Overview of the investigation

At about 2230 on 17 March 2022, an axle in the rear part of train 5WB7 broke as the train entered the yard at Casino, derailing the wagon. As the train passed through the yard it travelled over a set of points for the closed Murwillumbah Branch (set for the mainline). At this point, the derailment worsened with the rear four wagons derailing and becoming detached from the rest of the train. The train then passed through a second set of points (also set for the mainline) and came to a stop. A further four wagons at the rear of the train were derailed. A significant amount of track and signal infrastructure was damaged within Casino yard, however there were no injuries.

During the investigation, the ATSB found:

• The derailment was due to a broken axle on the 55th wagon (RKPF30311).
• The metallurgical analysis of axle concluded that the failure was due to a fatigue crack on the axle barrel. The fracture face exhibited corrosion indicating the crack had been present for an extended period. The initial cause of the fatigue crack and exact duration could not be determined with the evidence available.
• The wagon was operated and maintained by Pacific National until it was transferred to Qube on 1 January 2022.
• The journey on 17 March 2022 was the first time that the wagon (RKPF30311) had been used by Qube since the transfer. The wagon underwent a full train inspection (FX) prior to departing Port Kembla.  
• The train, wagon and axle had been inspected and maintained in accordance with both operators’ procedures.
• The in-service inspections of wheels and axles were by visual inspection as part of the full train inspection and roll-by inspection. However, the inspections were limited to the detection of large or obvious defects.
• When wheels and axles were removed from the wagon they were subjected to visual and non‑destructive testing in accordance with the operators’ procedures and relevant standards. Where damage was detected, the defect could be treated if it was below the maximum permissible defect size. Non-destructive testing was conducted to ensure the defect was removed prior to the axles being returned to service.

During the investigation, the ATSB also reviewed the following:

• the axle inspection and defect data for class E axles held by the operator
• the axle inspection process and engineering standards
• the visual and non-destructive testing process for class E axles and witnessed the inspection process
• asset handover process from Pacific National to Qube.

Reasons for the discontinuation

Based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues or important safety lessons. Consequently, the ATSB has discontinued this investigation.

In response to the incident, Qube has advised the following safety actions have been taken:

• Visual inspections and ultrasonic testing of the axles on the wagons received from Pacific National.
• Updated rolling stock maintenance manual using data from the on-wagon axle testing to provide clear standard for future axle maintenance.
• Created an axle register to ensure that all Qube axles have unique identifying numbers.
• Made representations to the Rail Industry Safety and Standards Board (RISSB), to consider strengthening the requirements of AS 7515 Axles to mandate the marking of axles with dates and sources of manufacture to align with traceability requirements of AS 7514 Wheels.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.

During a maintenance inspection of a Boeing 737-300 aircraft, registered VH-YNU, the failure of a wing spoiler cable was identified. The Civil Aviation Safety Authority (CASA) requested technical assistance from the ATSB in the examination of the cable. To facilitate this assistance, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.

The ATSB has concluded the examination of the cable, and provided the results of that work to CASA on 6 May 2022.

The Civil Aviation Safety Authority is responsible for and will administer the release of any information from the maintenance inspection. Any enquires relating to the matter should be directed to CASA at casa.gov.au.

Executive summary

What happened

On 26 February 2022, at around 1030 local time, a student pilot and instructor were conducting a low-level hover training exercise at Gold Coast Airport, Queensland, in a Robinson Helicopter R22, registered VH-THM, operated by Professional Helicopter Services. 

After around 30 seconds of stable hover just above the ground, there was a ‘bang’ through the airframe. The helicopter then pitched nose up, developed a large vibration and then yawed to the right. The instructor took over immediately and landed. There were no injuries. Subsequent inspection found that the tail rotor gearbox and empennage assembly had separated from the tailcone (boom). 

What the ATSB found

The tail rotor tip cap detached due to moisture-induced failure of the adhesive bond. Tap testing of the tail rotor blades during the most recent scheduled inspection, for the purpose of detecting adhesive failure, did not identify any disbonds that were very likely present at the time. 

The tailcone aft casting then fractured due to the detachment of the tail rotor tip cap, which led to a tail rotor imbalance and severe abnormal loading event on the casting.

What has been done as a result

Robinson released updated service bulletins and service letters in response to seeing tail rotor blades that were allowed to corrode to an unserviceable condition and receiving reports of tail rotor blade tips coming loose in service due to corrosion. Notably, Robinson released Revision A of R22 service letter SL-93 in June 2022, which required blade replacement with any evidence of bond line corrosion. The updated service letter also included inspection criteria and a minimum 10x magnification inspection of the bond line to increase the likelihood of detection. Other recommended tail rotor blade maintenance practices were also updated. 

Robinson has also identified certain part and serial number blades as being susceptible to corrosion. These blades required additional visual inspection prior to the first flight of the day, until replacement with blades that were less susceptible to corrosion. The United States Federal Aviation Administration released an airworthiness directive regarding this matter. 

Safety message

In-service detachment of a tail rotor tip cap due to adhesive failure is an uncommon event, but still presents a significant hazard to the helicopter. The resultant destructive imbalance could result in a loss of tail rotor drive and/or tail assembly. Pilots and maintainers should recognise that tap testing alone may be insufficient to detect adhesive disbonds, and that detailed visual inspection, especially for signs of corrosion around the bond line, will assist in identifying blade degradation. 

Meanwhile, pilots should ensure they are familiar with the immediate corrective actions required for the loss of tail rotor effectiveness, in accordance with the pilot operating handbook, to reduce the likelihood of a loss of helicopter control.

The occurrence

On 26 February 2022, at around 1030 local time, a student pilot and instructor were conducting a low-level hover training exercise at Gold Coast Airport, Queensland, in a Robinson Helicopter R22 registered VH-THM, operated by Professional Helicopter Services. 

Prior to commencement of the exercise, the instructor conducted a daily check of the helicopter, with no issues found. The instructor then taxied the helicopter from the helipad to the western grassed training area. The instructor reported having flown the helicopter frequently and that the helicopter felt normal, with no unusual sounds or vibrations.

After reaching the training area, the instructor handed control of the helicopter to the student to commence the hover exercise at a skid height of approximately 3–5 feet above the ground. This was the student’s fourth hover exercise and the instructor was closely guarding the flight controls against any abrupt inputs form the student. 

After around 30 seconds of stable hover, the instructor described feeling a significant jolt[1] through the airframe. The helicopter then pitched nose up, developed a large vibration and then yawed to the right. The instructor immediately took control of the helicopter, lowered the collective and closed the throttle to control the yaw. The helicopter was landed safely and there were no injuries.

Once on the ground, with the engine still running, the vibration ceased. The instructor shut down the helicopter and on inspection, identified that the tail rotor gearbox and empennage assembly had each separated from the tailcone (boom) and were reportedly located within 10 metres from the final position of the helicopter (Figure 1). The ATSB did not attend the site.

Figure 1: Proximity of separated major tail components from the helicopter

Tail rotor blades (not shown) had separated from the gearbox assembly

Source: Helicopter operator, annotated by the ATSB

Context

Aircraft information

The accident helicopter was a Robinson R22 Beta, serial number 4057, manufactured in 2006 and registered with the current operator since November 2019. The airframe had 3,355 hours at the time of the occurrence. The helicopter’s most recent maintenance was a scheduled 100-hour / annual airframe inspection that was conducted on 24 January 2022 at 3,334 airframe hours, which was 21 flight hours and 33 days prior to the occurrence. 

The tail section of the R22 comprises a tailcone assembly, through which the tail rotor drive shaft and pitch control rod passes. An aluminium casting is riveted to the skin at the end of the tailcone, and supports the tail rotor gearbox and empennage assembly. An example of the tail arrangement on another R22 helicopter is shown in Figure 2.

Figure 2: Exemplar R22 tail arrangement

Source: Archangel12, via Wikimedia Commons, annotated by the ATSB

Component history

The tailcone assembly (part number A023-23, serial number 5986), including the tailcone aft casting, was removed from another helicopter in December 2016 due to it having been dented. A repair was completed by Robinson in April 2017 and fitted to VH-THM in November 2018. The assembly had accrued 1,155 hours since the repair and fitment to VH-THM, and 2,787 hours total time in service. The tailcone assembly had a 4,400-hour service life.

The tail rotor blades (part number A029-2 Rev R, serial numbers 5802 and 5803) fitted to the helicopter had a 2,200 hour operational, or 12 year calendar, life limit. The tail rotor blades were installed as a set in November 2018, having accrued 1,155 hours on another helicopter. At the time of the occurrence the blades had 2,147 hours since new (53 hours of life remaining), and had a calendar life expiry of April 2028. The tail rotor blades had most recently been repainted in November 2020.

Component examinations

Empennage and gearbox

The separated tail rotor gearbox and empennage assembly, and tail rotor blades, were sent to the ATSB’s technical facilities in Canberra for detailed examination. 

The empennage assembly was recovered in one piece and had separated from the tailcone and gearbox due to fracture of the aft casting, part of which remained attached to the horizontal stabiliser. The inboard end of the horizontal stabiliser had sustained impact damage (Figure 3). There was no damage to any of the stabiliser extremities.

Figure 3: Empennage overview and damage

Source: ATSB

The tail rotor gearbox was firmly fastened to the remaining part of the fractured tailcone casting (Figure 4). On disassembly, there was no indication of movement or fretting[2] between the mating surfaces. The gearbox separated from the tailcone due to tearing of the skin immediately forward of the casting rivet line. 

Figure 4: Tail rotor gearbox assembly as recovered

Source: ATSB

The gearbox output shaft was bent. Both tail rotor blades were fractured and separated close to the blade root. One of the tail rotor blades was missing the tip cap, which was not found. The pitch change bellcrank support arm was fractured due to rotation of the bent output shaft.

The tail rotor drive shaft was fractured at the aft flex coupling and the tailcone push-pull tube was fractured and twisted around the driveshaft. The aft flex coupling was determined to have been assembled correctly and the flex plate had deformed and fractured due to overstress. The driveshaft flange had deformation consistent with resistance on the tail rotor side of the drive system. 

Figure 5: Fractured tail rotor aft flex coupling

Source: ATSB

Tail rotor blades

Description and examination

The tail rotor blades were Robinson part number A029-2 Rev R with serial numbers (SN) 5802 and 5803 (Figure 6). After ATSB examination, the blades were forwarded to Robinson for examination under the supervision of the United States National Transportation Safety Board (NTSB). 

Figure 6: Tail rotor blades SN 5802 and SN 5803

Source: ATSB

Deformation and scoring of the tail rotor blades matched the damage sustained to the inboard end of the horizontal stabiliser, indicating they had come into contact during the occurrence sequence (Figure 7). 

Figure 7: Rotor blade contact with horizontal stabiliser

Source: ATSB

The aluminium tip cap was bonded to the internal skin surface of the blade using an epoxy film adhesive (Solvay FM 94K) described in the datasheet as follows:

FM® 94 adhesive offers a unique combination of high temperature performance, toughness and moisture resistance as demonstrated by its ability to bond to wet Nomex® honeycomb and retention of shear properties after pre- and post-bond humidity exposure.

The tip cap of blade SN 5803 had separated. Examination and measurements of the original bonded area identified that approximately 85% was smooth, consistent with adhesive failure,[3] with some discolouration and material transfer from the missing tip cap (Figure 8). The remaining 15% exhibited a rough fracture surface indicative of cohesive failure. The NTSB reported ‘traces of yellow patches were observed across the entire surface … and under microscopic examination, when pressed, the patches expressed fluid.’ Robinson and the NTSB concluded that the tip cap detached from the blade as a result of moisture-induced adhesive failure.

Figure 8: Blade SN 5803 post-occurrence tip cap adhesive condition 

Source: ATSB

Both blades had significant erosion and thinning of the leading edge skin, particularly at the tip (Figure 9). The erosion wore completely through the skin on a small section of the leading edge on Blade SN 5802. Blade SN 5803 had a crack in the leading edge, across the tip cap bond. The heavily oxidised condition of the crack surface indicated that it was not a recent fracture and therefore pre-dated the tip cap separation. Both blades had small areas of corrosion, indicated by paint bubbles, on the blade skin adjacent to the tip cap.

During the examination, Robinson tap-tested[4] SN 5802 with the tip cap in situ and identified likely indications of voids or disbonding ‘mid-span’ along the tip cap bond line.[5] Disassembly of the blade revealed some regions of adhesive failure, appearing to be predominantly progressing towards the blade root from around the circumference of the bond line, amounting to about 30% of the original bond area (Figure 10). 

Figure 9: Tail rotor blade leading edges, showing paint loss, erosion and skin cracking 

Source: ATSB

Figure 10: Blade SN 5802 adhesive failure

The other side of the bond exhibited similar visual characteristics.

Source: Robinson Helicopter Company, annotated by the ATSB

Maintenance requirements

Chapter 2 of the R22 maintenance manual contained a 100-hourly inspection procedure and checklist, which stated:

Tail Rotor Blades: Inspect condition. Refer to § 9.220 for damage limitations…Verify blade tip drain holes (2 per A029-1 blade, 1 per A029-2 blade) are unobstructed. Verify no corrosion. Tap test bonded areas per § 26-44.

Tap testing structures involves lightly tapping an item of specific size, weight and material (often a coin or washer) along the length of a bonded structure and listening for changes in the acoustic response. Areas of delamination or disbond will sound hollow in comparison to a solid structure. A video illustrating a tap test was published by Robinson, at https://www.robinsonheli.com/media.

The 100-hourly inspection procedure and checklist was completed at the 24 January 2022 inspection, with no defects recorded.

Chapter 9, section 9.220 of the helicopter’s maintenance manual detailed inspection and repair limits for tail rotor dents, nicks, scratches and corrosion. Blades were required to be replaced where erosion caused deformation or ripples in the leading edge. The section contained a procedure for re-painting the blades, but not a specific limit or requirement for repainting due to general wear. The tail rotor blade description under section 9.000 stated that ‘Maintaining the paint finish will reduce corrosion and erosion.’ The service letter, SL-93, similarly stated: ‘Paint offers the best protection against leading edge corrosion’ and the ‘preferred blade condition is with a fully painted leading edge’.

Section 26-44 of the maintenance manual detailed void limits during detection by tap testing of main rotor blades and referenced ‘critical’, ‘semi-critical’ and ‘non-critical’ blade bond areas. There were no tail rotor blade void limits given. The maintainer of the occurrence tail rotor blades indicated they had extensive experience in tap testing and had previously identified disbonds in other manufacturer’s rotor blades.

Robinson also published R22 service letter SL-93 in June 2021, the background for which stated:

RHC [Robinson] has recently seen tail rotor blades that were allowed to corrode to an unserviceable condition including severe leading edge pitting and degradation of the bond at the tip cap. Regular preventive maintenance is imperative for continued safe operation and additional care may be required in corrosive environments such as coastal or shipboard operations. 

The service letter recommended practices included removal of any corrosion by hand sanding and instructed to ‘remove only material necessary to eliminate corrosion; any hole that completely penetrates blade skin requires blade replacement.’ The service letter also reinforced the maintenance manual requirement for tap testing of the blades to ‘verify bond integrity’.

Tailcone aft casting 

The two separated pieces of the fractured tailcone casting remained secured to the horizontal stabiliser and tailcone skin/gearbox respectively (Figure 11). There were no visible part or serial numbers. 

Figure 11: Aft tailcone casting fracture, empennage side (left) and tailcone side (right)

Darkened regions on the fracture surface were considered to be due to gearbox oil migration.

Source: ATSB

The casting was manufactured from A356.0-T6[6] aluminium alloy. Chemical analysis and hardness of the occurrence casting material found these characteristics to be in accordance with the alloy standard.

Visually and under low magnification optical microscopy, the casting fracture surface had irregular and faceted, brittle fracture features. There was evidence of localised deformation from contact between the two halves of the fractured bulkhead and as a result of impact with the adjacent pitch‑change push-pull tube. Microstructural analysis showed that the casting was unmodified,[7] and the faceted fracture surface was the result of the presence of coarse, plate-like silicon eutectic constituents in the alloy. Unmodified A356 crack growth studies have found that, at higher stress intensities, crack progression tends to follow the silicon particle orientation, which therefore dominates the fracture surface, producing the faceted fracture features observed in the occurrence sample.

At high magnification using a scanning electron microscope (SEM), there were several areas of minor shrinkage porosity and non-metallic inclusions that were generally to be expected for this type of casting. There were also some very minor striated areas that appeared consistent with high-cycle cracking. However, none of the defects observed were considered significant enough to have meaningfully contributed to the casting fracture. 

To more fully characterise the fracture surface of this type of unmodified cast aluminium alloy, the ATSB conducted some laboratory fractures and the Defence Science and Technology Group (DSTG) conducted fatigue testing on the casting alloy for comparison (Appendix A).

Adhesive bond failures

Failure types comprise adhesive, cohesive, and mixed failures (Petrie 2000):

Adhesive failure is an interfacial bond failure between the adhesive and the adherend [bonded surface]. Cohesive failure could exist within either the adhesive material or the adherend. Cohesive failure of the adhesive occurs when stress fracture within the adhesive material allows a layer of adhesive to remain on both substrates (i.e., the attachment of the adhesive to the substrate is stronger than the internal strength of the adhesive itself, and the adhesive fails within its bulk). When the adherend fails before the adhesive and the joint area remains intact, it is known as a cohesive failure of the adherend.

An illustration of cohesive, adhesive, and mixed failure types is provided in Figure 12. 

Figure 12: Cohesive and adhesive failures

Source: Petrie (2000), modified by the ATSB

Moisture can affect the strength of an adhesive bond. This failure mechanism involves water diffusing through the adhesive, through the interface between the adhesive and adherend and/or through cracks or defects in the adhesive or adherend layers. The absorbed water molecules degrade the interface by deteriorating secondary bonds between the adhesive and adherend, or by weakening the oxide layer of the aluminium substrate.

Related occurrences

R44 in flight break-up

On 4 July 2020 a Robinson R44 Raven I helicopter, VH-NBY, experienced an in-flight break-up shortly after takeoff, 3 km north of Broome Airport, Western Australia. As with VH-THM, the tailcone aft casting failed, but there was no tail rotor blade failure (ATSB investigation AO‑2020‑033). 

R22 tail rotor failure

The US National Transportation Safety Board investigated (ERA22LA340) a July 2022 accident involving an instructional flight in a Robinson R22 helicopter that collided with terrain. The instructor reported hearing a popping and banging sound, followed by an uncommanded right yaw, and subsequent collision with terrain.

The investigation report stated:

Postaccident examination of the helicopter revealed that the tail rotor gearbox had fractured and that the tail rotor assembly had separated from the helicopter. Additional examination of the tail rotor blades, which had remained attached to the tail rotor drive shaft and gearbox, revealed corrosion and interior delamination of the blades. There was also erosion present on the blade leading edges, which likely provided a path for moisture to ingress, thereby resulting in the observed corrosion as well the failure of the bonding adhesive within the blade. It is likely that this condition resulted in an imbalance of the blades that imparted a vibratory loading onto the tail rotor gearbox that ultimately resulted in its failure during the accident flight. Review of partial maintenance records provided by the operator revealed that the tail rotor blades installed on the accident helicopter were not the blades that were noted in the maintenance logbooks, and the service history of the installed blades could not be determined.

Robinson tail rotor tip cap separations

R44 tail rotor tip cap separation

A March 2022 occurrence involving an R44 tail rotor tip cap separation was reported through the Civil Aviation Safety Authority’s (CASA’s) defect reporting system (the location was not provided). 

The tip cap separated from rotating tail rotor blade shortly after landing and the resulting vibration fractured the tail rotor gearbox input cartridge mounting flange, as shown in Figure 13. Internal corrosion at the tip bond area was attributed to a disbond (per the mechanism described in R22 SB-120 and the R44 equivalent, SB-112). The R44 part number C029-3 tail rotor blades were similar in construction to the R22 A029-2 blades, and these reportedly had 1,806 hours since new.

The submitted report advised that tap testing of the bonded area at the most recent inspection gave no indication of disbonding. During subsequent experiments the separated tip was loosely re-fitted to the blade and another tap test carried out. The reporter stated that there was no discernible difference between the sound response of the blade with the refitted, but not bonded, tip and that of a new blade. Additionally, while there was evidence of leading-edge erosion on the blade, the reporter indicated there was no corrosion discernible under external visual examination. 

The ATSB did not examine the subject blade or tip cap. The supplied images indicated minor rough or bubbled paint on the exterior surface, mid-span, adjacent to the bond line, which may have been indicative of underlying corrosion.

Figure 13: R44 tip cap separation and resultant gearbox mount fracture

Source: Civil Aviation Safety Authority, modified by the ATSB

Other tail rotor tip cap separation occurrences 

A 2024 United States Federal Aviation Administration airworthiness directive (AD 2024–04–02) was prompted by 3 reports[8] of tail rotor blade tip caps coming loose due to corrosion at the bond in R44 helicopters (which have similar tip caps). A search of the Civil Aviation Safety Authority and Federal Aviation Administration defect reporting systems did not identify any other reports of tip caps separating on Robinson R22 or R44 helicopters.

Safety analysis

Failure sequence

The normal proximity of the tail rotor blades to the point of impact with the horizontal stabiliser meant that contact was only possible if the empennage assembly separated. The remaining damage to the tail rotor drive system was the result of the tail rotor strike on the stabiliser. Separation of the empennage assembly in this manner was due to fracture of the tailcone casting.

Detailed fractographic analysis of the tailcone casting found that the fracture was the result of a high applied stress intensity, and identified no significant defects that would have resulted in fracture during normal operation. As such, the casting was most likely subjected to abnormal loading conditions around the time of the occurrence. 

Aside from the tail rotor tip cap detachment, there was no evidence of an operational event or issue with the helicopter tail or tail rotor drive system that might have resulted in abnormal loading of the tail assembly. Consistent with Robinson service bulletin advice, in-flight detachment of the tip cap would have caused severe vibration. This would have been in the form of immediate, and relatively high frequency and high amplitude loading leading to rapid fracture of the low-ductility casting. That is, the tip cap detachment and resulting imbalance led to the empennage separation. 

The failures occurred with the helicopter in a low hover. Nevertheless, the instructor’s quick and appropriate actions were effective in preventing a more serious outcome.

Tail rotor tip cap adhesive failure

The condition of the residual adhesive at the tail rotor tip cap was consistent with adhesive failure over approximately 85% of the original bonded area. With normal forces acting on it at the time of the occurrence, reduced bond effectiveness is the only reasonable explanation for the tip cap to separate in this case.

Given the nature of the failure and the presence of the fluid patches (likely water) in the bond of blade 5803 it is likely that this adhesive failure was associated with the presence of moisture. While both blades exhibited adhesive failure, there was a marked difference in the residual cohesive failure area, indicating a more rapid degradation in blade 5803. The tail rotor blades were installed as a set and, to the extent that could be determined, had experienced the same operational life and environmental conditions. This was consistent with the blades exhibiting a similar degree of erosion and pitting of the leading edge. 

The leading-edge skin crack was almost certainly related to the significant erosion and pitting, and the condition of the crack showed that it existed prior to the tip cap separation. As such, it would have provided a moisture pathway to the adhesive bond, in addition to attack around the circumference of the bond line. This probably contributed to the differing extent of disbonding between the cracked blade and the opposing blade. However, it is noted that the reported tip cap separation involving an R44 had no evidence of blade skin cracking, showing that cracking was not necessarily a prerequisite for adhesive failure of the tip cap bond.

The resistance of adhesive bonds to moisture attack relies primarily on appropriate preparation of the substrate. While there were no identified manufacturing anomalies, it was possible that there were small differences in the bonding preparation between the two blades. However, given the very low incidence of this type of occurrence, it is unlikely that the manufacturing process was problematic or that the life limit was inappropriate.  

Maintenance inspections

Defence against detachment of the tail rotor tip cap involved visual inspections of external blade condition and tap testing of the bond area. The extent of adhesive failure at the detached blade tip indicated that a significant disbond likely existed at the time of the most recent maintenance inspection, 21 flight hours prior to the occurrence. However, there were no recorded defects or indications of disbond from tap testing that, per the R22 service letter SL-93, was for the purpose of verifying bond integrity.  

Tap testing is perhaps the simplest and most inexpensive method for non-destructive inspection of adhesive bond integrity. However, the test has limitations. Tap testing relies on operator judgement in identifying differences in acoustic responses while consistently tapping along a bond area. To produce a change in pitch, there needs to be an underlying structural difference associated with the bond. Unbonded substrates maintaining good contact with the adhesive, or as in this case, bonds with extensive adhesive failure may not produce a clear acoustic difference.

The reason disbond indications were not detected by tap testing in this occurrence was not explored in detail, however the limited examples in this report highlight some of the variability and limitations of tap testing to accurately assess adhesive bond integrity: 

• The maintainer of the occurrence blade indicated they had extensive experience in tap testing and had previously identified disbonds in other manufacturer’s rotor blades. This indicates a degree of success with the test method, but not necessarily with the subject blades.
• Tap testing of the opposite blade by Robinson, under ideal conditions during their blade inspection, identified some likely disbonds ‘mid-span’ (although Robinson did not attempt to determine the extent of the disbonds that were later found to be present around most of the tip circumference).
• The reporter of an R44 tip cap detachment occurrence stated that their tap testing during the most recent maintenance inspection did not produce indications of disbonding. They could not subsequently identify an acoustic difference between the blade with the detached tip (after refitment) and a new blade. 

Visual examination of the external blade condition for damage and corrosion cannot provide a direct indication of adhesive bond integrity, but may provide an indication of potential underlying conditions that could lead to in-service failure. For example, the occurrence blades, the blade from the NTSB tail rotor failure investigation, and potentially the R44 occurrence mentioned above had indications of corrosion adjacent to the tip cap bond line. The visible bond line corrosion could extend to the adjacent bond or be indicative of exposure to conditions that increase the risk of adhesive failure. 

At the time of the occurrence, detection of blade corrosion did not require blade replacement, unless it exceeded the depth limits in the R22 maintenance manual, or per SL93, for ‘any hole that completely penetrates blade skin’. Had the corrosion been identified and removed in accordance with this procedure, the tip cap separation would likely still have occurred. In contrast, identification of the leading-edge crack would have necessitated blade replacement. However, the blade skin had deformed and the crack opened up during the tip separation. As such, it wasn’t possible to establish how the crack would have initially presented and whether it would have been readily identifiable under unaided visual inspection.  

Findings

From the evidence available, the following findings are made with respect to the in-flight tail rotor blade failure and tail assembly separation involving Robinson R22, VH-THM, at Gold Coast Airport, Queensland on 26 February 2022. 

Contributing factors

• In-flight detachment of a tail rotor blade tip cap led to abnormal dynamic loading within the tail rotor assembly, fracture of the aft tailcone bulkhead and separation of the empennage.
• The tail rotor blade tip cap bond had a significant proportion of moisture-induced adhesive failure that reduced the bond strength resulting in the in-flight detachment from the tail rotor blade.
• The scheduled maintenance inspection, including tap testing of the tail rotor blades, 21 flight hours prior to the occurrence, did not identify adhesive disbonding that was very likely present at the tip cap bond line of both blades.

Safety issues and actions

Safety action not associated with an identified safety issue

Safety action by Robinson Helicopter Company

On 3 June 2022, RHC published revision ‘A’ of R22 Service Letter SL‑93, R44 Service Letter SL‑82,and R66 Service Letter SL‑40, on the subject of tail rotor blade condition and care. The original service letter was published on 30 June 2021. The background to the service letter stated:

RHC has recently seen tail rotor blades that were allowed to corrode to an unserviceable condition including severe leading edge pitting and degradation of the bond at the tip cap. Regular preventive maintenance is imperative for continued safe operation and additional care may be required in corrosive environments such as coastal or shipboard operations. Recommended practices to prevent and mitigate the effects of corrosion are provided below. Revision A adds inspection criteria.

Revision A corrosion inspection criteria included using 10x magnification to inspect adjacent to the tip cap bond line for the presence of adhesive and absence of corrosion. Blades were required to be replaced if there was any corrosion at the bond line or if there were any gaps in the bond line adhesive.

On 22 December 2022 RHC published revision A of R22 Service Bulletin SB–120, R44 Service bulletin SB–112, and R66 Service Bulletin SB–41. The background to the service bulletin stated:

RHC has received reports of tail rotor blade tips coming loose due to corrosion at the bond. Helicopters operating near saltwater are particularly susceptible to corrosion, especially if stored outdoors. A debonded tip can cause severe vibration and possible failure of the tail rotor gearbox housing. 

The service bulletin listed the affected blade part and serial numbers that have been deemed susceptible to corrosion and provided a recurrent visual inspection to be inserted into the pilot’s operating handbook and carried out before the first flight of the day. Any indications of corrosion or exposure at or adjected to the tip cap bond line required compliance with SL-93 before further flight. The susceptible blades were required to be replaced no later than 31 December 2024, noting that:

Helicopters operated and/or stored outdoors in corrosive environments such as salt water coastlines should replace affected blades as soon as practical.

The bulletin indicated that newer revision blades had tip caps manufactured from an alternate alloy to reduce the likelihood of corrosion. 

Safety action by United States Federal Aviation Administration

The United States Federal Aviation Administration (FAA) issued airworthiness directive AD 2024‑04‑02, effective from 2 April 2024, relating to tail rotor blades on Robinson helicopters, due to 3 reports of tip caps coming loose due to corrosion at the bond in R44 helicopters (which have similar tail rotor blade tip caps). The summary statement stated:

The FAA is adopting a new airworthiness directive (AD) for certain Robinson Helicopter Company Model R22, R22 Alpha, R22 Beta, R22 Mariner, R44, R44 II, and R66 helicopters. This AD was prompted by reports of helicopters losing a tail rotor blade (TRB) tip cap. This AD requires visually checking and inspecting certain part-numbered and serial-numbered TRB tip caps for evidence of corrosion and, depending on the results, removing the corrosion. This AD also requires removing all affected TRBs from service and prohibits installing them on any helicopter. The FAA is issuing this AD to address the unsafe condition on these products.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the instructor for the occurrence flight
• Professional Helicopter Services
• Robinson Helicopter Company and
• the maintenance organisation for VH-THM. 

References

Petrie, Edward M. (2000). Handbook of Adhesives and Sealants. McGraw-Hill, New York.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the instructor for the occurrence flight
• Professional Helicopter Services
• Robinson Helicopter Company
• the maintenance organisation for VH-THM
• the Civil Aviation Safety Authority

Submissions were received from the Robinson Helicopter Company.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A – Metallurgical examination and testing of the fractured tailcone aft casting

Casting material

The as-cast A356 microstructure primarily consists of a hard, brittle, plate-like silicon eutectic[9] constituent in an aluminium matrix. In the unmodified[10], as-cast state, the silicon phase is brittle and has a coarse, plate-like morphology, leading to a low ductility material. Alloy modification and heat treatment is often employed to improve the ductility and toughness of the material.

Fractography

General fracture characteristics

The scanning electron microscope (SEM) examination of the tailcone aft casting fracture identified a general brittle fracture surface dominated by irregularly shaped silicon plates within an aluminium matrix (Figure 14). The brittle fracture features were consistent with a metallographic section perpendicular that showed the jagged fracture path preferentially followed the line of silicon plates in the alloy microstructure. A metallurgical examination identified that the microstructure of the aft bulkhead was consistent with unmodified A356 (Figure 15).

Figure 14: SEM micrograph showing the general casting fracture surface morphology 

Source: ATSB

Figure 15: Microstructural cross section of unmodified A356, showing silicon eutectic (grey) in an aluminium matrix (white) 

Source: ATSB

Fracture surface striations

Isolated areas of aluminium matrix with vague parallel features, or striations, were present across the fracture surface (Figure 16). Some of the features were determined to be mechanical damage due to local contact between the crack or fracture halves and/or related to fracture or decohesion[11] of the silicon eutectic particles. 

For comparison, a section of the casting was subjected to a monotonic (single impact) fracture. At low magnification, the fracture surface appeared similar in appearance to that of the occurrence fracture. However, at high magnification there were areas of well-defined, micro-dimpled rupture in the matrix (Figure 17) that were not observed on the occurrence fracture. The dimples were determined to be characteristic of unstable crack growth or ‘fast fracture’ under tensile loading. 

Further examination of the occurrence casting identified localised areas of very fine striations near the part surface or an area of shrinkage porosity, that were more representative of high cycle fatigue crack progression (Figure 18). There were no gross material or manufacturing defects observed on the fracture surface and the total combined defect area was relatively low in comparison to similar castings examined (from other Robinson helicopters). The larger of these defects were located immediately below the part surface and were in the order of 1 mm across the principal axis on the fracture surface (Figure 19). The fracture surface immediately surrounding some of these defects was noticeably flatter and also exhibited similar striation-like features in area of aluminium matrix. The reason for the striations or cracking was not determined, however, the areas affected were too small to have had any meaningful influence on the casting fracture. 

Figure 16: Occurrence fracture surface ‘striated’ matrix

Source: ATSB

Figure 17: Monotonic fracture surface showing micro-dimpled rupture

Source: ATSB

Figure 18: Discrete area of striations identified on the fracture surface 

Source: ATSB

Figure 19: SEM micrograph of an example defect in the aft bulkhead fracture surface where subsurface shrinkage porosity was identified

Source: ATSB

Fatigue testing of the casting alloy

High-cycle and low-cycle fatigue tests were conducted on a representative sample[12] of A356 material by the Defence Science and Technology Group (DSTG) at the request of the ATSB to allow further fractographic characterisation and comparison with the occurrence casting. The specimens were tested to failure in a tension-tension test regime (Table 1, Table 2, Table 3, and Table 4).

Table 1: High cycle fatigue testing specimen geometry

Table 2: High cycle fatigue testing parameters

Table 3: Low cycle fatigue testing specimen geometry

Table 4: Low cycle fatigue testing parameters

Cracks initiated in both specimens at subsurface porosity at one corner of the specimen. Both specimens showed a defined, relatively flat, cleavage-type crack origin and initial crack progression region, with clear chevrons, river lines and striation features, clearest in the high-cycle fatigue specimen (Figure 20). This transitioned to an increased prevalence of the faceted, silicon particle-dominated, fracture surface and micro-dimpled rupture through the unstable crack growth and overstress regions. There was no similar significant area of cleavage fracture on the occurrence fracture surface.

Figure 20: High-cycle fatigue specimen fracture origin

Source: ATSB

Discussion

A review of fatigue crack growth studies showed that that the mechanism of crack progression through unmodified A356 alloy was dependent on the particle morphology and orientation, as well as the applied stress intensity. At low stress intensities, the plate-like silicon particles debond from the matrix unless their principal axis was oriented perpendicular to the crack plane. The result was a flatter, cleavage-type fracture, such as that exhibited by the initiation region of the high cycle fatigue test specimen. At higher stress intensities, particle fracture was found to dominate and the fracture surface produced was more faceted, with the crack path following the orientation of the silicon particles. Based on this, while there were discrete areas representative of the former mechanism, the dominant appearance of the occurrence fracture was consistent with a higher applied stress intensity. 

While there were some minor casting defects in this occurrence, there were no significant material, manufacturing or operational anomalies identified that would have abnormally predisposed the part to fracture, beyond other similar castings. 

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On 11 January 2022, a Robinson Helicopter Company R22 Beta helicopter with registration VH‑VHE, was participating in a mustering operation south-west of Mitchell, Queensland. At approximately 1015, 25 minutes into the second mustering flight of the day, the pilot heard a ‘pop’ and a ‘crack’ and experienced a significant uncommanded yaw and abnormal vibration. The pilot completed a forced landing from an altitude of approximately 3 to 5 metres, shut down the engine and inspected the helicopter; identifying that the tail rotor drive shaft had fractured.

What the ATSB found

The ATSB found that the intake valve in the engine’s number-four cylinder sustained thermal damage, which led to reduced engine performance and required the pilot to conduct a forced landing. During the forced landing, for reasons that could not be determined, the tail rotor drive shaft fractured as a result of torsional overstress.

In addition, an unapproved modification was present on the leading edge of the tail rotor blades, although this probably had no influence on the occurrence.

Safety message

This occurrence illustrates the potential seriousness of unexpected yaw and reduced engine performance during flight. These characteristics in piston engine helicopters may be symptomatic of developing engine intake valve damage. If this condition remains unattended it can lead to an increased risk of induction backfire events and significant loss of engine power.

When a loss of engine power or abnormal operation is encountered, an appropriately‑licensed maintenance engineer should complete an engine cylinder inspection in accordance with the helicopter and engine manufacturer’s requirements before further flight.

There is an opportunity to improve the understanding of engine intake valve issues with better quality data. Maintenance organisations are therefore encouraged to follow the Civil Aviation Safety Authority (CASA) recommendation for borescope inspections of valves and report any defects or nil-defect findings.

The investigation

The occurrence

On 11 January 2022, a Robinson Helicopter Company (RHC) R22 Beta helicopter, registered VH‑VHE and operated by Diamond T Helicopters, was participating in a mustering operation south‑west of Mitchell, Queensland. The pilot was the only person on board.

Prior to the first flight of the day, the pilot prepared the helicopter for operation and completed pre‑flight checks, with no anomalies observed. The pilot then performed a stabilised hover check[1] and conducted a 1.1 hour positioning flight to the mustering location, departing at 0530 Eastern Standard Time.[2] After shutting down, the pilot then refuelled the helicopter and completed the first mustering flight, which took 2.5 hours. The pilot shut down the helicopter and again refuelled. Both flights were reported to be free from incident or abnormalities.

At about 0950, the pilot commenced a second mustering flight. About 25 minutes into the flight, the pilot heard a ‘pop’ and a ‘crack’, then experienced a significant uncommanded yaw[3] and abnormal vibration. The pilot conducted a forced landing, with a degree of pedal control, from height of 10 to 15 ft above ground level. As the skids touched the ground, the pilot heard another ‘crack’ and felt the helicopter go ‘into a spin’. 

The pilot remained in the helicopter while completing shut down, including waiting for the cylinder head temperature to reduce. Inspection following shut down revealed that the tail rotor drive shaft was fractured. 

Subsequent technical inspection by the maintenance organisation revealed that the number-four cylinder could not hold the required pressure and the intake valve had significant thermal damage and guttering[4] (see the section titled Context - Examination by maintenance organisation).

Context

Examination by maintenance organisation

The helicopter was examined by a maintenance organisation who initially identified the following:

• the tail rotor drive shaft had fractured approximately 5 mm forward of the rear flange weld (Figure 1 and Figure 2)
• rotational scoring was present on the internal surface of the tailcone adjacent to the fracture location
• the tail rotor blade surfaces were free from evidence of foreign object damage, and the skid tube (shown schematically in Figure 1) was free from contact indications
• there was erosion on the leading-edge of the main rotor blades and the tail rotor blades
• epoxy additions were present on the tip of the leading-edge of the tail rotor blades (Figure 3), which were reportedly applied to increase blade wear resistance.

Figure 1: Tail rotor drive shaft fracture location

The fracture location is approximately 5mm forward of the rear flange weld. 

Source: Robinson Helicopter Company, annotated by the ATSB

Figure 2: Fractured tail rotor drive shaft 

The fracture shows significant plastic deformation. The corrosion product was not present at time of the occurrence.

Source: ATSB

Figure 3: Tail rotor blade leading edge erosion and blade modification

Both tail rotor blades exhibited erosion and a leading-edge tip modification. There was no indication consistent with a strike to either tail rotor blade.

Source: Maintenance organisation, annotated by the ATSB

During the post-occurrence inspection of the engine, maintenance engineers identified that the number-four cylinder was unable to hold pressure when subjected to a hot-compression check. The maintenance organisation removed the cylinder and, on further inspection, identified thermal damage and guttering to the intake valve (Figure 4). The bottom of the valve exhibited an asymmetric burn pattern, which was evidence of severe and uneven heating. The guttering present on the valve face provided a gas leakage path between the cylinder and the intake manifold.

Figure 4: Damaged engine intake valve from number-four cylinder 

The asymmetric burn pattern on bottom on valve is evidence of severe and uneven heating. The valve face guttering is a leakage path between the cylinder and the intake manifold. The valve was ground by the maintenance organisation, following removal, to ‘clean’ the face to enhance the appearance of the thermal damage. The appearance of the face immediately following the occurrence was not recorded.

Source: ATSB

The maintenance organisation inspected the drive train components, and observed that:

• the intermediate flex plate was undamaged
• the tail rotor gearbox chip detector was free from debris and the gearbox oil was clear
• the clutch assembly operated without defect or roughness, and the lubricating fluid was free from contaminants or fragments.

ATSB technical examination

Additional examination of the damaged number-four cylinder intake valve, tail rotor gearbox, and the fractured tail rotor drive shaft was completed at the ATSB’s technical facilities. 

The ATSB examination found:

• confirmation of the thermal damage and guttering on the intake valve[5] 
• correct assembly of the tail rotor drive shaft to the gear box yoke connection 
• no anomalies with the gearbox bevel gears and bearings that could have restricted movement of the drive shaft were identified
• the turning resistance of the tail rotor gear box was consistent with manufacturer's advice. 

The direction of the torsional deformation of the driveshaft was indicative of either drag on the tail rotor assembly or over-torque from the driving side of the failure location. 

Examination at high magnification, using both an optical and scanning electron microscope, of the mating fracture surfaces of the drive shaft revealed only gross ductile overstress features. A polished and etched cross section, and hardness measurements taken through the weld connecting the shaft to the flange, found the weld to be heat-relieved, which was consistent with the manufacture’s specifications. Energy dispersive spectroscopic analysis found the composition of the alloy to also be consistent with the manufacturer’s specifications. 

There were no pre-existing defects identified from manufacture, or operational damage such as surface scoring, fatigue cracking, denting, or corrosion that might have otherwise weakened the shaft and predisposed it to fracture.

Operational and maintenance history

VH-VHE was manufactured by the Robinson Helicopter Company (RHC) in 2010 and first registered in Australia in the same year. The helicopter was powered by a Lycoming Engines (Lycoming) four-cylinder O-360-J2A engine. The helicopter had accumulated 2,135.5 hours total time in service. 

