The occurrence

On the morning of 18 July 2022, the pilot of a Kavanagh E-260 hot air balloon, registered VH-FSR (FSR) and the pilot of a Kavanagh B-400 hot air balloon, registered VH-OOP (OOP) prepared to depart a launch site 7 km south‑east of Alice Springs Airport for a balloon transport flight.[1] Both balloons were operated by Red Centre Ballooning.

Before departing, the pilots released a pilot balloon[2] to determine wind conditions. The pilots observed that up to about 200 ft above ground level (AGL) a 3‑5 kt westerly wind prevailed. Above this was a 100 ft thick layer of calm air. Extending above the calm layer was a north‑easterly wind of about 10‑15 kt (Figure 1). The pilots also noted that cloud and visibility conditions were clear.

Figure 1: Departure site and prevailing winds

Source: Google Earth, annotated by ATSB

Both balloons departed at about 0645 local time. On board FSR was a pilot and 10 passengers, while OOP had a pilot and 23 passengers on board.

At about 0700, FSR was flying at about 900 ft above ground level (AGL) within the faster north‑easterly wind, while 1,150 m ahead, OOP was at about 100 ft AGL within the slower westerly wind. At about this time, the pilot of FSR decided to descend to the lower-level wind (below 200 ft AGL) to slow the balloon.

Before descending, the pilot of FSR incorrectly judged OOP to also be flying in the faster wind. Consequently, the pilot of FSR assessed that FSR would descend behind OOP with sufficient separation and made a radio broadcast using an ultra-high frequency (UHF) radio advising of the descent. The pilot of FSR did not confirm that the pilot of OOP had received and understood the broadcast.

During the descent, the pilot of FSR realised that OOP was flying lower and more slowly than initially assessed. When the distance between the two balloons reduced to about 250 m, the pilot of FSR recognised that a collision was possible.

About 40 seconds before the eventual collision, the pilot of OOP observed FSR closing and recognised the potential for contact (Figure 2), so called the pilot of FSR 4 times using a UHF radio. During that time, the pilot of FSR was focussed on managing the descent and misinterpreted these broadcasts as communications between other balloons that were operating in the area and therefore did not reply.

Figure 2: Overview of flights

Note: The balloon flightpaths were not recorded, the tracks depicted are representative only of the overall flights.

Source: Google Earth and operator, annotated by ATSB

The pilot of FSR was aware that a basket to envelope collision carried the risk of tearing the envelope of the lower balloon and so attempted to control the descent such that any collision would be between the balloon envelopes. FSR continued to decelerate slowly, but the balloon’s momentum continued to carry it toward OOP. To minimise the risk of envelope to basket contact, the pilot of OOP attempted to maintain a steady altitude. As FSR closed on OOP, the pilot of OOP alerted the passengers to the likely collision.

At 0702, the two balloons collided close to the widest point of each of their envelopes (Video 1). The balloons were not damaged and there were no injuries. After the collision, the balloons separated, and the flights continued without further incident.

Video 1: The collision

Source: Passenger aboard FSR

Context

Pilot information

The pilot of FSR held a Commercial Pilot Licence (Balloon) valid for Class 1 and Class 2 balloons.[3] At the time of the occurrence the pilot had accrued a total flying time of 1,010 hours, with 258 hours on the E-260 hot air balloon (Class 2). The pilot also held a current CASA Class 2 aviation medical certificate.

The pilot of OOP was the operator’s Head of Operations and also held a Commercial Pilot Licence (Balloon) valid for Class 1 and Class 2 balloons. At the time of the occurrence the pilot had accrued a total flying time of about 4,415 hours, with about 600 hours on the B-400 hot air balloon (Class 2). The pilot held a current CASA Class 2 aviation medical certificate.

A review of both pilots’ activities over the 72 hours prior to the occurrence identified that it was unlikely that either pilot was experiencing a level of fatigue known to affect performance.

Aircraft information

VH-FSR was a Kavanagh Balloons E-260 hot air balloon manufactured in 2009. The E‑260 balloon had an envelope capacity of 260,000 cubic feet (7,362 cubic meters) and a maximum take-off weight of 2,184 kg.

VH-OOP was a larger Kavanagh Balloons B-400 hot air balloon. The B‑400 balloon had an envelope capacity of 400,000 cubic feet (11,327 cubic meters) and a maximum take-off weight of 3,100 kg.

Airspace

The incident occurred within Alice Springs airspace. At the time of the incident, the control tower was not active, and the airspace was operating as class G airspace, utilising a common traffic advisory frequency.

Communications and collision avoidance

The balloons were equipped with both very-high frequency and ultra-high frequency (UHF) communications radios.

The Civil Aviation Safety Regulation (CASR) Part 91 Manual of Standards, Chapter 21 stated that when in the vicinity of a non-controlled aerodrome, a pilot must make a broadcast when the pilot ‘considers it reasonably necessary to broadcast to avoid the risk of a collision with another aircraft’.

The operator’s operations manual stated:

When in close proximity to other Company balloons establish contact on UHF Radio... The upper balloon will be responsible for avoiding basket to envelope contact between balloons. The lower balloon will acknowledge calls.

The operations manual also included a Civil Aviation Safety Authority (CASA) instrument, which stated:

Notwithstanding Civil Aviation Regulation (1988) 163;
 

• Whilst in flight give way to any balloon at a lower level by climbing to avoid the risk of the balloon basket contacting the envelope of the lower balloon, and
• except during inflation and launching, avoid envelope to envelope contact with other balloons.

At the time of the occurrence, CAR 163 had been superseded by the following CASRs:

91.055 - Aircraft not to be operated in a manner that creates a hazard
 

91.325 - A flight crew member must, during a flight, maintain vigilance, so far as weather conditions permit, to see and avoid other aircraft. 

Similar occurrence

ATSB investigation 198900820

On 13 August 1988, two hot air balloons, VH-NMS and VH-WMS, were operating tourist charter flights from the same launch site to the south‑east of Alice Springs Airport. VH-WMS departed about 2 minutes ahead of VH-NMS and climbed to about 4,000 ft AMSL (2,000 ft AGL) and drifted in a westerly direction. After reaching 4,000 ft, VH-WMS then commenced descending as VH-NMS climbed towards it.

VH-NMS continued climbing until its envelope collided with the basket of VH-WMS, tearing a large hole in the fabric. The degree of disruption to the envelope of VH-NMS was such that the balloon could not remain inflated. The balloon then descended uncontrolled until it collided with terrain. The pilot and 12 passengers were fatally injured. VH-WMS landed without further incident.

Safety analysis

While flying at about 900 ft above ground level (AGL) in 10‑15 kt winds, the pilot of hot air balloon VH-FSR (FSR) decided to descend to slow the balloon’s progress. The pilot of FSR observed VH-OOP (OOP), which was flying at about 100 ft AGL and about 1,150 m ahead within a layer of slow wind. However, the pilot of FSR misjudged the height of OOP and believed it to be flying higher in the same faster moving air stream that FSR was operating in. Based on that assessment, the pilot of FSR believed that sufficient separation would be maintained as FSR descended to a position behind OOP at a similar altitude. However, this misjudgement resulted in FSR converging toward OOP as it descended.

During the descent the pilots of both balloons identified the risk of collision. In response to the conflict, the pilot of OOP made 4 radio broadcasts to communicate with the pilot of FSR. However, the pilot of FSR was concentrating on managing the descent and misinterpreted these calls as communications between other balloons and not relevant so did not respond. However, by this time, it was unlikely that action could be taken to avoid the collision.

The pilot of FSR assessed that a collision could not be avoided and knowing the risks of basket to envelope contact, attempted to manage the descent so that the envelopes collided. To assist in avoiding basket to envelope contact, the pilot of OOP attempted to maintain a steady altitude. Although the envelope collision still carried safety risk, these actions resulted in the balloons avoiding basket to envelope contact and neither balloon was damaged in the collision.

