I

The South African Civil Aviation Authority (CAA) lost its Flight Inspection Unit (FIU) calibration service aircraft in a crash into the Outeniqua mountains, inland of George, on Thursday 23 January 2020.

This accident, sadly, claimed the lives of the three crew aboard the aircraft.

The final report into the accident, compiled by the Aircraft Accident Investigation Bureau of Ethiopia, was ready in November last year.

This report made many findings of irregularities and failure to follow procedure in regard to the organisation, management and operation of the FIU, its staff and CEO. Given that the CEO of the FIU (on the papers of record) is also the head of the CAA, these findings do not reflect well on the designated watchdog of the aviation industry in South Africa.

However, at the same time the report left many questions unanswered regarding the background environment faced by the crew in regard to their schedule and the pressures this may have brought to bear on their state of mind on the day of the accident.

Many other human performance factors usually analysed in an accident were omitted or glossed over. This makes it unlikely that a satisfactory picture will ever emerge. However, enough is known to know what happened on the flight.

The release of the report to the South African public was delayed to Sunday 23 January 2022, the last day of the two year period conventionally allowed among International Civil Aviation Organisation (ICAO) member states for the publication of final reports.

Given the less than salutary contents, the fact that the CAA was undergoing an ICAO compliance audit in the intervening period, between the date of the report and its release might - many in the know in the aviation industry claim - have had more than a small role to play in the delay in its release.

While most of the issues raised in the report did not contribute directly to the accident on the day, they do raise many, many questions in regard to the CAA and highlight a culture of loose tolerances and deviation from best practice which, as anyone serious about aviation will know, is a dangerous slope that, if left unchecked, eventually leads to disaster.

This scrutiny of the aviation regulation, inspection and regulatory lapses as well as the position of the accident investigation unit within the CAA has placed an uncomfortable spotlight on the CAA.

Certainly, it has highlighted a glaring structural conflict in regard to our national aviation investigation division and its lack of independence from administrative and political interference.

It is perhaps to be expected then that the CAA has released a statement calling foul on the report as released. They claim they have documentary evidence to refute many of the findings of fact made against the CAA by their Ethiopian colleagues.

They have called on the Minister of Transport to “re-open” the inquiry and are especially aggrieved in regard to changes they suggested to the draft report not being in the version as released.

Notwithstanding all the political machinations that will inevitably surround the findings in order to protect deployees at the CAA and within the ministry of transport, what happened to the aircraft?

How and why did ZS-CAR crash?

As we examine the findings in the report, and reconstruct the fatal flight, it must be stressed that the goal of aviation accident investigation is not to apportion blame or find fault. The goal is to uncover the facts of the accident. These facts are then used by the worldwide aviation community to mitigate any hitherto unknown risks revealed by the investigation.

It is through this pursuit of knowledge rather than a chase to blame that aviation has and will continue to develop a just safety culture to the benefit of all who fly.

II

The aircraft, crew and their mission

ZS-CAR was a twin-engined Cessna Citation S550 business jet originally purchased by the then Department of Civil Aviation in 1986. It was owned, operated and crewed by the CAA's Flight Inspection Unit (FIU).

Its primary task was the testing, inspection and calibration of airfield navigation and approach guidance systems. These calibrations must, according to the CAA regulations and ICAO guidelines (ICAO annexe 10 available here), be undertaken at regular intervals in order for airports to retain their various operating and category certifications.

Aircraft make use of various electronic navigation aids to guide themselves towards airports, accurately approach the runway and land in conditions where visual references are absent.

Enroute guidance is provided by a network of VHF Omnidirectional Range (VOR) beacons. These transmit signals along each full compass bearing together with a sweeping signal. A VOR instrument in aircraft then decodes these signals to provide directional guidance to the beacon. Several beacons may be followed in turn to reach any given airport.

Once at the airport, two additional signals guide the aircraft to the runway. These are the Localiser (LOC) and the Glide Slope (GS) array used by the Instrument Landing System (ILS).

The LOC and GS systems make use of overlapping radio beams to provide their guidance via displays in the cockpit of suitably equipped aircraft. These overlapping signals need to be carefully aligned with the runway centre line and the required 3 degree approach angle to ensure their accuracy.

To check the ILS system, multiple passes, at right angles to the runway, are made 3000 feet above the ground. These sweeps start and end 35 degrees either side of the runway, typically at 17nm (nautical miles) from the threshold. Thereafter the glide slope is flown to check the angled signal.