The helicopter was overhauled in August 2021 and new Lycoming engine cylinder kits[6] were fitted at that time. The pilot stated that the engine seemed underpowered, when compared with engine power prior to the overhaul. The tail rotor drive shaft was also replaced with a new item at the overhaul.[7] 

The next 100-hourly scheduled inspection (75.7 hours following overhaul),[8] included compression checks[9], service limitations for valves checks,[10] and valve guide condition checks.[11] The compression checks found inadequate compression in the number-two and number-three cylinders, and the cylinders were reconditioned. At this inspection, the number‑four cylinder recorded adequate compression (78/80 pounds per square inch). The pilot stated that the power was improved following this inspection and cylinder reconditioning; however, was still underpowered compared with prior to the overhaul. The maintenance organisation did not perform, nor was there a requirement for them to perform, borescope inspection of the valve faces.

The helicopter accrued 93.3 hours in service from overhaul to the occurrence flight. The pilot reported that they did not observe any adverse indications or unusual behaviour of the engine, such as rough running, yawing, or backfiring during the numerous flights leading up to the occurrence. 

The maintenance organisation had a practise of applying epoxy to the leading edge, adjacent to the tips, of the tail rotor blades to extend the interval between re-painting. The epoxy was applied to the blades at the first instance re-painting was required. The maintenance organisation described the modification as 

• common practise in rural operations 
• low mass
• inspected during scheduled maintenance
• checked for balance, as part of blade balancing, following their addition and/or repainting. 

The maintenance organisation did not observe a change in the condition of the epoxy after the occurrence, except that the paint had eroded. 

Manufacturers’ advice in response to the occurrence

The ATSB sought comment from Lycoming regarding the condition of the damaged intake valve and the acceptable compression check result for the number-four cylinder, which occurred 17.6 hours prior to the occurrence. However, no advice was received at the time of writing. 

With regards to the subject occurrence, RHC advised that the VH-VHE tail rotor drive shaft fracture was consistent with a tail rotor strike, described as anything that creates a sudden resistance or drag to the tail rotor blade(s). They went on to state that a strike does not always result in damage to the blades, nor always leave an identifiable residue. The location of the tail rotor drive shaft fracture, in the event of a strike, can vary, but the fracture location in this occurrence would not be unusual for a strike. 

ATSB investigation AO-2021-008 (see the section titled Other occurrences - Tail rotor drive shaft fracture) had similarities to this occurrence. Consequently, the ATSB asked RHC whether there could be causal link between the engine response to intake valve failure, the instinctive pilot control inputs, the landing, and fracture of the tail rotor drive shaft. RHC stated that in the event of a sudden power loss followed by an instant increase in power, the input spike could distort the tail rotor drive shaft, possibly to the extent of twisting the shaft, provided that the contributing circumstances were extreme.

RHC also advised that the epoxy blade modifications were unapproved and would prevent inspection of the blade surface for cracking or corrosion. In addition, RHC stated that a helicopter could experience a more catastrophic consequence of the blade modification if an out-of-balance condition developed, possibly resulting in the loss of the entire empennage. 

Other occurrences

Cylinder head inlet valve distress

In 2019, prompted by increasing industry reports of engine issues involving RHC R22 and R44 helicopters, the Australian Helicopter Industry Association (AHIA) released an independent industry-supported investigation into durability issues affecting Lycoming O-320, O-360, and 
O-540 engines, fitted to RHC R22 and R44 models.[12] The report identified that poor operational durability of intake valves was principally due to accelerated valve, valve guide, and/or valve seat wear. The investigation further stated that these durability issues lead to a loss of cylinder compression and the potential for partial power loss events. The valve damage could result in an induction backfire, engine power loss, and airframe yaw. No one factor was identified as the reason for the accelerated intake valve wear. The report recommended helicopter operators remain vigilant of the issues outlined within the AHIA report and ensure they continue to follow best-practice operation and maintenance protocols.

In October 2020, RHC issued a Safety Alert in response to reports of burned engine intake valves in their R44 model helicopters.[13]^, [14] The Safety Alert listed three precautions for pilots to follow:

• Perform a complete run up and stabilized hover check prior to every flight. Do not initiate flight if there is any indication of engine roughness or sudden yaw.
• If engine roughness or sudden yaw occurs in flight, land as soon as practical and be prepared to land immediately.
• Following any engine roughness or sudden yaw, have a mechanic check valve condition before further flight. The mechanic should listen for sound of leakage at each intake valve while performing a compression check. Any intake vale with audible leakage requires repair prior to further flight. Check may be done with engine hot or cold.

Subsequently, Lycoming released a service instruction to collect early-life intake valve in-service data for the same RHC R44 models covered in the RHC Safety Alert to further understand the engine durability issues.[15] The ATSB asked Lycoming whether the collected data had revealed any safety relevant information data. At the time of writing, no response had been received, although it was also noted that R22 models were not included in this safety instruction. 

In July 2021, Lycoming published a service instruction allowing for the incorporation of rotator-type intake valves into O-360-J2A model engines[16] (the engine model fitted to VH-VHE) to improve valve seating and minimise compression loss at the intake valve seat. Valve rotation is known to improve face and seat wear distribution and cleaning. This optional modification had not been installed on VH-VHE.

The most recent issue of Civil Aviation Safety Authority (CASA) Airworthiness Bulletin 85-025 RHC R22/R44 Engine Intake Valve and Valve Seat Distress, published in August 2021, detailed many of the factors that may contribute to intake valve damage.[17] CASA made numerous recommendations to operators regarding operating procedures and limitations, which included: 

• expanding the three recommendations made in the RHC Safety Alert to include all R22 and R44 models
• guidance for operating temperature limitations 
• guidance for cool down and shut down procedures.

In addition, CASA strongly encouraged the implementation of regular borescope inspections and reporting of both defect and nil-defect findings to CASA. At the time of ATSB consultation, CASA had not received any borescope inspection results.

Tail rotor drive shaft fracture

A search of the Australian and United States aviation service difficulty reporting databases[18] identified two similar reported instances of a RHC R22 tail rotor drive shaft fracture events, both were Australian‑registered helicopters: 

• A defect report, which noted that the failure of the tail rotor drive shaft occurred during take-off and that the helicopter may have experienced an overspeed event or have operated within a resonant speed range.[19] 
• The ATSB investigated occurrence AO-2021-008, involving an R22 with registration VH-HCX. This investigation detailed notable similarities with this occurrence. In both occurrences the investigation found a thermally damaged intake valve, a fractured tail rotor drive shaft, no strike indications on the tail rotor blades or stinger, and both pilots stated they did not strike any object. A distinct difference between the two occurrences, however, was that the pilot of VH‑HCX had experienced reduced engine performance and associated momentary uncommanded yawing in the flight just prior to the occurrence, whereas the pilot of VH-VHE experienced no abnormal indications prior to the occurrence. The VH-HCX investigation also found that ‘the [intake] valve from the number-four cylinder of the engine sustained thermal damage, which led to reduced engine performance during the occurrence flight and the requirement for the pilot to perform a forced landing’. The ATSB concluded that the fracture of the tail rotor drive shaft occurred during the running landing; however, the investigation was unable to conclusively determine the reasons for the driveshaft fracture. 

Safety analysis

Engine power loss

Approximately 25 minutes into a mustering flight VH-VHE experienced an engine power reduction, induction backfire(s), and yawing event resulting in a forced landing. The unusual engine behaviour was likely due to thermal damage to the intake valve from the number-four engine cylinder, which reduced the effectiveness of the seal between the valve face and the seat. 

Neither the pilot nor the maintenance organisation observed any indications of the progressing damage to the intake valve. This included a successful compression test 17.6 flight hours prior to the occurrence. While not required, a borescope inspection may increase the likelihood of detecting valve damage that can lead to degraded engine performance. In this instance, the degradation in engine performance fortunately occurred where conditions were favourable for the forced landing.

Tail rotor drive shaft

The ATSB examination identified that the tail rotor drive shaft fractured in overstress from torsional loading. The reported pedal control, up until the skids touched the ground, suggested that the drive shaft fracture was concurrent with the helicopter touching the ground.

Noting the absence of identified mechanical or material issues with the tail rotor drive train, the ATSB considered two hypotheses to explain the fractured tail rotor drive shaft. These were:

• the tail rotor blades encountered a foreign object
• the altered engine performance, coupled with the pilot control inputs, and the ground contact led to fracturing of the tail rotor drive shaft. 

However, there was insufficient evidence to support either of these hypotheses, with the reasons for the driveshaft fracture remaining unknown.

Blade modifications

The tail rotor blade modifications found on VH-VHE were unapproved and had the potential for significant consequences. Using approved and documented engineering processes to make changes to an aircraft system is important, as it ensures the design complies with applicable airworthiness standards or an equivalent level of safety.

Findings

From the evidence available, the following findings are made with respect to the engine failure and forced landing of a RHC R22 Beta helicopter that occurred 130 km south-west of Mitchell, Queensland, on 11 January 2022.

Contributing factors

• Damage to the number-four engine cylinder intake valve allowed the fuel and air mixture, and exhaust gases into the air induction system. This resulted in the degraded engine performance and the forced landing of the helicopter.

Other factors that increased risk

• For reasons that could not be determined, the tail rotor driveshaft failed through torsional overstress, likely during the forced landing.
• An epoxy addition present on the leading edge of the tail rotor blades was an unapproved modification.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot of VH-VHE
• helicopter maintenance organisations
• Robinson Helicopter Company
• Helicopter Rebuilds Pty Ltd
• Lycoming Engines

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the pilot of VH-VHE
• Helismart Pty Ltd
• Approved Aircraft Maintenance Pty Ltd
• Lycoming Engines
• Robinson Helicopter Company
• Civil Aviation Safety Authority
• United States National Transportation Safety Board

A submission was received from:

• Robinson Helicopter Company

The submission was reviewed, however it did not result in any change to the report text.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Investigation summary

What happened

On 3 March 2022, the pilot of a Cessna U206G, registered VH-JVR and operated by MAGSPEC Aviation Pty Ltd, was conducting a low-level geophysical survey, about 120 km west of Norseman, Western Australia. Recorded data showed the first survey line commenced at 1252 local time, and the aircraft’s last recorded position occurred at 1343, in the survey area.

At about 1430, the ground operator observed that the satellite tracking system was no longer reporting the aircraft’s position, and they were subsequently unable to contact the pilot. When the aircraft failed to return to Kalgoorlie by its estimated arrival time of 1630, a search was initiated. At about 1852, the wreckage was located 3.2 km west of the aircraft’s last recorded position. The injured pilot had extricated themselves from the wreckage but shortly after succumbed to their injuries. The aircraft was destroyed. 

What the ATSB found

The ATSB found it was likely that, during a manoeuvre to intercept the next survey line, for undetermined reasons, control of the aircraft was lost at a height from which recovery was not possible. While an aerodynamic stall situation was a plausible explanation for the loss of control, this remained only a possibility due to the lack of recorded data beyond the last known position of the aircraft and no witness observations. 

Although the aircraft’s satellite tracking system had stopped at 1343, an emergency response was not initiated until 1700. This was in accordance with the operator’s emergency response plan, in which a search and rescue response was to commence 30 minutes after the estimated time for arrival. However, an earlier response was very unlikely to have altered the outcome due to the extent of the pilot’s injuries. Minimising the time for a search and rescue is essential to increasing the chances of a successful outcome in the event of an accident. 

In accordance with the operator’s training, its pilots routinely used high angle of bank (45‍–‍60°) turns at low level to manoeuvre between survey lines. Steep turns at low level increases the risk of an aerodynamic stall from which a recovery may not be possible. ATSB analysis of the available satellite tracking data identified that, although the pilot was conducting steep turns, they had flown the previous 24 turns without incident.

The pilot was not wearing any protective clothing or a helmet nor were they required to do so by the operator. Wearing of such items has been recommended by industry bodies, as they may offer some protection in the event of an accident, particularly from fire but also as environmental protection following an accident.

The ATSB identified that the operator’s risk management processes did not include a pre‑operational risk assessment that considered the generic risks and hazards common across their low‑level survey operations. Further, a risk register was not maintained, which limited the operator’s ability to track, monitor, and mitigate all known hazards, and assess the effectiveness of the existing risk controls.

Also, the operator trained its pilots to routinely fly survey patterns utilising steep turns at low level. However, the procedures or limitations specific to these manoeuvres were not included in the operations manual. It was also noted that, the operator’s aircraft were fitted with a satellite tracking system, but there was no requirement nor supporting procedures to confirm the set‑up and functionality of the system prior to flight.

Although not contributory, the ATSB identified that the regulatory oversight of the operator had not specifically examined the primary activity of low‑level geophysical survey flights or the processes and procedures designed to mitigate any associated risks.

What has been done as a result

MAGSPEC Aviation has consolidated its manuals, with its health, safety and environmental management system manual incorporated into its operations manual. In addition, it has implemented a range of measures regarding its low‑level survey operations including:

• an updated job safety analysis, which provides for the consideration of likelihood, consequence and details of any risk mitigations
• procedures for the use of satellite tracking including a requirement for a pre-flight check
• conduct of procedure turns including how the turns should be flown, with minimum speeds indicated and what to do if those speeds could not be achieved
• the requirement for fixed emergency locater transmitters on all aircraft, and limitations for flight if the unit is unserviceable or not present
• updating its low-level training syllabus to include specific parameters (which mimic its previous practical training), so that competency can be formally assessed against those parameters.

MAGSPEC Aviation has also advised it no longer operates at survey heights below 30 m above ground level and it provides its pilots with an individually registered portable locator beacon, which they are required to wear on their person. It is also progressing operational amendments to enable Flight Safety Foundation’s Basic Aviation Risk Standard accreditation. Just prior to final publication of this report, the operator advised that it had been awarded the Basic Aviation Risk Standard accreditation.

Safety message

Geophysical survey operations are generally conducted at low level, necessitated by the requirement for high quality, accurate data acquisition. This creates a high‑risk operating environment that requires effective risk management.

Risk management should include a pre‑operational risk assessment to consider hazards and risks common to an operation. This can then be used to inform the management of risk for specific taskings and assist in developing appropriate mitigations. Tools such as a risk register can assist an organisation to effectively monitor its risk profile and continually improve its risk mitigation strategies.

Policy and procedures form part of effective risk mitigation strategies and will establish safety and the operating standards to be met and maintained. Documented policies and procedures can ensure the correct set‑up and functionality of operating equipment and systems. It can also minimise opportunities for deviation from an operator’s expectations and the erosion of safety margins.

This accident further highlighted that regulatory oversight activities should ensure that an operator’s primary activity is examined in sufficient detail. Not doing so potentially limits the opportunity to assess an operator’s ability to manage the risks associated with its proposed operations.

The occurrence

On 3 March 2022, a Cessna Aircraft Company U206G aircraft, registered VH-JVR, was being operated by MAGSPEC Aviation Pty Ltd for low-level, geophysical survey flights of an area about 120 km west of Norseman, Western Australia (Figure 1).

The aircraft was based at Kalgoorlie for this survey task along with 2 pilots and a ground operator. One pilot would operate the aircraft in the morning and the other in the afternoon. The ground operator was responsible for the technical and logistical aspects of the survey. 

At about 1125 local time, at the completion of the morning survey flight, the aircraft was returned to Kalgoorlie. The second pilot commenced their pre‑flight preparations at about 1130 and discussed the morning survey flight with the returning pilot. That pilot advised of a minor concern about a fuel imbalance that developed during the approximate 4‑hour flight, however, they did not report any impact on aircraft handling or engine operation. 

The ground operator prepared the survey equipment and assisted the pilot to fully fuel the tanks. 

Figure 1: VH-JVR's operating area in proximity to Kalgoorlie and Norseman

Source: Operator’s satellite tracking data, overlaid on Google Earth, annotated by the ATSB

At about 1200, the aircraft departed for the survey area with the pilot as the sole occupant. Recorded GPS data showed that the first survey line was commenced at about 1252, picking up where the morning survey flight had been completed. The last position uploaded to the tracking system was at 1343, which showed the aircraft was on a westerly heading at a ground speed of 116 kt and a GPS height of 1,398 ft above mean sea level in the target survey area.

At about 1430, the ground operator checked the satellite tracking system for VH‑JVR and noted that the aircraft’s position was no longer being reported on the system. The satellite tracking system had the ability to automatically alert the operator 15 minutes after tracking data was no longer being uploaded to the system’s servers. The operator reported they did not receive an automatic alert. 

The ground operator then attempted unsuccessfully to call and text the pilot’s mobile phone. Although the aircraft carried a satellite phone as part of its survival kit, it was not routinely switched on during operations. The ground operator then advised the operations manager, who directed them to continue the attempts at making contact and prepare the ground vehicle for a potential response. Further attempts at contact were unsuccessful and the operations manager directed that no further action could be taken other than to monitor the situation and wait until the aircraft’s estimated time of arrival at Kalgoorlie.

The aircraft did not return to Kalgoorlie by the estimated time of arrival of 1630. At 1700, in accordance with its emergency response plan, the operator contacted the Australian Maritime Safety Authority’s Joint Rescue Coordination Centre (JRCC). Another company aircraft and pilot that was at Norseman was dispatched by the operator to VH-JVR’s last known position, however, the pilot was not able to locate the aircraft.

The JRCC initiated a search and rescue operation at 1739. The aircraft wreckage was located at 1852, approximately 3.2 km west of its last recorded position (Figure 2). The search aircraft’s crew were unable to establish communications with the pilot of VH‑JVR. The JRCC also deployed a rescue helicopter to the site, and at 0042, they found the pilot, fatally injured a short distance from the wreckage.

Figure 2: VH-JVR's accident site location and last recorded position

Source: Operator’s satellite tracking data, overlaid on Google Earth, annotated by the ATSB

Context

Pilot information

Qualifications and experience

The pilot held a commercial pilot licence (aeroplane) issued in 2014 and a valid class 1 aviation medical certificate. They held a multi‑engine aeroplane instrument rating and a grade 3 instructor rating, although neither were current, nor were they required to be. 

At the time of the accident, the pilot had about 1,822 hours total aeronautical experience, of which about 570 hours were with the operator, primarily in Cessna 210 aircraft. The pilot had accrued over 350 hours on Cessna 206 aircraft prior to joining the operator and had about 12 hours on VH‑JVR.  

The pilot commenced and completed a low‑level (aeroplane) rating in June 2021, which comprised 6.7 hours of dual training in a Cessna 152 aircraft, including a flight test. In July 2021, the pilot then commenced low‑level survey training with the operator in a Cessna 210 aircraft. The pilot’s logbook detailed 5 initial training survey flights totalling 18.6 hours. These were followed by about 21 hours of solo low‑level survey, culminating in a check flight of 5.6 hours. 

The chief pilot (CP) conducted the pilot’s low‑level survey training and their geophysical survey operations check flight. The CP reported that the pilot ‘was one of those pilots who picked it up very quickly’ and was ‘very switched on’. In total, the pilot had conducted about 500 hours of low‑level survey operations. 

Although the pilot had previously flown high‑level surveys, MAGSPEC Aviation was the first operator that the pilot had flown low‑level surveys for. The operator also reported that the pilot had been recently offered and had accepted the role of deputy chief pilot/deputy head of operations.

Recent history

The pilot had been on leave since 23 February 2022. The pilot’s partner reported that, on 1 March 2022, the pilot woke at about 0700, went to bed at about 1930‍–‍2000 and did not fly that day. On 2 March 2022, the day prior to the accident, the pilot woke at 0400 and arrived at Perth Airport at 0500 to take a scheduled passenger flight to Geraldton, where VH‑JVR had been undergoing scheduled maintenance. The pilot then ferried the aircraft about 700 km to Kalgoorlie, arriving around midday. Later that day, the pilot accompanied the second company pilot assigned to the survey area on a 30‍–‍40 minute local flight to familiarise the second pilot with VH‑JVR, as they had not previously flown that aircraft. 

The pilot’s partner received a text message from the pilot at 1922, advising that they were cooking dinner in their accommodation and had no plans to go out that night. There was no further evidence of the pilot’s activities prior to the accident flight, but the pilot usually woke around 0600‍–‍0630, exercised and studied in the mornings before conducting the afternoon survey flight. 

The day of accident was the first day of that survey task. Neither the other pilot nor the ground operator expressed any concern for the pilot. Based on the available recent history, there was no evidence the pilot was likely experiencing a level of fatigue at the time of the accident. 

Aircraft information

General

The Cessna Aircraft Company U206G Stationair was a high‑wing, fixed tricycle undercarriage aircraft powered by a single Continental IO‑520‑F piston engine, with a 3‑bladed constant speed propeller. VH‑JVR was manufactured in 1978 in the United States and was first registered in Australia in 1998. The aircraft was acquired by the operator in 2021. 

Factory fitted standard equipment included:

• a vane‑type aerodynamic stall[1] warning system in the leading edge of the left wing designed to activate the audible warning horn 5‍–‍10 kt above the stall speed in all configurations
• 2 vented fuel wing tanks, which were an integral part of the metal wing structure[2] and supplied fuel via gravity feed to 2 reservoir tanks, and a fuel selector valve with selections for LEFT, RIGHT and OFF
• 3-point safety harness restraints.

Modifications

In October 2021, VH‑JVR had been modified and equipped to conduct geophysical survey operations in accordance with engineering orders approved by a Civil Aviation Safety Authority (CASA) authorised aeronautical engineer and supplemental type certificates.[3] These modifications included:

• A magnetometer boom installed at the rear of the aircraft and associated survey equipment, with its own power supply, mounted in the rear cabin.
• A fuel selector valve, which enabled the selection of LEFT/BOTH/RIGHT with a pull‑out fuel shut off valve installed to cut off fuel flow.
• A survey data acquisition and navigation system, which included flight path guidance via a digital display mounted on top of the instrument panel, allowing the pilot to monitor aircraft position in relation to the pre-programmed survey lines.[4]
• A 4-point inertia safety restraint harness.

Maintenance

The aircraft was being maintained by an approved maintenance organisation in accordance with the CASA maintenance schedule 5 and regulatory requirements. The last periodic inspection was completed on 2 March 2022 at 7,982.4 hours total time‑in‑service. The current maintenance release was not recovered and likely destroyed in the post‑impact fire. A review of previous maintenance releases and maintenance records did not identify any major repairs or recurring airworthiness issues with the aircraft.

Emergency locator transmitter

Civil Aviation Safety Regulations (CASR) 1998 Part 91 General operating and flight rules Manual of Standards (MOS) required that VH‑JVR carry an emergency locator transmitter (ELT) or a survival ELT for its intended operation. At the time of the accident, VH‑JVR was not fitted with an ELT but carried a survival ELT (refer to section titled Emergency beacons).

Weight and balance

The CP provided a recreated weight and balance sheet of the accident flight to the ATSB. The morning pilot witnessed the aircraft depart with full fuel in the survey configuration. The weight and balance sheet identified that VH‑JVR weighed about 1,488 kg on departure, about 150 kg below the maximum take‑off weight of 1,636 kg. The centre of gravity on take‑off was near the centre of the allowable range. Therefore, it was very likely that VH‑JVR was within the weight and balance limits at the time of take‑off. 

Meteorological information

The pilot who flew the morning survey flight reported that the weather at that time was fine with good visibility, except for some light turbulence.

The Bureau of Meteorology forecast for the area, valid from 1300, was for visibility to be greater than 10 km and no significant weather for the time of the accident. Winds were forecast to be southerly at about 15 kt. Satellite imagery indicated no cloud cover over the survey area. The nearest weather stations to the accident site were at Norseman (124 km east) and Hyden (158 km west‑south‑west). There was no significant weather reported at either location. Recorded winds at 1330 were south‑westerly at about 14 kt at Norseman and south‑easterly at 10 kt gusting to 17 kt at Hyden.

According to Geoscience Australia’s geodetic calculator, the sun azimuth was north‑west at about 56° elevation about the time of the accident. This was relatively high in the sky and sun glare affecting the pilot was considered not likely.

Recorded data 

Spidertracks data

A Spidertracks Spider X tracking system was installed on the aircraft, which provided near real‑time tracking via satellite and/or cellular networks, recording position, altitude, track heading and groundspeed at 15‑second intervals, increasing during aircraft manoeuvring. The data was transmitted to Spidertracks servers once every minute. The Spidertracks system also had an automatic watch function whereby an alert would be sent via text and email to a nominated person(s) in the event that the data transmissions from the device were not received for a period of 15 minutes.

Spidertracks data was able to be recovered for analysis due to its cloud‑based operation. The physical unit, and other possible data sources of recorded data identified in the wreckage, including personal electronic devices, the engine data monitoring device and the geophysical survey data equipment, were all damaged in the post‑impact fire, preventing data recovery. 

The last known position transmitted by Spidertracks was about 3.2 km east, and approximately 1 minute away (at the last recorded speed) from the accident site (Figure 3). Position data was recorded by Spidertracks once every 15 seconds, increasing to about once every 3 seconds during a turn. However, as the data was only transmitted once every minute, it was likely that the accident occurred before Spidertracks was able to transmit the last data packet to the cloud storage.

The recovered data showed that the pilot had conducted procedure turns (refer to section titled Survey pattern) at the end of each of the completed 24 survey lines, over a period of about 50 minutes. Although all turns were observed to be conducted in a similar manner, one particular turn commenced at a greater distance away from the survey area. During interview, the CP suggested that the pilot may have done so in order to have a drink or attend to a flight‑related task. The ATSB noted no evidence to suggest any concern with this particular turn. The aircraft was on the 25th survey line when the data stopped, and the accident site was in the vicinity of the expected 25th procedure turn (Figure 3).

The recorded data showed the survey lines were being conducted in an east‑west orientation, with left turns conducted to the west and right turns to the east. The average survey line speed was 114 kt at an average height of about 78 ft above ground level (AGL).

Figure 3: Recorded flight path (excluding transit from Kalgoorlie)

Source: Operator’s satellite tracking data, overlaid on Google Earth, annotated by the ATSB

Procedure turn analysis

The available Spidertracks data was analysed to assess the aircraft handling during the accident flight. The recorded ground speed data and forecast wind and direction were used to estimate the true airspeed during the survey flight. Based on the available atmospheric conditions, true airspeed was assumed equal to indicated airspeed and is used throughout the following analysis.[5]

Using the available recordings, the average bank angle, rate of turn and G load for each turn for the accident flight were calculated. These calculations assumed steady coordinated turns, at constant altitude and airspeed, with a constant wind speed and direction. 

The ATSB’s analysis of the Spidertracks data from the aircraft identified that during the procedure turns:

• The angle of bank ranged from 43° to 60° and was typically between 50° to 60°.
• The rate of turn ranged from 10° to 18° per second and was typically between 14° to 18° per second.
• The G load[6] ranged from 1.3 G to 2 G and was typically about 1.7 G to 1.8 G.
• The indicated airspeed ranged from 89 kt to 109 kt and was typically between 94 kt to 104 kt.
• The altitude during turns were between 150 ft to 300 ft AGL, with the average being 200 ft.

Comparison flights

Spidertracks data from 2 previous flights for the accident pilot, which were in VH‑JVR, as well as the morning survey flight conducted in VH‑JVR by another pilot were made available to the ATSB. These were analysed for comparison to the accident flight.

Morning flight 

The morning flight conducted by the other pilot consisted of 50 survey lines and 49 procedure turns. These survey lines were typically flown at 85 ft AGL and 120 kts. This set of survey lines were immediately adjacent to the accident flight survey, with the procedure turns occurring in a similar area. Analysis of these procedural turns identified:

• The angle of bank ranged from 24° to 56° and was typically between 40° and 50°.
• The rate of turn ranged from 4° to 16° per second and was typically between 10° and 13° per second.
• The G load ranged from 1.1 G to 1.8 G and was typically between 1.3 G and 1.5 G.
• The airspeed ranged from 92 kt to 109 kt and was typically between 95 kt and 104 kt.
• The altitude during the turns varied between 210 ft and 550 ft, with the average being 320 ft AGL.

These turns, while generally comparable with the accident pilot’s turns, and considered steep turns,[7] were typically flown at lower angle of banks, rates of turn and G load, and at higher heights above ground level. The ATSB noted that the morning pilot had recently completed their survey training with the accident pilot on the Cessna 210. This was their first low‑level survey flight in the Cessna 206.

Previous flights (accident pilot)

Spidertracks data from 2 prior survey flights in VH‑JVR for the accident pilot were available. These flights were conducted in a different location, over undulating terrain with dense vegetation, with a higher average survey height of about 140 ft AGL at about 113 kt. Each flight consisted of just over 50 procedure turns and survey lines. A summary of the analysis of these procedural turns is contained in Table 1 below (refer flights 2 and 3), with comparison to the accident flight, and the morning pilot (flight 1).

Table 1: Comparative turn analysis results

The ATSB’s analysis of the Spidertracks data from the pilot’s previous survey flights identified that those turns were flown at slightly lower angles of bank, rates of turn and G load when compared with the accident flight. While the pilot was operating at a different location, which may have influenced the way they conducted their turns, the reason for the differences was not able to be determined from the evidence available.

Wreckage and impact information

Wreckage distribution

The aircraft was located in moderately dense scrubland with small to medium trees. The terrain was relatively flat, with some low ridges in the surrounding area. 

The distribution of the wreckage indicated that the aircraft initially struck trees in an upright orientation, with an approximate 20° left angle of bank, and a nose‑down attitude at about a 30° angle of impact. The initial tree strike resulted in the left wingtip and aileron separating from the aircraft. The aircraft then impacted the ground on its left side and continued through the bush in a southerly direction, coming to rest about 45 m from the initial point of impact, where it was consumed by a post‑impact fire.

The wreckage trail consisted of a number of felled trees and aircraft components, including the nose gear assembly, left main gear and fairing, left door, section of the left wing flap, windscreen and sections of the lower engine cowling and lower engine components. There was no indication of fire in the wreckage trail or detached aircraft components (Figure 4).

Figure 4: Wreckage trail looking north towards the impact area

Source: ATSB

The propeller had separated from the engine and was located towards the rear of the wreckage and the engine was upside down and detached from its mounts. Although the left wing was significantly affected by fire, the wing spar was still distinguishable. The right wing was relatively intact as was the magnetometer boom, albeit damaged by fire (Figure 5).

Figure 5: Main wreckage

Source: ATSB

Wreckage examination

Although post‑impact fire damage precluded examination of a significant proportion of the aircraft, inspection of the site and wreckage found:

• no evidence of any pre‑existing structural, mechanical or flight control defects that would have prevented normal operation
• the wing flaps were in the fully up (retracted) position
• a small, yet intense fire zone indicative of a significant amount of fuel, with ignition occurring from the left‑wing integral fuel tank rupturing during the accident sequence
• the fuel selector was in the ‘BOTH’ orientation
• damage to the propeller indicated that the engine was producing power at the time of the impact.

Extensive fire damage to all instruments and avionics resulted in no useful switch position information. The windscreen, located part way along the debris trail, did not exhibit signs of birdstrike, nor were feather or bird remains identified in the area. In addition, the morning pilot reported that, while they had observed bird activity on survey flights, none had been sighted that day. 

The reason for the fuel imbalance noted by the morning pilot could not be determined from the wreckage examination.

Medical and pathological information

Post-mortem examination

A post-mortem examination of the pilot was undertaken by a qualified pathologist on behalf of the Western Australia Coroner. The pathologist determined that the pilot’s cause of death was a result of a combination of traumatic injuries (both soft tissue injuries and multiple fractures) and the effects of fire from significant thermal injury and smoke inhalation. There were multiple fractures to the nasal bones but none to the skull or pelvis.

The pathologist assessed that the traumatic injuries sustained were potentially survivable with immediate medical assistance, but those injuries were compounded by the thermal injury and smoke inhalation. The ATSB’s aviation medical specialist also advised that the impact injuries were likely not fatal, however, they would have been severely incapacitating. The extensive thermal injury and, in particular, the smoke inhalation was likely to have rendered the pilot unconscious within minutes. They also stated that immediate intervention would have been required but the sustained thermal injuries were likely not survivable.

The post-mortem report indicated that the pilot did not have any significant natural disease. Further, toxicological analysis did not detect the presence of alcohol or common drugs and carbon monoxide[8] levels were not significantly raised (at less than 5% saturation). 

The pilot was reported by their partner to be fit and healthy with no known illnesses.

Survival aspects 

Impact protection

Due to extensive fire damage to the fuselage, there was limited evidence available about the survivable space/intrusions, or seat and seatbelt condition. Therefore, the ATSB was not able to determine survivability with regard to the cabin area. The left (pilot) door indicated an intrusion/compression and the left main landing gear leg was detached, consistent with high impact forces and the injuries sustained to the pilot.

Post-impact fire

Metal fuel tanks are prone to rupturing during an accident impact, allowing fuel to escape and increasing the risk of a post‑impact fire. To improve crashworthiness, the addition of fuel bladders and fuel cells that have been constructed of flexible materials have proven less prone to rupturing during an impact. They are able to withstand greater deformation and puncture less readily and are less likely to expand or tear to form a larger opening from which fuel can escape. Such systems may provide occupants with more time to egress the aircraft and/or reduce the risk of any fire‑related injury.

ATSB investigation report AO-2021-052, extensively discussed post‑impact fire safety and referenced studies by the United States National Transportation Safety Board and Transport Safety Board of Canada. Those studies concluded that post‑impact fire had been shown to contribute significantly to injuries and fatalities in accidents that were otherwise potentially survivable. A potentially survivable accident is one in which the impact forces are within the limits of occupant tolerance, the aircraft structure preserves the required survival space, and the occupant restraint is adequate. 

As a result of investigation AO‑2021‑052, the ATSB identified that the aircraft (an Air Tractor AT‑400) was not required to be fitted with a crash‑resistant fuel system under United States Federal Aviation Regulations. A safety issue was raised and the ATSB recommended that the United States Federal Aviation Administration take action to address certification requirements for crash‑resistant fuel systems for fixed‑wing aircraft, in an effort to reduce the risk of post‑impact fire. At the time of writing this report, the ATSB recommendation remained open and the Federal Aviation Administration had advised that the results of a study into post‑crash fire accidents was being reviewed to determine their next action (AO‑2021‑052‑SI‑01).

Protective clothing and helmets

For the accident flight, the pilot was reported to be wearing a t‑shirt, shorts and trainer type shoes and was not using a helmet. The operator did not require its pilots to wear protective clothing or helmets, nor were they required to do so by regulations. The CP explained that this decision took into account temperature, fatigue and pilot comfort balanced against mitigating the potential risks. In addition to comfort and fatigue factors, the bulk of a helmet may not be suitable to the smaller cockpit of the aircraft. However, the CP stated that no formal risk assessment had been completed to support this decision. The operator reported that it issued each pilot (including the accident pilot) with company polo shirts made of 100% cotton as a measure of fire protection and the use of other protective clothing and helmets was left to individual pilots’ discretion. The CP indicated that some of their pilots did wear such items. It could not be determined if the accident pilot was wearing the company polo shirt. The ATSB noted that the operator’s job safety analysis (refer to section titled Job safety analysis) included consideration of protective equipment and clothing as methods of reducing risk factors.

The ATSB’s aviation medical specialist advised that if protective clothing and an appropriate helmet was worn, in most general circumstances, this would have reduced the severity of injury in an accident. However, they were unable to comment on the effectiveness of these items for this accident and noted that protective clothing and a helmet would not have prevented any smoke inhalation injury.

The International Airborne Geophysics Safety Association (IAGSA – refer to section titled International Airborne Geophysics Safety Association) recommended that appropriate clothing should be worn by all flight crew involved in geophysical surveys to minimise the immediate risk of fire in the event of an accident and for protection from exposure in a survival situation. These include:

• cotton undergarments covered by long trousers and long‑sleeved shirt or an appropriate flying suit
• closed shoes
• have gloves available at all times
• layers of clothing appropriate for the conditions
• cold weather clothing should include felt lined boots, down parka with attached hood and large mittens.

IAGSA also recommended that for fixed‑wing operations, each individual operator should determine the appropriateness of the use of an industry approved helmet. A case by case, risk assessed approach should be adopted, taking into account the relevant variables for each specific survey task.

The Flight Safety Foundation’s Basic Aviation Risk Standard[9] is a set of risk‑based aviation industry standards. The standard covers a wide variety of aviation applications of which airborne geophysical survey operations were included. The standard implementation guidelines for survey operations also recommended appropriate clothing for crew such as non‑synthetic long trousers and pants or flying suit. It also recommended that helmets should be worn when operating below 500 ft AGL unless a risk assessment stated otherwise. 

Flight following

Satellite tracking

Operator requirements

The operator had implemented flight following through use of the Spidertracks satellite tracking system installed on each of its aircraft. The company operations manual stated:

In addition to the required safety equipment the Company equips all aircraft with a real-time satellite monitoring system with a refresh rate of at least every 5 minutes and automatic alerting (to company mobile phone and email) in the event of an emergency.

Should the satellite monitoring system alert be inadvertently activated by the pilot an “ops normal” call should be made to the company as soon as practicable.

The ground operator assigned to each survey job was the primary person responsible for flight following. They were to monitor the aircraft’s location via the tracking system and initiate an emergency response, if required.

The morning pilot could not recall any specific pre‑flight requirements for the Spidertracks device and another company pilot reported that there were not any checks required, the device turned on once the aircraft’s electrical system was on.

The operations manual did not include flight following as a specific duty for the ground operator or any other staff member. Further, the manual did not detail procedures for the conduct of flight following, nor were there procedures or guidance to confirm that the tracking system was correctly configured and operating as expected prior to flight.

Automatic watch function

The operator was surprised that a Spidertracks automatic alert was not received during the accident and advised that, on a number of occasions, their satellite tracking had experienced dropouts. On some of those occasions, contact was made with the pilot and a system reset restored normal function. On other occasions, when contact with the pilot was not possible, the aircraft returned by the nominated estimated time of arrival (ETA). The operator had not contacted Spidertracks about the dropouts or conducted any other troubleshooting.

Spidertracks advised the ATSB that the automatic watch function on the aircraft’s device had not been activated on the accident flight, nor was it active for earlier flights on 2 and 3 March 2022. They further advised that there was no indication of any service‑related issues, confirming that up to the loss of data, the aircraft’s device was operating as expected. Diagnostic logs for the device were not available due to this data only being transmitted via mobile phone networks. Spidertracks confirmed that the length of time with no transmissions received, or a data loss or delay was not typical and could be indicative of a power or device failure, transmission interference or installation issue. Spidertracks found no recorded issues with the satellite service or their cloud platform at the time of, or leading up to, the accident.

Emergency response plan

The operator had a phased emergency response plan, predicated on an elapsed time since the aircraft’s ETA. Each phase was commensurate with an escalating level of concern. Satellite tracking was referred to in the plan, within the section Phase 1 - Uncertainty. Phase 1 commenced 0‍–‍15 minutes after the aircraft’s ETA had expired. The plan directed a check of the satellite tracking and if there was an abnormal or no indication in the system, the next step was to attempt contact with the crew. If contact with the crew was not possible and overall operations were assessed as not normal, the plan directed that the operations manager, as primary contact, to be notified, then the chief executive officer and CP as alternates.

The plan did not elaborate any further on required actions for an abnormal or no indication in the system prior to advancing to the next step, which was Phase 2 - Alert. Phase 2 commenced 15‍–‍30 minutes after the ETA had expired and directed the primary or alternate contacts to establish the final status of the aircraft via the tracking system. It included a note that, if there was no contact with company operations then the ground operator was to contact the Australian Maritime Safety Authority’s Joint Rescue Coordination Centre or local search and rescue services direct. Commencement of Phase 3 - Distress was at 30 minutes after ETA had expired or whenever the aircraft was confirmed as missing. 

The operator commenced phase 3 at 1700, 30 minutes after the ETA for VH‑JVR had expired and then contacted the Joint Rescue Coordination Centre.

Emergency beacons

Emergency locator transmitter 

The company operations manual stated that all company aircraft were to be fitted with an approved ELT or a portable ELT if the fixed device was inoperative or otherwise not serviceable. The operator was not able to determine why VH‑JVR was not fitted with an ELT.

The ATSB research report (AR‑2012‑128) discussed the potential safety benefits of an approved, fitted ELT, which were designed to automatically activate following an impact normally associated with a collision. While the research noted some limitations with the effectiveness of ELTs, the fitment of a crash‑activated ELT greatly increases the early notification for search and rescue efforts and arrival of potentially life‑saving medical treatment especially when occupants or crew are incapacitated.

Personal locator beacon 

The CP and morning pilot stated that a personal locator beacon (PLB) was carried in the aircraft as part of a survival kit, which was secured to the passenger seat. The PLB was routinely carried in the aircraft, and not as an alternative to an ELT but as an additional item. In accordance with regulations, the PLB was classed as a survival ELT, and an alternative to a fixed ELT. However, the PLB was not identified in the wreckage and was likely consumed by fire. 

The ATSB research report (AR‑2012‑128) suggested that carrying a PLB will most likely only be beneficial to safety if it is carried on the person, rather than being fixed or stowed elsewhere in the aircraft. The CASR Part 91 MOS stated that a survival ELT must be carried either on the person of a crew member, in or adjacent to a life raft, or adjacent to an emergency exit. 

Operational information

Airborne geophysical survey flights

Airborne geophysical survey flights are conducted by a variety of rotary and fixed‑wing aircraft which have been specifically modified and equipped with geophysical sensors. Survey flights were normally flown below 500 ft AGL over the desired area via a pre‑determined pattern and at heights designed to maximise the quality of the data captured. The data provides a detailed below ground composition of the surveyed area, primarily to inform mining and resource industry activities.

Requirement for CASA low‑level rating 

Operations requiring flight below 500 ft AGL, such as geophysical surveys, required a pilot to hold a CASA Part 61 low‑level rating. A low‑level rating is specific to various types of flying operations (such as aerial survey, firefighting or agricultural), however, the training and testing is not specific to any one type of operation. To obtain a low‑level rating a pilot must demonstrate competency in certain operational techniques, which included, but were not limited to, steep, maximum rate and minimum radius turns, procedure turns, recovery from approach to stalls (level and turning). In addition to holding a low‑level rating, MAGSPEC Aviation required prospective pilots to have a minimum of 500 hours as pilot in command. MAGSPEC Aviation then provides training specific to its operational requirements.