From the evidence available, the following findings are made with respect to the mid-air collision between Kavanagh E-260, VH-FSR and Kavanagh B-400, VH-OOP on 18 July 2022.

Contributing factors

• While attempting to descend to a position behind VH-OOP, the pilot of VH-FSR misjudged the speed and direction of VH-OOP and descended VH-FSR toward VH-OOP.

• After recognising that a collision was likely, the pilot of VH-FSR managed the balloon's descent so that a basket and envelope did not collide, reducing the risk of damage.

Proactive safety action by Red Centre Ballooning

In response to the occurrence, the operator provided education to all company pilots emphasising:

• the need to make radio communications advising of intentions when operating in close proximity if anything out of the ordinary. If required, use alternative means of communication such as mobile phone.
• the importance of passenger communication to the passengers throughout a flight. This could include but is not limited to layover landings and flying around other aircraft.
• that higher balloons should overfly lower balloons before descending as higher balloons are generally travelling faster than lower balloons and may still be carrying some forward momentum after completion of a descent.
• the requirements of the company operations manual, including operating in accordance with the Civil Aviation Safety Authority instrument.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• balloon operator
• pilots of the VH-FSR and VH-OOP
• Civil Aviation Safety Authority
• Airservices Australia
• balloon passengers
• Bureau of Meteorology

References

Civil Aviation Safety Authority 2021, Advisory Circular AC 91-14 v1.0 Pilots’ responsibility for collision avoidance, October 2021

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the balloon operator and the involved pilots
• the Civil Aviation Safety Authority

Submissions were received from:

• the balloon operator and the involved pilots
• the Civil Aviation Safety Authority

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Executive summary

What happened

On the afternoon of 18 January 2023, a Boeing 737-838 aircraft, registered VH-XZB and operated by Qantas, departed Auckland, New Zealand on a scheduled passenger service to Sydney, Australia. While in the cruise, about 1 hour and 24 minutes after departure, there was an uncommanded shutdown of the left engine. Due to their location at the time, the flight crew declared a MAYDAY, to prioritise communications with air traffic control and to ensure they were cleared for an immediate descent to flight level 240 (24,000 ft). The engine could not be restarted in-flight, and the flight crew conducted an uneventful single-engine landing at Sydney Airport about 1 hour later.

What the ATSB found

The engine examination identified separation of the radial driveshaft (located in the inlet gearbox), which resulted in a mechanical discontinuity between the engine core and accessory gearbox. Loss of drive to the accessory gearbox resulted in a loss of fuel pump pressure and uncommanded shutdown of the engine. There was also secondary damage to some components as the engine shut down. In addition, the failed driveshaft prevented the engine restarting in-flight. 

Further, the ATSB found that the cockpit voice recorder was inadvertently overwritten during maintenance activities conducted after the aircraft arrived at Sydney Airport.

What has been done as a result

As a result of this incident, Qantas has enhanced their procedures to prevent inadvertent overwrite of cockpit voice recorders and flight data recorders.

Safety message

It has been well established that the importance of training, following standard procedures, and effective communications are crucial to aviation safety. This incident highlighted the positive benefits of effective decision-making and management of an unexpected situation. Such actions are best demonstrated by:

• maintaining a high level of situation awareness, utilising all sources of information, via procedural checklists and communications, including with cabin crew and air traffic control
• consideration of all options and evaluation to decide the best course of action to ensure additional operational difficulties are not inadvertently introduced
• a frequent review to ensure appropriate actions are being maintained throughout changing circumstances.

In addition, operators need to ensure correct procedures are in place to protect information recorded during the flight that enhances the accuracy and effectiveness of a safety investigation.

The occurrence

On the afternoon of 18 January 2023, a Boeing 737-838 aircraft, registered VH-XZB and operated by Qantas Airways, was being prepared for a scheduled passenger service from Auckland, New Zealand to Sydney, Australia. On board were 2 flight crew, 5 cabin crew and 143 passengers. The captain was designated as the pilot flying and the first officer was the pilot monitoring.[1]

The captain reported that the pre-flight briefing package identified good weather conditions for Auckland, en route, and Sydney. The weather forecast for additional airports was also included, in case of the requirement for a diversion. The flight was dispatched as an extended diversion time operations (EDTO)[2] flight authorised to operate up to 180 minutes or 1,200 NM (2,222 km) from an alternate aerodrome. The required EDTO maintenance had been completed in Auckland. This inspection included engine and auxiliary power unit (APU)[3] oil quantity checks, and a review of recent oil consumption records. The aircraft departed Auckland at 1430 local time and reached a cruise altitude of flight level (FL)[4] 360 about 20 minutes later.

The flight crew reported that they carried out an EDTO brief before entering the EDTO segment. The EDTO briefing included that, in the event of an engine failure, Auckland and Sydney were the primary airports.

After about 1 hour in the cruise, the flight crew transferred high frequency (HF) radio communications from Auckland to the en route controller at Brisbane Centre (en route controller).[5] Once the en route controller accepted monitoring of the aircraft, the flight crew requested to climb to FL 380. About 3 minutes later, and before the climb was authorised, the flight crew reported hearing a ‘pop’ sound, followed by the autopilot and auto throttle disengaging, with associated warning lights and horn. They then identified left (#1) engine was not operating. The flight crew broadcast MAYDAY,[6] citing an engine failure and requested an immediate descent to FL 240. The en route controller enquired if it was a single or double engine failure, to which the flight crew confirmed a single-engine failure (Figure 1). About 1 minute later, the en route controller authorised a descent to FL 240 when ready.

Figure 1: Map showing VH-XZB flight path and location of the engine failure

Source: APS Flight Analysis System (FAS) using Cesium, annotated by the ATSB

At the same time, following the completion of cabin service, the cabin safety manager (CSM) heard a noise and felt the aircraft yawing in a manner they described as ‘not normal’. After confirming that the cabin crew member next to them had also experienced the event, the CSM advised that they called the flight deck. The captain answered and advised the CSM that they could not talk at that moment as an engine had just failed. The CSM then called the cabin crew team leader at the rear of the cabin to inform them of the situation.

About 5 minutes later, the captain called the CSM to the flight deck and explained the situation, in that the left engine had shut down uncommanded and they were unsure why. The captain further advised that the aircraft was operating safely on one engine, and they were working through the engine failure, and associated checklists. The captain requested that the CSM relay this information to the cabin crew, monitor the passengers and to advise the flight deck if anything changed in the cabin.

Soon after, the CSM advised the flight crew that the cabin was getting quite warm[7] and power was not available to various galley equipment and the rear bathrooms.[8] The APU had been selected to ‘on’ as part of the engine failure checklist, however, cabin airflow had been affected. The flight crew reported they then selected the temperature controller to minimum and conditions improved.

The flight crew continued working through the non-normal checklists, while on a slow descent. Following authorised descent to FL 200, and with all checklists completed, the flight crew decided to attempt the in-flight engine restart checklist. While the first few steps were accomplished, the engine start attempt had to be aborted when a designated parameter could not be achieved. The flight crew then consolidated their plan and prepared for a single-engine landing at Sydney.

Throughout the descent into Sydney, en route and Brisbane Centre air traffic controllers[9] maintained contact with the flight crew, with scheduled check-in times to ascertain location details, operational status, and updates to any requirements in Sydney.

Just prior to top of descent, the flight crew advised Brisbane Centre they were downgrading from a MAYDAY to PAN PAN[10] but would still like aviation rescue fire-fighting services to attend and inspect the left engine before they proceeded to the terminal. Shortly after, air traffic control (ATC) communications were transferred to Sydney.