The localiser flight legs, however, involve higher than usual bank angles at each end of the pattern in order to reverse the course and accurately re-capture the desired flight path for the next sweep.

The Crew

The Pilot In Command (PIC) of ZS-CAR, Captain Thabiso Tolo, was 49 years old. Captain Tolo started flying for the erstwhile Bophutatswana Air Force in 1989. When that service was absorbed into the South African Air Force in 1994, he continued to serve in the SAAF. He also served at AFB Langebaanweg as an instructor.

He then moved to South African Airways in 2004 where he worked as a first officer. In 2008 he joined the CAA in the compliance division. He later applied for, and was given, the post of Senior Pilot of the FIU. He held an Airline Transport Pilot Licence (ATPL), a Grade 2 instructor's certificate and was instrument rated.

His total flying experience encompassed 5 215.4 flying hours built up over 31 years of flying.

Throughout his time as chief pilot of the FIU, he averaged just more than 10 hours of flying per month. The accident report showed 15.4 hours in the 90 days preceding the accident, which was less than half the monthly average. Part of the reason for this could have been due to him having attended re-currency training in the United States with Textron (the owner of the Cessna brand) during November 2019.

The final report into the accident states that the last recorded pilot's proficiency check (PPC) in respect of Captain Tolo was only valid to 30 November 2019. However, the training carried out in the USA during November 2019 would reasonably be expected to have included a proficiency check.

The AIIB report, however, notes that no record of a current, valid, signed PPC certificate nor unusual attitude recovery training was found in the documentation presented to the investigators. These certifications were a required part of the FIU unit's procedures and should have been on hand.

The First Officer, Tebogo Lekalakala, was 33 and held a commercial pilot's licence. She had 1 061.8 hours of flying experience.

She had also flown 15.4 hours in the preceding 90 days. However, she had more than 200 hours of total flying experience as part of a team with Captain Tolo in the same aircraft. In total they had completed 58 VOR and 50 ILS calibrations, making them an experienced crew combination for these operations.

They had both undertaken a calibration inspection flight in the same aircraft at Port Elizabeth airport (as it was called at the time) the day before the accident flight.

The Third crew member aboard the aircraft was Flight Inspector Gugu Mnguni who operated the calibration test equipment fitted in the cabin.

III

The Accident flight

The weather in the immediate vicinity of George airport on the morning of 23 January 2020 was nominally what is known as suitable for Visual Flight Rules (VFR) flying. VFR flights are to be conducted with clear visual reference to the ground at all times.

While VFR conditions prevailed early on, the Outeniqua mountains to the north of the airport were covered in cloud. The southern approaches and the visibility up and down the coast, especially over the sea, however, still offered broken cloud cover. As the morning progressed though, the weather began closing in.

The FIU aircraft had to be flown from Port Elizabeth to George to undertake the calibrations. While inbound the FIU aircraft made contact with the controllers in George and asked to do a calibration of the VOR beacon. This would entail flying a 360 degree anti-clockwise pattern around the VOR beacon. Owing to the growing overcast conditions in the area in which the orbit would need to be flown, the controller did not approve the request.

The Captain of ZS-CAR then decided to land, refuel and thereafter do a calibration of the ILS system on runway 11.

Once the refuelling had been completed, the crew called up the tower to obtain start up clearance and to relay their intentions.

As ZS-CAR was not fitted with a cockpit voice recorder (it was not a legal requirement for this particular aircraft) the only record of conversation for the accident flight was on the tower and approach control recordings.

In the event, the presence or otherwise of a CVR unit had no direct bearing on the cause of the accident. It did, however, impact the investigation process by making it impossible to determine the exact sequence of events in the cockpit. Thus no determination could be made as regards who was doing the flying during the ILS calibration sweep.

At 10.28 a.m. the crew of ZS-CAR asked for start clearance to perform a sweep of the 17 nautical mile range of the ILS signal. They indicated they would fly on the George VOR radial 250, at the coast, to radial 300 which marked the northernmost limit of the George airport chart's safe operating range.

10.28.25 ZS CAR first Officer to Tower

Ma'am we are 3 on board, 4 hours 30 min of endurance. Requesting start for ILS calibrations, 3000 feet.