International Airborne Geophysics Safety Association (IAGSA)

The IAGSA is an international industry association comprised of airborne geophysical survey organisations with an overall objective to promote and enhance safety in the airborne geophysics survey industry. IAGSA publishes a safety manual for its member organisations, which details its standards and recommended safety practices. 

IAGSA is a non-regulatory body and holds no authority to compel its members to follow its standards and recommended practices, which are not a replacement for the regulatory requirements that each individual organisation may operate under. However, members have agreed under the terms of membership to follow those standards and practices where they are more stringent or not covered by regulations, except where they have filed a notification of difference. Members are also required to complete an annual self‑audit. At the time of the accident, MAGSPEC Aviation’s most recent self‑audit outlined a number of differences to IAGSA standards and practices. Although IAGSA had requested it, it had not received a formal notification of differences from the operator.

Survey height

The operator was issued a CASA instrument in 2017, which allowed it to conduct operations at a height lower than that permitted by Civil Aviation Regulation (CAR) 157.[10] The instrument was last renewed in 2021 and was valid until 2024. 

The instrument did not specify the lowest height that could be flown. The CP stated that survey flights would often be flown at 30 m (100 ft) AGL, although a standard or minimum height was not documented in the operations manual. Rather, the survey height would be requested by the client. 

The CP explained that the requested survey height was assessed during the planning stage, through a review of maps of the survey area and the conduct of a reconnaissance flight. A detailed guide on how to conduct a reconnaissance flight was included as an appendix to the operations manual. This process would confirm if the survey could be flown at the requested height. The operator stated that, on numerous occasions this process resulted in the survey being flown at heights higher than requested.

The client for the accident survey specified a height of 25 m (82 ft) AGL.

The IAGSA safety manual acknowledged that there were increased risks associated with low flying and that operating at such heights can ‘aggravate the consequences of mechanical malfunctions or human error’. When discussing minimum safe survey heights, and while recognising that lower heights may improve the quality of survey data, they noted many differences of opinion among its members. 

Having a predetermined height had been debated among the members, however, they concluded that ‘no single universal “minimum safe survey height” can be designated given the wide variety of survey conditions and aircraft characteristics’. As such, IAGSA indicated that the safety issue was not necessarily the survey height, but more importantly, could the survey be safely flown at the requested survey height. Consequently, IAGSA recommended that:

Clients specify the maximum clearance height possible, consistent with the objectives of the survey to be flown and that operators, prior to commencing a survey, conduct a detailed risk analysis in accordance with an internationally recognized procedure considering, but not limited to, the following factors and Appendix IV of this manual:

•  terrain relief, elevation & vegetation canopy thickness

•  aircraft type

•  aircrew flight and duty times

•  prevailing weather conditions

•  anticipated density altitude

•  pilot experience and recency

•  planned flight speed.

Survey pattern

From the recorded data, the accident survey flight was flown in a back‑to‑back pattern, which was a series of consecutive parallel lines followed by a procedure turn used to establish the aircraft onto the next line in the reciprocal direction (Figure 6). This was the routine pattern used by the operator in its geophysical surveys. The client had specified 25 m spacing on east‑west survey lines.

The CP explained that procedure turns consisted of an initial climbing turn to establish the aircraft at about 300 ft AGL and about 400‍–‍500 m lateral offset from the next line. After this, a level turn would be commenced (into wind) at a 45‍–‍60° angle of bank (referred to as a steep turn) to intercept the next line. Descent to the survey height commenced once the aircraft wings were established straight-and-level.

Figure 6: Back-to-back pattern and procedure turns

Source: Aerial Application Association of Australia, annotated by the ATSB

IAGSA highlighted the risks associated with turns at low level:

Turns at low level present a considerable hazard, particularly if the terrain presents visual illusions; the aircraft descends in the turn, airspeed is low, or the angle of bank is steep. An excessive angle of bank, often resulting from close line spacing or drifting in strong crosswind conditions, is insidious as the stall speed of the aircraft increases with the angle of bank (assuming a level turn) whilst at the same time the aircraft’s speed is reduced from increased drag.

During straight and level flight there may be a significant margin above the stall speed, however in a steep turn the stall speed may be reached quickly with little warning and a stall in the turn at low level will likely result in a fatal accident.

For manoeuvring at low level, IAGSA recommended:

All turns at low level should be limited to a maximum angle of bank of 30 degrees and be done at a constant altitude. No climbs or descents should be carried out during the turn. If the terrain dictates that a climb is necessary the aircraft should be climbed to the required height prior to commencing the turn and any descent back to survey height should only be done after established in a wings level attitude.

The CP explained that the back‑to‑back pattern with procedure turns was the most efficient method and enabled the capture of higher quality survey data. They reported that flying consecutive lines was less workload intensive for their pilots, especially regarding obstacle hazard avoidance. This allowed a pilot to deal with a particular hazard for a short period as they moved away from it. 

Operations manual – Special operations 

Volume 2 of the operations manual, valid at the time of the accident, discussed aircraft operations and included a section titled Part 2D Special Operations specific to survey operations. It included sub sections on low flying, survey tolerances and safety considerations during surveys. However, there was limited detail with regard to the process or procedures for the conduct of low‑level survey flights. 

As previously discussed, a standard or minimum survey height was not included in the operations manual. 

In Part 2D1.1 Low Flying, height was discussed in terms of a minimum height when overflying occupied structures, vehicles or livestock but it did not include reference to other obstacles such as terrain, vegetation canopy or masts/antennas.

Part 2D1.4 Survey Tolerances stated:

Track, height and groundspeed tolerances for the survey will be established by the client and should be adhered to as closely as possible. Significant deviations will require the line to be re-flown.

Client established survey tolerances, although important to data accuracy, remain secondary to safety and pilots should disregard them as necessary to ensure the safety of aircraft, personnel, equipment, and environment.

Part 2D1.5 Safety considerations during survey, required a minimum survey speed to be established for each aircraft type operated by MAGSPEC Aviation. This was to be the greater of the 130% of clean stall speed (wing flaps up and landing gear up if retractable), 110% of the best single‑engine climb speed or 110% of the take‑off safety speed.

Although procedure turns and a back‑to‑back survey pattern were taught to, and routinely flown by all company pilots, the special operations section did not refer to these manoeuvres. The CP stated that there was no other reference document that outlined how the operator expected its pilots to conduct the procedure turns, nor were there any documented limitations such as a maximum angle of bank or minimum height AGL prior to commencing the procedure turn.

Aerodynamic stall 

A wing generates lift as a result of the pressure differential created by airflow over the wing’s surface. The angle between the incoming or relative air flow and wing chord is known as the angle of attack (AoA). As the AoA increases, lift increases up to a certain angle, known as the critical AoA. At this point, the airflow over the upper surface of the wing becomes separated. This condition is referred to as an aerodynamic stall (or simply a stall) and results in a significant loss of lift and an increase in drag. Due to the sudden reduction in lift from the wing and rearward movement of the centre of lift, typically an uncommanded aircraft nose‑down pitch results.

A loss of altitude also occurs during the recovery from a stall and it is possible to stall with insufficient height above the ground to recover. The pilot’s operating handbook (POH) for the U206G stated that the maximum altitude loss during a stall recovery may be as much as 240 ft in power off conditions and straight and level flight. The U206G has a stall warning vane[11] and warning horn to alert the pilot of an impending stall.

Most general aviation aircraft typically have a critical AoA of around 16°. This critical AoA can be exceeded at any airspeed, any (pitch) attitude and any power setting. However, as most small aircraft are not fitted with an AoA indicator, the AoA at which the stall occurs may be referenced to an airspeed. 

When banking or turning an aircraft, it is necessary to increase the amount of lift generated to ensure that the aircraft does not descend. This increases the AoA resulting in lift and drag greater than normal straight and level flight. This increases the load factor on the aircraft above 1 G. As the angle of bank increases, the lift required to maintain a constant altitude also increases, requiring the pilot to apply back pressure on the control column. The effect is, as the angle of bank and load factor increases, the stall speed increases. At 45° angle of bank, the load factor is 1.41. This results in an almost 19% increase in the wings level stall speed. At 60° angle of bank, the load factor is 2, resulting in an increase in stall speed of 41%. 

The U206G POH provided the stall speeds at maximum weight with power off, flaps up, various angles of bank (up to the POH limit of 60°) and centre of gravity (CoG) positions (Table 2Table 2).

Table 2: U206G stall speeds (extracted from the POH)

Recovery from a stall requires reducing the AoA by moving the control column forward, which normally means lowering the aircraft nose (pitching down).

Organisational and management information

MAGSPEC Aviation

MAGSPEC Aviation Pty Ltd commenced operations in 2017 to provide airborne geophysical survey services across Australia. It operated a fleet of 2 Cessna 206 and 2 Cessna 210 aircraft. At the time of the accident, they operated under a CASR Part 138 (aerial work) air operator’s certificate. Part 138 came into effect on 2 December 2021. Since commencing low‑level survey operations, the operator had experienced the following occurrences:

• In 2018, the engine of a Cessna 210 failed necessitating a forced landing. The pilot was uninjured, however, the aircraft was substantially damaged. It was identified that sufficient fuel had not been transferred from the aircraft’s tip tanks to the main fuel tanks. The operator undertook action to review training and to reinforce fuel management procedures.
• In 2019, a Cessna 210 struck a powerline and the aircraft sustained minor damage. The aircraft was safely flown back to its departure point. The operator reported that the aircraft had been flown on north‑south lines due to the sun’s position before transitioning to east‑west lines after the sun was no longer a factor. Following this, the pilot had flown 50 m from the powerline before making contact on the reciprocal heading. Subsequently, the operator incorporated a national database of powerlines into its pre‑survey assessment process.
• In 2020, the engine of a Cessna U206G lost partial power and the pilot conducted a forced landing, resulting in substantial damage to the aircraft. The pilot was uninjured. Fuel starvation was determined as the reason for the engine power loss. It was identified that the aircraft had been operated with only one fuel tank selected instead of both. The operator updated checklists to incorporate the requirement for fuel tank selection to BOTH and amended the survey data acquisition system to provide periodic fuel check messages as a reminder to pilots.

Following the 2018 occurrence, the ATSB completed an occurrence brief (AB-2018-058). This was a short summary report and not an investigation, to allow for greater industry awareness of potential safety issues and possible safety actions. The ATSB did not investigate the other occurrences. CASA conducted 2 surveillance events following the 2018 occurrence. In response to the draft report, on 28 January 2025, the operator reported that they had requested assistance from CASA after the other occurrences but reported no assistance was provided. The ATSB reviewed CASA records, which indicated no action had been taken following the 2019 or 2020 occurrences (refer to section titled Regulatory oversight activity. 

Safety management system

Managing safety

According to the International Civil Aviation Organization (ICAO, 2018), a safety management system is a systematic approach to managing safety that seeks to proactively mitigate risks before they result in an accident or incident. This includes defining the necessary organisational structures, accountabilities, responsibilities, policies and procedures.

At the time of the accident, there was no CASA regulatory requirement for the operator to have a safety management system. However, the operator had implemented a Health, Safety and Environmental Management System (HSEMS), for the purpose of describing:

…the process by which MAGSPEC aviation manages risks has been developed to meet the Civil Aviation Safety Authority SMS requirements in addition to providing more generalized guidance on the management of risk within the organisation.

Specifically, one of the operator’s policy commitments was to:

…minimize the risks associated with operational activity to a point that is as low as reasonably practicable/achievable…

While the HSEMS was submitted to CASA, a review of CASA records found that it had not been assessed, nor was there a requirement to do so.

Safety risk management

Risk management is a key component of safety management and includes hazard identification, safety risk assessment, safety risk mitigation and risk acceptance. It is an ongoing process as the aviation system is constantly changing, with new hazards introduced, and some hazards and associated risks changing over time (ICAO, 2018).

CASR Part 138 required an operator conducting aerial work to undertake risk assessments of its operations. This was a new requirement introduced with Part 138. The Part 138 MOS detailed a layered approach to risk assessment and that before conducting an operation:

(a) the operator’s operations manual must contain: 

(i) pre-operational risk procedures [refer below] for risk assessments and mitigation processes applicable to the operation; and 

(ii) procedures for post-flight risk review; and 

(b) the operator must have a flight risk management plan based on a pre-operational risk assessment in accordance with the procedures; and 

(c) the operator must ensure that the operator and each crew member is satisfied, in a pre-flight risk review, that the flight risk management plan will eliminate, reduce or mitigate risks and hazards to the extent that it is safe to conduct, and continue, the operation without unacceptable risk to the crew members, any aerial work passengers, the aircraft or any other person or property.

The MOS further specified what was to be included in an operator’s pre‑operational risk procedures:

a. processes for identifying, reporting and recording hazards; 

b. processes for analysing identified hazards and assessing the risks they may pose, including for pre-flight, in-flight and post-flight stages of operations; 

c. processes to mitigate the risks or control the risks, including processes for the incorporation of risk controls into standard operating procedures; 

d. the creation and management of: 

i. a risk register; and 

ii. records of dedicated risk assessments performed to address each type aerial work operation that is to be conducted, including details of the risk assessors; 

e. procedures to ensure that the pilot in command and the other crew members are familiar with the pre-operational risk assessment and the associated standard operating procedures (SOP); 

f. in-flight procedures for the pilot in command and the other crew members to consider and manage the risks associated with aerial work operations.

The operator’s HSEMS stated that safety risk management begins with hazard identification and then assessing the risks associated with the hazard in terms of likelihood and severity. The manual further stated that, once the level of risk was identified, appropriate remedial or mitigation measures could be implemented to reduce the risk to as low as reasonably practicable. The risk management process detailed in the HSEMS followed a 5‑stage process:

• Stage 1 - Identify the hazard and associated risks
• Stage 2 - Assess the risk in regard to severity and likelihood
• Stage 3 - Evaluate risk tolerability
• Stage 4 - Treat/mitigate the risk
• Stage 5 - Monitoring

Stage 1 of the process listed sources for hazard identification and stated that the safety manager was to use the Donesafe[12] system to manage and record these hazards. It also noted that:

Due to the varying nature of MAGSPEC Aviation’s operating environment a separate Operational Job Safety Analysis (JSA) (see appendix 3) was undertaken by the Chief Pilot or his designee to assess site-specific risks prior to each job provide an overall risk rating for the job. 

Where non-site-specific items are identified as part the JSA or field crew safety meeting these will be reported to the HSEMS system via the DONESAFE “Hazards” report tab. 

Each survey task, including the risks associated with that task, were assessed via the job safety analysis (JSA). Any risks identified in the JSA that were not specific to the survey tasking location were entered into the Donesafe system. The risks specific to the location were not captured in the system.  

Pre-operational risk assessment

One of the key requirements for managing risk was that an operator should undertake an overarching assessment (pre‑operational risk assessment) to consider and evaluate the risks associated with its proposed operations, in this case, low‑level geophysical survey. This assessment recognised the underlying principles of CASR Part 138, where the risks and hazards associated with a type of aerial work operation are common to that type of operation. The matters to be considered in the assessment included, but were not limited to the (CASA, 2023): 

− nature of the intended operation and its particular characteristics 

− location (if known) of the intended operation and its particular characteristics 

− aircraft to be used in the intended operation and their performance profile and impacts of serviceability status 

− qualifications and experience of the FCMs [flight crew members] and support personnel to be used in the intended operation 

− generic or known hazards particular to the type of aerial work operation, external to the aircraft, that may be met during the operation.

CASA advisory circular 138‑05 v2.1 Aerial work risk management, stated that an operator should use data from the risk register and dedicated risk assessments to inform the pre‑operational risk assessment. Once populated, the assessment should then be updated over time and from operational experience, to incorporate lessons learnt from previous operations. Further, to ensure it is readily available to all crew members, it should form part of the company’s operations manual.

The ATSB’s review of the HSEMS and operations manual did not identify any requirement for a pre‑operational risk assessment to be completed.The CP also confirmed that, at the time of the accident, such an assessment had not been conducted.

Risk register

Safety risk management activities should be documented, including any assumptions underlying a risk assessment, decisions made, and risk controls implemented. A risk register could be used to ensure identified hazards and risks that emerged during planning or day‑to‑day operations were tracked and mitigated as part of formal risk management processes. An operator’s risk register can also be incorporated into the pre‑operational risk assessment. The register could include the hazard, potential likelihood and consequences, assessment of the associated risks, when or where it applied, and any controls put in place to mitigate the risk. Notably, (ICAO, 2018):

Maintaining a register of identified hazards minimizes the likelihood that the organization will lose sight of its known hazards. When hazards are identified, they can be compared with the known hazards in the register to see if the hazard has already been registered, and what action(s) were taken to mitigate it. 

The CP reported that a risk register was not maintained for the company’s operations. Although it was noted that the operator did retain a fatigue risk register. 

Flight risk management plan

The results of the pre‑operational risk assessment were to be considered when preparing a flight risk management plan, which was specific to an individual flight or task within the type of operation. The plan should outline the specific mitigators or risk controls that were to be used during the flights. The flight crew should also have sufficient time to review and confirm the plan prior to the commencement of the operation. 

Job safety analysis

Components 

As required by the company operation’s manual, the JSA was the documented risk management process designed to address the safety concerns with each project the operator conducted, that is, for each specific survey task. The ATSB’s interpretation of the Part 138 risk assessment requirements was that the JSA was equivalent to the flight risk management plan, as discussed above. The JSA consisted of 5 parts:

• Part A - Pre-survey risk assessment: This assessment was to be completed by the operations manager at the time a tasking was quoted and included details on the activity, hazards, hazard effects, initial risk score, risk mitigators, residual risk, and a final risk score. This used a pre‑populated risk matrix with 14 hazard areas, each of which were assigned a descriptor and risk score of 1 (negligible) to 5 (unacceptable). The total risk score determined if any further action was required, such as a need for additional risk controls or stopping the tasking until the risk was reduced.
• Part B - Operational job safety analysis. This was to be completed by the CP or other suitable person prior to commencing the survey task. This considered any operational limitations relating to aircraft performance, obstacles and human performance, whether any hazards affected the safety or technical performance of the survey, and if any changes were required. The risk level for the task was assessed using a pre-populated matrix with 27 hazards, but with instructions to add more as appropriate. The final risk level determined if the survey could proceed as planned (low risk), or if the survey could proceed with approval from the CP and amendments to the plan or additional risk mitigators (medium risk), or if the survey was not to proceed as currently planned (high risk).
• Part C - Field crew safety meeting: The meeting was to be completed by operational personnel at the survey site, prior to commencing survey operations and every crew change. This section was a yes/no answer sheet covering a range of operational areas designed to assess any additional hazards and risks not identified in Parts A and B. At the direction of the CP, a reconnaissance flight could also be performed to assess the survey area for any additional risks or hazards not already identified in the original JSA.
• Part D - Post-survey field crew meeting: This meeting allowed the operator to better understand any issues faced on the job and if anything needed to be accounted for, either at that specific location or for an ongoing basis.
• Part E - Emergency response plan: This plan was to be reviewed during the field crew safety meeting and crew members were to ensure that the contact and procedure details were correct.

Neither Part A nor Part B referred to consideration of previous JSAs for any applicable risk information that may be relevant to the current JSA.

Survey task assessment

Parts A-C of the JSA completed for the accident flight survey task are discussed in the following paragraphs.

Part A was completed by the operations manager and listed hazards including the 25 m survey height, which was assessed with the highest risk score of 5. It did include mitigating factors of carrying a portable personal ELB and portable GPS, conducting operations with satellite flight following and a comprehensive pilot briefing including maps. 

Several elevated risk areas were identified on the matrix, such as operations below 100 ft AGL and operating in hot conditions between 35‍–‍40 °C. Overall, the initial risk rating for the survey task was determined to be low, based on a score of 36 (Figure 7)Figure 8. 

Figure 7: Part A – Initial pre-survey risk assessment for the accident task

Source: MAGSPEC Aviation, annotated by the ATSB

The CP and operations manager approved Part B of the JSA, identifying that the survey height and antenna/masts, and the survey location with regard to other aircraft activity were concerns. When considering if there were any hazards that would affect safety or the technical performance of the survey, the survey height of 25 m was noted, and the possibility of trees, powerlines and masts in the area were low still but still a risk. As such, it was determined that a detailed reconnaissance flight was to be conducted. 

The final risk level was assessed as low, with 4 hazards identified (Figure 8Figure 9). The ATSB noted that the hazard of ‘terrain clearance less than 30 metres’ had not been ticked. However, if it had been selected, the final risk level would have remained at low.

Figure 8: Part B – Hazards risk matrix for the accident tasking

Source: MAGSPEC Aviation

Part C had been originally completed by another pilot and the ground operator. That pilot had conducted a reconnaissance flight of the survey area and signed part C noting that no additional risks had been identified. That pilot was subsequently assigned to another task. 

The ATSB noted that the survey height was referred to in the question, Can the job be flown at the suggested survey height? and this was answered as yes with no amplifying comments.

The day prior to the accident, the ground operator met with the accident and morning pilot to conduct another field crew safety meeting. They discussed the JSA, and the ground operator reported that they advised the pilots about some taller trees in the area, which had been identified in the reconnaissance flight (but not noted in Part C).

Text messages between the accident pilot and CP showed that conducting another reconnaissance flight was discussed. The CP suggested that another could be done if the pilot felt it was required but there was no direction from the CP to do so. The morning pilot completed another reconnaissance of the survey area prior to commencing their survey. 

In reference to the utility and sufficiency of the JSA, the operator advised on 28 January 2025 in response to the draft report that they considered the JSA to be their risk assessment process and was a combined risk register, pre‑operational risk assessment, flight risk management plan and record of the crew meeting. The operator further advised that the JSA was reviewed by CASA during the transition to Part 138 and: 

This risk assessment was approved by CASA during the 2nd December 2021, Part 91 / 138 AWK [aerial work] changes. It has been accepted and approved by multiple third-parties, including those that represent BARS [Flight Safety Foundation’s Basic Aviation Risk Standard].

The ATSB sought clarification from CASA to determine if the JSA met the requirement of Part 138 and whether it had been approved by CASA. On 1 May 2025, CASA advised: 

The JSA as described in the report does not meet the requirement of a pre-operational risk assessment.

The reasons for this advice are:

• The ATSB report outlined that Part A of the JSA had a pre-populated risk matrix with 14 hazard areas and Part B of the JAS had a pre‑populated matrix with 27 hazards and instructions to add more as necessary.

• CASA’s AC 138-05 identifies how a risk register is a critical component to the creation of a pre‑operational risk assessment and CASA notes that the ATSB report mentions that the operator’s Chief Pilot (CP) “reported that a risk register was not maintained for the company’s operations” which supports that a pre-operational risk assessment was not produced.

• CASA agrees with the ATSB that this activity is not specifically considering or evaluating the risks associated with the type of aerial work operation to be conducted, i.e. the JSA process is basically done on a per task basis, which is not the same as the pre-operational risk assessment as the pre‑operational risk assessment is intended to be an enduring document that is regularly updated from risk register updates and post-flight risk reviews (see the first sentence of CASA AC 138‑05 paragraph 4.2.5).

• Effectively, the JSA Part A is potentially covering elements of risk assessments that would support the updating of the pre-operational risk assessment but is not creating the pre-operational risk assessment itself.

• CASA further advised:

• The accident occurred 3 months after the commencement of the new flight operations regulations, of which Part 138 of CASR and its supporting Manual of Standards was one element.

• Under the transitional rules in Subpart 202.EAA of CASR, holders of AOCs authorising aerial work under the pre-2 December 2021 paragraph 206(1)(a) of CAR, where the AOC was in force immediately before 2 December 2021, had these AOCs recognised as legally being an aerial work certificate and such operators were required to ensure their operations manuals complied with Part 138 of CASR and contained all necessary content to enable that compliance.

• As the operator was the holder of an AOC authorising aerial work under the pre-2 December 2021 rules, the content of their operations manual would have been approved by CASA as part of them holding that AOC. Compliance with the new flight operations regulations for all such operators would be reviewed at the next appropriate CASA oversight event.

Regulatory oversight activity

Regulatory framework

CASA was responsible, under the provisions of Section 9 of the Civil Aviation Act 1988, for the safety regulation of civil aviation in Australia and of Australian aircraft outside of Australia. Section 9(1) stated the means of conducting the regulation included:

(c) developing and promulgating appropriate, clear and concise aviation safety standards;

(d) developing effective enforcement strategies to secure compliance with aviation safety standards…

(e) issuing certificates, licences, registrations and permits;

(f) conducting comprehensive aviation industry surveillance, including assessment of safety‑related decisions taken by industry management at all levels for their impact on aviation safety…

The 2 primary means of oversighting a specific operator’s aviation activities were:

• assessing applications for the issue of, or variations to its air operator’s certificate (AOC) and associated approvals (including approvals of key personnel)
• conducting surveillance of its activities. 

CASA was required by Section 28 of the Civil Aviation Act 1988 to satisfy itself about various matters when processing an application for the issue of, or variation to, an AOC. The matters included whether the organisation was suitable and whether it had suitable procedures and practices to ensure that AOC operations were conducted safely.

CASA provided records related to their assessment of MAGSPEC Aviation’s initial AOC and low flying applications. 

Initial issue of air operator’s certificate 

The CASA entry control process involved assessing an application for the issue of a new AOC or a variation to an existing AOC. The worksheet used by CASA for an AOC assessment was intended to be used in conjunction with the AOC Process Manual, AOC Handbook, other relevant technical assessor handbooks and applicable legislation. This worksheet contained the criteria required for an assessor to undertake a technical assessment. It focused on generic regulatory requirements applicable to most operators and there was no specific criteria that referred to assessing an operator’s primary activity, in this case, low‑level survey operations. Although the assessment process confirmed that the operator had processes and procedures to support its operations, there was no evidence that these were examined in any detail for their suitability for the proposed operations. 

However, the CASA officer processing the AOC application acknowledged that, while it was a new operation, the organisation included personnel from a previous operator, and that these personnel had experience and exposure to low‑level survey operations. The officer further stated that this experience was evident during the assessment, interview, and inspection phases of the assessment. 

As part of the AOC application, CASA was to also approve the appointment of the CP. The CP’s records included an assessment paper, interview record, and notes from an assessment flight. The assessment focused on the CP’s ability to manage the regulatory requirements of an AOC holder, yet did not indicate how the operator would conduct its low‑level survey operations. The assessment flight did not include any low‑level flying as CASA did not permit its officers to undertake low flying. 

The AOC was issued to the operator on 3 October 2017.

In December 2021, CASA amended its AOC entry control procedures to include more emphasis on assessing the proposed primary activity. A specific worksheet was introduced for assessing a Part 138 application and included reviewing the processes that allow an operator to safely conduct and manage its aerial work operation in compliance with the regulations. 

Low flying approval

The AOC Handbook acknowledged that low flying was an operational requirement and that an application for low flying under CAR 157(4)(b) was required. This assessment was conducted at the same time as the initial AOC application.

The worksheet for the AOC application did not record any assessment undertaken by CASA to approve the operator to undertake low flying below the levels permitted in CAR 157. However, the assessing officer indicated that a key component of issuing the low flying approval was that the operator had a legitimate requirement and that its CP and line pilots held the required low‑level rating. There was no record of any in depth assessment of how the operator would address the risks associated with low flying. Further, the AOC Handbook did not provide any guidance or instruction on how such an application should be assessed.

The low flying instrument was issued to the operator on 22 September 2017. 

Surveillance post‑AOC issue (pre‑accident)

Post‑authorisation review

As at 2017, following the issue of an initial AOC, CASA was to conduct a post‑authorisation review (PAR) of the operator to ensure that all the entry control requirements were being met. This surveillance activity was to be conducted within 6‍–‍15 months following the initial issue.[13] As described in the CASA Surveillance Manual, a PAR was a type of level 1 surveillance, which was a structured, forward planned larger surveillance event. 

The CASA records showed that a PAR, as defined in its surveillance manual, had not been undertaken on the operator. 

In response to the draft report on 3 February 2025, CASA advised the ATSB that:  

At the time of the accident CASA conducted its surveillance planning under the National Surveillance Selection Process (NSSP), which was a risk-based methodology for the selection and prioritisation of surveillance events. Under the NSSP an operator such as this did not require a post authorisation review. CASA has since implemented a multi-year surveillance approach whereby all Aerial Work Operators undergo surveillance on a regular basis, irrespective of the degree of risk that CASA has assessed. This multi-year surveillance approach is one of many core elements of CASA’s National Oversight Plan.

On 3 April 2025, the ATSB and CASA had a follow‑up briefing to seek clarification on its responses to the draft report. CASA advised that the obligation for a PAR could also be achieved through an alternative activity, and in this case had been accomplished through the conduct of a level 2 surveillance event. CASA indicated that the level 2 surveillance, conducted in July 2018 (discussed below), was noted in its surveillance system as ‘post authorisation’ and would likely have been similarly scoped to a PAR. Therefore, this was considered an equivalent activity at the time. CASA had not provided the ATSB any supporting documentation indicating that an equivalent activity was permitted, or what should have been considered if this was to be undertaken. 

Surveillance in 2018

A level 2 surveillance event was a less formal interaction with an operator and could be in the form of checklist-based compliance and product checks of a specific section of its systems. A level 2 surveillance event took place in July 2018, after the operator’s first occurrence. The planned scope included airworthiness assurance, fuel load control, operational standards, and safety assurance. Nil findings were issued, and the CASA surveillance team noted that the operator was still in the process of reviewing its operating procedures with changes to be reviewed at the next surveillance event scheduled for later in 2018. It was not evident to what extent that low‑level survey operations were examined.

A second level 2 surveillance took place in October–November 2018. The planned scope included the same areas as the previous surveillance with the additional items of:

• airworthiness control
• implementation of the drug and alcohol management plan
• crew scheduling
• flight systems
• safety risk management
• assessments
• training infrastructure
• training management. 

Three safety findings and 7 safety observations were issued as a result of that surveillance. The surveillance team noted that the operator was actively trying to mitigate some of the operational risks, but the operations manual was lacking some of the procedures followed by the operator. The findings related to non‑conformance with operations manual procedures, uncontrolled documents, and aircraft defect management. 

Observations were not required to be actioned by the operator, although CASA did encourage them to do so. One observation related to fuel load control and procedures for addressing discrepancies in fuel quantity. Another observation related to limited procedures for the completion of the JSA. The surveillance report did not make any findings or observations on overall processes or procedures for low‑level survey operations. 

Periodic assessment tool

The authorisation holder performance indicator (AHPI) was a questionnaire‑based tool used by CASA to assess ‘the apparent risk to safety presented by an authorisation holder [operator]’. The AHPI tool consisted of a number of factors and sub‑factors associated with organisational characteristics and performance, commonly thought to affect or relate to safety performance behaviour. This was used by CASA to assist with determining whether any risk‑based surveillance of an organisation was required, and to scope the areas for that assessment.

A number of AHPI assessments had been completed by CASA and 5 out of the 6 AHPIs did not trigger any higher priority for surveillance. The last AHPI prior to the accident was completed in February 2022. CASA noted that there was no record in its system of a formal PAR being conducted, and there was no record of action following the 2019 and 2020 occurrences. The CASA officer recommended surveillance take place at the earliest possible convenience. 

Transition to Part 138 regulations

In response to the draft report, on 1 May 2025, CASA advised the ATSB that the accident occurred about 3 months after the commencement of the new flight operations regulations, which included Part 138. Under the transitional arrangements to the new regulations, current holders of an AOC authorising aerial work before 2 December 2021 had this certificate legally recognised as being an ‘aerial work certificate’. These operators were required to ensure that the operations manual complied with Part 138 and contained all the necessary content to enable that compliance. 

In this case, as the operator held an AOC prior to 2 December 2021, the content of its operations manual would have been approved by CASA. The operator’s compliance with Part 138 was to be reviewed at the next appropriate CASA oversight event.

While operators were not required to submit their entire operations manual for assessment prior to 2 December 2021, as part of the transition, CASA required operators (no later than 60 days prior) to submit extracts from their operations manual covering 2 key measures. These included change management and procedures for the carriage of aerial work passengers required under Part 138. CASA only required operators to submit their entire updated operations manual immediately before the commencement date of the new regulations. 

On 27 September 2021, MAGSPEC provided CASA with its complete operations manual, the HSEMS, including the change management and carriage of aerial work passenger procedures. CASA notified MAGSPEC via email in April 2022 that its initial submissions related to these 2 aspects were not yet compliant. Following a further submission by the operator, on 18 August 2022 CASA advised via email that these areas were ‘compliant’. CASA did not provide any advice related to an assessment of any other parts of the operations manual including those related to operational risk management. 

Surveillance post-accident

Shortly after the accident, CASA conducted an initial review to determine if further surveillance of the operator was required. The CASA officer noted that the operator had never undergone a level 1 surveillance event or had a PAR conducted. The officer recommended that a response surveillance event should be scheduled.

On 31 August 2023, the ATSB briefed CASA on the draft investigation findings, which included discussion on the operator’s risk management processes in place at the time of the accident. A similar briefing had also been provided to the operator on 19 July 2023. CASA completed a level 1 systems audit of the operator in September 2023. This level of surveillance is a structured, larger-type event that considers the specific activities conducted by the operator. The audit included a review and follow-up of this accident. The scope included: 

• airworthiness and maintenance aspects
• aircraft and passenger loading control
• crew scheduling and fatigue management
• operational standards, and data and documentation
• authorised activities
• flight systems and operational support systems
• safety assurance and safety risk management. 

The audit identified 6 safety findings and one observation for the operator related to maintenance documentation, fatigue management, and operations manual compliance. Specifically, one finding regarding the operations manual noted that it did not include all the content as required by the regulations. This included limited detail regarding:

• processes and procedures relating to low‑level operations and manoeuvring and role specific equipment usage (data acquisition system)
• processes and procedures relating to the training of operational and handling procedures with regards to low‑level operations and manoeuvring and role specific equipment usage (data acquisition system).

There were no other findings or observations made regarding the operational risk management processes and procedures.

At the time of the audit, the operator advised CASA that it was waiting for the completion of the ATSB’s investigation prior to initiating any changes to its processes or procedures. However, it was noted that, while the audit was not an investigation, a number of potential latent issues existed, including:

• No active or consistent fatigue monitoring of flight crew during operations other than the required recording of flight and duty records.

• Limited detail in operational risk assessments pertaining to operations in general and the additional fatigue obligations as required by legislation.

• Limited documented operational procedures and associated training relating to low level flight techniques and procedures including the use of operational equipment utilised during survey operations [as detailed above].

• Limited documented process and procedure, and subsequent detail established when conducting internal investigation following operational incidents.

Similar occurrences

Regulatory oversight

Regulatory oversight of air operations has been discussed in detail in previous ATSB investigation reports. These included a fatal Cessna 172 accident at Agnes Waters, Queensland in 2017 (AO‑2017‑005), a fatal Eurocopter EC120B helicopter accident at Hardy Reef, Queensland in 2018 (AO‑2018‑026), and a fatal Eurocopter EC135 helicopter accident at Port Hedland, Western Australia in 2018 (AO‑2018‑022).

These investigations identified that CASA’s regulatory oversight activities had not specifically examined the nature of the operator’s primary activities. The findings were as follows:

The Civil Aviation Safety Authority’s procedures and guidance for scoping a surveillance event included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards. (safety issue AO-2017-005-SI-08) 

Although the operator’s primary helicopter activity was conducting charter flights to pontoons at Hardy Reef, regulatory oversight activity by the Civil Aviation Safety Authority had not specifically examined the operator’s procedures and practices for conducting operations to these helicopter landing sites. 

Although the operator’s primary helicopter activity was conducting marine pilot transfers, regulatory oversight activity by the Civil Aviation Safety Authority had not specifically examined the operator’s procedures and practices for conducting approaches and landings to ships at night in degraded visual cueing environments. 

In response to safety issue AO-2017-005-SI-08, CASA amended its surveillance and scoping form to require consideration of current activities. Further, it proposed the addition of an operator profile report to provide current, contextual information on an operator with a view to provide a more effective audit scoping process in which consideration and documentation of an operator’s activities was mandatory.

In response to the draft report, on 3 February 2025, CASA advised the ATSB that:

CASA’s Surveillance activities do not include specific checks of the suitability or effectiveness of the processes and procedures in these specific areas. However, under CASR [Civil Aviation Safety Regulation] Part 138.370, the operator is required to conduct risk assessments and mitigation processes before conducting any particular aerial work operation (that is, they must consider the risk of the specific operation and introduce appropriate mitigants). Surveillance is carried out under set scope of 138 operators under this regulation to ensure the operations are suitably risk assessed. 

Based on the actions in response to AO-2017-005-SI-08, the ATSB was of the understanding that an operator’s primary activity was considered in entry control processes and surveillance scope. As such, the above comment was also discussed at the ATSB‑CASA meeting on 3 April 2025. CASA advised that an operator’s primary activity is considered, and when assessing a Part 138 operator it uses a standardised worksheet to ensure there is a consistent approach to that assessment and to maintain a record of the decision‑making process. 

Low-level accidents

There has been a number of ATSB investigations into fatal accidents that resulted from a loss of control at low altitude, from which a recovery was not possible.

ATSB investigation AO-2012-059

On 29 April 2012, the owner-pilot of a Cessna 150 aircraft, registered VH‑UWR, was aerial stock mustering on a cattle station about 55 km north‑east of Bourke, New South Wales. The aircraft was observed circling over an area (where cattle were not moving), then entered a steep descent followed by the sound of an impact. The aircraft was substantially damaged, and the pilot sustained fatal injuries.

The ATSB found that, while manoeuvring at low level, the pilot inadvertently allowed the aircraft to aerodynamically stall, resulting in a high rate of descent and collision with terrain. There was insufficient information about pilot control inputs to establish the factors that precipitated the stall.

ATSB investigation AO-2014-192 

On 29 December 2014, a Cessna 172S aircraft, registered VH‑PFT, departed Cambridge Airport, Tasmania to photograph yachts participating in the 2014 Sydney Hobart race. On board the aircraft were the pilot and a photographer.

At about 1815 local time, the aircraft commenced low-level photographic runs on yachts to the east of Cape Raoul. Shortly after completing a run on one yacht at a height of about 50 ft, the aircraft entered a steep climbing turn. The aircraft had almost completed a 180° turn when the upper (right) wing dropped sharply while the aircraft’s nose pitched down to almost vertical. The aircraft impacted the water’s surface in an almost vertical nose‑down attitude with wings about level. Both aircraft occupants were fatally injured, and the aircraft was substantially damaged.

As a result of the steep climbing turn, the aircraft’s upper wing aerodynamically stalled, resulting in a rapid rotation out of the turn. The steep pitch attitude indicated that, due to the stalled upper wing, the aircraft entered a spin. There was insufficient height for the pilot to recover the aircraft.

ATSB investigation AO-2021-016 

On 13 April 2021, a Cessna R172K aircraft, registered VH-DLA, departed Canberra Airport, Australian Capital Territory, with a pilot and an observer on board to conduct powerline survey work to the north of Sutton township, New South Wales.

About 3 hours into the flight, while conducting a powerline inspection in the vicinity of Tallagandra Lane, nearby witnesses observed the aircraft flying low above the trees before commencing a left turn that continued into a steep descent and collision with terrain. The pilot and observer were fatally injured, and the aircraft was destroyed.

The ATSB found that, while manoeuvring to align the aircraft to inspect a powerline, the aircraft aerodynamically stalled and entered a spin at a height that was insufficient for recovery prior to the collision with terrain.

ATSB investigation AO-2021-052 

On 4 December 2021, the pilot of an Air Tractor AT‑400 aircraft, registered VH‑ACQ, was conducting aerial spraying operations on a property 75 km west‑south‑west of Moree, New South Wales.

At 0632 local time, the aircraft took off from the property’s airstrip with the first spray load. The pilot then completed 10 spray loads, each time returning to the airstrip to replenish its load. 

Prior to departing with the 11th load, the aircraft was refuelled to full and its spray load refilled. The aircraft then returned to the western side of the target block, but after descending to recommence spraying towards the south, the aircraft climbed and turned away to track north and overfly a flood-affected area. The pilot radioed the company operations manager expressing concern about the weather conditions and the potential for chemical to drift onto a neighbouring property. About 5 minutes later, the aircraft returned to the target block, this time on the eastern boundary.

The pilot then conducted 2 ‘smoker’ runs to assess the drift, followed by 5 back‑to‑back (parallel) spray runs. At the end of the 5th spray run, the aircraft was observed to climb then enter a right procedure turn. During the turn, the aircraft descended rapidly, collided with terrain, and was subsequently destroyed by fire. The pilot sustained fatal injuries.

The ATSB found that the aircraft was too close to the start of the spray run during the turn, which probably resulted in the pilot tightening the turn. This almost certainly resulted in an aerodynamic stall at a height too low to recover before colliding with the ground.

Safety analysis

Introduction

In the afternoon of 3 March 2022, a Cessna U206G, registered VH‑JVR, was being operated on a low‑level geophysical survey flight. When on the 25th survey line, the aircraft collided with terrain and was destroyed in the post‑impact fire. The pilot was fatally injured. 

This analysis will discuss the potential reasons for the loss of control and the initiation of the emergency response. The angle of bank regularly used for procedure turns, and the benefits of protective clothing and helmets are also examined. It will also consider the operator’s risk management processes and supporting procedures for low‑level geophysical survey flights, and regulatory oversight of these activities. 

Loss of control

The last recorded position of the aircraft was on a survey line consistent with the planned survey parameters. Likewise, a comparison of the available flight data indicated that the aircraft’s location was in a similar position to that of previous procedure turns. Therefore, it was likely that the aircraft was being manoeuvred onto the next survey line at the time of the accident.

