Key points:

• Pilots took off with fog forecast and fog developing in the area
• The descent in low visibility resulted in the pilot having insufficient time to manoeuvre the balloon to climb above the trees after sighting them
• The ATSB has issued a safety recommendation to CASA to undertake a risk assessment of the reduced visibility exemption to the visual flight rules for balloons

Sixteen passengers sustained injuries, three of them serious, when their hot air balloon collided with trees and landed heavily after their pilot aborted the flight due to fog and poor visibility, an ATSB investigation report details.

The Kavanagh G-525 balloon, with a pilot and 24 passengers on board, was one of three balloons operated by the International Balloon Flight Company that launched from Peppers Creek near Pokolbin, New South Wales for a planned one-hour scenic flight on 30 March 2018.

The ATSB’s investigation found that the three pilots decided to launch despite forecast fog and developing fog at the launch site, without an awareness of the fog’s extent.

“This resulted in the balloons being above a layer of fog through which they had to descend,” said ATSB Director Transport Safety Stuart Macleod.

The descent in low-visibility conditions diminished the accident balloon pilot’s ability to see trees in the approach path, the investigation notes. This, combined with a 12 knot wind at the landing site, resulted in the pilot having insufficient time to manoeuvre the balloon to climb above the trees after sighting them.

“Adequate weather planning is essential for safe ballooning operations, including to ensure that the pilot is able to see and avoid obstacles during landing,” Mr Macleod said.

“Balloon pilots must ensure weather conditions are compatible with the limitations of balloon manoeuvrability.”

The investigation noted that the pilots’ decision to take off was permitted under a Civil Aviation Safety Authority (CASA) exemption to visual flight rules for balloons allowing them to operate in visual meteorological conditions with a minimum of 100 metres visibility below 500 feet above ground level.

“This visual flight rules exemption permits balloons to arrive and depart in foggy conditions without assurance that sufficient visibility existed to see and avoid obstacles," Mr Macleod said.

“The rule permitted the pilots to launch the balloons in the conditions experienced prior to the accident flight.”

As a consequence, the ATSB has issued a safety recommendation to CASA to undertake a risk assessment of the reduced visibility exemption to the visual flight rules for balloons, to determine whether it assures an adequate level of safety.

“The ATSB remains concerned that, given the climb performance/profile of balloons, the current visual meteorological criteria for operation below 500 feet above ground level do not provide assurance that sufficient visibility exists to see and avoid obstacles.”

However, the ATSB acknowledges and welcomes CASA’s planned publication of an advisory circular (AC) to provide guidance for balloon operators and pilots regarding weather assessment and low-visibility operations.

Mr Macleod noted that this investigation highlights that is it is vital that pilots obtain a full appreciation of the weather for the duration of the planned flight from the Bureau of Meteorology, which is the approved source of aviation meteorology products.

“Fog is fickle, and the ultimate responsibility for a pilot’s decision on whether to launch or not rests with the pilot,” he said.

“This decision needs to address factors and limitations related to the pilot, balloon, environment and operation.”

Separately, the investigation found the pilot and ground crew did not follow the operator’s emergency procedures to not move injured passengers after the accident, increasing the risk of exacerbating their injuries.

Read the final report: Controlled flight into terrain involving Kavanagh Balloons G-525, VH-HVW, Pokolbin, New South Wales, on 30 March 2018

Key points:

• Flight crew elected to return to Perth after detecting a popping or banging sound from the left engine
• Managing partial power loss a more complex scenario than a complete engine failure
• Both engines found to have erosion damage to the high pressure turbines

The flight crew of a Dash 8 turboprop airliner elected to return to Perth Airport soon after take-off after detecting a popping or banging sound from the vicinity of the left engine, an ATSB investigation report details.

The Skippers Aviation DHC-8-315 (Dash 8-300) had departed Perth Airport for the Duketon Gold Mine on 23 April 2019. Climbing through approximately 250 feet above ground level, as the landing gear was being retracted, the flight crew heard a popping or banging sound from the vicinity of the number one (left) engine and detected a reduction in power from that engine. At about the same time, the pilot flying experienced a yaw through the aircraft controls. The crew also noted a gradual reduction in right engine power.

