote the classification of biocide treatment of aircraft fuel systems as a critical maintenance task, which would ensure that an error-capturing method is included as part of the task.

Intentionally left blank

5 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1 Factual information 1.1 History of the flight The aircraft had recently undergone base maintenance overseas, including a biocide shock treatment1 on its fuel system2, after which it had returned to the UK. Its next flights were in the 24 hours preceding this serious incident, during which it suffered engine abnormalities across four flights and with two sets of flight crew. The serious incident occurred on the final flight. 1.1.1 Base maintenance G-POWN was scheduled to enter base maintenance at an EASA Part  145  Approved Maintenance Organisation (Base AMO). The operator defined the work package, which consisted of a variety of Aircraft Maintenance Manual (AMM) tasks and modifications. As part of the preparation for this work, the operator tested G-POWN’s fuel tanks for microbial contamination and found moderate contamination. In response to the positive test result, the operator added a biocide shock treatment task to the work package. Maintenance work on G-POWN started on 23 January 2020. Base Engineer 13 was assigned to accomplish the biocide shock treatment. The task stated that the aircraft fuel tanks should be treated with Kathon FP1.5 biocide (Kathon) at a concentration of 100 parts per million (ppm) by volume with Jet A1 fuel. On 20 February 2020, Base Engineer 1 treated G-POWN with Kathon-dosed fuel that had a bulk concentration of 3,814 ppm (by volume), which was approximately 38 times the recommended concentration.

The maintenance work package was completed and G-POWN departed to London Stansted Airport (Stansted) on 24 February 2020.  1.1.2 The flights before the incident flight The flight crew who experienced the serious incident (Crew A) operated the first of the four flights, positioning4 G-POWN from Stansted to London Gatwick Airport (Gatwick). At around 0520 hrs, they started the No 25 engine normally but while starting the No 1 engine the Electronic Centralised Aircraft 1 An AMM procedure to treat microbial contamination in fuel. See 1.6.7, AMM procedures for biocide treatments. 2 See 1.6.3, Fuel System. 3 During this report, engineers will be identified by the type of maintenance they carried out, Base or Line, and by a number where necessary. 4 Positioning flight – A non-revenue flight to position an aircraft to another airport. 5 The No 1 and No 2 engines are on the left and right respectively (looking forwards). The No 2 engine is usually started first.

6 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Monitoring (ECAM) system6 displayed the message eng 1 hp fuel valve7. Commander A followed the associated ECAM action to re-select the engine No 1 master switch8 to off – thus stopping the start cycle9 – and the ECAM message extinguished. Commander A reported that an engineer from within the company, who was assisting with the engine starts via an external headset, advised them to attempt another start on engine No 1, which was successful. There were no further engine abnormalities during that flight. At Gatwick, Crew A briefed the on-coming flight crew (Crew B) on the engine No 1 starting fault they had experienced. They rested at a hotel while Crew B operated G-POWN on a return charter trip to Krakow International Airport (Krakow), Poland. Crew A were scheduled to re-position the aircraft back to Stansted that night, along with five members of cabin crew. The engines functioned normally on the outbound flight to Krakow. At around 2000 hrs engine No 2 started successfully for the return flight, but engine No 1 was subject to three start cycles. Recorded data suggested that start cycles one, and possibly two, generated the ECAM alert eng 1 hp fuel valve – each time resulting in Crew B aborting the start. The third start cycle generated an eng 1 start fault… eng 1 stall10,11 ECAM alert, which resulted in a new start in progress message12. The automatic restart was successful, with no further ECAM alerts. Both of Crew B subsequently stated that the only things they could recall were the high pressure (HP) fuel valve ECAM alerts, and that engine No 1 started during the third cycle. After departing Krakow, Commander B notified the operator of that alert via the Aircraft Communications Addressing and Reporting System (ACARS)13 at 2032 hrs. While level at FL140 during descent towards Gatwick, with around 66% N1 14 on each engine, Crew B felt slight vibration in the airframe. It disappeared when engine thrust was reduced for further descent and returned when thrust was increased. Co-pilot B reported it seemed worst between 58 and 64% N1. 6 ECAM – Monitors and displays systems information, including faults and corrective actions to be taken by the pilots. 7 Failure modes with associated procedures are generally accompanied by a master caution or warning aural alert. 8 Also known as ‘engine master lever’ – when selected on, the Full Authority Digital Engine Control (FADEC) initiates the relevant engine start sequence. When selected off, the FADEC shuts down that engine or aborts its start sequence. 9 One automatic start cycle (initiated by selecting the engine master switch on) can include up to three start attempts by the FADEC, depending on the nature of the fault. 10 The engine start fault ECAM message is displayed along with one of its six triggering conditions underneath – in this case, eng 1 stall. 11 Engine stall – disruption of airflow in a turbine engine. 12 Displayed when the FADEC attempts a re-start. 13 ACARS – a digital datalink system for text messaging between aircraft and ground stations. 14 N1 – the engine’s fan speed, shown on a gauge in the cockpit.

7 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Crew B reported the engine parameters appeared normal, including N1 and N2 vibration readings15 of around 0.4 units. On two occasions when the airframe vibration was present, the ECAM system displayed the message eng 2 stall momentarily16,17. Co-pilot B reported the messages were so transient that they were uncertain which engine had been specified. Crew B attempted to maintain the N1 below 50% and perform a continuous descent approach18. They briefed that if the ECAM alert re-occurred, they would reduce thrust on the affected engine, declare a MAYDAY, and continue to Gatwick. Commander B reported that the airframe vibration returned after the landing gear was extended on the approach. No further ECAM alerts were received. The aircraft landed at 2215 hrs and taxied to stand. A number of cabin crew heard a ‘pumping’ noise during landing, which they reported to Crew B after arrival. 1.1.3 Line maintenance At around 2230 hrs, after shutting down the engines, Commander B telephoned the operator’s Technical Control department to report the No 2 ‘Engine Stall’ ECAM message, and subsequently recorded it in the aircraft’s Technical Logbook (TLB). A line engineer was instructed to attend the aircraft by a Technical Control engineer to troubleshoot the No 2 engine stall. The line engineer used AirN@v19 to search the troubleshooting manual  (TSM) and printed the procedure he thought was appropriate. However, this procedure applied to LEAP-1A32 engines whereas G-POWN was fitted with CFM56‑5B3/3 engines. When Crew A returned to the aircraft, Commander A liaised with Crew B, the line engineer, and the Technical Control engineer regarding the engine abnormalities. The line engineer completed the troubleshooting procedure and Commander A observed him as being “meticulous” in doing so. With no fault having been found, the line engineer signed off the engine stall defect and the Certificate of Release to Service in G-POWN’s TLB. Commander A had further discussion with the Technical Control engineer and agreed that he would accelerate the engines to 50% N1 20 for longer than usual before taking off to check the engine control indications. 15 Indicated as numerical units on the ECAM engine system display page - an advisory is generated when N1 ≥ 6.0 units and N2 ≥ 4.3 units. 16 The first of these occurred at 2158 hrs. The CVR recorded data began at 2140 hrs. 17 Crew B reported the messages were displayed for less than a second each time. 18 Continuous descent approach – an arrival technique using minimum thrust and avoiding level flight, normally for reducing fuel burn and noise. 19 A maintenance data application. See section 1.6.9. 20 A normal procedure used to check engine control indications before applying takeoff thrust.

8 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.1.4 The incident flight At 2349 hrs, as the aircraft was pushed back from stand, Crew A started engine No 2 normally but engine No 1 produced an eng 1 start fault… eng 1 ignition fault ECAM alert, which was read aloud by Co-pilot A, who was pilot monitoring (PM). This was followed by new start in progress and a subsequent instruction to re-select the engine No 1 master switch to off, which extinguished the ECAM messages. Commander A, who was pilot flying, attempted a second start cycle which generated the ECAM alert eng 1 fail. The associated ECAM procedure included re-selecting engine No 1’s master switch to off, then stated if no damage: eng 1 relight. consider. Commander A described the ECAM messages to Technical Control over the telephone, who advised trying again. He reported deciding then that if cycle three was unsuccessful, he would return to stand and re-consider departing. He asked the pushback crew to remain connected to the aircraft. The third start cycle generated a temporary eng 1 fail ECAM message. However, it extinguished automatically, and Commander A reported that the engine control indications seemed normal. Recorded data showed that soon afterwards both engines’ parameters were consistent with one another. Commander A telephoned Technical Control again who advised that the No 1 engine’s starting abnormalities probably resulted from an ignition fault, which should be resolved once the engine was running. Commander A released the pushback crew. Crew A accelerated the engines once at the runway holding point; checked the status of the cabin with the senior cabin crew member (SCCM); and then accelerated the engines again for around 15 seconds on the runway. The related indications looked normal. They commenced the takeoff from Runway 26L (Rwy 26L) at 0009 hrs (the flight is shown in Figure 1). Crew A reported that at around 500 ft agl the No 1 engine began “banging and surging”. Commander A recalled that the engine’s control indications were fluctuating, and the aircraft was “yawing… and fishtailing… all over the place”. There was no accompanying ECAM alert. Data recorded on the flight data recorder subsequently showed that the No 1 engine N1 reduced below 40% for a period of approximately 25 seconds despite the thrust levers remaining in the FLEX/MCT21 detent. 21 The FLEX/MCT detent is a gate into which the thrust levers were moved for takeoff.

9 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Figure 1 Radar track of G-POWN with timing of significant events highlighted A number of cabin crew saw flames coming from the No 1 engine’s tailpipe and attempted to contact Crew A using the interphone. Commander A transmitted a MAYDAY call, requesting an immediate return to Rwy 26L and issued an emergency call22 to the cabin crew. He disengaged the autopilot and turned right, downwind. He moved the No 1 engine’s thrust lever to idle. At one stage after doing so, he recalled seeing the No 2 engine’s control indications begin to fluctuate. The aircraft levelled at around 3,600 ft agl. Just after commencing descent, the ECAM message eng 2 stall was displayed three times in quick succession. This prompted Commander A to move the No 1 engine’s thrust lever forward out of idle. He commented that both engines appeared more stable when the thrust was reduced while descending, so he aimed to maintain each engine’s N1 at around 49%. Co-pilot A prepared the aircraft’s flight management guidance system for a return to Rwy 26L, and Commander A positioned the aircraft on a 9 nm final approach. He flew slightly above the glidepath to minimise engine thrust, and so he could glide the aircraft to the runway if the engine problems worsened. The aircraft landed at 0020 hrs, with reverse thrust appearing to function normally. 22 A standard procedure to alert the cabin crew that an emergency evacuation may be required.

10 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information After stopping, Crew A noted the engine parameters seemed normal; however, the airport rescue and firefighting service (ARFFS) attending the aircraft heard unusual engine noises. Therefore, Crew A shut down both engines on the adjacent taxiway. 1.2 Injuries to persons Injuries Crew Passengers Others Fatal 0 0 0 Serious 0 0 0 Minor/None 7 0 0 Table 1 Injuries to persons 1.3 Damage to the aircraft Damage was found on sixteen Stage 3 HP compressor blades and one Stage 7 HP compressor blade on engine No 2. There was no visible damage on engine No 1. 1.4 Other damage None. 1.5 Personnel information 1.5.1 Commander A Age: 28 years Licence: Airline Transport Pilot’s Licence Licence expiry date: Valid for life Ratings: A320 Operator Proficiency Check: 10 December 2019 Licence Proficiency Check: 10 December 2019 Line check: 15 July 2019 Medical certificate: 14 February 2020 Flying experience: 5,059 hours total;

4,855 hours on type Previous rest period: 16 hours 17 minutes Emergency and safety equipment: 10 December 2019 Crew Resource Management training: 11 October 2019

11 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.5.2 Co-pilot A Age: 38 years Licence: Airline Transport Pilot’s Licence Licence expiry date: 30 November 2020 Ratings: A320 Operator Proficiency Check: 8 November 2019 Licence Proficiency Check: 8 November 2019 Line check: 14 May 2019 Medical certificate: 22 December 2020 Flying experience: 1,245 hours total;

1,083 hours on type Previous rest period: 16 hours 17 minutes Emergency and safety equipment: 10 January 2020 Crew Resource Management training: 10 January 2020 1.5.3 Base Engineer 1 Age: 52 years Location: Overseas Base AMO Licence: EASA Part-66 Categories B1, B2 and C Aircraft Maintenance Licence, for piston and turbine aeroplanes and helicopters, with no relevant limitations Licence expiry date: 4 April 2023 Summary of type ratings: Airbus A320 family, with CFM56 and IAE V2500 engines; various other Airbus and Boeing types; and Bombardier DHC-8-400 Engineering experience: 24 years (B1 licence gained in 2005); with current employer since October 2019 Recent duty pattern: Alternating between five weekdays on morning shift and five weekdays on afternoon shift with weekends off Base Engineer 1’s first language was not English. He communicated effectively in conversation with the AAIB, though he spoke predominantly in the present tense even when describing events in the past. He reported having no difficulty working with procedures written in English.