10:28:32 Tower to ZS-CAR

Charlie Alpha Romeo your start is approved ma'am for runway one-one on a QNH (A setting used to get altitude above sea level on the altimeter) of one zero one eight. Your transmission is slightly soft. I just want to verify that you want to do the calibration and you want to intercept...did you say...three thousand feet...is that correct?
The tower controller then gave start up permission. Thereafter the tower and approach controller spent some time discussing the requested flight path and the weather situation which had, by that time, deteriorated even further. From the discussion it appears that they expected the operation to be carried out in VFR conditions.

Additionally, they discussed the fact that the aircraft would be operating at the outer edges of the controlled airspace around the airport.

After studying the weather again, a decision was made that the weather conditions just met the minima for VFR operations and Visual Meteorological Conditions (VMC) was declared at the airport.

Taxi clearance was then granted and ZS-CAR taxied to the holding point for runway 11. Once at the holding point, ZS-CAR called for its ATC clearance.

10:39:00     ZS-CAR first officer to tower

Tower, Charlie Alpha Romeo ready to copy ATC clearance.

10:39:04 Tower to ZS-CAR

Thank you Charlie Alpha Romeo. After departure runway one-one, climb, maintain runway track to three thousand feet, the approach control on one-two-eight-decimal-two passing two thousand five hundred feet. Squawk (A code used to identify the aircraft on the radar display) one-five-four-five.

The first officer read back the clearance and the aircraft was instructed to contact the tower when ready for departure. This was acknowledged.

10:39:35 First officer to tower

Report ready for departure next, Charlie Alpha Romeo.

Immediately after the first officer had responded, the Captain called the tower to request a change to the departure procedure.

 10:39:37 Captain to tower

And tower, from Charlie Alpha Romeo...

10:39:39 Tower to ZS-CAR

Go ahead sir.

10:39:41 Captain to tower

Is it at all possible to do an immediate right turn...after departure?

Aircrew with whom this sequence of events has been discussed while researching this article commented on this request. They speculated that, given the narrowing weather gap in which to operate the flight according to visual flight rules, the Captain may have wanted to make an immediate turn to reduce the time that would otherwise be used on a normal procedural departure and climb-out from runway 11.

If this was, in fact the reason for the request to change the clearance, it indicates a possible perception of time pressure in the mind of the Captain. However, the AIIB report does not mention any research into the human factors and work schedules of the crew.

This change was, however, approved by the approach controller and the tower informed the crew.

10:39:52 Tower to ZS-CAR

Charlie Alpha Romeo affirm. Then you are re-cleared after departure runway one-one you can turn immediately right as per your request and then climbing three thousand feet. I just need to check...are you then going out to intercept that radial as the lady said?

10:40:04 Captain to tower

Affirm ma'am. Two five zero, three three zero, immediate right turn, three thousand feet, Charlie Alpha Romeo.

The tower confirmed the read back of the modified clearance as correct and advised ZS-CAR that it would be in and out of controlled airspace at the intended 17 nautical mile distance from the DME.

Following the acknowledgement of this and a remark to the effect that “...we are fully ready...” take off clearance was given.

At 10:42:00 ZS-CAR was airborne. At 10:42.01 The First Officer reported they were flying to the threshold and would then then turn right to the coast and position themselves at 17 nautical miles DME to fly the arc between radial 250 and 300 “...about ten times...”.

The area on the seaward side still had some broken cloud but the Outeniqua mountains and foothills were blanketed in thick cloud and mist.

Discussion by the author with calibration teams in the United Kingdom and the United States indicates that, in their operations, the Pilot Flying (PF) concentrates on the aircraft and flying the arc accurately once established on course. The Pilot Non-Flying (PNF) in those teams handles overall navigation, communications and ensures separation of the aircraft from conflicting traffic and terrain.

Yet again, owing to the lack of a CVR, there is no way of knowing if this was the procedure being followed aboard ZS-CAR nor who was at the controls.

The final communication to the aircraft was at 10:46:10.

10:46:10 Tower to ZS-CAR

Charlie Alpha Romeo advise that you will be outside the TMA (Terminal Manoeuvring area)...broadcast one-two-four-decimal-two for traffic below the TMA.

At 10:50:31 ZS-CAR, now positioned at 17 nm DME and slightly beyond the 35 degree zone to the seaward side of the runway, commenced a turn towards the mountain from the coast to pick up the 250 to 300 radial arc at 3000 feet.

The flight then crossed the extended runway centre line and continued towards the 300 radial point. Instead of turning immediately on to a reciprocal course once they reached this point, however, the aircraft continued on the arc and then entered cloud.