The flight crew decided not to shut down the malfunctioning engine immediately, allowing them to concentrate on continuing the climb during a period of increased workload. Both engines responded to an increase in power, however the crew elected to return to Perth Airport, where an uneventful landing was conducted.

A subsequent inspection of both engines found erosion damage to both high pressure turbines, with the damage to the left engine more pronounced. This erosion damage likely disrupted the airflow through the left engine, inducing the symptoms reported by the crew.

The ATSB investigation report stresses that a partial power loss presents a more complex scenario to flight crew than a complete engine failure. In these circumstances the engine is still providing some power but the power may be unreliable, and that reliability may be difficult to assess.

In this case, while the affected engine appeared to return to normal operation, the flight crew remained committed to returning to the airport. Abnormal engine operation, even if only transient, can be an indication of a developing fault and therefore the safest course of action is to discontinue the flight as soon as possible.

The investigation’s safety messages note that this occurrence highlights the benefits of timely and appropriate flight crew action in response to a power loss on take-off.

Read the final report: Engine malfunction and return involving Bombardier DHC-8-315, VH-XKJ, Perth Airport, Western Australia, on 23 April 2019

Key points:

• Helicopter came into a high hover in a crosswind during a hydraulics-off training exercise
• Hovering the AS350 without hydraulics can lead to a rapid loss of control
• A detailed preflight briefing was not conducted before the flight

Hovering the AS350 Squirrel helicopter with hydraulics assistance disabled can lead to a rapid loss of control with catastrophic consequences even for highly experienced pilots, an ATSB investigation highlights.

AS350BA Squirrel helicopter registration VH-BAA was conducting an emergency procedures training flight from Hobart Airport on 7 November 2017 with a pilot under instruction (undergoing type rating endorsement training on the type) with the helicopter operator’s chief flying instructor (CFI), when it collided with the ground during a simulated hydraulic system failure exercise. The CFI, who was seated on the left, was fatally injured in the accident, while the pilot under instruction sustained serious injuries.

The helicopter was not fitted with, nor was it required to be, cockpit voice and flight data recorders, however analysis of airport CCTV footage, photographs and air traffic control data allowed the ATSB to determine the accident’s sequence of events.

That analysis showed that the helicopter entered a high hover without hydraulics with a crosswind, however, the AS350 flight manual stipulates that in order to ensure control following a hydraulic system failure (or simulated failure), a shallow approach should be made into wind and the helicopter should not enter a hover.

Entering a high hover with a crosswind rendered the helicopter uncontrollable, ATSB Director Transport Safety Mr Stuart Macleod said, with a number of elements having the potential to cause a delay in restoring hydraulics and preventing the pilots from regaining control.

”The AS350 flight manual notes that without hydraulics the helicopter is subject to rapid changes in control direction and force,” Mr Macleod said.

As detailed in the flight manual, the safe practice of a hydraulic failure sequence in the AS350 requires a flat final approach into wind and a no-hover or slow run‑on landing at a speed of around 10 knots. This is a compromise to minimise the speed of the run-on landing and avoid hovering.

“Compliance with the AS350 flight manual requirements following a real or simulated hydraulic failure ensures that the helicopter remains controllable during all phases of flight.”

The report notes that flight test evaluation of the AS350 by the Royal Australian Air Force’s Aircraft Research and Development Unit in 1997 – all three arms of the Australian Defence Force have operated the AS350 for helicopter pilot training – found that while hovering without hydraulics that the AS350 is subject to random perturbations and a reduction in control authority, Mr Macleod noted.

“This and many other similar accidents illustrate that hovering an AS350 without hydraulic assistance can lead to a rapid, catastrophic loss of control even for highly experienced pilots,” he said.

The ATSB reviewed 34 investigations of accidents involving AS350 helicopters’ hydraulic systems worldwide, Mr Macleod noted, with data indicating that loss of control accidents during simulated hydraulic failure training do occur to even highly experienced pilots.

“The average recorded experience of flight instructors involved in these events was over 9,000 hours total time, with over 1,000 hours of those on the AS350. These are very experienced helicopter pilots,” Mr Macleod said

The investigation also details that a preflight briefing was not conducted before the flight, which may have led to confusion over roles in controlling the helicopter as the emergency progressed.

“This accident’s rapid development reinforces the need for a clear understanding and coordination between instructor and student when conducting hazardous activities such as simulated system failures,” Mr Macleod said.