12 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.5.4 Line Engineer Age: 47 years Location: London Gatwick Airport, line maintenance organisation Licence: EASA Part-66 Aeroplanes Turbine Categories A and B1, Aircraft Maintenance Licence with no limitations Licence expiry date: 10 October 2022 Summary of type ratings: Airbus A320 family, with CFM56, CFM LEAP 1A and IAE V2500 engines; Airbus A330 and A380; various Boeing types; and McDonnell Douglas DC10 Engineering experience: 30 years (B1 licence gained in 2002); with current employer since 2008 Recent duty pattern: Blocks of four 12-hour shifts consisting of two 12-hour day shifts then two 12-hour night shifts with four days off between blocks. The incident occurred on the engineer’s second night shift and last shift within a block The investigation collected a sleep and work history for the line engineer which did not indicate any sleep or task related risk factors for fatigue. 1.6 Aircraft information 1.6.1 General Manufacturer: Airbus Type: A321-211 Power plants: 2 CFM56-5B3/3 turbofan engines Build serial number: 3830 Year of manufacture: 2009 Total airframe hours: 28,586.05 hours Total landings: 13,404 landings Certificate of Registration No: G-POWN/R1 Registered Owner: Hagondale Ltd, trading as Titan Airways Date of issue: 30 March 2016

13 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Issuing Authority: United Kingdom CAA Certificate of Airworthiness: EASA Certificate of Airworthiness, issued 30 March 2016 Airworthiness Review Certificate: EASA ARC expiry date 14 February 2021 1.6.2 Aircraft description The Airbus A321 is a short to medium range, narrow body passenger aircraft which can carry up to 236 passengers. The aircraft structure is predominantly made from aluminium alloys with a turbofan engine underslung each wing. The A321 can be equipped with either CFM International CFM56 or IAE V2500 engines, whereas the A321neo is equipped with CFM International LEAP-1A or Pratt & Whitney PW1100 engines. It is the largest member of Airbus’s A320 family. The operator had a mixed fleet including several A321s with CFM56 engines and an A320 with IAE V2500 engines. The operator had also ordered some A321neo aircraft with CFM LEAP-1A engines. Although these aircraft had not yet been delivered, the maintenance data was available for planning. 1.6.3 Fuel system Fuel is stored in three separate fuel tanks within the aircraft structure, comprising of one tank in each wing and a centre tank in the fuselage between the wings (Figure 2). On G-POWN there was a refuel coupling in the right wing, used in normal operation, and each wing was fitted with an overwing aperture, allowing direct access to the fuel tanks for gravity refuelling. The aircraft can hold 24,050 litres of fuel and the breakdown of quantities are shown in Table 2. Left Wing Tank Centre Tank Right Wing Tank Fuel volume (litres) 7,925 8,200 7,925 Fuel weight (kg – SG=0.785) 6,221 6,437 6,221 Unusable fuel (litres) 19 23 19 Unpumpable fuel (litres) 53 67 53 Table 2 Fuel tank quantities

14 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information

Figure 2 Airbus A321 fuel system diagram In each wing fuel tank are two electrically powered main fuel pumps which pump fuel from the wing tanks to the engines. They are situated at the wing root end with one pump inlet at the front of the wing and the other at the rear (Figure 3). In the centre fuel tank are two jet pumps which are used to transfer fuel to the wing tanks and will continue to do so until all the fuel is transferred. The main fuel pumps can also be used to transfer fuel between the tanks utilising the refuel line and a cross-feed valve. The fuel pump inlets are positioned to optimise the amount of the fuel that can be used in flight. The unusable fuel is the amount remaining once the tank is drained in the in-flight attitude. The unpumpable quantity is the amount of fuel remaining in the on-ground attitude. In each fuel tank there are water drains to facilitate removal of any water within the tank during periodic maintenance. The drains are located as close as possible to the lowest points. The amount of accumulated water is dependent on the water content in fuel that is uplifted and the environment through which the aircraft flies. Microbes can enter the fuel tank carried in air or fuel and grow in the interface boundary between the fuel and water. If this growth continues unchecked, it can form a sludge which will ultimately block the fuel filters and restrict fuel flow to the engines. Effective water management is critical to minimise microbial contamination along with effective monitoring and use of biocides.

15 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Figure 3 Airbus A321 fuel system. View on left wing root looking outboard (courtesy Airbus) 1.6.4 CFM56-5B3/3 engine The CFM56-5B3/3 is a high-bypass two-shaft turbofan engine. The low‑pressure  (LP) shaft consists of a single-stage fan and a four-stage LP compressor, driven by a four-stage turbine. The HP shaft consists of a nine‑stage HP compressor, driven by a single-stage turbine. The data pertaining to the engines fitted to G-POWN are listed in Table 3. Position No 1 (left) No 2 (right) Type CFM56-5B3/3 Serial number 699165 699274 Date of manufacture 19 Nov 2008 29 Jan 2009 Total flight time (hours) 28,979.28 27,804.41 Flight time since last overhaul (hours) 306.19 27,804.41 Total flight cycles 14,185 13,142 Flight cycles since last overhaul 129 13,142 Table 3 Engine data

16 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.6.5 Engine Control Unit Each engine is equipped with an Engine Control Unit (ECU), which contains two identical computers, designated Channel A and Channel B. The ECU performs engine control calculations electronically and monitors the engine’s condition. 1.6.6 Engine Hydromechanical Units Each engine is equipped with an HMU, one function of which is to transform electrical signals sent from the ECU into fuel hydraulic pressure to move actuators used to control the engine (Figure 4). Figure 4 Schematic diagram of the HMU (courtesy CFMI) Fuel is supplied to the HMU from the engine HP fuel pump, and the Flow Metering Valve (FMV) within the HMU regulates the flow of pressurised fuel to the fuel spray nozzles in the combustion chamber (Figure 5). The fuel metering system controls the flow of fuel to the engine fuel nozzles through the FMV servo and torque motor, according to commands from the ECU. The ECU commands the FMV to rotate to modify the metered fuel flow. An FMV resolver provides an electrical signal proportional to the FMV position to the ECU, to achieve closed-loop control. The FMV position is not recorded. A pressurising and shut-off valve (PSOV) is located between the FMV and the fuel nozzles. During engine start, the PSOV establishes a minimum fuel

17 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information pressure to ensure proper operation of the HMU. The PSOV is composed of a piston, a pre-loaded spring and two separate position switches, each indicating if the PSOV is open or closed. The open or closed state of the PSOV, as determined by the switches, is recorded on the aircraft’s flight data recorder at a rate of once per second. Figure 5 Engine fuel distribution system (courtesy CFMI) The Delta P and bypass valves ensure that the metered fuel flow is proportional to the FMV area, by maintaining a constant pressure drop across the FMV. The Delta P valve spool and Variable Stator Vane (VSV) and Variable Bleed Valve (VBV) flow control valve spools are rotated around their axes by the HMU drive, each via engagement of a drive pin, to reduce hysteresis. A buffer piston is located between the Delta P and bypass valves to provide compensation to prevent speed overshoot and instability which could occur during operation of the N2 overspeed governor. A PC regulator regulates the pressure of fuel used within the HMU control systems to 300 psi above the bypass valve fuel pressure. The PC regulator is comprised of a piston within a ported valve body which moves under the action of fuel pressure against a spring. A separate control return pressure (PCR) regulator functions identically to the PC regulator but its spring is selected to control the pressure of the return fuel to 150 psi above the bypass fuel pressure.

18 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information High pressure fuel is used to provide hydraulic power to the following actuators:

VBV actuator – controls the position of the VBV used to bleed air from the compressor to maintain the compressor pressure within the optimal region when the rotational speed of the compressors (LP and HP shafts) changes and a new equilibrium between spool speeds needs to be achieved.

Transient Bleed Valve (TBV) actuator – controls the position of the transient bleed valve in the HP compressor (HPC) in response to transient pressure changes in the HPC. The TBV is used to prevent HPC stall during engine start and acceleration.

VSV actuator – controls the angle of the stator vanes in the HPC to optimise efficiency and prevent the compressor from stalling during transient engine operations.

HP Turbine Case Control (HPTCC) actuator – controls the position of the HPTCC valve to modulate the flow of HPC bleed air to cool the HP turbine (HPT) shroud support structure, to control the tip clearance between the HPT blades and shroud to improve engine efficiency, and to reduce the load on the compressor during transient engine operations.

Low-Pressure Turbine Case Control (LPTCC) actuator – controls the position of the LPTCC valve to modulate the flow of fan discharge air to cool the low-pressure turbine (LPT), to control the LPT rotor-to-stator clearances. The positions of these actuators are not measured or recorded. The fuel pressure supplied to the VSV and VBV actuators is controlled by a second‑stage flow control valve, which is itself controlled by a first-stage pilot valve which receives a mechanical input from a torque motor (Figure 6). The torque motors are controlled by signals from the ECU. The radial clearance between the VSV and VBV pilot valve and rotating flow control valve is less than 0.0005 in (12.7 mm).

19 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Figure 6 VSV and VBV flow regulator valves, showing the pilot valve and flow control valve design (courtesy CFMI) The fuel pressure supplied to the TBV, HPTCC and LPTCC valve actuators is controlled by single-stage flow control valve which receives a mechanical input from a torque motor controlled by the ECU (Figure 7). The radial clearance between the HPTCC and LPTCC flow control valve and the valve bore is less than 0.00035 in (8.9 mm). Figure 7 TBV, HPTCC and LPTCC flow control valve design (courtesy CFMI)

20 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.6.7 Base maintenance 1.6.7.1 Preparation for base maintenance In preparation for the base maintenance, on 23 November 2019 the operator took fuel samples from the aircraft tanks to be tested for microbial contamination, in accordance with AMM task 12-32-28-281-003-A, Sample Fuel for Microbiological Contamination Analysis. The samples were sent to a laboratory and it was determined that there was moderate contamination23. The AMM task stated that a second test was required no more than 10 days after the first test and, should this show positive, then biocidal treatment should be applied to the fuel tanks within a further 10 days. In response to the positive test result, the operator added AMM task: ‘28-11-00-600-008-A01 Biocide Shock Treatment for Moderate Contamination – With Fuel Mixed with Kathon Biocide’ (pre-mix procedure) to the work package. This was sent to the Base AMO on 8 January 2020 for inclusion in the scheduled base maintenance. No further microbiological testing was performed. G-POWN arrived at the Base AMO on 20 January 2020 and entered the hangar for work to start on 23 January 2020. Work on G-POWN progressed but there was some difficulty with an in-seat power modification. The maintenance was running behind the agreed schedule and there were representatives from the operator present at the Base AMO throughout the work, who attempted to speed up progress. 1.6.7.2 Preparation for the biocide treatment The Base AMO had two aircraft that needed to be treated with Kathon biocide, YL-LCQ and G-POWN. YL-LCQ, an Airbus A321, was due to enter long‑term storage at the Base AMO and required biocide treatment as part of the storage procedure. An EASA Part-66 licensed engineer (Base Engineer 2) was assigned to the preparation of the aircraft. Base Engineer 2 had worked in aircraft engineering for 13 years and was qualified to work on various aircraft types. He studied the biocide treatment procedure in December 2019 in preparation for the treatment of YL-LCQ. He made an initial calculation to determine how much Kathon to order but did not understand the term ‘ppm’. This initial calculation was used as the basis for Kathon orders for YL-LCQ and G-POWN and by the time G-POWN needed to be treated, there was 150 kg of Kathon available in the AMO stores. 23 Moderate contamination is defined as between 1,000 and 10,000 Colony Forming Units (CFU) / ml in water, or between 4,000 and 20,000 CFU / ml in fuel.