The wreckage examination determined that the aircraft impacted the trees in a left angle of bank, with a steep angle of impact and a nose‑down attitude, indicative of a loss of control. The ATSB considered several reasons for the loss of control. There was no evidence to suggest any airborne impact with a bird nor that the weather conditions affected the pilot’s ability to maintain control of the aircraft. To the extent possible, the ATSB determined that the aircraft was structurally intact, there was no flight control malfunction, and the engine was producing power at the time of impact. Further, the pilot did not have any reported health issues, and the post‑mortem and toxicology examinations did not identify the presence of any natural disease or substances. While some causes of incapacitation may not always be identified post‑mortem, there was no evidence to suggest that the pilot had become incapacitated during flight.

The pilot had previously conducted 24 survey lines with no apparent issues identified from the recorded data. Based on the ATSB’s analysis, the aircraft’s airspeed had remained above the aerodynamic stall speed during the procedure turns. Therefore, there was no indication of a near or actual stall on the previous turns. Although, the data identified that the procedure turns were consistently conducted at heights below which a recovery from a stall and loss of control may not be possible. A stall situation was a plausible explanation, as found in previous ATSB investigations into low‑level accidents. However, in this case, this remained only a possibility due to the lack of recorded data beyond the last known position and no witness observations, making it difficult to determine the precise circumstances that led to the loss of control and collision with terrain.

Delayed emergency response

The operator had a phased emergency response plan, predicated on an elapsed time since the aircraft’s estimated time of arrival (ETA). Each phase was commensurate with an escalating level of concern. Unless there was a notification of an accident by other means, the distress phase would commence at 30 minutes past the ETA, at which point the Joint Rescue Coordination Centre (JRCC) would be contacted to initiate search and rescue activity. Each phase of the plan required accessing the satellite tracking system to ascertain the location of the aircraft. 

When the satellite tracking data stopped at 1343, the automatic watch function did not send an alert to the operator after 15 minutes had elapsed, as this function had not been activated. This was not noticed until 1430 when the ground operator conducted a periodic check. While the operator reported previously experiencing dropouts of the satellite tracking system, Spidertracks confirmed that up to the loss of data, the device was functioning as expected and that there were no recorded system outages. 

The ground operator was not able to contact the pilot via mobile phone and there was no emergency beacon activation. The ATSB noted that, while the aircraft was not fitted with an emergency locator transmitter, a personal locator beacon was carried in the aircraft. However, as this was not worn by the pilot, this was not readily accessible following the accident. 

As such, the status of the pilot and aircraft could not be established. The operations manager then advised the ground operator to follow the emergency response plan and wait until the ETA. When the aircraft did not arrive at the ETA of 1630, about 3 hours after the accident, in accordance with the plan the operator contacted the JRCC at 1701. 

The JRCC promptly initiated search and rescue procedures, and an aircraft departed at 1739 and located the aircraft wreckage at 1852. A search and rescue helicopter crew physically located the pilot at 0042. With the time taken to access the pilot, whose injuries required immediate medical care, it was very likely that even if the search and rescue activities had commenced when the satellite tracking data was lost, the pilot would have succumbed to the injuries received.

When an accident occurs and any injuries that result are potentially survivable, a timely response is essential. Minimising the time for search and rescue and enabling emergency services to respond as quickly as possible may increase the chances of a successful outcome. 

Low-level manoeuvring

The operator’s pilots routinely used high angle of bank procedure turns to manoeuvre between consecutive survey lines. This back‑to‑back pattern was described by the chief pilot (CP) as the most efficient method and it also reduced pilot workload, especially for obstacle and hazard avoidance.

The CP stated that procedure turns were trained to be at about 300 ft above ground level and a 45‍–‍60° angle of bank (known as a steep turn). Analysis of the accident flight indicated that the pilot was flying high angle of bank procedure turns consistent with the operator’s training. However, they were turning at an average of about 200 ft, lower than what was explained by the CP. 

The ATSB noted that, during the preceding 24 turns, the pilot had maintained sufficient margin above the stall speeds listed in the pilot’s operating handbook. However, as aircraft data was not available up to the loss of control it was not possible to determine if the aircraft stalled nor the exact circumstances that existed.

The similar occurrences discussed involved a loss of control that was preceded by a stall at very low heights. The U206G pilot’s operating handbook stated that up to 240 ft may be required to recover from a stall, but this height was based on flight testing in controlled conditions and that significantly more height may be required.

High angle of bank turns at low level present a significant risk and International Airborne Geophysics Safety Association (IAGSA) recommended that the angle of bank should be limited due to the stall speed increasing with increasing angles of bank, thus reducing the safety margins available. These margins can be quickly eroded if a pilot tightens the turn to ensure they intercept the survey line, which can increase the load factor further, resulting in reaching the stall speed quicker.

Protective clothing and helmets

At the time of the accident, the pilot was not wearing any protective clothing or a helmet. The use of such equipment was not required by the regulator, or the operator having considered environmental, comfort, and cockpit space aspects. Instead, it was left to the individual pilot’s discretion. 

The ATSB’s aviation medical specialist indicated that protective clothing and helmets may reduce the magnitude of injuries in an accident. While they were unable to comment on the effectiveness of these items for this accident, it was acknowledged that these items would not have protected the pilot from smoke inhalation. 

In some cases, occupants survive an accident only to succumb to hazards such as fire, drowning or environmental elements such as heat and cold (Shanahan, 2004). IAGSA recommended that survey pilots/crew wear protective clothing, not just as fire protection in the event of an accident but to also provide coverage from the elements while waiting for rescue or in a survival situation. Similarly, the Basic Aviation Risk Standard also recommended that all flight and aircrew wear protective clothing during operations. It is therefore important that these hazards have been considered to enable the best opportunity for survival in the event of an accident.

Risk management

In August 2019, MAGSPEC Aviation implemented a health, safety and environmental management system (HSEMS), which was intended to meet the Civil Aviation Safety Authority (CASA) safety management system (SMS) requirements. It also provided more generalised guidance on the management of risk within the organisation. However, as an SMS was not required by regulation, it was not assessed by CASA. The ATSB acknowledges that an operator’s SMS, in this case HSEMS, will evolve and mature with time. Significant events like accidents provide an opportunity to assess if the system is operating in a way that assures the highest level of safety given the nature of their operations. 

Acknowledging the CASR Part 138 requirements for aerial work operators to undertake risk assessments, which came into effect about 3 months prior to the accident, the ATSB reviewed the safety risk management component of the HSEMS. The HSEMS manual had detailed the 5‑stage process for risk management. However, there was no requirement in the operator’s manuals, as required by Part 138, to conduct a pre‑operational risk assessment nor had one been completed, as confirmed by the CP. 

The absence of a pre‑operational risk assessment did not allow formal mitigation strategies, nor provide assurance that the risk level associated with low‑level survey operations was as low as reasonably practical. For example, the operator reported that the survey flights were often flown at about 30 m (100 ft) above ground level. While low operating heights were specified in the job safety analysis (JSA), there was no formalised risk controls referred to in the JSA. The accident survey flight had been flown at 25 m (85 ft) and this had been accepted on the basis of the reconnaissance flight, without any formal identification and implementation of supporting risk controls. While IAGSA acknowledged that stipulating a fixed minimum safe survey height was not practical given differences in survey conditions and aircraft characteristics, a pre‑operational risk assessment for operations at a reasonably anticipated operating height may have provided a foundation from which to adequately assess any variations to this height.

Further, the operator routinely flew consecutive survey lines, which used increased (steep) angle of bank procedure turns (45‍–‍60°) to manoeuvre between the lines. There was no assessment to identify any risks associated with conducting higher angle of bank turns at low-level to ensure that reasonable mitigations were implemented, and appropriate safety margins were applied. 

The HSEMS further outlined that non‑site‑specific hazards were reported in their online SMS program, but due to the varying nature of operations, a separate site‑specific assessment of each survey job would be completed using the JSA. With the JSA, each survey task was assessed in isolation, with no reference to previous JSAs to ensure that applicable risk controls continued to be applied and/or were appropriate. Also, the JSA did not benefit from being informed by an overarching pre‑operational risk assessment. Therefore, as the predominant method for assessing operational risk, the JSA did not provide assurance that all hazards would be identified, and the associated risks would be assessed and mitigated. 

As noted by the International Civil Aviation Organization (2018), safety risk management activities should be documented and the Part 138 Manual of Standards stipulated that the operator’s pre‑operational risk procedures were to include the use of a risk register. The CP reported that an operational risk register was not being maintained as part of their HSEMS at the time of the accident. While non‑site‑specific hazards would be recorded and assessed in the online SMS program, there was a missed opportunity to record the site‑specific hazards identified from the individual JSAs. Therefore, without a risk register, the operator’s ability to track, monitor, and mitigate all known hazards, and assess the effectiveness of existing risk controls was limited. 

In interactions with CASA during the transition phase to Part 138 and the level 1 surveillance event post‑accident, there was no commentary related to the adequacy of the operator’s operational risk management processes. On that basis, the operator was of the understanding that the JSA met the risk assessment requirements of Part 138 inclusive of a pre‑operational risk assessment. However, CASA has since advised the ATSB that the JSA did not meet the requirements of a pre‑operational risk assessment.

Survey manoeuvres

As emphasised by IAGSA, conducting steep turns at low level can present challenges for fixed‑wing aircraft as any margin above the stall speed can quickly diminish and there may be limited height within which to respond to an unexpected situation. The ATSB’s analysis of the flight data showed there was some variation in the angle of bank used during the procedure turns on the accident flight, ranging from 43° up to the Cessna U206G angle of bank limit of 60°. At this limit, the stall speed increases by about 40%. The data also indicated that the procedure turns were conducted at an average of about 200 ft above ground level, which was lower than what was explained by the CP.  

Similarly, a review of the morning pilot’s flight and discussions with other company pilots identified that there were differences in the individual turn techniques, demonstrating variations of the procedure turns.

While 45‍–‍60° angle of bank procedure turns were being taught, the operations manual did not include any policy or procedure for this manoeuvre. Further, there were no specific limits identified, such as a minimum turn height or maximum angle of bank, to establish appropriate safety margins such as that recommended by IAGSA. 

ATSB research investigation report B2004/0337 discussed the importance of operational procedures:

The absence, deficiency or inappropriateness of operating procedures for operators may increase the risk to aviation safety.

The absence of standardised procedures means there may be considerable differences in the techniques used by different operators and contracting organisation staff to conduct tasks. Processes that are used to accomplish a particular task will evolve through a process of experience and passing on this information, often by word of mouth. There will be inconsistencies in how the task is accomplished, as different staff and operators will have differing levels of competence and experience, and different solutions to the same problem will have naturally evolved. The organisation that is managing the operation in such an uncontrolled environment will not be in full control or fully aware of how its tasks are being accomplished and therefore will have less control over the safety of the operation.

While the ATSB was unable to determine the circumstances that led to the loss of control, an operator’s expectations and desired safety margins should be documented to minimise variation and ensure operations are performed safely. Otherwise, without formal procedures, pilots are required to exercise judgement based on their experience, skills and knowledge.

Flight following

Survey flights are often conducted over remote, inhospitable terrain where regular communication services may not be available. Therefore, the use of satellite‑based flight following services are essential for providing real‑time monitoring of an aircraft’s location and for an efficient search and rescue response. 

The operator had installed Spidertracks to all its aircraft and there was an expectation that an automatic alert would be received from the system in the event of emergency. However, there was no requirement and supporting procedure to check the functionality of the system prior to each flight. In this case, the alert function had not been activated for multiple flights, including the accident flight, which potentially influenced the delayed emergency response. Also, while the ground operator assigned to each tasking was responsible for providing flight following services, there was no expected schedule for checking the satellite tracking nor any procedure detailing the expectations of this role. Despite this, given the severity of the pilot’s injuries, it was very unlikely that a prompt emergency response would have changed the outcome. 

It is important that an emergency response plan clearly identifies the notification and escalation triggers to avoid delays. Satellite tracking systems are useful in their ability to provide early notification of an emergency, especially in cases where the occupants have been incapacitated or otherwise unable to raise an alarm. However, their usefulness can only be realised if, when installed, they are correctly configured and operating as expected, otherwise increasing the risk of a delayed response.

Regulatory oversight activity

Since 2019, 3 ATSB investigations have been published identifying that regulatory oversight did not formally include the nature of the operator’s primary activities, the inherent threats or hazards associated with those activities, and the risk controls for managing those threats or hazards.

The ATSB acknowledges that CASA’s regulatory oversight activities were subject to normal constraints of time and resources, which may limit an ability to identify issues. Therefore, regulatory surveillance cannot examine every aspect of an operator’s activities, nor identify all the limitations associated with these activities.

The initial air operator’s certificate assessment of the operator and CP focused on the generic regulatory requirements and there were no criteria to evaluate their primary activity of low‑level survey operations. Although CASA had considered the operator and its key personnel as being suitable to conduct the proposed operations, there was no evidence that the processes and procedures for the primary activity had been specifically examined. Likewise, while the operator’s pilots held the appropriate low-level rating, there were no records to indicate that a detailed assessment of how the operator would address the risks associated with low flying had been conducted as part of the low flying approval. 

Prior to this accident, the operator had undergone surveillance twice in 2018, following the first occurrence. Operational standards were included in the scope for both surveillance events but there were no related findings made by CASA nor was there any indication to what extent the operator’s low-level survey operations were examined.

The last AHPI review in early 2022 also noted that no post‑authorisation review (PAR) had been conducted following the initial issue of the air operator’s certificate (AOC) and there were no CASA records of action following the 2019 and 2020 occurrences. Consequently, it was recommended that a surveillance activity take place. The same recommendation was also made following this accident. The subsequent surveillance event in 2023 identified that the operator had limited documented operational procedures and training related to low‑level flight techniques. 

CASA advised that a PAR (a type of level 1 surveillance) was likely to have been covered by an alternative level 2 surveillance event. The ATSB noted that a level 1 event was more comprehensive than a level 2, and for a PAR, was intended to ensure that the entry control requirements were being met following the initial issue of an AOC. As the CASA officers had made comments about a PAR having never been conducted, it was unclear whether the level 2 was sufficient to have been considered as having met the requirement of a PAR. 

While none of CASA’s activities specifically focused on topics related to low‑level survey operations, for example survey patterns and heights, it was difficult to determine whether additional focus, through the conduct of a level 1 PAR for example, would have identified the specific aspects as found in the post‑accident surveillance event. However, CASA has since strengthened its AOC entry control procedures and surveillance planning and scoping to include more emphasis on assessing the primary activity including the use of a specific worksheet that highlights areas specific to Part 138 operators. Consideration of the primary activity provides a level of assurance that operators continue to meet the established requirements and function at the level of competency and safety required to undertake the activity for which they have been approved to perform. 

In addition to the above, and as previously discussed, the ATSB identified deficiencies with the operator’s risk management processes. As the requirement for risk assessments only came into effect about 3 months prior to the accident, with the introduction of Part 138, there was limited opportunity for CASA to review these processes within that period. It was also noted that CASA had intended to look at the operator’s Part 138 compliance at the next scheduled surveillance event. 

The 2023 surveillance event, which was also a review and follow-up to the accident, was a level 1 surveillance and included risk management within the scope of that activity. However, there were nil findings or observations identifying that there was no pre‑operational risk assessment and risk register, although required under Part 138. As an unintended consequence of this and the transition process to Part 138, the operator was of the understanding that the JSA satisfied this requirement. However, CASA has since indicated to the ATSB that the JSA did not meet the requirement of a pre‑operational risk assessment. While post‑accident, the 2023 surveillance event was a missed opportunity for CASA to identify the deficiencies in processes and inform the operator’s understanding of their risk assessment obligations under Part 138.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain, involving a Cessna U206G registered VH-JVR, 124 km west of Norseman, Western Australia, on 3 March 2022. 

Contributing factors

• It was likely that, during a manoeuvre to intercept the next survey line, for undetermined reasons, control of the aircraft was lost at a height from which recovery was not possible, resulting in a collision with terrain. 

Other factors that increased risk

• An emergency response was not initiated until 30 minutes after the aircraft's estimated time of arrival, which was 3 hours after satellite tracking had stopped and attempts to contact the pilot had been unsuccessful. Although an earlier response was very unlikely to have altered the outcome in this case, minimising the time for search and rescue and enabling emergency services to respond as quickly as possible may increase the chances of a successful outcome.
• In accordance with the operator’s training, pilots routinely used increased angle of bank (45‍–‍60°) turns at low altitude to position the aircraft onto survey lines. This increased the risk of an aerodynamic stall at altitudes from which recovery may not be possible.
• The operator did not require its pilots to wear protective clothing or helmets during low‑level survey operations, nor were they required to do so by regulations. However, the use of such has been recommended by industry to improve survivability in the event of an accident.
• MAGSPEC Aviation's safety risk management processes did not include a pre‑operational risk assessment that recognised the generic risks and hazards common across that type of operation nor was a risk register maintained. Consequently, there was limited assurance that all the risks had been identified and that all reasonable mitigations had been applied. (Safety issue)
• The operator’s pilots were trained to, and routinely flew survey patterns utilising steep turns at low level. However, procedures or limitations specific to these manoeuvres were not included in the operations manual, which increased the risk of inconsistencies in the application of those manoeuvres and reducing the safety margins available.
• While the operator’s aircraft were fitted with a satellite-based flight following system, there was no requirement nor were there supporting procedures to confirm the set‑up and functionality of the system prior to flight or to monitor the system during flight. This increased the risk the system not operating as expected and not providing early notification of an emergency.
• The Civil Aviation Safety Authority regulatory oversight of the operator had not specifically included the primary activity of low-level survey flights, or the processes and procedures designed to reduce the risks associated with that activity.

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.  Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.  Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Risk management framework

Safety issue number: AO-2022-011-SI-01

Safety issue description: MAGSPEC Aviation's safety risk management processes did not include a pre‑operational risk assessment that recognised the generic risks and hazards common across that type of operation nor was a risk register maintained. Consequently, there was limited assurance that all the risks had been identified and that all reasonable mitigations had been applied.

Safety recommendation to MAGSPEC Aviation Pty Ltd

The ATSB makes a formal safety recommendation, either during or at the end of an investigation, based on the level of risk associated with a safety issue and the extent of corrective action already undertaken. Rather than being prescriptive about the form of corrective action to be taken, the recommendation focuses on the safety issue of concern. It is a matter for the responsible organisation to assess the costs and benefits of any particular method of addressing a safety issue.

Safety recommendation number: AO-2022-011-SR-01

Safety recommendation description: The Australian Transport Safety Bureau recommends that MAGSPEC Aviation Pty Ltd develops and maintains a pre-operational risk assessment and risk register that is separate to its existing job safety analysis process. This should encompass the generic risks and hazards common across its operations and allow it to fully consider operational risks beyond individual survey tasks.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Additional safety action by MAGSPEC Aviation Pty Ltd

In response to this accident, MAGSPEC Aviation has taken the following safety action:

• The JSA has been revised to include the selection of consequence and likelihood to determine a risk for each identified hazard. It also recorded mitigations that would be applied. The operator advised the overall and highest risk scores determined whether the survey could proceed and/or if it was likely to increase the fatigue and safety of the operation to unacceptable levels.
• The health, safety and environmental management system has been incorporated into the operations manual as an appendix.
• The emergency response plan was revised to clarify initiation triggers and accounted for a satellite tracking system failure. The operator has also equipped its operations room with 2 dedicated monitors for the sole purpose of tracking aircraft.
• The operations manual now includes a minimum speed versus angle of bank section and pilot actions if an aircraft cannot achieve or maintain the required speed.
• Guidance on procedural turns has been formalised in the operations manual. Although there is a description of how to conduct the turn, the manual also explains that this was the desired turn method and may not always be possible (due to terrain, obstacles, block shape et cetera).
• The operations manual has been amended to clearly state that an aircraft was required to have a fixed emergency locator transmitter. If this becomes unserviceable or has to be removed, the aircraft can only be flown for the purpose of having the issue rectified.
• Each pilot has been issued with a personal locator beacon, individually registered with the Australian Maritime Safety Authority. Pilots are required to keep the device on their person while operating company aircraft. The operations manual also states that the personal locator beacon cannot be carried/used if not tested.
• Follow-up with Spidertracks is to be made on each occurrence of dropout, service interruption or delay in tracking updates and numerous improvements made to the interface. The operator advised that the SOS automatic watch function and alert has been investigated and rectified. A checklist item has been added to ensure Spidertracks is correctly functioning prior to departure.
• They no longer operate at survey heights below 30 m.
• The operator identified that its low‑level training syllabus was lacking parameters to mark a pilot as competent, especially in critical phases of flight. This has been formalised to match what had been done practically.
• Its operations manual is currently under review by CASA. This includes items to enable Flight Safety Foundation’s Basic Aviation Risk Standard accreditation. Just prior to final publication of this report, the operator advised that it had been awarded the Basic Aviation Risk Standard accreditation.

Glossary

AGL	Above ground level
AHPI	Authorisation holder performance indicator
AoA	Angle of attack
AOC	Air operator’s certificate
CAR	Civil Aviation Act
CASA	Civil Aviation Safety Authority
CASR	Civil Aviation Safety Regulations
CoG	Centre of gravity
CP	Chief pilot
ETA	Estimated time of arrival
ELT	Emergency locator transmitter
G	Gravity
GPS	Global positioning system
HSEMS	Health, safety and environmental management system
IAGSA	International Airborne Geophysics Safety Association
JRCC	Joint Rescue Coordination Centre
JSA	Job safety analysis
MOS	Manual of Standards
PLB	Personal locator beacon
POH	Pilot’s operating handbook
SMS	Safety management system

Sources and submissions

Sources of information

The sources of information during the investigation included:

• MAGSPEC Aviation Pty Ltd
• other pilots who conducted flights for the operator
• recorded data from the satellite tracking device
• the maintenance organisation
• aviation medical specialist
• Pathwest Laboratory Medicine WA
• Civil Aviation Safety Authority
• Bureau of Meteorology
• Western Australia Police Force
• Australian Maritime Safety Authority Joint Rescue Coordination Centre
• Spidertracks Ltd.

References

Australian Transport Safety Bureau. (2005). Aviation Research Investigation Report B2004/0337 Risks associated with aerial campaign management: Lessons from a case study of aerial locust control. Retrieved from /publications/2005/aerial_locust_control/

Australian Transport Safety Bureau. (2013). ATSB Research Investigation AR-2012-128 A review of effectiveness of emergency locator transmitters in aviation accidents. Retrieved from /publications/2012/ar-2012-128

Civil Aviation Safety Authority, (2021). Civil Aviation Safety Regulations 1998 Part 138 - Aerial work Operations. Retrieved from https://www.legislation.gov.au/F1998B00220/2021-12-02/text

Civil Aviation Safety Authority, (2021). Part 138 (Aerial Work Operations) Manual of Standards 2020 Retrieved from https://www.legislation.gov.au/F2020L01402/2021-12-02/text

Civil Aviation Safety Authority, (2022). Aerial work risk management (advisory circular AC138-05 v2.0) Retrieved from https://www.casa.gov.au/aerial-work-risk-management 

Federal Aviation Administration, (2021). Airplane Flying Handbook, FAA-H-8083-3C. US: FAA. Retrieved from Airplane Flying Handbook | Federal Aviation Administration (faa.gov)

Flight Safety Foundation, (2022). Basic Aviation Risk Standard Implementation Guidelines. (Version 9 2022). Retrieved from https://flightsafety.org/bars/the-bar-standards-and-manuals/

International Airborne Geophysics Safety Association. (2017). Safety Policy Manual (v2017-1201). Retrieved from https://iagsa.ca/

International Civil Aviation Organization. (2018). Safety Management Manual, fourth edition, Montréal: International Civil Aviation Organization.

Shanahan, D.F. (2004). Human tolerance and crash survivability. RTO HFM Lecture Series on ‘Pathological Aspects and Associated Biodynamics in Aircraft Accident Investigation’. Madrid, Spain.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• MAGSPEC Aviation Pty Ltd
• other pilots who conducted flights for the operator
• Civil Aviation Safety Authority.

Submissions were received from:

• MAGSPEC Aviation Pty Ltd
• Civil Aviation Safety Authority.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]      Aerodynamic stall: occurs when airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack, typically 16˚ to 18˚, and results in reduced lift.

[2]      Integral fuel tanks are part of the aircraft structure. They are manufactured by assembling parts of the aircraft structure with sealant to form a fuel-tight compartment, most commonly in the wings.

[3]      A supplemental type certificate is a type certificate issued when an applicant has received regulatory approval to modify an aeronautical product from its original design. The supplemental type certificate, which incorporates by reference the related type certificate, approves not only the modification but also how that modification affects the original design.

[4]      The system was pre-programmed by the ground operator prior to departure, minimising any manipulation required by the pilot during flight.

[5]      From the pilot’s operating handbook, the calibrated airspeed and indicated airspeed in the range of interest were within 1 kt, so for the purposes of the analysis were considered equivalent. The term indicated airspeed is used throughout the analysis.

[6]      G load: the nominal value for acceleration. In flight, G load represents the combined effects of flight manoeuvring loads and turbulence and can have a positive or negative value.

[7]      A steep turn is one greater than a 45° bank angle.

[8]      Carbon monoxide is a colourless, odourless, tasteless, and poisonous gas that is produced as a by-product of burnt fuel. Exposure to a leak from the exhaust of an aircraft engine into the cabin can lead to elevated levels of carbon monoxide, which can impair cognitive function.

[9]      https://flightsafety.org/bars/the-bar-standards-and-manuals/

[10]    CAR 157 (2) requires that an aircraft shall not fly over a populous area at a lower height than 1,500 ft or any other area at a lower height than 500 ft. CAR 157 (4)(b) states that the provisions of CAR 157 (2) shall not apply if the aircraft is engaged in aerial work operations and the operator has a permit from the authority (CASA) to do so.

[11]    As the wing to which the stall warning vane is mounted approaches the critical AoA, the relative air flow changes direction and will push the vane up, closing a switch in the device. This will activate a warning horn.

[12]     Donesafe is a web and application‑based safety management system tool.

[13]    This timeframe has since changed with the most recent being 12-18 monthsfollowing the initial issue, depending on the type of authorisation issued (CASA Surveillance Manual version 5.2 ‑ May 2024).

Executive summary

The ATSB conducts 'no-blame' investigations for the purpose of improving transport safety. ATSB investigations are independent of other investigations, including those conducted by the Civil Aviation Safety Authority and the Northern Territory Police Force.

What happened

On 28 February 2022, at about 0900 local time, a pilot and an egg collector were preparing to commence crocodile egg collection activities near King River, Northern Territory, using a Robinson R44 Raven II helicopter, registered VH-IDW and operated by Helibrook. The activity was conducted under a Civil Aviation Safety Authority (CASA) instrument authorising the pilot to carry a sling person (egg collector) on a 100 ft line attached to the helicopter.

At 1024, the crews of 2 other R44 helicopters collecting crocodile eggs nearby became concerned that they had not heard any communications from the crew of VH-IDW, which they reported was unusual. One of those helicopters returned to the area where VH-IDW was last seen and, at 1036, the search pilot found the fatally injured egg collector on the ground, wearing their harness and attached to the sling line, which was disconnected from the helicopter. The helicopter had collided with terrain 44 m beyond the sling person, and the pilot lay beside the helicopter having sustained serious injuries.

The ATSB referred matters concerning possible offences under the Transport Safety Investigation Act 2003 relating to the status of evidence available to the ATSB for the purposes of its 'no-blame' safety investigation to the Australian Federal Police for investigation. The referral did not concern the circumstances of the accident itself. The Australian Federal Police referred the matters to the Northern Territory Police as part of its broader investigations.

What the ATSB found

The ATSB found that the helicopter was likely not refuelled at the en route fuel depot, which was about three quarters of the way between the departure location on the outskirts of Darwin and a clearing near King River where the helicopter and crew were to commence crocodile egg collecting. The pilot did not identify the reducing fuel state before the helicopter’s engine stopped in flight due to fuel exhaustion. During the subsequent autorotation, the pilot released the egg collector above a likely‑survivable height, fatally injuring them. The pilot then completed the autorotation to the ground, but there was insufficient main rotor energy to cushion the landing. This resulted in serious injuries to the pilot and substantial damage to the helicopter.

The ATSB found that Helibrook’s CASA-approved safety management system was not being used to systematically identify and manage operational hazards. As a result, the risks inherent in conducting human sling operations, such as carriage of the egg collector above a survivable fall height, were not adequately addressed.

The ATSB also found that CASA did not have an effective process for assuring an authorisation would be unlikely to adversely affect safety. As a result, CASA delegates did not use the available structured risk management process to:

• identify and assess risks
• ensure suitable mitigations were included as conditions of the instrument
• assess the effects of changes on the overall risk.

This resulted in removal of instrument conditions limiting the height, speed and exposure for the sling person, which permitted carriage of the egg collector at a non‑survivable fall height.

In addition to the above contributing factors to the accident, the ATSB identified the following factors that increased risk but there was insufficient evidence to show they contributed to the accident or severity of the consequences, or to another contributing safety factor. The ATSB identified that CASA's lack of effective process resulted in the continued operation of piston engine helicopters for human sling operations without adequate mitigations. This included the issue of a 3-year instrument to Helibrook shortly prior to the commencement of improved regulations that would require a turbine engine helicopter for human slinging operations. Although conducting the operation with a piston helicopter increased the overall risk of the activity compared with use of a turbine helicopter, previous accident data showed fuel exhaustion was as likely to occur in a piston as it was in a turbine engine helicopter.

Although not likely to result in sudden power loss, engine defects present at the time of the accident likely affected the engine’s maximum power output and fuel consumption. Additionally, Helibrook had likely overrun the helicopter's maintenance, inspection and overhaul periods, which increased the likelihood of the helicopter experiencing a technical failure or malfunction.

The ATSB also found that the pilot’s exposure to cocaine within the previous few days increased the likelihood of fatigue, depression and inattention, however there was insufficient evidence to determine whether these effects occurred.

Finally, the ATSB found that the helicopter's emergency locator transmitter had been removed from its mount prior to the accident. Therefore, it could not activate automatically, which likely delayed the emergency response.

What has been done as a result

CASA implemented significant changes to its internal processes to ensure that the assessment and management of safety risks of new aviation activities (and associated approvals) were standardised in accordance with the CASA Risk Management Manual and that decision-making was appropriately documented. Additionally, CASA developed an ‘exemption protocol suite’ of documents, which detailed the principles, protocols and work instructions for CASA’s regulatory exemption process. CASA also completed and provided exemplar bowtie and aviation safety risk assessments using the structured process. 

Following this accident, Helibrook advised that it had ceased operation and the helicopter fleet was being sold. In addition, the chief executive officer/chief pilot was no longer involved with the operation. CASA confirmed that as Helibrook no longer had the required key personnel, it was considered to be suspended from operation. Under those circumstances, the operator’s safety management system was no longer in use.

Safety message

The contributing factors to this fatal accident highlight the significant influence that the actions and decisions of pilots, operators and the regulator can all have on aviation safety.

Fundamentally, this occurrence illustrates the importance of effective fuel management. It is vital to use all available means, including accurate fuel records and quantity cross‑checks, to ensure that pilots accurately know their aircraft’s fuel state. This is especially critical when operating a helicopter where a fuel‑related power loss offers few safe options, such as inside the height-velocity avoid area with a vulnerable human external load. Pilots also should understand the functionality and limitations of any installed low fuel warning systems.

At the operator and regulatory level, effective safety management processes that identify and safely manage hazards are vital to preventing future accidents.

The occurrence

On 28 February 2022, the crews of 3 Robinson R44 helicopters were preparing to conduct crocodile egg collection in Arnhem Land, Northern Territory. Each helicopter was operated by a different aircraft operator, contracted to Wild Harvest Northern Territory, and crewed by a pilot and an egg collector.

One of the helicopters was an R44 Raven II, registered VH-IDW, operated by Helibrook. The method of egg collection included slinging the collector underneath the helicopter, in a harness attached to a 100 ft ‘long line’ (see the section titled R44 human external cargo operations).[1]

The pilot of VH-IDW reported that they arrived at Helibrook’s hangar at Noonamah, on the outskirts of Darwin, Northern Territory at about 0530 local time, conducted the daily inspection of the helicopter and found no defects.

The other 2 R44 helicopters involved in the egg collection on the accident day arrived at Noonamah at about 0645. Their crews reported briefing together with the VH-IDW crew. The briefing involved discussing the day’s plan, including who was collecting from which nests, and where they would meet to refuel. The plan was to refuel at Mount Borradaile en route to King River, then collect eggs from about 15 nests located between King River and Maningrida, which was 90 km beyond King River (Figure 1). The crews then planned to refuel at Maningrida, before continuing south-east to collect additional eggs.  

At about 0703, the 3 helicopters departed Noonamah for Mount Borradaile, 205 km east-north-east, where fuel drums had been pre-positioned. At 0743, having travelled 111 km from Noonamah, a photo was taken in the cockpit of VH-IDW. The image showed the accident pilot as the passenger, seated in the left front seat, and the egg collector piloting the helicopter from the right seat. Based on the time taken to reach that point, the helicopter probably arrived at Mount Borradaile at about 0816.

Figure 1: Map showing key locations and times

Source: Google Earth with OzRunways data, annotated by the ATSB

The 3 R44 helicopters landed at Mount Borradaile for the planned refuelling, where the crews intended to ‘hot refuel’[2] each helicopter from fuel drums. A witness reported that the 3 R44 helicopters departed Mount Borradaile at about 0830 to track towards King River. One helicopter continued past King River to the north-east and commenced collecting eggs. OzRunways[3] data for the other 2 helicopters, including VH-IDW, recorded their arrival near King River at 0850.

At a clearing near King River, 60 km beyond Mount Borradaile, the second helicopter’s crew retrieved a harness from VH-IDW. Two witnesses reported that the accident pilot was in the left passenger seat and the egg collector was in the pilot seat and flew VH-IDW to King River, where the dual controls were removed. However, the accident pilot and one other egg collector reported that the dual controls had been removed at Mount Borradaile and the pilot had swapped to the pilot seat and flown VH-IDW from Mount Borradaile to King River. While VH-IDW was still on the ground, the second helicopter departed to commence collecting eggs about 12 km to the north-east. Data recorded from an egg collection application showed that the crew of the 2 helicopters, other than VH‑IDW, conducted operations from 9 nests (Figure 2) between 0911 and 1014.

Figure 2: Accident area including King River, accident site and nests  

Source: Google earth overlaid with nest collection data, annotated by the ATSB

At 1024, the pilot of one of those helicopters became concerned that they had not heard any radio communications from the crew of VH-IDW since they commenced egg collection operations and were unable to contact them. As a result, the pilot elected to return to the area where they expected VH-IDW to be operating. The pilot travelled in the reverse direction past the 3 planned nests assigned to the crew of VH‑IDW (Figure 12).

At 1036, they located the accident site closest to the first planned nest and landed nearby. They found the sling person (egg collector) fatally injured. VH-IDW was located 44 m beyond the sling person, substantially damaged having collided with trees and terrain (Figure 3). The accident pilot had sustained serious injuries and was found lying beside the helicopter. After providing reassurance to the pilot of VH-IDW, the other pilot returned to their helicopter and briefly became airborne to get mobile reception and call for assistance. The first call to emergency services was received at 1046.

Figure 3: VH-IDW accident site

Source: CareFlight

The second helicopter and remaining crew arrived at the site about 1 hour later. They found spare egg collection equipment from VH-IDW in the clearing where VH-IDW was last seen before the accident. The accident site was between the clearing and the closest of 3 nests that were to be collected by VH-IDW’s crew. No eggs had been collected.

Based on photos and reports from those who attended the site on the accident day, the egg collector’s bucket and pole were the first items in the accident trail (Figure 4). The pole was vertical with one end embedded in the ground. About 4 m beyond the pole, the long line attachment rings were found, also embedded in wet ground, with the long line loosely coiled over about 8 m. The egg collector was found wearing a harness, which was intact, firmly secured and attached to the long line, and their helmet was on the ground nearby. The long line was not connected to the helicopter.

Figure 4: Accident trail

Source: Apple Maps annotated by the ATSB

Following notification of the accident, a CareFlight rescue helicopter departed Darwin at 1122, arrived at the accident site at 1232, and departed with the injured pilot at 1310. As they departed the site, another Helibrook R44 helicopter arrived with Helibrook’s chief pilot, a Wild Harvest Northern Territory representative and an off-duty Northern Territory Police Force officer.

A CareFlight nurse remained at the site until the rescue helicopter returned at 1532 to retrieve the deceased egg collector, departing about 20 minutes later. The crews of the other 3 helicopters reported departing about 20 minutes after the rescue helicopter.  

Context

Personnel information

Pilot information

Qualifications and experience

The pilot held a commercial pilot licence (helicopter) with low-level and sling ratings. At the time of the accident, the pilot had recorded about 2,500 hours total aeronautical experience. The pilot’s most recent flight review was on 21 May 2021. The pilot had recorded 340.1 hours of sling experience, the most recent of which was gained in May 2021. The pilot had been contracting to Helibrook for 8–9 years, including for crocodile egg collection. In addition, the pilot operated their own R44 helicopters and contracted to other operators. According to the pilot’s logbook, they had first conducted slinging of human external cargo (HEC) for crocodile egg collection on 13 December 2017. Their last recorded HEC sling time was in March 2020, but the pilot reported having also conducted human slinging for egg collection in the wet season from December to May of 2020–2021 and 2021–2022.

Documents provided by the operator indicated that the pilot had completed a proficiency check flight with the Helibrook chief pilot on 3 August 2021 in the pilot’s R44 II helicopter, which was not fitted with dual hooks. The pilot had recorded a flight time of 0.8 hours in their logbook with no reference to conducting sling operations, whereas the Helibrook Rotary Pilot Competency Check form stated the flight time as 1.1 hours. According to the form, the pilot had demonstrated competency in pre-flight tasks, normal and emergency procedures and the following specialised tasks:

• search and rescue
• charter
• sling operations
• croc egg harvesting
• aerial advertising – banner towing
• supply dropping
• surveillance
• hover exit entry.  

The pilot was also a licenced aircraft maintenance engineer and the head of aircraft airworthiness and maintenance control (HAAMC) for Helibrook.

Medical and toxicology

The pilot held a class 1 aviation medical certificate with no restrictions, valid to 27 May 2022.

A blood sample was taken from the pilot at 1638 on the accident day, 11 minutes after the pilot’s arrival at Royal Darwin Hospital. Toxicology results from the sample identified several substances administered by CareFlight and Royal Darwin Hospital medical staff. Additionally, the results detected 2 metabolites of cocaine – ecgonine methyl ester and benzoylecgonine – at low levels (less than 0.01 mg/L). These results were identified using mass spectrometry and considered to be reliable indications of previous cocaine exposure. These metabolites can be detected in the blood up to 3–4 days after exposure (see the section titled Cocaine metabolites).

Cocaine itself is generally detectable in blood tests for up to 1–2 days after exposure and was not detected in the pilot’s blood.

The pilot had no reported medical conditions and in the self-disclosure section of their aviation medical application, they had advised not using any drugs or recreational substances within the last 5 years. The pilot also advised the ATSB that they did not use cocaine.

Anticonvulsant medication levetiracetam was also identified in the pilot’s toxicology results. There was no evidence of this having been administered by CareFlight or Royal Darwin Hospital medical personnel, although it was consistent with emergency treatment for the pilot's injuries. There was also no evidence obtained to indicate that the pilot had recently visited a doctor, had a condition requiring the medication, or obtained a prescription for it. A pharmacological expert advised the ATSB that even if it had been present before the accident, it was one of the least likely anticonvulsant drugs to interfere with cognitive process as there was evidence of its widespread positive effects on cognition. It was also less likely to produce ataxia[4] and dizziness than other antiepileptic drugs.

Recent history

The pilot reported having limited recollection of events leading up to, and including, the accident sequence. Despite that, the ATSB was able to identify the following activity in the days leading up to the accident.

On 24 February 2022, the pilot was operating a Robinson R22 helicopter (not associated with Helibrook) to locate crocodile nests, when an engine valve failed, requiring the pilot to conduct a forced landing. The pilot reported feeling ‘pretty rattled’ by it.

The next day, after repairs were conducted on the R22, its engine again lost power during take-off. Additionally, the day’s egg collection activities were suspended due to rain and the pilot’s partner reported that they spent a quiet evening at home together.

On 26 February, the pilot was involved in crocodile egg collection activities, which were again suspended due to rain. The pilot consumed alcohol that evening and reportedly attended a party, returning home between 0100 and 0200 the following morning. The pilot left again before their partner awoke between 1000 and 1100 on 27 February. Rideshare records from the pilot’s phone indicated that a car was used between 0243 and 0306, and again at 1040, with no end time recorded.

Information obtained from the pilot’s phone showed that later that day, the pilot started operating VH-IDW at 1545 and conducted crocodile egg collection about 60 km south‑west of Darwin, until 1810. This was consistent with information subsequently provided by the helicopter operator. The pilot’s partner reported that the pilot went to bed at about 2130 that evening and left for work at about 0445 on the accident morning.

The ATSB considered whether the pilot’s activity in the preceding days may have led to them being fatigued at the time of the accident. Specific factors that potentially increased fatigue risk included:

• the pilot likely experienced a high level of stress following 2 engine power losses, leading to an unscheduled overnight stay at accommodation away from the pilot’s home
• the pilot’s usual sleep pattern was significantly disrupted on one night, getting to sleep around 6 hours after the usual reported sleep time
• over the previous 4 nights, the pilot slept in 3 different locations, which had the potential to affect sleep quality
• the pilot only had 6–7 hours sleep opportunity on each of the 2 nights before the accident, meaning that the pilot was probably carrying some level of sleep debt at the time of the accident
• on the day of the accident the pilot awoke during the window of circadian low, which also has the potential to affect the pilot’s sleep debt
• consumption of alcohol or exposure to recreational drugs is known to reduce sleep quality
• hot, humid weather conditions, such as those in the Northern Territory in February, are associated with reduced sleep quality and quantity.

While a number of these factors could combine to increase likelihood, there was insufficient evidence to establish if the pilot was likely experiencing a level of fatigue known to affect performance at the time of the accident. In a statement provided to the ATSB in response to the draft report, the pilot reported that they were not tired or affected by alcohol or drugs on commencing the operation of the helicopter.