Subsequent to the accident the operator has undertaken a number of safety actions, including updating the training school’s operations manual with stricter controls on performing AS350 sequences in line with the flight manual requirements.

Separately, the ATSB notes that in 2019 the AS350’s manufacturer, Airbus Helicopters, released a Safety Information Notice (No. 3246-S-29) and accompanying educational video covering hydraulic failure training in the AS350. The video can be viewed on the Airbus website here(Opens in a new tab/window).

Read the final report: Loss of control and collision with terrain involving Eurocopter AS350BA, VH-BAA, Hobart Airport, Tasmania, on 7 November 2017

Key points:

• Missing nut allowed bolt to separate from bellcrank in cyclic control assembly
• Self-locking nut was likely either not reinstalled or inadequately torqued after recent overhaul
• Verbal communications are not a reliable means for capturing essential tasks over extended time periods

A self-locking nut that was likely either not reinstalled or inadequately torqued during maintenance, allowing a bolt to separate from a bellcrank in a Robinson R22’s cyclic control in-flight, resulted in the helicopter’s unrecoverable loss of control and collision with terrain, fatally injuring the pilot.

The R22 had departed Cloncurry Airport, north-west Queensland, on 2 August 2017, on a ferry flight to reposition for aerial mustering after having undergone a major overhaul. About fourteen minutes after take-off witnesses observed a plume of smoke in the general direction of the helicopter’s path. The wreckage of the R22 was subsequently located about 7 km to the north-north-west of the airport.

The ATSB’s investigation subsequently identified that a fastener – a bolt and self-locking nut – which connected the helicopter’s cyclic assembly’s horizontal push-pull tube to a bellcrank, was missing. After re-examining the helicopter wreckage, the bellcrank and a bolt, later confirmed to be from the missing fastener, were recovered from the wreckage site and examined by the ATSB.

ATSB Director Transport Safety Dr Stuart Godley said the separation of the bolt would have resulted in the main rotor disc tilting back beyond its normal operating limits and striking the tailcone.

“Different scenarios were examined for the cause of the bolt separation; however, as it was not possible for the helicopter to operate for any length of time without a nut attached to the bolt, it was likely that the nut was not reinstalled or inadequately torqued during the helicopter’s recent 2,200-hour overhaul,” Dr Godley said.

The investigation also found that the maintenance organisation had not recorded and tracked all maintenance activities for the overhaul as the work progressed over a period of almost four months.

Instead, it had adopted a number of work practices that increased the risk of memory-related errors and omissions, including using abbreviated inspection checklists, not recording all flight control disturbances, and not progressively certifying for every inspection item as the work was completed.

“This investigation highlights the limitations of verbal communication as a method of explaining and understanding problems and their unreliability as a means for capturing essential tasks over an extended time period,” Dr Godley said.

“Maintenance organisations are urged to consider the human factors elements associated with their practices, capture them in their documented quality control procedures, and ensure they are complied with.”

The investigation noted that in the weeks prior to the accident the maintenance company was experiencing a period of very high workload that likely exceeded the workforce’s capability and reduced the chief engineer's capacity to oversight maintenance activities. In addition, in the years leading up to the accident, staff changes reduced the maintenance provider’s levels of qualifications and experience.

The investigation also found the maintenance organisation had limited internal independent oversight and increased reliance on audits for the evaluation of its quality performance.

“Audits are essential for independently verifying the effectiveness of an organisation's processes and procedures. This accident reinforces the importance of auditors inspecting the evidence collected during an audit to ascertain whether the requirements are being met, specifically conformance with the relevant standards,” Dr Godley said.

“Audits may also be used to identify potential underlying human factors issues, which may be raised as an observation or opportunity for improvement to inform the auditee of best industry practices.”

Read the final report: Loss of cyclic control and in-flight break-up involving Robinson R22 helicopter, VH-HGU, 7 km north-north-west of Cloncurry Airport, Queensland, on 2 August 2017

An incident in which a rail safety worker was nearly struck by two trains within the airport tunnel near the Sydney suburb of Redfern highlights the importance of planning and controlling rail corridor worksites, an investigation details.