21 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information The maintenance manager was a Part-66 C-Licensed engineer24. He was responsible for the planning and allocation of work to individual engineers, document control, liaison with operators’ representatives and answering technical queries from other engineers. Base Engineer 1 was assigned to the maintenance tasks on the No 1 engine and left wing of G-POWN including the aircraft Kathon biocide treatment. The maintenance manager and Base Engineer 1 discussed how to administer the Kathon to the aircraft’s fuel tanks and agreed to add it directly into the tanks through the overwing aperture during refuelling. Base Engineer 1, having referred to the pre-mix AMM procedure for biocide application, thought that using the overwing refuel aperture was an acceptable way to do this procedure. 1.6.7.3 The biocide treatment The AMM task stated that the aircraft fuel tanks should be treated with Kathon FP1.5 biocide (Kathon) at a concentration of 100 ppm by volume, with Jet A1 fuel. Base Engineer 1 had not done a biocide treatment before but he expected it to be an “easy job”. Base Engineer 1 was not familiar with the term ‘ppm’ and attempted to find it in the AMM glossary. The term ‘ppm’ was not defined in the AMM glossary and he could not find another engineer at the Base AMO who knew how to calculate the biocide quantity, so he searched the internet. He found an online calculator and used it to perform the calculation. He could not subsequently recall specifically what website he used or how he performed the calculation. Base Engineer 1 knew that he would be uploading 6,200 kg of fuel into each wing tank. He calculated a quantity of 30 kg of Kathon for each wing tank and made a material requisition for 60 kg of Kathon. Starting on 20 February 2020, Base Engineer 1 treated G-POWN with 30 kg of Kathon in each wing tank. The biocide was administered directly via the overwing aperture at the same time as each wing tank was filled with fuel. On completion, the Kathon-dosed fuel had a bulk concentration of 3,814 ppm by volume, which was approximately 38 times the recommended concentration. The treatment of the wing tanks took 24 hours after which the Kathon-dosed fuel was transferred to the centre fuel tank for a further 24 hours. Base Engineer 1 stated he felt sure the calculation was correct when he administered the biocide treatment. Base Engineer 1 reported that when unsure 24 The category C licence permits certification of scheduled base maintenance by the issue of a single Certificate of Release to Service for the complete aircraft after the completion of all such maintenance. The principle function of the category C certifying staff member is to ensure all required maintenance has been called up and signed off by appropriately qualified staff.

22 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information how to do something, the options were to look in the maintenance manual or ask colleagues. 1.6.7.4 Completion of the work and departure of G-POWN The engine and Auxiliary Power Unit (APU) fuel filters where changed, the task card was stamped as complete and a further task was opened to perform a biological contamination check within 10 days but after at least five flights. The maintenance was completed and G-POWN departed to Stansted on 24 February 2020. 1.6.7.5 Other biocide treatments at the Base AMO The Base AMO had performed one biocide treatment before G-POWN. This was in April 2019 when OE-LOE was treated using one 5 kg container of Kathon. The engineer that did this treatment had a degree in Mechanical Engineering in addition to an EASA Part-66 aircraft maintenance licence. He was not present at the Base AMO when Base Engineer 1 was seeking advice about the task. On 27 January 2020, it was time for the biocide treatment to be performed on YL-LCQ and Base Engineer 2 was assigned to the task. He was still unsure about the term ppm. He looked for information in the AMM abbreviation list and could not find it, so he searched the internet. He found an internet calculator that offered a ppm to percentage conversion. Base Engineer 2 explained that he mistook the number 0.01 for a factor that he could multiply by fuel quantity to get the required Kathon quantity (Figure 8). When asked what ‘by volume’ meant in the biocide procedure, Base Engineer 2 stated it meant that if one of the quantities was in kilos, you must calculate the other quantity in kilos. Figure 8 Extract from internet calculator used by Base Engineer 2 Base Engineer 2 was not confident in the calculation using the internet source and said during interview, “I try ‘till the very last minute to find another thing just to cross-check it.” He looked for further information on the Kathon packaging but did not find anything he felt was useful. He reported that he finally consulted

23 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Base Engineer 1, because he was aware that he had recently treated G-POWN. Base Engineer 1 confirmed he had treated G-POWN with 30 kg in each wing tank and this gave Base Engineer 2 the confidence to proceed. He treated YL‑LCQ with 40 kg in the right tank for 6,300 kg of fuel (4,808 ppm by volume) and 20 kg in the left tank for 3,500 kg of fuel (4,396 ppm by volume). The biocide was applied through the overwing apertures. Following an email from the Base AMO informing their engineers about the G-POWN serious incident, Base Engineer 2 realised that YL-LCQ had also been overdosed with biocide and reported it. YL-LCQ’s engines had not been started since the biocide treatment. 1.6.7.6 AMM procedures for biocide treatments In the operator’s A321 AMM there are 12 procedures for biocidal treatment of the aircraft fuel tanks: four relating to the treatment of moderate contamination, four related to heavy contamination, and four to proactively prevent growth during storage. Each group of four similar procedures has two procedures for each of the industry available biocides: Kathon and Biobor. For each of the biocides, there is a procedure using the biocide mixed with fuel, and a procedure to add the biocide during refuel using a metered injection rig. A comparison of all the procedures was undertaken and a variation in terminology and units was observed. A summary of the findings is shown in Appendix A. 1.6.7.7 Biocides - Kathon FP1.5 Kathon FP1.5 is a patented liquid antimicrobial agent that was specifically designed for microbial contamination of hydrocarbon fuels. It can treat a broad range of hydrocarbon fuels, such as diesel fuels, kerosenes, heating oils and aviation fuels. Kathon has two active ingredients, 5-chloro-2-methyl-4-isothiazolin-3‑one (1%) and 2-methyl- 4-isothiazolin-3-one (0.3%), suspended in dipropylene glycol (90%), water (6%) and magnesium salts (3%). It has a specific gravity25 of 1,040 kg / m3 and is available in 5 or 20 kg polythene containers. No concentration or specific gravity data is included on the container label. 1.6.7.8 Biocides - Biobor® JF Biobor® JF was introduced in 1965 specifically to eliminate microbial growth in aviation fuels. It can be used in jet, turbojet and reciprocating engines and is widely used. It contains two active ingredients, 2,2›-[(1-methylpropane- 1,3-diyl)bis(oxy)]bis[4-methyl-1,3,2‑dioxaborinane] and 2,2›-oxybis[4,4,6- 25 https://www.oilybits.com/downloads/Dow_Kathon_FP_1.5_Biocide_MSDS.pdf [accessed November 2020]. Correction May 2023: Amended sentence

• see Correction for

further details.

24 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information trimethyl-1,3,2-dioxaborinane], which constitute 95%, with 4.5% Petroleum naptha and 0.5% other inert material. Due to petroleum naptha being classed as carcinogenic and mutagenic, Biobor JF has not been registered for use under EU REACH26 regulation. It is available in 8 oz (236 ml), 16 oz (473 ml), 32 oz (946 ml), 1  gallon (3.78 l) and 5.5 gallon (20.8 l) containers. 1.6.7.9 Kathon concentration calculation The AMM task states the Kathon should be mixed with the fuel ‘at a concentration of 100 ppm (by volume).’ To achieve a concentration of 100 ppm by volume, the following calculation should be made: Fuel uplifted: 6,200 kg (per wing tank) With a Specific Gravity of 0.80827 = 7,678 litres 100 ppm = 0.0001 7,678 x 0.0001 = 0.768 litres of Kathon Using a Kathon Specific Gravity of 1.04 = 0.799 kg (per wing tank) Some Airbus A320 Family AMM tasks for biocide treatment of fuel included a sample calculation to help the engineers to obtain the correct concentration (Appendix A) but the task selected for G-POWN did not. At the Base AMO, the specific gravity of the uploaded fuel was available on the fuel receipt. The specific gravity of Kathon was not printed on the container but it was available in the online Material Safety Data Sheet (MSDS). 1.6.7.10 Administering methods - Pre-mix AMM Task 28-11-00-600-008-A01 - Biocidal Shock Treatment for Moderate Contamination - With Fuel Mixed with Kathon, SUBTASK 28-11-00-670-056-A step (4) states to “refuel all the fuel tanks to the maximum capacity, with fuel mixed with Antimicrobial Agent-Fuel System Liquid Additive”. No instructions are given within the AMM task on how the fuel and biocide should be mixed. The MSDS states “The biocide should be added in such a manner so as to allow good mixing and distribution across the fuel”. 26 Registration, Evaluation, Authorisation and Restriction of Chemicals. REACH is a regulation of the European Union, adopted to improve the protection of human health and the environment from the risks that can be posed by chemicals, while enhancing the competitiveness of the EU chemicals industry. 27 DEF STAN 91-091 Issue 11 states an allowable range of Jet A-1 density at 15°C of between 775.0 and 840.0 kg/m3. For the purposes of the calculation used in this report, the mean of these allowable density values, 807.5 kg/m3, has been used. This mean value equates to a Specific Gravity of 0.808.

25 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information An assessment was made subsequently by the aircraft manufacturer which determined that the process used by the Base AMO would not have mixed the Kathon and fuel effectively. Fuel and Kathon must be agitated to mix effectively, but because they were added to the fuel tank at different locations (refuel coupling and overwing refuel aperture) no direct impingement occurred. As there was no other mechanism available to mix the two fluids, the amount of mixing would have been minimal. The assessment assumed a worse case of no mixing and, as shown in Figure 9, the level of 30 kg of Kathon at the lowest point of the tank was simulated (red surface in Figure 9). This level was then compared to the fuel pump inlet positions in the on-ground and takeoff attitude cases.

  Figure 9 View of the left wing fuel tank at the root showing the fuel pump inlet positions in relation to approximately 30 kg of Kathon (shown in red) (images courtesy of Airbus) The assessment showed that while the aircraft is on-ground it is unlikely that the pumps would pick up much Kathon and therefore it is probable that the concentration of Kathon in the centre tank would be low. In the takeoff attitude of 15° nose-up, the aft pump inlet would be submerged into the Kathon-rich layer resulting in a high concentration of Kathon in the engine fuel supply. 1.6.7.11 Administering methods – metered injection rig In the alternative AMM task for moderate contamination, 28-11-00-600-008‑A03

• Biocidal Shock Treatment for Moderate Contamination - Using Kathon Biocide

with a Metered Injection Rig, instructions are given to add the biocide to the aircraft using “metering equipment” although no reference or detail is given. Correction May 2023: Updated Figure 9 - see Correction for further details.

26 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information A metered injection rig is an item of commercially available ground support equipment which enables additives to be added to fluids as they are uplifted into the aircraft storage tanks. They can be used for a variety of additives and fluids including fuel and biocides. The rig has a tank for the additive, an inlet from the fuel bowser and an outlet to the aircraft. A valve controls the amount of additive which is added to the flow of fuel as it comes from the bowser to the aircraft. The valve can be set by the operator to the desired concentration. No metered injection rig equipment was available at the Base AMO. 1.6.8 Line maintenance The engineer on duty at the operator’s Technical Control on the evening of the incident (Technical Control engineer) had over 20 years’ experience working as an engineer and maintenance manager on various aircraft types including Airbus types. The Technical Control engineer reported that Commander B had telephoned to report a “momentary indication of a stall” on engine No 2. The Technical Control engineer passed this information to the line engineer by telephone and asked for troubleshooting on this engine. The Technical Control engineer was aware of the engine No 1 start problem from the earlier flight and described it as “a start fault, nothing more than that… it was nothing to alert me at the time.” The Technical Control engineer did not have access to any more information than was available to the line engineer through the post-flight report (PFR). At the Line AMO, workload on the evening of the incident was light with three other aircraft apart from G-POWN. The line engineer saw the No 1 engine start problems on the PFR, but this was not highlighted by the operator’s Technical Control engineer or by Crew B and there were no entries about it in the aircraft’s TLB, ECAM messages or warnings. He stated he was not aware of the recent base maintenance and history of start failures on the flights following the maintenance. The line engineer demonstrated the process he remembered following to search for the No 2 engine stall troubleshooting procedure. He attempted first to use airnavX 28 but the operator’s maintenance data was not available on this application, so he used AirN@v instead. He chose to select all the operator’s aircraft in the effectivity filter box. His understanding was that the operator only had aircraft with CFM56 and V2500 engines and he did not see the LEAP 1A engine at the bottom of the list. He stated: “With my PFR, I’ve 28 A maintenance data application. See Section 1.6.9.