At about this time the captain made an announcement to the passengers, stating:

• they were to commence the descent into Sydney in a few minutes time
• acknowledging there were some issues with one engine that was affecting the air-conditioning and some electrical systems
• once on the ground, emergency services would attend the aircraft to inspect the engine, as a precaution, before they proceeded to the terminal
• reassuring them that everything was okay, and they would make another announcement once on the ground.

Following an uneventful landing at Sydney at 1526 local time, emergency services met the aircraft on the taxiway. Once cleared, the aircraft was taxied to the terminal, where engineering personnel conducted an additional inspection before the airbridge was positioned. At this point, the captain made a further announcement advising that they had experienced an engine failure about 1 hour out of Sydney. The captain thanked the passengers for their patience and understanding. In addition, the flight crew exited the flight deck and personally addressed each passenger as they disembarked.

Context

Personnel information

The captain held an Air Transport Pilot (Aeroplane) Licence, a current Class 1 Aviation Medical Certificate, and had accumulated 12,335 hours of aeronautical experience. Of this, about 1,620 hours were on the Boeing 737 type, and the captain had logged 230 hours in the preceding 90 days.

The first officer also held an Air Transport Pilot (Aeroplane) Licence, a current Class 1 Aviation Medical Certificate, and had accumulated 10,540 hours of aeronautical experience. Of this, about 794 hours were on the Boeing 737 type, and they had logged 165 hours in the preceding 90 days.

The training records showed the most recent full flight simulator session for the captain was completed in September 2022 and for the first officer in October 2022. In addition, the captain had practiced one engine inoperative situations (including during the cruise, missed approach and landing phases of flight) in November 2020, with the first officer completing this training in February 2022.

The flight crew reported being well rested and alert at the commencement of duty for the flight and there was no evidence to indicate that fatigue affected their performance during the flight.

Aircraft and engine information

General information

VH-XZB was a Boeing Company 737-838 aircraft, powered by 2 CFM56-7B26E[11] high bypass turbofan engines. The engine is a dual-rotor, axial-flow turbofan. The N1 refers to the rotational speed of the low-speed spool, which consists of a fan, a low‑pressure compressor and a low‑pressure turbine. N1 is the primary indication of engine thrust. The N2 refers to the rotational speed of the high-speed spool, which consists of a high-pressure compressor (HPC) and a high‑pressure turbine. The N1 and N2 rotors are mechanically independent. The N2 rotor drives the engine gearboxes.

When the engine is running, the accessory drive system extracts part of the core engine power, from the HPC (or N2) and transmits it through a series of shafts and gearboxes, to drive the engine and aircraft accessories, including the:

• fuel pump and hydromechanical unit
• hydraulic pump
• integrated drive generator.

The starter, also located on the accessory gearbox, used the same gearboxes and shafts to drive the HPC for engine start, either on the ground or in-flight.

Engine examination

An engine teardown inspection was conducted by the engine manufacturer at their technical facility in Malaysia and was observed by Qantas and the Air Accident Investigation Bureau Malaysia (on behalf of the ATSB). The examination identified that the inner radial driveshaft separated at 2 locations, at the mid-length bearing and near the upper spline (Figure 2). Subsequently, the mechanical discontinuity between the HPC shaft and accessory gearbox resulted in loss of fuel pump pressure and uncommanded shutdown of the engine. The mid-length bearing oil feed nozzle appeared clear (nil blockage). There was secondary damage to some components as the engine spooled down.

The failed driveshaft also prevented the starter from driving the HPC, which prevented the in‑flight engine restart.[12]

Figure 2: CFM56-7B engine, showing the accessory gearbox location, associated driveshafts and failure locations (red line)

Source: Operator, annotated by the ATSB

The manufacturer advised that the level of deterioration of the failed driveshaft and mid-length bearing prevented identification of the separation initiator. Further, the inner driveshaft oil supply features were destroyed by the bearing failure and therefore its condition at the time of the event could not be determined. Nevertheless, the engine manufacturer reported that the rupture of the inner driveshaft was considered the primary failure.

It was noted that the CFM56-7B world engine fleet had reported 7 similar radial driveshaft bearing events since 2012. However, there was no consistent component time accumulation prior to the failure. At the time of this incident, the approximate totals for the worldwide fleet were 15,200 engines, with 500 million hours in-service and 258 million cycles in-service.

Engine maintenance requirements

The engine oil system included scavenge screens and magnetic chip detectors that could collect any debris suspended in the oil. Metal contamination of the oil could be indicative of abnormal wear or impending failure of a component. Any metal contamination was to be examined to identify its origin and ascertain the quantity of the material. The engine manufacturer’s procedures then detailed steps to monitor or replace the affected component. In addition, an increase in oil consumption would require further inspection as per maintenance procedures.

The left engine was the original engine for the aircraft and had not been subject to any major repairs or overhaul. On 11 December 2022, a 500-hourly inspection was completed on the left engine oil system. This included a detailed inspection of the forward sump, aft sump, accessory and transfer gearboxes magnetic chip detectors and scavenge screens for debris and/or metal contamination. Further, the EDTO inspection completed in Auckland on 18 January 2023 included a review of the engine oil consumption over the previous 10 flights, to ensure it was within prescribed limits. Maintenance records indicated no metal contamination was identified and the oil consumption was within prescribed limits.

Recorded information

The cockpit voice recorder was downloaded at the ATSB’s technical facilities in Canberra. However, as the aircraft had been powered for maintenance activity following arrival at Sydney Airport, without the cockpit voice recorder being isolated, the audio data recorded during the incident flight was overwritten and not available for this investigation.

Data from the flight data recorder and quick access recorder was provided to the ATSB by the operator. The data showed that, 1 hour and 24 minutes after take-off from Auckland, the left engine abruptly shut down uncommanded. Further analysis of the data did not identify any appreciable changes to engine parameters, such as vibrations or temperature increase, prior to the failure. The flight crew also reported that there were no adverse indications prior to the sudden engine shutdown.

Operational procedures

Declaration of MAYDAY and PAN PAN

The operator’s procedures defined a MAYDAY and PAN PAN call consistent with the international standards as:

• MAYDAY: A condition of being threatened by serious and/or imminent danger and requiring immediate assistance.
• PAN PAN: A condition concerning the safety of an aircraft or other vehicle, or some person on board or within sight, but which does not require immediate assistance.

The flight crew considered the following regarding their decision to declare a MAYDAY:

• their location mid-way between Auckland and Sydney, and considerable distance to any other suitable airport
• desire to establish priority communication with Brisbane Centre via HF, which the flight crew reported could be busy and unreliable at times[13] (there was no satellite communication on the aircraft, therefore, HF radio was the only means of communication with ATC at that time)[14]
• requirement to ensure the airspace was clear for an immediate descent to an optimal altitude for single-engine operation and aircraft controllability
• uncertainty of the reason for the uncommanded shutdown and whether the remaining engine may also be affected.

Further, the flight crew advised that their decision to downgrade to a PAN PAN was based on the following:

• their reducing distance to their destination, and effective very high frequency communications with Sydney ATC
• all checklists were completed
• continued stable operation on one engine
• single-engine landing at Sydney had been planned and briefed by the flight crew.

Decision to continue to Sydney

The final step in the engine failure or shutdown checklist stated ‘plan to land at the nearest available airport’. The operator’s procedures stated that, ‘in a non-normal situation, the pilot-in-command, having the authority and responsibility for operation and safety of flight, must make the decision to continue the flight as planned or divert’. The procedures also stated considerations should include suitability of nearby airports in terms of facilities and weather, in decision-making where ‘the safest course of action is divert to a more distant airport than the nearest airport’.