Egg collector information

At the time of the accident, the egg collector had passed their private pilot licence (helicopter) flight test but not yet been issued that licence.

Wild Harvest Northern Territory annual requirements

Wild Harvest Northern Territory (WHNT) held a suite of documents for crocodile egg collection, which included safe work method statements[5] and procedures. WHNT engaged multiple helicopter operators each season to undertake crocodile egg collection. At the start of each egg collection season, those intending to conduct egg collection, including pilots and collectors, attended a WHNT ground-based training and administration day. Both the accident pilot and the egg collector attended this training on 1 December 2021, and had signed safe work method statement sign-on sheets for:

• ground operations for croc egg collecting, including:
  • equipment checks
  • personal protective equipment
  • safety around helicopters
  • firearm safety
  • selecting and collecting nests
• human sling operations (see the section titled Operator risk assessment)
• safe handling of fuel.

Aircraft information

General history

VH-IDW was a 4-seat Robinson Helicopter Company (Robinson) R44 Raven II (R44 II) helicopter, certified in accordance with United States (US) Federal Aviation Regulations (FAR) Part 27 and manufactured in the US in 2008. The helicopter was first registered in Australia in July 2008 and had a standard certificate of airworthiness and was to be operated in the normal category.[6] The helicopter was powered by a 6-cylinder Textron Lycoming IO-540-AE1A5 engine derated to 205 brake horsepower (BHP) with a maximum 5-minute take-off power of 245 BHP.  

In December 2009, at 62.2 total hours in service, the helicopter was involved in a dynamic rollover that resulted in sudden stoppage/damage to the main/tail rotor and the engine. The aircraft was returned to Robinson for overhaul, including the engine. The hour meter was reset to zero, and the helicopter was returned to service in May 2012.

Helibrook commenced operating VH-IDW on 15 October 2020 and, as the registered operator, was responsible for the continuing airworthiness of the helicopter. VH-IDW was to be maintained in accordance with the airframe and engine manufacturers’ maintenance schedule, which required a periodic inspection every 100 hours or 12 months, whichever occurred sooner. The engine and airframe were subject to overhaul at 2,200 hours or 12 years, whichever occurred first. Additionally, any instructions for continued airworthiness on approved modifications, such as cargo hooks, were to be complied with. The helicopter was fitted with an hour meter activated by a combination of oil pressure and an electrical switch on the collective.[7] The hour meter was an acceptable means of recording time in service, however it could be disconnected, which would prevent flight hours being recorded.

On 22 October 2020, shortly after the helicopter was purchased by Helibrook, a 100‑hourly inspection was carried out on VH-IDW, at which time the helicopter’s total time in service, recorded in the maintenance records was 1,577.9 hours and the hour meter read 1515.75. The maintainer reported that in November 2021, the hour meter was rolled forward 62.2 hours to match the helicopter’s total time in service for ease of record-keeping. At the accident site, the helicopter hour meter read 2,070.05 hours, which equated to 2,007.85 hours since overhaul.

Maintenance release

A maintenance release is required to be carried on an aircraft as an ongoing record of the aircraft’s time-in-service and airworthiness status. Subject to conditions, a maintenance release is valid for a set period, nominally 100 hours in service or 12 months from issue.

A daily inspection was required to be carried out and the maintenance release signed to show the inspection had been completed, prior to the first flight of the day. The inspection and certification could be made by any pilot licenced to fly the aircraft, or an appropriately licenced aircraft maintenance engineer. After the last flight of the day and before the aircraft was next flown, the total daily flight time was required to be entered and the progressive total time in service recorded.

VH-IDW’s maintenance release, current at the time of the accident, was provided to the ATSB on 3 March 2022. It had been issued on 7 February 2022, with 2,036.3 hours total time in service recorded. The accident pilot’s signature was on the maintenance release for 8, 9 and 10 February, with 7.6, 4.3 and 1.5 hours recorded respectively.

The accident pilot’s signature was on the maintenance release for the accident day. The pilot initially reported having conducted the daily inspection of VH-IDW on the morning of the accident, found no defects and signed the maintenance release. However, the pilot subsequently reported being unsure when they had signed the maintenance release for the accident day’s flight.

No defects had been recorded on part 2 of the maintenance release. Additionally, there were no entries on part 2 of the maintenance releases from when the fuel calibration was certified on 1 May 2020 to the accident day to indicate any issue with the fuel calibration, calibration card or fuel quantity indication. 

Recent maintenance

On 15 January 2022, due to a pilot reporting that the engine was ‘low on power’, the maintainer adjusted the magneto engine timing and renewed the spark plugs.

On 7 February 2022, the maintenance organisation completed a periodic inspection of VH-IDW. During that inspection, the No. 6 cylinder was replaced due to failed compression, however, there was no documentation supporting that a post-replacement compression check had been conducted. Other maintenance items completed at that time included replacement of the engine-driven fuel pump and the tail rotor assembly.

On 11 February 2022, with 2,050.09 hours recorded in the engine logbook, a Helibrook pilot had reported an ‘intermittent miss in flight’ to the maintainer. The maintainer identified that the left magneto had a failed drive bearing and replaced it with an overhauled magneto. The right magneto timing was also adjusted. The worksheet stated ‘compression test ok’ but no figures were recorded. The maintainer reported checking compression during troubleshooting for the intermittent miss but did not record the figures as they were satisfactory. The maintainer then recorded conducting a post-maintenance flight of 0.8 hours with no issues identified.

Recorded hours and other observations

The pilot’s logbook did not contain any entries relating to the operation of VH-IDW, and the pilot’s last logbook entry was in their own helicopter on 12 February 2022. Additionally, and despite the pilot reporting conducting egg collecting using VH‑IDW in previous seasons, the earlier VH-IDW maintenance releases covering the previous egg collection season did not contain any entries by the accident pilot. However, this did not preclude the pilot having flown VH-IDW after another person conducted the daily inspection and signed the maintenance release.

The pilot reported that VH-IDW had flown significantly more hours than were recorded and that the hour meter was never operating when they flew it, although they could not recall whether the hour meter was operating on the accident morning. The pilot estimated that they had flown VH‑IDW for about 70 hours in the 2021–22 crocodile egg collection season and had also flown it during 2020–21. The ATSB obtained invoices that indicated the pilot had conducted over 36 full days of egg collection in 2020–21 and 2021–22 seasons, all of which were reported to have been in VH‑IDW. Due to the apparent discrepancy in operating hours, the ATSB compared the hours recorded on VH-IDW’s maintenance releases from November 2020 to the accident day with:

• the pilot’s time (in units of days/half days) invoiced for crocodile egg collection
• spreadsheets recording hours for helicopters (by operator and helicopter type) and day/half‑day rates for personnel involved in crocodile egg collection
• the pilot’s phone records of start and stop times for VH-IDW
• recorded egg collection data (see the section titled Crocodile nest data)
• fuel uplift records
• evidence of VH-IDW being operated for a purpose other than egg collecting.

There were 21 days identified when VH-IDW was operating and there was no entry on the maintenance release, some of which were recorded as 10 to 11 hours of helicopter operation. For all other entries for crocodile egg collection, only a portion of the spreadsheet time was recorded – including as little as 10% of the hours recorded on the spreadsheet on single days. On those days, collected nests were recorded on the crocodile egg collection application and for many of them, the pilot had retained a record of VH-IDW start and stop times consistent with the spreadsheet’s recorded hours. The review of the spreadsheets and comparison with VH-IDW’s maintenance release hours included consideration of whether multiple Helibrook R44s were operating on a given day.

The accident pilot reported that the helicopter had not ‘missed a beat this season’, then subsequently described VH-IDW’s performance as good and that it flew well, but that it was nearing the end of its overhaul life and had problems in the weeks prior to the accident. These included a damaged inlet valve, a loose induction tube and fuel injector. The latter 2 items were recorded as rectified on the maintenance release on 14 December 2021. There was no documented recent inlet valve replacement identified but the No. 2 cylinder exhaust valve was replaced on 22 April 2021. When questioned whether there was any indication that the helicopter was overrunning the 100-hour inspection intervals, the maintainer reported that it was difficult to determine whether a helicopter had done 100 or more hours when it arrived for maintenance.

A maintainer who previously maintained Helibrook helicopters from June 2016 to January 2020, reported that they had previously found a Helibrook R44’s hour meter disconnected. In addition, the operator had leased a helicopter from the maintainer and a comparison of recorded GPS flight data with documented flight times showed that the hour meter had been disconnected and about 4 hours of the 14 hours flown during the cross-hire period were not recorded on the maintenance release.

A Civil Aviation Safety Authority (CASA) airworthiness inspector produced a report as part of CASA’s review of this accident. The report identified that VH-IDW’s engine-driven fuel pump had been replaced at reducing hours since new: 733.4 in 2017, 651.9 in January 2020, then, after purchase by Helibrook, at 387.8 hours in April 2021 and 263.2 hours in February 2022. The report stated this was indicative of flight hours not being accurately recorded.

Fuel capacity, calibration and indications

The R44 II POH stated that for tanks fitted with bladders (including VH‑IDW), the main fuel tank capacity was 115 L, of which 112 L was usable, and the auxiliary tank capacity was 65 L, of which 64 L was usable. Of the combined 180 L capacity, the total usable fuel was 176 L. The POH defined usable fuel as the fuel available for flight planning.

Unusable fuel is the amount of fuel in the tank/s below which continued running of the engine while performing the most adverse manoeuvre cannot be assured. Below this level, there is the potential to un-port[8] the fuel tank outlet due to fuel movement. In straight and level flight, some of the unusable fuel is likely to reach the engine. In the R44 II, the main tank to engine fuel union is located on the inboard side of the tank, forward and near its base.

Calibration of the main and auxiliary tank fuel gauges was required every 48 months. The last calibration was conducted by a CASA‑authorised maintainer in May 2020. The calibration is shown in Figure 5. The associated placards for the main and auxiliary tank gauge calibration were affixed in the cockpit, but the auxiliary tank placard was damaged and illegible (Figure 6).

Figure 5: Fuel tank gauge calibration as recorded in May 2020

Source: Supplied

Figure 6: VH-IDW cockpit photo showing fuel gauges and placards

Source: ATSB

The main tank placard stated that the low fuel warning light would illuminate when 20 L total fuel (usable and unusable) remained (Figure 6). According to the maintenance manual, the low fuel warning switch was not subject to calibration. The organisation that conducted the fuel calibration reported that, to establish the 20 L figure, they drained the tank, checked the low fuel light was illuminated, then added fuel until the low fuel light went out. The pilot reported that the light would illuminate with 18 L total fuel remaining. Both those figures differed from the POH, which stated that the low fuel warning light would illuminate with approximately 3 US gallons (11 L) of usable fuel remaining (14 L total fuel in the main tank) (Figure 7).

Figure 7: Low fuel warning

Source: Robinson R44 II Pilot’s Operating Handbook

The Robinson R44 II POH included Safety Notice SN-15 – Fuel exhaustion can be fatal, which advised pilots never to rely solely on the fuel gauge or low fuel warning light but to always record the hour meter reading each time the fuel tanks were filled. This enabled pilots to monitor fuel consumption and endurance. In addition, the POH required the pilot to visually check fuel quantity at each tank during the pre-flight. VH‑IDW was also fitted with a fuel flow transducer and an associated Fuel Scan (totaliser) instrument in the cockpit. The instrument could display fuel flow and other parameters including fuel used and fuel or time remaining. However, the display of accurate fuel quantity relied on the correct amount of fuel to be entered following engine start and the in-flight photograph taken en route from Noonamah for Mount Borradaile identified that the Fuel Scan instrument display was not visible.

Manifold pressure limits

Maximum continuous power manifold pressure limits were prescribed in the POH (Figure 8).

Figure 8: R44 II Maximum continuous power, manifold pressure limits

The red square depicts the limit for the conditions at the time the in-flight photo was taken.

Source: Robinson Helicopter Company, annotated by the ATSB

Flying with a higher manifold pressure than the prescribed limit may exceed the approved torque for the rotor drive system. Robinson advised that if excessive power was held continuously, the helicopter would exceed the normal flight envelope, likely causing stress to drive system components that were not designed for such loads.

Robinson safety notice SN-37 – Exceeding approved limitations can be fatal, stated:

Robinson also advised that higher‑than‑normal manifold pressure for a given airspeed could also indicate an engine issue. If one or more cylinders were not operating correctly, higher manifold pressure would be required to produce the same power. In this case, the higher manifold pressure may not exceed the approved torque for the rotor drive system.  

Hydraulic flight control assistance

The main rotor flight controls are hydraulically boosted to eliminate cyclic[9] and collective feedback forces. The hydraulic system operates at a pressure between 450–500 psi and consists of a pump, 3 servos, a reservoir, and interconnecting lines. The pump is mounted on, and driven by, the main rotor gearbox. A servo is connected to each of the 3 push-pull tubes that activate the main rotor swashplate. The reservoir is mounted on the steel tube frame behind the main rotor gearbox and includes a filter, pressure relief valve, and pilot-controlled pump bypass valve. A sight gauge for pre-flight fluid level checks is incorporated in the reservoir, which has a vented filler cap.

The pump bypass valve is solenoid-actuated and controlled by the hydraulic switch on the cyclic. When selected to HYD (on), the solenoid is deactivated. This fail-safe ensures hydraulic assist is retained in the event of a loss of electric system power. The switch should be on from start-up to shutdown, except during the hydraulic system check or simulated hydraulic failure training. When selected to off, power is applied to the solenoid and high-pressure hydraulic fluid is returned to the reservoir, removing hydraulic assist from the controls.

Robinson reported being unaware of any instances of the solenoid actuating in flight and causing a loss of hydraulic assist in the controls. The ATSB occurrence database contained 3 hydraulic related occurrences in R44 helicopters since 1997, none of which resulted in a loss of control or an accident. The first was the result of the pilot inadvertently switching off the hydraulic master switch in flight, the second was a failure of the hydraulic pump, and the third was a hydraulic leak.

Inadvertent engine stoppage

Robinson advised that there had been several accidents in which a pilot had inadvertently induced an engine stoppage by rolling off the throttle too fast. This had occurred in flight training when simulating an engine failure and in response to abnormal situations such as rapid engine RPM changes or discrepancy between engine and rotor RPM.

Skids

The helicopter had previously been fitted with floats, which had been removed, but the skid extenders necessary for float fitment remained fitted to the helicopter.

Emergency locator transmitter

The helicopter had a factory mount for an emergency locator transmitter (ELT) and associated wiring in the main rotor gearbox bay however no ELT was fitted to VH‑IDW, nor was one required to be. When fitted, the ELT is connected to an external antenna. The ELT had an arm/on/off switch, and a remote switch was located next to the cyclic, with a default position of ‘armed’.

Pannier

A pannier for the carriage of egg collection equipment was fitted on the left side of VH-IDW. This had been approved by a CASA-authorised aeronautical engineer under an engineering order, although the associated rotorcraft flight manual supplement (RFMS) was not inserted in the POH.

Dual hook system

VH-IDW was originally fitted with dual hooks for HEC under an engineering order. The engineering order required that the hook system be maintained in accordance with the instructions for continued airworthiness and operated in accordance with the associated flight manual supplement. The engineering order was replaced by a CASA-approved supplemental type certificate (STC)[10] in 2021. The system and hook part numbers and the maintenance requirements were unchanged, and the only change was a reduction in the maximum allowable hook weight from 150 to 129 kg (and the associated placard). This was to provide a greater safety margin for HEC operations for the same hook and its strength rating.  

The STC approved nominated R44 and R44 II helicopters to be:

• modified with a dual Onboard Systems International cargo hook kit for HEC operations in accordance with Master Document List R5106-07-R5 (28 July 2021)
• maintained in accordance with Instructions for Continued Airworthiness (ICA) R5106-09-R11 (21 July 2021)
• operated in accordance with RFMS R5106-25-R13 (11 June 2021), which was required to be inserted in the POH. The associated RFMS was not contained within VH-IDW’s POH.

The dual hooks could attach to rings on a 100 ft long line, enabling the carriage of a person below the helicopter. The 2 hooks could be released by the pilot by pressing 2 independent buttons of the primary quick release system (PQRS) or pulling 2 manual handles of the back-up quick release system (BQRS). In addition to 2 independent actions, the PQRS buttons were recessed into a housing to further reduce the likelihood of inadvertent pilot activation. The dual hook and release systems were designed to provide redundancy in case of failure.

Following electrical or manual activation, the hook arm would remain open, until it was manually relatched by pushing the hook up by hand to the closed/locked position (Figure 9). (Note: the red component in Figure 9 is the manual release lever).

Figure 9: Onboard Systems hook open and closed/locked (same part number as those installed on VH-IDW)

Source: Onboard Systems

Serviceability

The Onboard Systems HEC dual hook system was installed on VH-IDW on 23 October 2020. The ICA required the external load operation hours to be recorded when the primary hook, or both hooks, were used for external load operations in flight.[11] There was no evidence that external load operation hours were recorded on either hook. There was also no record in the aircraft maintenance documentation of the required 100-hourly/annual checks having been conducted. Finally, one of the hooks had been removed from another helicopter prior to being installed on VH‑IDW and had exceeded its 3 years in‑service limit.

The RFMS included the requirement for the pilot to conduct a functional check of the quick release systems prior to commencing the day’s HEC operations. The pilot reported that their normal procedure was to test that the primary and back-up quick releases were functional before the sling person hooked up but could not recall whether they had done so on the accident day.

Meteorological information

The helicopter departed Noonamah on the accident morning at about 0703. The weather conditions at the time included a light northerly wind and scattered low cloud. At 0743, the helicopter was en route, 60 NM beyond Noonamah and 50 NM from Mount Borradaile. The nearest Bureau of Meteorology weather station was at Point Stuart (Figure 1), where, at 0800, the wind was a north-north-westerly at 10–14 kt, the temperature was 27.5 °C and the QNH[12] 1008 hPa.

The Bureau of Meteorology weather station nearest the accident site was South Goulburn Island Airport (Warruwi), 29 km north-north-west. At 0930, the recorded meteorological conditions were westerly wind at 6 kt, temperature 29 ⁰C, dewpoint 24 ⁰C, QNH 1010 hPa and no cloud. Similar conditions were recorded at Oenpelli, 63 km south-west, and Maningrida, 90 km east-south-east of the accident site.

Recognising that the winds at these recording stations were light and the actual accident time unknown, the accident trail was consistent with it being approximately into wind. At the sea level elevation of the accident site, with QNH 1010 hPa and temperature 29 ⁰C, the calculated pressure altitude was 90 ft and density altitude[13] was 1,770 ft.

Recorded data

Mobile devices

There was a mobile telephone and an iPad on board the helicopter at the time of the accident with the potential to contain data relevant to the accident sequence. The ATSB was able to recover information from the pilot’s phone pertaining to their activities in the days prior to the accident, records of hours the pilot operated VH-IDW and previous maintenance release practices. However, no data directly relevant to the accident flight was able to be recovered.

The egg collector’s phone had been operating in the vicinity of the accident site, but was missing and could not be obtained by the ATSB for analysis and the iPad was severely damaged in the accident impact, rendering any stored data unrecoverable.

Phone records show the last mobile data session before the accident, commenced on the pilot’s phone at 0847:37 and the egg collector’s phone at 0858:16. The egg collector was sent a text message at 0923:44 but the message was not received. This indicated that the phone was either out of mobile range, which occurred below about 300 ft in the vicinity of the accident site, or was off/not powered.

In-flight photo

A georeferenced in-flight photo was taken at 0743 on the accident morning, 111 km beyond Noonamah and 94 km prior to the Mount Borradaile refuelling stop, on a direct track between the 2 locations (Figure 10). The photo showed:

• the fuel gauges reading just below three quarters full
• the Fuel Scan instrument was not operating
• the manifold pressure about 24 inches of mercury (inHg)
• an indicated airspeed 90 kt
• the engine and rotor RPM about 103%
• a chronometer indicating 00:45.

The photo also showed the accident pilot seated in the left seat as a passenger and the egg collector piloting the helicopter from the right seat.

Figure 10: Cut-out of in-flight photo taken at 0743 showing cockpit indications

Source: Northern Territory Police, annotated by the ATSB

As detailed in VH-IDW’s POH, for the pressure altitude at sea level and temperature 30 °C, the maximum continuous power was 23.1 inHg manifold pressure (red box in Figure 8). Based on the aircraft’s height, temperature and QNH at Point Stuart and interpolating the POH table, the maximum continuous power was about 23 inHg. Robinson advised that exceeding the manifold pressure limits with an engine functioning normally would be expected to result in a higher airspeed or rate of climb than depicted in the photo.

Assuming VH-IDW departed Noonamah at 0703, which was the time one of the other R44s departed, it averaged 90 kt ground speed to the in-flight photo location.

Crocodile nest data

A custom-built iPad application named ‘Crocpad’ was used to record the collection of eggs and nest locations. In the week prior to the accident, pilots (including the accident pilot) had conducted flights to locate the nests and entered each nest’s location into Crocpad.

The Crocpad data included fields for the device name, status, created date and modified date. The device name was that used by the person who located the nest (for example, ‘my iPad’). The created date contained the date and time the nest was located, at which time the nest’s status was set to LOCATED. When a nest was subsequently either COLLECTED or DELETED, the modified date was amended with the date and time this occurred. This did not need to be the same person or Crocpad that located the nest. The device name was not updated when a nest was collected or deleted, and remained as the device name that had been used to locate the nest.  The Crocpad data would update to the server when in mobile range, which the accident site was not. The iPad that was running Crocpad in VH-IDW had not updated the server with any information before it was severely damaged in the accident impact. The 9 nests amended on 28 February are shown in Table 1 and Figure 11.

Table 1: Crocpad data for 28 February 2022

Figure 11: Crocpad data showing nests recorded as collected or deleted on 28 February 2022

Source: Crocpad data overlaid on Google Earth, annotated by ATSB

On the accident morning, after departing the King River set-down area, the pilots and egg collectors of the 2 helicopters other than VH-IDW, reported meeting at a patch of 3 nests (No.1 to No. 3), then one helicopter went to a single nest (No. 4), before re-joining the crew of the other helicopter at another patch of nests (No. 5 to No. 9).

The accident pilot reported that one of the nests in the vicinity of the accident site could be collected on foot (without slinging). It was not known whether the crew of VH-IDW visited that nest before slinging towards the target nest where the accident occurred. However, the first person to attend the accident site reported no eggs had been collected and there was no indication any of the nests in the area had been visited.

Figure 12: Inset from Figure 11 showing nests in the vicinity of the accident site with the status of ‘located’ on the Crocpad data

Source: Crocpad data overlaid on Google Earth, annotated by ATSB

OzRunways data

OzRunways flight path data was obtained for 2 of the R44 helicopters, including VH-IDW. The data contained tracks commencing about halfway between Mount Borradaile and the King River, and ceasing near the clearing where VH-IDW and its crew were last seen prior to the accident (Figure 13). The data for VH-IDW was recorded on the egg collector’s iPhone from 0841:28 to 0850:13 local time and uploaded to the OzRunways server. The data covered about 15 NM, equating to a ground speed of about 100 kt. The other track was from 0840:22 to 0850:15, indicating the 2 helicopters were operating in company.

Figure 13: Recorded OzRunways tracks of VH-IDW and another R44 helicopter

Source: OzRunways data overlaid on Google Earth, annotated by ATSB

No OzRunways data was retrieved from the accident pilot’s phone and no data had uploaded to the server from the pilot’s phone or iPad. The pilot reported that they generally used landmarks to navigate for the ferry flight, and would only use OzRunways, in combination with Crocpad, for the egg collection.

Communications

The egg collector carried a UHF radio to enable communication with the pilot. It was reported that as the egg collector usually held a bucket in one hand and a pole in the other, it was difficult for them to press the transmit button to talk to the pilot, so they would usually use hand signals to communicate. The accident pilot subsequently reported that egg collectors could easily hold the crate and pole in one hand, making the radio accessible. Additionally, the accident pilot reported that as the helicopter radio was selected to VHF at the time of the accident, they could not have quickly communicated with the egg collector as it would have required switching the radio selector to UHF.

The pilot who was first on the accident site estimated that the accident occurred at about 0922 while they were on the ground and out of radio range. This estimation was based on the pilot not hearing an unintelligible radio transmission, later attributed to IDW, that was reported to have been heard by the crew of the other R44 which was airborne at the time.

Accident site assessment

The ATSB attended the accident site on 2 March 2022. The site was in a paperbark swamp approximately 440 m east of the clearing where spare equipment was found and where VH-IDW was last seen. From the egg collector to the helicopter, the accident trail lay in an approximately north‑westerly direction towards, and about 150 m before, a nest that was assigned to the crew of VH-IDW.

Assuming a direct transit from the clearing towards the first nest, the trees between where the helicopter probably took off, and where the egg collector was released, were 12–15 m tall. The trees in the vicinity of the target crocodile nest were at least 18 m tall. The bucket and pole were reported to have been found on the ground between trees about 4 m prior to the long line attachment rings. The egg collector was located about 8 m beyond the attachment rings and between 2 trees (Figure 14). On the first tree in the direction of flight, a section of bark had peeled away, about 4–5 m above the ground. While this may have been evidence of possible recent impact, no associated bark was found on the equipment or egg collector. 

Figure 14: Accident trail

Source: Northern Territory Police annotated by ATSB

The helicopter impacted the ground upright 44 m beyond the sling person, with the fuselage oriented on a heading of about 060° (Figure 15). The main rotor blades had struck one tall slender tree 3 times, indicating a vertical descent through the tree. The tree was about 9 m tall, with 2 distinctive upper branches that forked from the main trunk about 5 m above the ground. One rotor blade severed one upper branch 8 m above the ground, where the branch diameter was 35–‍40 mm). A blade then severed the trunk at the fork, 5 m above the ground, where the branch diameter was 50–55 mm. The final cut of the main trunk occurred 1.1 m above the ground, which was below the normal main rotor blade height above the ground in a level attitude.

The severed main tree stump (diameter 150 mm) was 2.4 m in front of the helicopter’s nose, leaning about 55° in the direction of main rotor rotation. The helicopter was facing over 90° right of the apparent direction of travel, consistent with rotation of the fuselage due to the main rotor blade’s impact with the tree trunk or pilot pedal input. During the accident sequence, one main rotor blade fractured about 1 m inboard from the blade tip, with the fragment located 45–50 m north‑west of the wreckage. It was noted that the main rotor pitch control link associated with this blade had fractured in overstress, with no damage to the other pitch link.

Figure 15: Site overview, with the orange arrow showing approximate direction of the accident trail

Source: Northern Territory Police, annotated by the ATSB

In addition to multiple rotor strikes to a single tree, indications of a mostly vertical descent, slightly right and nose-down attitude and a heavy impact included:

• the landing gear had splayed almost to horizontal, and fractured
• the forward cross tube was pushed up into the cabin, significantly reducing the available space in the rear cabin, resulting in empty egg crates in the middle of the back seats being distorted and wedged up against the internal cabin roof
• both skids had fractured forward of the front struts
• deformation to the nose was more pronounced to the right of the landing lights
• the pilot’s seat was collapsed towards the front right corner.

The base of the pilot’s seat had crushed, as designed, to absorb impact forces. The pilot’s restraint had reportedly been cut by those first on site and used in providing first aid to stabilise their injuries.

All the helicopter components were located in the vicinity of the accident site, indicating that there was no in-flight breakup. The forward doors were not installed, and the rear doors had been ejected on impact but were reportedly moved and placed under the pilot for support.

The helicopter was in a black dirt swamp and surrounded by water, up to about 0.5 m deep. The swamp had a gentle flow away from the helicopter, in a northerly direction, toward a nearby creek that was part of the King River system. When the ATSB attended the site 2 days after the accident, both fuel tank caps were correctly fitted, there was no fuel smell, no fuel in the auxiliary tank and a very small quantity of fuel at the bottom of the main tank.

The impact forced the right side of the transmission deck up to contact the underside of the auxiliary tank, such that the fuel drain could not be accessed. There was no evidence of fuel leaks on the transmission deck, from either tank or associated fuel lines. The right-side low orientation of the helicopter would have directed any fuel in the main tank to the engine fuel hose union near the base of the inboard side of the tank. Any fluid that leaked from the helicopter would have flowed downstream and away from the site.

The first person to arrive at the site could not recall checking the fuel tanks, but 2 others who arrived in the second Helibrook helicopter reported having observed the first person to arrive look in one tank and advise that there was fuel visible. In addition, the Helibrook chief pilot who was on board the second Helibrook helicopter reported looking in one tank and seeing a shimmer of fluid however, they did not dip the tanks to check the quantity. The first person to arrive at the accident site reported that there had been a fuel smell, but subsequently reported that the fuel smell may have been from a damaged jerry can that had been behind the pilot’s seat at the time of the accident.

A CareFlight first responder who arrived at 1232 reported that there was no smell or indication of fuel, only hydraulic fluid, which created a sheen on the water. A photo taken at 1555 on the accident day showed a slick on the water near the accident site. It was unknown whether that was from hydraulic fluid, fuel or another source. The ATSB obtained images of the site taken in June 2022, 4 months after the accident, in which there was no evidence of vegetation dieback that can indicate fuel contamination. However, 206.2 mm of rainfall had been recorded at the nearest Bureau of Meteorology weather station (Warruwi Airport) since the accident, reducing the likelihood that vegetation dieback would be evident.

The first person to arrive at the accident site also reported that there was no power to the aircraft when they arrived, but they switched off the electrical system master and alternator switches as a precaution, and rotated the main rotor blades to provide shade for the pilot. They further reported the fuel mixture control was in the full rich position and the magnetos were selected to ‘Both’, consistent with positions identified by the ATSB on site. The engine RPM governor switch, located at the forward end of the collective, was found in the OFF position. The hour meter read 2070.05. The stowage space under both forward seats was inspected, with nothing being located under the left seat and several small items, including a damaged headset, under the pilot’s seat. The POH and maintenance release were not in the helicopter.

No oil was found in the hydraulic system, however, hydraulic fluid was observed on the main transmission deck. The hydraulic switch was selected ON at the cyclic. Flight control continuity from the tail rotor to the main rotor head, above the transmission deck, was established. The fuses for the belt tensioning actuator, in-use and spare, were noted to be the correct amperage and undamaged. All 4 drive belts were present. The distorted pannier prevented easy access to the left side of the engine and the underside of the helicopter was not accessible due to the collapsed landing gear and distortion to the engine cowls. On-site images indicated that the engine was probably above the water level, however, water may have entered the cowls on impact.

The tail cone remained connected to the fuselage. There was no damage to the upper vertical fin and horizontal stabiliser. The tail cone and the lower vertical fin displayed compression damage consistent with terrain impact.

The tail rotor assembly was secure and rotated freely. Oil was evident in the tail rotor gearbox sight glass and the chip detector was clear of metal contamination. The tail rotor blades were in new condition and undamaged, with some light wood debris at the tip on the leading edge of one tail rotor blade. There was some corresponding minor scuffing to a partially submerged, sodden tree branch immediately under the tail rotor, consistent with contact following a vertical descent.

The ELT’s mount was located in the main rotor gearbox bay however, the ELT was not installed. The ELT harness, which included a quick disconnect socket, and antenna cable, were secured with cable-ties. The ELT end of the antenna cable was secured to the helicopter frame with tape. The remote switch, located next to the cyclic, was in the default ‘armed’ position.

Following on-site examination, VH-IDW was slung from the site by another helicopter. People on the ground when VH-IDW was lifted from the accident site did not report observing any fuel leaking from the helicopter. During the retrieval, VH-IDW was lifted multiple times, and also put down heavily en route to Jabiru, Northern Territory due to a technical issue with the slinging helicopter. At Jabiru, VH-IDW was loaded upright onto a truck and transported 252 km by road to a secure facility in Darwin for detailed examination. The switch positions identified on site were not altered during the retrieval and arrived in the same positions.

Helicopter examination

Hook system

The hook electric and manual release systems could not be functionally tested due to impact damage. However, both manual release T handles were found in the down position (not activated) and visual inspection did not identify any faults with the dual hook system. The hooks were found in the ‘up and locked’ position when the wreckage was lifted during retrieval from the accident site. Following activation, the hook arm would normally remain open, until manually relatched by pushing the hook up to the closed/locked position. In this instance, having had to open to release the egg collector, they were likely closed by the subsequent helicopter ground impact.

Drivetrain

Continuity of the drivetrain was established from the main rotor gearbox to the tail rotor gearbox, including all flex couplings. There was some distortion to the main rotor gearbox input driveshaft yoke and flex coupling, along with minor scraping on the transmission deck under the intermediate flex plate which was consistent with an unpowered rotor system (see the section titled Autorotation) during a heavy impact.

The main rotor gearbox could be rotated without restriction and the oil level was in the middle of the sight glass. Several main rotor gearbox mounts were fractured and the chip detector was damaged from perforating the transmission deck but was clear of debris. There was no indication of overheating of the main gearbox or clutch assemblies.

The clutch assembly was disassembled with no obvious damage to the sprags or race surface, consistent with the helicopter being in autorotation during multiple tree strikes before impacting the ground.

The belt tensioning actuator assembly had fractured in overstress at the connection to the upper bearing assembly and at the actuating rod. The actuator rod extension was consistent with properly engaged belts, which included assessment of expected stretch typical of their time in service. The drive belts were intact and appeared in reasonable condition although they were displaced from their respective sheave grooves, which was typical of heavy impact and actuating rod failure.

Main rotor

The main rotor head droop stops were undamaged with no evidence of excessive teeter or mast bumping. Both blades exhibited rearward distortion about mid-span, with some mild upward coning, indicative of low energy during the descent and tree strikes (Figure 16). The fractured pitch link failed in overstress at the upper rod end thread. The corresponding rod end was secured to the pitch horn, with a slight inboard deflection consistent with the rotor strike and blade fracture. The associated fractured blade had more pronounced coning near the hub, and impact marks and deformation on the lower surface, consistent with the blade being able to rotate about the pitch axis (up) following the pitch link failure. The blade tip was likely liberated at the stump strike.

Figure 16: VH-IDW’s main rotor blades showing rearward bending and fracture

Both main rotor blades were cut at the accident site to facilitate transport to Darwin

Source: ATSB

Control continuity

Flight control continuity was established throughout. Many control tubes had fractured due to overstress associated with impact, but the corresponding rod ends were secured to bell cranks. The left seat quick-disconnect (dual) controls were not installed and the cyclic boot was in place. The collective friction device had fractured due to impact forces. There was some movement in the collective, but it was restricted due to damaged control tubes. The overtravel spring was bent in a manner consistent with impact damage.

Engine RPM governor

A power source was applied to the governor motor. The motor operated in both directions with no evidence of interference. The governor wiring loom connector was secure and there was no evidence of loose or deformed pins. The governor switch was functional, with the governor itself sent to Robinson for testing under supervision of the US National Transportation Safety Board and found serviceable.

Hydraulics

The aft servo return line tee union was found to have fractured in overstress. The filter was clear with no sediment and the pump was secure. The solenoid that actuated the pressure shut-off valve was also tested and found functional.

Emergency locator transmitter

As detailed above, on-site examination identified that no ELT was fitted to the helicopter. The ATSB was subsequently provided with an ELT by the helicopter operator, who reported that they had removed it from the site after the accident. They advised that it was typically carried under one of the seats, otherwise it would get wet and erroneously activate. The produced ELT was registered to a former Helibrook chief pilot and not associated with any aircraft registration. It appeared intact, in reasonable condition, was switched off and its battery was due to expire in August 2022.

The Australian Maritime Safety Authority confirmed that previous unintended ELT activations had occurred due to water ingress and identified one record of activation of the ELT associated with VH-IDW, which occurred on 28 December 2021. A company representative for VH-IDW had advised the authority that the ELT had self-activated, likely due to water making contact with the ELT while collecting crocodile eggs. That ELT was not the one provided to the ATSB.

Warning and caution lights

All warning and caution lights were inspected, and electrical continuity confirmed. The filaments of the low rotor, low fuel, alternator and governor warning lamps were subsequently inspected under a microscope with none found stretched or broken as sometimes occurs if illuminated at impact. However, due to variables that affect the rate of acceleration applied to the filament, the absence of filament stretch does not enable a conclusion regarding whether or not the light was illuminated.

Electrical system

The helicopter battery was found out of the battery box but still connected to the helicopter by the battery leads. The alternator control unit was secure and connected.

Hour meter

One of the 2 electrical connections at the back of the hour (Hobbs) meter was found finger tight. Despite that, the connector would not move freely and had a lock washer under the nut to prevent it from coming loose during operation. However, only a small amount of hand pressure was needed to move the connection, consistent with it having been tightened by hand rather than with a spanner or socket.

Indications of engine rotation at impact

There were no indications of engine rotation at impact, evidenced by:

• no rotational damage to the engine cooling fan or housing
• no slippage to the cooling fan retention nut alignment mark
• no evidence of rotational scoring to the alternator housing or cooling fan and backing plate.

Significantly, impact damage and bending to the upper sheave forward end, lower surface was consistent with impact with the starter ring gear, and showed defined teeth impact marks, with no smearing (Figure 17).

This strongly supported the ring gear being stationary (engine stopped) when the helicopter collided with terrain.

Figure 17: Upper sheave damage from impact with non-rotating starter ring gear

Source: ATSB

Powerplant

External engine examination

External examination found no evidence of a catastrophic engine failure. The throttle butterfly was fully open at the fuel control unit, however as the impact forces would have tended to pull it open, the throttle position prior to impact could not be determined.

Oil

The engine oil cap and dipstick were secure, and the sump plug was relatively clean. The ATSB drained 8.6 L of oil from the engine with no significant debris found in the oil. The recommended maximum engine oil quantity was 9 quarts (8.5 L). Although the oil level slightly exceeded the maximum recommended capacity, it would not have affected the engine’s performance. The oil filter was opened and inspected with nil contamination identified on the filter element.

Air

Induction air enters through an opening on the right side of the fuselage and passes through the air filter within the air box. Air then passes along a flexible sceet duct, through the fuel control unit and into the engine. The air intake was damaged consistent with accident impact, but there was no evidence of blockage or ingestion of foreign material. The air box casing was distorted, also consistent with accident damage, though the filter was clean and there was no sign of blockage. The induction sceet hose had been crushed consistent with impact forces. The induction hose was also checked for delamination, due to a previously-identified issue with some induction hoses, and none was evident.

Engine examination 

The engine was shipped to a CASA-authorised maintenance facility for examination under ATSB’s supervision. Differential compression checks were carried out on the assembled engine. Cylinders No. 3 and No. 6 were below the limit of 60/80, which the engine manufacturer advised was the point that removal and overhaul should be considered (Table 2). However, cylinder compression is normally checked on a warm engine, as a cold engine may not provide reliable results.

Table 2: Compression checks of assembled engine – red denotes below limit

The cylinders were then removed from the engine and subjected to a second, differential compression check on a test bench. During testing, the valves were tapped to ensure any debris was not preventing a good seal. All cylinders then reached or exceeded 70/80 except cylinder No. 6, which only attained 5/80. The leak from cylinder No. 6 was visually identified as coming from both valve seats.

The valves from cylinder No. 6 were removed and the seating surface contact was examined. The seating faces were uneven (nonconcentric), particularly on the intake, and the exhaust seat had a low spot consistent with the valve not sealing properly (Figure 18). The poorly seated valves would have accounted for the low compression although the valves appeared in good condition with no evidence of carbon build-up. The No. 6 cylinder had been overhauled in 2016 and a vacuum pressure test was reportedly conducted at the time to check for leaking, however the results weren’t recorded. After overhaul, the cylinder was stored until installation in VH-IDW in 2022.

Figure 18: No. 6 cylinder intake and exhaust seats showing nonconcentric valve seating and low spot

Source: ATSB

The engine examination also found corrosion in all intake tubes, consistent with post-accident moisture from the impact in the swamp.

Prior to removing the cylinders, the valve trains were removed, and the hydraulic plungers were returned to a dry/deflated condition. After reassembly, the rocker arm to valve clearances were checked and only 5 of the 12 clearances were found to be within the engine manufacturer’s service limits. Table 3 shows the resulting clearances, with those out of service limits highlighted in red. Valve clearances were set on installation of the cylinder and can vary with wear. Insufficient clearance may prevent the valve from closing properly and excessive clearance can reduce valve lift and duration.

Table 3: Rocker arm to valve clearance – red denotes outside limits (0.28–0.80”)

The low compression in cylinder No. 6 would reduce the maximum power output and at any achievable power output, the fuel consumption would be higher than an engine with compressions within service limits. No defects were identified that should have resulted in sudden power loss or engine stoppage.

The ATSB also obtained an expert opinion from the engine manufacturer, regarding the engine and specifically the low compression result. They advised that low compression in the cold test scenario was not necessarily representative of results obtained from a warm engine. They also stated that the low compression would not result in a significant power reduction or sudden engine stoppage.

Loose B nut

At the engine examination, it was identified that the ‘B’ nut[14] on the fuel control unit (FCU) was loose – about 1.5 turns from tight. This was not indicative of its security at the time of the accident as it was loosened by an ATSB investigator during engine removal prior to shipping for examination. 

Ignition system

The engine data plate recorded the engine-to-magneto timing as 20° before top dead centre. The left magneto[15] timing to the engine was found at about 35° and the right magneto timing at 23°. The incorrect timing of the left magneto was assessed as having resulted from impact forces, which resulted in mount fracture and anticlockwise rotation of the magneto that advanced the timing. The external oil filter impacted the right magneto.

Testing of spark plugs and visual inspection of the ignition leads found no defects of the ignition system.

The magnetos were functionally tested and internally inspected at a CASA-authorised electrical and instrument maintenance facility, under the supervision of the ATSB. The magnetos were run on a test bench and both functioned throughout the normal operating range, with nil faults. The magnetos were then partially disassembled for internal examination and testing including points gap and continuity, internal timing, coil and capacitor serviceability. Both magnetos were found to be in normal operating condition.