27 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information got an ATA29 Chapter 77 with a stall warning problem, so I know it’s a 77.” He browsed Chapter 77 using the chapter list and found one titled ‘Stall Above Idle on Engine 1(2)’ which he printed to use at the aircraft. The procedure selected was 77‑11‑00-810-815-A, Stall Above Idle on Engine 1(2) which applied to LEAP‑1A32 engines. However, G-POWN was fitted with CFM56‑5B3/3 engines and the applicable TSM procedure for this engine was 73-00-00-810‑866-A, Stall of engine 1 or 2 in flight. The line engineer completed the troubleshooting procedure he had selected and found no fault. He signed off the engine stall defect and released the aircraft to service. When the line engineer reported that no fault was found, the Technical Control engineer felt that additional assurance was required and agreed with Commander A to do an extra “check of the engines” at the end of the runway. The Technical Control engineer expected that a fault message or indication problems would occur if there was a fault and the pilots would return to stand. 1.6.9 Aircraft maintenance data applications There are various ways that Airbus maintenance data is provided to AMOs and operators. For G-POWN at the Line AMO, the TSM was provided using the manufacturer’s online system AIRBUS World. This system included two different applications: AirN@v and airnavX. AirnavX has been introduced to replace AirN@v using a gradual transition process. The content of the two applications in terms of maintenance data is identical, they only differ in terms of the graphical interface presented to the user. Aircraft maintenance data is customised to an operator’s fleet and, in some cases, to a specific aircraft. It can also include procedures that an operator has developed. Maintenance engineers who perform maintenance tasks for multiple operators filter the data for the relevant operator each time they access the data. When an operator has multiple aircraft, the maintenance data can also be filtered for the specific aircraft registration or fleet serial number30 to ensure that only the relevant data is presented. 1.6.9.1 Maintenance data applications interface design To consider if the design of the maintenance data applications was contributory in this incident, the AAIB performed a task-based heuristic assessment31 to 29 ATA: Air Transport Association. ATA chapters (or System Codes) categorise systems found on aircraft. 30 Also known as ‘effectivity’. 31 Nielsen, J. (1994b). Heuristic evaluation. In Nielsen, J., and Mack, R.L. (Eds.), Usability Inspection Methods, John Wiley & Sons, New York, NY. Also see: https://www.nngroup.com/articles/ten-usability- heuristics/ [accessed October 2020].

28 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information evaluate the usability of AirN@v and airnavX. The AAIB evaluated the task of searching for the troubleshooting procedure appropriate for G-POWN based on the PFR and TLB entry that was made after the Krakow to Gatwick flight. Figure 10 shows the filtering interfaces for AirN@v and airnavX. In AirN@v, the filtering interface is accessed by clicking on the button highlighted in Figure 11. In airnavX, the ‘Context’ interface is presented continuously and occupies a prominent position on the left of the screen. Figure 10 shows how the filtering box appeared in AirN@v on the computer that the line engineer used on the evening of the incident when it was examined during the investigation. The size of the box and the width of the columns are adjustable so that more, or less information is visible. Therefore, this image may not exactly represent what the line engineer saw at the time.

Figure 10 Filtering interface in AirN@v (left) and airnavX (right) (courtesy Airbus) AirN@v and airnavX offer various ways to search the TSM. The method to reach the appropriate task, described by the manufacturer in the TSM introduction, is to use the ‘Start Troubleshooting’ function in AirN@v and the ‘Troubleshooting’ tab in airnavX (Figure 11). These both offer an intelligent search function where the engineer can input any fault codes generated by the aircraft in conjunction with other information such as crew observations. The applications then lead the engineer to the appropriate troubleshooting procedure(s). In airnavX, the application forces the user to filter the data to the individual aircraft level before the ‘Troubleshooting’ function can be used. Another method, possible in both applications, is to browse the table of contents which is organised according to ATA codes (Figure 12). In AirN@v, the TSM table of contents is visible by default after accessing the TSM from the initial catalogue page. In airnavX, two clicks are required to access this view. Figure 12 left shows how the table of contents appeared to the line engineer in AirN@v. Chapter 77 – (CFMI) relates to the CFM56 engines fitted to G-POWN. Chapter 77 – (CFML) relates to the LEAP engine and

29 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Chapter 77 – (IAE) relates to the V2500 engine. Figure 12 right shows the equivalent part of the interface in airnavX.

Figure 11 Intelligent search functions – ‘Start Troubleshooting’ in AirN@v (above) and ‘Troubleshooting’ tab in airnav X (below) (courtesy Airbus)

Figure 12 Table of contents in AirN@v (left) and airnavX (right) showing options for Chapter 77 when data for the operator was not filtered for fleet serial number (courtesy Airbus)

30 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information There is also a standard search function in both applications where a user can enter key words or a specific procedure number. The output from the standard search does not take into account the fault codes or other information that the intelligent search function does. These latter two methods are not recommended or taught by the manufacturer. 1.6.9.2 Transition between AirN@v and airnavX and the delegation of access The Line AMO did not have access to the G-POWN maintenance data in airnavX because it had not been delegated by the operator. The operator reported that they did not intend this and believed that they had delegated access to airnavX to the Line AMO. Figure 13 shows extracts from the operator’s delegation screen as it was at the time of the incident. It shows that the operator had delegated access to RNM32 and SB (Service Bulletin). The text highlighted by the red circle says: ‘The access rights delegated are applicable for the following applications: airnavX’. After the incident, the manufacturer instructed that to provide the Line AMO with access to airnavX they also needed to delegate access to RNMC – Maintenance data set consult. Several engineers at the Line AMO stated that they did not question their lack of access to airnavX because they assumed that it was a manufacturer service that the operator had decided not to purchase. The manufacturer explained that the transition from AirN@v to airnavX was taking place in phases over a period of years and due to be completed in June 2021. The ability to start using airnavX and stop using AirN@v depended on the capability of an operator’s IT systems, security requirements and the level of operator customisation of maintenance data. 1.6.9.3 Appearance of the troubleshooting procedure When a procedure was displayed on the screen within the AirN@v application, the fleet serial number was highlighted in red near the top (Figure 14). The custom at the Line AMO was to print a black and white PDF export of the procedure to use during the maintenance task. When printed, the first page of the procedure appeared as shown in Figure 15. The fleet serial number was grey and there was no identification on any page of the engine type the procedure applied to. 32 This represents the maintenance data set including all the documents of the Maintenance & Engineering domain (such as AMM, TSM and Illustrated Parts Catalogue) to download for consultation with AirN@v.

31 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Figure 13 Operator Airbus maintenance data delegation screen at the time of the incident. Codes and names that would identify the organisations have been redacted (courtesy Airbus)

32 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information

Figure 14 Appearance of procedure 77-11-00-810-815-A Stall Above Idle on Engine 1(2) within the AirN@v application (courtesy Airbus)

Figure 15 Scan of the procedure used by the Line AMO (courtesy Airbus) 1.6.10 Troubleshooting procedures for the engine stall message 1.6.10.1 77-11-00-810-815-A - Stall Above Idle on Engine 1(2) The troubleshooting task is sub-divided into two sections depending on whether additional observations were noted. The TLB entry 53289, made after the

33 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Krakow to Gatwick flight, only referenced the brief ECAM message and the PFR. Some vibration was noted but this was linked to N1 speed and landing gear extension. This would have led the line engineer to follow the abbreviated troubleshooting which consisted of: ‘Perform the following abbreviated troubleshooting: a) Check for concurrent fault in the PFR, EEC LAST LEG REPORT, SMR Report, Class 3 report. b) Inspect the tailpipe for indications of metal, damage or defects. c) Inspect the engine inlet, fan blades, fan abradable material, booster Inlet Guide Vane (IGV) for indications of damage, abnormalities or signs of bird strike. d) Turn the fan rotor (N1) by hand to ensure that it turns freely.’ The line engineer noted in the TLB response that no abnormalities were found during the general visual inspection (GVI) and there were no reports of further faults in any of the other reports. This leads to the following conclusion of the TSM task: ‘If no damage or abnormalities are found, an engine borescope inspection is NOT required, and the engine can be considered serviceable.’ The task was subsequently closed and signed for by the line engineer. 1.6.10.2 73-00-00-810-866-A - Stall of Engine 1 or 2 in Flight Using the TSM ‘Start troubleshooting’ interface in either AirN@v or airnavx and inputting ‘Eng 2 Stall’ along with the crew observation in flight, returns the same result of 73-00-00-810-866-A - Stall of Engine 1 or 2 in Flight. AirN@v does not require effectivity to be filtered to airframe level to achieve this result. However, airnavX will not allow the ‘Start Troubleshooting’ to start until the effectivity is filtered to a single aircraft. The procedure for the CFM56-5B3/3 engines fitted to G-POWN requires a GVI of the inlet and exhaust of the engine and a borescope inspection of various booster, compressor and turbine stages in accordance with ‘Do a borescope inspection of the HPT Blades Ref. AMM 72-52-00-290-001 and Stage 1 LPT Blades Ref. AMM 72-54-00-20-005’.

34 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Based upon borescope inspections carried out by the AAIB after the incident flight, these additional borescope inspections would have shown an abnormal covering of the turbine blades with a light white deposit33. Borescope inspection experts were consulted to determine what actions would have been taken when presented with these findings and it was stated that images would have been taken and passed to the engine manufacturer for comment. The engine manufacturer confirmed that if presented with these images they would have recommended the engine be removed for further inspection. No further flights would have been permitted. 1.6.11 Operational procedures 1.6.11.1 Engine starting The operator’s Flight Crew Operating Manual (FCOM)34 described the protection for automatic engine starting. It explained the engines’ Full Authority Digital Engine Control (FADEC) detects a hot start, a hung start, or no light up; identifies the fault in an ECAM message; and runs an abort sequence if the start has aborted on the ground, which may result in additional start attempts. Under starter limitations, the FCOM stated one automatic start cycle includes up to three start attempts, and a 15 minute cooling period is required after four failed cycles. While abnormal and emergency procedures are often presented by the ECAM system when required, some are also published in the FCOM. The FCOM ‘ENG[INE] 1 [or] 2 HP FUEL VALVE’ procedure stated: ‘This alert triggers when HP fuel valve is failed in closed or open position’. If it has failed in the closed position, with the associated engine running below idle, the ECAM system will display the accompanying message hp fuel valve not open, and an instruction to select the engine master switch off. The FCOM procedure for an ‘ENG[INE] 1 [or] 2 START FAULT’ triggered by ‘ENG[INE] 1 [or] 2 IGNITION FAULT’35 stated for an automatic start cycle on the ground ‘If the engine does not start, the FADEC can attempt an additional engine restart. After any start attempt that is not successful, a dry crank36 phase automatically occurs’, and the ECAM message new start in progress will be displayed. When the final dry cranking process has finished, the flight crew are required to select the relevant engine master 33 The high- and low-pressure turbine blades were coated in a thin layer of white material that was observed on the turbine blades’ convex surfaces. See Section 1.12.2. 34 Published by the aircraft manufacturer. 35 Occurs when the engine fails to start within 18 seconds following ignition start being selected by the flight crew 36 Dry cranking – pre-start motoring for up to 60 s, to limit the engine core speed.

35 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information switch to off. Then  ‘Following starter cooldown, the pilot must decide whether to attempt auto or manual start, or to report the no start condition for appropriate maintenance action.’ The FCOM procedure for an ‘ENG[INE] 1 [or] 2 START FAULT’ triggered by an ‘ENG[INE] 1 [or] 2 STALL’, during an automatic start on the ground, stated ‘If the FADEC detects a stall… [it] will reduce the fuel schedule in stages, if necessary, to achieve a normal condition’. The ECAM message new start in progress will be displayed. If a restart is not possible the procedure stated: ‘If normal conditions cannot be achieved, the FADEC shuts off fuel and turn[s] off ignition’. Thereafter the procedure required the relevant engine master switch to be selected off, which ‘confirms automatic start abort’. The procedure notes stated: ‘In case of ENG STALL, consider making XBLEED start if pressure is low’. The associated procedure for a manual start on the ground was subsequently listed. It stated: ‘After the starter cools, and for any subsequent attempt to start the engine, the flight crew must perform a manual start, or must report the “no start condition” to maintenance for appropriate action’. The FCOM stated the ECAM message ‘ENG[INE] 1 [or] 2 IGN[ITION] FAULT’ on its own is presented for ‘crew awareness’ when ignition circuit A or B is failed, thus had no associated procedure actions. 1.6.11.2 Engine vibration The procedure for ‘HIGH ENGINE VIBRATION’ in the operator’s quick reference handbook (QRH)37 explained: ‘The VIB advisory38 on ECAM (N1 ≥ 6 units, N2 ≥ 4.3 units) is mainly a guideline for the flight crew to monitor engine parameters more closely … The ECAM advisory alone does not require engine shut down … High N1 vibration [is] generally accompanied by perceivable airframe vibrations’ while ‘High N2 vibration can occur without …’. The procedure instructed flight crew to check engine parameters, especially the exhaust gas temperature (EGT), and cross-check them with the other engine. Then, if icing is not a suspected cause, reduce thrust on the affected engine below the advisory threshold. If vibrations continue after landing, shut down the engine when possible. 37 Published by the aircraft manufacturer. 38 Advisory – affected parameter pulses green, and does not generate a separate ECAM message or aural alert.