At the time of the engine failure, the aircraft was located about (distance from) (Figure 3):

• Auckland 611 NM (1,132 km) and a 180° turn
• Sydney 560 NM (1,037 km) continuing on the current track
• Williamtown/Newcastle 550 NM (1,019 km) with a slight diversion to right of track
• Norfolk Island 484 NM (896 km) and a 115° right turn.

Figure 3: Engine failure location with respect to the 400 NM (741 km) EDTO radius from nearby alternate airports

Source: Google Earth, annotated by the ATSB

The Qantas Route Manual Supplement section for Norfolk Island noted several difficulties associated with the airport including:

• ‘actual weather can change rapidly and vary from forecast’ and a diversion to Australia may be required
• high terrain near the airport and rising terrain at the end of runway 11 could result in the illusion of being too high on approach
• strong winds in February and March could produce severe turbulence
• no mobile services
• the supplement-authorised runway at Norfolk Island was identified as 1,950 m long.

The flight crew reported that Sydney was on their direct route, the forecast weather conditions were more favourable, and the airport offered extensive emergency response (if required). In addition, their planned runway for landing was on a straight-in approach and 3,962 m long. The flight crew therefore elected to continue to Sydney.

Flight and cabin crew training

The captain and CSM had flown together previously, however, it was the first time either of them had flown with the first officer. The flight crew and CSM reported that the operator’s crew resource management training, which was conducted with flight and cabin crew combined, fostered an understanding of each area of operation, enabling openness and free-flowing sharing of information between the flight deck and cabin. In addition, role-specific training and use of standard procedures allowed them to each focus on their required tasks during an unanticipated situation.

Safety analysis

While in cruise, about 1 hour and 24 minutes from departure and without command, the left engine shut down. The flight crew reported they did not detect any change in parameters, which may have alerted them to an impending engine issue. This was consistent with the recorded data, which showed there was no warning. In addition, recent maintenance was indicative of a normally operating engine. The reason for the uncommanded shutdown was later established as being the result of the separation of the radial driveshaft. The mechanical discontinuity between the engine core and accessory driveshaft resulted in loss of fuel pump pressure and the subsequent engine failure. The driveshaft failure also prevented the engine restart.

While Norfolk Island was closer at the time of the engine failure, a diversion required a deviation from their current track. In addition, Norfolk Island presented changeable weather and operational conditions. In contrast, Sydney Airport was on their direct route, had favourable weather conditions forecast, had an extensive emergency response, and a straight‑in approach on a very long runway. The flight crew’s decision to continue to Sydney ensured no additional risk was added to an already high workload situation.

The ATSB publication Black box flight recorders highlights the benefits of aircraft flight recorders such as the cockpit voice recorder, by creating a record of the total audio environment in the cockpit area. This includes crew conversations, radio transmissions, aural alarms, and ambient cockpit sounds, check list management, and decision making. As highlighted in the ATSB’s publication, around 80% of aircraft accidents involve human factors, which means that crew performance may have contributed to some events. As a result, the cockpit voice recorder often provides accident investigators with invaluable insights into why an accident occurred. In this case, the recorded audio of this incident was inadvertently overwritten during maintenance operations. However, flight data was available and was found to be consistent with the flight crew’s recollections and ATC audio recordings.

Findings

From the evidence available, the following findings are made with respect to the engine failure involving Boeing Company 737-838, VH-XZB, en route between Auckland, New Zealand and Sydney, Australia, on 18 January 2023.

Contributing factors

• During cruise, separation of the radial driveshaft led to a mechanical discontinuity between the engine core and accessory gearbox. This resulted in loss of the accessory gearbox-driven main fuel pump pressure and uncommanded shutdown of the left engine. In addition, the failed driveshaft prevented the engine from being restarted in-flight. 

Other findings

• Based on the more favourable forecast weather conditions and operational requirements, the flight crew decided to continue to Sydney rather than divert to Norfolk Island, which ensured that no additional risk was added to an already high workload situation.
• The cockpit voice recorder was inadvertently overwritten during maintenance activity following the incident flight. Although not critical to this investigation, this information could have provided direct evidence regarding the flight crew's coordination, check list management, and decision making throughout the flight.

Safety actions

Safety action by Qantas addressing preservation of cockpit voice recorders following an occurrence

Qantas have advised they are taking the following safety action in response to this incident. When a request is received to secure the cockpit voice recorder and/or flight data recorder, the following steps are to be carried out:

• immediately notify the duty technical manager to raise a task in the maintenance software to have the requested item quarantined (or at a minimum, power to the recorders is to be removed)
• follow up with a telephone call to the respective port and ensure the ground engineer is advised of the limited timeframe to secure the data
• continually follow up with the applicable ports until positive confirmation of the requested action has been confirmed.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• flight crew and cabin manager on VH-XZB
• Qantas Airways Limited
• Airservices Australia
• Airways New Zealand
• engine manufacturer
• the flight data recorder.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Qantas Airways Limited
• the flight crew and cabin service manager on VH-XZB
• engine manufacturer
• United States National Transportation Safety Board 
• New Zealand Transport Accident Investigation Commission.

Submissions were received from:

• Qantas Airways Limited
• the captain
• the engine manufacturer.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On 8 January 2023, the pilot of a Robinson R44 helicopter, registered VH-ZUJ, noticed a persistent clutch warning light on approach to Hamilton Island Airport, Queensland, and carried out the clutch warning light emergency procedure. The aircraft landed at Hamilton Island Airport, where ground crew found that the clutch actuator electric drive motor had separated from the gearmotor assembly and fallen between the drive belts and the right-hand fan shroud.

What the ATSB found

The ATSB established that during assembly of the gearmotor the required thread adhesive was not applied, or applied in a manner that did not prevent the loosening of the electric motor retaining nut. Consequently, over time, normal aircraft vibrations loosened the retaining nut, resulting in the clutch actuator electric motor separating from the gearmotor assembly in flight.

What has been done as a result

Robinson Helicopter Company advised that they are actively working with the component manufacturer to rectify identified quality issues with the gearmotor assembly and are considering updating the procedures for the inspection of the clutch actuator assembly.

Safety message

Personnel involved in maintenance and operation of R44 helicopters should be aware of the risks posed by the failure of this component, specifically the risk of a loose component interfering with the v-belts and impacting rotor drive. The ATSB encourages pilots and maintenance engineers to physically check the security of the R44 clutch gearmotor assembly on a regular basis.

Hand checking the motor for security, with electrical power off or visual inspection for motor rotation during operation are 2 methods that may detect a loosening motor prior to complete separation.

If a defect is identified, the gearmotor assembly should be replaced and the defect reported to the Civil Aviation Safety Authority and the manufacturer.

The investigation

The occurrence

On 8 January 2023 a Robinson R44 helicopter registered VH-ZUJ was being used to conduct a number of local tourist charter flights from Hamilton Island, Queensland. The aircraft completed 7 flights and 6 engine starts that morning without incident, 4 of those flights were passenger‑carrying flights.

At about 1130 local time the aircraft departed Qualia helipad, with no passengers aboard, for a positioning flight to Hamilton Island Airport. On approach to runway 14, at about 300 meters from the threshold, the pilot noted the illumination of the clutch caution light.

The pilot waited for 10 seconds, then, as the light did not extinguish, they pulled the clutch motor circuit breaker in accordance with the clutch warning light emergency procedure in the pilot’s operating handbook. The landing was completed at Hamilton Island Airport and the aircraft was shut down without further incident.