The rail safety worker had left the worksite in the Eastern Suburbs Railway tunnel to find a toilet. After entering an adjacent worksite at Redfern Station, the worker used the public toilets at the station but was prevented from returning to the worksite by the barricades for another worksite. The worker entered the entrance to the airport tunnel, mistakenly believing it would take them safely back to their worksite.

While in the tunnel, the worker heard a train approaching. Moving clear of the track, the worker clung to the wall of the tunnel, three seconds before train 89-K passed by at about 45km/h. Train 89-K came to an emergency stop and reported a near-miss to the area controller. The worker, meanwhile, moved past the now-stationary train, only to cross into the path of a second train, 88-C, near the mouth of the Up side of the tunnel.

The driver of 88-C also made an emergency brake application, and reported a near-miss to the area controller. The area controller began warning trains of a possible trespasser in the area, as the identity of the person was unknown.

Following the two near-misses, after finding a path to the worksite, the worker completed the shift without advising anyone of the incident until the afternoon. 

The transport safety investigation into the occurrence, undertaken by the NSW Office of Transport Safety Investigation (OTSI), on behalf of the ATSB, found that the rail safety worker had not been briefed about the other worksite, or the requirements on how to access the station. As a result, the worker entered a worksite without receiving or seeking a project site induction, left the protected area, and entered a live tunnel.

Additionally, the worker signed the project site induction record sheet, despite not being present for an induction.

In response to this incident, Sydney Trains removed the worker from safe working duties, and conducted a number of briefings following the occurrence in order to communicate lessons learned with the workgroup.

The investigation’s safety message highlights the importance of planning and controlling worksite within the rail corridor. This is particularly important when staff are working within tunnels and at platforms where access can be from multiple directions

Workers must ensure that they receive safety briefings prior to undertaking work or entering a new work area, and seek further information if required prior to starting work, the investigation notes. Workers are also advised to stop and find a safe place if they become lost or are separated from their work group.

Additionally, workers should report all safety incidents in a timely manner.

Read the final report: Near miss with rail safety worker by trains 89-K and 88-C, near Redfern, New South Wales, on 8 September 2018

A fan blade failure in an Airbus A330’s Rolls-Royce Trent 700 engine due to a fatigue crack has led to enhanced inspection processes and technical solutions that reduce the likelihood of future similar occurrences, a new ATSB investigation report details.

In June 2017, an AirAsia X Airbus A330-300 sustained an engine failure while operating a scheduled passenger flight from Perth to Kuala Lumpur. About one hour into the flight, during a step change in altitude, the flight crew heard a metallic bang, significant vibrations could be felt through the airframe, and an ‘ENG 1 STALL’ warning was triggered.

The flight crew executed the relevant engine malfunction procedure and commenced a single-engine return to Perth. While the airframe vibrations continued during the return to Perth, the aircraft landed there without further incident.

On the ground an inspection found about three quarters of one fan blade was missing from the failed left engine.

Subsequent detailed structural analysis determined that the failure of the fan blade was due to a fatigue crack which had initiated from within the blade’s internal structure where an internal reinforcing membrane joins to the blade’s convex skin panel.

Detailed structural analysis determined that the failure of the fan blade was due to a fatigue crack.

The report notes the blade manufacturing process produced a variation in the internal membrane-to-panel acute corner geometry that, in combination with the inherent high level of blade panel stress, could lead to increased localised stresses in those corner areas and the initiation and propagation of fatigue cracking.

The investigation also determined that the scheduled inspections recommended by Rolls-Royce to detect cracking in Trent 700 fan blades were insufficient to detect early onset fatigue cracks in the membrane to panel bond before those cracks could progress to failure.

Rolls-Royce have taken a number of proactive safety actions to mitigate future blade failures. These include reviewing the design and manufacturing of the Trent 700 fan blade and releasing service bulletins covering engine inspections (one of which was supported by a European Aviation Safety Agency (EASA) issued Airworthiness Directive).  

The engine manufacturer also introduced new a control system modification, designed to shut the engine down quickly when fan blade failure event occurs to reduce damage to the fan shaft. 

During the complex manufacturing process of Trent 700 fan blades, a latent issue developed that was not realised for a number of years, the investigation notes. This demonstrates the importance for manufacturers of critical components, and regulators monitoring the manufacturers, to have systems in place to quickly identify core issues and put in place measures to mitigate risk.