Fuel system examination

Fuel tanks

The fuel system includes one main and one auxiliary tank, a gascolator, and a shut-off valve, with the associated pilot control knob located between the front seats. The fuel shut-off selector knob was found separated from the control tube and free to rotate however, the valve position was consistent with the fuel selected to the on position. The auxiliary tank was correctly interconnected with the main tank and, due to it being mounted higher than the main tank, would empty first while fuel remained in the main tank. The inter-tank flexible hose assembly was found clear of obstructions.

The fuel tank bladders remained intact despite splitting along riveted joins and punctures to the outer aluminium tanks. The aluminium tanks showed impact damage and subtle deformation (Figure 19 and Figure 20). Robinson assessed that the deformation of the fuel tanks was consistent with ‘lower fuel quantity’ but could not determine whether the deformation was due to impact damage, bulging of internal contents, or a combination of both. Robinson provided an image of an auxiliary tank that was known to have been nearly full at impact for comparison, which presented severe bulging over the entire tank (Figure 20). When compared with the exemplar image, the damage to VH-IDW’s fuel tanks was assessed as representative of the high vertical impact resulting in severe distortion to the airframe around the tanks, with little or no fuel within. This was also consistent with an ATSB investigation into a previous Robinson R22 accident, in which the tank was half-full on impact and displayed distinctive bulging from the internal contents that was not evident in the deformation of VH-IDW’s tanks.

Figure 19: VH-IDW’s auxiliary and main tanks showing subtle deformation and compression damage

Source: ATSB

Figure 20: An exemplar auxiliary tank known to be nearly full at impact and VH-IDW’s

Source: RHC, annotated by the ATSB

All remnant fuel was drained from the main tank on arrival at Darwin. It comprised about 250 ml of blue fuel (Figure 25), contained minimal debris/sediment and was tested clear of water. No fuel was found in the auxiliary tank. Noting as detailed previously (see the section titled Fuel capacity, calibration and indications) that the helicopter’s fuel system had 4 L of unusable fuel, the relatively small recovered quantity indicated that fuel had either been removed from the tanks after the accident or, considered more likely, had leaked out following the accident and/or during the transport from the accident site to Darwin.  

Pressurised fuel system

The pressurised fuel system includes an engine-driven fuel pump, an electric (auxiliary) fuel pump and a fuel return line, which allows pump supply in excess of engine demand to return to the fuel tanks. If pressure from the electric pump is low in flight, a pressure switch illuminates the auxiliary fuel pump caution light. Return fuel passed through the fuel pressure relief valve (FPRV) and then flowed to a tee junction connected to the auxiliary tank. The return fuel jet and tee assembly were found to be installed correctly.

The FPRV was tested on a rig, to simulate both fuel return and static leak from the tank back into the engine fuel system. The FPRV fully opened at about the expected parameter however, a small bypass at lower pressures was noted. Robinson reported that the flow curve was similar to other FPRVs they have seen with significant time in service, and advised that:

The electric fuel pump was connected to a power source and operated. The pump was then disassembled, and the pump vane could be rotated manually. The electric motor was worn, with brushes almost down to the leads and the commutator grooved (Figure 21).

Figure 21: Electric fuel pump showing worn brush and commutator

Source: ATSB

There was no sign of particulate contamination or water in the fuel system.

The mechanical (engine-driven) fuel pump serial number matched that recorded as being installed on 7 February 2022. The pump was not blocked, and no defects were found. In addition, function of the driving plunger was observed with engine rotation.

Fuel control unit examination

The FCU was examined by a specialist at a CASA-authorised maintenance facility, overseen by the ATSB. There was no fuel found in the FCU, and the finger filter was clear. The throttle arm was distorted and there was damage to the FCU body, near the mixture control lever, consistent with impact forces. The nozzles were all visually clear and were bench tested. The fuel flow was within the service limits for overhauled nozzles (31.4–32.6 lb/h) except No. 6, which was slightly low (31.0 lb/h). The fuel system specialist advised the slightly reduced flow would not stop the engine from operating.

On the test bench, the FCU tested slightly high (running slightly rich) at the lower power setting, and within limits at all other settings including maximum power. The specialist advised that it was not uncommon for the low-test point to become overly rich. During the testing, flushed fuel was passed through a filter membrane with no contaminants collected. The FCU diaphragm was in good condition and there was no evidence of water contamination in the FCU. Throughout the examination and disassembly no seals or O-rings were found to be failed or damaged. The throttle mechanism was functional.

Fuel system disruption

The fuel lines, flow divider and gascolator were all clean, and empty of fuel. The gascolator drain valve was found depressed against the firewall when examined at the Darwin hangar but reset when manipulated. Upward forces during impact distorted the aircraft structure around the drain assembly resulting in the drain extender tube, used to compress the drain valve, bending and splitting (Figure 22).

Following removal from the accident site, yellow sand was observed in the end of the tube, which was consistent with the site where the helicopter was set down during the wreckage retrieval. The sand likely entered the tube as the skids were removed prior to extrication of the wreckage from the swamp, leaving the tube as the lowest point below the fuselage. The gascolator bowl was dry and the filter screen was clear. Examination of the cowls did not identify any discolouration or staining that would be associated with leaking fuel, either prior to, or after the accident.

Figure 22: Gascolator, drain valve and tube, and R44 II Illustrated Parts Catalog extract

Source: Robinson Helicopter Company and ATSB

The fuel flow transducer, positioned between the fuel control unit and flow divider, had a fractured outlet fitting. The fracture surface was consistent with impact damage, with no evidence of pre‑existing fatigue. On behalf of the ATSB, Robinson conducted a test by removing the fuel line (and transducer) from the FCU outlet with the fuel valve open, mixture full rich and throttle full open. Robinson found that due to gravity, the fuel flowed out at a significant rate and would eventually empty the tanks. Loose black organic soil consistent with the accident site filled the transducer end of the fractured fitting (Figure 23), which likely would have been dislodged at the fuel flow rate demonstrated by Robinson.  

The flow divider was opened and noted to be dry and clean, and there were no contaminants or restrictions that would have prevented fuel flowing through each of the nozzles and into the cylinders.

Figure 23: Fractured fitting between transducer and flow divider

Source: ATSB

Fuel system indications

The fuel gauges and low fuel switch were independent systems, in that the low fuel switch would illuminate the low fuel warning lamp, independently of the fuel sender position. The float-operated low fuel switch assembly, located in the main tank, was electrically tested, while manipulating the float up and down, and found to be functional. Additionally, the low fuel switch and lamp were signed off as having been tested by the maintainer on 7 February 2022, as part of the periodic inspection.

The ATSB removed the fuel quantity senders from both tanks and tested the sender calibration in Darwin in June 2022. Further testing of the main tank senders and gauge was conducted by Northern Territory Police on behalf of ATSB in August 2023.

Both senders moved smoothly throughout the operating range. The R44 Maintenance Manual fuel quantity sender check specified positioning the float arm at 4 noted heights and measuring the resistance at each point to verify it was within the specified tolerance. The main tank sender could not be positioned to the up stop height and at the down stop was slightly below the down stop height for the testing, and measured slightly above the resistance range at the intermediate heights. When the fuel gauge was connected to the sender and a power source, the fuel quantity indicator needle moved smoothly from empty to full. The 4 sender test heights corresponded to the gauge indications at Empty, 1/4,1/2 and Full. As a result of the sender float arm position, the gauge very slightly overread (within a needle-width) at the lower 3 indications.

The results were sent to Robinson for expert assessment. Robinson advised that the testing indicated the main tank gauge would have been reading slightly higher than what was actually in the main tank, but ‘nowhere near’ the calibration sticker figures, which indicated the main tank gauge was underreading.

Examination of the auxiliary tank sender base plate identified a slight bend to the sender pole and that the strainer and siphon assemblies were distorted. It could not be determined if the distortion was associated with the fuselage impact forces, or pre-existing. Regardless, the strainer distortion would not have affected fuel flow to the tank interconnect hose. In addition, the siphon, part of the fuel tank drain system would have no effect on fuel supply to the engine. The ATSB determined that the auxiliary tank sender was within the required resistance range at the up and down stops.

Partial power loss

Robinson advised that main rotor blade strike, or strikes, to a tree could stall an engine at low power or idle, prior to impact with the terrain. The ATSB assessed all available evidence against the engine manufacturer’s troubleshooting tables for Low power and uneven running and Failure of engine to develop full power. In addition, the 29 items on Robinson’s troubleshooting checklist for low power were reviewed. All applicable items were tested where possible, within the constraints of damage. Nothing was identified that would likely result in a sudden onset of low power.

Fuel considerations

Fuel uplift

Procedure for filling tanks

The placard adjacent to the auxiliary fuel tank stated that the procedure to fill the tanks to full fuel entailed filling the main tank, then the auxiliary tank, then topping up the main tank. This procedure was required due to the self-levelling of the interconnected tanks.

The Helibrook operations manual included a procedure for hot refuelling (with the engine running). The manual stated that Robinson helicopters were not to be refuelled with the engine running,

The Helibrook safety manager advised that they did not have a completed form for the pilot or the egg collector of VH-IDW, and there was no other evidence to indicate whether they had undertaken the training. The egg collector in the second helicopter to land at Mount Borradaile previously flew and collected eggs for Helibrook and was the only person present who had completed the required training to hot refuel a Helibrook R44 helicopter.

Noonamah

Based on interviews with the helicopter operator, pilot and fuel supplier, and the 2 most recently delivered fuel batch receipts, the Noonamah fuel storage tank contained blue 100 low lead (LL) Avgas. A total fuel quantity of 440 L was recorded as being taken from the Noonamah tank on 28 February, but there were no records of the quantity uplifted to individual helicopters. As well as VH-IDW, at least one of the other 2 R44 helicopters was reportedly refuelled when they arrived at Noonamah at about 0645 and several jerry cans were also filled from the Noonamah storage tank. The Helibrook R44 helicopter that flew to the site after the accident may also have used fuel included in that total.

The quantity and source of fuel remaining in VH-IDW prior to refuelling on the accident morning could not be determined. The accident pilot reported that they would have filled the helicopter to full at Noonamah, in accordance with normal procedures. They also stated that their usual practice was to set the chronometer to zero after fuelling the helicopter. Other pilots reported that normal practice was to ensure sufficient fuel to get to Mount Borradaile, but not necessarily to fill both tanks.

In a submission provided to the ATSB following review of the draft report, one of the egg collectors operating on the accident day reported that VH-IDW was filled with 100 LL fuel at a Helibrook base near Sweets Lagoon, 33 NM from Noonamah at the end of the previous day’s activities. They further reported that they were present at the hangar on the accident morning and had not observed VH-IDW being fuelled. Based on that account, if the helicopter was not refuelled at the hangar on the accident morning it would have departed Noonamah with 23-25 L less than the full fuel tank capacity.

Mount Borradaile

As detailed previously, based on the georeferenced in-flight photograph, VH-IDW probably arrived at Mount Borradaile at about 0816. This time was consistent with the departure and arrival time recorded on a GPS device on the third R44 helicopter to arrive at Mount Borradaile that morning.

There were no records of the fuel uplifted at Mount Borradaile. Those present at Mount Borradaile reported that the R44 helicopters were hot refuelled. The accident pilot reported that their normal action was to always fill the helicopter to full at Mount Borradaile.

An Airbus/Eurocopter AS350 helicopter, with a pilot and crewman onboard, had landed at Mount Borradaile before the three R44 helicopters arrived. The helicopter was associated with the crocodile egg collection and its pilot was waiting for the pilot of the third R44 helicopter, who was the operator of the AS350, to assist with a maintenance issue with the AS350.

In preparation for the R44 refuelling, the AS350 crewman rolled 2 200 L drums out, checked they were marked WHNT, and verified they were labelled 100/130 green Avgas. They further recalled that the first drum had been partly used, and its lid was on tightly and difficult to open.

The helicopter crews reported that VH-IDW arrived first of the 3 R44s at Mount Borradaile. There were consistent recollections that the egg collector was in the pilot seat of VH‑IDW, and the accident pilot was in the passenger seat of VH-IDW, when it arrived. Pilot 2 (P2) and egg collector 2 (E2) were in the second helicopter and pilot 3 (P3) and egg collector 3 (E3) in the third.

When P3 arrived, they reportedly went immediately to the AS350 and did not witness the refuelling. The accident pilot could not confidently recall the refuelling events at Mount Borradaile, other than that they got into the third R44 and moved it up to the fuel drum. P2 reported that there was no drum pump carried in VH-IDW that day, and the pump used for refuelling was from the second helicopter. P2 and E2 reported that the pump from their helicopter was used by the accident pilot to put fuel into the main tank of VH-IDW, before the second helicopter moved to the drum. A submission to the ATSB following review of the draft report included a statement made in April 2023 by E2. In their statement, E2 reported that they had not seen VH-IDW being refuelled at Mount Borradaile.

In a statement to the ATSB in March 2022, E3 reported that when they arrived in the third helicopter at Mount Borradaile, they went to hold the hose for the accident pilot, who was getting ready to fuel VH‑IDW. They recalled that the third helicopter was refuelled next, and the second helicopter was still refuelling when the other 2 helicopters departed Mount Borradaile. However, in a subsequent statement in September 2022, E3 stated that they observed the egg collector partially fuelling VH-IDW before they took over and personally filled VH-IDW to full after first helping to refuel the third helicopter.

The AS350 crew reported that the 3 R44 helicopters left Mount Borradaile at 0830, which was consistent with the OzRunways recorded data for 2 of the 3 helicopters.

Based on the planned fuel figures, each R44 would have consumed about 80–90 L of fuel to reach Mount Borradaile. They therefore needed at least 80–90 L to fully fill at Mount Borradaile (noting that would have resulted in a minimum of 50% of the fuel in the tanks being 100/130 Avgas). The pump transferred about 1 L per revolution from the drum to the tank. After refuelling, the standard operating procedure required pilots to conduct fuel drains from 3 points on each helicopter to check for water and other contaminants. It was possible to fill each helicopter within a few minutes, particularly as several people capable of pumping fuel and conducting fuel drains were at Mount Borradaile.

The WHNT fuel drums at Mount Borradaile contained green-coloured 100/130 ‘leaded’ fuel.[16] The same person who rolled out the 2 fuel drums for the R44 pilots to refuel on the accident day, subsequently identified those drums and provided samples to the ATSB for testing. The person identified that as the drums had been reused, they had old 100 LL labels on the side, and the current 100/130 fuel labels on the top (Figure 24). WHNT was also clearly painted on the drums. The person checked the labels and seals, and recalled that the fuel in the drums was green.

Figure 24: WHNT fuel drum at Mount Borradaile showing distinct paint and labels. Inset: Fuel sample

Source: Supplied, annotated by the ATSB

The first drum rolled out was emptied on the accident morning then placed upside down by the AS350 crewman. As a result, when that crew person subsequently obtained fuel samples on behalf of the ATSB, the drum was distinctive as it had mud on the lid from having stood inverted. It was identified as the drum most likely to have been used first on the accident morning and VH‑IDW was reportedly the first helicopter to land at Mount Borradaile that morning. Samples from all 4 WHNT 100/130 drums at Mount Borradaile were taken to Darwin by WHNT and the ATSB arranged for the fuel to be tested.

The ATSB was subsequently advised that there were many empty fuel drums at Mount Borradaile, including some containing 100 LL located near the 100/130 drums. This raised the possibility that the drums used on the day of the accident may have been misidentified when samples were subsequently collected on behalf of the ATSB. However, a photo of one of those drums showed it was not painted with WHNT but was labelled with a different crocodile farm name and had a fuel expiry date of 13 October 2021. Additionally, the owner of the fuel supply reported that due to the remoteness and the criticality of having fuel available, they would not expect pilots to use fuel purchased for other operators and had not been advised of any fuel being wrongly taken.  

Fuel testing and analysis

Testing of the fuel drained from VH-IDW found it was consistent with 100 LL fuel, partially evaporated due to handling post-accident (see Appendix A – Fuel analysis). Gas chromatography with mass spectrometry testing of the VH-IDW sample found that it comprised less than approximately 1% 100/130 Avgas (1% was the testing limit of distinguishing between 100 LL and 100/130). There was also no evidence of contamination with Jet A-1, diesel, premium 98 petrol (car fuel) or Opal (low-aromatic car fuel used in the Northern Territory).

Samples from the 4 drums at Mount Borradaile containing green 100/130 fuel supplied by WHNT were obtained. The fuel from the 2 drums identified as having been used on the accident morning, were tested and found to meet the specifications of 100/130 fuel in accordance with the supplied batch test results. Figure 25 shows the colour of the Mount Borradaile sample compared with the remaining fuel recovered from VH‑IDW.

Figure 25: Comparison of Mount Borradaile sample and VH-IDW fuel

Source: ATSB

Fuel jerry cans

Images provided to the ATSB from first responders at the accident site showed 2 jerry cans in VH‑IDW, one behind each of the front seats. The jerry cans were subsequently removed from the helicopter and were not at the site when the ATSB arrived, nor subsequently provided to verify their contents. Those first on site and the accident pilot reported that both were full at the time of the accident and had probably been filled at Noonamah that morning. The jerry can behind the pilot seat was reportedly damaged on impact and may have leaked fuel, although no one reported detecting fuel leaking at the time.

The ATSB considered the potential effect of interference with the site in relation to the laboratory fuel testing results. The only plausible scenario that permitted both the described full refuelling at Mount Borradaile with 100/130 fuel and the residual 100 LL identified in testing was if 40 L of 100 LL fuel was poured from the jerry cans into VH-IDW after the accident and then most of it subsequently leaked away before the ATSB assessed the tank fuel quantity on arrival at the accident site. To dilute the 100/130 fuel component to less than the tested 1%, there would have to have been less than approximately 800 ml of fuel remaining in tank at the time prior to the addition of 100 LL from the jerry cans, comprised of approximately 50% 100/130 and 50% 100 LL fuel.

No one at the site, including the first to arrive, who was there until 1555, reported seeing anyone pour fuel into, or drain fuel from, VH-IDW. It was also reported that fuel from the 2 jerry cans was emptied into other helicopters that attended the site prior to their return to Darwin. Further, the empty jerry cans were then reportedly used to transfer fuel from a fuel drum to a helicopter at Mount Borradaile on the return to Darwin.

Fuel flow

The Helibrook operations manual required pilots to use a fuel flow rate of 60 L/h for flight planning purposes for R44 II helicopters for ‘normal, specialised and holding’, and a fixed reserve of 20 minutes (20 L). In a submission to the ATSB draft report, the pilot stated that VH‑IDW’s normal fuel burn was 60 L/h. The operator reported that VH-IDW normally consumed about 65–70 L/h.

Robinson does not publish fuel flow rates for their helicopters. They provide a planning fuel flow of 60 L/h and guidance including to record the hour meter reading each time fuel tanks are filled, check the fuel level in the tanks visually, continually check hour meter and fuel gauges, and to refuel before the main tank fuel gauge reads less than 1/4 full.

With 176 L of usable fuel (full fuel) with no reserves, VH-IDW would have the following endurance:

• 2 hours 56 minutes at 60 L/h
• 2 hours 42 minutes at 65 L/h
• 2 hours 31 minutes at 70 L/h.

Required engine power, and therefore fuel flow, is highest during take-off, landing and while hovering. As such, when conducting low‑speed flight while carrying an external load, the engine would be operating at high power and fuel flow rate.

Low compression in one cylinder results in less power produced compared to the other cylinders. Therefore, a higher power setting and increased overall fuel usage would be required to achieve the same airspeed as a fully serviceable engine. The actual increase in fuel consumption on the accident day due to low compression in the number 6 cylinder could not be quantified as the specific compression was unknown.

Regarding in-flight fuel re-planning and quantity measurement, the Helibrook operations manual stated:

Single-pilot low-level aerial work activities undertaken by this company are such that the priority of maintaining control of the aircraft and awareness of their surroundings prevents more than a visual scan of the fuel quantity gauges. For these operations where the recording of fuel figures may be detrimental to safe flight, fuel state will be managed using visual gauge checks, watches and reference to elapsed flight time.

The pilot reported never using the fitted fuel flow meter and the display was not visible in the in‑flight photo.

Operational information

Loading and performance

The RFMS required that the weight and centre of gravity be checked to verify the helicopter remained within the approved limits throughout each flight. Although not required to be documented, there was no evidence that a weight and balance assessment had been conducted on the accident day.

Based on photos, interviews, and evidence from the accident site, when the helicopter departed Noonamah on the accident morning with the pilot and egg collector on board, its contents included:

• slinging equipment
• 6 to 10 egg collecting buckets and poles
• 2 x 20 L jerry cans filled with 100 LL Avgas fuel
• 8 x 1 quart (0.95 L) engine oil cartons
• fishing rod/s, firearms, drink bottles, ammunition and personal effects.

The ATSB did not have access to many of these items and it is unknown if other items may have been on board but removed from the site. Therefore, the helicopter’s exact total weight at the time of the accident could not be calculated. However, based on the available information, the helicopter was likely operating below the maximum allowable weight of 1,134 kg at the time of the accident.

In addition to the gross weight limit, it was also a requirement of the RFMS for HEC operations that the aircraft was operated at a weight at which the helicopter could hover out of ground (OGE) effect[17] at least 3,000 ft above the ground. Due to the above uncertainty associated with the helicopter’s actual weight (including its fuel quantity), and the identified low engine cylinder compression, it was not possible to determine whether OGE performance existed at the time of the accident. However, in the ambient conditions at the time of the accident, the helicopter would not have met the 3,000 ft out of ground effect hover capability requirement at its maximum gross weight (1,134 kg).

The RFMS also stated that the maximum weight permitted on the dual hooks was 129 kg including the sling person, line, harness, equipment, bucket and crocodile eggs. At the time of the accident, the egg collector with equipment weighed 118 kg and the line weighed 26 kg. The total weight on the hooks was therefore 144 kg plus the bucket, pole and small items that were not weighed. Although this exceeded the permitted weight, there was no evidence the hooks or associated equipment had failed.  

Autorotation

In the event of an engine power loss, drive is no longer supplied to the rotor system and the pilot must lower the collective and sometimes conduct an initial flare to maintain sufficient rotor RPM while establishing autorotation. In an autorotation, the rotor blades are driven solely by the upward flow of air through the main rotor. The total energy available for an autorotation in the event of a power loss comes from the kinetic energy of the rotor blades and airspeed, and potential energy, which is directly proportional to the height.

Several factors affect the rate of descent in autorotation: bank angle, density altitude, gross weight, rotor RPM, trim condition, and airspeed. Two aspects pilots commonly use for managing distance travelled and rate of descent, are airspeed and rotor RPM.

In an autorotation in an R44 II, the rate of descent is high at zero airspeed, lowest at 55 kt, and increases again at higher airspeeds. The only energy available to arrest the descent rate for landing is the forward speed of the helicopter and the rotational kinetic energy stored in the rotor blades. Maintaining adequate rotor RPM is essential to ensure sufficient energy to flare the helicopter for landing. The flare is a critical manoeuvre that ensures safe completion of a power-off landing. The flare simultaneously decreases forward speed and rate of descent while increasing rotor RPM. Flaring too far away from the ground will leave the helicopter without sufficient energy to cushion the landing.

The R44 II POH stipulated that in the event of complete power loss, the pilot was to immediately lower the collective to enter autorotation. The specific procedure for power failure between 8 and 500 ft above ground level was:

1. Lower collective immediately to maintain rotor RPM.
2. Adjust collective to keep RPM between 97 and 108% or apply full down collective if light weight prevents attaining above 97%.
3. Maintain airspeed until ground is approached, then begin cyclic flare to reduce rate of descent and forward speed.
4. At about 8 feet AGL, apply forward cyclic to level ship and raise collective just before touchdown to cushion landing. Touch down in level attitude and nose straight ahead.

The minimum rate of descent during an autorotation was about 1,350 ft per minute at an airspeed of 55 kt and rotor RPM 97% when below 500 ft.

Height-velocity diagram

A height-velocity (H/V) diagram is required for single-engine helicopters certified under FAR Part 27. The diagram:

defines an envelope of airspeed and height above the ground from which a safe power-off or one engine inoperative (OEI) landing cannot be made (FAA, 2014).

The Robinson R44 II Pilot’s Operating Handbook (POH)[18] included the H/V diagram for R44 II helicopters, including VH-IDW (Figure 26).

Figure 26: Robinson R44 II height-velocity diagram

Source: Robinson Helicopter Company R44 II POH

When operating at low speed in the shaded (or ‘avoid’) area on the left side of the diagram, in the event of a power loss, a pilot may have insufficient height to accelerate to the speed required to autorotate successfully (autorotation speed).[19] Above a certain height above the ground, at least 400 ft for the R44 II depending on the density altitude, it is possible for a pilot to achieve autorotation speed even from a high hover (FAA, 2019). In the shaded area on the lower right side of the diagram, the combination of faster airspeed and proximity to the ground provides limited reaction time for the pilot in the event of in-flight emergencies. The FAA Helicopter Flying Handbook (FAA, 2019), stated:

The unshaded region of the diagram shows the combinations of airspeed and height above the ground that allows a pilot to successfully complete a landing in a full autorotation without requiring exceptional skill. At low heights (below about 10 ft) with low airspeed, such as a hover taxi, the helicopter is in a safe part of the H/V diagram. There, a pilot can use the kinetic energy from the rotor disc to cushion the landing with collective, converting rotational inertia to lift. An increase in height without a corresponding increase in airspeed puts the helicopter above a survivable un‑cushioned impact height, until a height is reached from which rotor inertia and gravitational potential energy can be converted to sufficient lift to reduce the vertical velocity at impact to a survivable value (FAA, 2019).

Rotorcraft flight manual supplement

Limitations and procedures for HEC operations

A requirement of certification of the dual hooks for HEC was to have the appropriate limitations and procedures for conducting human external cargo operations incorporated in the rotorcraft flight manual supplement (RFMS). The first draft of the RFMS associated with the STC for the hooks system was developed in 2013, and revision 13 of the R44 RFMS for HEC Dual Hook was approved by CASA, along with the STC, in July 2021.

The CASA-approved rotorcraft flight manual supplement

The CASA-approved RFMS and associated STC were specifically for the activity of collecting crocodile eggs, and some operational procedures were included in the RFMS. The RFMS Introduction stated that it was only valid if the operator also had ‘CASA approved operational procedures for use of the HEC Dual Hook system’.

The RFMS Section 1 General, contained a warning of elevated risk to aircrew ‘and particularly the Human External Cargo (HEC)’ involved in helicopter crocodile egg collection operations. The elevated risks included:

It then detailed additional risks including the:

• ‘use of a low powered single piston engine helicopter’
• lack of a ‘spotter’ in the aircraft due to R44 weight restrictions
• isolated nature of crocodile egg collection
• potential for crocodile attack.  

Section 2 Limitations included:

• a maximum airspeed of 60 kt during HEC operations
• maximum 15 kt wind
• no operations within 5 NM of lightning
• a weight limit such that the helicopter has out-of-ground-effect hover capability at least 3,000 ft above ground level
• maximum 129 kg down weight: combined weight carried on the hooks including the HEC person, line, harness, equipment, crocodile eggs and their container
• HEC line length between 48 and 105 ft (15–32 m).

The RFMS Section 3 Emergency procedures stated:

In establishing the emergency procedures, the design engineer advised that considerations of the line disconnecting (uncommanded) resulting in release of the HEC, were addressed by the hooks’ compliance with FAR certification standards for hooks for HEC. They reported that it was recognised that engine failure was the biggest risk. In managing this risk, the expectation was that an engine would rarely stop suddenly – usually running rough and degrading over a period of 30–‍60 seconds before stopping. It was considered that expected behaviour should give a pilot time to manoeuvre the helicopter away from the HEC, preferably downwind.

Furthermore, the design engineer advised that the emergency procedures were based on minimising risk to the HEC because the sling person was unprotected, whereas the pilot had a seat, restraint, and airframe as protection. Jettisoning the HEC from higher than 10 to 15 ft above ground would likely result in fatality, therefore keeping the HEC on the line while the helicopter autorotated, was assessed as offering a better overall outcome. The design engineer reported that at the time of the STC approval, the FAA advised that they could see ‘almost no circumstances in which the pilot would release the HEC’, but that more recently FAA’s emphasis had changed to requiring a very high degree of engine and systems reliability.

Comparison emergency procedures

US Department of the Interior

The US Department of the Interior (DOI) defined the transport of one or more people suspended beneath a helicopter as ‘short-haul’. The DOI Helicopter Short-Haul Handbook outlined minimum policies, procedures, qualifications, training requirements and equipment for helicopter short-haul programs, and was accepted as ‘best-practice’ guidance material.

Chapter 6: Emergency procedures (US DOI, 2010) stated:

The only difference between this text and the CASA-approved RFMS Emergency procedures, was that the DOI Handbook stated that ‘Release of the short-haul line is a possible consideration’, whereas the RFMS stated ‘Apart from in exceptional circumstances, release of the HEC line is not an operational consideration’, while HEC is attached beneath the aircraft. Both documents stated that the HEC survival was best assured by the sling person remaining attached to the line in the event of an emergency landing.

Other dual hooks for HEC RFMS

There were no STCs for dual hooks for HEC for R44 helicopters in Canada or the US. The ATSB reviewed the RFMS and STCs for dual hooks for HEC (using single turbine engine helicopters) that were approved in Canada and the US. Those STCs were used for multiple activities, unlike the R44 dual hooks with HEC for crocodile egg collection, which were only approved for that activity.

In Canada, single turbine engine HEC was only approved for rescue and similar activities considered to be in the public interest, that is, where there is a value of life consideration. The RFMS approved by Transport Canada incorporated only emergency procedures as they related to failure of the hook system. For example, a Transport Canada-approved RFMS for Bell 206L‑series helicopters HEC dual hook system Emergency/malfunction procedures section consisted of:

• the need to release both hooks to jettison HEC
• actions in the event of (hydraulic) failure of the PQRS to open the HEC hook
• uncommanded release of either hook system.

An FAA-approved RFMS for Bell 206L/407 had emergency procedures for the event of electrical failure of the hooks, plus the following statement:

An FAA-approved RFMS for MD Helicopters MD 369 Emergency procedures stated:

In summary, a Transport Canada-approved test pilot advised that an RFMS associated with an STC for dual hooks for HEC would document how to release a load, and procedures in the event of failure of the hooks or quick release system (QRS), but would not address particular operational scenarios. The expectation was that these would generally be contained in an operator’s standard operating procedures approved by the Operational Authority.

Operator information

Helibrook

Helibrook held an air operator’s certificate issued 2 April 2020, with an expiry date of 31 July 2022. Under the certificate, Helibrook was permitted to conduct charter and aerial work operations, including sling load operations. At the time of the accident, Helibrook had one Bell 206L and 3 Robinson R44 II helicopters. 

The 3 key positions at Helibrook were the head of aircraft airworthiness and maintenance control (HAAMC), who was the accident pilot of VH-IDW, the chief executive officer (CEO), who was also the chief pilot, and the safety manager.

Head of aircraft airworthiness and maintenance control

The accident pilot was a licenced aircraft maintenance engineer and had held the role of Helibrook’s HAAMC since 12 July 2019. The Helibrook operations manual defined the HAAMC role as follows.

Chief pilot

The chief pilot was responsible to CASA for all operational matters affecting the safety of flying operations. The chief pilot’s responsibilities listed in Helibrook’s operations manual included:

• safe and efficient operation of the aircraft
• monitoring operational standards
• maintaining training records and supervising the training and checking of pilots and crew including of equipment used
• ensuring pilot flight and duty times were accurately recorded
• ensuring the aircraft were appropriately maintained.

Prior to holding the chief pilot role, the Helibrook CEO had been subject to CASA enforcement action. As a result, CASA imposed a variation on the pilot’s helicopter licence. The variation required the CEO to attend aviation theory remedial training and testing, and complete four 6‑monthly flight reviews with a CASA-approved examiner. These were aimed at ensuring ongoing proficiency in making appropriate safety judgements.

The CEO reported completing the first of those flight reviews and aviation theory training on 6 July 2019. On the same day, the CEO submitted an application to CASA for approval to become Helibrook’s chief pilot. The applicant’s previous breaches meant they did not meet one of the criteria for the chief pilot appointment, which required the person to have ‘maintained a satisfactory record in the conduct or management of flying operations’. CASA offered the applicant the opportunity to demonstrate an acceptable means of compliance with that requirement and submit a safety case stating how they would manage the risks.

Having provided a response to CASA, the chief pilot applicant was required to conduct 2 flights with a CASA flight operations inspector and complete associated ground activities. The CEO conducted the first CASA assessment flight on 6 August 2019 and was assessed satisfactory. The activities assessed were a charter flight and simulated crocodile egg collection. The examiner identified some gaps in knowledge of recent legislation, which the applicant was reported to be working to address. The examiner’s notes described an experienced pilot with a good safety focus.

The CEO’s second chief pilot assessment flight and ground activity was conducted on 25 November 2019. The examiner commented that the CEO demonstrated the ability to supervise and mentor other pilots and was assessed as suitable for consideration for appointment as chief pilot of Helibrook.

CASA subsequently approved the CEO as Helibrook’s chief pilot on 20 January 2020. Additionally, the CEO was provided with an exemption removing the requirement for the previously imposed 6-monthly flight review checks. As part of the process for the CEO to conduct the chief pilot role, Helibrook introduced a safety management system (SMS) and appointed a safety manager.

Safety manager

The safety manager was recruited by the Helibrook CEO in August 2019. The safety manager was also assigned the roles of operations manager and drug and alcohol management plan (DAMP) officer for Helibrook. Apart from a short period in 2020, when the safety manager worked for Helibrook in the Northern Territory, including as a helicopter charter pilot, the safety manager lived interstate and conducted the safety manager, operations manager, and DAMP officer roles remotely.

Documented key responsibilities of the safety manager included:

• maintaining the safety management system and ensuring it was relevant to the operations
• conducting hazard and risk identification
• conducting incident and accident investigations.

Safety management system

Overview

Attributes of a safe organisation include a healthy safety culture with appropriate risk management processes, which achieves safety objectives through internal responsibility rather than relying on regulatory compliance (CASA, 2019). The International Civil Aviation Organization (ICAO, 2018) defined an SMS as:

It is designed to continuously improve safety performance through the identification of hazards, collection and analysis of safety data and safety information, and continuous assessment of safety risks. An SMS seeks to proactively mitigate safety risks before they result in aviation accidents and incidents.

The Helibrook SMS manual version 1.0 was issued on 1 August 2019 and accepted by CASA on 22 November 2019. Although not generally required by CASA regulations at the time, it was introduced to demonstrate a commitment to safety and thereby aid in obtaining CASA’s approval of the chief pilot. The SMS manual outlined the company’s safety policy, objectives, and responsibilities for supporting the SMS and reporting of incidents, risks and hazards. It stated:

Helibrook’s SMS manual stated that it was to be updated annually, by the CEO in collaboration with the safety manager, and that safety meetings were to occur monthly and involve the safety manager, CEO/chief pilot and HAAMC.

Safety risk management

Safety risk management includes hazard identification, and safety risk assessment, mitigation and risk acceptance (ICAO, 2018). The safety risk management process is continuous and risk mitigation strategies must be monitored to determine whether they are effective. Helibrook’s SMS manual stated the aim of risk management was ‘to treat or control risks to as low as reasonably practicable’. Their stated risk management tools included a documented risk assessment, evaluation and treatment process, a master risk register, and a regular hazard and risk review process.

Hazard identification

According to ICAO (2018), a hazard can be considered as a dormant potential for harm, which is present in one form or another within the system or its environment. Therefore, hazard identification is the first step in the safety risk management process. The intention is to proactively identify hazards before they lead to accidents, incidents, or other safety‑related occurrences. Hazard identification may also consider hazards that are generated outside of the organisation and outside their direct control, such as weather (ICAO, 2018).

The Helibrook SMS manual listed several means of identifying hazards including reporting systems, audits, staff input, and experience.

Helibrook hazards

The Helibrook hazard register, titled Hazards and Risks, listed items under 7 headings: organisation, operational, helicopter, pilot and flight crew, operating environment, weather and egg collecting. The following 2 lists are relevant to this investigation:

On 30 September 2019, in response to a request from CASA, the safety manager identified 13 hazards ‘that have the potential to cause harm to pilots and passengers’ and proposed actions to mitigate associated risks. None were associated with crocodile egg collection operations.

Risk assessment

A risk assessment is a process where hazards and the chances of an adverse event happening due to the hazard were identified, analysed, and evaluated (CASA, 2021). This evaluation was expressed in terms of likelihood and consequence and should highlight the risks to be considered before and while carrying out an operation.

Organisations should have multiple layers of controls or defences in place to manage their identified hazards (CASA, 2014). Risk assessments should be carried out across all levels of an organisation and at different stages in the operation. These could consist of a formal, documented process or a continuous ongoing mental assessment carried out by a pilot, or a combination of both. An example of a formal risk assessment would be an operational risk assessment conducted by the operator to consider and evaluate the risks associated with the type of work being undertaken.

The Helibrook operations manual stated that the ability to identify hazards and assess risks was an important component of their continuous safety improvement process. It stated that if a risk assessment was required, the chief pilot would conduct and document the process, which included assessing the risk, developing risk control strategies and implementing them, then assessing those controls. The Helibrook operations manual standard operating procedure for crocodile egg harvesting included that in the event of an aircraft failure:

• the sling person must have a clear understanding of the risk and implications of such an emergency
• the risk of injury will be reduced providing all height and speed limitations are adhered to
• prior to slinging, the pilot must advise the sling person of the high risk nature of the operation and what steps shall be taken to reduce the risk.

Risk register

Safety risk management activities should be documented, including any assumptions underlying the probability and severity assessment, decisions made, and risk controls implemented (ICAO, 2018). A tool such as a risk register could be used to ensure identified hazards were tracked and mitigated as part of a formal risk management process of prioritisation, documentation, and assessment. The register could include the hazard, potential consequences, assessment of the associated risks, and any controls put in place to manage the risk (ICAO, 2018).

Safety reporting system

The effectiveness of a safety reporting system partly relies on the promotion of a positive reporting culture and proactive identification of safety deficiencies. One way of achieving this is by clearly stating that reported information will be used solely to support the enhancement of safety (International Civil Aviation Organization, 2018). This also included a culture where people can report without fear of punishment (Reason, 1998). The Helibrook SMS described a formal reporting system as a key element of the SMS.

Safety culture

CASA SMS booklet 2 – Safety policy and objectives stated that good safety management ‘is not about having an SMS manual on the shelf…it needs context to be effective’. Further, that the ‘ultimate responsibility for safety rests on the shoulders of senior managers’, who should demonstrate a commitment to safety. This included maintaining a positive safety culture.

Safety culture has been defined as 'the set of enduring values, behaviors and attitudes regarding safety, shared by every member at every level of an organization' (SM ICG, 2019). More simply, it is ‘what goes on when no-one is watching’ (EASA, n.d.). Additionally, the effectiveness of a safety management system has been shown to be dependent on the safety culture (SM ICG, 2019).

The Hudson Ladder defined 5 steps, or maturity levels, in the evolution of safety culture (Figure 27). The first step – pathological (‘who cares as long as we’re not caught’) – was not really a culture of safety (Hudson, n.d.). The second step, a reactive safety culture, was one in which safety was a burden imposed by the regulator. In a reactive culture, action was only taken in response to an incident, and often involved blame or punishment. In a poor safety culture, ‘not everyone takes safety seriously, are not watchful, are complacent and compromise too readily’ (ARPANSA, n.d.). In contrast, a positive safety culture ensures operations are conducted as safely as practicable, which reduces the risk of accidents occurring.

CASA described safety culture elements, in which an example ‘enabler’ of a positive safety culture was that an ‘effective method of hazard identification has been established’. The converse example ‘disabler’ of a positive safety culture was ‘no effort is spent on hazard identification’ (CASA, 2021).

Figure 27: Hudson Ladder

Source: Hudson n.d.

Helibrook’s safety management

Helibrook’s SMS manual had not been amended since initial issue and no meetings had been conducted since the introduction of the SMS. The safety manager described their role as ‘lacking’ and reported that most of their time was devoted to managing day-to-day operations (in their other role as Helibrook’s operations manager).  

The safety manager also described the Helibrook hazard register as ‘a bit lacking’, with many of the listed items not actually hazards. Additionally, there was no assessment of risks, controls or mitigation strategies. Helibrook did not have or maintain a formal risk register, or any alternate means to track and identify hazards and associated controls for their operation. The safety manager also reported that no risk assessment had been conducted of any of Helibrook’s approved activities, including crocodile egg collection (an activity which the safety manager had not actually observed). The CASA instrument that approved human external cargo operations stipulated that human slinging could only be conducted if it was assessed as reducing the risk of heat exhaustion and/or crocodile attack. Despite that, there was no documented means of assessing the relative risks.

Safety equipment, maintenance and time to rebuild/overhaul were listed on the hazard register relating to ‘Helicopter’, however no risks had been identified with VH-IDW. The safety manager also reported being unaware that VH-IDW’s ELT was not installed.

The safety manager described Helibrook’s reporting culture as ‘not great’, with only one incident in Helibrook’s safety reporting system – a hard landing involving VH-XHB, which occurred on 30 August 2020, while the safety manager was at the site. In relation to that occurrence, the safety manager submitted an incident report to ATSB on 1 September 2020.

The report stated the pilot was the only person on board at the time of the accident. However, the ATSB obtained footage taken by one of 3 passengers on board at the time. The safety manager was nearby at the time of the accident and, despite the detail on the incident report, reported being unaware how many people were on board. The safety manager was also the Helibrook DAMP officer and had not requested drug and alcohol testing of the pilot following that incident, as they did not think the incident was sufficiently serious to warrant it. In response to that incident, the safety manager reported proposing a windsock be put in the area to assist pilots identifying the wind direction, as misidentification of the wind direction was assessed as a factor contributing to the incident.

The safety manager did not conduct an internal investigation into the accident involving VH‑IDW and several months after the accident reported that they did not know what happened, had not seen the aircraft or been able to obtain any information about it. As the DAMP officer, the safety manager had also not requested testing of the accident pilot.