Ground crew visually inspected the drive belt tensioner assembly and found that the clutch actuator electrical drive motor had separated from the gear assembly and was found between the drive belts and fan shroud. The motor was still attached electrically to the aircraft, and the gear assembly was securely attached to the drive belt tensioner assembly. (Figure 1)

Figure 1: Electric motor position

Source: Pilot. Annotated by the ATSB

Drive belt system

The Robinson R44 helicopter's rotor drive system incorporates a belt driven common shaft for main and tail rotor drive. Power is transmitted from the engine to the main and tail rotors through vertically mounted sheaves (also commonly called drive pulleys) and a v-belt arrangement (Figure 2). The drive assembly carries 4 double‑banded v-belts. Each drive belt consists of 2 single v-belts that are bonded by a common rubber backing (tie-band). The lower drive sheave is bolted to the output flange of the engine crankshaft, while the upper sheave is located immediately above on the common main and tail rotor driveshaft.

Before the engine is started, the clutch actuator is placed in the disengaged position, which leaves the v-belts slack and allows the engine to start and run freely without the load of the main and tail rotors. A pilot-operated, electrically‑driven actuator progressively tensions the drive belts and enables power transfer from the engine to the rotor system.

Figure 2: R44 clutch assembly

Source: Robinson Helicopter Company. Modified for clarity and annotated by the ATSB

Drive belt clutch system

The clutch actuator is vertically positioned between the upper and lower sheaves. When the actuator is engaged, the upper sheave and clutch shaft are moved upward, applying tension to the drive belts. A column spring arrangement within the clutch actuator senses the compressive load caused by increasing belt tension and stops the actuator gearmotor when the tension reaches a pre-set value. The actuator also incorporates up limit switches to prevent over extension due to belt stretching, and a down limit switch to set the clutch disengaged positions. The clutch gearmotor assembly uses an electric motor to drive the actuator, via a worm-drive[1] arrangement, which ensures that belt tension forces are not fed back into the actuator motor; this allows the motor to be de-energised and belt tension to be maintained. The gearmotor assembly is attached to the belt tensioner by 4 corrosion resistant screws. (Figure 2)

A clutch caution light is illuminated in the cockpit whenever the gearmotor is running, either engaging or disengaging the clutch. It is normal for the clutch caution light to illuminate briefly during flight as the actuator re-tensions the drive belts to maintain the correct drive belt tension.

Gearmotor assembly

The clutch actuator electrical motor and gear assembly, collectively known as the gearmotor assembly, are factory assembled. The assembly is not field serviceable or repairable, requiring return to the manufacturer if unserviceable. The motor is attached to the drive gear by a threaded, free‑rotating, captive retaining nut. The retaining nut is secured with a commercially available thread locking adhesive and torqued with a c-spanner using castellations built into the nut, The electric motor case is then partially slid over the retaining nut, covering the castellations. (Figure 3) The design does not include a mechanical locking device, and no visual indication of loosening creep is embodied.

Figure 3: Gearmotor assembly

Source: ATSB

The incident gearmotor assembly was retained and inspected by the ATSB. The inspection noted the following (Figure 4):

• No unusual damage to the threads of the electric motor or gear assembly was evident.
• A black residue was found in the root of the gear assembly threads. This residue was not chemically identified due to an insufficient amount available for analysis.
• The thread locking compound specified was designed to fluoresce in ultraviolet light to enable inspection of the fastener. The ATSB assembled a test piece with the locking compound and when disassembled the compound was evident when examined under ultraviolet light.
• No evidence of thread adhesive was found on the engaging threads of either part of the incident gearmotor assembly under ultraviolet, or visible light conditions.
• Fluorescent residue was found on a threaded section of the gear assembly, outside of the engaging threads section.

Figure 4: Gearmotor UV light inspection

Source: ATSB

Thread adhesive

Loosening of threaded fasteners subject to vibration or rotation is an established and understood phenomenon of aircraft operation.[2] Secondary locking devices and assembly torque are carefully designed to minimise the risk of the threaded fastener loosening in service. Thread adhesive can be used as a secondary locking mechanism to mitigate vibration‑induced loosening of threaded fasteners.

The thread adhesive specified for the gearmotor is a medium strength adhesive designed for permanent locking and sealing. Once cured, it has a wide operating temperature and requires parts to be heated to 232°C to reduce the adhesive strength for disassembly. The tightening torque applied to a threaded fastener is calculated, in part, by taking into account the opposing friction created between the threads during the torquing process.

Thread locking adhesive can have a secondary effect of lubrication of the threaded fastener during assembly and tightening. This lubrication allows a greater proportion of the torquing force to be converted into clamping force between 2 parts. The increased clamping force contributes to a reduction in vibration induced loosening.[3]

Gearmotor scheduled inspections

Scheduled inspection of the clutch actuator assembly is limited to a visual inspection and functional checking of the assembly during 100-hour/1-year inspections, up to its 2,200-hour overhaul life. The inspection procedure specifies inspections of the upper and lower bearings and testing of the limit switches, among other visual inspections. It does not specify a check for security of the gearmotor assembly, or of the electrical motor.

At the time of the incident the aircraft had a total of 133 flight hours, with the 100-hour inspection certified on 23 December 2022. All the required inspections were carried out on the clutch actuator assembly at this time, and no defects were noted by the certifying licenced aircraft maintenance engineer.

Pilot action

If the clutch caution light illuminates in flight, and does not go out within 10 seconds, the pilot’s operating handbook, clutch caution light emergency procedure, instructed pilots to:

…pull CLUTCH circuit breaker and land as soon as practical. Reduce power and land immediately if there are other indications of drive system failure (be prepared to enter autorotation). Have drive system inspected for possible malfunction.[4]

It is likely that the electric motor separated from the gear assembly sometime between the pilot engaging the clutch after start, and the continuous illumination of the clutch caution light immediately prior to landing. The clutch system attempted to re-tension the belts and as the motor had separated from the gear assembly, the motor ran continuously, illuminating the clutch caution light.

On noticing the clutch caution light and waiting the requisite 10 seconds, the pilot carried out the clutch caution light emergency procedure and was able to land immediately. Had the landing been delayed in this incident it is possible that the position of the electric motor, between the drive belts and right fan shroud, could have caused damage to the drive belts and created a hazard to the safety of flight.

Safety analysis

The gearmotor assembly process incorporated the application of a thread adhesive designed to act as a secondary locking device to prevent the inadvertent loosening of the electric motor due to normal helicopter vibrations in flight. ATSB inspection of the threaded sections of the incident gearmotor under ultraviolet light showed that the thread adhesive was not visible in an area that would reliably ensure the security of the motor. This resulted in loosening of the motor due to normal operating vibrations. The reason for the absence of thread locking adhesive on the mating surfaces of the threads could not be determined.

The absence of thread adhesive during assembly, and its associated lubricating effect, probably reduced the intended design clamping force between the gear assembly and electric motor. It is important to note that the residue found in the gear assembly threads was not chemically identified so the impact it had on adhesion or lubrication, could not be assessed. The extent to which these factors influenced the failure of the gearmotor assembly was not determined, but it is possible that a reduced assembly clamping load contributed to the failure.

The integrity and effectiveness of thread adhesives are difficult to determine by visual inspection alone, and generally require specialised tooling or procedures to accurately assess. It is therefore likely that the inspecting licenced aircraft maintenance engineers would have been unable to have detected the gearmotor defect by visual inspection, had it existed at the time of the last scheduled inspection.

Findings

From the evidence available, the following findings are made with respect to the drive belt tensioning motor failure involving Robinson Helicopter R44, VH-ZUJ, at Hamilton Island Airport, Queensland on 8 January 2023.

Contributing factors

• Thread adhesive was not applied to the threads or applied to the threads in a manner that would effectively prevent the in‑service loosening of the motor.
• The gearmotor electric motor separated from the gearmotor assembly due to normal aircraft vibrations.