The report also notes that this incident represents a good example of how manufacturers, through quick and positive actions, can communicate engineering solutions and technical information to operators and maintenance providers through messages, service bulletins and service letters.

It also demonstrates how regulatory authorities can work with manufacturers and incorporate mandatory safety solutions through communications, including Airworthiness Directives.

Read the final report: Engine failure involving Airbus A330, 9M-XXE, near Carnarvon, Western Australia, on 25 June 2017

A Diamond DA40 NG light aircraft’s loss of control and collision with terrain just south of Port Macquarie Airport highlights the need to maintain aircraft control in the event of an emergency or abnormal situation, an ATSB investigation notes.

On the evening of 8 September 2017, an instructor and student were preparing to conduct the student’s first series of night circuits, with the instructor at the controls for the first take-off. At about 200 feet above the runway, the instructor observed propeller speed and engine power fluctuations that continued to increase as the aircraft climbed to 400 feet.

Recorded data would show that the engine was producing full power, however, the instructor interpreted the noise and vibrations brought on by the propeller fluctuations as a partial engine power loss and commenced a left turn, aiming to return and land on the runway in the opposite direction to the take-off.

The instructor had considered landing straight ahead but assessed that there was power available to turn and that they would be unable to see and avoid trees or to be sure to land in a suitable clearing ahead.

In the 10 seconds that the instructor was assessing and making decisions about a perceived partial power loss, the airspeed reduced from 75 to 69 knots due to the aircraft’s nose-up attitude. Then, at the same time as commencing the turn back towards the runway, the instructor reduced engine power to 30 per cent, while maintaining a nose-up attitude, and airspeed reduced rapidly.

During the turn, the aircraft stalled, resulting in a loss of control. Although the aircraft pitched down and the instructor subsequently increased power, control was not regained. The aircraft descended and collided with trees, coming to rest inverted.

The student and instructor were seriously injured, and the aircraft was destroyed.

The ATSB’s investigation into this accident found after reducing power, the instructor did not maintain adequate airspeed during the turn. This resulted in the aerodynamic stall and loss of control.

The aircraft manufacturer, Diamond Aircraft Industries, could not determine the reason for the fluctuations. Propeller speed fluctuations had occurred in other DA40 NG aircraft, and either resolved without pilot input or by moving the power lever.

“This investigation highlights three initial actions that pilots should consider to maintain aircraft control in the event of an emergency or abnormal situation, such as in this accident, which was a perceived partial power loss after take-off,” said ATSB Director Transport Safety Dr Stuart Godley.

“Firstly, lower the nose to maintain the glide speed of the aircraft, and if turning, pilots need to keep in mind an increased bank angle will increase the stall speed.  

“Secondly, maintain glide speed and assess whether the aircraft is maintaining, gaining or losing height to gauge current aircraft performance.
 
“Finally, fly the aircraft to make a landing, given the aircraft’s height and performance, and the pre-planned routes for the scenario.”

Read the final report: Loss of control and collision with terrain involving Diamond DA40, VH-YPQ, 1 km south of Port Macquarie Airport, New South Wales, on 8 September 2017

Further details of the research are included in the ATSB research report’s Avoidable Accidents No. 3 – Managing partial power loss after take-off in single-engine aircraft, as well as more information to assist pilots maintain aircraft control in the event of an emergency or abnormal situation.   

The loss of control and collision with terrain of a Bristell LSA aircraft clearly demonstrates the catastrophic consequences of conducting aerobatic flight in a non-aerobatic aircraft, without adequate training in the specialist techniques and methods required for maintaining aircraft control, a new ATSB report says.

On 5 October 2018, the pilot of the Bristell aircraft departed Moorabbin Airport, Victoria with the pilot and passenger on board for a navigation exercise in support of the pilot’s commercial pilot training requirements. After take-off, the flight headed over the northern part of Port Phillip Bay. Automatic Dependence Surveillance Broadcast data and on-board flight and GPS data showed the pilot commenced significant manoeuvres including steep climbs, descents and turns in excess of 90 ° angle of bank between 600‑1,300 ft above ground level (AGL) over a built up area west of Melbourne.