Helibrook operations manual

CASA first assessed and accepted the Helibrook operations manual in December 2016. The Helibrook operations manual version 7.3 was accepted by CASA on 28 February 2020. The manual included a standard operating procedure (SOP) for crocodile egg harvesting. That SOP was approved by CASA on 11 June 2020. CASA’s approval of the slinging operation was based on reducing the overall risk of crocodile attack and heat exhaustion. The SOP stated that the primary reason for slinging personnel was to:

It further stated:

The intent of the latter statement appeared to be to avoid operating in and around a helicopter if personnel were affected by fatigue.

One requirement of the procedure was for the chief pilot to have briefed the pilot before the pilot was permitted to conduct HEC sling loads. The briefing was to include a minimum 30-minute oral brief, a minimum 30-minute equipment demonstration/inspection and a minimum of 1 hour flying time. This was to be documented on a pilot competency check form. There was no record this had been conducted for the accident pilot.

Additionally, Helibrook did not have documented training for the pilot to conduct HEC slinging operations, or evidence that the pilot had trained in Helibrook’s emergency procedures for HEC slinging. The pilot reported having demonstrated some criteria and conducted ergonomic testing of the switches with CASA, but could not recall specific training by the operator. At the start of each season, the pilot completed annual administration and recurrency with WHNT but no helicopter-based training specifically for the activity.

The pilot reported that they did not generally practise emergency procedures for slinging. In their most recent operator proficiency check, the pilot recalled conducting autorotations and other emergencies. They did not practise releasing the sling load, as the pilot reported doing it ‘every day’ and it was ‘just two pushes of the buttons’. The chief pilot reported that it was ‘too dangerous to put yourself in an autorotation in that scenario to practise’, but they did general emergencies/autorotations as part of the training.

The SOP included ‘Safety aspects to consider before approaching a nest’. It required pilots and sling persons to assess slinging access to the nest including consideration of timber, trees and obstacles. It stated: ‘Should there be obstacles that will affect the safe operation then the sling option will be abandoned’.

Pilots were also required to be ‘fully conversant’ with the CASA instrument (approving use of HEC for crocodile egg collection) including the conditions and limitations. The requirement for the pilot to brief the crew/sling person on the emergency procedures was included.

Emergency procedures for crocodile egg harvesting

Helibrook’s standard operating procedure

The SOP included the following section titled Emergency procedures:

The following emergency procedures were then specified:

Training in emergency procedures

Planning for emergency procedures is a critical component of risk management in HEC operations (DOI, 2010). A study into the human factors aspects of human external loads recommended that all HEC crewmembers be initially and continually trained and practised in emergency procedures (Shehab, Schlegel & Palmerton, 1998). For any in-flight emergency, training is essential to ensure a pilot responds quickly and appropriately. The FAA General Aviation Joint Steering Committee’s Safety Enhancement Topic – Emergency Procedures Training (FAA, 2013), stated:

In the event of an engine power loss while operating in the H/V avoid area, a safe outcome is not always possible, and a pilot has very limited time to respond to achieve the most effective autorotation possible. In the event of a power loss with an external load, the decision to release a load is dependent on the load characteristics. For non-HEC, the load would be jettisoned to reduce aircraft weight, prevent the load from interfering with controllability and increase survivability of the helicopter’s landing.

For HEC, the pilot must decide whether to put the sling person on the ground or to release them. If the sling person is placed on the ground at a speed that minimises their risk of injury, the helicopter will descend rapidly from the height of the length of the sling line, increasing the pilot’s injury risk. The pilot’s injury risk is reduced as the impact velocity decreases. The minimum rate of descent of an R44 II helicopter in an autorotation is achieved at 55 kt airspeed. A sling person would be unlikely to survive an autorotation to the ground with that combination of vertical and horizontal velocity.

Although the Helibrook SOP permitted a sling person to be carried up to 5 m above vegetation (including trees), releasing the sling person more than 5 m above the ground is likely to result in fatal injuries. Additionally, release of the sling person with any horizontal velocity may make it difficult for them to remain erect, increasing the risk of landing other than feet first and increased injury severity.

Release of the sling person

The CASA-approved RFMS stated that survivability of HEC personnel during an in-flight emergency was best accomplished by having the sling person remain attached to the helicopter, unless they were snagged on terrain or likely to become so. However, the Helibrook emergency procedure in the event of engine failure stated that the pilot ‘shall release the sling person as close to the ground as practicable’.

CASA’s instrument approving HEC for crocodile egg collection required pilots to comply with both the RFMS and the company operations manual, and the onus was on the helicopter operator to ensure there was no discrepancy between the 2 documents. When asked about the discrepancy between the RFMS emergency procedure to keep the HEC attached to the line and Helibrook’s emergency procedure to release the HEC, the accident pilot reported that the RFMS stated it was the pilot’s discretion whether to jettison the HEC in the event of an engine failure.

The pilot commented that they ‘did not agree with’ the RFMS procedure to leave the sling person connected in the event of emergency, as that was ‘not a good method at all’. The pilot further commented that with a complete engine failure when operating above trees, if they left the HEC attached to the helicopter, the helicopter would either descend 100 ft vertically on top of the sling person, or the sling person would be dragged through the trees.

The chief pilot advised that in the event of an issue with the helicopter with HEC the pilot would flare the helicopter to try to ‘get the sling person off safely’, and in doing so, sacrifice themselves (and the helicopter) because they would lose rotor RPM. They further stated that in the event of engine failure while slinging, they would likely have their head out the door (watching the sling person) and would look in at the cockpit instruments and identify what had happened. The pilot reported that if they had forward speed, they would flare to release the sling person as safely as possible, then nose forward to try to regain airspeed before flaring the helicopter onto the ground.

Operating height

The Helibrook emergency procedure stated that the HEC ‘shall not be more than 5 m above the ground and or vegetation’. The accident pilot reported that when slinging with HEC, they tried to minimise the height and distance, and the sling person would usually be just above the treetops. The chief pilot also reported that they would go over trees and another pilot who had previously conducted crocodile egg collection reported that the SOP requirement to be not more than 5 m above the ground or vegetation was interpreted to include not more than 5 m above 30.5 m (100 ft) trees. One of the other operators conducting crocodile egg collection reported that they had normalised operating above treetop height, and had removed the height reference from their operations manual. The amendment to that operations manual had been accepted by CASA.

Operating above trees increased both the height of the fall if the sling person was released and the likelihood of having to release the sling person to prevent entanglement with vegetation rather than place them on the ground.

R44 human external cargo operations

Requirements for human external cargo operations

A CASA-authorised aeronautical (design) engineer first issued an engineering order approval for installation of a hook system on an R44 helicopter in December 2007, to enable slinging of an egg collector onto a crocodile nest to facilitate egg collection. However, the approval for fitment of the hook system did not in itself provide approval to conduct external load operations. To make it clear that operational approval was also required, the RFMS associated with the engineering order for the hooks system stipulated that use of the hooks was limited to the commercial collection of crocodile eggs in accordance with CASA-approved operational procedures.

CASA authorisation  

Civil Aviation Regulations 151 and 250, which were in force throughout the 2007–2021 period of instrument approvals, did not permit a person to be picked up or carried outside a helicopter without CASA’s authorisation and permission. For crocodile egg collection, CASA issued instruments to helicopter operators that authorised the pilot in command to pick up a person under Civil Aviation Regulation 151(3) and permitted the pilot to carry that person in a harness system attached to the R44 helicopter under Civil Aviation Regulation 250(2). Civil Aviation Safety Regulations Part 11 applied to this authorisation. Specifically, CASR 11.055 (1)(d)[20] stated that CASA may grant the authorisation only if ‘granting the authorisation would not be likely to have an adverse effect on the safety of air navigation’ (CASR, 2010).

Key safety considerations

For the helicopter and pilot (and any other occupants), the key risk that results from carrying (slinging) a person under the helicopter is an event in which the HEC becomes entangled or a similar scenario that may cause a loss of control to the helicopter. Additionally, slinging involves operation in the H/V avoid area, and carries similar hazards to the helicopter and occupants as any other operation in that flight regime.

As the sling person is outside the protection of the helicopter, consideration is required of the likelihood of any scenario where they may collide with an obstacle or the ground, such as a fall resulting from deliberate or inadvertent release of the hooks.

Certification of dual hooks for HEC

Certification requirements

In 2013, CASA identified that the hooks that were being used for crocodile egg collection operations were not certified for HEC. The premise for the certification of any jettisonable external load was that it could be released, without exceptional pilot skill, to prevent hazard to the aircraft, such as causing a loss of control. For HEC, in addition to the need to be able to rapidly release the load to avoid a hazard to the aircraft, it was also necessary to minimise the probability of inadvertent release.

The design engineer then commenced a process to enable the hooks to be approved for HEC by meeting the certification requirements of US FAR 27.865. Compliance was demonstrated except for the requirement that the hooks would not open uncommanded and release the HEC or fail to release, due to electromagnetic interference (EMI). Given limited time until the crocodile egg collection season started that year (December 2013), CASA approved the design engineer to continue to authorise installation of the dual hooks under the engineering order with an interim approval exempting compliance with the FAR EMI requirement until March 2014. The operation continued to be conducted in accordance with a separate CASA operational approval (instrument).

Equivalent level of safety

About 12 months later (after the March 2014 deadline had passed), the design engineer advised CASA that the EMI testing had not been carried out and sought an equivalent safety determination[21] for the requirement. The basis for the proposed equivalent level of safety was that the operational limitations for HEC specific to the egg collection role ‘reduce the risk to equivalent or less than that of a system showing compliance’. That is, there would not be an unacceptable level of risk to the sling person if the hooks released due to EMI while the sling person was on the line, or to the pilot and helicopter if the hooks failed to release due to EMI.

A suite of supporting documents was supplied to CASA, including one that documented operational conditions to reduce exposure to EMI. Another key document proposed limitations to the height the HEC could be carried, to reduce the consequences in the event of release of the sling person due to EMI.

HEC height limitations

In approving crocodile egg collection operations with HEC, CASA had imposed speed and height limitations – that the HEC was to be carried at walking pace and not more than 5 m above the ground or obstacles. The HEC height limitations document relating to EMI risk proposed that those conditions already in place would provide an equivalent level of safety to compliance with the requirement that EMI must not result in release of the hooks. The report concluded that the proposed limitations provided ‘a strictly controlled level of risk for the HEC person in crocodile egg collection operations’. The proposed limitations included ‘a speed not exceeding walking pace’ and that:

The report referenced scientific studies into injuries and mortality due to falls from heights. These studies identified a significant increase in the likelihood of mortality associated with:

• falls from heights above 5 m
• increased age
• landing other than feet first
• head injury.

Based on these factors, the report noted 4 conditions associated with crocodile egg collection that mitigated against the risk of injury in falls from heights. These were that:

• only fit, young persons were employed
• any release would have the person in the best orientation, normally erect, and a maximum of three body lengths above the ground, minimising the time for the orientation to be upset
• use of parachute fall landing technique[22]
• use of helmets to prevent head injuries.

Design compliance

In October 2015, a new hook wiring design was bench tested and the 28 Volt electrical system was found compliant with the EMI requirement. At that time, CASA requested the design engineer lodge an application for the hooks to be fitted under an STC.

In the same month, the design engineer provided CASA with a compliance report detailing assessment of the R44 dual hook for HEC installation with FAR 27.865 – External loads. Demonstration of the reliability of the system included completion of a Failure Modes and Effects Analysis,[23] showing that all potential failure modes of the QRS that may result in catastrophic failures, serious injuries or fatalities were extremely improbable (in the order of 10^-9 or less), and any less significant failures were improbable (in the order of between 10^-7 and 10^-9). The FAA Advisory Circular (AC) 27-1B regarding Reliability of the external load system, including QRS, stated:

In meeting all requirements of FAR 27.865, failure of the hooks resulting in the release of the HEC or failing to release were assessed as extremely improbable. These therefore met the defined acceptable (tolerable) level of safety. Having conducted the analysis for failure modes of the hooks, the design engineer described helicopter engine or control loss as ‘the most significant risk for this operation and can only partly be ameliorated’. Further, that the ‘only amelioration which can be applied is’:

Instrument conditions

Purpose of the conditions

In granting an authorisation to conduct HEC, CASA could specify conditions that were required to be complied with when operating under the authorisation. These were stipulated in an authorisation instrument. CASA delegates stated that the instrument conditions were designed to mitigate the risks of the activity.

Previous CASA instrument conditions

The first CASA authorisation instrument for R44 HEC for crocodile egg collection, was reported to have been issued in 2007 associated with the first fitment of a hook system to an R44 helicopter for HEC. CASA was unable to find any record of instruments issued prior to 2010 or any documented safety case or risk assessment associated with the first instruments that were issued for the activity.  

The ATSB obtained instruments issued to several operators from 2010 to 2021 and interviewed several CASA delegates who had approved instruments for the activity, or were involved in the approval process from 2013 onwards.

The 2010 instrument was issued for both R44 and Bell 206 helicopters. All subsequent instruments were for R44 (and R44 II) helicopters only. The 2010 instrument listed 20 conditions, most of which appeared in all subsequent instruments. Included in the conditions were limitations to the height, speed and distance the sling person could be carried. Appendix C – HEC height, speed and distance/time conditions 2010–2021 includes a table of the HEC limitation conditions in the instruments issued from 2010 to 2021.

For the instruments issued from 2010 to 2013 (inclusive), these conditions were:

• The person is not lifted to a height of greater than 5 metres above the ground or obstacles.
• The aircraft is not flown at a ground speed greater than walking pace when the person is carried under the helicopter.
• The maximum distance the person is carried under the helicopter is 500 metres for each pick up.

Request for changes to conditions

In 2013, one operator requested an amendment to the conditions, including replacing HEC height, speed and distance limits with pilot-assessed safe height, speed, and distance. In response, CASA asked the operator to conduct a risk assessment.

Operator risk assessment

That operator provided CASA with an assessment of risks identified for human sling operations for crocodile egg collection. The assessment was derived from a WHNT safe work method statement provided to all operators involved in the crocodile egg collection. The assessment detailed 7 steps in the job sequence. For each of those, it identified ‘What can go wrong’, assessed the initial risk, proposed control measures and assessed the resulting risk.

The job sequence ‘Lift collector and transit to crocodile nest’ obtained an initial risk rating of ‘catastrophic’. The likelihood was assessed as ‘very possible – will probably occur in most circumstances’; the consequences were assessed as ‘extreme – fatality or multiple fatalities’.

The list of hazards for that risk included equipment failure, falling from height and external load limitations (along with crocodile attack, adverse weather, fatigue/heat exposure/exhaustion, flora and fauna). The risk was reduced to ‘high’: unlikely – could happen sometime, with extreme consequences of one or multiple fatalities, with the following proposed mitigations:

Engine mechanical failure and fuel exhaustion/starvation were not included in the hazards for the slinging component therefore no relevant mitigations were included. Engine mechanical failure was however identified as a hazard in the non-slinging job sequences ‘Start aircraft and take-off’, Fly/Ferry to collection areas’ and ‘Return to base/ferry to next job’. Mitigations for engine mechanical failure included the daily inspection, emergency training and rescue plans, adherence to helicopter limitations, and pilot training/experience.

The CASA delegate who assessed the provided risk assessment described it as basic and the requested condition changes were not granted. However, there was no documentation provided that correlated the risk assessment with CASA’s retention of the conditions in the instrument.

2014 and 2015

The 2014 and 2015 instruments were valid from December to the following May, consistent with the crocodile egg collection season. In 2014, the 2013 condition that limited the HEC height to 5 m above the ground or obstacles was amended to:

No documented reason for amendment to the operating height conditions was provided. The delegate who made that amendment reported that the purpose was to make it clearer and avoid ambiguity. The delegate also amended the speed condition to be less prescriptive and provide ‘flexibility to operate more safely’. The HEC speed limitation was changed from ‘walking pace’ to:

A new condition was also added in the 2014 instrument, which stated that the sling person must be provided with a copy of the instrument and ‘made aware, in writing, that the hook system is not certified for human use’. That condition was retained in all subsequent instruments.

2016

In 2016, the CASA delegate was invited to a demonstration of human slinging for simulated crocodile egg collection. Following the demonstration, the height condition was amended to provide the operators ‘some relief to be able to go over obstacles that might be in their flight path to go from one point to another’ as follows:

When asked how lifting the HEC above the nominal survivable height of 5 m affected the activity risk, the delegate commented that it was not un-survivable because ‘the operator had an obligation to conduct the operation in a safe manner’. Additionally, in 2016, the 500 m distance limit the HEC could be carried was amended to:

In 2016, Helibrook received their first instrument for R44 HEC for crocodile egg collection. The chief pilot had previously been involved in conducting the same operation for different AOC holders.

2017 and 2018

The ATSB obtained instruments issued to 3 operators in 2017, including Helibrook. As Helibrook was oversighted by a different CASA regional office to the other operators, multiple delegates were involved in the instrument approvals.

Late in 2016, the EMI test report demonstrating compliance of the hook system was completed. As a result, the HEC height limit was removed from the RFMS for the hooks, which was only required to consider failure of the hook system, not failure of the helicopter and associated operational safety limitations. A 60 kt speed restriction was included in the RFMS, based on reported feedback from an egg collector stating that was a suitable operating speed. It was noted at the time the amendments were made to the RFMS, that operational limitations specified in CASA’s operational instrument would be ‘overarching and could contain more conservative limitations’. However, when CASA asked for advice regarding limitations, the design engineer advised that additional limitations were unnecessary as the system was now HEC compliant.  

The 2017 delegates and their CASA subject matter experts – airworthiness/engineering and the previous delegate – agreed that as the height limitation had been removed from the RFMS, it could also be removed from the CASA instrument, because inadvertent release was now extremely unlikely as the hook system was compliant. It was also assessed that there was no longer any purpose in stipulating a speed limit because ‘at 500 ft above ground level…forward speed will have no bearing on the HEC’s chances of survivability’. Therefore, the height limitation condition and the clause in the speed condition regarding minimisation of injury to the HEC were removed from the 2017 instrument conditions. However, the pilot-assessed safe speed and minimum distance conditions were retained.

The delegates reported that they relied on information provided by the subject matter experts and assessed that there were reasonable mitigations in place with the conditions. One delegate reported that they had accessed relevant files and had conversations with other delegates. They therefore assessed that the activity presented an acceptable risk, particularly as the instrument was a renewal for an activity that had been conducted without accident or serious incident for at least 5 years.

Although the height and speed limit conditions were removed once the hooks were HEC compliant, the instrument condition advising that the hooks were not certified for human use was retained. The delegate reported that their understanding was that the hooks were satisfactory and fit for purpose but not certified or approved by CASA.

The instrument delegate responsible for the instrument issued to Helibrook assessed that the activity was high risk, but accepted by CASA. Further, they considered that the removal of the height limitation was ‘a small change’ and nothing significant that would affect the operation.

From 2018, the instruments were issued for a 12-month period from December.

2019 and 2020 

The CASA flight operations inspector responsible for oversighting Helibrook was assigned as the delegate for Helibrook’s instrument renewal in 2019 and 2020. The delegate assessed that the Helibrook operations manual had reasonable procedures for the activity, the sling equipment was approved, and the chief pilot and/or pilots involved had sling approval and relevant experience.

The delegate assessed that as it was a renewal, the procedures were in place and if they continued doing what they were doing previously, there was probably no reason not to allow them to continue what was an established activity. They also assessed that minimisation of exposure was included in the operator’s procedures. The delegate did not identify any discrepancies between the operations manual, RFMS and the instrument conditions.

In both of those instruments, CASA’s STC approval process of the hooks was underway. In anticipation of that approval, the conditions included that the aircraft must have been modified in accordance with the nominated engineering order for the dual hooks, but would need to be shown to be compliant with and certified to the STC within 14 days of the STC’s approval.

Delegate guidance material

In an email to the ATSB, CASA reported that there was no ‘granular documented process’ for approving instruments like the R44 Dual Hooks for HEC for Crocodile Egg Collection authorisation. The CASA Air Operator’s Certificate (AOC) Process Manual included a section on CASA approvals and exemptions, with a process map and the administrative steps required. Additionally, CASA’s Air Operator’s Certificate Handbook provided detailed information for assessing and issuing an AOC, including:

• process overview
• assessment criteria, methodology and link to checklists for AOC approvals
• operational personnel
• inspection of specialised equipment fitted to aircraft
• assessing an operations manual
• volume 2 provided guidance for assessing an application to include an aerial work purpose on an AOC, which included appropriate operations manual content, inspection of specialised equipment and review of the chief pilot's experience and qualifications
• volume 4 included assessing safety management systems with a sub-section on safety risk management, which included guidance to assure an acceptable level of safety existed.

The CASA delegates approached by the ATSB reported that the AOC‑related documents provided broad or generic guidance, and while similar principles could be used for assessing a request for an authorisation and permission instrument, they did not contain specific relevant guidance.

Safety assessment

To determine how CASA delegates assessed that safety was preserved when issuing authorisations, the ATSB requested detail of any risk assessments associated with the instruments. In response, CASA advised that they could not locate any risk assessments and that they had not conducted any specific testing or assessment of the risk profile for the activity of R44 HEC for crocodile egg collection. Specifically, CASA also advised that they had no evidence of any risk assessments associated with the instruments issued to Helibrook between 2016 and 2021.

CASA required a request for an authorisation to be made in writing and when assessing a request, delegates relied on the advice of other CASA personnel with subject matter expertise and experience. This advice was generally communicated by emails, some of which were filed in the records management system, or by telephone. The assessment was then made based on judgement of the activity’s reasonableness, but there was no documented acceptable risk level.

Although they reported not having seen a CASA risk assessment for the activity, the involved delegates assumed that a safety case would have been provided with the first operator’s request for approval for the activity (sometime prior to 2013) and that had been assessed and accepted by CASA. The activity was understood to be high risk, but delegates believed that CASA accepted that risk level. In particular, as the 2013 instruments were signed by a senior CASA manager, this was interpreted as an endorsement that it was appropriate to continue issuing the approvals.

Additionally, the annual approvals for operators were considered to be reissues of instruments for a previously accepted activity, albeit to varying helicopter operators. All the operators conducting crocodile egg collection each season received essentially the same instrument, although some conditions varied from one year to another. Prior to issuing Helibrook’s first instrument in 2016, a CASA inspector verified that the operator had:

• a procedure for conducting the activity
• appropriately experienced personnel
• relevant documentation and sling equipment.

For an annual issue of an instrument to an operator who had previously held the authorisation, the delegate’s primary check was whether there had been changes to procedures or personnel since the previous issue. The delegates reported that if there had been no changes to procedures, and no enforcement action taken against an operator, they had no reason not to reissue the instrument. Additionally, as mentioned above, they assessed that the activity was being done safely as there had been no reported accidents or serious incidents. 

The delegates all reported that the instrument conditions were intended to mitigate the risks associated with the activity, and that they assessed there were sufficient conditions and procedures in place to mitigate the risk to a reasonable level. Additionally, they considered that there was an onus on the operators to act safely and to advise CASA, via their operating procedures, how they were going to reduce the associated risks.

Human external cargo rotorcraft load combination decision

In August 2013, a CASA project was initiated to consider existing HEC regulations and propose amendments to Civil Aviation Order (CAO) 29.6, which only applied to non-human sling operations. The project identified that permissions being issued by CASA regional offices were not issued on the basis of a risk assessment or reflective of international standards. Specifically, in the US, United Kingdom and Canada, HEC was not permitted with piston engine rotorcraft and, CASA had assessed that the use of piston engine helicopters increased the risks to HEC compared with turbine engine rotorcraft. Additionally, in 2013, helicopter operators involved in the powerline industry had approached CASA for HEC approval using turbine engine rotorcraft, consistent with international requirements.

As a result of the project, in October 2013, the then CASA Director of Aviation Safety (DAS) signed an internal minute that recommended CASA restrict HEC operations to the following requirements:

• single engine turbine powered rotorcraft with a usage monitoring system
• out of ground effect hover performance with a performance buffer
• restrictions on who could be carried
• an attachment means certified for the carriage of humans.

The minute also recommended that the proposed standard be communicated to CASA field officers for consideration in all authorisation/permission approvals, while the proposed amendment to CAO 29.6 to reflect the policy was being drafted.

As a component of the project, a CASA risk workshop on crocodile egg collection using HEC was held on 20 November 2013. While no minutes were recorded from the meeting, a draft risk management plan (RMP) provided to the ATSB formed the basis of the discussions.

Risk management plan

The stated purpose of the RMP was:

The RMP was drafted by a senior standards officer with significant helicopter and HEC expertise using a CASA general aviation operations template. The scope included that the assessment:

The assumptions listed in the RMP were:

The overall operational risk of the activity was assessed with an initial risk rating of high (7), which ‘needs senior management attention’, and the residual risk (with controls in place) of medium (5), requiring ‘management responsibility’. 

CASA’s General aviation operations group risk matrix utilised to assess the operational risk is depicted in Appendix B – CASA operational group risk matrix (2013). Extreme and high risks were required to be reported to senior management and have detailed treatment plans, ‘which reduce the risk in accordance with the ALARP [as low as reasonably practicable] principle’. CASA AC 138-05 – Aerial work risk management defined ALARP as ‘the point where the costs of introducing further safety measures to lower a risk outweigh the safety benefit. However, a risk should be tolerated only if there is a clear benefit such as a compelling operational need’ (CASA, 2022). 

The broad risk categories considered in assessing the risk associated with HEC operation were:

• engine failure/malfunction inside the H/V envelope with HEC attached
• insufficient excess power available for role and environment
• equipment/hardware failure of rotorcraft system or subsystem
• human error while undertaking HEC operation.

Potential risk controls were:

• preference of multi engine turbine rotorcraft with [one engine inoperative] OEI accountability
• preference to single engine turbine rotorcraft
• usage monitoring systems of pertinent parameters
• equipment standards to HEC design criteria
• limitation of exposure measured in time, distance, speed and height [above ground level] AGL
• CASA increased surveillance of operations whilst under limited conditions
• CASA mandated minimum experience level and qualification to conduct HEC
• increased engine and critical component inspection criteria
• mandated excess power margin requirements for [hover out of ground effect] HOGE conditions
• limitations in environmental conditions including wind azimuth, velocity, humidity.

The RMP identified 26 individual hazards, all of which were assessed as initially not ALARP. Some of the documented hazards were linked to the R44 POH and Robinson Safety Notices. Proposed operational mitigations included additional regulatory oversight to ensure procedures were followed and maintenance/overhaul requirements were adhered to.

For the hazard of single engine piston rotorcraft engine failure while operating in the H/V envelope, the likelihood was assessed as rare – 1 in 10,000 to 1 in 100,000, with severe consequences – multiple life-threatening injuries/less than 10 fatalities, and an overall medium risk. Suggested mitigations to reduce the residual risk, still rated as medium, included:

• minimise exposure time for HEC and enforce conservative limits of distance, height and time
• require engine usage monitoring system
• use fuel injected models only
• require single engine turbine to reduce failure rate, or multi-engine rotorcraft with one engine inoperative accountability; or in consultation with the manufacturer increase inspection requirements including engine compression checks, and reduce overhaul period.

There was no assessment of the hazard of fuel exhaustion, but fuel starvation or contamination was assessed. For these, the initial risk was assessed as unlikely, and the consequences were severe with an overall high risk rating. With mitigations including fuel checks, minimum fuel requirements, fuel usage policy and turbine engine, the residual risk was medium, requiring CASA management responsibility.

The author of the RMP subsequently advised the ATSB that the omission of fuel exhaustion as a hazard was unintended, and that the proposed mitigations were also applicable to fuel exhaustion.  

CASA’s Flight Standards Branch advised the ATSB that the RMP was never finalised, and the risk controls proposed to mitigate the risks of continuing R44 HEC for a further 6-month period were not implemented. The draft RMP was however used by CASA Flight Standards Branch to propose HEC standards, first for an amendment to Civil Aviation Order 29.6, which was subsequently discontinued (in 2016), and then for the development of CASR Part 138.

CASA also advised that the RMP was used to consider the potential viability of allowing single engine piston helicopter HEC operations based on an equivalent level of safety. This would have required demonstration that the piston engine helicopter had a similar in-flight failure rate as a turbine engine helicopter with a usage monitoring system. Members of CASA’s Flight Standards Branch presented this option to operators in 2014, however, no operator attempted to demonstrate this equivalence. 

Intent to amend approval conditions from 2014

On 6 December 2013, CASA’s operations division sent a letter to an operator that had previously been authorised to conduct R44 HEC operations. The letter included the proposed future position requiring single engine turbine power rotorcraft with a usage monitoring system and other requirements as per the revised policy position approved by the then DAS. The letter stated that CASA had:

The letter then detailed the relative risks of single engine piston rotorcraft compared with single engine turbine rotorcraft. This included detail that in the US from 2004–2008, the accident rate of single engine piston rotorcraft on average exceeded 1 per 10,000 flight hours and was more than 3 times that of single engine turbine rotorcraft. Engine failure inside the H/V envelope was identified as one of the main risks related to single engine rotorcraft. It also listed other known failure modes of R44 rotorcraft that had been identified in the RMP.

In summary, the letter advised the operator that CASA intended to renew the authorisation with some changes to the conditions for one more season before turbine engine rotorcraft would be required. At the time, the cargo hooks were not certified for HEC and a proposed condition was that the authorisation did not override engineering or airworthiness limitations.   

Response to the proposed changes

The design engineer responsible for the hooks system responded to CASA’s letter on behalf of operators that conducted crocodile egg collection. The response disputed the safety data referenced in CASA’s letter, requested coordination between CASA’s certification/airworthiness and operations personnel and continued R44 operation for one more season to allow operators time to address the proposed requirements.

In response, a CASA regional manager made a documented recommendation to a senior manager within CASA that R44 HEC operations continue. The recommendation outlined CASA’s authorisations of R44 HEC operations for crocodile egg collection, the 2013 DAS decision to establish formal policy (including the use of turbine powered rotorcraft for human sling load operations) and that since that decision, CASA had undertaken work regarding the appropriateness of piston engine rotorcraft to carry human external cargo.

The recommendation also advised that that operator had requested reissue of the authorisation to continue to operate until CAO 29.6 changes were finalised. In support of the request for continued R44 HEC operations, the design engineer provided their comparative analysis of Bell 206 (turbine helicopter) and R44 engine failure data. Additionally, the regional manager proposed that extra conditions be included in the instrument to ‘mitigate those risks further’. Key additional conditions from the precedent instrument (which was valid from 2 December 2011 to 31 December 2013) were:

• the hooks are to be certified for use in human sling load operation
• engineering orders must confirm that all things attached to the hook systems are fit for purpose
• the aircraft is to be operated in accordance with the approved FMS
• daily inspection includes sling system/equipment
• the pilot is required to verify the engine is capable of normal rated power with no defects evident and to certify this on the maintenance release
• only persons employed or contracted for egg collection can be carried.

The reasons given for the recommendation were that:

• the overall risk to safety of the egg collector could be reduced by the use of the R44 aircraft type
• other operational activities permitted by CASA possessed ‘equal hazards and risks, such as mustering operations, night agricultural operations, and parachuting activities’. 

The senior manager agreed with the recommendation and signed instruments authorising continued R44 HEC operations for crocodile egg collection to the end of April 2014 for 2 operators.

The CASA delegate who approved the following year’s instrument assumed that one reason the 2013 instruments were signed by a senior manager was to demonstrate that CASA senior management was aware of the operational approvals process and was satisfied it was appropriate to issue the instruments.

Proposal to discontinue CAO amendments

In 2016, the then DAS agreed with a proposal from CASA Flight Standards Division to close the existing project to amend CAO 29.6, as it had been ‘superseded by Part 138’. The finalisation of Part 138 was reported to be ‘imminent’, with a proposed effective date of September 2018. The proposal included that crocodile egg collection would ‘continue as per current exemptions until such time as Part 138 is made and the regulation commences’.

Transitional regulations

At the time of the accident, Helibrook and other operators were conducting crocodile egg collection under their AOC as an aerial work operation. From 2 December 2021, crocodile egg collection required a CASR Part 138 Certificate (instead of an AOC) to authorise the operation. The crocodile egg collection operation (carriage of a person outside a rotorcraft) was categorised as an aerial work class D external load operation under CASR Part 138.[24] Chapter 15 of the Part 138 manual of standards (MOS) – Rules for external load operations, applied to the activity.

Section 15.06(3)(e) applied to rotorcraft that cannot hover out of ground effect with one engine inoperative, requiring section 9.05(b), (c), (d) and (e) of the MOS to be complied with. This required the rotorcraft to have:

• a turbine engine 
• a usage monitoring system 
• control to be maintained in all phases of flight in the event of a hydraulics failure or alternatively dual hydraulics
• redundant means of controlling fuel flow to the engine. 

CAR 151 and 250 were repealed on 2 December 2021. An authority under CAR 151(3) and a permission under CAR 250(2) applied to CASR Part 138. The Part 138 requirements were more onerous than the existing instrument issued to Helibrook for crocodile egg collection, which permitted use of a piston-engine helicopter without a usage monitoring system. In order to permit continued egg collection using the R44 an exemption was granted under Division 11.F.1, including CASR 11.170(3), which stated:

Despite the intended safety improvement associated with the introduction of Part 138 requirements, Helibrook’s instrument was issued on 9 September 2021, with a 3‑year validity period. Under the transitional legislation, it would cease at the earliest of the:

• expiry of the instrument (31 December 2024)
• second anniversary of the instrument commencement (7 September 2023)
• day the operator’s AOC expired (31 July 2022, extended to July 2023 after the accident).

Considering these criteria, Helibrook would be required to comply with CASR Part 138 and Part 138 MOS when its AOC expired. 

Briefing note July 2021

In July 2021, an internal briefing note to a senior CASA manager stated that:

The briefing note outlined the risk assessment and subsequent work, which had concluded that HEC operations were very high risk for the sling person. It stated that the risk could be substantially mitigated through the use of a turbine engine helicopter with a usage monitoring system. Additionally, the hook system needed to provide redundancy in the case of failure of the hooks/system.

The Background section of the briefing note included that CASA’s previous permission instruments had not been issued on the basis of a risk assessment, and that the risk had been assessed in 2013 as unacceptable without mitigation. Further, that CASA’s authorisation of R44 HEC operations was not reflective of international standards and significantly differed from the FAA, Transport Canada and EASA. At that time these organisations generally required multi turbine engine helicopters with one engine inoperative accountability for commercial operations, with the use of high-reliability single turbine engine helicopters permitted for limited specified operations.  

The Way Forward section of the document noted that some helicopter operators were already conducting powerline maintenance work using a single engine turbine helicopter for HEC, based on the CASR Part 138 standards.

Helibrook’s 2021 instrument

The 2020 instruments were valid until 31 December 2021. On 2 September 2021, the Helibrook safety manager emailed CASA’s Regulatory Services requesting a renewal of the instrument with the 2020 instrument attached to the email. After payment, the task was assigned to the delegate on 9 September 2021, who recalled that it was relatively urgent. The delegate reported being unaware of the history of the authorisation, but was aware of the general risk of the operation and that it had been assessed by multiple sections within CASA.

The delegate reviewed the file relating to the most recent instruments and emailed the previous approver asking whether there were any concerns regarding reissue of the instrument to Helibrook. The previous approver advised that:

• the STC for the hooks had been issued on 30 July 2021
• there had been no changes to Helibrook’s equipment or procedures that they were aware of
• CASR Part 138 was not yet in force
• considering the above, they saw no reason why a new instrument should not be issued.

They also commented that they did not believe there was a compelling statistical argument to justify the higher cost of a turbine engine helicopter that would be required under Part 138.

The delegate then signed the instrument on 9 September 2021 with an expiry date of 31 December 2024. There was no change to the conditions from the previous year’s instrument. The references to the now redundant EO were not removed. Condition 23 stated that when the STC is approved, ‘all aircraft previously certified to the [engineering order] EO will be shown to be compliant with and certified to the STC within 14 days of the STC being approved, after which time aircraft certified only to the EO may no longer undertake this work’. Helibrook did not update the hook installation on VH-IDW to the STC. The delegate reported that they were unsure about whether the hooks had been certified. The delegate also reported being unaware of the implications of the impending Part 138 requirements when they issued the instrument for a 3-year period.

At the time of the accident, VH-IDW was operating under CASA Instrument CASA.CARRY.0163 Revision 1, issued to Helibrook and dated 7 September 2021 (2 days prior to it being assigned to the delegate).

There were 34 listed conditions that Helibrook and the pilot in command were required to comply with (Appendix D – Instrument conditions). There was no limitation specified for the HEC carriage height. Key conditions discussed previously included:

• The pilot in command and sling person were required to have completed a course of training for the activity promulgated in the helicopter operator’s operations manual. The operator’s training course was to include not less than 1 hour of flight time and 1 hour of ground instructional time.
• A thorough pre-flight briefing was to include actions to be taken by crew members during possible emergencies – the briefing was to be conducted in accordance with the briefing procedures in the operations manual.
• The helicopter was required to be compliant with the STC SVR 541 and to be operated in accordance with the FMS, which details normal and emergency procedures associated with the activity.
• The pilot and operator were required to comply with the relevant procedures in the company operations manual.
• The pilot was required to have continuous and clear radio communications with the sling person throughout.
• The pilot was required to fly the helicopter at a ‘safe speed’ and to carry the sling person ‘for the minimum distance and time required in order to safely conduct the activity’.
• The sling person was required to wear an Australian Standard helmet (‘appropriate to the risks encountered during the activity’).
• Prior to commencement of the activity each day, the pilot was required to verify that the engine was producing normal rated power output, and that no defects were evident which could lead to power reduction during those operations.
• The sling person must be made aware, in writing, that the hook system is not certified for human use.

Engine failure probability analysis

US data

Data based on the Lycoming Service Reporting Database, National Transportation Safety Board Aviation Accident Database, FAA Service Difficulty Reports, and FAA Accident and Incident Database System from 31 December 2016 to 31 December 2021, found power loss rate (incidents per 100,000 flight hours) were 0.54 for the R44 and 0.11 for the R44 II. These helicopter types therefore met the EASA requirements[25] for ‘Helicopter operations without an assured safe forced landing capability’ engine in-service sudden power loss rate requirement of not more than 1 per 100,000 (1 x 10^-5) engine hours in a 5-year moving window. For that data, where the cause of the engine failure was unknown, or where maintenance was identified as the reason for the failure, they were counted as 0.5 and 0 events respectively.

Australian data

A review of R44 and R44 II engine failure occurrences reported to the ATSB,[26] compared with flight hours for the period 2011 and 2020 showed the average engine failure rate was 4.4 per 100,000 flight hours. Unlike the power loss rate data above, these did not consider whether the failure resulted from maintenance or an unknown reason, which may account for the higher engine failure rate in Australia. Fuel exhaustion and fuel starvation were not coded as engine failures.

In addition to engine failures, the ATSB identified R44/R44 II accidents and serious incidents that occurred during the same period, which would likely result in injury to the sling person if they occurred during slinging operations. These were primarily losses of control and occurred at a rate of 2.8 per 100,000 flight hours. The combined rate of engine failure and other occurrence types likely to result in injury to the sling person was 7.2 per 100,000 flight hours.

At risk time

To quantify the risk of the activity, it was necessary to approximate the amount of time HEC was being conducted each year in Australia under a CASA authorisation. In the 2020–21 and 2021–22 seasons, 3 helicopter operators had CASA authorisation for R44 HEC operations to conduct crocodile egg collection. Of those, 2 contracted to WHNT and one operator supplied a different crocodile farm. WHNT provided total invoiced hours for 3 R44 helicopter operators for those seasons, one of which did not have a CASA instrument for HEC, but the ATSB obtained evidence from February 2021 showing dual hooks installed on their helicopter. In the 2020–21 season, 566.1 hours were invoiced and 507.3 in the following season, in which activities were suspended following the accident. This included the accident pilot, operating VH-IDW as one of the 2 HEC helicopters for WHNT, who had invoiced 21.5 full days of conducting crocodile egg collection for the 2021–22 season to 22 February 2022 (approximately 200 hours).

WHNT initially estimated that they were generally slinging about half the total engine-running time, and later revised this to about 20% of the total time for the 3 helicopters operating for WHNT. The other (non-WHNT) operator estimated they did about 15 hours of HEC each season.

Based on the information and approximations provided, the ATSB assessed the effect of slinging a person under an R44 helicopter for 200 hours per year. On average, an engine failure or in-flight emergency likely to result in an accident, would occur once every 69 years while slinging a person.  

Exceeded maintenance intervals

Exceeding maintenance, inspection and overhaul limits, increases the probability of an in-flight engine failure. The Robinson R44 Maintenance Manual stated that it ‘is the operator’s responsibility to maintain a record of time in service for the airframe, engine and life-limited components…[an] hour meter is an acceptable means of recording time in service’. The manual included the warning that:

Lycoming Service Instruction 1009BE – Time between overhaul (TBO) schedules included the warning that ‘Operation of an engine in a non-airworthy condition could result in loss of life, serious injury, and damage to property’. Additionally, the Lycoming operator’s manual included:

Previous occurrences

HEC accident

On 11 May 2022, a Bell Helicopter Textron Canada 407 helicopter was conducting HEC training in Livermore, California, US. The helicopter was about 175 ft above ground level with a sling person on a 60-ft long line when the engine lost power. The pilot manoeuvred the helicopter and partially raised the collective when the sling person was about 15 ft above the ground (AGL) and cushioned them onto the ground. The sling person was uninjured.

The pilot then manoeuvred the helicopter away from the sling person and when about 10 ft AGL, raised collective and released the sling line. The helicopter landed hard resulting in substantial damage to the helicopter and serious injury to the pilot, who had to be extricated from the wreckage. At the time of publication of this report, the US NTSB investigation was ongoing however, the occurrence showed that in a helicopter with more main rotor inertia than an R44, it is possible to cushion the HEC onto the ground, but the ensuing autorotative landing can result in serious injuries to the pilot.

Fuel exhaustion occurrences

Safety publication 

The ATSB Avoidable Accidents publication Starved and exhausted: Fuel management aviation accidents (ATSB, 2013) defined 2 main reasons why fuel stops getting to an engine during flight:

• Fuel exhaustion happens when there is no usable fuel remaining to supply the engine/s.
• Fuel starvation happens when the fuel supply to the engine/s is interrupted although there is adequate fuel on board.