Safety action by Robinson Helicopter Company

Robinson Helicopter Company advised that they are actively working with the component manufacturer to rectify identified quality issues with the gearmotor assembly and are considering updating the procedures for the inspection of the clutch actuator assembly.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot of the incident flight
• Robinson Helicopter Company
• Helibiz (VH-ZUJ maintenance provider)
• Globe Motors

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• United States National Transportation Safety Board
• Whitsunday air services (Operator)
• Helibiz
• Robinson Helicopter Company
• Globe Motors
• the pilot of the incident flight.

Submissions were received from:

• Robinson Helicopter Company
• Globe Motors

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Executive summary

What happened

On the morning of 5 January 2023, a British Aerospace BAE 146-200, registered VH-SFV and operated by Pionair Australia, operated a freight transport flight in darkness from Brisbane to Rockhampton, Queensland. After discontinuing a required navigation performance approach to runway 33 at Rockhampton because of low cloud, the crew conducted a missed approach and commenced a second approach at 0358 local time.

When commencing the second approach, the captain began descending the aircraft from 3,500 feet above mean sea level at the initial approach fix waypoint SARUS. Prior to crossing the intermediate fix at the waypoint BRKSI, the aircraft descended below the 3,000 ft segment minimum safe altitude (SMSA). The aircraft then continued descending on about a 3° profile and crossed BRKSI at 1,705 ft (1,295 ft below the SMSA) before then also descending below the next SMSA of 1,500 ft a few seconds later.

As the aircraft continued descending toward the minimum descent altitude, the flight crew recognised that the aircraft had descended below the SMSA and immediately commenced a missed approach. At about the same time, the ground proximity warning system activated.

What the ATSB found

The ATSB found that the captain commenced the second approach descent early based upon the incorrect application of their preferred regular descent technique but from a lower altitude. Additionally, the first officer did not identify the early descent due to an incorrect mental model of the aircraft's position in relation to the required flightpath. This led to the aircraft twice descending below segment minimum safe altitudes.

The ATSB also found that due to the time of the approaches and inadequate sleep, both flight crewmembers were likely experiencing a level of fatigue known to adversely affect performance. This, in combination with a period of high workload associated with the missed approach and second approach, led to the early descent and monitoring errors.

Finally, while the operator's flight crew rosters were compliant with applicable regulations and adequate sleep opportunities were available, the rosters were irregular and disruptive to the flight crew's sleep patterns which adversely impacted their ability to obtain adequate sleep prior to the incident flight.

What has been done as a result

Following the occurrence, the operator implemented several organisational, operational, and training changes including:

• the establishment of a fatigue safety action group
• a temporary reduction in total operational workload to reduce roster pressures and increase roster stability while training of additional flight crew was completed
• revisions to standard operating procedures to clarify actions and reduce workload during approaches
• revision of the training programs for flight management computer use during approaches.

Safety message

This incident illustrates the human factors implications associated with the combination of increased workload and the effects of fatigue.

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported by industry. One of the priorities is improving the management of fatigue, which is the physical and psychological state typically caused by prolonged wakefulness and/or inadequate sleep.

Managing fatigue is a shared responsibility. This incident emphasises the importance of operators providing predictable and stable rosters to support pilots in achieving adequate sleep. Also highlighted, is the importance of pilots monitoring their own health and wellbeing to ensure that they are well-rested, especially when conducting overnight operations.

The occurrence

At 0238 local time on 5 January 2023, a British Aerospace BAE 146-200, registered VH-SFV and operated by Pionair Australia, departed Brisbane, Queensland (QLD) for a freight transport flight to Rockhampton, QLD with 2 crewmembers on board.[1] The captain was acting as pilot flying, and the first officer was acting as pilot monitoring.[2]

At 0300, as the aircraft climbed through flight level 220,[3] air traffic control cleared the flight to track to the waypoint SARUS. This waypoint was the initial approach fix for the required navigation performance (RNP) approach for runway 33 at Rockhampton and the tracking allowed the crew to proceed directly from the cruise and descent to a straight-in RNP approach (Figure 1).

Figure 1: First approach

Source: Operator and Google Earth, annotated by the ATSB

At 0330, the aircraft crossed SARUS to commence the RNP approach for runway 33. As was the captain’s normal practice (see the section titled Crew approach techniques), the aircraft crossed SARUS at 4,980 ft above mean sea level while descending. The aircraft continued descending along the approach until reaching the 710 ft minimum descent altitude (MDA) for the approach. Upon reaching the MDA, the crew could not see the runway lights due to cloud and commenced a missed approach.

The crew carried out the missed approach, climbed to 4,500 ft and returned to the waypoint SARUS to prepare for a second approach (Figure 2). At SARUS, the crew conducted a holding pattern and descended to the minimum holding altitude of 3,500 ft. While conducting the holding pattern, the crew obtained updated weather information from ATC, reactivated the pilot-activated runway lights, completed an approach briefing and readied the aircraft for the second approach.

Figure 2: Flight path of first missed approach, holding and second approach

Source: Operator and Google Earth, annotated by ATSB

At 0358, the aircraft crossed SARUS at 3,500 ft to begin the second approach and, the captain applied their usual descent technique and commenced descending. At the same time, the first officer made a radio broadcast on the Rockhampton common traffic advisory frequency (CTAF). As the first officer was busy with the broadcast, the captain took on the pilot monitoring task of calling out the aircraft’s altitude and distance to run to the next waypoint (BRKSI).

After completing the radio calls, the first officer took over the pilot monitoring tasks and started to call out the altitude and distance to run, continuing from the captain’s previous callout but incorrectly believing that the aircraft had already passed BRKSI.

At 0358:55, prior to crossing BRKSI, the aircraft descended below the 3,000 ft segment minimum safe altitude (SMSA) (Figure 3). The aircraft continued descending on about a 3° approach profile and crossed BRKSI at 1,705 ft (1,295 ft below the SMSA) before then descending below the next SMSA of 1,500 ft, 24 seconds later at 04:00:56.

Figure 3: Rockhampton RNP runway 33 approach chart

Source: Airservices

As the aircraft continued descending toward the MDA, along a descent profile consistent with it being one approach segment further along than it actually was, the flight crew recognised that the ground lighting appeared different to the first approach and that distance measuring equipment indications were not as expected. In response, the first officer looked at the flight management computer and identified that the next waypoint was BRKSF, not the expected missed approach point, and immediately called for the captain to conduct a missed approach.

At about the same time, 0401:54, the ground proximity warning system generated a ‘terrain’ alert (see the section titled Ground proximity warning system). The crew then conducted a second missed approach. The minimum height recorded during the approach was 602 ft above ground level.

Following the missed approach, the crew diverted to Mackay, QLD and landed without further incident. The crew then completed a return trip to Rockhampton and Brisbane before completing their duty.

Context

Crew details

The captain held an air transport pilot licence (aeroplane) and class 1 aviation medical certificate. The captain had over 16,400 hours of flying experience, of which about 2,000 were on the BAE 146.

The first officer held an air transport pilot licence (aeroplane) and class 1 aviation medical certificate. The first officer had over 2,400 hours of flying experience, of which about 280 were on the BAE 146.

The first missed approach at Rockhampton was the first officer’s first missed approach in a BAE 146 aircraft (other than in a simulator).

Crew approach techniques

The crewmembers regularly operated from Brisbane to Rockhampton. When conditions favoured a runway 33 approach at Rockhampton, both crewmembers preferred to conduct an RNP approach by tracking straight in from the inbound track via SARUS.

When operating as pilot flying, the captain preferred to conduct a constant descent from the cruise segment to cross SARUS at about 5,000 ft above mean sea level while continuing the descent into the approach.

The first officer usually descended and levelled at 3,500 ft prior to crossing SARUS as this allowed additional time to configure the aircraft for the approach before continuing the approach descent from the waypoint BRKSI.

Both descent methods were consistent with the operator’s procedures.