36 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information The operator’s Flight Crew Techniques Manual (FCTM)39 stated: ‘High engine vibration alone does not require an engine in-flight shutdown. If the engine needs to be shutdown, other symptoms and certainly an ECAM alert will warn the flight crew, and request them to shut down the engine.’ 1.6.11.3 Engine stall The QRH procedure for an engine stall is shown in Figure 16. Figure 16 QRH procedure for an engine stall The manufacturer’s ‘ECAM System Logic Data’ page indicated that the ECAM ‘eng 1 [or] 2 stall’ alert in flight would instruct the crew to select the affected thrust lever to idle, check the engine parameters, then apply the QRH procedure.

The FCOM’s guidance on engine stalls included: ‘Indications of an engine stall include varying degrees of abnormal engine noises/bangs, accompanied by flame from the engine exhaust (and possibly from the engine inlet in severe cases), fluctuating performance parameters, vibration, sluggish or no thrust lever response, high EGT and/or rapid EGT rise when thrust lever is advanced’. 39 Published by the aircraft manufacturer.

37 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information The FCTM described other symptoms: ‘The engine may give the impression to pump’ and ‘Acrid smell in the cockpit’. It stated: ‘An engine stall can be due to any of the following reasons:

An engine degradation (e.g. compressor blade rupture, or high wear)

Ingestion of foreign objects (e.g. birds), or ice

A malfunction of the bleed system

fuel scheduling, or stall protection devices) …The FADEC is not able to detect an engine stall in all cases. Therefore, if the flight crew detects one or a combination of the engine stall symptoms, the flight crew should suspect an engine stall, and apply the QRH Engine Stall procedure. The Engine Stall procedure is not a memory item40. Therefore, if a stall occurs during the cruise phase, the flight crew shall take the time to assess the situation before applying the procedure, as most of the times FADEC will self-recover from the stall before any flight crew action. …The flight crew should not shut down the engine if the stall can be avoided... The flight crew must report any engine stall for maintenance action.’ 1.6.11.4 Engine fail The FCOM ‘ENG 1 [or] 2 FAIL’ procedure explained that the alert triggers when the engine core speed is below idle, with the engine master switch set to on and the engine fire push button not pushed. It stated: ‘The flight crew can suspect engine damage if [they] observe two or more of the following symptoms:

Rapid increase of EGT above the red line

Important mismatch of the rotor speeds, or absence of rotation

Significant increase of aircraft vibrations and/or buffeting

Hydraulic systems loss

Repeated or uncontrollable engine stalls …if no damage, a new start sequence may be initiated.’ 40 The FCTM defined abnormal or emergency procedures as being either ‘memory items’ or ‘read and do’.

38 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.6.11.5 Fuel contamination – procedures and training The only reference to fuel contamination in the pilots’ operating manuals was contained in the FCOM ‘ENG[INE] 1 [or] 2 FUEL FILTER CLOG’ procedure. It stated: ‘Dual fuel filter clog is likely an indication of fuel contamination’. Commander A recalled undertaking some simulator training with his previous operator whereby fuel contamination produced symptoms like high engine EGT and loss of fuel-related indications. It affected both engines in the same way and caused the APU to shut down. 1.6.11.6 ECAM The operator’s head of pilot training summarised the sequence of applying the procedures, relevant to this incident, as follows: ‘…before pushback… Action the ECAM… [After] the aircraft moves under its own power… Stop and apply park brake… Action the ECAM… Refer to QRH’.41 The FCTM guidance on ‘ECAM Tasksharing’ explained that the first pilot who notices the alert resets the master warning/caution. Then for each ECAM procedure, PM announces the ‘Title of the failure’, confirms it by checking the overhead panel and associated systems display. The QRH section relating to task sharing for abnormal and emergency procedures stated that PM is responsible for ‘Monitoring and reading aloud the ECAM and checklists’. The FCTM advised ‘If an ECAM warning42 disappears while a procedure is being applied, the warning can be considered no longer applicable. Application of the procedure can be stopped’. 1.7 Meteorological information Gatwick airport’s weather report on 26 February 2020 at 0020 hrs was: wind from 260° at 13 kt, CAVOK43, temperature 2°C, dewpoint 0°C and QNH 998 hPa. 1.8 Aids to navigation Not applicable. 41 This was based upon the sequence quoted in the FCTM: Memory items or Operations Engineering Bulletin (OEB) immediate actions; ECAM; QRH. 42 The terms ECAM alert or ECAM warning may be used interchangeably. 43 Visibility ≥ 10 km; No cloud < 5,000 ft, and no cumulonimbus (CB) or towering cumulus (TCU) cloud at any level; no significant weather in the vicinity of the aerodrome.

39 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.9 Communications The aircraft remained tuned to the ‘Gatwick Tower’ VHF frequency for the flight, during which a MAYDAY call was transmitted. After landing, Crew A communicated with the ARFFS on 121.6 MHz. Cockpit Voice Recorder (CVR) data showed those communications were effective. 1.10 Airport information Gatwick has built-up areas in its vicinity. It has two parallel runways but uses single runway operations, preferring the longer one, Rwy 08R/26L. Rwy 26L’s takeoff run available44 is declared as 3,041 m and its landing distance available45 is declared as 2,830 m. It has high intensity runway lighting at the threshold, runway edge, centreline and stop end. Gatwick has an ARFFS category of ‘A10’ which is the highest ICAO standard, allowing operation of the largest aircraft in commercial service. 1.11 Recorded information G-POWN was equipped with an L3 FA2100 solid state CVR, which recorded two hours of audio, and an L3 FA2100 solid state flight data recorder (FDR), which recorded over 177 hours of data. The audio recordings included communications between the pilots, radio transmissions, and audio from the cockpit area microphone. Reports from the aircraft’s ECAM that displayed engine and aircraft system information to the crew were analysed. Radar and CCTV from Gatwick Airport were also reviewed to corroborate with other evidence and data sources. 1.11.1 Radar data An overview of the event flight is shown in Figure 1 in Section 1.1. The figure highlights key points in the incident flight relative to the flightpath based on the recorded secondary surveillance radar Mode S radar returns. The data showed that the aircraft took off from Gatwick at 0009 hrs and landed 11 minutes later at 0020 hrs. 1.11.2 Flight data Data from the FDR for the event flight and the previous flights post biocidal treatment are presented in the following subparagraphs. Note that the data for the engines is recorded once per second so transient engine behaviour is 44 The runway length declared available and suitable for the ground run of an aeroplane taking off. 45 The runway length declared available and suitable for the ground run of an aircraft when landing.

40 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information not always captured and visible in the data. Fuel data such as fuel flow and the open or closed position of the fuel HP shut-off valves were recorded but not the position of the fuel metering valves inside the HMU.46 Also, master warnings and cautions recorded by the FDR are sampled once per second and show if the warning and caution indicator lights are on. The associated chimes (a single chime for a caution and three chimes for a warning) are recorded on the CVR; therefore, the exact timing of these can be determined. It also means that while the indicator lights remain on (ie not cancelled by the crew) any additional alerts are also detected. However, as the CVR recording was two hours with only the event flight recorded in its entirety47, any multiple master warning and caution alerts for the earlier flights would go undetected. 1.11.2.1 Typical fuel flow characteristics for engine starts Prior to the biocidal treatment, the FDR recording included the data for 48 flights. The fuel flow during engine starts for each of these flights was examined. Of these 48 flights, 37 had similar fuel flow characteristics to those in Figure 17(a). The other 11 had at least one engine exhibiting an oscillation in the fuel flow immediately after engine start, like the one for Engine 1 in Figure 17(b), which would support that there are likely different fuel regulation methods or control feedback loops that can be active. The fuel flow characteristics shown in Figures 17(a) & 17(b) are therefore considered to represent those for normal engine starts.

(a)

(b) Figure 17 Fuel flow for typical engine start pre-biocidal treatment 46 Fuel metering valves positions are recorded on more recent variants of the A320 family including the new engine option (NEO) versions. 47 The beginning of CVR recording was during the Krakow-Gatwick flight as the aircraft descended through FL300.

41 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.11.2.2 Larnaca-Stansted (24 February) - first flight post biocidal treatment Two days prior to the first flight post biocidal treatment, ground runs were conducted twice on the engines at Larnaca. No faults were reported and there was no evidence in the engine data to suggest any problems with the engines. For the subsequent flight to Stansted, the fuel flow for each engine start looked normal. There was no evidence of engine problems in the data and no engine faults reported for the flight. 1.11.2.3 Stansted-Gatwick (25 February) - second flight post biocidal treatment Figure 18 plots data for the engine starts for the flight from Stansted to Gatwick. The key points are labelled [A] through [E], the details of which are described in the following bullet points:

Engine No 2 started successfully [A]; however, the fuel flow exhibited unusual behaviour (highlighted) following the start, compared to the normal behaviour.

Once engine No 2 had started, an engine No 1 start [B] was initiated by the crew (first cycle).

As the engine No 1 HP shut-off valve (HPSOV) started to open [C] a master caution was issued corresponding to an eng 1 hp fuel valve > hp fuel valve not open48 message alert on the ECAM (§1.11.3.3); however, the engine N1, N2 and EGT continued to increase and the engine ignited.

After about two and a half minutes of ignition as the engine reached idle speed, a second master caution was issued corresponding to an eng 1 hp fuel valve > hp fuel pos swt fault49 message alert on the ECAM (§1.11.3.3) [D], after which the engine No 1 master switch was moved to the off position. Throughout the time engine No 1 had been running, the fuel flow exhibited unusual behaviour (highlighted).

Engine No 1 start initiated by the crew E several minutes later. The engine started successfully; however, the fuel flow exhibited unusual behaviour (highlighted) following the start compared to the normal behaviour. 48 The aircraft manufacturer determined the nature of the alert from its analysis of the data. The alert indicates that the HP fuel valve failed to open within a defined period. 49 The aircraft manufacturer determined the nature of the alert from its analysis of the data. The alert is generated if the FADEC detects a switch position that is not consistent with the engine state: failed open with the engine below idle (ie N2 < about 60%) or failed closed with the engine at or above idle.

42 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information

Figure 18 Stansted to Gatwick flight engine starts 1.11.2.4 Gatwick-Krakow (25 February) - third flight post biocidal treatment Fuel flow for each engine starts looked normal. There was no evidence of engine problems in the data. No engine faults were reported for the flight.

43 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.11.2.5 Krakow-Gatwick (25 February) - fourth flight post biocidal treatment Figure 19 plots data for the engine starts for the flight from Krakow to Gatwick (the penultimate flight before the event flight). The key points are labelled [A] through [L] the details of which are described in the following bullet points:

Engine No 2 started successfully [A]; however, the fuel flow exhibited unusual behaviour (highlighted) following the start compared to the normal behaviour.

Once engine No 2 had started, an engine No 1 start [B] was initiated by the crew (first cycle).

The N1 and N2 for engine No 1 started to increase; however, the fuel HPSOV for engine No 1 remained in closed position [C].

About 28 seconds after the engine start was initiated (and 11 seconds after the HPSOV was commanded to open), a master caution was triggered corresponding to an eng 1 hp fuel valve > hp fuel valve not open message alert on the ECAM (§1.11.3.4) [D] after which the crew moved the engine master switch to off.

After about 40 seconds, by which time the N1 and N2 had dropped to zero, the engine No 1 master switch was moved to on for another start attempt (second cycle) [E].

After about 30 seconds, as the N1 and N2 for engine No 1 increased, the fuel HPSOV for engine No 1 opened for about 15 seconds [F] and fuel started to flow. However, the opening of the valve was coincident with the first of two master cautions the first of which corresponded to an eng 1 hp fuel valve > hp fuel valve not open message alert on the ECAM (the reason for the second is unknown – §1.11.3.4) [G] after which the crew moved the engine master switch to off.