There is no way of knowing why the aircraft continued past the usual turning point nor what was happening or being said in the cockpit to cause this sequence of events.

The investigators were unable to determine if any alarm, such as the ground proximity or other warning had sounded to cause the control inputs recorded immediately after the aircraft encountered IMC conditions.

What is known, however, is that a sudden unplanned change from VFR to IMC can be disorientating for even the most experienced pilots.

We also know what happened to the aircraft in the next nine seconds.

Information recovered from the Flight Data Recorder (FDR) during the investigation phase, shows that the aircraft initially lost some height then suddenly climbed from 2900 feet to 3900 feet within 6 seconds, which is a rate of climb of 10 000 feet per minute.

While the heading of 37.5 degrees had remained constant up to the moment the aircraft entered the cloud, within two seconds, in tandem with the climb, it changed to 67.5 degrees. The aircraft's bank angle also changed to 35 degrees right bank and the nose pitch dropped 10 degrees.

The change in altitude and bank angle indicate that the pilot at the controls had pulled back on the column to gain altitude while simultaneously banking the aircraft to turn to the right.

As an aircraft banks (moves in the roll axis), the lifting force that is normally acting upwards in level flight is gradually moved towards, and begins to act in the direction of, the bank and increases the roll rate unless counteracted with the controls.

This appears to have been what happened with ZS-CAR as, within the next five seconds, the bank angle increased to 105 degrees. This is well beyond the vertical and an over bank situation.

The aircraft then dropped its nose to a negative pitch value of -32.5 degrees and the altitude rapidly decreased to below 2800 feet. The airspeed reading at this point of the FDR plot showed a speed of 275 knots (509 km/h).

During this period the magnetic heading changed rapidly to 150 degrees as the nose of the aircraft swung down following the steep bank condition and the aircraft entered a spiral dive.

In the final three seconds of the flight the pitch angle reduced to -17.5 degrees. The speed increased to 310 knots (574 km/h) before starting to reduce slightly. In the final second the bank angle was returning to normal.

The altitude loss in the final three seconds, however, equated to a descent rate of more than 16 000 feet per minute.

Tragically, at 10:53 a.m. South African Standard Time (SAST), the aircraft crashed into the ground 2 192 feet above sea level, north of Friemersheim while traveling at an airspeed of 286 knots (529 km/h),.

The final flight path of ZS-CAR. Source: AIIB/CAA Report 9855.

IV

The aftermath

Once the radar target from ZS-CAR stopped displaying, the controllers in George attempted to make contact with the aircraft and a DETRESFA alert was declared.

This is the highest grade of missing aircraft alert in the three level ICAO search and rescue alert procedure. It indicates a situation wherein there is “...a reasonable certainty that an aircraft and its occupants are threatened by grave and imminent danger and that they require immediate assistance.”

As their repeated calls met only with silence, the controllers asked aircraft in the area that were able to safely go towards the last known radar contact location, to try and locate the aircraft.

Due to the weather having closed in to 1 500 feet, however, the pilots trying to assist were not able to safely get their aircraft close to the probable crash site.

No emergency locator transmitter (ELT) signals were picked up from the aircraft and, in the event, no ELT device was found in the vicinity of the crash site. The report does not shed any further light on this anomaly.

The wreckage was, however, found an hour later. It was immediately obvious to the first responders that it had not been a survivable accident as evidenced by the severe fragmentation of the aircraft and the fact that there had been a post-impact fire.

Crash site location SOURCE: AIIB/CAA Report 9855.

Due to the increasingly inclement weather, operation of the rescue helicopters was becoming hazardous and the search and rescue efforts were called off to the following day.

The CAA and the Minister of Transport, naturally, made much of the determination of the CAA to thoroughly investigate the causes of the tragedy “without fear or favour” when addressing the media in the ensuing hours.

Many voices rightly pointed out, however, that letting the CAA, in effect, investigate itself was akin to letting the fox guard the hen house.

The CAA attempted to make much of the fact that there was a ministerial decree in force that set the line of reporting by the Accident and Incident Investigations Division (AIID) as being directly to a nominated DoT official and not the CAA itself.

However, the nominated official is merely a functionary and the AIID is actually housed within the CAA offices, the AIID staff are under the administration of the CAA. Control of the daily activities and output of the AIID is, therefore, de-facto, that of the CAA and its director.