Flight crew fatigue and workload

Crewmember sleep details

On the morning of 4 January, the captain and first officer completed a 9-hour duty together at 0445. Following this, the captain had about 2 hours of sleep and the first officer about 3 hours. In the evening, the captain had a further period of about 3 hours of sleep, waking at 2100 and the first officer about 2.5 hours before waking at 2130. On the previous day (3 January), the captain had about 4 hours of sleep while the first officer had about 7 hours. Therefore, at the commencement of duty at 0140 on 5 January, the captain had achieved about 9 hours of sleep in the preceding 48 hours, while the first officer had achieved about 12.5 hours.

Prior to 3 January, the captain had 2 days free of duties and the first officer had 11 days free.

Causes and effects

Civil Aviation Safety Authority (CASA) advisory publication CAAP 48-01 v3.2 Fatigue management for flight crew members provides a substantial amount of information on flight crew fatigue, sleep, workload, and the effects of sleep loss on performance.

The publication stated that the average adult needs between 7 to 9 hours of quality sleep per day to sustain normal performance and that obtaining sufficient, quality sleep during the optimum window for rest was essential. In the absence of sufficient sleep, the brain does not operate effectively and both concentration and decision making are negatively impacted. In addition, the effects of restricting sleep accumulate with pilots becoming progressively less alert and functional with each further day of sleep restriction. This is described as accumulating a ‘sleep debt’.

Insufficient sleep can lead to a deterioration in an individual’s processing speed and ability to maintain attention. More complex mental tasks, such as anticipating events, planning, and reacting to novel situations are also negatively impacted. These capabilities are critical to aviation safety, particularly during critical and high workload phases such as an instrument approach. Furthermore, once people are sufficiently fatigued, they are no longer able to reliably assess their own levels of fatigue, and consequently relying solely on self-assessment of fatigue can be flawed.

Additionally, the time of day can also have an impact on sleep and performance. Humans exhibit various predictable physiological and behavioural rhythms within a period of about a day known as circadian rhythms. These rhythms include periods of reduced alertness corresponding with the body temperature decreasing to its lowest level from 0300 to 0600 and, to a lesser extent, from 1600 to 1800. These circadian rhythms are synchronised to the solar day by external factors, the most important of which is the external light-dark cycle. Therefore, night work is particularly challenging, as it requires an individual to override the circadian rhythm to maintain adequate alertness.

The CASA advisory publication also emphasised the following with regard to flight crew duty rosters:

Operator guidance

Pionair’s operations manual included a Fatigue Management Policy which provided crewmembers with fatigue guidance and, in part, aimed to:

• ensure that crewmembers were aware of the accrual, and identification of (and need to address) fatigue that can arise from work and personal factors
• embrace a fair and just reporting culture to facilitate improvement of fatigue management understanding and procedures
• facilitate fatigue management rostering and practices that avoid disruptive roster patterns and minimise the risks associated with fatigued crewmembers, with the goal of having no flight operations on which crewmembers are fatigue impaired to the extent that safety is impacted.

This policy also stated the following with regard to determining personal fatigue level:

The policy also required a crewmember to notify the operator should the crewmember believe that because of fatigue they were not fit for duty. Fatigue management is also emphasised in CAAP 48‑01 as a shared responsibility between the operator and crewmembers.

Roster stability

Both crew members reported that inconsistent and varying rosters reduced their ability to achieve sufficient and good quality sleep. Prior to departure, the captain and first officer discussed the difficulty in obtaining sleep the previous day. The captain recalled feeling moderately tired, although neither crewmember reported feeling unfit for duty or felt the need to make a fatigue report prior to commencing duty.

The ATSB undertook an analysis of the operator’s rostering practices. This analysis included examinations of the rosters of the operating crew and a further 4 flight crew (2 captains and 2 first officers) and found the following:

• regarding maximum flight and duty hours, number of consecutive duties during window of circadian low, and minimum hours off-duty; all rosters assessed were compliant with Civil Aviation Order 48.1 as applicable at the time of the occurrence
• there was no pattern to the rosters and there was variability in terms of duty start times which was also evident during consecutive days of duty
• some duty start times were in forward rotation and some in backwards rotation[4]
• crew were not completing more duties than originally rostered, nor completing duties during standby periods
• almost all the recorded duty times varied from the published roster but in most cases did not affect maximum duty period or minimum off-duty periods.

Aircraft details

General

The BAE 146 is a 4-engine, high-wing, regional jet aircraft. VH-SFV was manufactured in 1987 and was configured for air freight operations (Figure 4).

Figure 4: VH-SFV

Source: ATSB

Instrumentation

The BAE-146 entered service in 1983 and was fitted with an analogue cockpit based upon technologies and ergonomic considerations of the time (Figure 5). When manufactured, VH‑SFV was not equipped with an integrated flight management computer (FMC) although one was later fitted to allow for operational practices introduced since the aircraft’s manufacture. The FMC fitted to VH-SFV included a lateral navigation function but did not include a vertical navigation function or vertical path protection. Management of the vertical profile of the approach using the autopilot was achieved using the vertical speed mode. In this mode, the PF used the control column to descend the aircraft and, once the desired descent rate was achieved, pressed a ‘sync’ button to enter the targeted vertical speed into the autopilot.

Figure 5: VH-SFV instrumentation

Source: ATSB

The control display units (CDU) of the FMC were positioned on the centre pedestal of the cockpit and allowed for the entry of navigation data. During an RNP approach, the FMC provided a waypoint distance to run indication on the horizontal situation indicator, but did not identify the waypoint name (Figure 6). Waypoint information, including the waypoint where the aircraft was tracking from and to, and the subsequent approach waypoint was displayed on the CDU screen (Figure 7).

Figure 6: Horizontal situation indicator display

Source: Pionair Australia, modified and annotated by ATSB

Figure 7: Control display unit

Source: Pionair Australia

Ground proximity warning system

The aircraft was equipped with an enhanced ground proximity warning system (EGPWS). This system used aircraft inputs, including geographic position, attitude, altitude, and speed combined with internal terrain, obstacles, and airport runway databases to predict potential conflicts between the aircraft flight path and terrain or an obstacle. When a terrain or obstacle conflict was detected, the system provided a visual and audio warning alert.

Meteorology

Both approaches at Rockhampton were conducted in dark night conditions.

At 0336, the time of the commencement of the first missed approach, the Bureau of Meteorology (BoM) automatic weather station at Rockhampton Airport recorded the wind as 3 kt from 273° magnetic. Cloud cover was recorded: few[5] at 526 ft above mean sea level (AMSL) and scattered at 5,746 ft. Visibility was recorded as 23 km.

About 22 minutes later, at 0358, as the crew commenced the second approach, the station recorded the wind as 5 kt from 225° magnetic. Cloud cover was recorded as: few at 922 ft and scattered at 1,936 ft AMSL. Light rain had been recorded at the station in the preceding minute and visibility was recorded as 6,700 m.

Aerodrome weather information service

Rockhampton Airport was equipped with an aerodrome weather information service (AWIS), providing observations of meteorological conditions observed at the airport. These observations were available via telephone or air traffic control briefing. The Rockhampton AWIS was not available on a discrete radio frequency.

Rockhampton RNP runway 33 approach

Minimum descent altitude and missed approach requirements

For a 2-dimensional approach, to allow for the transition from descent to a level segment or missed approach without descending below the minimum descent altitude (MDA), the operator’s procedures required the addition of 50 ft to the 660 ft MDA. This provided a 710 ft MDA for the RNP approach in Rockhampton.

When the aircraft reached the missed approach point, if visual reference with the runway was not established (as occurred during the first approach), a missed approach was required.