50 seconds later, by which time the N1 and N2 had again dropped to zero, the engine No 1 master switch was moved to on for another start attempt (third cycle) [H].

As N1 and N2 increased, the fuel HPSOV opened and fuel began to flow. As the EGT passed about 280°C, the N1 at about 10% and N2 at about 46% stopped increasing [I]; however, the EGT continued to rise.

44 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information   Figure 19 Krakow to Gatwick flight engine starts

As the EGT of engine No 1 reached about 490°C (70°C above the EGT of engine No 2) the fuel flow dropped to zero for approximately four seconds [J], during which a master caution was issued corresponding to an eng 1 start fault

eng 1 stall50 message alert on the ECAM (§1.11.3.4) [K].

This message would have been followed by new start in progress as the FADEC automatically initiated another start attempt. 50 This was confirmed by the aircraft manufacturer who also confirmed that this ECAM message would have disappeared once the N2 went above 50% following a successful automatic start attempt. Correction May 2023: Corrected Figure 19

• see Correction for

further details.

45 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information

The EGT immediately began to fall and as it dropped below about 450°C the fuel started to flow again. The N1 and N2 then started to increase [L] and the engine started successfully. The fuel flow, however, exhibited unusual behaviour (highlighted) following the start compared to the normal behaviour.

The engine No 1 N2 reached 50% 22 seconds after the master caution was issued, at which point the eng 1 stall message alert on the ECAM disappeared. For the flight, there was no evidence of engine surges in the recorded engine data. Throughout, the N1, N2 and EGT for both engines were matched; however, N1 and N2 vibrations for the No 1 engine were more varied when compared to the No 2 engine. During the descent, transitioning from FL130 (time 21:58:25) and passing through FL122 (time 21:59:59), master cautions were issued corresponding to an eng 2 stall message alert on the ECAM. The No 2 engine N1 vibration ranged from 0.0 to 0.2, and the N2 vibration ranged from 0.1 to 0.4 during the 1 min 34 seconds between and during the two No 2 engine stall alerts. 1.11.2.6 Gatwick-Gatwick (25/26 February) – event flight The event flight has been broken down into four data plots covering: (1) engine starts; (2) the climb during which engine No 1 surged; (3) downwind during which engine No 2 stalled; and (4) engine shutdown. Key points in data are highlighted on the plots. Engine starts Figure 20 plots data for the engine starts for the event flight. The key points are labelled [A] through [F] the details of which are described in the following bullet points:

Engine No 2 start initiated [A] with the engine reaching an N2 > 50% at about time 23:50:00. The engine started successfully; however, the fuel flow exhibited unusual behaviour (highlighted) following the start compared to the normal behaviour.

Engine No 1 start initiated by the crew B during which the fuel HPSOV exhibited erratic behaviour (highlighted). The HPSOV started to open (three seconds after being commanded to with the N1 and N2 rising) but closed after a second before reopening five seconds later.

46 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information The fuel started to flow as soon as the valve initially opened and continued to flow until seven seconds after it opened for the second time. A master caution was issued coincident with the fuel flow stopping. The reason for the master caution is unknown; however, the crew referred to some kind of “IGNITION … FAULT” (the speech on the CVR recording is unclear).

There was a second master caution 17 seconds after the first which the crew identified as an eng  1 start fault

  eng  1  ignition fault ECAM message alert. The crew

were also aware that a new start was in progress. The HPSOV, however, continued to behave erratically before closing.

A third master caution (reason unknown) was issued 26 seconds after the second as the engine was attempting to start while the HPSOV remained closed (§1.11.3.5). The engine failed to start, and the crew moved the master switch to off.

Engine No 1 start initiated by the crew C during which the N2 reached just over 50% for at least three seconds before dropping below 50%. This generated an eng 1 fail message alert on the ECAM that prompted the crew to move the master switch to off.

Engine No 1 start initiated by the crew D during which the N2 reached just over 50% for at least three seconds before dropping below 50%. This again generated an eng 1 fail message alert on the ECAM, and just as the crew were about to move the master switch to off, the N2 began to increase. The engine started successfully; however, the fuel flow exhibited unusual behaviour (highlighted) following the start compared to the normal behaviour.

Engine run ups were made to about 40% N1 [E] at the runway holding point and to about 50% N1 [F] just before takeoff.

47 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information

Figure 20 Incident flight engine starts Event flight Figures 21 and 22 are an overview of the engine No 1 surge and the engine No  2 stall events during the incident flight. Again, note that the engine parameters are recorded once per second so transient behaviour of the engines is not captured. Also, during the downwind leg of the flight (Figure 22), of the 11 master cautions that were issued and heard on the CVR, only those relating to ECAM fault alerts are highlighted. The other master cautions relate to ECAM alerts providing operational information to the crew which are not recorded (§1.11.3). There were no master cautions issued during the climb phase (Figure 21) when the No 1 engine surged. This was because not all

48 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information stall types (of which surging is one) can be detected by the FADEC. To detect a stall, the FADEC monitors changes of the PS3 static pressure51 within a 45 millisecond period; however, not all stall types have sufficient changes in PS3 for them to be detected. The once-per-second sampling rate of PS3 on the FDR also means only much slower changes in PS3 can be observed, and PS3 is, therefore, not shown in these figures. The main points from Figures 21 and 22 are: Figure 21:

Once the aircraft was airborne, the N1 and N2 for engine No 1 became unsteady in comparison to engine No 2 [G].

At about 350 ft agl, there was an uncommanded drop in the N1 of engine No 1 (and correspondingly N2) over five seconds from about 87% to 35% [H].

At time 00:09:16 as the aircraft climbed through 550 ft agl, a thud sound was recorded on the CVR [I] that corresponded with the flash of flames seen coming out of the engine on the airport’s CCTV. This was followed by another thud sound one second later, and then for a period of 30 seconds a further 100-plus thuds (between two and four per second). Again, these thuds corresponded to flashes seen on the CCTV footage.

The lateral acceleration (sampled four times per second) shows lateral oscillations during this period [J]; however, the sample rate would need be higher to accurately capture the yaw oscillations that the crew reported. A negative shift in the overall lateral acceleration during this period indicates that the aircraft was sideslipping to the right. Right rudder was applied countering the yaw from the thrust asymmetry with the loss of No 1 engine thrust.

With the drop in the engine No 1 thrust there was a corresponding increase in N2 vibration on that engine [K].

At time 00:09:43, the engine No 1 throttle lever was pulled back to 25° [L]. About five seconds later, the engine No 1 N1 (and N2) responded by increasing back toward the commanded position [M]. 51 PS3 is the HP compressor discharge static air pressure – one of several pressures used for engine control.

49 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information

The engine No 1 N2 vibration remained high compared to the engine No 2 N2 vibration [N].

At time 00:10:15, the N1 and N2 for engine No 1 became unsteady again when compared to engine No 2 [O].

At time 00:10:28, there was another uncommanded drop in the N1 (and N2) of No 1 engine [P].

At time 00:10:32, a thud sound was recorded on the CVR [Q].

Six seconds later the crew moved the engine No 1 throttle lever to the idle position [R]. Figure 22:

About 15 seconds later the engine No 1 N1 (and N2) started to increase [S].

At time 00:10:53 there was an increase in the engine No 2 N1 vibration that exceeded 1.0 for about five seconds [T]. During these five seconds autopilot 1 disengaged.

As the engine No 2 N1 vibration started to decrease back below 1.0, the first of three master cautions were issued corresponding to eng 2 stall message alerts on the ECAM [U]. The three alerts all happened within six seconds of each other. Autopilot 2 engaged shortly after the first engine stall alert and disengaged about three seconds after the third engine stall alert.

The engine No 1 throttle lever was returned to the position of the No 2 engine throttle lever [V]. The engine No 1 responded within a couple of seconds to match the N1 and N2 of engine No 2. No further engine events were recorded for the airborne portion of the flight.

50 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information   Figure 21 Overview of flight data from the incident (plot 1 of 2) Correction May 2023: Corrected Figure 21

• see Correction for further

details.

51 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information

Figure 22 Overview of incident flight data (plot 2 of 2) Correction May 2023: Updated title for Figure 22

• see Correction for further

details.

52 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Engine shut down Figure 23 plots data for the engines post the event flight just prior to engine shutdown.

Figure 23 Post incident flight engine behaviour

53 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information The key points are:

Once on the ground thrust reverse was selected [W]. Within one minute the aircraft was brought to a stop and the throttle levers were moved to the idle position.

Unusual behaviour of the fuel flow for engine No 1 was recorded compared to engine No 2 (highlighted).

For a steady throttle lever angle, erratic behaviour in engine No 1 was recorded compared to the steady response of engine No 2 X.

The engines were run up to about 28% N1 coincident with the aircraft taxiing onto the taxiway [Y].

At time 00:39:45 both engines were shut down [Z]. 1.11.3 ECAM – message alerts Several ECAM message alerts have been referred to in previous paragraphs which are summarised here together with how they were relayed back to the operator. 1.11.3.1 Types of ECAM message alerts The ECAM message alerts generally fall into two categories: system failures that may require a maintenance action post-flight, and operational alerts to the crew not associated with a system failure. The alerts either require a crew action or monitoring of a system or are just for information and require no action from the crew. Aural (chime) and visual (master caution or master warning lights) cues are used to capture the crews’ attention depending on the severity of the alert. 1.11.3.2 Recording of ECAM message alerts Maintenance alerts are automatically sent to the operator via the ACARS digital datalink when they happen. They also form part of the PFR that can be printed from the cockpit printer after a flight (Figure 24) and which is also sent to the operator via the ACARS to the real-time AIRMAN52 maintenance tool. There is, however, a three-minute delay following first engine start (ie N2 > 50%) before 52 AIRMAN (AIRcraft Maintenance ANalysis) is a maintenance and troubleshooting software tool, developed by Airbus that (1) provides real-time receipt and management of on-board maintenance system messages through the ACARS which allows mechanics to prepare a maintenance action while the aircraft is still in-flight, (2) provides easy access to all information connected with an aircraft maintenance message and offers troubleshooting advice for mechanics on-line, and (3) for each aircraft in the fleet, it provides a daily task list of preventive maintenance measures.

54 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information the PFR opens and ACARS messages can be sent, to avoid transient failures of some systems because of invalid or out of range parameters being reported during the first engine start with the second engine off line. The consequence of this is that genuine start faults during the first engine start and any for the second engine start within these three minutes are alerted to the crew on the ECAM but are not recorded by the PFR or automatically messaged to the operator. The PFR for each of the four flights on the day of the serious incident flight are shown in Appendix C. These are the versions of the PFR stored in AIRMAN and include, for completeness, the PFR for the flight from Gatwick to Krakow during which no engine issues were reported. Operational alerts are neither recorded by the PFR nor messaged to the operator.

Figure 24 Copy of the PFR printout for the event flight with engine No 1 start faults and engine No 2 stall occurrences highlighted

55 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.11.3.3 Stansted-Gatwick (25 February) – ECAM fault alerts Time & Flight Phase ECAM Fault Message Notes 05:24:45 Eng No 1 start (cycle 1) eng 1 hp fuel valve > hp fuel valve not open PFR not open - no recording of fault message. The aircraft manufacturer, however, confirmed that the valve had failed to open within the required period following the FADEC command to open. 05:26:28 Eng No 1 start (cycle 1) eng 1 hp fuel valve > hp fuel pos swt fault The eng 1 hp fuel valve message was automatically sent via ACARS at 0527 hrs to operator and recorded in the PFR*. The aircraft manufacturer, however, confirmed that as the engine was at idle the cause for the alert was a fault with the valve position switch.

• PFR sent to operator via ACARS at 0602 hrs.