The report stated that the ATSB received an average of 21 reports of fuel exhaustion or starvation occurrences each year. Fuel exhaustion occurrences were normally either the result of an error in pre-flight fuelling, or a number of seemingly minor aspects of fuel planning and management during the flight. Consideration of different fuel consumption rates depending on the activity being conducted and flight conditions is a key component of fuel planning. 

The chance of fuel exhaustion is reduced if a pilot accurately determines the amount of fuel on board prior to starting, by cross-checking from multiple sources. These include fuel quantity gauges, dipsticks, totalisers/flow meters and calculations from previous refuels and fuel usage regularly checked for accuracy.

ATSB fuel exhaustion occurrences 2011–2020

The ATSB occurrence database held 54 fuel exhaustion occurrences for the 10-year period 2011‑2020. Considering the involved engine types, 49 were piston, 4 were turbine and 1 engine type was unknown. However, of the total aircraft, only 5 were helicopters, 3 of which had turbine engines and 2 were piston engine helicopters. Neither of the piston helicopters were an R44, but one of the occurrences involved a piston engine R22 Beta helicopter conducting mustering operations. Given the small data set, there was no significant difference in engine type for helicopter fuel exhaustion occurrences.

For 14 of the 54 occurrences, the total flight time of at least one pilot was recorded. Table 4 details the number of occurrences, the number of those where the total flight time of one pilot was known, and the median total flight time. The median total flight time of a pilot involved in a fuel exhaustion occurrence was 1,227 hours with a range of 20 to 14,500 hours. This suggests that experience is not a mitigation against fuel exhaustion occurrences.

Table 4: Fuel exhaustion occurrences 2011–2020, engine type (1 unknown), median and range of pilot total flight time (TT)

Source: ATSB occurrence data

ATSB investigation AO-2010-073

On 4 October 2010, a Robinson R22 Beta helicopter collided with the ground while conducting cattle mustering operations. The pilot was fatally injured, and the helicopter sustained substantial damage. The investigation found that the collision with terrain was probably a result of engine stoppage due to fuel exhaustion, while operating at low altitude. The investigation also found that:

Long line fuel exhaustion accident

In 2012, the US National Transportation Safety Board investigated an MD Helicopters 500D helicopter accident, in which the engine lost power while a utility worker was suspended on a long line attached to the helicopter. The investigation analysis included the following:

The National Transportation Safety Board determined the accident to be a result of improper maintenance resulting in erroneous fuel gauge indications, combined with the pilot’s inadequate fuel management. The investigation also found there were no written company procedures or fuelling records to track fuel loading and time-based fuel consumption.

Survivability

Post-mortem report

The post-mortem examination of the egg collector found multiple blunt force injuries resulting from a fall from a height. The examination identified that there were numerous head, neck, and torso (or trunk) injuries. There was also external evidence of blunt force trauma to the upper and lower limbs, but there were no underlying skeletal injuries. No obvious evidence of fuel was found on the egg collector’s clothing to indicate a fuel leak prior to the accident, but the clothing was not specifically tested for the presence of fuel. Additionally, no bark residue, indicative of tree contact, was identified.

Height of fall

Three studies conducted on patients presenting to an emergency or trauma centre following a fall from height analysed injuries sustained and the height of the fall (Icer and others, 2013, Liu and others, 2008, Nau and others, 2021). The studies found that the overall injury severity was higher with increasing fall height. With increased height of the fall, there was a significantly higher severity of thoracic and pelvic injuries, whereas the severity of head injuries and spinal fractures did not increase with fall height. Life-threatening injuries were more likely the higher the fall height, and falls greater than 18 m were usually fatal (Nau and others, 2021).

In one study, the mean fatal fall height was 6.61 m, noting that the study excluded people who had died before arriving at the hospital. About 30% of people who fell from 10 m or higher died, which was twice the percentage of those who fell from 6–9.9 m and nearly 3 times that of those who fell from 3.1–6 m. Of those fatally injured, 91% sustained head injuries. The study found haemopneumothorax[27] and subarachnoid haemorrhage[28] were the most important factors affecting mortality (Icer and others, 2013). Another study also found severe head injury was a significant prognostic factor for mortality in people who fell from heights of at least 6 m (Liu and others, 2009). 

These research findings were consistent with a retrospective study of autopsy reports (Abder-Rhman, Jaber, & Al-Sabaileh, 2018), which found that internal injuries were directly proportional to the height of the fall. Head injury was the most common fatal injury in all heights, chest injuries and skull base fractures were more prevalent in falls from above 3 m, and abdominal injuries were mainly prominent in heights above 9 m.

The Civil Aeromedical Research Institute of the US FAA report Human survivability of extreme impacts in free-fall, analysed factors affecting survivability in individuals who survived falls from heights of up to 84 m (275 ft) (Snyder, 1963). Among other factors, the study found that orientation of the body was important. The initial impacts were feet-first in 10 of the 12 cases of survived falls from over 33 m (100 ft). The impact force was found to be greatly attenuated by bending and flexion of the leg muscles. 

Freefall orientation

The sling person’s harness is designed to keep them in an upright position. Keeping the sling person attached during an emergency landing would allow them to remain upright and impact the ground feet first, decreasing the mortality risk. When the sling person is released, they have no means of orientating themselves and are more likely to tumble, increasing the likelihood of landing other than feet first, thereby potentially increasing risk of fatal injury.

Injury assessment

A forensic pathologist assessed the egg collector’s injuries and found that there was evidence of significant head injury due to ground impact. In assessing the height from which the sling person was likely released, the pathologist referenced research showing that higher mortality is found in falls from greater heights and that the threshold for suffering major trauma from a fall from a height is at least 6.1 m (20 ft). Further, that pelvic fractures occur significantly more often if the fall height is at least 6 m, and chest trauma is more common the higher the height of the fall.

Based on the research and the egg collector’s extensive pelvic, spinal, and chest fractures, the forensic pathologist assessed that they likely fell from a height above 5 m.  

Egg collector helmet

The egg collector’s helmet was found nearby, and the helmet’s clasp receptacle had fractured.

The instrument issued to Helibrook for picking up and carrying a sling person under an R44 helicopter for crocodile egg collection stipulated that the sling person was to wear a helmet that ‘meets the Australian standard appropriate to the risks encountered during the activity’. The sling person’s helmet had a sticker showing compliance with American National Standard for Industrial Head Protection ANSI/ISEA Z89.12009 Type I Class C. This standard was amended (in 2014) to Z89.1-2014.

The standard stated that Type I helmets were ‘intended to reduce the force of impact resulting from a blow only to the top of the head’. (The Class C (‘conductive’) helmets also provided no electrical protection). In contrast, Type II helmets met additional requirements for lateral impact protection (front, back and sides) and chin strap retention. In this accident, a Type II helmet would not have reduced the severity of the egg collector’s injuries to a survivable level.

Pilot restraint and helmet

The pilot sustained swelling and bleeding on the brain indicative of rapid deceleration and acceleration. Although the pilot was not wearing a helmet, it would likely not have reduced the severity of head injury in this accident as no head impact occurred. The pilot reported always wearing the 4-point restraint and could not recall how they exited the helicopter.

Pilot seat

R44 helicopter seats are designed to crush and absorb impact forces. Under the seat is a stowage area marked with a weight limit and a limitation for storage of soft articles only. The pilot reported that they normally had the following under their seat: lunch, water bottle, satellite phone, first aid kit and a raincoat. A broken headset and other small items were found under the pilot seat and photos from the site showed other items that were removed before ATSB arrived that may also have been stored under the seat.

Impact forces crushed the seat into the storage area, with the seat box and support structure collapsing. Additionally, the fuselage belly pushed upwards after the undercarriage skids exceeded their capability. The floor also pushed up to the level of the collapsed seat pan.

This indicated that the energy absorption capability of the airframe with respect to the seat installation had been exceeded. The seat probably collapsed onto the contents of the stowage compartment and may have contributed to the pilot’s injuries.

Cocaine metabolites

In Australia, cocaine is classed as a ‘Schedule 8 – controlled drug’. Cocaine is a central nervous system stimulant and an illicit drug, unless there is evidence it is used for medical purposes. In a dilute solution, it is used as a topical anaesthetic for limited purposes and is listed as an unrestricted Schedule 8 substance in Northern Territory hospitals. A deputy director at Royal Darwin Hospital advised that cocaine was not stocked in the Emergency Department and was not administered to the pilot at Royal Darwin Hospital. CareFlight NT’s Medical Director advised that their aircraft did not carry topical cocaine.

In the context of aviation safety, detrimental effects of cocaine can occur in the hours immediately after use, and depending on the regularity and dose used, there may also be longer-term effects. Immediate effects of a moderate dose of cocaine on skills performance can include risk-taking, inattentiveness and poor impulse control. During the ‘crash phase’, which lasts 9 hours to 4 days following cocaine use, the user can feel depressed, agitated, irritable, and there can be significant fatigue and lack of energy (Isenschmid, 2002). As the effects of cocaine wear off, the user can suffer fatigue, depression, sleepiness, and inattention (Couper and Logan, 2014).

Cocaine is metabolised in the body to benzoylecgonine and ecgonine methyl ester. Blood concentration of cocaine decreases rapidly and is typically detectable in blood 1–2 days after use. Cocaine metabolites benzoylecgonine and ecgonine methyl ester may be detectable for at least 3–4 days after cocaine use. The presence of benzoylecgonine and other cocaine metabolites in blood in the absence of cocaine usually indicates the cocaine exposure did not occur immediately prior to the blood sampling (Isenschmid, 2002). A toxicological pharmacologist advised the ATSB that it was extremely difficult to correlate blood cocaine concentration with the timing and quantity of exposure to the drug. They also assessed that the pilot’s toxicological results were indicative of exposure to cocaine possibly up to about 4 days prior, but not in the previous 24 hours.

CASR 91.520 detailed that a crew member is unfit for duty if their ability to perform the duty is likely to be impaired because they have used a psychoactive substance such as cocaine. Pilots are required to declare recreational drug use to a designated aviation medical examiner.

Safety analysis

Introduction

From about 0850 on 28 February 2022, the crew of Robinson R44 II helicopter, VH-IDW, were preparing to conduct crocodile egg collection, near King River, Northern Territory. The helicopter was operating under a Civil Aviation Safety Authority (CASA) instrument that authorised the pilot to operate with a person in a harness system (‘sling person’) outside and attached to the helicopter, for the purpose of collecting crocodile eggs. The authorisation was subject to conditions that were intended to mitigate the risks of the operation.

After hearing no communications from the pilot of VH-IDW for more than one hour, another pilot conducting egg collection nearby commenced a search. They found the accident site about 150 m from the first nest they expected VH-IDW’s crew to collect eggs from. The egg collector lay fatally injured on the ground, wearing their harness and attached to one end of the sling. The attachment rings at the other end of the sling were not connected to the helicopter, which had collided with the ground upright, 44 m from the egg collector, and was substantially damaged. The pilot sustained serious injuries.

There were no witnesses to the accident and the accident pilot had no recollection of the accident and limited recollection of the hours leading up to it. No recorded data to accurately determine the accident sequence, including the time of the accident, was recoverable.

There was no fuel present in the helicopter’s auxiliary tank and a very small quantity in the main tank. Assessment of the helicopter indicated that the engine was stopped before the helicopter impacted the ground. Additionally, there was no evidence of failure of the harness, sling, attachments or the hooks system. There was also no evidence of failure or defects to the airframe or the helicopter’s systems likely to have contributed to the accident.    

This analysis will discuss:

• fuel uplift
• the pilot’s awareness of the helicopter’s fuel state
• potential reasons for the in-flight engine stoppage
• the circumstances relating to the release of the sling person and the helicopter’s collision with terrain.

The influence of the helicopter operator’s safety management system and the Civil Aviation Safety Authority’s (CASA’s) process for issuing authorisation instruments will also be analysed. Finally, the potential contribution of the helicopter’s state of airworthiness, presence of cocaine metabolites in the pilot’s toxicology results and lack of emergency location transmitter fitted to the helicopter will also be considered.

Fuel uplift

After reportedly being filled with fuel, the helicopter departed from the operator’s hangar at Noonamah on the outskirts of Darwin at about 0703 in company with 2 other R44 helicopters. Fuel receipts showed that the Noonamah fuel tank contained only blue‑coloured 100 low lead (LL) Avgas fuel and there was no record of the quantity of fuel uplifted to VH-IDW at Noonamah on the accident morning. An in-flight photo taken en route to Mount Borradaile showed the chronometer reading 45 minutes, which the pilot reported usually setting to zero after refuelling.

A subsequent report that VH-IDW was filled the evening prior to the accident and not on the accident morning, suggested that VH-IDW departed with less than full fuel (151–153 L usable). However, the in-flight photo showed the gauges reading slightly below 3/4, consistent with the helicopter having departed Noonamah at or near full, based on the reported fuel flow rate of about 65 L/h.

Based on flight data, witness accounts and evidence from the in-flight photo, the 3 helicopters probably arrived at the en-route fuel depot at Mount Borradaile at around 0816. The accident pilot reported that they always left Mount Borradaile with full fuel tanks and their intention had been to refuel there. However, they were unable to confidently recall the specific fuelling activities at Mount Borradaile or events thereafter.

There were consistent recollections from others present at Mount Borradaile that VH-IDW was the first helicopter to arrive and that it did not have a fuel drum pump on board to transfer fuel from the drum stock. However, there were also differing recollections of the order in which the R44s were refuelled, with each helicopter being repositioned in turn close to the drums and the entire activity being undertaken without shutting any of the aircraft down. Two people reported seeing the accident pilot pumping fuel, including into VH-IDW. However, in a submission following review of the draft report, one of those reported not having seen anyone fuel VH-IDW. One other person reported assisting the pilot to pump fuel. However, that person’s recollection subsequently changed to having observed the egg collector partially fuelling VH-IDW before taking over to finish the fuelling themselves.  

In the approximately 14 minutes the helicopters were at Mount Borradaile, there was probably sufficient time to refuel 3 helicopters given the number of people available to assist. Two witnesses reported that the egg collector was flying VH-IDW, from the right seat, when it departed Mount Borradaile, and that the accident pilot removed the dual controls after arriving at King River. However, the accident pilot and another egg collector reported that the accident pilot had flown VH-IDW from Mount Borradaile, having removed the dual controls there.

The ATSB’s assessment, based on the consistent accounts of the first 2 witnesses and recorded GPS data transmitted to a server from the egg collector’s phone indicating they were using an electronic flight bag application to navigate between Mount Borradaile and King River, was that it was more likely that the egg collector flew VH-IDW from Mount Borradaile to King River.

The person who prepared the 2 fuel drums for the R44 crews on the accident morning at Mount Borradaile had a detailed recollection of which drums were used and subsequently obtained fuel samples from those drums for ATSB testing. The samples were confirmed as green‑coloured 100/130 fuel in accordance with the relevant specifications and the delivered batch test data.

The first person to arrive at the accident site, reported that there was a fuel smell but later assessed that may have been from a leaking jerry can stored behind the pilot’s seat. The first emergency responder on site reported the absence of a fuel smell, but noted leaking hydraulic fluid that created a sheen on the water. The Helibrook chief pilot also reported that there was no fuel smell when they arrived. As the helicopter wreckage was in a swamp, with water slowly running downstream, it was possible for fuel to also drain away, although no one observed that occurring. There were also varying reports that people who attended the site after the accident looked in one or both fuel tanks and detected fuel, but no one attempted to measure the quantity.

When ATSB investigators arrived at the accident site 2 days after the accident, there was no fuel present in the auxiliary tank and only a small quantity of fuel in the main fuel tank. Although it was not possible to accurately measure the quantity in the main fuel tank on‑site, it was assessed by the ATSB investigators to be significantly less than the documented unusable quantity of 4 L. Recognising that the worst‑case helicopter orientation is used to arrive at that unusable fuel quantity, it is possible to consume some of the published 4 L in‑flight. However, it was considered unlikely that the small remaining quantity observed by the ATSB on‑site would have sustained the engine. As such, following the ground collision some fuel was either removed from the helicopter or was able to drain away.

Examination of the helicopter identified that it was possible for fuel to drain under gravity from the tanks through the fuel system and out via either a fractured fitting between the fuel flow transducer and flow divider, or through the drain at the gascolator. However, the loose organic black soil from the accident site that filled the fractured transducer fitting would likely have been flushed out if fuel had drained through that route. There was also no fuel staining on the cowls, but this may have been due to water ingress into the cowls at the accident site. Images taken of the site 4 months after the accident showed no evidence of vegetation dieback that would be indicative of significant fuel leakage, however over 200 mm of rain had fallen in the intervening period.

The helicopter manufacturer assessed that the deformation of the fuel tanks was consistent with a lower fuel quantity, but was unable to distinguish between some or no usable fuel remaining, or between impact damage and possible bulging due to internal contents. However, the degree of tank deformation indicated that the helicopter was not filled with any significant amount of fuel at Mount Borradaile unless the accident occurred at about the time the helicopter was located. This was considered unlikely because the accident occurred between the clearing and the first target nest in the direction of travel that morning. Other than the egg collector’s phone briefly contacting a cell tower at 0858, there was no evidence the crew planned to go anywhere other than the 3 nests they had been allocated to collect, and no eggs had been collected. There was no communication between the cell tower and the pilot’s phone at that time. 

Scientific testing of the fuel drained from VH-IDW after the accident found that it was 100 LL Avgas and likely contained no more than 1% 100/130 fuel, consistent with residue from previous fuelling. This physical evidence opposed any significant quantity of 100/130 fuel being added to the tank at Mount Borradaile. Although it was later reported that it was possible for other drums at Mount Borradaile containing 100 LL to have been used, the distinct drum markings and reported general usage of the fuel location made that unlikely.

The potential effect of interference with the site was considered in relation to the removal of the jerry cans and the fuel testing results. The only plausible scenario that permitted both refuelling at Mount Borradaile to occur and the sole presence of 100 LL when chemically tested was if 40 L of 100 LL fuel was poured from the jerry cans into VH-IDW after the accident and then subsequently largely leaked away.

While it was possible that the addition of 40 L of 100 LL from the jerry cans could produce the attained test results, there was no evidence that occurred. Conversely, those on‑site reported that one of the jerry cans was damaged on impact and fuel from the jerry cans out of VH-IDW was used to fuel one of the other helicopters before departing the accident site. This was consistent with reports of empty jerry cans being used at Mount Borradaile to transfer fuel from a drum to a helicopter on the return trip. Additionally, the lack of fuel smell, cowl staining and soil lodged in the fractured transducer fitting also indicated that 40 L of fuel was not poured through the system.

Considering the relatively greater strength of the technical evidence, the ATSB concluded that the helicopter was probably not refuelled at Mount Borradaile prior to the commencement of the egg collecting activity.

Detection of low fuel state

The sources of information for the pilot regarding the helicopter’s fuel state were the chronometer, fuel totaliser, fuel log, fuel gauges and low fuel warning system.

The pilot’s normal practice, consistent with the in-flight photo was to reset the chronometer to zero following refuelling. The chronometer did not store data and therefore its reading at the time of accident could not be determined. The pilot reported that they did not use the totaliser, which was not visible in the in-flight photo. Further, there were no records of fuel uplifted to VH-IDW for the accident day.

When tested, the main tank indication overread within a needle-width at empty, a quarter and half full. The auxiliary tank gauge indicated very close to the actual fuel level. The placard below the main fuel tank gauge, from the last fuel calibration, indicated the main tank gauge would significantly underread. Therefore, had the pilot been relying on the calibration placard’s quantity to interpret the gauges, there would have been less fuel in the main tank than expected, other than when full or empty. However, based on the in-flight photo showing the fuel gauges, and testing of the gauge senders and gauges, the gauges would likely have been reasonably accurate.

The calibration placard also stated the low fuel warning light would illuminate with 20 L fuel total remaining and the pilot recalled that it would illuminate with 18 L remaining. However, according to VH-IDW’s Pilot’s Operating Handbook, the low fuel warning light would illuminate with 11 L of usable fuel remaining, which would be 14 L total. It is therefore likely that, if the light illuminated in flight, the pilot would think there was more fuel remaining than the POH indicated. The accident pilot also reported that their normal practice was to depart Mount Borradaile with full fuel. This expectation may have influenced the degree to which the pilot focused on the fuel quantity.

The low fuel warning system was found to be functional. However, it is possible that, if the low fuel light and/or fuel gauges were indicating low fuel, the accident pilot may have dismissed these cues as they would not have been consistent with their expectation. Additionally, had the low fuel light illuminated, the pilot may have thought there was more fuel remaining than actual.

A previous ATSB investigation into a Robinson R22 accident that occurred during mustering operations, found that the nature of the operation potentially diverted the pilot’s attention away from monitoring the helicopter’s fuel state. This resulted in probable fuel exhaustion and stoppage of the engine in flight. This potential also existed in conducting slinging operations, as the pilot would have had their head out the door, looking down at the sling person, and not at the instrument panel or gauges. This limitation of monitoring gauges was included in the Helibrook operations manual and suggested pilots conducting low-level aerial work operations also monitor elapsed flight time. However, had the chronometer been reset to zero at Mount Borradaile but the helicopter not refuelled, this would have provided an erroneous indication of time since refuelling.

Had the pilot detected a low fuel situation, there were 2 jerry cans of 100 LL fuel in VH-IDW that could be used for refuelling and multiple landing sites were available. Ultimately, while indications of the in-flight fuel state should have been available to the pilot, the pilot may have not observed them, dismissed them as erroneous or misinterpreted them. In any case, it is likely that the pilot did not recognise the helicopter’s fuel state.

In assessing whether the pilot’s experience as a helicopter pilot and in slinging operations would mitigate the risk of fuel exhaustion, the ATSB reviewed fuel exhaustion occurrences in the 10-year period 2011–2020. The median total experience of pilots involved in fuel exhaustion occurrences reported to the ATSB in that period was 1,227 hours. This illustrates that experience alone does not mitigate fuel exhaustion.

In-flight event assessment

The ATSB analysed what in-flight event occurred that led to the egg collector dropping their equipment, the pilot releasing them, and the subsequent helicopter collision with terrain. The orientation of the accident trail was consistent with the route between the clearing and the nest most likely to be collected first. There was no evidence of snagging of the sling line or egg collector that led the pilot to release them. There was also no evidence of in-flight breakup or damage to the helicopter airframe due to failure, bird strike, or consistent with a manoeuvring error or mishandling.

Significantly, there was physical evidence that the engine was stationary when the helicopter impacted the ground, and no evidence that supported engine rotation was identified. Based on advice from the helicopter manufacturer, the ATSB assessed whether the engine had stopped in flight or because of the main rotor blade striking the tree while the engine was producing low power. The damage to the main rotor blade, including one broken pitch link, was consistent with a tree strike in a low rotor energy state. The diameter of the branches struck on the first 2 strikes was assessed as too small to stop the engine. The last tree strike was more substantial but occurred below the main rotor blade height, indicating the helicopter impacted the ground prior to that strike. On balance it was therefore considered likely that the engine stopped in flight.  

Reason for engine stoppage

Pilot action

The ATSB assessed the possibility of inadvertent pilot-induced engine stoppage in the context of the pilot’s logged total helicopter flight experience of about 2,500 hours and more than 300 hours of sling time. Robinson advised that there had been several accidents in which a pilot had inadvertently induced an engine stoppage by rolling off the throttle too fast. This had occurred in flight training when simulating an engine failure and as an incorrect response to abnormal situations such as a sudden change in engine RPM or discrepancy between engine and rotor RPM.

It was considered very unlikely that the pilot would have simulated an engine failure at any stage during the accident flight. Although it could not be determined whether there was another situation that led to the pilot quickly rolling off the throttle, this would be a highly unlikely response of an experienced pilot, while conducting human external cargo (HEC) operations.

Aircraft, engine and fuel system examinations

The ATSB conducted extensive airframe and component examinations. Independent experts were engaged to conduct engine and fuel system examinations, overseen by the ATSB and other involved parties. The results were also analysed by manufacturers of the helicopter and engine, and other specialists. There was no evidence of a defect that could have led to sudden stoppage of the engine, of any critical component of the engine, fuel, or other helicopter system. Examination of the engine and fuel system found:

• no evidence of any issue with air intake to the engine or the exhaust system
• low static compression in one cylinder, but the actual compression was probably higher when the engine was running and warm, which was unlikely to have resulted in sudden in-flight complete or substantial power loss
• several valve clearances were out of service limits
• no evidence of any issue with the spark plugs, ignition leads or magnetos
• no fuel remaining in the system other than the main fuel tank, no evidence of fuel contamination with debris, water, or wrong fuel, no defects in the fuel system and no condition likely to prevent usable fuel reaching the engine.

The out‑of‑limit valve clearances and low cylinder compression probably reduced the power that the engine was able to produce. However, the accident was not consistent with insufficient power available to lift the sling person, as the maximum power required would have occurred during the lift and before forward speed (consistent with the accident trail) was achieved. The ATSB assessed VH-IDW for all the possible reasons for an engine problem listed by the engine and helicopter manufacturer. The aircraft, engine and fuel system examinations did not identify any failure or condition, other than an absence of fuel throughout the system, that would likely result in sudden complete or substantial engine power loss.

Fuel exhaustion

The helicopter had not been shut down between when it was started before 0700 and last seen at a clearing near King River at about 0855. No recorded data was available to indicate the helicopter’s movements after 0900, including at the time of accident. However, the egg collector’s phone was momentarily in range of the nearest phone tower at 0858 and the accident pilot’s phone was not. As mobile phone reception was only in range when about 300 ft above the accident site, this may indicate that the egg collector was briefly airborne in the helicopter at that time.

As described above, the accident occurred between the clearing and VH-IDW’s first target nest, and no eggs had been collected. Additionally, no communication had been made with VH-IDW since about 0900, and it was considered unusual for the crew not to communicate for over an hour.

The operator reported VH-IDW’s normal fuel flow was 65–70 L/h, equating to a fuel endurance between 2 hours 31 minutes and 2 hours 42 minutes. Had the helicopter not been refuelled since 0658 at Noonamah, the helicopter would have exhausted usable fuel between 0929 and 0940. Furthermore, if the helicopter had been refuelled the previous evening and then travelled for about 23 minutes to Noonamah, and was not fuelled prior to the start of the accident day, fuel exhaustion was possible from 0904. Low cylinder compression evident in the No. 6 cylinder at engine examination, and high power settings, as evident in the in-flight photo, increase fuel consumption. Fuel exhaustion was therefore possible earlier than 0929. This was consistent with the search pilot’s estimation that the accident occurred at about 0922, when they were on the ground and out of communication range, and other crew heard a static radio transmission that may have been from VH-IDW.  

The helicopter’s hour meter read 2070.05 at the accident site and the maintenance release recorded 2067.6 at the end of the previous day. This indicated the helicopter had a flight time of 2.45 hours (not including time on the ground), which would also support fuel exhaustion. However, this was considered unreliable evidence as the pilot reported that the hour meter was never running when they operated VH-IDW, in which case the maintenance release did not reflect actual hours flown. 

In summary, considering the:

• likely lack of fuel on site, including in the helicopter tanks
• elapsed time since last probable refuelling
• timeframe in which the accident likely occurred
• the absence of any fault with the helicopter likely to result in sudden or substantial power loss

fuel exhaustion was assessed as the probable reason for engine stoppage.

Release of sling person and helicopter terrain impact

There was no evidence of a failure of the hooks system or sling equipment. The pilot reported that they always checked both quick release systems were functional before slinging. Had the experienced egg collector not attached themselves correctly, it was unlikely the pilot would have been able to lift them into the air attached to the helicopter and traverse above trees before they were released. By design and certification, inadvertent release of the hooks by the pilot was extremely improbable. Furthermore, inadvertent release of the egg collector would not have resulted in the subsequent helicopter ground collision without an additional failure/malfunction or mishandling. Therefore, the pilot almost certainly released the sling person, consistent with their stated procedure in the event of an engine failure or malfunction in the vicinity of trees.

Due to a lack of recorded data or recollection from the pilot, an assessment could not be made of the height and speed of the helicopter when the engine stopped or the egg collector was released. The trees between where the helicopter probably took off and the vicinity of the accident site were between 12–15 m tall, with taller trees up to 18 m tall closer to the crocodile nest site. The pilot’s reported procedure was to remain within about 5 m above the vegetation and therefore, if following their stated practice, the egg collector was likely about 20 m above the ground when the power loss occurred. Considering the length of the sling line, that would have positioned the helicopter about 50 m (164 ft) above the ground.

To estimate the height from which the egg collector was released, their injuries were assessed by a forensic pathologist using survivability research into falls from heights. Based on the injuries sustained, the pathologist assessed that the egg collector likely fell from at least 5 m above the ground. Additional research reviewed by the ATSB that considered how specific injuries varied with height indicated a likelihood that the egg collector was released from above 9 m, from which most falls are fatal.

Based on the pilot’s reported normal practice to minimise height and speed while slinging, the helicopter was likely operating within the ‘avoid’ area of the helicopter’s height-velocity graph. In that area, the combination of height and airspeed was such that a pilot may have been unable to complete an autorotation landing without damage. This was consistent with the low rotor energy and crushing of the fuselage evident in the damage sustained by VH-IDW.

The helicopter’s vertical descent through at least the last 8 m (24 ft), which was the height of the tree that the main rotor blade struck 3 times, was consistent with an attempt to avoid the obstacles ahead (due to densely growing tall trees) relative to the direction of travel.  

Helibrook safety management

Helibrook had introduced a CASA-accepted safety management system (SMS) in conjunction with CASA’s approval of the Helibrook chief pilot. This included purchase of a third‑party produced SMS manual and assigning the operations manager to also perform the safety manager role. The SMS manual stated that through the SMS, Helibrook would identify hazards and risks, with the goals of minimising risk, maintaining the health of stakeholders, and continually improving safety.

An assessment of the operator’s SMS following the accident quickly identified that in the 2 years since its approval, Helibrook had not implemented the system described in the SMS manual. Time or resources had not been allocated to safety management tasks, and the safety manager’s priority had been to fulfill their other role as operations manager. There was no evidence of a maturing safety culture, in which effective hazard identification enabled actions to proactively manage risks and prevent accidents. No formal, documented risk assessment had been conducted for any of Helibrook’s approved activities, including human external cargo (HEC) operations. As an operator conducting a specialised high-risk activity, application of the SMS would have assisted the identification of hazards and risk controls to reduce the risk of harm to operating crew.

CASA’s approval to conduct HEC operations required the pilot and egg collector to assess that the risk of heat illness and crocodile attack outweighed the risks of slinging. A structured risk process would have provided a means for this assessment to be made as well as identifying occasions when slinging was unacceptably risky. The same process should also have identified mitigations to reduce the:

• likelihood of an emergency event occurring, such as:
  • good maintenance practices and adherence to operating limitations to ensure ongoing helicopter airworthiness
  • ensuring that required pilot briefing and training in HEC operations were conducted, including fuel management
• consequences of an in-flight emergency, such as height and speed limits for carrying the sling person, and fitting the helicopter with an emergency locator transmitter.  

In not using their SMS, Helibrook did not identify the risks associated with conducting human external cargo operations, particularly the carriage of the egg collectors at non‑survivable fall heights, and ensure they were adequately managed.

The Civil Aviation Safety Authority’s approval process

Approval process

Picking up and carrying a person outside a helicopter was not permitted without specific authorisation. CASA could only grant such an authorisation, if doing so would be unlikely to have an adverse effect on safety. To ensure safety was preserved, CASA could impose conditions set out in an authorisation instrument.

Guidance was available for the administrative side of processing a request for an authorisation. However, there were no guidance or tools for conducting the safety assessment to determine whether an authorisation and its conditions assured the preservation of safety. Flight operations considerations for approving an aerial work activity were detailed in the Air Operator’s Certificate (AOC) Handbook, but this did not include the management of risk. The AOC handbook also contained safety management and risk assessment guidance for assessing an AOC holder's SMS, but the CASA delegates contacted by the ATSB as part of this investigation did not consider this relevant to the instrument approval process.

The first approval instrument to conduct HEC operations for the purpose of crocodile egg collection was reported to have been issued in 2007, and subsequently reissued generally on an annual basis. CASA was unable to locate records of instruments issued before 2010, any assessment as to whether the authorisation was likely to adversely affect safety, or how the imposed conditions mitigated the risks. The first instrument obtained by the ATSB was for 2010 and listed 20 conditions. These included a requirement that hooks were fitted to the helicopter under an appropriate design approval and limitations to the height, speed and distance the sling person could be carried.

The CASA delegates who issued authorisation instruments for R44 HEC for crocodile egg collection from 2013–2021 incorrectly assumed a risk assessment had been performed when the first instrument was issued. The delegates also assumed previous approvals meant that the risks of HEC operations had been assessed as acceptable by CASA, and that the conditions included in the instrument mitigated the risks. However, none of the delegates had sighted a risk assessment for the activity, nor did they conduct one, including when changing or removing instrument conditions. Additionally, although the instrument only permitted operators to conduct HEC if there was an overall safety advantage in reducing the risk of crocodile attack and heat illness, CASA did not ensure that the operators had a process for assessing the relative risks.

In the absence of a formal risk assessment process, delegates based their approval of the activity and the imposed conditions on the advice of CASA flight operations and airworthiness inspectors, and a reasonableness test. Additionally, delegates considered the instruments were reissues of an existing approval even when removing or amending conditions. Therefore, if there were no changes to procedures and no accidents, they assessed that there was no reason not to issue an authorisation, as the level of safety was considered not to have changed.

A draft HEC in piston engine rotorcraft risk management plan (RMP) using a CASA general aviation template was prepared by CASA Flight Standards Branch personnel and presented to CASA executive in 2013. The RMP and associated template was a formal risk assessment tool. The RMP assessed that HEC operations in single engine piston (R44) and turbine helicopters was an unacceptable risk without mitigations to improve helicopter reliability, and speed, height and duration limitations for carrying the HEC.

The RMP formed the basis of CASA’s proposed standard to cease issuing approvals for HEC with the R44 and to require a single engine turbine helicopter with a usage monitoring system. This was due to the associated higher risk of in-flight power loss and additional failure modes of an R44. The turbine engine requirement aligned with US and European regulations and was to be included as an amendment to Civil Aviation Order 29.6. That amendment was abandoned in 2016, due to planned implementation in 2018 of the same ruleset incorporated in Civil Aviation Safety Regulations Part 138. However, regulatory change took longer than anticipated, and Part 138 was implemented in December 2021. None of the delegates involved in approving instruments after 2013 reported having seen the RMP.

As the instrument conditions were described as risk mitigations, a formal risk assessment would have enabled delegates to quantify the change in overall risk associated with changes to, or removal of, conditions. Without a formal risk management process, CASA delegates were unable to show in a structured way that an authorisation did not adversely affect safety or that the conditions included in an authorisation were sufficient to achieve the required level of safety.

Influence on human external cargo risks

Once the hooks met the required certification standard, failure of the hooks was extremely improbable. As a result, CASA approved amendments to the rotorcraft flight manual supplement associated with the dual hooks. These included the removal of limits for the height and distance a sling person could be carried and an increase of the maximum slinging speed to 60 kt. However, this did not consider circumstances that could result in release of the sling person, other than failure of the hooks.

CASA delegates then removed the HEC limitations from CASA’s instrument conditions. It is unclear why these conditions were removed. However, as a formal risk assessment was not performed it was not identified that there were other failure conditions likely to result in release of the sling person and that the removal of height and speed limits for carrying the sling person significantly increased the overall risk.  

Falls from greater than 5 m above the ground are more likely to result in a fatality. CASA’s removal of those limitations meant that an operator could both operate within an authorisation instrument’s conditions and permit an avoidable fatal outcome for a sling person in the event of an emergency release, such as occurred during this accident.

Continued unmitigated operational risk

As CASA delegates had not formally assessed the operational risk of using an R44 helicopter they continued to approve R44 HEC for crocodile egg collection without assurance that aviation safety was preserved. Although CASA’s RMP assessed that a single turbine engine helicopter with a usage monitoring system had a higher reliability and less likelihood of engine failure than an R44 helicopter, it did not consider or compare the hazard of fuel exhaustion.

Having formally assessed the risks for the RMP in 2013, the following year, CASA Flight Standards Branch personnel engaged with operators who conducted HEC for crocodile egg collection and advised of CASA’s intent to require a turbine helicopter with a usage monitoring system for improved helicopter reliability. CASA personnel then drafted the relevant legislation and engaged with the industry before it was finalised. Although operators had been notified and engaged during the rulemaking process, shortly prior to commencement of the regulations in 2021, a CASA delegate issued Helibrook with a 3-year instrument approving continued use of an R44 helicopter for human slinging operations. This resulted in continuation of what CASA had assessed as an unacceptable ongoing risk.

There was insufficient data available of helicopter fuel exhaustion accidents to indicate an increased risk in piston engine helicopters compared with turbine engine helicopters. There was also insufficient evidence from which to assess the difference in outcome between an autorotation in a single engine turbine helicopter and in an R44. Single engine turbine helicopters, with a higher inertia rotor than the R44, may provide more opportunity to place the sling person on the ground, as occurred in a Bell 407 accident in the US in 2022, and reduce the consequences for the pilot in an autorotative landing. However, operating in any helicopter's height-velocity avoid area does not ensure a safe landing can be made.

Without adequate height and speed limitations to protect the sling person, there is no evidence that the use of a single turbine engine helicopter would have altered the outcome in this accident.

Engine defects

The low compression in one cylinder and valve clearances out of service limits increased the likelihood that the engine's maximum power output was reduced. Although the engine was derated, to counter the reduction in performance at higher density altitudes, the defects increased the risk of having insufficient performance for the helicopter to hover out of ground effect, essential to conduct slinging operations.

The higher-than normal fuel flow for slinging operations was unlikely to have affected the pilot’s assessment of fuel endurance. This was because the pilot had conducted slinging in VH-IDW the day prior to the accident and the fuel flow would unlikely have changed since then. The in-flight photo taken on the accident morning showed the helicopter operating above the manifold pressure limit at the time, which may have been symptomatic of reduced engine performance.

The approval to conduct HEC operations required that the engine was capable of making maximum rated power and able to hover out of ground effect 3,000 ft above the ground. Poor engine condition increased the likelihood of insufficient power available to conduct safe slinging operations and of an in-flight failure. However, there was no evidence of any failure or condition that would have suddenly stopped or significantly reduced engine power.

Helicopter hours overrun

Accurate recording of time in service is required to ensure helicopter components are inspected, overhauled or replaced within life limits. Exceeding the life limits increases the probability of component failure and renders the helicopter unairworthy.

VH-IDW was to be maintained in accordance with the airframe and engine manufacturers’ maintenance schedule, which required a periodic inspection every 100 hours or 12 months, whichever occurred sooner, and was subject to overhaul at 2,200 hours or 12 years, whichever occurred first. Based on a review of VH-IDW’s maintenance releases, at the periodic inspections, the helicopter’s hour meter matched the time in service recorded on the maintenance release.

Based on the hour meter reading at the accident site, VH-IDW had about 192 hours until overhaul. The ATSB found the hour meter connected, but one of the 2 connections was only finger tight, consistent with having been connected by hand. Additionally, the hour meter had almost certainly been disconnected for periods, resulting in under-recording of the hours in operation. Based on a comparison of the hours recorded on VH-IDW’s maintenance releases with hours recorded in spreadsheets and on the pilot’s phone, it was likely the helicopter had been overrunning the 100-hour maintenance intervals and had exceeded its overhaul life. This was also supported by a CASA airworthiness inspector’s review of maintenance records, which identified the engine-driven fuel pump being replaced at decreasing recorded hourly intervals, as VH-IDW approached its end of overhaul life and while being operated by Helibrook.

In-use hours for the hooks were independent from total helicopter hours but were also not being recorded. Additionally, one hook was overdue for overhaul based on calendar time and the hooks had not been maintained as required, but there was no evidence these had failed.

Although overrunning maintenance, inspection and overhaul periods increased the likelihood of component failure, there was no evidence of an engine, airframe or hook component failure that resulted in the engine stoppage, helicopter accident or increased severity of injuries or damage. Despite that, while operating in the height-velocity avoid area, a successful autorotation was not guaranteed. Therefore, high reliability of the helicopter and systems was necessary to mitigate the risks to the pilot and the sling person. In stopping the hour meter and exceeding maintenance, inspection and overhaul limits, the operator increased the likelihood of a catastrophic component failure of the helicopter. This posed an unnecessary increase in risk for the pilot and particularly sling crew conducting HEC operations.

Cocaine metabolites

Cocaine is an illicit drug and can have deleterious effects on pilot performance. Possible effects include risk-taking, inattentiveness and poor impulse control. Although the pilot reported that they did not use cocaine, very low levels of cocaine metabolites were found in the pilot’s toxicology results.

On the basis that the metabolites indicate exposure to cocaine, the detected levels indicated the pilot had not been exposed to cocaine within the previous 24 hours and may not have been affected by cocaine on the accident day. There was insufficient evidence to enable an assessment of whether the drug contributed to the development of the accident. However, the indication of exposure to cocaine is highlighted, as the effects of cocaine and post-cocaine exposure clearly increase risk to aviation activities. The post-cocaine exposure effects can include fatigue, depression and inattention.

Emergency locator transmitter

The helicopter's emergency locator transmitter was not mounted and did not activate in the accident impact. Although the actual time of the accident could not be established, there is a high likelihood that it was a significant time before the helicopter was located. Therefore, had the emergency locator transmitter been fitted and activated on impact, emergency medical care may have arrived sooner.

Immediate notification to rescue medical services can have a significant effect on the outcome for occupants of a serious aircraft accident. Although prompt medical attention would not have altered the outcome for the egg collector, the pilot’s condition likely worsened over time since the accident. The actions of the individual to search for VH‑IDW and alert emergency services contributed to the pilot’s survival, but more timely initiation of medical assistance would have reduced the risks of exacerbating the pilot’s injuries and deterioration of their condition.