Approach procedure chart

Airservices Australia and Jeppesen (an approved data service provider) published charts for the RNP runway 33 procedure. The charts produced by both organisations were designed and published in accordance with International Civil Aviation Organisation (ICAO) guidance.[6] The crew of VH-SFV used an electronic approach chart provided by Jeppesen, which was presented in dark mode for the night approach.

The Airservices Australia chart vertical profile presentation included the full approach, including the waypoint SARUS. This chart also included the minimum altitude of 3,500 ft at SARUS, the distance to the missed approach point of 15.3 nm (Figure 8) and the segment minimum safe altitude (SMSA) of 3,000 ft between SARUS and BRKSI. The Jeppesen chart (Figure 9) vertical profile commenced at waypoint BRKSI and did not include the waypoint SARUS, nor the SMSA between SARUS and BRKSI.

Figure 8: Airservices Australia RNP runway 33 approach chart

Source: Airservices, annotated by ATSB

Figure 9: Jeppesen RNP runway 33 approach chart (dark)

Source: Pionair Australia, annotated by ATSB

To provide a standardised presentation of aeronautical data for Jeppesen charts worldwide, Jeppesen chart design specifications directed that the vertical profile commence at the intermediate fix (IF) when an approach has multiple transitions. Jeppesen noted that this was the most common worldwide depiction of profile information. As the Rockhampton RNP approach had multiple transitions leading to the BRKSI IF, the vertical profile commenced at that waypoint.

Recorded data

Analysis of flight data from VH-SFV’s flight data recorder showed the descent profiles of the 2 approaches (Figure 10). The profiles show a similar descent angle, but with the second approach displaced by about 5 nm (1 approach segment).

Figure 10: RNP approach procedure showing the descent profiles of the 2 approaches

Source: Airservices and ATSB

Safety analysis

Early descent and error identification

After completing the first approach and missed approach, the crew completed a holding pattern to prepare for a second approach. The holding pattern provided a straight track to the initial approach fix SARUS, similar to the normal sequence for the crew when conducting a Brisbane to Rockhampton flight. The captain’s normal practice for this straight-in approach was to have the aircraft descending to cross SARUS at about 5,000 ft above mean sea level and to continue descending towards the next waypoint, BRKSI, while remaining above the 3,000 ft segment minimum safe altitude (SMSA).

On this occasion, following the missed approach and holding pattern, the aircraft crossed SARUS, and the captain immediately commenced descending as per their normal practice, but from the minimum holding altitude of 3,500 ft rather than their accustomed crossing altitude of 5,000 ft during a straight-in approach. This resulted in the aircraft incorrectly descending along a profile consistent with being one approach segment further along than its actual position.

As the aircraft descended along a normal descent angle, but one segment early, it twice descended below SMSAs. In dark night and cloudy conditions, this removed terrain and obstacle separation protections.

As the aircraft approached the minimum descent altitude, the different external sight picture and distance measuring equipment indications led the first officer to check the control display unit indications and identify that the aircraft was one approach segment behind their mental model of the approach and immediately call for a missed approach. At about the same time, the aircraft penetrated the ground proximity warning system warning envelope and a ‘terrain’ alert sounded.

The first officer’s normal practice when acting as pilot flying was to commence the approach from 3,500 ft at the waypoint after SARUS ‑ BRKSI. At the time of the descent of the second approach, the first officer’s focus was on completing radio broadcasts. While the first officer completed these broadcasts, the captain took over the callout and monitoring of descent distance and altitudes, temporarily removing the first officer from the approach monitoring task. When the first officer took over the task, they commenced monitoring the approach in the belief that the aircraft had already passed their preferred approach descent commencement point, BRKSI. Additionally, the next waypoint information was not immediately visible on the horizontal situation indicator and further contributed to the early descent error not being immediately recognised.

In addition, the Jeppesen approach chart used by both crews, while designed and published in accordance with ICAO guidance, did not include the waypoint SARUS or the SMSA for the SARUS-BRKSI segment on the vertical profile depiction. Although not considered contributory, this potentially limited the usefulness of the chart as an aid in enabling the crew to identify the early descent error.

Fatigue and workload

The approaches took place during the crew’s window of circadian low, a time of increased fatigue risk. Additionally, the crew were likely subject to an accumulated sleep debt resulting from the inability to get adequate sleep on the day prior to the incident as well as on the previous day. Both crew had also achieved less sleep than was considered adequate in Pionair’s fatigue management policy, particularly the captain. This sleep debt resulted in both flight crewmembers likely experiencing a level of fatigue known to adversely affect performance at the time of the approaches.

In addition, the second approach commenced during a period of high workload. The crew had completed one approach and a missed approach, the first in a BAE 146 aircraft (other than in a simulator) for the first officer. The crew then positioned the aircraft in the holding pattern and prepared for the second approach in dark and turbulent conditions. During the holding pattern, with Rockhampton Airport meteorological information not available via radio, the first officer obtained this information through air traffic control while also making the standard broadcasts to both air traffic control and on the common traffic advisory frequency. The aircraft’s analogue instrumentation and rudimentary autopilot systems also required significant input from the crew, further increasing the workload. The high workload, combined with the likely effects of fatigue, contributed to the early descent error made by the captain (as pilot flying) and to the first officer not immediately identifying the error (as pilot monitoring).

Stable rostering

The crews were operating night duties, which required sleeping during normal wakeful periods. This required the crew to adapt their sleeping patterns to match the available sleep opportunities. On the day prior to the occurrence duty, despite an adequate opportunity being available, both crewmembers were unable to obtain adequate sleep. The ATSB’s analysis of the operator’s rosters found that the rosters were irregular, unpredictable and that the duty hours operated were often inconsistent and varied from those rostered. This was disruptive to the crew’s sleep patterns and reduced their ability to effectively adapt to the available sleep opportunities, which in turn adversely impacted their ability to obtain adequate sleep prior to the incident flight.

Managing fatigue is a shared responsibility of the operator and crew. Part of this responsibility is the requirement of crew to self-report if they believe that they are unfit for duty due to fatigue. However, a known effect of fatigue is a reduction in an individual’s ability to accurately self-assess their fatigue level. This can reduce the effectiveness of crew self-reporting as a means of preventing crew from operating when fatigued, further reinforcing the need for stable and predictable rosters.

While the rostering practices increased the risk of the crew being unable to obtain adequate sleep, they were not considered contributory to the incident. Both the rosters and duties operated by the crews were found to be compliant with regulatory requirements. Furthermore, the time of the incident was generally associated with a reduction in human alertness and high fatigue risk, while also coinciding with a period of high workload following a missed approach and preparation for a second approach. Finally, the existence of other protections such as the ground proximity warning system alert were assessed as being effective in alerting the crew to the situation in sufficient time to take action.

Findings

From the evidence available, the following findings are made with respect to the descent below minimum altitude involving British Aerospace BAE 146, VH-SFV, 15 km south of Rockhampton Airport on 5 January 2023.

Contributing factors

• Following a missed approach, a second approach descent was commenced early when the captain applied their regular descent technique, but from a lower altitude, while the first officer did not identify the early descent due to an incorrect mental model of the aircraft's position along the approach. This resulted in the aircraft twice descending below segment minimum safe altitudes.
• Due to the time of the approaches and inadequate sleep, both flight crewmembers were likely experiencing a level of fatigue known to adversely affect performance. This, in combination with a period of high workload associated with the second approach, led to the early descent and monitoring errors.

Other factors that increased risk

• While the operator's flight crew rosters were compliant with applicable regulations and adequate sleep opportunities were available, the rosters were irregular and disruptive to the flight crew's sleep patterns. This adversely impacted their ability to obtain adequate sleep prior to the incident flight.

Other finding

• As the aircraft descended toward the approach minimum descent altitude one approach segment early (prior to the final approach fix), the flight crew identified the error and commenced a missed approach. At about the same time, the ground proximity alert activated.