As far back as the mid 2000's ICAO had strongly suggested that the AIID be set up as an entirely separate entity, as is the norm in most other member states.

A proposal to do this had, in fact, been incorporated in the new Civil Aviation Act. However, this new act had been crawling along to implementation for the better part of a decade, without yet having been enacted, by January 2020.

Within time the calls for an independent investigation due to the existence of this untenable and unavoidable conflict of interest increased – most notably from the families of the crew. Eventually it was decided to approach the AIIB of Ethiopia to conduct the investigation in co-operation with the investigator in charge from the CAA. The MOU to this effect was only signed a year later though, on 25 January 2021.

In the interim the AIID at the CAA had moved with some alacrity. The FDR from ZS-CAR was sent to the French Bureau of Enquiry and Analysis for Civil Aviation Safety (BEA) for analysis. The module arrived in France for inspection on 3^rd February 2020.

Notwithstanding damage to some parts of the recorder, the data module was intact and data read out was successful. More than 100 hours of flight data was recovered, including the accident flight.

However, due to misconfiguration of the aircraft triggering parameters, only seven of the expected 16 mandatory parameters that should have been recorded by the FDR were, in fact, recorded. The most pertinent data recovered has been included in the foregoing accident synopsis.

In addition, it was found that the FDR had not been serviced and downloaded annually on the due dates of 8 January 2019 and 8 January 2020. These inspections were mandated as per the maintenance schedule for the unit as well as the regulations pertaining to the FDR in the applicable sections of the aviation act.

This lack of adherence to the required maintenance schedule meant, in effect, that at the time of the accident, the aircraft's certificate of airworthiness had, in the strictest legal sense, been invalid for more than a year.

This was so as the law states the certificate is immediately rendered invalid once a scheduled maintenance check item on an aircraft has not been performed. In addition, such a state of affairs would also normally have rendered any insurance on the aircraft, its crew and its operations invalid.

Yet again though, this did not have a direct bearing on the cause of the crash. It does, however, show that all was not well at the FIU and the CAA.

An exhaustive analysis of the several infringements listed in the AIIB report will not make for easy reading and is beyond the scope of this article. For those interested to read all of the adverse findings made by the Ethiopian AIIB, the full report is available here.

However, one fact of particular note in the report is that at the time of the accident, the Director of the Civil Aviation Authority, who is Ms. Poppy Khoza, held the roles of Accountable Manager and CEO of the Flight Inspection Unit. She is also the administrative head of the AIID staff. It is thus easy to understand the reluctance of the crew's families to have the investigation entrusted to the local aviation authorities.

The political and financial ramifications, however, do not obscure the fact that the regulator of civil aviation in South Africa has been found well and truly wanting and in violation of the very rules and regulations it seeks to apply, with otherwise commendable zeal, to third parties.

Hindsight from another FIU crew.

An obvious question, with the benefit of hindsight, is “What could have been done differently?”

Crew members from at least two FIU companies were given the airport and flight details, topography and charts and asked this exact question.

“Wait for full VFR conditions without clouds and clear sight of the mountains.” was the answer. “While you can do calibration flights in IMC we would only do this in areas where the terrain is relatively flat. At this airport, we would suggest that the standard operational procedure should be for calibration flights to be completed only in good VFR conditions.”

V

The accident's legacy

The crash of ZS-CAR can be marked for two vital things:

Firstly, it serves as a reminder to all aviators of the risks they face with every flight. It reminds us that even the most experienced and competent among us is not immune to the ever-present dangers that seek to remove us from the air.

While these risks may lie dormant for decades, they are ever ready to pounce within a fleeting second when we decide to “push the envelope”, place time above process and ignore red flags raised by regulations or conditions on the day.

Secondly it sounds an alarm about the state of our national aviation regulator in regard to how it is structured and run. The time has long since passed for the AIID to be set apart as a properly independent, effectively staffed entity.

In addition, the full staffing of the CAA with properly qualified aviation career professionals at every level is not optional, but non-negotiable.

It is perhaps time for an urgent overhaul of the entity in collaboration with the wider industry. “International best practice” should not simply be a slogan in a mission statement, but actively applied on a daily basis in all aspects of the CAA's remit.

While they are protesting the outcome, it certainly seems from the report on the loss of ZS-CAR, that the CAA management, oversight, processes and systems have, in many respects, failed.

Mark D Young is an investigative journalist and aviation safety author.