The aircraft then headed north-west until overhead Stawell Airport. Once past the airport, a number of witnesses saw the aircraft commence a 180° turn to the south-east followed by a series of steep climbs and turns and then abruptly enter an upright spin and descend out of view. The aircraft maintained the spinning descent until it impacted terrain. The pilot and passenger sustained serious injuries and the aircraft destroyed.

The ATSB investigation found that contrary to the aircraft’s limitations and the pilot’s qualifications, aerobatic manoeuvres were conducted during the flight, and immediately before the loss of control. The aircraft then experienced an accelerated aerodynamic stall and entered into an upright, fully‑developed spin. Although the pilot did not consistently apply the manufacturer’s recommended spin recovery technique, recovery from a fully‑developed spin may not have been possible in aircraft types not approved for spinning.

The ATSB safety message from the investigation emphasises that aerobatic flight should not be undertaken by pilots who are not been adequately trained, as it requires specialist techniques and methods to maintain control of the aircraft during significant manoeuvring.

In addition, pilots need to be aware that when the aircraft manufacturers stipulate flight limitations and prohibit aerobatics in their aircraft types, this means the aircraft has not been designed or tested to ensure these manoeuvres can be done safely. Related warnings, advice and instructions need to be followed.

The aircraft’s data recording system was integral in determining the magnitude of the aerobatic manoeuvres during the accident flight. They can also be a readily accessible tool for both flying training and maintenance.  

The ATSB identified that the operator had not installed an optional SD back up memory card for the aircraft’s Garmin G3X integrated instrument and avionics system. Therefore, had the avionics unit been damaged valuable data could have been lost.

Aircraft owners are encouraged to make themselves aware of the data recording capability of their aircraft and ensure that the systems are fully functioning and backing up information.

Read the report: Loss of control and collision with terrain involving BRM Aero S.R.O Bristell LSA aircraft, VH-YVX, at Stawell, Victoria, on 5 October 2018

A freight train unexpectedly encountered and entered floodwaters across a rail bridge near Tully, Queensland, highlighting the importance of weather monitoring stations at known flood locations being serviceable, a new ATSB report says.  

Intermodal Aurizon freight train 6792 had departed Cairns for Brisbane early morning on 7 March 2018, with a ‘condition affecting network’ (CAN) declared for wet weather and a requirement to run at ‘controlled speed’—requiring that the train be able to stop short of an obstruction within half the distance of clear line that was visible ahead—for a significant amount of the journey.

Approaching the Little Banyan Creek rail bridge, near Tully, the driver saw floodwater covering the bridge and immediately attempted to stop the train by applying the emergency brake. However, the train was unable to stop in the distance available, and it entered the water.

Neither of the train crew were injured, and after consulting with the network control officer and the crew’s supervisor, the driver moved the train forward at low speed through the floodwater and into Tully yard.

The ATSB investigation found that the Little Banyan Creek weather monitoring station’s water level sensor had been out of service for several weeks and could not provide a flood warning to network control to pass on to the crew. Further, a closed circuit television camera for monitoring water levels was also ineffective at night due to an out-of-service illuminator.

The investigation also found that the rail infrastructure operator, Queensland Rail (QR), did not have an effective means of ensuring that, during situations such as a CAN, network control personnel were aware of the relevant weather monitoring systems that were unserviceable. Control personnel were also not required to actively search for information about track conditions ahead of a train during situations when conditions had the realistic potential to have deteriorated since the last patrol or train had run over a section.

The investigation also identified issues with the application of the controlled speed restriction, and the management of workload during two-driver operations during a CAN.

“This investigation highlights the importance of having serviceable weather monitoring stations at known flooding locations on a rail network, and ensuring that if these systems are not functioning all relevant parties need to be aware of the defect,” said ATSB Director Transport Safety Dr Mike Walker.

“Further, operating under a CAN requires effective communication between all relevant parties. Train controllers need to ensure that all relevant information associated with the network conditions are passed to train crews and track maintenance personnel so that they can effectively perform their roles.”

Following the incident QR made improvements to its processes for ensuring the reliability of weather monitoring systems, as well as to its procedures for ensuring network control personnel were aware of any faults. It has also developed new procedures and training for network control personnel to proactively monitor network conditions when managing a CAN.

Read the final report: Collision with floodwater involving freight train 6792, Little Banyan Creek, Queensland, on 7 March 2018