Table 4 ECAM messages for the Stansted-Gatwick flight 1.11.3.4 Krakow-Gatwick (25 February) – ECAM fault alerts Time & Flight Phase ECAM Fault Message Notes 19:53:52 Eng No 1 start (cycle 1) eng 1 hp fuel valve > hp fuel valve not open PFR not open - no recording of fault message. The aircraft manufacturer, however, confirmed that the valve had failed to open within the required period following the FADEC command to open for the first two alerts. Crew sent ACARS message at 2032 hrs stating an eng 1 hp fuel valve fault. The reason for the third alert is unknown. 19:55:09 Eng No 1 start (cycle 2) eng 1 hp fuel valve > hp fuel valve not open 19:55:14 Eng No 1 start (cycle 2) (reason unknown)

56 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Time & Flight Phase ECAM Fault Message Notes 19:57:17 Eng No 1 start (cycle 3) eng 1 start fault > eng 1 stall The fault alert was automatically sent via ACARS at 1957 hrs to operator and recorded in the PFR, but not the triggering condition. For the A321 with CFM56 engines there are six possible triggers of which only three automatically initiate a new start. These are: an EGT over-limit, an ignition fault or an engine stall. The EGT was about 400°C which was below the 725°C over-limit threshold but hot enough for the engine to be ignited; therefore, the only trigger left was a stall condition. This logic was confirmed by the aircraft manufacturer. 21:58:25 FL130 eng 2 stall Automatically sent via ACARS at 2158 hrs to operator and recorded in the PFR. 21:59:59 FL122 eng 2 stall Recorded in the PFR.*

• PFR sent to operator via ACARS at 2218 hrs.

Table 5 ECAM messages for the Krakow-Gatwick flight 1.11.3.5 Gatwick-Gatwick (25/26 February) – event flight – ECAM fault alerts Time & Flight Phase ECAM Fault Message Notes 23:50:54 Eng No 1 start (cycle 1) (reason unknown) PFR not open - no recording of fault alert; however, the crew referred to an ignition fault on the CVR recording. 23:51:11 Eng No 1 start (cycle 1) eng 1 start fault > eng 1 ignition fault PFR not open - no recording of fault message; however, the crew verbalised the ECAM fault alert and triggering condition (captured by the CVR).

57 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Time & Flight Phase ECAM Fault Message Notes 23:51:37 Eng No 1 start (cycle 1) (reason unknown) PFR not open - no recording of fault message. 23:54:23 Eng No 1 start (cycle 2) eng 1 fail Automatically sent via ACARS at 2354 hrs to operator and recorded in the PFR. 23:57:33 Eng No 1 start (cycle 3) eng 1 fail Recorded in the PFR. 00:11:09 3,500 ft agl (a/c  downwind) eng 2 stall Automatically sent via ACARS at 0011 hrs to operator and recorded in the PFR. 00:11:13 3,500 ft agl (a/c  downwind) eng 2 stall Recorded in the PFR. 00:11:15 3,500 ft agl (a/c  downwind) eng 2 stall Recorded in the PFR.*

• PFR sent to operator via ACARS at 0022 hrs.

Table 6 ECAM messages for the Gatwick-Gatwick event flight 1.12 Aircraft and engine examination 1.12.1 Fuel tanks and engine fuel filters The left and right wing fuel tanks were drained following the incident, and the tank internal surfaces and components were visually examined. No abnormalities were identified. The engines’ fuel filter and filter bowl fuel samples were analysed. The fuel filters were clean in appearance and generally free from debris, however chemical analysis of the small amount of filter debris present indicated unusually high levels of magnesium, a constituent element present in Kathon.

58 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.12.2 Engines The aircraft’s engines were subjected to an initial borescope visual examination on the day after the incident flight. Both engines exhibited similar findings. There was no significant damage evident to the fan, LP compressor or HP compressor, and any minor defects that were observed were stated to be within AMM damage limits. However, the combustion chambers, and the HPT and LPT blades were coated in a thin layer of white material that was observed on the turbine blades’ convex surfaces (Figure 25). The HPT nozzle guide vanes were also coated in the white material. As the engines were not disassembled, it was not possible to obtain a sample of the white material. Figure 25 White material deposits on No 2 engine combustion chamber and HPT blades observed during initial borescope inspection (No 1 engine similar) A second borescope inspection was carried out four months after the incident, following a delay due to Covid-19 restrictions. The purpose of this second inspection was to document the visual condition of the engines prior to their repair and return to service. The inspection of the No 1 engine did not reveal any damage beyond AMM limits. Inspection of the No 2 engine identified that 16 blades of the Stage 3 HP compressor had smooth impact depressions on the blade root radius outside AMM damage limits. In addition, one Stage 7 HP compressor blade also had an impact mark at the blade root radius outside AMM damage limits. It is not known whether this damage was present before the incident flight. The white deposits observed during the initial borescope inspections were not evident in the second borescope inspections. The areas where the white deposits had been observed were now covered in a thin layer of crystalline material of a dendritic appearance (Figure 26). It was concluded that the white deposits observed during the initial borescope inspection had, over the

59 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information intervening four-month period, been dissolved into water that had condensed onto the internal engine surfaces. The white material had then reformed into the dendritic crystalline pattern as the water subsequently evaporated. Figure 26 Dendritic crystalline surface deposit on engine No 2 LPT Both borescope inspections revealed that significant deposits of a brown material were present on all the combustion chamber swirl cups, adjacent to the fuel spray nozzles, in both engines (Figures 27 and 28). Figure 27 Brown material deposits in No 2 engine combustion chamber swirl cups observed during initial borescope inspection The igniter plugs from each engine were removed and visually examined. No abnormalities were noted and there was no significant difference in appearance between those from the No 1 and No 2 engines.

60 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Figure 28 Brown/black material deposits in No 1 engine combustion chamber swirl cups observed during second borescope inspection 1.12.3 Hydro Mechanical Unit examinations The HMUs were removed from their respective engines and were sent to the manufacturer for disassembly and examination. The units were protected for shipment by capping open apertures, but no inhibiting treatments were applied, to avoid contamination of any trace evidence. 1.12.3.1 HMU from No 1 engine The examination of the HMU from the No 1 engine took place six weeks after the incident flight. Approximately 100 ml of clear fuel was drained from the unit and was subsequently laboratory tested. The HMU drive did not readily rotate when checked, and no torque check was attempted in order to prevent further damage to the unit. The unit was disassembled, and a few areas of a viscous, gelatinous substance were observed within (Figure 29).

61 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Figure 29 Gelatinous residue (circled in red) on VBV pilot valve (courtesy Woodward) The colour of this residue varied between clear to very light yellow. Increased friction above what was considered normal was noted between almost all moving parts. The Delta P valve was seized and its drive pin was observed to be fractured (Figure 30). Figure 30 Fractured Delta P valve drive pin (courtesy Woodward) The buffer piston was stuck in position and was freed by soaking in deionised water. The pressurising valve piston and shut-off piston were stuck in position and pried free. The control pressure (PC) and control pressure return (PCR)

62 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information regulators were also stuck in position and were removed after soaking in an aqueous cleaning solution. The VSV and VBV pistons were pried loose to remove them from the unit. Once these stuck components were removed, the remaining parts within the HMU moved freely. 1.12.3.2 HMU from No 2 engine The examination of the HMU from No 2 engine took place four weeks after the incident flight. Approximately 50 ml of clear fuel was drained from the unit and was subsequently laboratory tested. Torque required to rotate the HMU drive was 5.5 in lb. This was considerably in excess of the normal torque level, which is less than 0.5 in lb. The unit was disassembled and it was noted that areas of viscous, gelatinous deposits were present throughout the unit (Figures 31 and 32 show typical examples). The colour of these deposits varied from clear, through light orange to a dark rust colour. The drier the deposits were, the darker the appearance and the more difficult they were to remove. The residue was water-soluble. Increased friction above what is considered normal was noted between almost all the moving parts within the HMU. The Delta P pilot valve was seized and its drive pin was broken. The buffer piston was stuck in position and was freed by soaking in deionised water. The PC and PCR regulators were also stuck in position and were removed after soaking in an aqueous cleaning solution. The VSV and VBV valve pistons were pried loose to remove them from the unit. Once these stuck components were removed, the remaining parts within the HMU moved freely. Figure 31 VBV pilot valve first-stage deposits under ultraviolet light (courtesy Woodward)

63 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Figure 32 Brown, sticky deposits on low-pressure turbine case control turbine clearance valve (courtesy Woodward) 1.12.4 Analysis of deposits found within the HMUs The sticky brown residue found on the FMV, VBV and VSV valves from both HMUs was analysed. Infra-red analysis showed the presence of a mixture of dipropylene glycol, nitrate salt and water. This chemical signature is consistent with the chemical composition of Kathon biocide. Analysis of the water-soluble compounds on the surface of the FMV, VBV, VSV, and Delta P valve spools showed the presence of high levels of nitrate, magnesium and chloride along with lower levels of sulphate and sodium. The relative ratio of nitrate, magnesium and chloride found on the valves matched the ratios in Kathon biocide. Corrosion was observed on the FMV, VBV and VSV valve sleeves but minimal corrosion was present on the spools. Fuel samples from both HMUs contained higher than typical levels of the Kathon components including the active ingredients 5-chloro-2-methyl-4-isothiazolin- 3-one and 2-methyl-4-isothiazolin-3-one, and the dipropylene glycol solvent. Fuel sampled from the No 1 engine’s HMU contained Kathon at a concentration by volume of approximately 450 ppm, and fuel sampled from the No 2 engine’s HMU contained Kathon at a concentration of approximately 850 ppm by volume.

64 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.13 Medical and pathological information Not applicable. 1.14 Fire No sustained fire occurred during the incident. 1.15 Crashworthiness Not applicable. 1.16 Tests and research 1.16.1 Fuel samples Following the serious incident, fuel samples were taken from the left and right wing fuel tank water drain valves and were subjected to laboratory analysis. When the fuel was tested it was found not to comply with the Jet A-1 specification requirements53 for appearance and water separation characteristics (MSEP54). The fuel samples, once the contents had settled out under gravity, contained a separate brown liquid layer beneath the main fuel layer (Figure 33). Trace element results of the fuel and the bottom brown layer showed similar spectra to a reference Kathon sample, but with a higher water content. The laboratory that conducted the fuel testing commented that: ‘The results indicate contamination with undissolved Kathon. It was noted that the bottom layer that is mostly Kathon plus some unknown products and water, suspected to be causing the darker colour than the reference Kathon sample. This is likely due to the glycol type solvent used in Kathon dissolving polar materials from the fuel and fuel tank surfaces. This may be analogous to observations with another similar glycol additive, FSII (Fuel System Icing Inhibitor), which is used in military jet fuels. It is colourless but forms a brown additive/water layer in tank bottoms.’ 53 DEF STAN 91-091 Issue 11 and AFQRJOS Check List Issue 31. 54 Water Separator Index Modified (MSEP).

65 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Figure 33 Fuel samples drained from left and right wing fuel tanks 1.16.2 Part-145 AMO survey 1.16.2.1 Method A questionnaire (Appendix B) was developed to identify general practices relating to the aircraft biocide dosing task and use of the Airbus TSM across a wide range of AMOs. The questionnaire was sent to UK and French EASA Part-145 Approved Maintenance Organisations and 21 substantive responses were received. The questionnaire was split into three sections:(1) The biocide dosing task, (2) Use of the Airbus TSM and (3) Response taken to the G-POWN event and AAIB Special Bulletin S1/2020. The following is a summary of the responses received. 1.16.2.2 Findings - Fuel biocide dosing task Responses were received from AMOs that performed biocide dosing on a wide range of commercial aircraft and rotorcraft. Not all AMOs who responded to the AAIB questionnaire reported performing biocide treatments. The number of biocide dosings carried out varied widely between AMOs, with the highest average number during the period 2017-19 inclusive being 251 per year across that AMO’s global service network. Two other AMOs reported exceeding an average of 10 dosings per year over the period, whereas over half the responding AMOs performed seven per year or fewer over the period, indicating that the task is generally not a routine or common procedure. It was not possible to normalise the number of biocide treatments against the size of the fleets treated, due to lack of data.

66 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Biocide dosing using a metered injection rig was more common than manual dosing, although two of the five AMOs performing the highest number of dosings used manual dosing. Of the AMOs that reported applying biocide manually, only two responded that they used an external fuel tank or bowser to mix the biocide with fuel, whereas five AMOs stated that they applied biocide directly to aircraft fuel tanks. As the variety of aircraft types treated was broad, it was not determined whether direct application of biocide to aircraft fuel tanks was an approved AMM method in all cases. It was found to be more common for the dosing task to be completed by a Part-66 B1 licensed engineer alone, rather than a mechanic acting under the oversight of a B1 LAE. Some AMOs have technical support for performing the calculation of biocide quantity required, or an independent check, but this was not a universal safeguard. Four AMOs classified the dosing task as a critical maintenance task, in accordance with EASA Part M.A.402(h), but most AMOs did not. Most AMOs did not have specific training for the biocide dosing task and those who responded positively mainly referred to the training instructions for the metered injection rigs. Only one AMO described a stores process that limited the issue of biocide to a maximum amount (of 10 x 0.5 kg bottles). Other safeguards involved checking the biocide quantity to be used with the Chief Engineer or Team Leader. No AMOs reported previous incidents or errors involving incorrect biocide dosing. Two AMOs stated that familiarity with the metered injection rig was essential. One stated that care had to be taken in its use as the required rig setting was at the low end of the operational range, and the other commented on the possibility of mixing up dosing rates between ppm/vol and ppm/weight. Overall, the questionnaire shows that the Base AMO in the G-POWN investigation was typical of other AMOs that perform this task infrequently, in terms of process and procedure. 1.16.2.3 Findings - Airbus troubleshooting manual The questionnaire responses indicated that AirN@v and airnavX were used by an equal number of organisations. Of these two applications, a few organisations used both, but it was more common to use one or the other. Most organisations did not have a company policy or specific training that defined how to search the TSM for the right procedure. The responses indicated that most AMOs relied on engineers to do as taught during type training.

67 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information According to the responses, all of the different methods to access the TSM were used on both AirN@v and airnavX. Only one AMO reported they solely used the application as recommended by the manufacturer. A few reported that they used the recommended method but also used other methods to access information. The remainder did not use the recommended method at all. 1.16.2.4 Findings - response to the G-POWN Serious Incident Almost all the responding AMOs stated that they were aware of the G-POWN event and had read AAIB Special Bulletin S1/2020. Most AMOs, by a ratio of 3:1, intended to take safety action based on S1/2020 and these included improving existing procedures, independent checks on biocide dosages and communicating the safety messages to staff. Almost all of the safety action reported related to biocide dosing. It was noted that while the biocide dosing issue had prompted safety actions, the use of the TSM had prompted almost none. 1.16.3 Part-145 AMO visits The AAIB visited three UK Part-145 AMOs that perform biocide treatments and troubleshooting activity on Airbus aircraft, to collect more detailed information on normal practice in AMOs. 1.16.3.1 Biocide treatment Two of the AMOs visited performed biocide treatments regularly, with the frequency of the task having increased as aircraft were stored during the coronavirus related reduction in flying activity. All three AMOs applied the biocide using a metered injection rig, and the two AMOs that performed the activity regularly had developed error-capturing measures for the task. These included cross-checking of the biocide dosing calculation by other maintenance engineers and the AMOs’ Technical Services department, and by the introduction of bespoke spreadsheet calculators to control the way in which the required biocide concentration is determined. Two of the AMOs had identified that the dosing setting of the metered injection rig was potentially prone to error. They had established a procedure where the dosing rate for an initial quantity of fuel (one AMO used 500 kg, the other 500 ltr) was checked by comparing this fuel quantity to the amount of biocide consumed, prior to completing the biocide dosing task. The AMOs had noted that the metered injection rigs were typically set to deliver a maximum concentration of approximately 400 ppm/vol, which while preventing a gross overdose, still provided the possibility of allowing an excessive biocide concentration if the rig had not been set properly prior to its use.

68 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Use of the metered injection rig was not restricted to particular individuals, and any LAE, once shown how to use the rig by an experienced user, was expected to be able to do so thereafter. 1.16.3.2 Airbus troubleshooting During the visits, the AAIB spoke to a sample of typical LAEs about how they approached troubleshooting for Airbus aircraft. The engineers were asked to describe how they would use the PFR and navigate the TSM using the maintenance data application used at their AMO. Some of the engineers’ descriptions matched the manufacturer’s recommended method of searching and others did not. When told about the manufacturer’s recommended method, some of the engineers expressed surprise and stated they had never been taught this. Most of the engineers reported that they would generally expect to find the appropriate troubleshooting procedure in the chapter with the same ATA number as the fault on the PFR but that this was not always the case. 1.17 Organisational and management information 1.17.1 Base AMO The Base AMO was a relatively new organisation operating from a hangar that had been vacated by the previous operator. One engineer described how the hangar was “like a bare shop” during a visit in August 2019 but by November 2019 there was much more equipment. Several engineers who were interviewed reported that the organisation had a lack of tools in general and were building up their equipment and renting tools where needed. Several engineers commented that they felt that the amount of work that the Base AMO was contracted to do was too high for its capacity in terms of space, tooling and people. One engineer stated that the Base AMO had capacity for a maximum of two aircraft and during the period when they were working on G-POWN there were six or seven aircraft being worked on. The operator observed inadequate document control at the Base AMO during a visit when G-POWN was being worked on and raised a safety report on 21 February 2020 for ‘Unrecorded maintenance during base input’. The AAIB visited the Base AMO and observed the environment and processes there. There was evidence that workload in the planning department was very high and there was not enough space in the planning office to keep work packs well organised. The stores were well controlled with access to records on the issue of all chemicals, but no process was in place to limit the quantity of any chemical that could be issued to an engineer. There was no formal

69 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information engineering technical support role or department within the organisation. Any engineer that required advice asked for it from colleagues or the maintenance manager. 1.17.2 Substitution test performed by the Line AMO As part of the Line AMO’s internal investigation, an investigator gave five other engineers from the organisation the same engine fault scenario that the line engineer faced. Four of the five engineers attempted to use airnavX first and reverted to AirN@v when this was not possible. Three of the five engineers retrieved the correct maintenance task. One of these three used the ‘Start Troubleshooting’ function to search, the other two used the chapter list. Both engineers who did not find the correct procedure browsed Chapter 77 of the TSM. One, who had not filtered the data according to aircraft effectivity, found the task 77-11-00-810-815-A Stall Above Idle on Engine 1 (2) for the CFM  LEAP‑1A engine and appeared to believe this was the correct procedure. 1.17.3 Engineer type training and competency assessment at the Line AMO Most of the line engineer’s recent type training was conducted by the EASA Part‑147 maintenance training organisation associated with the Line AMO. The line engineer’s most recent type rating training was in November 2017 for Airbus A320 Family fitted with the CFM LEAP-1A engine. His most recent competency assessment was in January 2020. Records from both the training and the competency assessment showed no issues or concerns with any aspect of the line engineer’s performance. Troubleshooting formed a high proportion of the Airbus type courses at the Line AMO’s maintenance training organisation. It was assessed in terms of whether the trainees navigated to the correct procedures and understood how to use them. It was not assessed in terms of the specific method the trainees used to search for the procedures. The AirN@v and airnavX applications were both used during engineer type courses, but the syllabi did not specifically include how to search for troubleshooting procedures. The Line AMO’s competency assessment criteria included the ability to find the correct maintenance data and the method by which it was accessed: ‘By reference to the behavioural indicators and guidance below, document objective evidence that the individual found and referred to the correct maintenance data, pertinent to the task and effectivity of the aircraft. The summary should contain the precise maintenance data reference and how this was accessed.’

70 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information The records from the line engineer’s most recent competency assessment on 16 January 2020 confirmed that the engineer could gain access to the Airbus online maintenance data applications but did not document evidence of his method of navigation of them or confirm the maintenance data printed was correct for the task and had the correct effectivity. The station manager that performed this competency assessment was aware of the manufacturer’s recommended method of searching the TSM. 1.17.4 Engineer type training at the aircraft manufacturer The teaching objectives of the manufacturer’s Part-147 approved courses for B1 and B2 certifying technicians explicitly included:

● ‘Selection of A/C effectivity’

● ‘Difference in-between Start Troubleshooting and TSM’

● ‘Start Troubleshooting concept (Tech log and PFR usage)’

● ‘Pattern search (Start Troubleshooting function)’ The training materials included visual references showing the relevant interface features of the AirN@v system and the sequence of actions required to correctly search for a procedure in the TSM (Figure 34). Figure 34 Example of manufacturer’s training material relating to method of using the TSM (Courtesy Airbus)

71 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information 1.17.5 Help functions within the maintenance data applications The AAIB found two relevant items within the help centre of airnavX, ‘Troubleshooting philosophy’ and a video entitled ‘How to troubleshoot.’ The ‘Troubleshooting philosophy’ document explained that the TSM can be accessed through the ‘My library’ tab or the ‘Troubleshooting’ tab (Figure 35). The video provided a worked demonstration of using the search via the ‘Troubleshooting’ tab (ie the manufacturer’s recommended method of doing the task). Figure 35 Screenshot from ‘Troubleshooting philosophy’ document in the Help Centre within airnavX (Courtesy Airbus) There are no specific instructions or training materials for using AirN@v built into the application itself. The help function within AirN@v links to a content library in AIRBUS World and this includes some e-learning resources for AirN@v. 1.17.6 Regulatory requirements and oversight of engineer type training Aircraft engineer training and licensing is governed by ‘COMMISSION REGULATION (EU) No 1321/2014 of 26 November 2014 on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks’. Specifically, Annex III (Part-66) covers aircraft maintenance licences and Annex IV (Part-147) covers maintenance training organisations. Organisations that provide training and examination for Part-66 licensed engineers must meet the requirements of Part-147. The Competent Authority inspects candidate Part-147 maintenance training organisations and issues approvals if the requirements are met. Approved Part-147 maintenance training organisations must be audited at least every two years, including monitoring of at least one training course and one exam. The Competent

72 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information Authority for assessing Part-147 maintenance training organisations based in the UK is the CAA. A requirement of Part-147 is that aircraft type training course content for LAEs is to comply with Part-66. Concerning maintenance documentation it also requires ‘Students shall have access to examples of maintenance documentation and technical information’ (147.A.120). Appendix III to Part-66 defines aircraft type training and examination standards. It states one of the objectives of engineer type training for a B1 aeroplanes turbine licence is to ‘demonstrate the use, interpret and apply appropriate documentation including structural repair manual, troubleshooting manual, etc.’ Appendix III to the Acceptable Means of Compliance (AMC) of Part-66 provides additional detail on competence assessment in relation to the use of aircraft documentation. It states the assessment should include: ‘Aircraft documentation finding and handling (identify the appropriate aircraft documentation, navigate, execute and obey the prescribed maintenance procedures)’. The AMC to point 3.1(d) of Appendix III to Part-66 concerns the use of Training Needs Analysis (TNA)55 and states that the purpose of the analysis is: ‘to adapt and justify the duration of the course for a specific aircraft type.’ It also states: ‘The content and the duration deriving from this TNA may be supported by an analysis from the Type Certificate holder.’ The TNA should identify all the areas where there is a need for training, ‘considering the design philosophy of the aircraft type,’ among other factors. The AMC lists areas that the TNA should address, which includes ‘Use of maintenance publications.’ The AMC states that the TNA should be reviewed or updated based on operational feedback, information about maintenance occurrences and other changes. The CAA stated that Part-147 maintenance training organisations must submit a declaration of what will be taught and to what level and this is assessed by the CAA to check it meets requirements and is comprehensive. The audit process for maintenance training organisations uses a sampling strategy and depends on availability of course(s) at the time of the audit. The audit criteria are based on the requirements of Part-147 and Part-66. These requirements are not detailed at the level of individual aircraft types or the exact content of 55 Training needs analysis is a process where the knowledge and skills required for a job role are identified and compared to the current skill and knowledge of potential trainees or existing staff who will undertake the role. The gap between the required knowledge and skills and the current knowledge and skills defines the content of training. Training needs analysis often considers the frequency of use, importance and difficulty of each knowledge and skill element to determine the proportion of time to allocate and training method for each.

73 Factual Information Aircraft Accident Report: 1/2021 G-POWN AAIB-26436 © Crown Copyright 2021 Section 1 - Factual information training on the use of maintenance data. Audits last approximately three hours and must be unobtrusive to the training process. The CAA explained that these practicalities mean that it would be unlikely to identify whether a training course included the manufacturer’s recommended method of using the Airbus maintenance data applications (AirN@v or airnavX) for troubleshooting or not. 1.17.7 Operational Suitability Data Commission Regulation (EU) No 69/2014 of 27 January 2014 introduced the requirement of Operational Suitability Data (OSD) to Annex I (Part-21) to Regulation (EU) No 748/2012. This requirement is applicable to aircraft Type Certificate (TC) holders (and holders of supplemental type certificates (STC)) where they must produce certain data considered important for the safe operation of the aircraft. The OSD becomes the reference for customised training courses and Minimum Equipment Lists. It consists of five elements: